* [PATCH 4.6 02/96] x86/quirks: Apply nvidia_bugs quirk only on root bus
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 03/96] x86/quirks: Reintroduce scanning of secondary buses Greg Kroah-Hartman
` (90 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Andy Lutomirski,
Bjorn Helgaas, Borislav Petkov, Brian Gerst, Denys Vlasenko,
H. Peter Anvin, Josh Poimboeuf, Linus Torvalds, Peter Zijlstra,
Thomas Gleixner, Yinghai Lu, Ingo Molnar
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
commit 447d29d1d3aed839e74c2401ef63387780ac51ed upstream.
Since the following commit:
8659c406ade3 ("x86: only scan the root bus in early PCI quirks")
... early quirks are only applied to devices on the root bus.
The motivation was to prevent application of the nvidia_bugs quirk on
secondary buses.
We're about to reintroduce scanning of secondary buses for a quirk to
reset the Broadcom 4331 wireless card on 2011/2012 Macs. To prevent
regressions, open code the requirement to apply nvidia_bugs only on the
root bus.
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Yinghai Lu <yinghai@kernel.org>
Link: http://lkml.kernel.org/r/4d5477c1d76b2f0387a780f2142bbcdd9fee869b.1465690253.git.lukas@wunner.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/early-quirks.c | 7 +++++++
1 file changed, 7 insertions(+)
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -76,6 +76,13 @@ static void __init nvidia_bugs(int num,
#ifdef CONFIG_ACPI
#ifdef CONFIG_X86_IO_APIC
/*
+ * Only applies to Nvidia root ports (bus 0) and not to
+ * Nvidia graphics cards with PCI ports on secondary buses.
+ */
+ if (num)
+ return;
+
+ /*
* All timer overrides on Nvidia are
* wrong unless HPET is enabled.
* Unfortunately that's not true on many Asus boards.
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 03/96] x86/quirks: Reintroduce scanning of secondary buses
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 02/96] x86/quirks: Apply nvidia_bugs quirk only on root bus Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 04/96] x86/quirks: Add early quirk to reset Apple AirPort card Greg Kroah-Hartman
` (89 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Andy Lutomirski,
Bjorn Helgaas, Borislav Petkov, Brian Gerst, Denys Vlasenko,
H. Peter Anvin, Josh Poimboeuf, Linus Torvalds, Peter Zijlstra,
Thomas Gleixner, Yinghai Lu, linux-pci, Ingo Molnar
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
commit 850c321027c2e31d0afc71588974719a4b565550 upstream.
We used to scan secondary buses until the following commit that
was applied in 2009:
8659c406ade3 ("x86: only scan the root bus in early PCI quirks")
which commit constrained early quirks to the root bus only. Its
motivation was to prevent application of the nvidia_bugs quirk
on secondary buses.
We're about to add a quirk to reset the Broadcom 4331 wireless card on
2011/2012 Macs, which is located on a secondary bus behind a PCIe root
port. To facilitate that, reintroduce scanning of secondary buses.
The commit message of 8659c406ade3 notes that scanning only the root bus
"saves quite some unnecessary scanning work". The algorithm used prior
to 8659c406ade3 was particularly time consuming because it scanned
buses 0 to 31 brute force. To avoid lengthening boot time, employ a
recursive strategy which only scans buses that are actually reachable
from the root bus.
Yinghai Lu pointed out that the secondary bus number read from a
bridge's config space may be invalid, in particular a value of 0 would
cause an infinite loop. The PCI core goes beyond that and recurses to a
child bus only if its bus number is greater than the parent bus number
(see pci_scan_bridge()). Since the root bus is numbered 0, this implies
that secondary buses may not be 0. Do the same on early scanning.
If this algorithm is found to significantly impact boot time or cause
infinite loops on broken hardware, it would be possible to limit its
recursion depth: The Broadcom 4331 quirk applies at depth 1, all others
at depth 0, so the bus need not be scanned deeper than that for now. An
alternative approach would be to revert to scanning only the root bus,
and apply the Broadcom 4331 quirk to the root ports 8086:1c12, 8086:1e12
and 8086:1e16. Apple always positioned the card behind either of these
three ports. The quirk would then check presence of the card in slot 0
below the root port and do its deed.
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: linux-pci@vger.kernel.org
Link: http://lkml.kernel.org/r/f0daa70dac1a9b2483abdb31887173eb6ab77bdf.1465690253.git.lukas@wunner.de
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/early-quirks.c | 34 +++++++++++++++++++++-------------
1 file changed, 21 insertions(+), 13 deletions(-)
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -610,12 +610,6 @@ struct chipset {
void (*f)(int num, int slot, int func);
};
-/*
- * Only works for devices on the root bus. If you add any devices
- * not on bus 0 readd another loop level in early_quirks(). But
- * be careful because at least the Nvidia quirk here relies on
- * only matching on bus 0.
- */
static struct chipset early_qrk[] __initdata = {
{ PCI_VENDOR_ID_NVIDIA, PCI_ANY_ID,
PCI_CLASS_BRIDGE_PCI, PCI_ANY_ID, QFLAG_APPLY_ONCE, nvidia_bugs },
@@ -648,6 +642,8 @@ static struct chipset early_qrk[] __init
{}
};
+static void __init early_pci_scan_bus(int bus);
+
/**
* check_dev_quirk - apply early quirks to a given PCI device
* @num: bus number
@@ -656,7 +652,7 @@ static struct chipset early_qrk[] __init
*
* Check the vendor & device ID against the early quirks table.
*
- * If the device is single function, let early_quirks() know so we don't
+ * If the device is single function, let early_pci_scan_bus() know so we don't
* poke at this device again.
*/
static int __init check_dev_quirk(int num, int slot, int func)
@@ -665,6 +661,7 @@ static int __init check_dev_quirk(int nu
u16 vendor;
u16 device;
u8 type;
+ u8 sec;
int i;
class = read_pci_config_16(num, slot, func, PCI_CLASS_DEVICE);
@@ -692,25 +689,36 @@ static int __init check_dev_quirk(int nu
type = read_pci_config_byte(num, slot, func,
PCI_HEADER_TYPE);
+
+ if ((type & 0x7f) == PCI_HEADER_TYPE_BRIDGE) {
+ sec = read_pci_config_byte(num, slot, func, PCI_SECONDARY_BUS);
+ if (sec > num)
+ early_pci_scan_bus(sec);
+ }
+
if (!(type & 0x80))
return -1;
return 0;
}
-void __init early_quirks(void)
+static void __init early_pci_scan_bus(int bus)
{
int slot, func;
- if (!early_pci_allowed())
- return;
-
/* Poor man's PCI discovery */
- /* Only scan the root bus */
for (slot = 0; slot < 32; slot++)
for (func = 0; func < 8; func++) {
/* Only probe function 0 on single fn devices */
- if (check_dev_quirk(0, slot, func))
+ if (check_dev_quirk(bus, slot, func))
break;
}
}
+
+void __init early_quirks(void)
+{
+ if (!early_pci_allowed())
+ return;
+
+ early_pci_scan_bus(0);
+}
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 04/96] x86/quirks: Add early quirk to reset Apple AirPort card
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 02/96] x86/quirks: Apply nvidia_bugs quirk only on root bus Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 03/96] x86/quirks: Reintroduce scanning of secondary buses Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 05/96] dmaengine: at_xdmac: align descriptors on 64 bits Greg Kroah-Hartman
` (88 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: b43-dev
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukas Wunner <lukas@wunner.de>
commit abb2bafd295fe962bbadc329dbfb2146457283ac upstream.
The EFI firmware on Macs contains a full-fledged network stack for
downloading OS X images from osrecovery.apple.com. Unfortunately
on Macs introduced 2011 and 2012, EFI brings up the Broadcom 4331
wireless card on every boot and leaves it enabled even after
ExitBootServices has been called. The card continues to assert its IRQ
line, causing spurious interrupts if the IRQ is shared. It also corrupts
memory by DMAing received packets, allowing for remote code execution
over the air. This only stops when a driver is loaded for the wireless
card, which may be never if the driver is not installed or blacklisted.
The issue seems to be constrained to the Broadcom 4331. Chris Milsted
has verified that the newer Broadcom 4360 built into the MacBookPro11,3
(2013/2014) does not exhibit this behaviour. The chances that Apple will
ever supply a firmware fix for the older machines appear to be zero.
The solution is to reset the card on boot by writing to a reset bit in
its mmio space. This must be done as an early quirk and not as a plain
vanilla PCI quirk to successfully combat memory corruption by DMAed
packets: Matthew Garrett found out in 2012 that the packets are written
to EfiBootServicesData memory (http://mjg59.dreamwidth.org/11235.html).
This type of memory is made available to the page allocator by
efi_free_boot_services(). Plain vanilla PCI quirks run much later, in
subsys initcall level. In-between a time window would be open for memory
corruption. Random crashes occurring in this time window and attributed
to DMAed packets have indeed been observed in the wild by Chris
Bainbridge.
When Matthew Garrett analyzed the memory corruption issue in 2012, he
sought to fix it with a grub quirk which transitions the card to D3hot:
http://git.savannah.gnu.org/cgit/grub.git/commit/?id=9d34bb85da56
This approach does not help users with other bootloaders and while it
may prevent DMAed packets, it does not cure the spurious interrupts
emanating from the card. Unfortunately the card's mmio space is
inaccessible in D3hot, so to reset it, we have to undo the effect of
Matthew's grub patch and transition the card back to D0.
Note that the quirk takes a few shortcuts to reduce the amount of code:
The size of BAR 0 and the location of the PM capability is identical
on all affected machines and therefore hardcoded. Only the address of
BAR 0 differs between models. Also, it is assumed that the BCMA core
currently mapped is the 802.11 core. The EFI driver seems to always take
care of this.
Michael B?sch, Bjorn Helgaas and Matt Fleming contributed feedback
towards finding the best solution to this problem.
The following should be a comprehensive list of affected models:
iMac13,1 2012 21.5" [Root Port 00:1c.3 = 8086:1e16]
iMac13,2 2012 27" [Root Port 00:1c.3 = 8086:1e16]
Macmini5,1 2011 i5 2.3 GHz [Root Port 00:1c.1 = 8086:1c12]
Macmini5,2 2011 i5 2.5 GHz [Root Port 00:1c.1 = 8086:1c12]
Macmini5,3 2011 i7 2.0 GHz [Root Port 00:1c.1 = 8086:1c12]
Macmini6,1 2012 i5 2.5 GHz [Root Port 00:1c.1 = 8086:1e12]
Macmini6,2 2012 i7 2.3 GHz [Root Port 00:1c.1 = 8086:1e12]
MacBookPro8,1 2011 13" [Root Port 00:1c.1 = 8086:1c12]
MacBookPro8,2 2011 15" [Root Port 00:1c.1 = 8086:1c12]
MacBookPro8,3 2011 17" [Root Port 00:1c.1 = 8086:1c12]
MacBookPro9,1 2012 15" [Root Port 00:1c.1 = 8086:1e12]
MacBookPro9,2 2012 13" [Root Port 00:1c.1 = 8086:1e12]
MacBookPro10,1 2012 15" [Root Port 00:1c.1 = 8086:1e12]
MacBookPro10,2 2012 13" [Root Port 00:1c.1 = 8086:1e12]
For posterity, spurious interrupts caused by the Broadcom 4331 wireless
card resulted in splats like this (stacktrace omitted):
irq 17: nobody cared (try booting with the "irqpoll" option)
handlers:
[<ffffffff81374370>] pcie_isr
[<ffffffffc0704550>] sdhci_irq [sdhci] threaded [<ffffffffc07013c0>] sdhci_thread_irq [sdhci]
[<ffffffffc0a0b960>] azx_interrupt [snd_hda_codec]
Disabling IRQ #17
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=79301
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=111781
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=728916
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=895951#c16
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1009819
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1098621
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1149632#c5
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1279130
Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=1332732
Tested-by: Konstantin Simanov <k.simanov@stlk.ru> # [MacBookPro8,1]
Tested-by: Lukas Wunner <lukas@wunner.de> # [MacBookPro9,1]
Tested-by: Bryan Paradis <bryan.paradis@gmail.com> # [MacBookPro9,2]
Tested-by: Andrew Worsley <amworsley@gmail.com> # [MacBookPro10,1]
Tested-by: Chris Bainbridge <chris.bainbridge@gmail.com> # [MacBookPro10,2]
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Acked-by: Rafa? Mi?ecki <zajec5@gmail.com>
Acked-by: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Bjorn Helgaas <bhelgaas@google.com>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Brian Gerst <brgerst@gmail.com>
Cc: Chris Milsted <cmilsted@redhat.com>
Cc: Denys Vlasenko <dvlasenk@redhat.com>
Cc: H. Peter Anvin <hpa@zytor.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Matthew Garrett <mjg59@srcf.ucam.org>
Cc: Michael Buesch <m@bues.ch>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Yinghai Lu <yinghai@kernel.org>
Cc: b43-dev at lists.infradead.org
Cc: linux-pci at vger.kernel.org
Cc: linux-wireless at vger.kernel.org
Link: http://lkml.kernel.org/r/48d0972ac82a53d460e5fce77a07b2560db95203.1465690253.git.lukas at wunner.de
[ Did minor readability edits. ]
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/kernel/early-quirks.c | 64 +++++++++++++++++++++++++++++++++++++++++
drivers/bcma/bcma_private.h | 2 -
include/linux/bcma/bcma.h | 1
3 files changed, 65 insertions(+), 2 deletions(-)
--- a/arch/x86/kernel/early-quirks.c
+++ b/arch/x86/kernel/early-quirks.c
@@ -11,7 +11,11 @@
#include <linux/pci.h>
#include <linux/acpi.h>
+#include <linux/delay.h>
+#include <linux/dmi.h>
#include <linux/pci_ids.h>
+#include <linux/bcma/bcma.h>
+#include <linux/bcma/bcma_regs.h>
#include <drm/i915_drm.h>
#include <asm/pci-direct.h>
#include <asm/dma.h>
@@ -21,6 +25,9 @@
#include <asm/iommu.h>
#include <asm/gart.h>
#include <asm/irq_remapping.h>
+#include <asm/early_ioremap.h>
+
+#define dev_err(msg) pr_err("pci 0000:%02x:%02x.%d: %s", bus, slot, func, msg)
static void __init fix_hypertransport_config(int num, int slot, int func)
{
@@ -597,6 +604,61 @@ static void __init force_disable_hpet(in
#endif
}
+#define BCM4331_MMIO_SIZE 16384
+#define BCM4331_PM_CAP 0x40
+#define bcma_aread32(reg) ioread32(mmio + 1 * BCMA_CORE_SIZE + reg)
+#define bcma_awrite32(reg, val) iowrite32(val, mmio + 1 * BCMA_CORE_SIZE + reg)
+
+static void __init apple_airport_reset(int bus, int slot, int func)
+{
+ void __iomem *mmio;
+ u16 pmcsr;
+ u64 addr;
+ int i;
+
+ if (!dmi_match(DMI_SYS_VENDOR, "Apple Inc."))
+ return;
+
+ /* Card may have been put into PCI_D3hot by grub quirk */
+ pmcsr = read_pci_config_16(bus, slot, func, BCM4331_PM_CAP + PCI_PM_CTRL);
+
+ if ((pmcsr & PCI_PM_CTRL_STATE_MASK) != PCI_D0) {
+ pmcsr &= ~PCI_PM_CTRL_STATE_MASK;
+ write_pci_config_16(bus, slot, func, BCM4331_PM_CAP + PCI_PM_CTRL, pmcsr);
+ mdelay(10);
+
+ pmcsr = read_pci_config_16(bus, slot, func, BCM4331_PM_CAP + PCI_PM_CTRL);
+ if ((pmcsr & PCI_PM_CTRL_STATE_MASK) != PCI_D0) {
+ dev_err("Cannot power up Apple AirPort card\n");
+ return;
+ }
+ }
+
+ addr = read_pci_config(bus, slot, func, PCI_BASE_ADDRESS_0);
+ addr |= (u64)read_pci_config(bus, slot, func, PCI_BASE_ADDRESS_1) << 32;
+ addr &= PCI_BASE_ADDRESS_MEM_MASK;
+
+ mmio = early_ioremap(addr, BCM4331_MMIO_SIZE);
+ if (!mmio) {
+ dev_err("Cannot iomap Apple AirPort card\n");
+ return;
+ }
+
+ pr_info("Resetting Apple AirPort card (left enabled by EFI)\n");
+
+ for (i = 0; bcma_aread32(BCMA_RESET_ST) && i < 30; i++)
+ udelay(10);
+
+ bcma_awrite32(BCMA_RESET_CTL, BCMA_RESET_CTL_RESET);
+ bcma_aread32(BCMA_RESET_CTL);
+ udelay(1);
+
+ bcma_awrite32(BCMA_RESET_CTL, 0);
+ bcma_aread32(BCMA_RESET_CTL);
+ udelay(10);
+
+ early_iounmap(mmio, BCM4331_MMIO_SIZE);
+}
#define QFLAG_APPLY_ONCE 0x1
#define QFLAG_APPLIED 0x2
@@ -639,6 +701,8 @@ static struct chipset early_qrk[] __init
*/
{ PCI_VENDOR_ID_INTEL, 0x0f00,
PCI_CLASS_BRIDGE_HOST, PCI_ANY_ID, 0, force_disable_hpet},
+ { PCI_VENDOR_ID_BROADCOM, 0x4331,
+ PCI_CLASS_NETWORK_OTHER, PCI_ANY_ID, 0, apple_airport_reset},
{}
};
--- a/drivers/bcma/bcma_private.h
+++ b/drivers/bcma/bcma_private.h
@@ -8,8 +8,6 @@
#include <linux/bcma/bcma.h>
#include <linux/delay.h>
-#define BCMA_CORE_SIZE 0x1000
-
#define bcma_err(bus, fmt, ...) \
pr_err("bus%d: " fmt, (bus)->num, ##__VA_ARGS__)
#define bcma_warn(bus, fmt, ...) \
--- a/include/linux/bcma/bcma.h
+++ b/include/linux/bcma/bcma.h
@@ -158,6 +158,7 @@ struct bcma_host_ops {
#define BCMA_CORE_DEFAULT 0xFFF
#define BCMA_MAX_NR_CORES 16
+#define BCMA_CORE_SIZE 0x1000
/* Chip IDs of PCIe devices */
#define BCMA_CHIP_ID_BCM4313 0x4313
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 05/96] dmaengine: at_xdmac: align descriptors on 64 bits
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (2 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 04/96] x86/quirks: Add early quirk to reset Apple AirPort card Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 06/96] dmaengine: at_xdmac: fix residue corruption Greg Kroah-Hartman
` (87 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ludovic Desroches, Nicolas Ferre, Vinod Koul
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludovic Desroches <ludovic.desroches@atmel.com>
commit 4a9723e8df68cfce4048517ee32e37f78854b6fb upstream.
Having descriptors aligned on 64 bits allows update CNDA and CUBC in an
atomic way.
Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel
eXtended DMA Controller driver")
Reviewed-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/at_xdmac.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -242,7 +242,7 @@ struct at_xdmac_lld {
u32 mbr_dus; /* Destination Microblock Stride Register */
};
-
+/* 64-bit alignment needed to update CNDA and CUBC registers in an atomic way. */
struct at_xdmac_desc {
struct at_xdmac_lld lld;
enum dma_transfer_direction direction;
@@ -253,7 +253,7 @@ struct at_xdmac_desc {
unsigned int xfer_size;
struct list_head descs_list;
struct list_head xfer_node;
-};
+} __aligned(sizeof(u64));
static inline void __iomem *at_xdmac_chan_reg_base(struct at_xdmac *atxdmac, unsigned int chan_nb)
{
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 06/96] dmaengine: at_xdmac: fix residue corruption
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (3 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 05/96] dmaengine: at_xdmac: align descriptors on 64 bits Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 07/96] dmaengine: at_xdmac: double FIFO flush needed to compute residue Greg Kroah-Hartman
` (86 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ludovic Desroches, Nicolas Ferre, Vinod Koul
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludovic Desroches <ludovic.desroches@atmel.com>
commit 53398f488821c2b5b15291e3debec6ad33f75d3d upstream.
An unexpected value of CUBC can lead to a corrupted residue. A more
complex sequence is needed to detect an inaccurate value for NCA or CUBC.
Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel
eXtended DMA Controller driver")
Reviewed-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/at_xdmac.c | 54 +++++++++++++++++++++++++++++--------------------
1 file changed, 32 insertions(+), 22 deletions(-)
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -1400,6 +1400,7 @@ at_xdmac_tx_status(struct dma_chan *chan
u32 cur_nda, check_nda, cur_ubc, mask, value;
u8 dwidth = 0;
unsigned long flags;
+ bool initd;
ret = dma_cookie_status(chan, cookie, txstate);
if (ret == DMA_COMPLETE)
@@ -1435,34 +1436,43 @@ at_xdmac_tx_status(struct dma_chan *chan
}
/*
- * When processing the residue, we need to read two registers but we
- * can't do it in an atomic way. AT_XDMAC_CNDA is used to find where
- * we stand in the descriptor list and AT_XDMAC_CUBC is used
- * to know how many data are remaining for the current descriptor.
- * Since the dma channel is not paused to not loose data, between the
- * AT_XDMAC_CNDA and AT_XDMAC_CUBC read, we may have change of
- * descriptor.
- * For that reason, after reading AT_XDMAC_CUBC, we check if we are
- * still using the same descriptor by reading a second time
- * AT_XDMAC_CNDA. If AT_XDMAC_CNDA has changed, it means we have to
- * read again AT_XDMAC_CUBC.
+ * The easiest way to compute the residue should be to pause the DMA
+ * but doing this can lead to miss some data as some devices don't
+ * have FIFO.
+ * We need to read several registers because:
+ * - DMA is running therefore a descriptor change is possible while
+ * reading these registers
+ * - When the block transfer is done, the value of the CUBC register
+ * is set to its initial value until the fetch of the next descriptor.
+ * This value will corrupt the residue calculation so we have to skip
+ * it.
+ *
+ * INITD -------- ------------
+ * |____________________|
+ * _______________________ _______________
+ * NDA @desc2 \/ @desc3
+ * _______________________/\_______________
+ * __________ ___________ _______________
+ * CUBC 0 \/ MAX desc1 \/ MAX desc2
+ * __________/\___________/\_______________
+ *
+ * Since descriptors are aligned on 64 bits, we can assume that
+ * the update of NDA and CUBC is atomic.
* Memory barriers are used to ensure the read order of the registers.
- * A max number of retries is set because unlikely it can never ends if
- * we are transferring a lot of data with small buffers.
+ * A max number of retries is set because unlikely it could never ends.
*/
- cur_nda = at_xdmac_chan_read(atchan, AT_XDMAC_CNDA) & 0xfffffffc;
- rmb();
- cur_ubc = at_xdmac_chan_read(atchan, AT_XDMAC_CUBC);
for (retry = 0; retry < AT_XDMAC_RESIDUE_MAX_RETRIES; retry++) {
- rmb();
check_nda = at_xdmac_chan_read(atchan, AT_XDMAC_CNDA) & 0xfffffffc;
-
- if (likely(cur_nda == check_nda))
- break;
-
- cur_nda = check_nda;
+ rmb();
+ initd = !!(at_xdmac_chan_read(atchan, AT_XDMAC_CC) & AT_XDMAC_CC_INITD);
rmb();
cur_ubc = at_xdmac_chan_read(atchan, AT_XDMAC_CUBC);
+ rmb();
+ cur_nda = at_xdmac_chan_read(atchan, AT_XDMAC_CNDA) & 0xfffffffc;
+ rmb();
+
+ if ((check_nda == cur_nda) && initd)
+ break;
}
if (unlikely(retry >= AT_XDMAC_RESIDUE_MAX_RETRIES)) {
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 07/96] dmaengine: at_xdmac: double FIFO flush needed to compute residue
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (4 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 06/96] dmaengine: at_xdmac: fix residue corruption Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 08/96] mm, sl[au]b: add __GFP_ATOMIC to the GFP reclaim mask Greg Kroah-Hartman
` (85 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ludovic Desroches, Nicolas Ferre, Vinod Koul
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ludovic Desroches <ludovic.desroches@atmel.com>
commit 9295c41d77ca93aac79cfca6fa09fa1ca5cab66f upstream.
Due to the way CUBC register is updated, a double flush is needed to
compute an accurate residue. First flush aim is to get data from the DMA
FIFO and second one ensures that we won't report data which are not in
memory.
Signed-off-by: Ludovic Desroches <ludovic.desroches@atmel.com>
Fixes: e1f7c9eee707 ("dmaengine: at_xdmac: creation of the atmel
eXtended DMA Controller driver")
Reviewed-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/dma/at_xdmac.c | 24 +++++++++++++++++++++++-
1 file changed, 23 insertions(+), 1 deletion(-)
--- a/drivers/dma/at_xdmac.c
+++ b/drivers/dma/at_xdmac.c
@@ -1425,7 +1425,16 @@ at_xdmac_tx_status(struct dma_chan *chan
residue = desc->xfer_size;
/*
* Flush FIFO: only relevant when the transfer is source peripheral
- * synchronized.
+ * synchronized. Flush is needed before reading CUBC because data in
+ * the FIFO are not reported by CUBC. Reporting a residue of the
+ * transfer length while we have data in FIFO can cause issue.
+ * Usecase: atmel USART has a timeout which means I have received
+ * characters but there is no more character received for a while. On
+ * timeout, it requests the residue. If the data are in the DMA FIFO,
+ * we will return a residue of the transfer length. It means no data
+ * received. If an application is waiting for these data, it will hang
+ * since we won't have another USART timeout without receiving new
+ * data.
*/
mask = AT_XDMAC_CC_TYPE | AT_XDMAC_CC_DSYNC;
value = AT_XDMAC_CC_TYPE_PER_TRAN | AT_XDMAC_CC_DSYNC_PER2MEM;
@@ -1481,6 +1490,19 @@ at_xdmac_tx_status(struct dma_chan *chan
}
/*
+ * Flush FIFO: only relevant when the transfer is source peripheral
+ * synchronized. Another flush is needed here because CUBC is updated
+ * when the controller sends the data write command. It can lead to
+ * report data that are not written in the memory or the device. The
+ * FIFO flush ensures that data are really written.
+ */
+ if ((desc->lld.mbr_cfg & mask) == value) {
+ at_xdmac_write(atxdmac, AT_XDMAC_GSWF, atchan->mask);
+ while (!(at_xdmac_chan_read(atchan, AT_XDMAC_CIS) & AT_XDMAC_CIS_FIS))
+ cpu_relax();
+ }
+
+ /*
* Remove size of all microblocks already transferred and the current
* one. Then add the remaining size to transfer of the current
* microblock.
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 08/96] mm, sl[au]b: add __GFP_ATOMIC to the GFP reclaim mask
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (5 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 07/96] dmaengine: at_xdmac: double FIFO flush needed to compute residue Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 09/96] memcg: mem_cgroup_migrate() may be called with irq disabled Greg Kroah-Hartman
` (84 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mel Gorman, Marcin Wojtas,
Vlastimil Babka, Michal Hocko, Andrew Morton, Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mel Gorman <mgorman@techsingularity.net>
commit e838a45f9392a5bd2be1cd3ab0b16ae85857461c upstream.
Commit d0164adc89f6 ("mm, page_alloc: distinguish between being unable
to sleep, unwilling to sleep and avoiding waking kswapd") modified
__GFP_WAIT to explicitly identify the difference between atomic callers
and those that were unwilling to sleep. Later the definition was
removed entirely.
The GFP_RECLAIM_MASK is the set of flags that affect watermark checking
and reclaim behaviour but __GFP_ATOMIC was never added. Without it,
atomic users of the slab allocator strip the __GFP_ATOMIC flag and
cannot access the page allocator atomic reserves. This patch addresses
the problem.
The user-visible impact depends on the workload but potentially atomic
allocations unnecessarily fail without this path.
Link: http://lkml.kernel.org/r/20160610093832.GK2527@techsingularity.net
Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
Reported-by: Marcin Wojtas <mw@semihalf.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/internal.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/mm/internal.h
+++ b/mm/internal.h
@@ -24,7 +24,8 @@
*/
#define GFP_RECLAIM_MASK (__GFP_RECLAIM|__GFP_HIGH|__GFP_IO|__GFP_FS|\
__GFP_NOWARN|__GFP_REPEAT|__GFP_NOFAIL|\
- __GFP_NORETRY|__GFP_MEMALLOC|__GFP_NOMEMALLOC)
+ __GFP_NORETRY|__GFP_MEMALLOC|__GFP_NOMEMALLOC|\
+ __GFP_ATOMIC)
/* The GFP flags allowed during early boot */
#define GFP_BOOT_MASK (__GFP_BITS_MASK & ~(__GFP_RECLAIM|__GFP_IO|__GFP_FS))
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 09/96] memcg: mem_cgroup_migrate() may be called with irq disabled
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (6 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 08/96] mm, sl[au]b: add __GFP_ATOMIC to the GFP reclaim mask Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 10/96] memcg: css_alloc should return an ERR_PTR value on error Greg Kroah-Hartman
` (83 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tejun Heo, Christian Borntraeger,
Johannes Weiner, Michal Hocko, Vladimir Davydov, Andrew Morton,
Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit d93c4130a7d049b234b5d5a15808eaf5406f2789 upstream.
mem_cgroup_migrate() uses local_irq_disable/enable() but can be called
with irq disabled from migrate_page_copy(). This ends up enabling irq
while holding a irq context lock triggering the following lockdep
warning. Fix it by using irq_save/restore instead.
=================================
[ INFO: inconsistent lock state ]
4.7.0-rc1+ #52 Tainted: G W
---------------------------------
inconsistent {IN-SOFTIRQ-W} -> {SOFTIRQ-ON-W} usage.
kcompactd0/151 [HC0[0]:SC0[0]:HE1:SE1] takes:
(&(&ctx->completion_lock)->rlock){+.?.-.}, at: [<000000000038fd96>] aio_migratepage+0x156/0x1e8
{IN-SOFTIRQ-W} state was registered at:
__lock_acquire+0x5b6/0x1930
lock_acquire+0xee/0x270
_raw_spin_lock_irqsave+0x66/0xb0
aio_complete+0x98/0x328
dio_complete+0xe4/0x1e0
blk_update_request+0xd4/0x450
scsi_end_request+0x48/0x1c8
scsi_io_completion+0x272/0x698
blk_done_softirq+0xca/0xe8
__do_softirq+0xc8/0x518
irq_exit+0xee/0x110
do_IRQ+0x6a/0x88
io_int_handler+0x11a/0x25c
__mutex_unlock_slowpath+0x144/0x1d8
__mutex_unlock_slowpath+0x140/0x1d8
kernfs_iop_permission+0x64/0x80
__inode_permission+0x9e/0xf0
link_path_walk+0x6e/0x510
path_lookupat+0xc4/0x1a8
filename_lookup+0x9c/0x160
user_path_at_empty+0x5c/0x70
SyS_readlinkat+0x68/0x140
system_call+0xd6/0x270
irq event stamp: 971410
hardirqs last enabled at (971409): migrate_page_move_mapping+0x3ea/0x588
hardirqs last disabled at (971410): _raw_spin_lock_irqsave+0x3c/0xb0
softirqs last enabled at (970526): __do_softirq+0x460/0x518
softirqs last disabled at (970519): irq_exit+0xee/0x110
other info that might help us debug this:
Possible unsafe locking scenario:
CPU0
----
lock(&(&ctx->completion_lock)->rlock);
<Interrupt>
lock(&(&ctx->completion_lock)->rlock);
*** DEADLOCK ***
3 locks held by kcompactd0/151:
#0: (&(&mapping->private_lock)->rlock){+.+.-.}, at: aio_migratepage+0x42/0x1e8
#1: (&ctx->ring_lock){+.+.+.}, at: aio_migratepage+0x5a/0x1e8
#2: (&(&ctx->completion_lock)->rlock){+.?.-.}, at: aio_migratepage+0x156/0x1e8
stack backtrace:
CPU: 20 PID: 151 Comm: kcompactd0 Tainted: G W 4.7.0-rc1+ #52
Call Trace:
show_trace+0xea/0xf0
show_stack+0x72/0xf0
dump_stack+0x9a/0xd8
print_usage_bug.part.27+0x2d4/0x2e8
mark_lock+0x17e/0x758
mark_held_locks+0xa2/0xd0
trace_hardirqs_on_caller+0x140/0x1c0
mem_cgroup_migrate+0x266/0x370
aio_migratepage+0x16a/0x1e8
move_to_new_page+0xb0/0x260
migrate_pages+0x8f4/0x9f0
compact_zone+0x4dc/0xdc8
kcompactd_do_work+0x1aa/0x358
kcompactd+0xba/0x2c8
kthread+0x10a/0x110
kernel_thread_starter+0x6/0xc
kernel_thread_starter+0x0/0xc
INFO: lockdep is turned off.
Link: http://lkml.kernel.org/r/20160620184158.GO3262@mtj.duckdns.org
Link: http://lkml.kernel.org/g/5767CFE5.7080904@de.ibm.com
Fixes: 74485cf2bc85 ("mm: migrate: consolidate mem_cgroup_migrate() calls")
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Christian Borntraeger <borntraeger@de.ibm.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: Vladimir Davydov <vdavydov@virtuozzo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memcontrol.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -5524,6 +5524,7 @@ void mem_cgroup_migrate(struct page *old
struct mem_cgroup *memcg;
unsigned int nr_pages;
bool compound;
+ unsigned long flags;
VM_BUG_ON_PAGE(!PageLocked(oldpage), oldpage);
VM_BUG_ON_PAGE(!PageLocked(newpage), newpage);
@@ -5554,10 +5555,10 @@ void mem_cgroup_migrate(struct page *old
commit_charge(newpage, memcg, false);
- local_irq_disable();
+ local_irq_save(flags);
mem_cgroup_charge_statistics(memcg, newpage, compound, nr_pages);
memcg_check_events(memcg, newpage);
- local_irq_enable();
+ local_irq_restore(flags);
}
DEFINE_STATIC_KEY_FALSE(memcg_sockets_enabled_key);
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 10/96] memcg: css_alloc should return an ERR_PTR value on error
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (7 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 09/96] memcg: mem_cgroup_migrate() may be called with irq disabled Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 11/96] mm/swap.c: flush lru pvecs on compound page arrival Greg Kroah-Hartman
` (82 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tejun Heo, Johannes Weiner,
Vladimir Davydov, Michal Hocko, Andrew Morton, Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit ea3a9645866e12d2b198434f03df3c3e96fb86ce upstream.
mem_cgroup_css_alloc() was returning NULL on failure while cgroup core
expected it to return an ERR_PTR value leading to the following NULL
deref after a css allocation failure. Fix it by return
ERR_PTR(-ENOMEM) instead. I'll also update cgroup core so that it
can handle NULL returns.
mkdir: page allocation failure: order:6, mode:0x240c0c0(GFP_KERNEL|__GFP_COMP|__GFP_ZERO)
CPU: 0 PID: 8738 Comm: mkdir Not tainted 4.7.0-rc3+ #123
...
Call Trace:
dump_stack+0x68/0xa1
warn_alloc_failed+0xd6/0x130
__alloc_pages_nodemask+0x4c6/0xf20
alloc_pages_current+0x66/0xe0
alloc_kmem_pages+0x14/0x80
kmalloc_order_trace+0x2a/0x1a0
__kmalloc+0x291/0x310
memcg_update_all_caches+0x6c/0x130
mem_cgroup_css_alloc+0x590/0x610
cgroup_apply_control_enable+0x18b/0x370
cgroup_mkdir+0x1de/0x2e0
kernfs_iop_mkdir+0x55/0x80
vfs_mkdir+0xb9/0x150
SyS_mkdir+0x66/0xd0
do_syscall_64+0x53/0x120
entry_SYSCALL64_slow_path+0x25/0x25
...
BUG: unable to handle kernel NULL pointer dereference at 00000000000000d0
IP: init_and_link_css+0x37/0x220
PGD 34b1e067 PUD 3a109067 PMD 0
Oops: 0002 [#1] SMP
Modules linked in:
CPU: 0 PID: 8738 Comm: mkdir Not tainted 4.7.0-rc3+ #123
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.2-20160422_131301-anatol 04/01/2014
task: ffff88007cbc5200 ti: ffff8800666d4000 task.ti: ffff8800666d4000
RIP: 0010:[<ffffffff810f2ca7>] [<ffffffff810f2ca7>] init_and_link_css+0x37/0x220
RSP: 0018:ffff8800666d7d90 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffffffff810f2499 RSI: 0000000000000000 RDI: 0000000000000008
RBP: ffff8800666d7db8 R08: 0000000000000003 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000000 R12: ffff88005a5fb400
R13: ffffffff81f0f8a0 R14: ffff88005a5fb400 R15: 0000000000000010
FS: 00007fc944689700(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f3aed0d2b80 CR3: 000000003a1e8000 CR4: 00000000000006f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
cgroup_apply_control_enable+0x1ac/0x370
cgroup_mkdir+0x1de/0x2e0
kernfs_iop_mkdir+0x55/0x80
vfs_mkdir+0xb9/0x150
SyS_mkdir+0x66/0xd0
do_syscall_64+0x53/0x120
entry_SYSCALL64_slow_path+0x25/0x25
Code: 89 f5 48 89 fb 49 89 d4 48 83 ec 08 8b 05 72 3b d8 00 85 c0 0f 85 60 01 00 00 4c 89 e7 e8 72 f7 ff ff 48 8d 7b 08 48 89 d9 31 c0 <48> c7 83 d0 00 00 00 00 00 00 00 48 83 e7 f8 48 29 f9 81 c1 d8
RIP init_and_link_css+0x37/0x220
RSP <ffff8800666d7d90>
CR2: 00000000000000d0
---[ end trace a2d8836ae1e852d1 ]---
Link: http://lkml.kernel.org/r/20160621165740.GJ3262@mtj.duckdns.org
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Vladimir Davydov <vdavydov@virtuozzo.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/memcontrol.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4184,7 +4184,7 @@ mem_cgroup_css_alloc(struct cgroup_subsy
return &memcg->css;
fail:
mem_cgroup_free(memcg);
- return NULL;
+ return ERR_PTR(-ENOMEM);
}
static int
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 11/96] mm/swap.c: flush lru pvecs on compound page arrival
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (8 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 10/96] memcg: css_alloc should return an ERR_PTR value on error Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 12/96] mm, compaction: abort free scanner if split fails Greg Kroah-Hartman
` (81 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michal Hocko, Lukasz Odzioba,
Kirill Shutemov, Andrea Arcangeli, Vladimir Davydov, Ming Li,
Minchan Kim, Andrew Morton, Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Odzioba <lukasz.odzioba@intel.com>
commit 8f182270dfec432e93fae14f9208a6b9af01009f upstream.
Currently we can have compound pages held on per cpu pagevecs, which
leads to a lot of memory unavailable for reclaim when needed. In the
systems with hundreads of processors it can be GBs of memory.
On of the way of reproducing the problem is to not call munmap
explicitly on all mapped regions (i.e. after receiving SIGTERM). After
that some pages (with THP enabled also huge pages) may end up on
lru_add_pvec, example below.
void main() {
#pragma omp parallel
{
size_t size = 55 * 1000 * 1000; // smaller than MEM/CPUS
void *p = mmap(NULL, size, PROT_READ | PROT_WRITE,
MAP_PRIVATE | MAP_ANONYMOUS , -1, 0);
if (p != MAP_FAILED)
memset(p, 0, size);
//munmap(p, size); // uncomment to make the problem go away
}
}
When we run it with THP enabled it will leave significant amount of
memory on lru_add_pvec. This memory will be not reclaimed if we hit
OOM, so when we run above program in a loop:
for i in `seq 100`; do ./a.out; done
many processes (95% in my case) will be killed by OOM.
The primary point of the LRU add cache is to save the zone lru_lock
contention with a hope that more pages will belong to the same zone and
so their addition can be batched. The huge page is already a form of
batched addition (it will add 512 worth of memory in one go) so skipping
the batching seems like a safer option when compared to a potential
excess in the caching which can be quite large and much harder to fix
because lru_add_drain_all is way to expensive and it is not really clear
what would be a good moment to call it.
Similarly we can reproduce the problem on lru_deactivate_pvec by adding:
madvise(p, size, MADV_FREE); after memset.
This patch flushes lru pvecs on compound page arrival making the problem
less severe - after applying it kill rate of above example drops to 0%,
due to reducing maximum amount of memory held on pvec from 28MB (with
THP) to 56kB per CPU.
Suggested-by: Michal Hocko <mhocko@suse.com>
Link: http://lkml.kernel.org/r/1466180198-18854-1-git-send-email-lukasz.odzioba@intel.com
Signed-off-by: Lukasz Odzioba <lukasz.odzioba@intel.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Kirill Shutemov <kirill.shutemov@linux.intel.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Vladimir Davydov <vdavydov@parallels.com>
Cc: Ming Li <mingli199x@qq.com>
Cc: Minchan Kim <minchan@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/swap.c | 11 +++++------
1 file changed, 5 insertions(+), 6 deletions(-)
--- a/mm/swap.c
+++ b/mm/swap.c
@@ -239,7 +239,7 @@ void rotate_reclaimable_page(struct page
get_page(page);
local_irq_save(flags);
pvec = this_cpu_ptr(&lru_rotate_pvecs);
- if (!pagevec_add(pvec, page))
+ if (!pagevec_add(pvec, page) || PageCompound(page))
pagevec_move_tail(pvec);
local_irq_restore(flags);
}
@@ -295,7 +295,7 @@ void activate_page(struct page *page)
struct pagevec *pvec = &get_cpu_var(activate_page_pvecs);
get_page(page);
- if (!pagevec_add(pvec, page))
+ if (!pagevec_add(pvec, page) || PageCompound(page))
pagevec_lru_move_fn(pvec, __activate_page, NULL);
put_cpu_var(activate_page_pvecs);
}
@@ -390,9 +390,8 @@ static void __lru_cache_add(struct page
struct pagevec *pvec = &get_cpu_var(lru_add_pvec);
get_page(page);
- if (!pagevec_space(pvec))
+ if (!pagevec_add(pvec, page) || PageCompound(page))
__pagevec_lru_add(pvec);
- pagevec_add(pvec, page);
put_cpu_var(lru_add_pvec);
}
@@ -627,7 +626,7 @@ void deactivate_file_page(struct page *p
if (likely(get_page_unless_zero(page))) {
struct pagevec *pvec = &get_cpu_var(lru_deactivate_file_pvecs);
- if (!pagevec_add(pvec, page))
+ if (!pagevec_add(pvec, page) || PageCompound(page))
pagevec_lru_move_fn(pvec, lru_deactivate_file_fn, NULL);
put_cpu_var(lru_deactivate_file_pvecs);
}
@@ -647,7 +646,7 @@ void deactivate_page(struct page *page)
struct pagevec *pvec = &get_cpu_var(lru_deactivate_pvecs);
get_page(page);
- if (!pagevec_add(pvec, page))
+ if (!pagevec_add(pvec, page) || PageCompound(page))
pagevec_lru_move_fn(pvec, lru_deactivate_fn, NULL);
put_cpu_var(lru_deactivate_pvecs);
}
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 12/96] mm, compaction: abort free scanner if split fails
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (9 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 11/96] mm/swap.c: flush lru pvecs on compound page arrival Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 13/96] fs/nilfs2: fix potential underflow in call to crc32_le Greg Kroah-Hartman
` (80 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Rientjes, Vlastimil Babka,
Minchan Kim, Joonsoo Kim, Mel Gorman, Hugh Dickins,
Andrew Morton, Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rientjes <rientjes@google.com>
commit a4f04f2c6955aff5e2c08dcb40aca247ff4d7370 upstream.
If the memory compaction free scanner cannot successfully split a free
page (only possible due to per-zone low watermark), terminate the free
scanner rather than continuing to scan memory needlessly. If the
watermark is insufficient for a free page of order <= cc->order, then
terminate the scanner since all future splits will also likely fail.
This prevents the compaction freeing scanner from scanning all memory on
very large zones (very noticeable for zones > 128GB, for instance) when
all splits will likely fail while holding zone->lock.
compaction_alloc() iterating a 128GB zone has been benchmarked to take
over 400ms on some systems whereas any free page isolated and ready to
be split ends up failing in split_free_page() because of the low
watermark check and thus the iteration continues.
The next time compaction occurs, the freeing scanner will likely start
at the end of the zone again since no success was made previously and we
get the same lengthy iteration until the zone is brought above the low
watermark. All thp page faults can take >400ms in such a state without
this fix.
Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1606211820350.97086@chino.kir.corp.google.com
Signed-off-by: David Rientjes <rientjes@google.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/compaction.c | 39 +++++++++++++++++++++------------------
1 file changed, 21 insertions(+), 18 deletions(-)
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -436,25 +436,23 @@ static unsigned long isolate_freepages_b
/* Found a free page, break it into order-0 pages */
isolated = split_free_page(page);
+ if (!isolated)
+ break;
+
total_isolated += isolated;
+ cc->nr_freepages += isolated;
for (i = 0; i < isolated; i++) {
list_add(&page->lru, freelist);
page++;
}
-
- /* If a page was split, advance to the end of it */
- if (isolated) {
- cc->nr_freepages += isolated;
- if (!strict &&
- cc->nr_migratepages <= cc->nr_freepages) {
- blockpfn += isolated;
- break;
- }
-
- blockpfn += isolated - 1;
- cursor += isolated - 1;
- continue;
+ if (!strict && cc->nr_migratepages <= cc->nr_freepages) {
+ blockpfn += isolated;
+ break;
}
+ /* Advance to the end of split page */
+ blockpfn += isolated - 1;
+ cursor += isolated - 1;
+ continue;
isolate_fail:
if (strict)
@@ -464,6 +462,9 @@ isolate_fail:
}
+ if (locked)
+ spin_unlock_irqrestore(&cc->zone->lock, flags);
+
/*
* There is a tiny chance that we have read bogus compound_order(),
* so be careful to not go outside of the pageblock.
@@ -485,9 +486,6 @@ isolate_fail:
if (strict && blockpfn < end_pfn)
total_isolated = 0;
- if (locked)
- spin_unlock_irqrestore(&cc->zone->lock, flags);
-
/* Update the pageblock-skip if the whole pageblock was scanned */
if (blockpfn == end_pfn)
update_pageblock_skip(cc, valid_page, total_isolated, false);
@@ -938,6 +936,7 @@ static void isolate_freepages(struct com
block_end_pfn = block_start_pfn,
block_start_pfn -= pageblock_nr_pages,
isolate_start_pfn = block_start_pfn) {
+ unsigned long isolated;
/*
* This can iterate a massively long zone without finding any
@@ -962,8 +961,12 @@ static void isolate_freepages(struct com
continue;
/* Found a block suitable for isolating free pages from. */
- isolate_freepages_block(cc, &isolate_start_pfn,
- block_end_pfn, freelist, false);
+ isolated = isolate_freepages_block(cc, &isolate_start_pfn,
+ block_end_pfn, freelist, false);
+ /* If isolation failed early, do not continue needlessly */
+ if (!isolated && isolate_start_pfn < block_end_pfn &&
+ cc->nr_migratepages > cc->nr_freepages)
+ break;
/*
* If we isolated enough freepages, or aborted due to async
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 13/96] fs/nilfs2: fix potential underflow in call to crc32_le
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (10 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 12/96] mm, compaction: abort free scanner if split fails Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 14/96] mm, compaction: prevent VM_BUG_ON when terminating freeing scanner Greg Kroah-Hartman
` (79 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Torsten Hilbrich, Ryusuke Konishi,
Andrew Morton, Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Torsten Hilbrich <torsten.hilbrich@secunet.com>
commit 63d2f95d63396059200c391ca87161897b99e74a upstream.
The value `bytes' comes from the filesystem which is about to be
mounted. We cannot trust that the value is always in the range we
expect it to be.
Check its value before using it to calculate the length for the crc32_le
call. It value must be larger (or equal) sumoff + 4.
This fixes a kernel bug when accidentially mounting an image file which
had the nilfs2 magic value 0x3434 at the right offset 0x406 by chance.
The bytes 0x01 0x00 were stored at 0x408 and were interpreted as a
s_bytes value of 1. This caused an underflow when substracting sumoff +
4 (20) in the call to crc32_le.
BUG: unable to handle kernel paging request at ffff88021e600000
IP: crc32_le+0x36/0x100
...
Call Trace:
nilfs_valid_sb.part.5+0x52/0x60 [nilfs2]
nilfs_load_super_block+0x142/0x300 [nilfs2]
init_nilfs+0x60/0x390 [nilfs2]
nilfs_mount+0x302/0x520 [nilfs2]
mount_fs+0x38/0x160
vfs_kern_mount+0x67/0x110
do_mount+0x269/0xe00
SyS_mount+0x9f/0x100
entry_SYSCALL_64_fastpath+0x16/0x71
Link: http://lkml.kernel.org/r/1466778587-5184-2-git-send-email-konishi.ryusuke@lab.ntt.co.jp
Signed-off-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
Tested-by: Torsten Hilbrich <torsten.hilbrich@secunet.com>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/nilfs2/the_nilfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/nilfs2/the_nilfs.c
+++ b/fs/nilfs2/the_nilfs.c
@@ -443,7 +443,7 @@ static int nilfs_valid_sb(struct nilfs_s
if (!sbp || le16_to_cpu(sbp->s_magic) != NILFS_SUPER_MAGIC)
return 0;
bytes = le16_to_cpu(sbp->s_bytes);
- if (bytes > BLOCK_SIZE)
+ if (bytes < sumoff + 4 || bytes > BLOCK_SIZE)
return 0;
crc = crc32_le(le32_to_cpu(sbp->s_crc_seed), (unsigned char *)sbp,
sumoff);
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 14/96] mm, compaction: prevent VM_BUG_ON when terminating freeing scanner
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (11 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 13/96] fs/nilfs2: fix potential underflow in call to crc32_le Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 15/96] uapi: export lirc.h header Greg Kroah-Hartman
` (78 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, David Rientjes, Minchan Kim,
Joonsoo Kim, Hugh Dickins, Mel Gorman, Vlastimil Babka,
Andrew Morton, Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Rientjes <rientjes@google.com>
commit a46cbf3bc53b6a93fb84a5ffb288c354fa807954 upstream.
It's possible to isolate some freepages in a pageblock and then fail
split_free_page() due to the low watermark check. In this case, we hit
VM_BUG_ON() because the freeing scanner terminated early without a
contended lock or enough freepages.
This should never have been a VM_BUG_ON() since it's not a fatal
condition. It should have been a VM_WARN_ON() at best, or even handled
gracefully.
Regardless, we need to terminate anytime the full pageblock scan was not
done. The logic belongs in isolate_freepages_block(), so handle its
state gracefully by terminating the pageblock loop and making a note to
restart at the same pageblock next time since it was not possible to
complete the scan this time.
[rientjes@google.com: don't rescan pages in a pageblock]
Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1607111244150.83138@chino.kir.corp.google.com
Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1606291436300.145590@chino.kir.corp.google.com
Signed-off-by: David Rientjes <rientjes@google.com>
Reported-by: Minchan Kim <minchan@kernel.org>
Tested-by: Minchan Kim <minchan@kernel.org>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/compaction.c | 36 ++++++++++++++----------------------
1 file changed, 14 insertions(+), 22 deletions(-)
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -936,8 +936,6 @@ static void isolate_freepages(struct com
block_end_pfn = block_start_pfn,
block_start_pfn -= pageblock_nr_pages,
isolate_start_pfn = block_start_pfn) {
- unsigned long isolated;
-
/*
* This can iterate a massively long zone without finding any
* suitable migration targets, so periodically check if we need
@@ -961,36 +959,30 @@ static void isolate_freepages(struct com
continue;
/* Found a block suitable for isolating free pages from. */
- isolated = isolate_freepages_block(cc, &isolate_start_pfn,
- block_end_pfn, freelist, false);
- /* If isolation failed early, do not continue needlessly */
- if (!isolated && isolate_start_pfn < block_end_pfn &&
- cc->nr_migratepages > cc->nr_freepages)
- break;
+ isolate_freepages_block(cc, &isolate_start_pfn, block_end_pfn,
+ freelist, false);
/*
- * If we isolated enough freepages, or aborted due to async
- * compaction being contended, terminate the loop.
- * Remember where the free scanner should restart next time,
- * which is where isolate_freepages_block() left off.
- * But if it scanned the whole pageblock, isolate_start_pfn
- * now points at block_end_pfn, which is the start of the next
- * pageblock.
- * In that case we will however want to restart at the start
- * of the previous pageblock.
+ * If we isolated enough freepages, or aborted due to lock
+ * contention, terminate.
*/
if ((cc->nr_freepages >= cc->nr_migratepages)
|| cc->contended) {
- if (isolate_start_pfn >= block_end_pfn)
+ if (isolate_start_pfn >= block_end_pfn) {
+ /*
+ * Restart at previous pageblock if more
+ * freepages can be isolated next time.
+ */
isolate_start_pfn =
block_start_pfn - pageblock_nr_pages;
+ }
break;
- } else {
+ } else if (isolate_start_pfn < block_end_pfn) {
/*
- * isolate_freepages_block() should not terminate
- * prematurely unless contended, or isolated enough
+ * If isolation failed early, do not continue
+ * needlessly.
*/
- VM_BUG_ON(isolate_start_pfn < block_end_pfn);
+ break;
}
}
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 15/96] uapi: export lirc.h header
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (12 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 14/96] mm, compaction: prevent VM_BUG_ON when terminating freeing scanner Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 16/96] mm, meminit: always return a valid node from early_pfn_to_nid Greg Kroah-Hartman
` (77 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mauro Carvalho Chehab, Alec Leamas,
Andrew Morton, Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mauro Carvalho Chehab <mchehab@s-opensource.com>
commit 12cb22bb8ae9aff9d72a9c0a234f26d641b20eb6 upstream.
This header contains the userspace API for lirc.
This is a fixup for commit b7be755733dc ("[media] bz#75751: Move
internal header file lirc.h to uapi/"). It moved the header to the
right place, but it forgot to add it at Kbuild. So, despite being at
uapi, it is not copied to the right place.
Fixes: b7be755733dc44c72 ("[media] bz#75751: Move internal header file lirc.h to uapi/")
Link: http://lkml.kernel.org/r/320c765d32bfc82c582e336d52ffe1026c73c644.1468439021.git.mchehab@s-opensource.com
Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
Cc: Alec Leamas <leamas.alec@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/uapi/linux/Kbuild | 1 +
1 file changed, 1 insertion(+)
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -244,6 +244,7 @@ endif
header-y += hw_breakpoint.h
header-y += l2tp.h
header-y += libc-compat.h
+header-y += lirc.h
header-y += limits.h
header-y += llc.h
header-y += loop.h
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 16/96] mm, meminit: always return a valid node from early_pfn_to_nid
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (13 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 15/96] uapi: export lirc.h header Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 17/96] mm, meminit: ensure node is online before checking whether pages are uninitialised Greg Kroah-Hartman
` (76 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mel Gorman, David Rientjes,
Andrew Morton, Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mel Gorman <mgorman@techsingularity.net>
commit e4568d3803852d00effd41dcdd489e726b998879 upstream.
early_pfn_to_nid can return node 0 if a PFN is invalid on machines that
has no node 0. A machine with only node 1 was observed to crash with
the following message:
BUG: unable to handle kernel paging request at 000000000002a3c8
PGD 0
Modules linked in:
Hardware name: Supermicro H8DSP-8/H8DSP-8, BIOS 080011 06/30/2006
task: ffffffff81c0d500 ti: ffffffff81c00000 task.ti: ffffffff81c00000
RIP: reserve_bootmem_region+0x6a/0xef
CR2: 000000000002a3c8 CR3: 0000000001c06000 CR4: 00000000000006b0
Call Trace:
free_all_bootmem+0x4b/0x12a
mem_init+0x70/0xa3
start_kernel+0x25b/0x49b
The problem is that early_page_uninitialised uses the early_pfn_to_nid
helper which returns node 0 for invalid PFNs. No caller of
early_pfn_to_nid cares except early_page_uninitialised. This patch has
early_pfn_to_nid always return a valid node.
Link: http://lkml.kernel.org/r/1468008031-3848-3-git-send-email-mgorman@techsingularity.net
Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
Acked-by: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/page_alloc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -1110,7 +1110,7 @@ int __meminit early_pfn_to_nid(unsigned
spin_lock(&early_pfn_lock);
nid = __early_pfn_to_nid(pfn, &early_pfnnid_cache);
if (nid < 0)
- nid = 0;
+ nid = first_online_node;
spin_unlock(&early_pfn_lock);
return nid;
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 17/96] mm, meminit: ensure node is online before checking whether pages are uninitialised
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (14 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 16/96] mm, meminit: always return a valid node from early_pfn_to_nid Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 18/96] vmlinux.lds: account for destructor sections Greg Kroah-Hartman
` (75 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mel Gorman, David Rientjes,
Andrew Morton, Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mel Gorman <mgorman@techsingularity.net>
commit ef70b6f41cda6270165a6f27b2548ed31cfa3cb2 upstream.
early_page_uninitialised looks up an arbitrary PFN. While a machine
without node 0 will boot with "mm, page_alloc: Always return a valid
node from early_pfn_to_nid", it works because it assumes that nodes are
always in PFN order. This is not guaranteed so this patch adds
robustness by always checking if the node being checked is online.
Link: http://lkml.kernel.org/r/1468008031-3848-4-git-send-email-mgorman@techsingularity.net
Signed-off-by: Mel Gorman <mgorman@techsingularity.net>
Acked-by: David Rientjes <rientjes@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
mm/page_alloc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -286,7 +286,9 @@ static inline void reset_deferred_memini
/* Returns true if the struct page for the pfn is uninitialised */
static inline bool __meminit early_page_uninitialised(unsigned long pfn)
{
- if (pfn >= NODE_DATA(early_pfn_to_nid(pfn))->first_deferred_pfn)
+ int nid = early_pfn_to_nid(pfn);
+
+ if (node_online(nid) && pfn >= NODE_DATA(nid)->first_deferred_pfn)
return true;
return false;
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 18/96] vmlinux.lds: account for destructor sections
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (15 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 17/96] mm, meminit: ensure node is online before checking whether pages are uninitialised Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 19/96] mm: thp: refix false positive BUG in page_move_anon_rmap() Greg Kroah-Hartman
` (74 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitry Vyukov, Andrey Ryabinin,
Andrew Morton, Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Vyukov <dvyukov@google.com>
commit e41f501d391265ff568f3e49d6128cc30856a36f upstream.
If CONFIG_KASAN is enabled and gcc is configured with
--disable-initfini-array and/or gold linker is used, gcc emits
.ctors/.dtors and .text.startup/.text.exit sections instead of
.init_array/.fini_array. .dtors section is not explicitly accounted in
the linker script and messes vvar/percpu layout.
We want:
ffffffff822bfd80 D _edata
ffffffff822c0000 D __vvar_beginning_hack
ffffffff822c0000 A __vvar_page
ffffffff822c0080 0000000000000098 D vsyscall_gtod_data
ffffffff822c1000 A __init_begin
ffffffff822c1000 D init_per_cpu__irq_stack_union
ffffffff822c1000 A __per_cpu_load
ffffffff822d3000 D init_per_cpu__gdt_page
We got:
ffffffff8279a600 D _edata
ffffffff8279b000 A __vvar_page
ffffffff8279c000 A __init_begin
ffffffff8279c000 D init_per_cpu__irq_stack_union
ffffffff8279c000 A __per_cpu_load
ffffffff8279e000 D __vvar_beginning_hack
ffffffff8279e080 0000000000000098 D vsyscall_gtod_data
ffffffff827ae000 D init_per_cpu__gdt_page
This happens because __vvar_page and .vvar get different addresses in
arch/x86/kernel/vmlinux.lds.S:
. = ALIGN(PAGE_SIZE);
__vvar_page = .;
.vvar : AT(ADDR(.vvar) - LOAD_OFFSET) {
/* work around gold bug 13023 */
__vvar_beginning_hack = .;
Discard .dtors/.fini_array/.text.exit, since we don't call dtors.
Merge .text.startup into init text.
Link: http://lkml.kernel.org/r/1467386363-120030-1-git-send-email-dvyukov@google.com
Signed-off-by: Dmitry Vyukov <dvyukov@google.com>
Reviewed-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/asm-generic/vmlinux.lds.h | 4 ++++
1 file changed, 4 insertions(+)
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -540,15 +540,19 @@
#define INIT_TEXT \
*(.init.text) \
+ *(.text.startup) \
MEM_DISCARD(init.text)
#define EXIT_DATA \
*(.exit.data) \
+ *(.fini_array) \
+ *(.dtors) \
MEM_DISCARD(exit.data) \
MEM_DISCARD(exit.rodata)
#define EXIT_TEXT \
*(.exit.text) \
+ *(.text.exit) \
MEM_DISCARD(exit.text)
#define EXIT_CALL \
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 19/96] mm: thp: refix false positive BUG in page_move_anon_rmap()
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (16 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 18/96] vmlinux.lds: account for destructor sections Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 20/96] mm: memcontrol: fix cgroup creation failure after many small jobs Greg Kroah-Hartman
` (73 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Hugh Dickins, Dmitry Vyukov,
Kirill A. Shutemov, Mika Westerberg, Andrea Arcangeli,
Rik van Riel, Andrew Morton, Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hugh Dickins <hughd@google.com>
commit 5a49973d7143ebbabd76e1dcd69ee42e349bb7b9 upstream.
The VM_BUG_ON_PAGE in page_move_anon_rmap() is more trouble than it's
worth: the syzkaller fuzzer hit it again. It's still wrong for some THP
cases, because linear_page_index() was never intended to apply to
addresses before the start of a vma.
That's easily fixed with a signed long cast inside linear_page_index();
and Dmitry has tested such a patch, to verify the false positive. But
why extend linear_page_index() just for this case? when the avoidance in
page_move_anon_rmap() has already grown ugly, and there's no reason for
the check at all (nothing else there is using address or index).
Remove address arg from page_move_anon_rmap(), remove VM_BUG_ON_PAGE,
remove CONFIG_DEBUG_VM PageTransHuge adjustment.
And one more thing: should the compound_head(page) be done inside or
outside page_move_anon_rmap()? It's usually pushed down to the lowest
level nowadays (and mm/memory.c shows no other explicit use of it), so I
think it's better done in page_move_anon_rmap() than by caller.
Fixes: 0798d3c022dc ("mm: thp: avoid false positive VM_BUG_ON_PAGE in page_move_anon_rmap()")
Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1607120444540.12528@eggly.anvils
Signed-off-by: Hugh Dickins <hughd@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Mika Westerberg <mika.westerberg@linux.intel.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Rik van Riel <riel@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/rmap.h | 2 +-
mm/hugetlb.c | 2 +-
mm/memory.c | 3 +--
mm/rmap.c | 9 +++------
4 files changed, 6 insertions(+), 10 deletions(-)
--- a/include/linux/rmap.h
+++ b/include/linux/rmap.h
@@ -158,7 +158,7 @@ struct anon_vma *page_get_anon_vma(struc
/*
* rmap interfaces called when adding or removing pte of page
*/
-void page_move_anon_rmap(struct page *, struct vm_area_struct *, unsigned long);
+void page_move_anon_rmap(struct page *, struct vm_area_struct *);
void page_add_anon_rmap(struct page *, struct vm_area_struct *,
unsigned long, bool);
void do_page_add_anon_rmap(struct page *, struct vm_area_struct *,
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -3328,7 +3328,7 @@ retry_avoidcopy:
/* If no-one else is actually using this page, avoid the copy
* and just make the page writable */
if (page_mapcount(old_page) == 1 && PageAnon(old_page)) {
- page_move_anon_rmap(old_page, vma, address);
+ page_move_anon_rmap(old_page, vma);
set_huge_ptep_writable(vma, address, ptep);
return 0;
}
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -2397,8 +2397,7 @@ static int do_wp_page(struct mm_struct *
* Protected against the rmap code by
* the page lock.
*/
- page_move_anon_rmap(compound_head(old_page),
- vma, address);
+ page_move_anon_rmap(old_page, vma);
}
unlock_page(old_page);
return wp_page_reuse(mm, vma, address, page_table, ptl,
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1084,23 +1084,20 @@ EXPORT_SYMBOL_GPL(page_mkclean);
* page_move_anon_rmap - move a page to our anon_vma
* @page: the page to move to our anon_vma
* @vma: the vma the page belongs to
- * @address: the user virtual address mapped
*
* When a page belongs exclusively to one process after a COW event,
* that page can be moved into the anon_vma that belongs to just that
* process, so the rmap code will not search the parent or sibling
* processes.
*/
-void page_move_anon_rmap(struct page *page,
- struct vm_area_struct *vma, unsigned long address)
+void page_move_anon_rmap(struct page *page, struct vm_area_struct *vma)
{
struct anon_vma *anon_vma = vma->anon_vma;
+ page = compound_head(page);
+
VM_BUG_ON_PAGE(!PageLocked(page), page);
VM_BUG_ON_VMA(!anon_vma, vma);
- if (IS_ENABLED(CONFIG_DEBUG_VM) && PageTransHuge(page))
- address &= HPAGE_PMD_MASK;
- VM_BUG_ON_PAGE(page->index != linear_page_index(vma, address), page);
anon_vma = (void *) anon_vma + PAGE_MAPPING_ANON;
/*
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 20/96] mm: memcontrol: fix cgroup creation failure after many small jobs
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (17 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 19/96] mm: thp: refix false positive BUG in page_move_anon_rmap() Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 21/96] radix-tree: fix radix_tree_iter_retry() for tagged iterators Greg Kroah-Hartman
` (72 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Johannes Weiner, John Garcia,
Vladimir Davydov, Tejun Heo, Nikolay Borisov, Andrew Morton,
Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johannes Weiner <hannes@cmpxchg.org>
commit 73f576c04b9410ed19660f74f97521bee6e1c546 upstream.
The memory controller has quite a bit of state that usually outlives the
cgroup and pins its CSS until said state disappears. At the same time
it imposes a 16-bit limit on the CSS ID space to economically store IDs
in the wild. Consequently, when we use cgroups to contain frequent but
small and short-lived jobs that leave behind some page cache, we quickly
run into the 64k limitations of outstanding CSSs. Creating a new cgroup
fails with -ENOSPC while there are only a few, or even no user-visible
cgroups in existence.
Although pinning CSSs past cgroup removal is common, there are only two
instances that actually need an ID after a cgroup is deleted: cache
shadow entries and swapout records.
Cache shadow entries reference the ID weakly and can deal with the CSS
having disappeared when it's looked up later. They pose no hurdle.
Swap-out records do need to pin the css to hierarchically attribute
swapins after the cgroup has been deleted; though the only pages that
remain swapped out after offlining are tmpfs/shmem pages. And those
references are under the user's control, so they are manageable.
This patch introduces a private 16-bit memcg ID and switches swap and
cache shadow entries over to using that. This ID can then be recycled
after offlining when the CSS remains pinned only by objects that don't
specifically need it.
This script demonstrates the problem by faulting one cache page in a new
cgroup and deleting it again:
set -e
mkdir -p pages
for x in `seq 128000`; do
[ $((x % 1000)) -eq 0 ] && echo $x
mkdir /cgroup/foo
echo $$ >/cgroup/foo/cgroup.procs
echo trex >pages/$x
echo $$ >/cgroup/cgroup.procs
rmdir /cgroup/foo
done
When run on an unpatched kernel, we eventually run out of possible IDs
even though there are no visible cgroups:
[root@ham ~]# ./cssidstress.sh
[...]
65000
mkdir: cannot create directory '/cgroup/foo': No space left on device
After this patch, the IDs get released upon cgroup destruction and the
cache and css objects get released once memory reclaim kicks in.
[hannes@cmpxchg.org: init the IDR]
Link: http://lkml.kernel.org/r/20160621154601.GA22431@cmpxchg.org
Fixes: b2052564e66d ("mm: memcontrol: continue cache reclaim from offlined groups")
Link: http://lkml.kernel.org/r/20160617162516.GD19084@cmpxchg.org
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Reported-by: John Garcia <john.garcia@mesosphere.io>
Reviewed-by: Vladimir Davydov <vdavydov@virtuozzo.com>
Acked-by: Tejun Heo <tj@kernel.org>
Cc: Nikolay Borisov <kernel@kyup.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/memcontrol.h | 25 +++++--------
mm/memcontrol.c | 82 +++++++++++++++++++++++++++++++++++++++++----
mm/slab_common.c | 4 +-
3 files changed, 87 insertions(+), 24 deletions(-)
--- a/include/linux/memcontrol.h
+++ b/include/linux/memcontrol.h
@@ -97,6 +97,11 @@ enum mem_cgroup_events_target {
#define MEM_CGROUP_ID_SHIFT 16
#define MEM_CGROUP_ID_MAX USHRT_MAX
+struct mem_cgroup_id {
+ int id;
+ atomic_t ref;
+};
+
struct mem_cgroup_stat_cpu {
long count[MEMCG_NR_STAT];
unsigned long events[MEMCG_NR_EVENTS];
@@ -172,6 +177,9 @@ enum memcg_kmem_state {
struct mem_cgroup {
struct cgroup_subsys_state css;
+ /* Private memcg ID. Used to ID objects that outlive the cgroup */
+ struct mem_cgroup_id id;
+
/* Accounted resources */
struct page_counter memory;
struct page_counter swap;
@@ -330,22 +338,9 @@ static inline unsigned short mem_cgroup_
if (mem_cgroup_disabled())
return 0;
- return memcg->css.id;
-}
-
-/**
- * mem_cgroup_from_id - look up a memcg from an id
- * @id: the id to look up
- *
- * Caller must hold rcu_read_lock() and use css_tryget() as necessary.
- */
-static inline struct mem_cgroup *mem_cgroup_from_id(unsigned short id)
-{
- struct cgroup_subsys_state *css;
-
- css = css_from_id(id, &memory_cgrp_subsys);
- return mem_cgroup_from_css(css);
+ return memcg->id.id;
}
+struct mem_cgroup *mem_cgroup_from_id(unsigned short id);
/**
* parent_mem_cgroup - find the accounting parent of a memcg
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -4038,6 +4038,60 @@ static struct cftype mem_cgroup_legacy_f
{ }, /* terminate */
};
+/*
+ * Private memory cgroup IDR
+ *
+ * Swap-out records and page cache shadow entries need to store memcg
+ * references in constrained space, so we maintain an ID space that is
+ * limited to 16 bit (MEM_CGROUP_ID_MAX), limiting the total number of
+ * memory-controlled cgroups to 64k.
+ *
+ * However, there usually are many references to the oflline CSS after
+ * the cgroup has been destroyed, such as page cache or reclaimable
+ * slab objects, that don't need to hang on to the ID. We want to keep
+ * those dead CSS from occupying IDs, or we might quickly exhaust the
+ * relatively small ID space and prevent the creation of new cgroups
+ * even when there are much fewer than 64k cgroups - possibly none.
+ *
+ * Maintain a private 16-bit ID space for memcg, and allow the ID to
+ * be freed and recycled when it's no longer needed, which is usually
+ * when the CSS is offlined.
+ *
+ * The only exception to that are records of swapped out tmpfs/shmem
+ * pages that need to be attributed to live ancestors on swapin. But
+ * those references are manageable from userspace.
+ */
+
+static DEFINE_IDR(mem_cgroup_idr);
+
+static void mem_cgroup_id_get(struct mem_cgroup *memcg)
+{
+ atomic_inc(&memcg->id.ref);
+}
+
+static void mem_cgroup_id_put(struct mem_cgroup *memcg)
+{
+ if (atomic_dec_and_test(&memcg->id.ref)) {
+ idr_remove(&mem_cgroup_idr, memcg->id.id);
+ memcg->id.id = 0;
+
+ /* Memcg ID pins CSS */
+ css_put(&memcg->css);
+ }
+}
+
+/**
+ * mem_cgroup_from_id - look up a memcg from a memcg id
+ * @id: the memcg id to look up
+ *
+ * Caller must hold rcu_read_lock().
+ */
+struct mem_cgroup *mem_cgroup_from_id(unsigned short id)
+{
+ WARN_ON_ONCE(!rcu_read_lock_held());
+ return idr_find(&mem_cgroup_idr, id);
+}
+
static int alloc_mem_cgroup_per_zone_info(struct mem_cgroup *memcg, int node)
{
struct mem_cgroup_per_node *pn;
@@ -4097,6 +4151,12 @@ static struct mem_cgroup *mem_cgroup_all
if (!memcg)
return NULL;
+ memcg->id.id = idr_alloc(&mem_cgroup_idr, NULL,
+ 1, MEM_CGROUP_ID_MAX,
+ GFP_KERNEL);
+ if (memcg->id.id < 0)
+ goto fail;
+
memcg->stat = alloc_percpu(struct mem_cgroup_stat_cpu);
if (!memcg->stat)
goto fail;
@@ -4123,8 +4183,11 @@ static struct mem_cgroup *mem_cgroup_all
#ifdef CONFIG_CGROUP_WRITEBACK
INIT_LIST_HEAD(&memcg->cgwb_list);
#endif
+ idr_replace(&mem_cgroup_idr, memcg, memcg->id.id);
return memcg;
fail:
+ if (memcg->id.id > 0)
+ idr_remove(&mem_cgroup_idr, memcg->id.id);
mem_cgroup_free(memcg);
return NULL;
}
@@ -4187,12 +4250,11 @@ fail:
return ERR_PTR(-ENOMEM);
}
-static int
-mem_cgroup_css_online(struct cgroup_subsys_state *css)
+static int mem_cgroup_css_online(struct cgroup_subsys_state *css)
{
- if (css->id > MEM_CGROUP_ID_MAX)
- return -ENOSPC;
-
+ /* Online state pins memcg ID, memcg ID pins CSS */
+ mem_cgroup_id_get(mem_cgroup_from_css(css));
+ css_get(css);
return 0;
}
@@ -4215,6 +4277,8 @@ static void mem_cgroup_css_offline(struc
memcg_offline_kmem(memcg);
wb_memcg_offline(memcg);
+
+ mem_cgroup_id_put(memcg);
}
static void mem_cgroup_css_released(struct cgroup_subsys_state *css)
@@ -5736,6 +5800,7 @@ void mem_cgroup_swapout(struct page *pag
if (!memcg)
return;
+ mem_cgroup_id_get(memcg);
oldid = swap_cgroup_record(entry, mem_cgroup_id(memcg));
VM_BUG_ON_PAGE(oldid, page);
mem_cgroup_swap_statistics(memcg, true);
@@ -5754,6 +5819,9 @@ void mem_cgroup_swapout(struct page *pag
VM_BUG_ON(!irqs_disabled());
mem_cgroup_charge_statistics(memcg, page, false, -1);
memcg_check_events(memcg, page);
+
+ if (!mem_cgroup_is_root(memcg))
+ css_put(&memcg->css);
}
/*
@@ -5784,11 +5852,11 @@ int mem_cgroup_try_charge_swap(struct pa
!page_counter_try_charge(&memcg->swap, 1, &counter))
return -ENOMEM;
+ mem_cgroup_id_get(memcg);
oldid = swap_cgroup_record(entry, mem_cgroup_id(memcg));
VM_BUG_ON_PAGE(oldid, page);
mem_cgroup_swap_statistics(memcg, true);
- css_get(&memcg->css);
return 0;
}
@@ -5817,7 +5885,7 @@ void mem_cgroup_uncharge_swap(swp_entry_
page_counter_uncharge(&memcg->memsw, 1);
}
mem_cgroup_swap_statistics(memcg, false);
- css_put(&memcg->css);
+ mem_cgroup_id_put(memcg);
}
rcu_read_unlock();
}
--- a/mm/slab_common.c
+++ b/mm/slab_common.c
@@ -526,8 +526,8 @@ void memcg_create_kmem_cache(struct mem_
goto out_unlock;
cgroup_name(css->cgroup, memcg_name_buf, sizeof(memcg_name_buf));
- cache_name = kasprintf(GFP_KERNEL, "%s(%d:%s)", root_cache->name,
- css->id, memcg_name_buf);
+ cache_name = kasprintf(GFP_KERNEL, "%s(%llu:%s)", root_cache->name,
+ css->serial_nr, memcg_name_buf);
if (!cache_name)
goto out_unlock;
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 21/96] radix-tree: fix radix_tree_iter_retry() for tagged iterators.
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (18 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 20/96] mm: memcontrol: fix cgroup creation failure after many small jobs Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 22/96] pps: do not crash when failed to register Greg Kroah-Hartman
` (71 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrey Ryabinin, Dmitry Vyukov,
Konstantin Khlebnikov, Matthew Wilcox, Hugh Dickins,
Ross Zwisler, Andrew Morton, Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Ryabinin <aryabinin@virtuozzo.com>
commit 3cb9185c67304b2a7ea9be73e7d13df6fb2793a1 upstream.
radix_tree_iter_retry() resets slot to NULL, but it doesn't reset tags.
Then NULL slot and non-zero iter.tags passed to radix_tree_next_slot()
leading to crash:
RIP: radix_tree_next_slot include/linux/radix-tree.h:473
find_get_pages_tag+0x334/0x930 mm/filemap.c:1452
....
Call Trace:
pagevec_lookup_tag+0x3a/0x80 mm/swap.c:960
mpage_prepare_extent_to_map+0x321/0xa90 fs/ext4/inode.c:2516
ext4_writepages+0x10be/0x2b20 fs/ext4/inode.c:2736
do_writepages+0x97/0x100 mm/page-writeback.c:2364
__filemap_fdatawrite_range+0x248/0x2e0 mm/filemap.c:300
filemap_write_and_wait_range+0x121/0x1b0 mm/filemap.c:490
ext4_sync_file+0x34d/0xdb0 fs/ext4/fsync.c:115
vfs_fsync_range+0x10a/0x250 fs/sync.c:195
vfs_fsync fs/sync.c:209
do_fsync+0x42/0x70 fs/sync.c:219
SYSC_fdatasync fs/sync.c:232
SyS_fdatasync+0x19/0x20 fs/sync.c:230
entry_SYSCALL_64_fastpath+0x23/0xc1 arch/x86/entry/entry_64.S:207
We must reset iterator's tags to bail out from radix_tree_next_slot()
and go to the slow-path in radix_tree_next_chunk().
Fixes: 46437f9a554f ("radix-tree: fix race in gang lookup")
Link: http://lkml.kernel.org/r/1468495196-10604-1-git-send-email-aryabinin@virtuozzo.com
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Acked-by: Konstantin Khlebnikov <koct9i@gmail.com>
Cc: Matthew Wilcox <willy@linux.intel.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Ross Zwisler <ross.zwisler@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
include/linux/radix-tree.h | 1 +
1 file changed, 1 insertion(+)
--- a/include/linux/radix-tree.h
+++ b/include/linux/radix-tree.h
@@ -399,6 +399,7 @@ static inline __must_check
void **radix_tree_iter_retry(struct radix_tree_iter *iter)
{
iter->next_index = iter->index;
+ iter->tags = 0;
return NULL;
}
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 22/96] pps: do not crash when failed to register
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (19 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 21/96] radix-tree: fix radix_tree_iter_retry() for tagged iterators Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 23/96] kernel/sysrq, watchdog, sched/core: Reset watchdog on all CPUs while processing sysrq-w Greg Kroah-Hartman
` (70 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jiri Slaby, Rodolfo Giometti,
Andrew Morton, Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jiri Slaby <jslaby@suse.cz>
commit 368301f2fe4b07e5fb71dba3cc566bc59eb6705f upstream.
With this command sequence:
modprobe plip
modprobe pps_parport
rmmod pps_parport
the partport_pps modules causes this crash:
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: parport_detach+0x1d/0x60 [pps_parport]
Oops: 0000 [#1] SMP
...
Call Trace:
parport_unregister_driver+0x65/0xc0 [parport]
SyS_delete_module+0x187/0x210
The sequence that builds up to this is:
1) plip is loaded and takes the parport device for exclusive use:
plip0: Parallel port at 0x378, using IRQ 7.
2) pps_parport then fails to grab the device:
pps_parport: parallel port PPS client
parport0: cannot grant exclusive access for device pps_parport
pps_parport: couldn't register with parport0
3) rmmod of pps_parport is then killed because it tries to access
pardev->name, but pardev (taken from port->cad) is NULL.
So add a check for NULL in the test there too.
Link: http://lkml.kernel.org/r/20160714115245.12651-1-jslaby@suse.cz
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Acked-by: Rodolfo Giometti <giometti@enneenne.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pps/clients/pps_parport.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/pps/clients/pps_parport.c
+++ b/drivers/pps/clients/pps_parport.c
@@ -195,7 +195,7 @@ static void parport_detach(struct parpor
struct pps_client_pp *device;
/* FIXME: oooh, this is ugly! */
- if (strcmp(pardev->name, KBUILD_MODNAME))
+ if (!pardev || strcmp(pardev->name, KBUILD_MODNAME))
/* not our port */
return;
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 23/96] kernel/sysrq, watchdog, sched/core: Reset watchdog on all CPUs while processing sysrq-w
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (20 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 22/96] pps: do not crash when failed to register Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 24/96] sched/debug: Fix deadlock when enabling sched events Greg Kroah-Hartman
` (69 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrey Ryabinin, Linus Torvalds,
Peter Zijlstra, Thomas Gleixner, Ingo Molnar
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Ryabinin <aryabinin@virtuozzo.com>
commit 57675cb976eff977aefb428e68e4e0236d48a9ff upstream.
Lengthy output of sysrq-w may take a lot of time on slow serial console.
Currently we reset NMI-watchdog on the current CPU to avoid spurious
lockup messages. Sometimes this doesn't work since softlockup watchdog
might trigger on another CPU which is waiting for an IPI to proceed.
We reset softlockup watchdogs on all CPUs, but we do this only after
listing all tasks, and this may be too late on a busy system.
So, reset watchdogs CPUs earlier, in for_each_process_thread() loop.
Signed-off-by: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: http://lkml.kernel.org/r/1465474805-14641-1-git-send-email-aryabinin@virtuozzo.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/core.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -4993,14 +4993,16 @@ void show_state_filter(unsigned long sta
/*
* reset the NMI-timeout, listing all files on a slow
* console might take a lot of time:
+ * Also, reset softlockup watchdogs on all CPUs, because
+ * another CPU might be blocked waiting for us to process
+ * an IPI.
*/
touch_nmi_watchdog();
+ touch_all_softlockup_watchdogs();
if (!state_filter || (p->state & state_filter))
sched_show_task(p);
}
- touch_all_softlockup_watchdogs();
-
#ifdef CONFIG_SCHED_DEBUG
sysrq_sched_debug_show();
#endif
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 24/96] sched/debug: Fix deadlock when enabling sched events
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (21 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 23/96] kernel/sysrq, watchdog, sched/core: Reset watchdog on all CPUs while processing sysrq-w Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 25/96] arc: unwind: warn only once if DW2_UNWIND is disabled Greg Kroah-Hartman
` (68 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Josh Poimboeuf, Linus Torvalds,
Matt Fleming, Mel Gorman, Mike Galbraith, Peter Zijlstra,
Srikar Dronamraju, Thomas Gleixner, Ingo Molnar
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josh Poimboeuf <jpoimboe@redhat.com>
commit eda8dca519269c92a0771668b3d5678792de7b78 upstream.
I see a hang when enabling sched events:
echo 1 > /sys/kernel/debug/tracing/events/sched/enable
The printk buffer shows:
BUG: spinlock recursion on CPU#1, swapper/1/0
lock: 0xffff88007d5d8c00, .magic: dead4ead, .owner: swapper/1/0, .owner_cpu: 1
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.7.0-rc2+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.1-20150318_183358- 04/01/2014
...
Call Trace:
<IRQ> [<ffffffff8143d663>] dump_stack+0x85/0xc2
[<ffffffff81115948>] spin_dump+0x78/0xc0
[<ffffffff81115aea>] do_raw_spin_lock+0x11a/0x150
[<ffffffff81891471>] _raw_spin_lock+0x61/0x80
[<ffffffff810e5466>] ? try_to_wake_up+0x256/0x4e0
[<ffffffff810e5466>] try_to_wake_up+0x256/0x4e0
[<ffffffff81891a0a>] ? _raw_spin_unlock_irqrestore+0x4a/0x80
[<ffffffff810e5705>] wake_up_process+0x15/0x20
[<ffffffff810cebb4>] insert_work+0x84/0xc0
[<ffffffff810ced7f>] __queue_work+0x18f/0x660
[<ffffffff810cf9a6>] queue_work_on+0x46/0x90
[<ffffffffa00cd95b>] drm_fb_helper_dirty.isra.11+0xcb/0xe0 [drm_kms_helper]
[<ffffffffa00cdac0>] drm_fb_helper_sys_imageblit+0x30/0x40 [drm_kms_helper]
[<ffffffff814babcd>] soft_cursor+0x1ad/0x230
[<ffffffff814ba379>] bit_cursor+0x649/0x680
[<ffffffff814b9d30>] ? update_attr.isra.2+0x90/0x90
[<ffffffff814b5e6a>] fbcon_cursor+0x14a/0x1c0
[<ffffffff81555ef8>] hide_cursor+0x28/0x90
[<ffffffff81558b6f>] vt_console_print+0x3bf/0x3f0
[<ffffffff81122c63>] call_console_drivers.constprop.24+0x183/0x200
[<ffffffff811241f4>] console_unlock+0x3d4/0x610
[<ffffffff811247f5>] vprintk_emit+0x3c5/0x610
[<ffffffff81124bc9>] vprintk_default+0x29/0x40
[<ffffffff811e965b>] printk+0x57/0x73
[<ffffffff810f7a9e>] enqueue_entity+0xc2e/0xc70
[<ffffffff810f7b39>] enqueue_task_fair+0x59/0xab0
[<ffffffff8106dcd9>] ? kvm_sched_clock_read+0x9/0x20
[<ffffffff8103fb39>] ? sched_clock+0x9/0x10
[<ffffffff810e3fcc>] activate_task+0x5c/0xa0
[<ffffffff810e4514>] ttwu_do_activate+0x54/0xb0
[<ffffffff810e5cea>] sched_ttwu_pending+0x7a/0xb0
[<ffffffff810e5e51>] scheduler_ipi+0x61/0x170
[<ffffffff81059e7f>] smp_trace_reschedule_interrupt+0x4f/0x2a0
[<ffffffff81893ba6>] trace_reschedule_interrupt+0x96/0xa0
<EOI> [<ffffffff8106e0d6>] ? native_safe_halt+0x6/0x10
[<ffffffff8110fb1d>] ? trace_hardirqs_on+0xd/0x10
[<ffffffff81040ac0>] default_idle+0x20/0x1a0
[<ffffffff8104147f>] arch_cpu_idle+0xf/0x20
[<ffffffff81102f8f>] default_idle_call+0x2f/0x50
[<ffffffff8110332e>] cpu_startup_entry+0x37e/0x450
[<ffffffff8105af70>] start_secondary+0x160/0x1a0
Note the hang only occurs when echoing the above from a physical serial
console, not from an ssh session.
The bug is caused by a deadlock where the task is trying to grab the rq
lock twice because printk()'s aren't safe in sched code.
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Matt Fleming <matt@codeblueprint.co.uk>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: Mike Galbraith <efault@gmx.de>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: cb2517653fcc ("sched/debug: Make schedstats a runtime tunable that is disabled by default")
Link: http://lkml.kernel.org/r/20160613073209.gdvdybiruljbkn3p@treble
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/fair.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -3194,7 +3194,7 @@ static inline void check_schedstat_requi
trace_sched_stat_iowait_enabled() ||
trace_sched_stat_blocked_enabled() ||
trace_sched_stat_runtime_enabled()) {
- pr_warn_once("Scheduler tracepoints stat_sleep, stat_iowait, "
+ printk_deferred_once("Scheduler tracepoints stat_sleep, stat_iowait, "
"stat_blocked and stat_runtime require the "
"kernel parameter schedstats=enabled or "
"kernel.sched_schedstats=1\n");
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 25/96] arc: unwind: warn only once if DW2_UNWIND is disabled
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (22 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 24/96] sched/debug: Fix deadlock when enabling sched events Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 26/96] ARC: unwind: ensure that .debug_frame is generated (vs. .eh_frame) Greg Kroah-Hartman
` (67 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexey Brodkin, Vineet Gupta
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Brodkin <Alexey.Brodkin@synopsys.com>
commit 9bd54517ee86cb164c734f72ea95aeba4804f10b upstream.
If CONFIG_ARC_DW2_UNWIND is disabled every time arc_unwind_core()
gets called following message gets printed in debug console:
----------------->8---------------
CONFIG_ARC_DW2_UNWIND needs to be enabled
----------------->8---------------
That message makes sense if user indeed wants to see a backtrace or
get nice function call-graphs in perf but what if user disabled
unwinder for the purpose? Why pollute his debug console?
So instead we'll warn user about possibly missing feature once and
let him decide if that was what he or she really wanted.
Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com>
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arc/kernel/stacktrace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/arch/arc/kernel/stacktrace.c
+++ b/arch/arc/kernel/stacktrace.c
@@ -142,7 +142,7 @@ arc_unwind_core(struct task_struct *tsk,
* prelogue is setup (callee regs saved and then fp set and not other
* way around
*/
- pr_warn("CONFIG_ARC_DW2_UNWIND needs to be enabled\n");
+ pr_warn_once("CONFIG_ARC_DW2_UNWIND needs to be enabled\n");
return 0;
#endif
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 26/96] ARC: unwind: ensure that .debug_frame is generated (vs. .eh_frame)
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (23 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 25/96] arc: unwind: warn only once if DW2_UNWIND is disabled Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 27/96] xen/pciback: Fix conf_space read/write overlap check Greg Kroah-Hartman
` (66 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Vineet Gupta
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vineet Gupta <vgupta@synopsys.com>
commit f52e126cc7476196f44f3c313b7d9f0699a881fc upstream.
With recent binutils update to support dwarf CFI pseudo-ops in gas, we
now get .eh_frame vs. .debug_frame. Although the call frame info is
exactly the same in both, the CIE differs, which the current kernel
unwinder can't cope with.
This broke both the kernel unwinder as well as loadable modules (latter
because of a new unhandled relo R_ARC_32_PCREL from .rela.eh_frame in
the module loader)
The ideal solution would be to switch unwinder to .eh_frame.
For now however we can make do by just ensureing .debug_frame is
generated by removing -fasynchronous-unwind-tables
.eh_frame generated with -gdwarf-2 -fasynchronous-unwind-tables
.debug_frame generated with -gdwarf-2
Fixes STAR 9001058196
Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/arc/Makefile | 2 --
1 file changed, 2 deletions(-)
--- a/arch/arc/Makefile
+++ b/arch/arc/Makefile
@@ -66,8 +66,6 @@ endif
endif
-cflags-$(CONFIG_ARC_DW2_UNWIND) += -fasynchronous-unwind-tables
-
# By default gcc 4.8 generates dwarf4 which kernel unwinder can't grok
ifeq ($(atleast_gcc48),y)
cflags-$(CONFIG_ARC_DW2_UNWIND) += -gdwarf-2
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 27/96] xen/pciback: Fix conf_space read/write overlap check.
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (24 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 26/96] ARC: unwind: ensure that .debug_frame is generated (vs. .eh_frame) Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 28/96] xen-blkfront: save uncompleted reqs in blkfront_resume() Greg Kroah-Hartman
` (65 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrey Grodzovsky, Boris Ostrovsky,
Jan Beulich, David Vrabel
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Grodzovsky <andrey2805@gmail.com>
commit 02ef871ecac290919ea0c783d05da7eedeffc10e upstream.
Current overlap check is evaluating to false a case where a filter
field is fully contained (proper subset) of a r/w request. This
change applies classical overlap check instead to include all the
scenarios.
More specifically, for (Hilscher GmbH CIFX 50E-DP(M/S)) device driver
the logic is such that the entire confspace is read and written in 4
byte chunks. In this case as an example, CACHE_LINE_SIZE,
LATENCY_TIMER and PCI_BIST are arriving together in one call to
xen_pcibk_config_write() with offset == 0xc and size == 4. With the
exsisting overlap check the LATENCY_TIMER field (offset == 0xd, length
== 1) is fully contained in the write request and hence is excluded
from write, which is incorrect.
Signed-off-by: Andrey Grodzovsky <andrey2805@gmail.com>
Reviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>
Reviewed-by: Jan Beulich <JBeulich@suse.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/xen-pciback/conf_space.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
--- a/drivers/xen/xen-pciback/conf_space.c
+++ b/drivers/xen/xen-pciback/conf_space.c
@@ -183,8 +183,7 @@ int xen_pcibk_config_read(struct pci_dev
field_start = OFFSET(cfg_entry);
field_end = OFFSET(cfg_entry) + field->size;
- if ((req_start >= field_start && req_start < field_end)
- || (req_end > field_start && req_end <= field_end)) {
+ if (req_end > field_start && field_end > req_start) {
err = conf_space_read(dev, cfg_entry, field_start,
&tmp_val);
if (err)
@@ -230,8 +229,7 @@ int xen_pcibk_config_write(struct pci_de
field_start = OFFSET(cfg_entry);
field_end = OFFSET(cfg_entry) + field->size;
- if ((req_start >= field_start && req_start < field_end)
- || (req_end > field_start && req_end <= field_end)) {
+ if (req_end > field_start && field_end > req_start) {
tmp_val = 0;
err = xen_pcibk_config_read(dev, field_start,
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 28/96] xen-blkfront: save uncompleted reqs in blkfront_resume()
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (25 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 27/96] xen/pciback: Fix conf_space read/write overlap check Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 29/96] xenbus: dont BUG() on user mode induced condition Greg Kroah-Hartman
` (64 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bob Liu, Konrad Rzeszutek Wilk
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bob Liu <bob.liu@oracle.com>
commit 7b427a59538a98161321aa46c13f4ea81b43f4eb upstream.
Uncompleted reqs used to be 'saved and resubmitted' in blkfront_recover() during
migration, but that's too late after multi-queue was introduced.
After a migrate to another host (which may not have multiqueue support), the
number of rings (block hardware queues) may be changed and the ring and shadow
structure will also be reallocated.
The blkfront_recover() then can't 'save and resubmit' the real
uncompleted reqs because shadow structure have been reallocated.
This patch fixes this issue by moving the 'save' logic out of
blkfront_recover() to earlier place in blkfront_resume().
The 'resubmit' is not changed and still in blkfront_recover().
Signed-off-by: Bob Liu <bob.liu@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/xen-blkfront.c | 91 ++++++++++++++++++-------------------------
1 file changed, 40 insertions(+), 51 deletions(-)
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -207,6 +207,9 @@ struct blkfront_info
struct blk_mq_tag_set tag_set;
struct blkfront_ring_info *rinfo;
unsigned int nr_rings;
+ /* Save uncomplete reqs and bios for migration. */
+ struct list_head requests;
+ struct bio_list bio_list;
};
static unsigned int nr_minors;
@@ -2007,69 +2010,22 @@ static int blkif_recover(struct blkfront
{
unsigned int i, r_index;
struct request *req, *n;
- struct blk_shadow *copy;
int rc;
struct bio *bio, *cloned_bio;
- struct bio_list bio_list, merge_bio;
unsigned int segs, offset;
int pending, size;
struct split_bio *split_bio;
- struct list_head requests;
blkfront_gather_backend_features(info);
segs = info->max_indirect_segments ? : BLKIF_MAX_SEGMENTS_PER_REQUEST;
blk_queue_max_segments(info->rq, segs);
- bio_list_init(&bio_list);
- INIT_LIST_HEAD(&requests);
for (r_index = 0; r_index < info->nr_rings; r_index++) {
- struct blkfront_ring_info *rinfo;
-
- rinfo = &info->rinfo[r_index];
- /* Stage 1: Make a safe copy of the shadow state. */
- copy = kmemdup(rinfo->shadow, sizeof(rinfo->shadow),
- GFP_NOIO | __GFP_REPEAT | __GFP_HIGH);
- if (!copy)
- return -ENOMEM;
-
- /* Stage 2: Set up free list. */
- memset(&rinfo->shadow, 0, sizeof(rinfo->shadow));
- for (i = 0; i < BLK_RING_SIZE(info); i++)
- rinfo->shadow[i].req.u.rw.id = i+1;
- rinfo->shadow_free = rinfo->ring.req_prod_pvt;
- rinfo->shadow[BLK_RING_SIZE(info)-1].req.u.rw.id = 0x0fffffff;
+ struct blkfront_ring_info *rinfo = &info->rinfo[r_index];
rc = blkfront_setup_indirect(rinfo);
- if (rc) {
- kfree(copy);
+ if (rc)
return rc;
- }
-
- for (i = 0; i < BLK_RING_SIZE(info); i++) {
- /* Not in use? */
- if (!copy[i].request)
- continue;
-
- /*
- * Get the bios in the request so we can re-queue them.
- */
- if (copy[i].request->cmd_flags &
- (REQ_FLUSH | REQ_FUA | REQ_DISCARD | REQ_SECURE)) {
- /*
- * Flush operations don't contain bios, so
- * we need to requeue the whole request
- */
- list_add(©[i].request->queuelist, &requests);
- continue;
- }
- merge_bio.head = copy[i].request->bio;
- merge_bio.tail = copy[i].request->biotail;
- bio_list_merge(&bio_list, &merge_bio);
- copy[i].request->bio = NULL;
- blk_end_request_all(copy[i].request, 0);
- }
-
- kfree(copy);
}
xenbus_switch_state(info->xbdev, XenbusStateConnected);
@@ -2084,7 +2040,7 @@ static int blkif_recover(struct blkfront
kick_pending_request_queues(rinfo);
}
- list_for_each_entry_safe(req, n, &requests, queuelist) {
+ list_for_each_entry_safe(req, n, &info->requests, queuelist) {
/* Requeue pending requests (flush or discard) */
list_del_init(&req->queuelist);
BUG_ON(req->nr_phys_segments > segs);
@@ -2092,7 +2048,7 @@ static int blkif_recover(struct blkfront
}
blk_mq_kick_requeue_list(info->rq);
- while ((bio = bio_list_pop(&bio_list)) != NULL) {
+ while ((bio = bio_list_pop(&info->bio_list)) != NULL) {
/* Traverse the list of pending bios and re-queue them */
if (bio_segments(bio) > segs) {
/*
@@ -2138,9 +2094,42 @@ static int blkfront_resume(struct xenbus
{
struct blkfront_info *info = dev_get_drvdata(&dev->dev);
int err = 0;
+ unsigned int i, j;
dev_dbg(&dev->dev, "blkfront_resume: %s\n", dev->nodename);
+ bio_list_init(&info->bio_list);
+ INIT_LIST_HEAD(&info->requests);
+ for (i = 0; i < info->nr_rings; i++) {
+ struct blkfront_ring_info *rinfo = &info->rinfo[i];
+ struct bio_list merge_bio;
+ struct blk_shadow *shadow = rinfo->shadow;
+
+ for (j = 0; j < BLK_RING_SIZE(info); j++) {
+ /* Not in use? */
+ if (!shadow[j].request)
+ continue;
+
+ /*
+ * Get the bios in the request so we can re-queue them.
+ */
+ if (shadow[j].request->cmd_flags &
+ (REQ_FLUSH | REQ_FUA | REQ_DISCARD | REQ_SECURE)) {
+ /*
+ * Flush operations don't contain bios, so
+ * we need to requeue the whole request
+ */
+ list_add(&shadow[j].request->queuelist, &info->requests);
+ continue;
+ }
+ merge_bio.head = shadow[j].request->bio;
+ merge_bio.tail = shadow[j].request->biotail;
+ bio_list_merge(&info->bio_list, &merge_bio);
+ shadow[j].request->bio = NULL;
+ blk_mq_end_request(shadow[j].request, 0);
+ }
+ }
+
blkif_free(info, info->connected == BLKIF_STATE_CONNECTED);
err = negotiate_mq(info);
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 29/96] xenbus: dont BUG() on user mode induced condition
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (26 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 28/96] xen-blkfront: save uncompleted reqs in blkfront_resume() Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 30/96] xenbus: dont bail early from xenbus_dev_request_and_reply() Greg Kroah-Hartman
` (63 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jan Beulich, David Vrabel
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Beulich <JBeulich@suse.com>
commit 0beef634b86a1350c31da5fcc2992f0d7c8a622b upstream.
Inability to locate a user mode specified transaction ID should not
lead to a kernel crash. For other than XS_TRANSACTION_START also
don't issue anything to xenbus if the specified ID doesn't match that
of any active transaction.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/xenbus/xenbus_dev_frontend.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
--- a/drivers/xen/xenbus/xenbus_dev_frontend.c
+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c
@@ -316,11 +316,18 @@ static int xenbus_write_transaction(unsi
rc = -ENOMEM;
goto out;
}
+ } else {
+ list_for_each_entry(trans, &u->transactions, list)
+ if (trans->handle.id == u->u.msg.tx_id)
+ break;
+ if (&trans->list == &u->transactions)
+ return -ESRCH;
}
reply = xenbus_dev_request_and_reply(&u->u.msg);
if (IS_ERR(reply)) {
- kfree(trans);
+ if (msg_type == XS_TRANSACTION_START)
+ kfree(trans);
rc = PTR_ERR(reply);
goto out;
}
@@ -333,12 +340,7 @@ static int xenbus_write_transaction(unsi
list_add(&trans->list, &u->transactions);
}
} else if (u->u.msg.type == XS_TRANSACTION_END) {
- list_for_each_entry(trans, &u->transactions, list)
- if (trans->handle.id == u->u.msg.tx_id)
- break;
- BUG_ON(&trans->list == &u->transactions);
list_del(&trans->list);
-
kfree(trans);
}
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 30/96] xenbus: dont bail early from xenbus_dev_request_and_reply()
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (27 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 29/96] xenbus: dont BUG() on user mode induced condition Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 31/96] xen-blkfront: fix resume issues after a migration Greg Kroah-Hartman
` (62 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jan Beulich, Konrad Rzeszutek Wilk,
David Vrabel
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jan Beulich <JBeulich@suse.com>
commit 7469be95a487319514adce2304ad2af3553d2fc9 upstream.
xenbus_dev_request_and_reply() needs to track whether a transaction is
open. For XS_TRANSACTION_START messages it calls transaction_start()
and for XS_TRANSACTION_END messages it calls transaction_end().
If sending an XS_TRANSACTION_START message fails or responds with an
an error, the transaction is not open and transaction_end() must be
called.
If sending an XS_TRANSACTION_END message fails, the transaction is
still open, but if an error response is returned the transaction is
closed.
Commit 027bd7e89906 ("xen/xenbus: Avoid synchronous wait on XenBus
stalling shutdown/restart") introduced a regression where failed
XS_TRANSACTION_START messages were leaving the transaction open. This
can cause problems with suspend (and migration) as all transactions
must be closed before suspending.
It appears that the problematic change was added accidentally, so just
remove it.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/xenbus/xenbus_xs.c | 3 ---
1 file changed, 3 deletions(-)
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -249,9 +249,6 @@ void *xenbus_dev_request_and_reply(struc
mutex_unlock(&xs_state.request_mutex);
- if (IS_ERR(ret))
- return ret;
-
if ((msg->type == XS_TRANSACTION_END) ||
((req_msg.type == XS_TRANSACTION_START) &&
(msg->type == XS_ERROR)))
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 31/96] xen-blkfront: fix resume issues after a migration
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (28 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 30/96] xenbus: dont bail early from xenbus_dev_request_and_reply() Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 32/96] xen-blkfront: dont call talk_to_blkback when already connected to blkback Greg Kroah-Hartman
` (61 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bob Liu, Konrad Rzeszutek Wilk
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bob Liu <bob.liu@oracle.com>
commit 2a6f71ad99cabe436e70c3f5fcf58072cb3bc07f upstream.
After a migrate to another host (which may not have multiqueue
support), the number of rings (block hardware queues)
may be changed and the ring info structure will also be reallocated.
This patch fixes two related bugs:
* call blk_mq_update_nr_hw_queues() to make blk-core know the number
of hardware queues have been changed.
* Don't store rinfo pointer to hctx->driver_data, because rinfo may be
reallocated so use hctx->queue_num to get the rinfo structure instead.
Signed-off-by: Bob Liu <bob.liu@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/xen-blkfront.c | 20 ++++++++------------
1 file changed, 8 insertions(+), 12 deletions(-)
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -877,8 +877,12 @@ static int blkif_queue_rq(struct blk_mq_
const struct blk_mq_queue_data *qd)
{
unsigned long flags;
- struct blkfront_ring_info *rinfo = (struct blkfront_ring_info *)hctx->driver_data;
+ int qid = hctx->queue_num;
+ struct blkfront_info *info = hctx->queue->queuedata;
+ struct blkfront_ring_info *rinfo = NULL;
+ BUG_ON(info->nr_rings <= qid);
+ rinfo = &info->rinfo[qid];
blk_mq_start_request(qd->rq);
spin_lock_irqsave(&rinfo->ring_lock, flags);
if (RING_FULL(&rinfo->ring))
@@ -904,20 +908,9 @@ out_busy:
return BLK_MQ_RQ_QUEUE_BUSY;
}
-static int blk_mq_init_hctx(struct blk_mq_hw_ctx *hctx, void *data,
- unsigned int index)
-{
- struct blkfront_info *info = (struct blkfront_info *)data;
-
- BUG_ON(info->nr_rings <= index);
- hctx->driver_data = &info->rinfo[index];
- return 0;
-}
-
static struct blk_mq_ops blkfront_mq_ops = {
.queue_rq = blkif_queue_rq,
.map_queue = blk_mq_map_queue,
- .init_hctx = blk_mq_init_hctx,
};
static int xlvbd_init_blk_queue(struct gendisk *gd, u16 sector_size,
@@ -953,6 +946,7 @@ static int xlvbd_init_blk_queue(struct g
return PTR_ERR(rq);
}
+ rq->queuedata = info;
queue_flag_set_unlocked(QUEUE_FLAG_VIRT, rq);
if (info->feature_discard) {
@@ -2137,6 +2131,8 @@ static int blkfront_resume(struct xenbus
return err;
err = talk_to_blkback(dev, info);
+ if (!err)
+ blk_mq_update_nr_hw_queues(&info->tag_set, info->nr_rings);
/*
* We have to wait for the backend to switch to
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 32/96] xen-blkfront: dont call talk_to_blkback when already connected to blkback
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (29 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 31/96] xen-blkfront: fix resume issues after a migration Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 36/96] Input: vmmouse - remove port reservation Greg Kroah-Hartman
` (60 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Bob Liu, Konrad Rzeszutek Wilk
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bob Liu <bob.liu@oracle.com>
commit efd1535270c1deb0487527bf0c3c827301a69c93 upstream.
Sometimes blkfront may twice receive blkback_changed() notification
(XenbusStateConnected) after migration, which will cause
talk_to_blkback() to be called twice too and confuse xen-blkback.
The flow is as follow:
blkfront blkback
blkfront_resume()
> talk_to_blkback()
> Set blkfront to XenbusStateInitialised
front changed()
> Connect()
> Set blkback to XenbusStateConnected
blkback_changed()
> Skip talk_to_blkback()
because frontstate == XenbusStateInitialised
> blkfront_connect()
> Set blkfront to XenbusStateConnected
-----
And here we get another XenbusStateConnected notification leading
to:
-----
blkback_changed()
> because now frontstate != XenbusStateInitialised
talk_to_blkback() is also called again
> blkfront state changed from
XenbusStateConnected to XenbusStateInitialised
(Which is not correct!)
front_changed():
> Do nothing because blkback
already in XenbusStateConnected
Now blkback is in XenbusStateConnected but blkfront is still
in XenbusStateInitialised - leading to no disks.
Poking of the XenbusStateConnected state is allowed (to deal with
block disk change) and has to be dealt with. The most likely
cause of this bug are custom udev scripts hooking up the disks
and then validating the size.
Signed-off-by: Bob Liu <bob.liu@oracle.com>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/block/xen-blkfront.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
--- a/drivers/block/xen-blkfront.c
+++ b/drivers/block/xen-blkfront.c
@@ -2469,10 +2469,23 @@ static void blkback_changed(struct xenbu
break;
case XenbusStateConnected:
- if (dev->state != XenbusStateInitialised) {
+ /*
+ * talk_to_blkback sets state to XenbusStateInitialised
+ * and blkfront_connect sets it to XenbusStateConnected
+ * (if connection went OK).
+ *
+ * If the backend (or toolstack) decides to poke at backend
+ * state (and re-trigger the watch by setting the state repeatedly
+ * to XenbusStateConnected (4)) we need to deal with this.
+ * This is allowed as this is used to communicate to the guest
+ * that the size of disk has changed!
+ */
+ if ((dev->state != XenbusStateInitialised) &&
+ (dev->state != XenbusStateConnected)) {
if (talk_to_blkback(dev, info))
break;
}
+
blkfront_connect(info);
break;
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 36/96] Input: vmmouse - remove port reservation
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (30 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 32/96] xen-blkfront: dont call talk_to_blkback when already connected to blkback Greg Kroah-Hartman
@ 2016-08-08 19:10 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 37/96] Input: elantech - add more IC body types to the list Greg Kroah-Hartman
` (59 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sinclair Yeh, Thomas Hellstrom,
Dmitry Torokhov
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sinclair Yeh <syeh@vmware.com>
commit 60842ef8128e7bf58c024814cd0dc14319232b6c upstream.
The VMWare EFI BIOS will expose port 0x5658 as an ACPI resource. This
causes the port to be reserved by the APCI module as the system comes up,
making it unavailable to be reserved again by other drivers, thus
preserving this VMWare port for special use in a VMWare guest.
This port is designed to be shared among multiple VMWare services, such as
the VMMOUSE. Because of this, VMMOUSE should not try to reserve this port
on its own.
The VMWare non-EFI BIOS does not do this to preserve compatibility with
existing/legacy VMs. It is known that there is small chance a VM may be
configured such that these ports get reserved by other non-VMWare devices,
and if this ever happens, the result is undefined.
Signed-off-by: Sinclair Yeh <syeh@vmware.com>
Reviewed-by: Thomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/mouse/vmmouse.c | 22 ++--------------------
1 file changed, 2 insertions(+), 20 deletions(-)
--- a/drivers/input/mouse/vmmouse.c
+++ b/drivers/input/mouse/vmmouse.c
@@ -355,18 +355,11 @@ int vmmouse_detect(struct psmouse *psmou
return -ENXIO;
}
- if (!request_region(VMMOUSE_PROTO_PORT, 4, "vmmouse")) {
- psmouse_dbg(psmouse, "VMMouse port in use.\n");
- return -EBUSY;
- }
-
/* Check if the device is present */
response = ~VMMOUSE_PROTO_MAGIC;
VMMOUSE_CMD(GETVERSION, 0, version, response, dummy1, dummy2);
- if (response != VMMOUSE_PROTO_MAGIC || version == 0xffffffffU) {
- release_region(VMMOUSE_PROTO_PORT, 4);
+ if (response != VMMOUSE_PROTO_MAGIC || version == 0xffffffffU)
return -ENXIO;
- }
if (set_properties) {
psmouse->vendor = VMMOUSE_VENDOR;
@@ -374,8 +367,6 @@ int vmmouse_detect(struct psmouse *psmou
psmouse->model = version;
}
- release_region(VMMOUSE_PROTO_PORT, 4);
-
return 0;
}
@@ -394,7 +385,6 @@ static void vmmouse_disconnect(struct ps
psmouse_reset(psmouse);
input_unregister_device(priv->abs_dev);
kfree(priv);
- release_region(VMMOUSE_PROTO_PORT, 4);
}
/**
@@ -438,15 +428,10 @@ int vmmouse_init(struct psmouse *psmouse
struct input_dev *rel_dev = psmouse->dev, *abs_dev;
int error;
- if (!request_region(VMMOUSE_PROTO_PORT, 4, "vmmouse")) {
- psmouse_dbg(psmouse, "VMMouse port in use.\n");
- return -EBUSY;
- }
-
psmouse_reset(psmouse);
error = vmmouse_enable(psmouse);
if (error)
- goto release_region;
+ return error;
priv = kzalloc(sizeof(*priv), GFP_KERNEL);
abs_dev = input_allocate_device();
@@ -502,8 +487,5 @@ init_fail:
kfree(priv);
psmouse->private = NULL;
-release_region:
- release_region(VMMOUSE_PROTO_PORT, 4);
-
return error;
}
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 37/96] Input: elantech - add more IC body types to the list
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (31 preceding siblings ...)
2016-08-08 19:10 ` [PATCH 4.6 36/96] Input: vmmouse - remove port reservation Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 38/96] Input: xpad - fix oops when attaching an unknown Xbox One gamepad Greg Kroah-Hartman
` (58 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Patrick Lessard, Dmitry Torokhov
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit 226ba707744a51acb4244724e09caacb1d96aed9 upstream.
The touchpad in HP Pavilion 14-ab057ca reports it's version as 12 and
according to Elan both 11 and 12 are valid IC types and should be
identified as hw_version 4.
Reported-by: Patrick Lessard <Patrick.Lessard@cogeco.com>
Tested-by: Patrick Lessard <Patrick.Lessard@cogeco.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/mouse/elantech.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
--- a/drivers/input/mouse/elantech.c
+++ b/drivers/input/mouse/elantech.c
@@ -1568,13 +1568,7 @@ static int elantech_set_properties(struc
case 5:
etd->hw_version = 3;
break;
- case 6:
- case 7:
- case 8:
- case 9:
- case 10:
- case 13:
- case 14:
+ case 6 ... 14:
etd->hw_version = 4;
break;
default:
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 38/96] Input: xpad - fix oops when attaching an unknown Xbox One gamepad
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (32 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 37/96] Input: elantech - add more IC body types to the list Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 39/96] Input: wacom_w8001 - w8001_MAX_LENGTH should be 13 Greg Kroah-Hartman
` (57 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Cameron Gutman, Dmitry Torokhov
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cameron Gutman <aicommander@gmail.com>
commit c7f1429389ec1aa25e042bb13451385fbb596f8c upstream.
Xbox One controllers have multiple interfaces which all have the
same class, subclass, and protocol. One of the these interfaces
has only a single endpoint. When Xpad attempts to bind to this
interface, it causes an oops when trying initialize the output URB
by trying to access the second endpoint's descriptor.
This situation was avoided for known Xbox One devices by checking
the XTYPE constant associated with the VID and PID tuple. However,
this breaks when new or previously unknown Xbox One controllers
are attached to the system.
This change addresses the problem by deriving the XTYPE for Xbox
One controllers based on the interface protocol before checking
the interface number.
Fixes: 1a48ff81b391 ("Input: xpad - add support for Xbox One controllers")
Signed-off-by: Cameron Gutman <aicommander@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/joystick/xpad.c | 23 +++++++++++++----------
1 file changed, 13 insertions(+), 10 deletions(-)
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -1427,16 +1427,6 @@ static int xpad_probe(struct usb_interfa
break;
}
- if (xpad_device[i].xtype == XTYPE_XBOXONE &&
- intf->cur_altsetting->desc.bInterfaceNumber != 0) {
- /*
- * The Xbox One controller lists three interfaces all with the
- * same interface class, subclass and protocol. Differentiate by
- * interface number.
- */
- return -ENODEV;
- }
-
xpad = kzalloc(sizeof(struct usb_xpad), GFP_KERNEL);
if (!xpad)
return -ENOMEM;
@@ -1468,6 +1458,8 @@ static int xpad_probe(struct usb_interfa
if (intf->cur_altsetting->desc.bInterfaceClass == USB_CLASS_VENDOR_SPEC) {
if (intf->cur_altsetting->desc.bInterfaceProtocol == 129)
xpad->xtype = XTYPE_XBOX360W;
+ else if (intf->cur_altsetting->desc.bInterfaceProtocol == 208)
+ xpad->xtype = XTYPE_XBOXONE;
else
xpad->xtype = XTYPE_XBOX360;
} else {
@@ -1482,6 +1474,17 @@ static int xpad_probe(struct usb_interfa
xpad->mapping |= MAP_STICKS_TO_NULL;
}
+ if (xpad->xtype == XTYPE_XBOXONE &&
+ intf->cur_altsetting->desc.bInterfaceNumber != 0) {
+ /*
+ * The Xbox One controller lists three interfaces all with the
+ * same interface class, subclass and protocol. Differentiate by
+ * interface number.
+ */
+ error = -ENODEV;
+ goto err_free_in_urb;
+ }
+
error = xpad_init_output(intf, xpad);
if (error)
goto err_free_in_urb;
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 39/96] Input: wacom_w8001 - w8001_MAX_LENGTH should be 13
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (33 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 38/96] Input: xpad - fix oops when attaching an unknown Xbox One gamepad Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 40/96] Input: wacom_w8001 - ignore invalid pen data packets Greg Kroah-Hartman
` (56 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ping Cheng, Peter Hutterer, Dmitry Torokhov
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping Cheng <pinglinux@gmail.com>
commit 12afb34400eb2b301f06b2aa3535497d14faee59 upstream.
Somehow the patch that added two-finger touch support forgot to update
W8001_MAX_LENGTH from 11 to 13.
Signed-off-by: Ping Cheng <pingc@wacom.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/touchscreen/wacom_w8001.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/input/touchscreen/wacom_w8001.c
+++ b/drivers/input/touchscreen/wacom_w8001.c
@@ -27,7 +27,7 @@ MODULE_AUTHOR("Jaya Kumar <jayakumar.lkm
MODULE_DESCRIPTION(DRIVER_DESC);
MODULE_LICENSE("GPL");
-#define W8001_MAX_LENGTH 11
+#define W8001_MAX_LENGTH 13
#define W8001_LEAD_MASK 0x80
#define W8001_LEAD_BYTE 0x80
#define W8001_TAB_MASK 0x40
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 40/96] Input: wacom_w8001 - ignore invalid pen data packets
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (34 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 39/96] Input: wacom_w8001 - w8001_MAX_LENGTH should be 13 Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 41/96] Input: xpad - validate USB endpoint count during probe Greg Kroah-Hartman
` (55 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris J Arges, Ping Cheng,
Peter Hutterer, Dmitry Torokhov
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ping Cheng <pinglinux@gmail.com>
commit 9e72ac7492149a229ce9039c680849cb682d7092 upstream.
ThinkPad X60 Tablet PC (pen only device) sometime posts
packets that are larger than W8001_PKTLEN_TPCPEN.
Reported-by: Chris J Arges <christopherarges@gmail.com>
Tested-by: Chris J Arges <christopherarges@gmail.com>
Signed-off-by: Ping Cheng <pingc@wacom.com>
Reviewed-by: Peter Hutterer <peter.hutterer@who-t.net>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/touchscreen/wacom_w8001.c | 9 +++++++++
1 file changed, 9 insertions(+)
--- a/drivers/input/touchscreen/wacom_w8001.c
+++ b/drivers/input/touchscreen/wacom_w8001.c
@@ -339,6 +339,15 @@ static irqreturn_t w8001_interrupt(struc
w8001->idx = 0;
parse_multi_touch(w8001);
break;
+
+ default:
+ /*
+ * ThinkPad X60 Tablet PC (pen only device) sometimes
+ * sends invalid data packets that are larger than
+ * W8001_PKTLEN_TPCPEN. Let's start over again.
+ */
+ if (!w8001->touch_dev && w8001->idx > W8001_PKTLEN_TPCPEN - 1)
+ w8001->idx = 0;
}
return IRQ_HANDLED;
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 41/96] Input: xpad - validate USB endpoint count during probe
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (35 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 40/96] Input: wacom_w8001 - ignore invalid pen data packets Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 42/96] Revert "Input: wacom_w8001 - drop use of ABS_MT_TOOL_TYPE" Greg Kroah-Hartman
` (54 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Cameron Gutman, Dmitry Torokhov
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Cameron Gutman <aicommander@gmail.com>
commit caca925fca4fb30c67be88cacbe908eec6721e43 upstream.
This prevents a malicious USB device from causing an oops.
Signed-off-by: Cameron Gutman <aicommander@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/joystick/xpad.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/input/joystick/xpad.c
+++ b/drivers/input/joystick/xpad.c
@@ -1421,6 +1421,9 @@ static int xpad_probe(struct usb_interfa
int ep_irq_in_idx;
int i, error;
+ if (intf->cur_altsetting->desc.bNumEndpoints != 2)
+ return -ENODEV;
+
for (i = 0; xpad_device[i].idVendor; i++) {
if ((le16_to_cpu(udev->descriptor.idVendor) == xpad_device[i].idVendor) &&
(le16_to_cpu(udev->descriptor.idProduct) == xpad_device[i].idProduct))
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 42/96] Revert "Input: wacom_w8001 - drop use of ABS_MT_TOOL_TYPE"
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (36 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 41/96] Input: xpad - validate USB endpoint count during probe Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 43/96] Input: synaptics-rmi4 - fix maximum size check for F12 control register 8 Greg Kroah-Hartman
` (53 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Peter Hutterer, Ping Cheng
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
commit 3e9161bfe0482f26efeaf584d5fd69398c69313c upstream.
This reverts commit 5f7e5445a2de848c66d2d80ba5479197e8287c33 because
removal of input_mt_report_slot_state() means we no longer generate
tracking IDs for the reported contacts.
Acked-by: Peter Hutterer <peter.hutterer@who-t.net>
Acked-by: Ping Cheng <pinglinux@gmail.com>
---
drivers/input/touchscreen/wacom_w8001.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/input/touchscreen/wacom_w8001.c
+++ b/drivers/input/touchscreen/wacom_w8001.c
@@ -155,6 +155,7 @@ static void parse_multi_touch(struct w80
bool touch = data[0] & (1 << i);
input_mt_slot(dev, i);
+ input_mt_report_slot_state(dev, MT_TOOL_FINGER, touch);
if (touch) {
x = (data[6 * i + 1] << 7) | data[6 * i + 2];
y = (data[6 * i + 3] << 7) | data[6 * i + 4];
@@ -522,6 +523,8 @@ static int w8001_setup_touch(struct w800
0, touch.x, 0, 0);
input_set_abs_params(dev, ABS_MT_POSITION_Y,
0, touch.y, 0, 0);
+ input_set_abs_params(dev, ABS_MT_TOOL_TYPE,
+ 0, MT_TOOL_MAX, 0, 0);
strlcat(basename, " 2FG", basename_sz);
if (w8001->max_pen_x && w8001->max_pen_y)
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 43/96] Input: synaptics-rmi4 - fix maximum size check for F12 control register 8
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (37 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 42/96] Revert "Input: wacom_w8001 - drop use of ABS_MT_TOOL_TYPE" Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 45/96] pvclock: Add CPU barriers to get correct version value Greg Kroah-Hartman
` (52 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Andrew Duggan, Chris Healy, Dmitry Torokhov
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrew Duggan <aduggan@synaptics.com>
commit e4add7b6beaff4061693d0632bc1dcb306edba10 upstream.
According to the RMI4 spec the maximum size of F12 control register 8 is
15 bytes. The current code incorrectly reports an error if control 8 is
greater then 14. Making sensors with a control register 8 with 15 bytes
unusable.
Signed-off-by: Andrew Duggan <aduggan@synaptics.com>
Reported-by: Chris Healy <cphealy@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/input/rmi4/rmi_f12.c | 9 +++++----
1 file changed, 5 insertions(+), 4 deletions(-)
--- a/drivers/input/rmi4/rmi_f12.c
+++ b/drivers/input/rmi4/rmi_f12.c
@@ -66,7 +66,7 @@ static int rmi_f12_read_sensor_tuning(st
struct rmi_device *rmi_dev = fn->rmi_dev;
int ret;
int offset;
- u8 buf[14];
+ u8 buf[15];
int pitch_x = 0;
int pitch_y = 0;
int clip_x_low = 0;
@@ -86,9 +86,10 @@ static int rmi_f12_read_sensor_tuning(st
offset = rmi_register_desc_calc_reg_offset(&f12->control_reg_desc, 8);
- if (item->reg_size > 14) {
- dev_err(&fn->dev, "F12 control8 should be 14 bytes, not: %ld\n",
- item->reg_size);
+ if (item->reg_size > sizeof(buf)) {
+ dev_err(&fn->dev,
+ "F12 control8 should be no bigger than %zd bytes, not: %ld\n",
+ sizeof(buf), item->reg_size);
return -ENODEV;
}
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 45/96] pvclock: Add CPU barriers to get correct version value
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (38 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 43/96] Input: synaptics-rmi4 - fix maximum size check for F12 control register 8 Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 46/96] pinctrl: single: Fix missing flush of posted write for a wakeirq Greg Kroah-Hartman
` (51 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Minfei Huang, Paolo Bonzini
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Minfei Huang <mnghuan@gmail.com>
commit 749d088b8e7f4b9826ede02b9a043e417fa84aa1 upstream.
Protocol for the "version" fields is: hypervisor raises it (making it
uneven) before it starts updating the fields and raises it again (making
it even) when it is done. Thus the guest can make sure the time values
it got are consistent by checking the version before and after reading
them.
Add CPU barries after getting version value just like what function
vread_pvclock does, because all of callees in this function is inline.
Fixes: 502dfeff239e8313bfbe906ca0a1a6827ac8481b
Signed-off-by: Minfei Huang <mnghuan@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
arch/x86/include/asm/pvclock.h | 2 ++
arch/x86/kernel/pvclock.c | 4 ++++
2 files changed, 6 insertions(+)
--- a/arch/x86/include/asm/pvclock.h
+++ b/arch/x86/include/asm/pvclock.h
@@ -85,6 +85,8 @@ unsigned __pvclock_read_cycles(const str
u8 ret_flags;
version = src->version;
+ /* Make the latest version visible */
+ smp_rmb();
offset = pvclock_get_nsec_offset(src);
ret = src->system_time + offset;
--- a/arch/x86/kernel/pvclock.c
+++ b/arch/x86/kernel/pvclock.c
@@ -66,6 +66,8 @@ u8 pvclock_read_flags(struct pvclock_vcp
do {
version = __pvclock_read_cycles(src, &ret, &flags);
+ /* Make sure that the version double-check is last. */
+ smp_rmb();
} while ((src->version & 1) || version != src->version);
return flags & valid_flags;
@@ -80,6 +82,8 @@ cycle_t pvclock_clocksource_read(struct
do {
version = __pvclock_read_cycles(src, &ret, &flags);
+ /* Make sure that the version double-check is last. */
+ smp_rmb();
} while ((src->version & 1) || version != src->version);
if (unlikely((flags & PVCLOCK_GUEST_STOPPED) != 0)) {
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 46/96] pinctrl: single: Fix missing flush of posted write for a wakeirq
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (39 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 45/96] pvclock: Add CPU barriers to get correct version value Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 47/96] pinctrl: imx: Do not treat a PIN without MUX register as an error Greg Kroah-Hartman
` (50 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Nishanth Menon, Tony Lindgren, Linus Walleij
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tony Lindgren <tony@atomide.com>
commit 0ac3c0a4025f41748a083bdd4970cb3ede802b15 upstream.
With many repeated suspend resume cycles, the pin specific wakeirq
may not always work on omaps. This is because the write to enable the
pin interrupt may not have reached the device over the interconnect
before suspend happens.
Let's fix the issue with a flush of posted write with a readback.
Reported-by: Nishanth Menon <nm@ti.com>
Signed-off-by: Tony Lindgren <tony@atomide.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/pinctrl-single.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/pinctrl/pinctrl-single.c
+++ b/drivers/pinctrl/pinctrl-single.c
@@ -1580,6 +1580,9 @@ static inline void pcs_irq_set(struct pc
else
mask &= ~soc_mask;
pcs->write(mask, pcswi->reg);
+
+ /* flush posted write */
+ mask = pcs->read(pcswi->reg);
raw_spin_unlock(&pcs->lock);
}
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 47/96] pinctrl: imx: Do not treat a PIN without MUX register as an error
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (40 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 46/96] pinctrl: single: Fix missing flush of posted write for a wakeirq Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 48/96] cgroup: remove redundant cleanup in css_create Greg Kroah-Hartman
` (49 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexander Shiyan, Linus Walleij
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shiyan <shc_work@mail.ru>
commit ba562d5e54fd3136bfea0457add3675850247774 upstream.
Some PINs do not have a MUX register, it is not an error.
It is necessary to allow the continuation of the PINs configuration,
otherwise the whole PIN-group will be configured incorrectly.
Signed-off-by: Alexander Shiyan <shc_work@mail.ru>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/pinctrl/freescale/pinctrl-imx.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/pinctrl/freescale/pinctrl-imx.c
+++ b/drivers/pinctrl/freescale/pinctrl-imx.c
@@ -209,9 +209,9 @@ static int imx_pmx_set(struct pinctrl_de
pin_reg = &info->pin_regs[pin_id];
if (pin_reg->mux_reg == -1) {
- dev_err(ipctl->dev, "Pin(%s) does not support mux function\n",
+ dev_dbg(ipctl->dev, "Pin(%s) does not support mux function\n",
info->pins[pin_id].name);
- return -EINVAL;
+ continue;
}
if (info->flags & SHARE_MUX_CONF_REG) {
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 48/96] cgroup: remove redundant cleanup in css_create
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (41 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 47/96] pinctrl: imx: Do not treat a PIN without MUX register as an error Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 49/96] cgroup: set css->id to -1 during init Greg Kroah-Hartman
` (48 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wenwei Tao, Tejun Heo, Vladimir Davydov
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wenwei Tao <ww.tao0320@gmail.com>
commit b00c52dae6d9ee8d0f2407118ef6544ae5524781 upstream.
When create css failed, before call css_free_rcu_fn, we remove the css
id and exit the percpu_ref, but we will do these again in
css_free_work_fn, so they are redundant. Especially the css id, that
would cause problem if we remove it twice, since it may be assigned to
another css after the first remove.
tj: This was broken by two commits updating the free path without
synchronizing the creation failure path. This can be easily
triggered by trying to create more than 64k memory cgroups.
Signed-off-by: Wenwei Tao <ww.tao0320@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Vladimir Davydov <vdavydov@parallels.com>
Fixes: 9a1049da9bd2 ("percpu-refcount: require percpu_ref to be exited explicitly")
Fixes: 01e586598b22 ("cgroup: release css->id after css_free")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/cgroup.c | 5 +----
1 file changed, 1 insertion(+), 4 deletions(-)
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -5150,7 +5150,7 @@ static struct cgroup_subsys_state *css_c
err = cgroup_idr_alloc(&ss->css_idr, NULL, 2, 0, GFP_KERNEL);
if (err < 0)
- goto err_free_percpu_ref;
+ goto err_free_css;
css->id = err;
/* @css is ready to be brought online now, make it visible */
@@ -5174,9 +5174,6 @@ static struct cgroup_subsys_state *css_c
err_list_del:
list_del_rcu(&css->sibling);
- cgroup_idr_remove(&ss->css_idr, css->id);
-err_free_percpu_ref:
- percpu_ref_exit(&css->refcnt);
err_free_css:
call_rcu(&css->rcu_head, css_free_rcu_fn);
return ERR_PTR(err);
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 49/96] cgroup: set css->id to -1 during init
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (42 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 48/96] cgroup: remove redundant cleanup in css_create Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 50/96] cgroup: Disable IRQs while holding css_set_lock Greg Kroah-Hartman
` (47 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tejun Heo, Wenwei Tao
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit 8fa3b8d689a54d6d04ff7803c724fb7aca6ce98e upstream.
If percpu_ref initialization fails during css_create(), the free path
can end up trying to free css->id of zero. As ID 0 is unused, it
doesn't cause a critical breakage but it does trigger a warning
message. Fix it by setting css->id to -1 from init_and_link_css().
Signed-off-by: Tejun Heo <tj@kernel.org>
Cc: Wenwei Tao <ww.tao0320@gmail.com>
Fixes: 01e586598b22 ("cgroup: release css->id after css_free")
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/cgroup.c | 1 +
1 file changed, 1 insertion(+)
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -5063,6 +5063,7 @@ static void init_and_link_css(struct cgr
memset(css, 0, sizeof(*css));
css->cgroup = cgrp;
css->ss = ss;
+ css->id = -1;
INIT_LIST_HEAD(&css->sibling);
INIT_LIST_HEAD(&css->children);
css->serial_nr = css_serial_nr_next++;
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 50/96] cgroup: Disable IRQs while holding css_set_lock
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (43 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 49/96] cgroup: set css->id to -1 during init Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 51/96] power_supply: power_supply_read_temp only if use_cnt > 0 Greg Kroah-Hartman
` (46 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Tejun Heo, Li Zefan, Johannes Weiner,
Juri Lelli, Steven Rostedt, cgroups, Rik van Riel,
Luis Claudio R. Goncalves, Daniel Bristot de Oliveira
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Bristot de Oliveira <bristot@redhat.com>
commit 82d6489d0fed2ec8a8c48c19e8d8a04ac8e5bb26 upstream.
While testing the deadline scheduler + cgroup setup I hit this
warning.
[ 132.612935] ------------[ cut here ]------------
[ 132.612951] WARNING: CPU: 5 PID: 0 at kernel/softirq.c:150 __local_bh_enable_ip+0x6b/0x80
[ 132.612952] Modules linked in: (a ton of modules...)
[ 132.612981] CPU: 5 PID: 0 Comm: swapper/5 Not tainted 4.7.0-rc2 #2
[ 132.612981] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.8.2-20150714_191134- 04/01/2014
[ 132.612982] 0000000000000086 45c8bb5effdd088b ffff88013fd43da0 ffffffff813d229e
[ 132.612984] 0000000000000000 0000000000000000 ffff88013fd43de0 ffffffff810a652b
[ 132.612985] 00000096811387b5 0000000000000200 ffff8800bab29d80 ffff880034c54c00
[ 132.612986] Call Trace:
[ 132.612987] <IRQ> [<ffffffff813d229e>] dump_stack+0x63/0x85
[ 132.612994] [<ffffffff810a652b>] __warn+0xcb/0xf0
[ 132.612997] [<ffffffff810e76a0>] ? push_dl_task.part.32+0x170/0x170
[ 132.612999] [<ffffffff810a665d>] warn_slowpath_null+0x1d/0x20
[ 132.613000] [<ffffffff810aba5b>] __local_bh_enable_ip+0x6b/0x80
[ 132.613008] [<ffffffff817d6c8a>] _raw_write_unlock_bh+0x1a/0x20
[ 132.613010] [<ffffffff817d6c9e>] _raw_spin_unlock_bh+0xe/0x10
[ 132.613015] [<ffffffff811388ac>] put_css_set+0x5c/0x60
[ 132.613016] [<ffffffff8113dc7f>] cgroup_free+0x7f/0xa0
[ 132.613017] [<ffffffff810a3912>] __put_task_struct+0x42/0x140
[ 132.613018] [<ffffffff810e776a>] dl_task_timer+0xca/0x250
[ 132.613027] [<ffffffff810e76a0>] ? push_dl_task.part.32+0x170/0x170
[ 132.613030] [<ffffffff8111371e>] __hrtimer_run_queues+0xee/0x270
[ 132.613031] [<ffffffff81113ec8>] hrtimer_interrupt+0xa8/0x190
[ 132.613034] [<ffffffff81051a58>] local_apic_timer_interrupt+0x38/0x60
[ 132.613035] [<ffffffff817d9b0d>] smp_apic_timer_interrupt+0x3d/0x50
[ 132.613037] [<ffffffff817d7c5c>] apic_timer_interrupt+0x8c/0xa0
[ 132.613038] <EOI> [<ffffffff81063466>] ? native_safe_halt+0x6/0x10
[ 132.613043] [<ffffffff81037a4e>] default_idle+0x1e/0xd0
[ 132.613044] [<ffffffff810381cf>] arch_cpu_idle+0xf/0x20
[ 132.613046] [<ffffffff810e8fda>] default_idle_call+0x2a/0x40
[ 132.613047] [<ffffffff810e92d7>] cpu_startup_entry+0x2e7/0x340
[ 132.613048] [<ffffffff81050235>] start_secondary+0x155/0x190
[ 132.613049] ---[ end trace f91934d162ce9977 ]---
The warn is the spin_(lock|unlock)_bh(&css_set_lock) in the interrupt
context. Converting the spin_lock_bh to spin_lock_irq(save) to avoid
this problem - and other problems of sharing a spinlock with an
interrupt.
Cc: Tejun Heo <tj@kernel.org>
Cc: Li Zefan <lizefan@huawei.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Juri Lelli <juri.lelli@arm.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
Cc: cgroups@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Reviewed-by: Rik van Riel <riel@redhat.com>
Reviewed-by: "Luis Claudio R. Goncalves" <lgoncalv@redhat.com>
Signed-off-by: Daniel Bristot de Oliveira <bristot@redhat.com>
Acked-by: Zefan Li <lizefan@huawei.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/cgroup.c | 142 +++++++++++++++++++++++++++++---------------------------
1 file changed, 74 insertions(+), 68 deletions(-)
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -837,6 +837,8 @@ static void put_css_set_locked(struct cs
static void put_css_set(struct css_set *cset)
{
+ unsigned long flags;
+
/*
* Ensure that the refcount doesn't hit zero while any readers
* can see it. Similar to atomic_dec_and_lock(), but for an
@@ -845,9 +847,9 @@ static void put_css_set(struct css_set *
if (atomic_add_unless(&cset->refcount, -1, 1))
return;
- spin_lock_bh(&css_set_lock);
+ spin_lock_irqsave(&css_set_lock, flags);
put_css_set_locked(cset);
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irqrestore(&css_set_lock, flags);
}
/*
@@ -1070,11 +1072,11 @@ static struct css_set *find_css_set(stru
/* First see if we already have a cgroup group that matches
* the desired set */
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
cset = find_existing_css_set(old_cset, cgrp, template);
if (cset)
get_css_set(cset);
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
if (cset)
return cset;
@@ -1102,7 +1104,7 @@ static struct css_set *find_css_set(stru
* find_existing_css_set() */
memcpy(cset->subsys, template, sizeof(cset->subsys));
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
/* Add reference counts and links from the new css_set. */
list_for_each_entry(link, &old_cset->cgrp_links, cgrp_link) {
struct cgroup *c = link->cgrp;
@@ -1128,7 +1130,7 @@ static struct css_set *find_css_set(stru
css_get(css);
}
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
return cset;
}
@@ -1192,7 +1194,7 @@ static void cgroup_destroy_root(struct c
* Release all the links from cset_links to this hierarchy's
* root cgroup
*/
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
list_for_each_entry_safe(link, tmp_link, &cgrp->cset_links, cset_link) {
list_del(&link->cset_link);
@@ -1200,7 +1202,7 @@ static void cgroup_destroy_root(struct c
kfree(link);
}
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
if (!list_empty(&root->root_list)) {
list_del(&root->root_list);
@@ -1600,11 +1602,11 @@ static int rebind_subsystems(struct cgro
ss->root = dst_root;
css->cgroup = dcgrp;
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
hash_for_each(css_set_table, i, cset, hlist)
list_move_tail(&cset->e_cset_node[ss->id],
&dcgrp->e_csets[ss->id]);
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
/* default hierarchy doesn't enable controllers by default */
dst_root->subsys_mask |= 1 << ssid;
@@ -1640,10 +1642,10 @@ static int cgroup_show_path(struct seq_f
if (!buf)
return -ENOMEM;
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
ns_cgroup = current_cgns_cgroup_from_root(kf_cgroot);
len = kernfs_path_from_node(kf_node, ns_cgroup->kn, buf, PATH_MAX);
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
if (len >= PATH_MAX)
len = -ERANGE;
@@ -1897,7 +1899,7 @@ static void cgroup_enable_task_cg_lists(
{
struct task_struct *p, *g;
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
if (use_task_css_set_links)
goto out_unlock;
@@ -1922,8 +1924,12 @@ static void cgroup_enable_task_cg_lists(
* entry won't be deleted though the process has exited.
* Do it while holding siglock so that we don't end up
* racing against cgroup_exit().
+ *
+ * Interrupts were already disabled while acquiring
+ * the css_set_lock, so we do not need to disable it
+ * again when acquiring the sighand->siglock here.
*/
- spin_lock_irq(&p->sighand->siglock);
+ spin_lock(&p->sighand->siglock);
if (!(p->flags & PF_EXITING)) {
struct css_set *cset = task_css_set(p);
@@ -1932,11 +1938,11 @@ static void cgroup_enable_task_cg_lists(
list_add_tail(&p->cg_list, &cset->tasks);
get_css_set(cset);
}
- spin_unlock_irq(&p->sighand->siglock);
+ spin_unlock(&p->sighand->siglock);
} while_each_thread(g, p);
read_unlock(&tasklist_lock);
out_unlock:
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
}
static void init_cgroup_housekeeping(struct cgroup *cgrp)
@@ -2043,13 +2049,13 @@ static int cgroup_setup_root(struct cgro
* Link the root cgroup in this hierarchy into all the css_set
* objects.
*/
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
hash_for_each(css_set_table, i, cset, hlist) {
link_css_set(&tmp_links, cset, root_cgrp);
if (css_set_populated(cset))
cgroup_update_populated(root_cgrp, true);
}
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
BUG_ON(!list_empty(&root_cgrp->self.children));
BUG_ON(atomic_read(&root->nr_cgrps) != 1);
@@ -2256,11 +2262,11 @@ out_mount:
struct cgroup *cgrp;
mutex_lock(&cgroup_mutex);
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
cgrp = cset_cgroup_from_root(ns->root_cset, root);
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
mutex_unlock(&cgroup_mutex);
nsdentry = kernfs_node_dentry(cgrp->kn, dentry->d_sb);
@@ -2337,11 +2343,11 @@ char *cgroup_path_ns(struct cgroup *cgrp
char *ret;
mutex_lock(&cgroup_mutex);
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
ret = cgroup_path_ns_locked(cgrp, buf, buflen, ns);
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
mutex_unlock(&cgroup_mutex);
return ret;
@@ -2369,7 +2375,7 @@ char *task_cgroup_path(struct task_struc
char *path = NULL;
mutex_lock(&cgroup_mutex);
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
root = idr_get_next(&cgroup_hierarchy_idr, &hierarchy_id);
@@ -2382,7 +2388,7 @@ char *task_cgroup_path(struct task_struc
path = buf;
}
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
mutex_unlock(&cgroup_mutex);
return path;
}
@@ -2557,7 +2563,7 @@ static int cgroup_taskset_migrate(struct
* the new cgroup. There are no failure cases after here, so this
* is the commit point.
*/
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
list_for_each_entry(cset, &tset->src_csets, mg_node) {
list_for_each_entry_safe(task, tmp_task, &cset->mg_tasks, cg_list) {
struct css_set *from_cset = task_css_set(task);
@@ -2568,7 +2574,7 @@ static int cgroup_taskset_migrate(struct
put_css_set_locked(from_cset);
}
}
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
/*
* Migration is committed, all target tasks are now on dst_csets.
@@ -2597,13 +2603,13 @@ out_cancel_attach:
}
} while_each_subsys_mask();
out_release_tset:
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
list_splice_init(&tset->dst_csets, &tset->src_csets);
list_for_each_entry_safe(cset, tmp_cset, &tset->src_csets, mg_node) {
list_splice_tail_init(&cset->mg_tasks, &cset->tasks);
list_del_init(&cset->mg_node);
}
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
return ret;
}
@@ -2634,7 +2640,7 @@ static void cgroup_migrate_finish(struct
lockdep_assert_held(&cgroup_mutex);
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
list_for_each_entry_safe(cset, tmp_cset, preloaded_csets, mg_preload_node) {
cset->mg_src_cgrp = NULL;
cset->mg_dst_cgrp = NULL;
@@ -2642,7 +2648,7 @@ static void cgroup_migrate_finish(struct
list_del_init(&cset->mg_preload_node);
put_css_set_locked(cset);
}
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
}
/**
@@ -2783,7 +2789,7 @@ static int cgroup_migrate(struct task_st
* already PF_EXITING could be freed from underneath us unless we
* take an rcu_read_lock.
*/
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
rcu_read_lock();
task = leader;
do {
@@ -2792,7 +2798,7 @@ static int cgroup_migrate(struct task_st
break;
} while_each_thread(leader, task);
rcu_read_unlock();
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
return cgroup_taskset_migrate(&tset, root);
}
@@ -2816,7 +2822,7 @@ static int cgroup_attach_task(struct cgr
return -EBUSY;
/* look up all src csets */
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
rcu_read_lock();
task = leader;
do {
@@ -2826,7 +2832,7 @@ static int cgroup_attach_task(struct cgr
break;
} while_each_thread(leader, task);
rcu_read_unlock();
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
/* prepare dst csets and commit */
ret = cgroup_migrate_prepare_dst(&preloaded_csets);
@@ -2859,9 +2865,9 @@ static int cgroup_procs_write_permission
struct cgroup *cgrp;
struct inode *inode;
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
cgrp = task_cgroup_from_root(task, &cgrp_dfl_root);
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
while (!cgroup_is_descendant(dst_cgrp, cgrp))
cgrp = cgroup_parent(cgrp);
@@ -2962,9 +2968,9 @@ int cgroup_attach_task_all(struct task_s
if (root == &cgrp_dfl_root)
continue;
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
from_cgrp = task_cgroup_from_root(from, root);
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
retval = cgroup_attach_task(from_cgrp, tsk, false);
if (retval)
@@ -3080,7 +3086,7 @@ static int cgroup_update_dfl_csses(struc
percpu_down_write(&cgroup_threadgroup_rwsem);
/* look up all csses currently attached to @cgrp's subtree */
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
cgroup_for_each_live_descendant_pre(dsct, d_css, cgrp) {
struct cgrp_cset_link *link;
@@ -3088,14 +3094,14 @@ static int cgroup_update_dfl_csses(struc
cgroup_migrate_add_src(link->cset, dsct,
&preloaded_csets);
}
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
/* NULL dst indicates self on default hierarchy */
ret = cgroup_migrate_prepare_dst(&preloaded_csets);
if (ret)
goto out_finish;
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
list_for_each_entry(src_cset, &preloaded_csets, mg_preload_node) {
struct task_struct *task, *ntask;
@@ -3107,7 +3113,7 @@ static int cgroup_update_dfl_csses(struc
list_for_each_entry_safe(task, ntask, &src_cset->tasks, cg_list)
cgroup_taskset_add(task, &tset);
}
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
ret = cgroup_taskset_migrate(&tset, cgrp->root);
out_finish:
@@ -3908,10 +3914,10 @@ static int cgroup_task_count(const struc
int count = 0;
struct cgrp_cset_link *link;
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
list_for_each_entry(link, &cgrp->cset_links, cset_link)
count += atomic_read(&link->cset->refcount);
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
return count;
}
@@ -4249,7 +4255,7 @@ void css_task_iter_start(struct cgroup_s
memset(it, 0, sizeof(*it));
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
it->ss = css->ss;
@@ -4262,7 +4268,7 @@ void css_task_iter_start(struct cgroup_s
css_task_iter_advance_css_set(it);
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
}
/**
@@ -4280,7 +4286,7 @@ struct task_struct *css_task_iter_next(s
it->cur_task = NULL;
}
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
if (it->task_pos) {
it->cur_task = list_entry(it->task_pos, struct task_struct,
@@ -4289,7 +4295,7 @@ struct task_struct *css_task_iter_next(s
css_task_iter_advance(it);
}
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
return it->cur_task;
}
@@ -4303,10 +4309,10 @@ struct task_struct *css_task_iter_next(s
void css_task_iter_end(struct css_task_iter *it)
{
if (it->cur_cset) {
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
list_del(&it->iters_node);
put_css_set_locked(it->cur_cset);
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
}
if (it->cur_task)
@@ -4338,10 +4344,10 @@ int cgroup_transfer_tasks(struct cgroup
mutex_lock(&cgroup_mutex);
/* all tasks in @from are being moved, all csets are source */
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
list_for_each_entry(link, &from->cset_links, cset_link)
cgroup_migrate_add_src(link->cset, to, &preloaded_csets);
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
ret = cgroup_migrate_prepare_dst(&preloaded_csets);
if (ret)
@@ -5449,10 +5455,10 @@ static int cgroup_destroy_locked(struct
*/
cgrp->self.flags &= ~CSS_ONLINE;
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
list_for_each_entry(link, &cgrp->cset_links, cset_link)
link->cset->dead = true;
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
/* initiate massacre of all css's */
for_each_css(css, ssid, cgrp)
@@ -5723,7 +5729,7 @@ int proc_cgroup_show(struct seq_file *m,
goto out;
mutex_lock(&cgroup_mutex);
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
for_each_root(root) {
struct cgroup_subsys *ss;
@@ -5776,7 +5782,7 @@ int proc_cgroup_show(struct seq_file *m,
retval = 0;
out_unlock:
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
mutex_unlock(&cgroup_mutex);
kfree(buf);
out:
@@ -5921,13 +5927,13 @@ void cgroup_post_fork(struct task_struct
if (use_task_css_set_links) {
struct css_set *cset;
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
cset = task_css_set(current);
if (list_empty(&child->cg_list)) {
get_css_set(cset);
css_set_move_task(child, NULL, cset, false);
}
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
}
/*
@@ -5972,9 +5978,9 @@ void cgroup_exit(struct task_struct *tsk
cset = task_css_set(tsk);
if (!list_empty(&tsk->cg_list)) {
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
css_set_move_task(tsk, cset, NULL, false);
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
} else {
get_css_set(cset);
}
@@ -6042,9 +6048,9 @@ static void cgroup_release_agent(struct
if (!pathbuf || !agentbuf)
goto out;
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
path = cgroup_path_ns_locked(cgrp, pathbuf, PATH_MAX, &init_cgroup_ns);
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
if (!path)
goto out;
@@ -6304,12 +6310,12 @@ struct cgroup_namespace *copy_cgroup_ns(
return ERR_PTR(-EPERM);
mutex_lock(&cgroup_mutex);
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
cset = task_css_set(current);
get_css_set(cset);
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
mutex_unlock(&cgroup_mutex);
new_ns = alloc_cgroup_ns();
@@ -6433,7 +6439,7 @@ static int current_css_set_cg_links_read
if (!name_buf)
return -ENOMEM;
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
rcu_read_lock();
cset = rcu_dereference(current->cgroups);
list_for_each_entry(link, &cset->cgrp_links, cgrp_link) {
@@ -6444,7 +6450,7 @@ static int current_css_set_cg_links_read
c->root->hierarchy_id, name_buf);
}
rcu_read_unlock();
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
kfree(name_buf);
return 0;
}
@@ -6455,7 +6461,7 @@ static int cgroup_css_links_read(struct
struct cgroup_subsys_state *css = seq_css(seq);
struct cgrp_cset_link *link;
- spin_lock_bh(&css_set_lock);
+ spin_lock_irq(&css_set_lock);
list_for_each_entry(link, &css->cgroup->cset_links, cset_link) {
struct css_set *cset = link->cset;
struct task_struct *task;
@@ -6478,7 +6484,7 @@ static int cgroup_css_links_read(struct
overflow:
seq_puts(seq, " ...\n");
}
- spin_unlock_bh(&css_set_lock);
+ spin_unlock_irq(&css_set_lock);
return 0;
}
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 51/96] power_supply: power_supply_read_temp only if use_cnt > 0
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (44 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 50/96] cgroup: Disable IRQs while holding css_set_lock Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 52/96] locks: use file_inode() Greg Kroah-Hartman
` (45 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Rhyland Klein, Krzysztof Kozlowski,
Sebastian Reichel
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rhyland Klein <rklein@nvidia.com>
commit 5bc28b93a36e3cb3acc2870fb75cb6ffb182fece upstream.
Change power_supply_read_temp() to use power_supply_get_property()
so that it will check the use_cnt and ensure it is > 0. The use_cnt
will be incremented at the end of __power_supply_register, so this
will block to case where get_property can be called before the supply
is fully registered. This fixes the issue show in the stack below:
[ 1.452598] power_supply_read_temp+0x78/0x80
[ 1.458680] thermal_zone_get_temp+0x5c/0x11c
[ 1.464765] thermal_zone_device_update+0x34/0xb4
[ 1.471195] thermal_zone_device_register+0x87c/0x8cc
[ 1.477974] __power_supply_register+0x364/0x424
[ 1.484317] power_supply_register_no_ws+0x10/0x18
[ 1.490833] bq27xxx_battery_setup+0x10c/0x164
[ 1.497003] bq27xxx_battery_i2c_probe+0xd0/0x1b0
[ 1.503435] i2c_device_probe+0x174/0x240
[ 1.509172] driver_probe_device+0x1fc/0x29c
[ 1.515167] __driver_attach+0xa4/0xa8
[ 1.520643] bus_for_each_dev+0x58/0x98
[ 1.526204] driver_attach+0x20/0x28
[ 1.531505] bus_add_driver+0x1c8/0x22c
[ 1.537067] driver_register+0x68/0x108
[ 1.542630] i2c_register_driver+0x38/0x7c
[ 1.548457] bq27xxx_battery_i2c_driver_init+0x18/0x20
[ 1.555321] do_one_initcall+0x38/0x12c
[ 1.560886] kernel_init_freeable+0x148/0x1ec
[ 1.566972] kernel_init+0x10/0xfc
[ 1.572101] ret_from_fork+0x10/0x40
Also make the same change to ps_get_max_charge_cntl_limit() and
ps_get_cur_chrage_cntl_limit() to be safe. Lastly, change the return
value of power_supply_get_property() to -EAGAIN from -ENODEV if
use_cnt <= 0.
Fixes: 297d716f6260 ("power_supply: Change ownership from driver to core")
Signed-off-by: Rhyland Klein <rklein@nvidia.com>
Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
Signed-off-by: Sebastian Reichel <sre@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/power/power_supply_core.c | 27 ++++++++++++++++-----------
1 file changed, 16 insertions(+), 11 deletions(-)
--- a/drivers/power/power_supply_core.c
+++ b/drivers/power/power_supply_core.c
@@ -565,11 +565,12 @@ static int power_supply_read_temp(struct
WARN_ON(tzd == NULL);
psy = tzd->devdata;
- ret = psy->desc->get_property(psy, POWER_SUPPLY_PROP_TEMP, &val);
+ ret = power_supply_get_property(psy, POWER_SUPPLY_PROP_TEMP, &val);
+ if (ret)
+ return ret;
/* Convert tenths of degree Celsius to milli degree Celsius. */
- if (!ret)
- *temp = val.intval * 100;
+ *temp = val.intval * 100;
return ret;
}
@@ -612,10 +613,12 @@ static int ps_get_max_charge_cntl_limit(
int ret;
psy = tcd->devdata;
- ret = psy->desc->get_property(psy,
- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX, &val);
- if (!ret)
- *state = val.intval;
+ ret = power_supply_get_property(psy,
+ POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT_MAX, &val);
+ if (ret)
+ return ret;
+
+ *state = val.intval;
return ret;
}
@@ -628,10 +631,12 @@ static int ps_get_cur_chrage_cntl_limit(
int ret;
psy = tcd->devdata;
- ret = psy->desc->get_property(psy,
- POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, &val);
- if (!ret)
- *state = val.intval;
+ ret = power_supply_get_property(psy,
+ POWER_SUPPLY_PROP_CHARGE_CONTROL_LIMIT, &val);
+ if (ret)
+ return ret;
+
+ *state = val.intval;
return ret;
}
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 52/96] locks: use file_inode()
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (45 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 51/96] power_supply: power_supply_read_temp only if use_cnt > 0 Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 53/96] Revert "ecryptfs: forbid opening files without mmap handler" Greg Kroah-Hartman
` (44 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Eryu Guan, Miklos Szeredi,
Jeff Layton, J. Bruce Fields
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@redhat.com>
commit 6343a2120862f7023006c8091ad95c1f16a32077 upstream.
(Another one for the f_path debacle.)
ltp fcntl33 testcase caused an Oops in selinux_file_send_sigiotask.
The reason is that generic_add_lease() used filp->f_path.dentry->inode
while all the others use file_inode(). This makes a difference for files
opened on overlayfs since the former will point to the overlay inode the
latter to the underlying inode.
So generic_add_lease() added the lease to the overlay inode and
generic_delete_lease() removed it from the underlying inode. When the file
was released the lease remained on the overlay inode's lock list, resulting
in use after free.
Reported-by: Eryu Guan <eguan@redhat.com>
Fixes: 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay and f_inode to the underlay")
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Reviewed-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/locks.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/fs/locks.c
+++ b/fs/locks.c
@@ -1628,7 +1628,7 @@ generic_add_lease(struct file *filp, lon
{
struct file_lock *fl, *my_fl = NULL, *lease;
struct dentry *dentry = filp->f_path.dentry;
- struct inode *inode = dentry->d_inode;
+ struct inode *inode = file_inode(filp);
struct file_lock_context *ctx;
bool is_deleg = (*flp)->fl_flags & FL_DELEG;
int error;
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 53/96] Revert "ecryptfs: forbid opening files without mmap handler"
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (46 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 52/96] locks: use file_inode() Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 54/96] ecryptfs: dont allow mmap when the lower fs doesnt support it Greg Kroah-Hartman
` (43 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jeff Mahoney, Tyler Hicks
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Mahoney <jeffm@suse.com>
commit 78c4e172412de5d0456dc00d2b34050aa0b683b5 upstream.
This reverts commit 2f36db71009304b3f0b95afacd8eba1f9f046b87.
It fixed a local root exploit but also introduced a dependency on
the lower file system implementing an mmap operation just to open a file,
which is a bit of a heavy hammer. The right fix is to have mmap depend
on the existence of the mmap handler instead.
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/kthread.c | 13 ++-----------
1 file changed, 2 insertions(+), 11 deletions(-)
--- a/fs/ecryptfs/kthread.c
+++ b/fs/ecryptfs/kthread.c
@@ -25,7 +25,6 @@
#include <linux/slab.h>
#include <linux/wait.h>
#include <linux/mount.h>
-#include <linux/file.h>
#include "ecryptfs_kernel.h"
struct ecryptfs_open_req {
@@ -148,7 +147,7 @@ int ecryptfs_privileged_open(struct file
flags |= IS_RDONLY(d_inode(lower_dentry)) ? O_RDONLY : O_RDWR;
(*lower_file) = dentry_open(&req.path, flags, cred);
if (!IS_ERR(*lower_file))
- goto have_file;
+ goto out;
if ((flags & O_ACCMODE) == O_RDONLY) {
rc = PTR_ERR((*lower_file));
goto out;
@@ -166,16 +165,8 @@ int ecryptfs_privileged_open(struct file
mutex_unlock(&ecryptfs_kthread_ctl.mux);
wake_up(&ecryptfs_kthread_ctl.wait);
wait_for_completion(&req.done);
- if (IS_ERR(*lower_file)) {
+ if (IS_ERR(*lower_file))
rc = PTR_ERR(*lower_file);
- goto out;
- }
-have_file:
- if ((*lower_file)->f_op->mmap == NULL) {
- fput(*lower_file);
- *lower_file = NULL;
- rc = -EMEDIUMTYPE;
- }
out:
return rc;
}
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 54/96] ecryptfs: dont allow mmap when the lower fs doesnt support it
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (47 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 53/96] Revert "ecryptfs: forbid opening files without mmap handler" Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 55/96] ext4: verify extent header depth Greg Kroah-Hartman
` (42 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Jeff Mahoney, Tyler Hicks
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Mahoney <jeffm@suse.com>
commit f0fe970df3838c202ef6c07a4c2b36838ef0a88b upstream.
There are legitimate reasons to disallow mmap on certain files, notably
in sysfs or procfs. We shouldn't emulate mmap support on file systems
that don't offer support natively.
CVE-2016-1583
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
[tyhicks: clean up f_op check by using ecryptfs_file_to_lower()]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ecryptfs/file.c | 15 ++++++++++++++-
1 file changed, 14 insertions(+), 1 deletion(-)
--- a/fs/ecryptfs/file.c
+++ b/fs/ecryptfs/file.c
@@ -169,6 +169,19 @@ out:
return rc;
}
+static int ecryptfs_mmap(struct file *file, struct vm_area_struct *vma)
+{
+ struct file *lower_file = ecryptfs_file_to_lower(file);
+ /*
+ * Don't allow mmap on top of file systems that don't support it
+ * natively. If FILESYSTEM_MAX_STACK_DEPTH > 2 or ecryptfs
+ * allows recursive mounting, this will need to be extended.
+ */
+ if (!lower_file->f_op->mmap)
+ return -ENODEV;
+ return generic_file_mmap(file, vma);
+}
+
/**
* ecryptfs_open
* @inode: inode speciying file to open
@@ -403,7 +416,7 @@ const struct file_operations ecryptfs_ma
#ifdef CONFIG_COMPAT
.compat_ioctl = ecryptfs_compat_ioctl,
#endif
- .mmap = generic_file_mmap,
+ .mmap = ecryptfs_mmap,
.open = ecryptfs_open,
.flush = ecryptfs_flush,
.release = ecryptfs_release,
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 55/96] ext4: verify extent header depth
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (48 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 54/96] ecryptfs: dont allow mmap when the lower fs doesnt support it Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 56/96] 9p: use file_dentry() Greg Kroah-Hartman
` (41 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Darrick J. Wong, Vegard Nossum, Theodore Tso
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vegard Nossum <vegard.nossum@oracle.com>
commit 7bc9491645118c9461bd21099c31755ff6783593 upstream.
Although the extent tree depth of 5 should enough be for the worst
case of 2*32 extents of length 1, the extent tree code does not
currently to merge nodes which are less than half-full with a sibling
node, or to shrink the tree depth if possible. So it's possible, at
least in theory, for the tree depth to be greater than 5. However,
even in the worst case, a tree depth of 32 is highly unlikely, and if
the file system is maliciously corrupted, an insanely large eh_depth
can cause memory allocation failures that will trigger kernel warnings
(here, eh_depth = 65280):
JBD2: ext4.exe wants too many credits credits:195849 rsv_credits:0 max:256
------------[ cut here ]------------
WARNING: CPU: 0 PID: 50 at fs/jbd2/transaction.c:293 start_this_handle+0x569/0x580
CPU: 0 PID: 50 Comm: ext4.exe Not tainted 4.7.0-rc5+ #508
Stack:
604a8947 625badd8 0002fd09 00000000
60078643 00000000 62623910 601bf9bc
62623970 6002fc84 626239b0 900000125
Call Trace:
[<6001c2dc>] show_stack+0xdc/0x1a0
[<601bf9bc>] dump_stack+0x2a/0x2e
[<6002fc84>] __warn+0x114/0x140
[<6002fdff>] warn_slowpath_null+0x1f/0x30
[<60165829>] start_this_handle+0x569/0x580
[<60165d4e>] jbd2__journal_start+0x11e/0x220
[<60146690>] __ext4_journal_start_sb+0x60/0xa0
[<60120a81>] ext4_truncate+0x131/0x3a0
[<60123677>] ext4_setattr+0x757/0x840
[<600d5d0f>] notify_change+0x16f/0x2a0
[<600b2b16>] do_truncate+0x76/0xc0
[<600c3e56>] path_openat+0x806/0x1300
[<600c55c9>] do_filp_open+0x89/0xf0
[<600b4074>] do_sys_open+0x134/0x1e0
[<600b4140>] SyS_open+0x20/0x30
[<6001ea68>] handle_syscall+0x88/0x90
[<600295fd>] userspace+0x3fd/0x500
[<6001ac55>] fork_handler+0x85/0x90
---[ end trace 08b0b88b6387a244 ]---
[ Commit message modified and the extent tree depath check changed
from 5 to 32 -- tytso ]
Cc: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ext4/extents.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -469,6 +469,10 @@ static int __ext4_ext_check(const char *
error_msg = "invalid extent entries";
goto corrupted;
}
+ if (unlikely(depth > 32)) {
+ error_msg = "too large eh_depth";
+ goto corrupted;
+ }
/* Verify checksum on non-root extent tree nodes */
if (ext_depth(inode) != depth &&
!ext4_extent_block_csum_verify(inode, eh)) {
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 56/96] 9p: use file_dentry()
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (49 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 55/96] ext4: verify extent header depth Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 57/96] cpufreq: Avoid false-positive WARN_ON()s in cpufreq_update_policy() Greg Kroah-Hartman
` (40 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alessio Igor Bogani, Miklos Szeredi, Al Viro
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@redhat.com>
commit b403f0e37a11f84f7ceaf40b0075499e5bcfd220 upstream.
v9fs may be used as lower layer of overlayfs and accessing f_path.dentry
can lead to a crash. In this case it's a NULL pointer dereference in
p9_fid_create().
Fix by replacing direct access of file->f_path.dentry with the
file_dentry() accessor, which will always return a native object.
Reported-by: Alessio Igor Bogani <alessioigorbogani@gmail.com>
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Tested-by: Alessio Igor Bogani <alessioigorbogani@gmail.com>
Fixes: 4bacc9c9234c ("overlayfs: Make f_path always point to the overlay and f_inode to the underlay")
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/9p/vfs_file.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c
@@ -74,7 +74,7 @@ int v9fs_file_open(struct inode *inode,
v9fs_proto_dotu(v9ses));
fid = file->private_data;
if (!fid) {
- fid = v9fs_fid_clone(file->f_path.dentry);
+ fid = v9fs_fid_clone(file_dentry(file));
if (IS_ERR(fid))
return PTR_ERR(fid);
@@ -100,7 +100,7 @@ int v9fs_file_open(struct inode *inode,
* because we want write after unlink usecase
* to work.
*/
- fid = v9fs_writeback_fid(file->f_path.dentry);
+ fid = v9fs_writeback_fid(file_dentry(file));
if (IS_ERR(fid)) {
err = PTR_ERR(fid);
mutex_unlock(&v9inode->v_mutex);
@@ -516,7 +516,7 @@ v9fs_mmap_file_mmap(struct file *filp, s
* because we want write after unlink usecase
* to work.
*/
- fid = v9fs_writeback_fid(filp->f_path.dentry);
+ fid = v9fs_writeback_fid(file_dentry(filp));
if (IS_ERR(fid)) {
retval = PTR_ERR(fid);
mutex_unlock(&v9inode->v_mutex);
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 57/96] cpufreq: Avoid false-positive WARN_ON()s in cpufreq_update_policy()
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (50 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 56/96] 9p: use file_dentry() Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 58/96] devpts: fix null pointer dereference on failed memory allocation Greg Kroah-Hartman
` (39 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Viresh Kumar
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
commit 742c87bf27d3b715820da6f8a81d6357adbf18f8 upstream.
CPU notifications from the firmware coming in when cpufreq is
suspended cause cpufreq_update_current_freq() to return 0 which
triggers the WARN_ON() in cpufreq_update_policy() for no reason.
Avoid that by checking cpufreq_suspended before calling
cpufreq_update_current_freq().
Fixes: c9d9c929e674 (cpufreq: Abort cpufreq_update_current_freq() for cpufreq_suspended set)
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/cpufreq/cpufreq.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/cpufreq/cpufreq.c
+++ b/drivers/cpufreq/cpufreq.c
@@ -2169,6 +2169,10 @@ int cpufreq_update_policy(unsigned int c
* -> ask driver for current freq and notify governors about a change
*/
if (cpufreq_driver->get && !cpufreq_driver->setpolicy) {
+ if (cpufreq_suspended) {
+ ret = -EAGAIN;
+ goto unlock;
+ }
new_policy.cur = cpufreq_update_current_freq(policy);
if (WARN_ON(!new_policy.cur)) {
ret = -EIO;
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 58/96] devpts: fix null pointer dereference on failed memory allocation
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (51 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 57/96] cpufreq: Avoid false-positive WARN_ON()s in cpufreq_update_policy() Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 59/96] namespace: update event counter when umounting a deleted dentry Greg Kroah-Hartman
` (38 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Colin Ian King
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Colin Ian King <colin.king@canonical.com>
commit 5353ed8deedee9e5acb9f896e9032158f5d998de upstream.
An ENOMEM when creating a pair tty in tty_ldisc_setup causes a null
pointer dereference in devpts_kill_index because tty->link->driver_data
is NULL. The oops was triggered with the pty stressor in stress-ng when
in a low memory condition.
tty_init_dev tries to clean up a tty_ldisc_setup ENOMEM error by calling
release_tty, however, this ultimately tries to clean up the NULL pair'd
tty in pty_unix98_remove, triggering the Oops.
Add check to pty_unix98_remove to only clean up fsi if it is not NULL.
Ooops:
[ 23.020961] Oops: 0000 [#1] SMP
[ 23.020976] Modules linked in: ppdev snd_hda_codec_generic snd_hda_intel snd_hda_codec parport_pc snd_hda_core snd_hwdep parport snd_pcm input_leds joydev snd_timer serio_raw snd soundcore i2c_piix4 mac_hid ib_iser rdma_cm iw_cm ib_cm ib_core configfs iscsi_tcp libiscsi_tcp libiscsi scsi_transport_iscsi autofs4 btrfs raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel qxl aes_x86_64 ttm lrw gf128mul glue_helper ablk_helper drm_kms_helper cryptd syscopyarea sysfillrect psmouse sysimgblt floppy fb_sys_fops drm pata_acpi jitterentropy_rng drbg ansi_cprng
[ 23.020978] CPU: 0 PID: 1452 Comm: stress-ng-pty Not tainted 4.7.0-rc4+ #2
[ 23.020978] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[ 23.020979] task: ffff88007ba30000 ti: ffff880078ea8000 task.ti: ffff880078ea8000
[ 23.020981] RIP: 0010:[<ffffffff813f11ff>] [<ffffffff813f11ff>] ida_remove+0x1f/0x120
[ 23.020981] RSP: 0018:ffff880078eabb60 EFLAGS: 00010a03
[ 23.020982] RAX: 4444444444444567 RBX: 0000000000000000 RCX: 000000000000001f
[ 23.020982] RDX: 000000000000014c RSI: 000000000000026f RDI: 0000000000000000
[ 23.020982] RBP: ffff880078eabb70 R08: 0000000000000004 R09: 0000000000000036
[ 23.020983] R10: 000000000000026f R11: 0000000000000000 R12: 000000000000026f
[ 23.020983] R13: 000000000000026f R14: ffff88007c944b40 R15: 000000000000026f
[ 23.020984] FS: 00007f9a2f3cc700(0000) GS:ffff88007fc00000(0000) knlGS:0000000000000000
[ 23.020984] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 23.020985] CR2: 0000000000000010 CR3: 000000006c81b000 CR4: 00000000001406f0
[ 23.020988] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 23.020988] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 23.020988] Stack:
[ 23.020989] 0000000000000000 000000000000026f ffff880078eabb90 ffffffff812a5a99
[ 23.020990] 0000000000000000 00000000fffffff4 ffff880078eabba8 ffffffff814f9cbe
[ 23.020991] ffff88007965c800 ffff880078eabbc8 ffffffff814eef43 fffffffffffffff4
[ 23.020991] Call Trace:
[ 23.021000] [<ffffffff812a5a99>] devpts_kill_index+0x29/0x50
[ 23.021002] [<ffffffff814f9cbe>] pty_unix98_remove+0x2e/0x50
[ 23.021006] [<ffffffff814eef43>] release_tty+0xb3/0x1b0
[ 23.021007] [<ffffffff814f18d4>] tty_init_dev+0xd4/0x1c0
[ 23.021011] [<ffffffff814f9fae>] ptmx_open+0xae/0x190
[ 23.021013] [<ffffffff812254ef>] chrdev_open+0xbf/0x1b0
[ 23.021015] [<ffffffff8121d973>] do_dentry_open+0x203/0x310
[ 23.021016] [<ffffffff81225430>] ? cdev_put+0x30/0x30
[ 23.021017] [<ffffffff8121ee44>] vfs_open+0x54/0x80
[ 23.021018] [<ffffffff8122b8fc>] ? may_open+0x8c/0x100
[ 23.021019] [<ffffffff8122f26b>] path_openat+0x2eb/0x1440
[ 23.021020] [<ffffffff81230534>] ? putname+0x54/0x60
[ 23.021022] [<ffffffff814f6f97>] ? n_tty_ioctl_helper+0x27/0x100
[ 23.021023] [<ffffffff81231651>] do_filp_open+0x91/0x100
[ 23.021024] [<ffffffff81230596>] ? getname_flags+0x56/0x1f0
[ 23.021026] [<ffffffff8123fc66>] ? __alloc_fd+0x46/0x190
[ 23.021027] [<ffffffff8121f1e4>] do_sys_open+0x124/0x210
[ 23.021028] [<ffffffff8121f2ee>] SyS_open+0x1e/0x20
[ 23.021035] [<ffffffff81845576>] entry_SYSCALL_64_fastpath+0x1e/0xa8
[ 23.021044] Code: 63 28 45 31 e4 eb dd 0f 1f 44 00 00 55 4c 63 d6 48 ba 89 88 88 88 88 88 88 88 4c 89 d0 b9 1f 00 00 00 48 f7 e2 48 89 e5 41 54 53 <8b> 47 10 48 89 fb 8d 3c c5 00 00 00 00 48 c1 ea 09 b8 01 00 00
[ 23.021045] RIP [<ffffffff813f11ff>] ida_remove+0x1f/0x120
[ 23.021045] RSP <ffff880078eabb60>
[ 23.021046] CR2: 0000000000000010
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/pty.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -667,8 +667,11 @@ static void pty_unix98_remove(struct tty
fsi = tty->driver_data;
else
fsi = tty->link->driver_data;
- devpts_kill_index(fsi, tty->index);
- devpts_put_ref(fsi);
+
+ if (fsi) {
+ devpts_kill_index(fsi, tty->index);
+ devpts_put_ref(fsi);
+ }
}
static const struct tty_operations ptm_unix98_ops = {
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 59/96] namespace: update event counter when umounting a deleted dentry
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (52 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 58/96] devpts: fix null pointer dereference on failed memory allocation Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 60/96] spi: rockchip: Signal unfinished DMA transfers Greg Kroah-Hartman
` (37 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Andrey Ulanov, Al Viro
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Andrey Ulanov <andreyu@google.com>
commit e06b933e6ded42384164d28a2060b7f89243b895 upstream.
- m_start() in fs/namespace.c expects that ns->event is incremented each
time a mount added or removed from ns->list.
- umount_tree() removes items from the list but does not increment event
counter, expecting that it's done before the function is called.
- There are some codepaths that call umount_tree() without updating
"event" counter. e.g. from __detach_mounts().
- When this happens m_start may reuse a cached mount structure that no
longer belongs to ns->list (i.e. use after free which usually leads
to infinite loop).
This change fixes the above problem by incrementing global event counter
before invoking umount_tree().
Change-Id: I622c8e84dcb9fb63542372c5dbf0178ee86bb589
Signed-off-by: Andrey Ulanov <andreyu@google.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/namespace.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -1562,6 +1562,7 @@ void __detach_mounts(struct dentry *dent
goto out_unlock;
lock_mount_hash();
+ event++;
while (!hlist_empty(&mp->m_list)) {
mnt = hlist_entry(mp->m_list.first, struct mount, mnt_mp_list);
if (mnt->mnt.mnt_flags & MNT_UMOUNT) {
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 60/96] spi: rockchip: Signal unfinished DMA transfers
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (53 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 59/96] namespace: update event counter when umounting a deleted dentry Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 61/96] spi: sunxi: fix transfer timeout Greg Kroah-Hartman
` (36 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tomeu Vizoso, Mark Brown
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tomeu Vizoso <tomeu.vizoso@collabora.com>
commit 4dc0dd83603f05dc3ae152af33ecb15104c313f3 upstream.
When using DMA, the transfer_one callback should return 1 because the
transfer hasn't finished yet.
A previous commit changed the function to return 0 when the DMA channels
were correctly prepared.
This manifested in Veyron boards with this message:
[ 1.983605] cros-ec-spi spi0.0: EC failed to respond in time
Fixes: ea9849113343 ("spi: rockchip: check return value of dmaengine_prep_slave_sg")
Signed-off-by: Tomeu Vizoso <tomeu.vizoso@collabora.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-rockchip.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/spi/spi-rockchip.c
+++ b/drivers/spi/spi-rockchip.c
@@ -578,7 +578,7 @@ static int rockchip_spi_transfer_one(
struct spi_device *spi,
struct spi_transfer *xfer)
{
- int ret = 1;
+ int ret = 0;
struct rockchip_spi *rs = spi_master_get_devdata(master);
WARN_ON(readl_relaxed(rs->regs + ROCKCHIP_SPI_SSIENR) &&
@@ -627,6 +627,8 @@ static int rockchip_spi_transfer_one(
spi_enable_chip(rs, 1);
ret = rockchip_spi_prepare_dma(rs);
}
+ /* successful DMA prepare means the transfer is in progress */
+ ret = ret ? ret : 1;
} else {
spi_enable_chip(rs, 1);
ret = rockchip_spi_pio_transfer(rs);
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 61/96] spi: sunxi: fix transfer timeout
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (54 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 60/96] spi: rockchip: Signal unfinished DMA transfers Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 62/96] spi: sun4i: fix FIFO limit Greg Kroah-Hartman
` (35 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michal Suchanek, Maxime Ripard, Mark Brown
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Suchanek <hramrach@gmail.com>
commit 719bd6542044efd9b338a53dba1bef45f40ca169 upstream.
The trasfer timeout is fixed at 1000 ms. Reading a 4Mbyte flash over
1MHz SPI bus takes way longer than that. Calculate the timeout from the
actual time the transfer is supposed to take and multiply by 2 for good
measure.
Signed-off-by: Michal Suchanek <hramrach@gmail.com>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-sun4i.c | 10 +++++++++-
drivers/spi/spi-sun6i.c | 10 +++++++++-
2 files changed, 18 insertions(+), 2 deletions(-)
--- a/drivers/spi/spi-sun4i.c
+++ b/drivers/spi/spi-sun4i.c
@@ -173,6 +173,7 @@ static int sun4i_spi_transfer_one(struct
{
struct sun4i_spi *sspi = spi_master_get_devdata(master);
unsigned int mclk_rate, div, timeout;
+ unsigned int start, end, tx_time;
unsigned int tx_len = 0;
int ret = 0;
u32 reg;
@@ -279,9 +280,16 @@ static int sun4i_spi_transfer_one(struct
reg = sun4i_spi_read(sspi, SUN4I_CTL_REG);
sun4i_spi_write(sspi, SUN4I_CTL_REG, reg | SUN4I_CTL_XCH);
+ tx_time = max(tfr->len * 8 * 2 / (tfr->speed_hz / 1000), 100U);
+ start = jiffies;
timeout = wait_for_completion_timeout(&sspi->done,
- msecs_to_jiffies(1000));
+ msecs_to_jiffies(tx_time));
+ end = jiffies;
if (!timeout) {
+ dev_warn(&master->dev,
+ "%s: timeout transferring %u bytes@%iHz for %i(%i)ms",
+ dev_name(&spi->dev), tfr->len, tfr->speed_hz,
+ jiffies_to_msecs(end - start), tx_time);
ret = -ETIMEDOUT;
goto out;
}
--- a/drivers/spi/spi-sun6i.c
+++ b/drivers/spi/spi-sun6i.c
@@ -160,6 +160,7 @@ static int sun6i_spi_transfer_one(struct
{
struct sun6i_spi *sspi = spi_master_get_devdata(master);
unsigned int mclk_rate, div, timeout;
+ unsigned int start, end, tx_time;
unsigned int tx_len = 0;
int ret = 0;
u32 reg;
@@ -269,9 +270,16 @@ static int sun6i_spi_transfer_one(struct
reg = sun6i_spi_read(sspi, SUN6I_TFR_CTL_REG);
sun6i_spi_write(sspi, SUN6I_TFR_CTL_REG, reg | SUN6I_TFR_CTL_XCH);
+ tx_time = max(tfr->len * 8 * 2 / (tfr->speed_hz / 1000), 100U);
+ start = jiffies;
timeout = wait_for_completion_timeout(&sspi->done,
- msecs_to_jiffies(1000));
+ msecs_to_jiffies(tx_time));
+ end = jiffies;
if (!timeout) {
+ dev_warn(&master->dev,
+ "%s: timeout transferring %u bytes@%iHz for %i(%i)ms",
+ dev_name(&spi->dev), tfr->len, tfr->speed_hz,
+ jiffies_to_msecs(end - start), tx_time);
ret = -ETIMEDOUT;
goto out;
}
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 62/96] spi: sun4i: fix FIFO limit
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (55 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 61/96] spi: sunxi: fix transfer timeout Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 63/96] clk: rockchip: initialize flags of clk_init_data in mmc-phase clock Greg Kroah-Hartman
` (34 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Michal Suchanek, Maxime Ripard, Mark Brown
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Michal Suchanek <hramrach@gmail.com>
commit 6d9fe44bd73d567d04d3a68a2d2fa521ab9532f2 upstream.
When testing SPI without DMA I noticed that filling the FIFO on the
spi controller causes timeout.
Always leave room for one byte in the FIFO.
Signed-off-by: Michal Suchanek <hramrach@gmail.com>
Acked-by: Maxime Ripard <maxime.ripard@free-electrons.com>
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/spi/spi-sun4i.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
--- a/drivers/spi/spi-sun4i.c
+++ b/drivers/spi/spi-sun4i.c
@@ -180,7 +180,10 @@ static int sun4i_spi_transfer_one(struct
/* We don't support transfer larger than the FIFO */
if (tfr->len > SUN4I_FIFO_DEPTH)
- return -EINVAL;
+ return -EMSGSIZE;
+
+ if (tfr->tx_buf && tfr->len >= SUN4I_FIFO_DEPTH)
+ return -EMSGSIZE;
reinit_completion(&sspi->done);
sspi->tx_buf = tfr->tx_buf;
@@ -270,8 +273,12 @@ static int sun4i_spi_transfer_one(struct
sun4i_spi_write(sspi, SUN4I_BURST_CNT_REG, SUN4I_BURST_CNT(tfr->len));
sun4i_spi_write(sspi, SUN4I_XMIT_CNT_REG, SUN4I_XMIT_CNT(tx_len));
- /* Fill the TX FIFO */
- sun4i_spi_fill_fifo(sspi, SUN4I_FIFO_DEPTH);
+ /*
+ * Fill the TX FIFO
+ * Filling the FIFO fully causes timeout for some reason
+ * at least on spi2 on A10s
+ */
+ sun4i_spi_fill_fifo(sspi, SUN4I_FIFO_DEPTH - 1);
/* Enable the interrupts */
sun4i_spi_write(sspi, SUN4I_INT_CTL_REG, SUN4I_INT_CTL_TC);
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 63/96] clk: rockchip: initialize flags of clk_init_data in mmc-phase clock
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (56 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 62/96] spi: sun4i: fix FIFO limit Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 64/96] clk: at91: fix clk_programmable_set_parent() Greg Kroah-Hartman
` (33 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Heiko Stuebner
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heiko Stuebner <heiko@sntech.de>
commit 595144c1141c951a3c6bb9004ae6a2bc29aad66f upstream.
The flags element of clk_init_data was never initialized for mmc-
phase-clocks resulting in the element containing a random value
and thus possibly enabling unwanted clock flags.
Fixes: 89bf26cbc1a0 ("clk: rockchip: Add support for the mmc clock phases using the framework")
Signed-off-by: Heiko Stuebner <heiko@sntech.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/rockchip/clk-mmc-phase.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/clk/rockchip/clk-mmc-phase.c
+++ b/drivers/clk/rockchip/clk-mmc-phase.c
@@ -153,6 +153,7 @@ struct clk *rockchip_clk_register_mmc(co
return ERR_PTR(-ENOMEM);
init.name = name;
+ init.flags = 0;
init.num_parents = num_parents;
init.parent_names = parent_names;
init.ops = &rockchip_mmc_clk_ops;
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 64/96] clk: at91: fix clk_programmable_set_parent()
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (57 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 63/96] clk: rockchip: initialize flags of clk_init_data in mmc-phase clock Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 65/96] lockd: unregister notifier blocks if the service fails to come up completely Greg Kroah-Hartman
` (32 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Boris Brezillon, Hans Verkuil,
Michael Turquette
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Brezillon <boris.brezillon@free-electrons.com>
commit f96423f483b1a7854270335b319e8d1cdd6f3585 upstream.
Since commit 1bdf02326b71e ("clk: at91: make use of syscon/regmap
internally"), clk_programmable_set_parent() is always selecting the
first parent (AKA slow_clk), no matter what's passed in the 'index'
parameter.
Fix that by initializing the pckr variable to the index value.
Signed-off-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Reported-by: Hans Verkuil <hans.verkuil@cisco.com>
Fixes: 1bdf02326b71e ("clk: at91: make use of syscon/regmap internally")
Signed-off-by: Michael Turquette <mturquette@baylibre.com>
Link: lkml.kernel.org/r/1468828152-18389-1-git-send-email-boris.brezillon@free-electrons.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/clk/at91/clk-programmable.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/clk/at91/clk-programmable.c
+++ b/drivers/clk/at91/clk-programmable.c
@@ -99,7 +99,7 @@ static int clk_programmable_set_parent(s
struct clk_programmable *prog = to_clk_programmable(hw);
const struct clk_programmable_layout *layout = prog->layout;
unsigned int mask = layout->css_mask;
- unsigned int pckr = 0;
+ unsigned int pckr = index;
if (layout->have_slck_mck)
mask |= AT91_PMC_CSSMCK_MCK;
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 65/96] lockd: unregister notifier blocks if the service fails to come up completely
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (58 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 64/96] clk: at91: fix clk_programmable_set_parent() Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 66/96] platform/chrome: cros_ec_dev - double fetch bug in ioctl Greg Kroah-Hartman
` (31 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Scott Mayhew, J. Bruce Fields
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scott Mayhew <smayhew@redhat.com>
commit cb7d224f82e41d82518e7f9ea271d215d4d08e6e upstream.
If the lockd service fails to start up then we need to be sure that the
notifier blocks are not registered, otherwise a subsequent start of the
service could cause the same notifier to be registered twice, leading to
soft lockups.
Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Fixes: 0751ddf77b6a "lockd: Register callbacks on the inetaddr_chain..."
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/lockd/svc.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -335,12 +335,17 @@ static struct notifier_block lockd_inet6
};
#endif
-static void lockd_svc_exit_thread(void)
+static void lockd_unregister_notifiers(void)
{
unregister_inetaddr_notifier(&lockd_inetaddr_notifier);
#if IS_ENABLED(CONFIG_IPV6)
unregister_inet6addr_notifier(&lockd_inet6addr_notifier);
#endif
+}
+
+static void lockd_svc_exit_thread(void)
+{
+ lockd_unregister_notifiers();
svc_exit_thread(nlmsvc_rqst);
}
@@ -462,7 +467,7 @@ int lockd_up(struct net *net)
* Note: svc_serv structures have an initial use count of 1,
* so we exit through here on both success and failure.
*/
-err_net:
+err_put:
svc_destroy(serv);
err_create:
mutex_unlock(&nlmsvc_mutex);
@@ -470,7 +475,9 @@ err_create:
err_start:
lockd_down_net(serv, net);
- goto err_net;
+err_net:
+ lockd_unregister_notifiers();
+ goto err_put;
}
EXPORT_SYMBOL_GPL(lockd_up);
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 66/96] platform/chrome: cros_ec_dev - double fetch bug in ioctl
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (59 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 65/96] lockd: unregister notifier blocks if the service fails to come up completely Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 67/96] qeth: delete napi struct when removing a qeth device Greg Kroah-Hartman
` (30 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Pengfei Wang, Dan Carpenter,
Kees Cook, Gwendal Grignou, Olof Johansson
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <dan.carpenter@oracle.com>
commit 096cdc6f52225835ff503f987a0d68ef770bb78e upstream.
We verify "u_cmd.outsize" and "u_cmd.insize" but we need to make sure
that those values have not changed between the two copy_from_user()
calls. Otherwise it could lead to a buffer overflow.
Additionally, cros_ec_cmd_xfer() can set s_cmd->insize to a lower value.
We should use the new smaller value so we don't copy too much data to
the user.
Reported-by: Pengfei Wang <wpengfeinudt@gmail.com>
Fixes: a841178445bb ('mfd: cros_ec: Use a zero-length array for command data')
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Tested-by: Gwendal Grignou <gwendal@chromium.org>
Signed-off-by: Olof Johansson <olof@lixom.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/platform/chrome/cros_ec_dev.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
--- a/drivers/platform/chrome/cros_ec_dev.c
+++ b/drivers/platform/chrome/cros_ec_dev.c
@@ -147,13 +147,19 @@ static long ec_device_ioctl_xcmd(struct
goto exit;
}
+ if (u_cmd.outsize != s_cmd->outsize ||
+ u_cmd.insize != s_cmd->insize) {
+ ret = -EINVAL;
+ goto exit;
+ }
+
s_cmd->command += ec->cmd_offset;
ret = cros_ec_cmd_xfer(ec->ec_dev, s_cmd);
/* Only copy data to userland if data was received. */
if (ret < 0)
goto exit;
- if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + u_cmd.insize))
+ if (copy_to_user(arg, s_cmd, sizeof(*s_cmd) + s_cmd->insize))
ret = -EFAULT;
exit:
kfree(s_cmd);
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 67/96] qeth: delete napi struct when removing a qeth device
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (60 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 66/96] platform/chrome: cros_ec_dev - double fetch bug in ioctl Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 68/96] init/Kconfig: keep Expert users menu together Greg Kroah-Hartman
` (29 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Ursula Braun, Alexander Klein,
David S. Miller
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ursula Braun <ubraun@linux.vnet.ibm.com>
commit 7831b4ff0d926e0deeaabef9db8800ed069a2757 upstream.
A qeth_card contains a napi_struct linked to the net_device during
device probing. This struct must be deleted when removing the qeth
device, otherwise Panic on oops can occur when qeth devices are
repeatedly removed and added.
Fixes: a1c3ed4c9ca ("qeth: NAPI support for l2 and l3 discipline")
Signed-off-by: Ursula Braun <ubraun@linux.vnet.ibm.com>
Tested-by: Alexander Klein <ALKL@de.ibm.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/s390/net/qeth_l2_main.c | 1 +
drivers/s390/net/qeth_l3_main.c | 1 +
2 files changed, 2 insertions(+)
--- a/drivers/s390/net/qeth_l2_main.c
+++ b/drivers/s390/net/qeth_l2_main.c
@@ -1051,6 +1051,7 @@ static void qeth_l2_remove_device(struct
qeth_l2_set_offline(cgdev);
if (card->dev) {
+ netif_napi_del(&card->napi);
unregister_netdev(card->dev);
card->dev = NULL;
}
--- a/drivers/s390/net/qeth_l3_main.c
+++ b/drivers/s390/net/qeth_l3_main.c
@@ -3226,6 +3226,7 @@ static void qeth_l3_remove_device(struct
qeth_l3_set_offline(cgdev);
if (card->dev) {
+ netif_napi_del(&card->napi);
unregister_netdev(card->dev);
card->dev = NULL;
}
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 68/96] init/Kconfig: keep Expert users menu together
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (61 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 67/96] qeth: delete napi struct when removing a qeth device Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 69/96] block: fix use-after-free in sys_ioprio_get() Greg Kroah-Hartman
` (28 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Ard Biesheuvel, Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Randy Dunlap <rdunlap@infradead.org>
commit 076501ff6ba265a473689c112eda9f1f34f620b5 upstream.
The "expert" menu was broken (split) such that all entries in it after
KALLSYMS were displayed in the "General setup" area instead of in the
"Expert users" area. Fix this by adding one kconfig dependency.
Yes, the Expert users menu is fragile. Problems like this have happened
several times in the past. I will attempt to isolate the Expert users
menu if there is interest in that.
Fixes: 4d5d5664c900 ("x86: kallsyms: disable absolute percpu symbols on !SMP")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
init/Kconfig | 1 +
1 file changed, 1 insertion(+)
--- a/init/Kconfig
+++ b/init/Kconfig
@@ -1423,6 +1423,7 @@ config KALLSYMS_ALL
config KALLSYMS_ABSOLUTE_PERCPU
bool
+ depends on KALLSYMS
default X86_64 && SMP
config KALLSYMS_BASE_RELATIVE
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 69/96] block: fix use-after-free in sys_ioprio_get()
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (62 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 68/96] init/Kconfig: keep Expert users menu together Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 70/96] mmc: block: fix free of uninitialized idata->buf Greg Kroah-Hartman
` (27 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitry Vyukov, Omar Sandoval, Jens Axboe
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Omar Sandoval <osandov@fb.com>
commit 8ba8682107ee2ca3347354e018865d8e1967c5f4 upstream.
get_task_ioprio() accesses the task->io_context without holding the task
lock and thus can race with exit_io_context(), leading to a
use-after-free. The reproducer below hits this within a few seconds on
my 4-core QEMU VM:
#define _GNU_SOURCE
#include <assert.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <sys/wait.h>
int main(int argc, char **argv)
{
pid_t pid, child;
long nproc, i;
/* ioprio_set(IOPRIO_WHO_PROCESS, 0, IOPRIO_PRIO_VALUE(IOPRIO_CLASS_IDLE, 0)); */
syscall(SYS_ioprio_set, 1, 0, 0x6000);
nproc = sysconf(_SC_NPROCESSORS_ONLN);
for (i = 0; i < nproc; i++) {
pid = fork();
assert(pid != -1);
if (pid == 0) {
for (;;) {
pid = fork();
assert(pid != -1);
if (pid == 0) {
_exit(0);
} else {
child = wait(NULL);
assert(child == pid);
}
}
}
pid = fork();
assert(pid != -1);
if (pid == 0) {
for (;;) {
/* ioprio_get(IOPRIO_WHO_PGRP, 0); */
syscall(SYS_ioprio_get, 2, 0);
}
}
}
for (;;) {
/* ioprio_get(IOPRIO_WHO_PGRP, 0); */
syscall(SYS_ioprio_get, 2, 0);
}
return 0;
}
This gets us KASAN dumps like this:
[ 35.526914] ==================================================================
[ 35.530009] BUG: KASAN: out-of-bounds in get_task_ioprio+0x7b/0x90 at addr ffff880066f34e6c
[ 35.530009] Read of size 2 by task ioprio-gpf/363
[ 35.530009] =============================================================================
[ 35.530009] BUG blkdev_ioc (Not tainted): kasan: bad access detected
[ 35.530009] -----------------------------------------------------------------------------
[ 35.530009] Disabling lock debugging due to kernel taint
[ 35.530009] INFO: Allocated in create_task_io_context+0x2b/0x370 age=0 cpu=0 pid=360
[ 35.530009] ___slab_alloc+0x55d/0x5a0
[ 35.530009] __slab_alloc.isra.20+0x2b/0x40
[ 35.530009] kmem_cache_alloc_node+0x84/0x200
[ 35.530009] create_task_io_context+0x2b/0x370
[ 35.530009] get_task_io_context+0x92/0xb0
[ 35.530009] copy_process.part.8+0x5029/0x5660
[ 35.530009] _do_fork+0x155/0x7e0
[ 35.530009] SyS_clone+0x19/0x20
[ 35.530009] do_syscall_64+0x195/0x3a0
[ 35.530009] return_from_SYSCALL_64+0x0/0x6a
[ 35.530009] INFO: Freed in put_io_context+0xe7/0x120 age=0 cpu=0 pid=1060
[ 35.530009] __slab_free+0x27b/0x3d0
[ 35.530009] kmem_cache_free+0x1fb/0x220
[ 35.530009] put_io_context+0xe7/0x120
[ 35.530009] put_io_context_active+0x238/0x380
[ 35.530009] exit_io_context+0x66/0x80
[ 35.530009] do_exit+0x158e/0x2b90
[ 35.530009] do_group_exit+0xe5/0x2b0
[ 35.530009] SyS_exit_group+0x1d/0x20
[ 35.530009] entry_SYSCALL_64_fastpath+0x1a/0xa4
[ 35.530009] INFO: Slab 0xffffea00019bcd00 objects=20 used=4 fp=0xffff880066f34ff0 flags=0x1fffe0000004080
[ 35.530009] INFO: Object 0xffff880066f34e58 @offset=3672 fp=0x0000000000000001
[ 35.530009] ==================================================================
Fix it by grabbing the task lock while we poke at the io_context.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Omar Sandoval <osandov@fb.com>
Signed-off-by: Jens Axboe <axboe@fb.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
block/ioprio.c | 2 ++
1 file changed, 2 insertions(+)
--- a/block/ioprio.c
+++ b/block/ioprio.c
@@ -150,8 +150,10 @@ static int get_task_ioprio(struct task_s
if (ret)
goto out;
ret = IOPRIO_PRIO_VALUE(IOPRIO_CLASS_NONE, IOPRIO_NORM);
+ task_lock(p);
if (p->io_context)
ret = p->io_context->ioprio;
+ task_unlock(p);
out:
return ret;
}
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 70/96] mmc: block: fix free of uninitialized idata->buf
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (63 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 69/96] block: fix use-after-free in sys_ioprio_get() Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 71/96] mmc: block: fix packed command header endianness Greg Kroah-Hartman
` (26 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ville Viinikka, Ulf Hansson
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ville Viinikka <ville@tuxera.com>
commit bfe5b1b1e013f7b1c0fd2ac3b3c8c380114b3fb9 upstream.
Set 'idata->buf' to NULL so that it never gets returned without
initialization. This fixes a bug where mmc_blk_ioctl_cmd() would
free both 'idata' and 'idata->buf' but 'idata->buf' was returned
uninitialized.
Fixes: 1ff8950c0433 ("mmc: block: change to use kmalloc when copy data from userspace")
Signed-off-by: Ville Viinikka <ville@tuxera.com>
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/card/block.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -352,8 +352,10 @@ static struct mmc_blk_ioc_data *mmc_blk_
goto idata_err;
}
- if (!idata->buf_bytes)
+ if (!idata->buf_bytes) {
+ idata->buf = NULL;
return idata;
+ }
idata->buf = kmalloc(idata->buf_bytes, GFP_KERNEL);
if (!idata->buf) {
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 71/96] mmc: block: fix packed command header endianness
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (64 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 70/96] mmc: block: fix free of uninitialized idata->buf Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 72/96] sched/fair: Fix effective_load() to consistently use smoothed load Greg Kroah-Hartman
` (25 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Taras Kondratiuk, Ulf Hansson
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Taras Kondratiuk <takondra@cisco.com>
commit f68381a70bb2b26c31b13fdaf67c778f92fd32b4 upstream.
The code that fills packed command header assumes that CPU runs in
little-endian mode. Hence the header is malformed in big-endian mode
and causes MMC data transfer errors:
[ 563.200828] mmcblk0: error -110 transferring data, sector 2048, nr 8, cmd response 0x900, card status 0xc40
[ 563.219647] mmcblk0: packed cmd failed, nr 2, sectors 16, failure index: -1
Convert header data to LE.
Signed-off-by: Taras Kondratiuk <takondra@cisco.com>
Fixes: ce39f9d17c14 ("mmc: support packed write command for eMMC4.5 devices")
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/mmc/card/block.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
--- a/drivers/mmc/card/block.c
+++ b/drivers/mmc/card/block.c
@@ -1762,8 +1762,8 @@ static void mmc_blk_packed_hdr_wrq_prep(
packed_cmd_hdr = packed->cmd_hdr;
memset(packed_cmd_hdr, 0, sizeof(packed->cmd_hdr));
- packed_cmd_hdr[0] = (packed->nr_entries << 16) |
- (PACKED_CMD_WR << 8) | PACKED_CMD_VER;
+ packed_cmd_hdr[0] = cpu_to_le32((packed->nr_entries << 16) |
+ (PACKED_CMD_WR << 8) | PACKED_CMD_VER);
hdr_blocks = mmc_large_sector(card) ? 8 : 1;
/*
@@ -1777,14 +1777,14 @@ static void mmc_blk_packed_hdr_wrq_prep(
((brq->data.blocks * brq->data.blksz) >=
card->ext_csd.data_tag_unit_size);
/* Argument of CMD23 */
- packed_cmd_hdr[(i * 2)] =
+ packed_cmd_hdr[(i * 2)] = cpu_to_le32(
(do_rel_wr ? MMC_CMD23_ARG_REL_WR : 0) |
(do_data_tag ? MMC_CMD23_ARG_TAG_REQ : 0) |
- blk_rq_sectors(prq);
+ blk_rq_sectors(prq));
/* Argument of CMD18 or CMD25 */
- packed_cmd_hdr[((i * 2)) + 1] =
+ packed_cmd_hdr[((i * 2)) + 1] = cpu_to_le32(
mmc_card_blockaddr(card) ?
- blk_rq_pos(prq) : blk_rq_pos(prq) << 9;
+ blk_rq_pos(prq) : blk_rq_pos(prq) << 9);
packed->blocks += blk_rq_sectors(prq);
i++;
}
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 72/96] sched/fair: Fix effective_load() to consistently use smoothed load
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (65 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 71/96] mmc: block: fix packed command header endianness Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 73/96] can: at91_can: RX queue could get stuck at high bus load Greg Kroah-Hartman
` (24 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Zijlstra (Intel),
Linus Torvalds, Thomas Gleixner, Ingo Molnar
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Zijlstra <peterz@infradead.org>
commit 7dd4912594daf769a46744848b05bd5bc6d62469 upstream.
Starting with the following commit:
fde7d22e01aa ("sched/fair: Fix overly small weight for interactive group entities")
calc_tg_weight() doesn't compute the right value as expected by effective_load().
The difference is in the 'correction' term. In order to ensure \Sum
rw_j >= rw_i we cannot use tg->load_avg directly, since that might be
lagging a correction on the current cfs_rq->avg.load_avg value.
Therefore we use tg->load_avg - cfs_rq->tg_load_avg_contrib +
cfs_rq->avg.load_avg.
Now, per the referenced commit, calc_tg_weight() doesn't use
cfs_rq->avg.load_avg, as is later used in @w, but uses
cfs_rq->load.weight instead.
So stop using calc_tg_weight() and do it explicitly.
The effects of this bug are wake_affine() making randomly
poor choices in cgroup-intense workloads.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: fde7d22e01aa ("sched/fair: Fix overly small weight for interactive group entities")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/sched/fair.c | 15 +++++++++------
1 file changed, 9 insertions(+), 6 deletions(-)
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -687,8 +687,6 @@ void init_entity_runnable_average(struct
/* when this task enqueue'ed, it will contribute to its cfs_rq's load_avg */
}
-static inline unsigned long cfs_rq_runnable_load_avg(struct cfs_rq *cfs_rq);
-static inline unsigned long cfs_rq_load_avg(struct cfs_rq *cfs_rq);
#else
void init_entity_runnable_average(struct sched_entity *se)
{
@@ -4822,19 +4820,24 @@ static long effective_load(struct task_g
return wl;
for_each_sched_entity(se) {
- long w, W;
+ struct cfs_rq *cfs_rq = se->my_q;
+ long W, w = cfs_rq_load_avg(cfs_rq);
- tg = se->my_q->tg;
+ tg = cfs_rq->tg;
/*
* W = @wg + \Sum rw_j
*/
- W = wg + calc_tg_weight(tg, se->my_q);
+ W = wg + atomic_long_read(&tg->load_avg);
+
+ /* Ensure \Sum rw_j >= rw_i */
+ W -= cfs_rq->tg_load_avg_contrib;
+ W += w;
/*
* w = rw_i + @wl
*/
- w = cfs_rq_load_avg(se->my_q) + wl;
+ w += wl;
/*
* wl = S * s'_i; see (2)
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 73/96] can: at91_can: RX queue could get stuck at high bus load
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (66 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 72/96] sched/fair: Fix effective_load() to consistently use smoothed load Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 74/96] can: c_can: Update D_CAN TX and RX functions to 32 bit - fix Altera Cyclone access Greg Kroah-Hartman
` (23 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wolfgang Grandegger, Amr Bekhit,
Marc Kleine-Budde
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wolfgang Grandegger <wg@grandegger.com>
commit 43200a4480cbbe660309621817f54cbb93907108 upstream.
At high bus load it could happen that "at91_poll()" enters with all RX
message boxes filled up. If then at the end the "quota" is exceeded as
well, "rx_next" will not be reset to the first RX mailbox and hence the
interrupts remain disabled.
Signed-off-by: Wolfgang Grandegger <wg@grandegger.com>
Tested-by: Amr Bekhit <amrbekhit@gmail.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/at91_can.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/net/can/at91_can.c
+++ b/drivers/net/can/at91_can.c
@@ -712,9 +712,10 @@ static int at91_poll_rx(struct net_devic
/* upper group completed, look again in lower */
if (priv->rx_next > get_mb_rx_low_last(priv) &&
- quota > 0 && mb > get_mb_rx_last(priv)) {
+ mb > get_mb_rx_last(priv)) {
priv->rx_next = get_mb_rx_first(priv);
- goto again;
+ if (quota > 0)
+ goto again;
}
return received;
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 74/96] can: c_can: Update D_CAN TX and RX functions to 32 bit - fix Altera Cyclone access
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (67 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 73/96] can: at91_can: RX queue could get stuck at high bus load Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 75/96] can: fix handling of unmodifiable configuration options fix Greg Kroah-Hartman
` (22 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Richard Andrysek, Thor Thayer,
Marc Kleine-Budde
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thor Thayer <tthayer@opensource.altera.com>
commit 427460c83cdf55069eee49799a0caef7dde8df69 upstream.
When testing CAN write floods on Altera's CycloneV, the first 2 bytes
are sometimes 0x00, 0x00 or corrupted instead of the values sent. Also
observed bytes 4 & 5 were corrupted in some cases.
The D_CAN Data registers are 32 bits and changing from 16 bit writes to
32 bit writes fixes the problem.
Testing performed on Altera CycloneV (D_CAN). Requesting tests on other
C_CAN & D_CAN platforms.
Reported-by: Richard Andrysek <richard.andrysek@gomtec.de>
Signed-off-by: Thor Thayer <tthayer@opensource.altera.com>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/c_can/c_can.c | 38 +++++++++++++++++++++++++++++++-------
1 file changed, 31 insertions(+), 7 deletions(-)
--- a/drivers/net/can/c_can/c_can.c
+++ b/drivers/net/can/c_can/c_can.c
@@ -332,9 +332,23 @@ static void c_can_setup_tx_object(struct
priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface), ctrl);
- for (i = 0; i < frame->can_dlc; i += 2) {
- priv->write_reg(priv, C_CAN_IFACE(DATA1_REG, iface) + i / 2,
- frame->data[i] | (frame->data[i + 1] << 8));
+ if (priv->type == BOSCH_D_CAN) {
+ u32 data = 0, dreg = C_CAN_IFACE(DATA1_REG, iface);
+
+ for (i = 0; i < frame->can_dlc; i += 4, dreg += 2) {
+ data = (u32)frame->data[i];
+ data |= (u32)frame->data[i + 1] << 8;
+ data |= (u32)frame->data[i + 2] << 16;
+ data |= (u32)frame->data[i + 3] << 24;
+ priv->write_reg32(priv, dreg, data);
+ }
+ } else {
+ for (i = 0; i < frame->can_dlc; i += 2) {
+ priv->write_reg(priv,
+ C_CAN_IFACE(DATA1_REG, iface) + i / 2,
+ frame->data[i] |
+ (frame->data[i + 1] << 8));
+ }
}
}
@@ -402,10 +416,20 @@ static int c_can_read_msg_object(struct
} else {
int i, dreg = C_CAN_IFACE(DATA1_REG, iface);
- for (i = 0; i < frame->can_dlc; i += 2, dreg ++) {
- data = priv->read_reg(priv, dreg);
- frame->data[i] = data;
- frame->data[i + 1] = data >> 8;
+ if (priv->type == BOSCH_D_CAN) {
+ for (i = 0; i < frame->can_dlc; i += 4, dreg += 2) {
+ data = priv->read_reg32(priv, dreg);
+ frame->data[i] = data;
+ frame->data[i + 1] = data >> 8;
+ frame->data[i + 2] = data >> 16;
+ frame->data[i + 3] = data >> 24;
+ }
+ } else {
+ for (i = 0; i < frame->can_dlc; i += 2, dreg++) {
+ data = priv->read_reg(priv, dreg);
+ frame->data[i] = data;
+ frame->data[i + 1] = data >> 8;
+ }
}
}
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 75/96] can: fix handling of unmodifiable configuration options fix
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (68 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 74/96] can: c_can: Update D_CAN TX and RX functions to 32 bit - fix Altera Cyclone access Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 76/96] can: fix oops caused by wrong rtnl dellink usage Greg Kroah-Hartman
` (21 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, ajneu, Oliver Hartkopp, Marc Kleine-Budde
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
commit bce271f255dae8335dc4d2ee2c4531e09cc67f5a upstream.
With upstream commit bb208f144cf3f59 (can: fix handling of unmodifiable
configuration options) a new can_validate() function was introduced.
When invoking 'ip link set can0 type can' without any configuration data
can_validate() tries to validate the content without taking into account that
there's totally no content. This patch adds a check for missing content.
Reported-by: ajneu <ajneu1@gmail.com>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/dev.c | 3 +++
1 file changed, 3 insertions(+)
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -798,6 +798,9 @@ static int can_validate(struct nlattr *t
* - control mode with CAN_CTRLMODE_FD set
*/
+ if (!data)
+ return 0;
+
if (data[IFLA_CAN_CTRLMODE]) {
struct can_ctrlmode *cm = nla_data(data[IFLA_CAN_CTRLMODE]);
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 76/96] can: fix oops caused by wrong rtnl dellink usage
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (69 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 75/96] can: fix handling of unmodifiable configuration options fix Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 77/96] RDS: fix rds_tcp_init() error path Greg Kroah-Hartman
` (20 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, ajneu, Oliver Hartkopp, Marc Kleine-Budde
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
commit 25e1ed6e64f52a692ba3191c4fde650aab3ecc07 upstream.
For 'real' hardware CAN devices the netlink interface is used to set CAN
specific communication parameters. Real CAN hardware can not be created nor
removed with the ip tool ...
This patch adds a private dellink function for the CAN device driver interface
that does just nothing.
It's a follow up to commit 993e6f2fd ("can: fix oops caused by wrong rtnl
newlink usage") but for dellink.
Reported-by: ajneu <ajneu1@gmail.com>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/dev.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/net/can/dev.c
+++ b/drivers/net/can/dev.c
@@ -1011,6 +1011,11 @@ static int can_newlink(struct net *src_n
return -EOPNOTSUPP;
}
+static void can_dellink(struct net_device *dev, struct list_head *head)
+{
+ return;
+}
+
static struct rtnl_link_ops can_link_ops __read_mostly = {
.kind = "can",
.maxtype = IFLA_CAN_MAX,
@@ -1019,6 +1024,7 @@ static struct rtnl_link_ops can_link_ops
.validate = can_validate,
.newlink = can_newlink,
.changelink = can_changelink,
+ .dellink = can_dellink,
.get_size = can_get_size,
.fill_info = can_fill_info,
.get_xstats_size = can_get_xstats_size,
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 77/96] RDS: fix rds_tcp_init() error path
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (70 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 76/96] can: fix oops caused by wrong rtnl dellink usage Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 78/96] irqchip/mips-gic: Map to VPs using HW VPNum Greg Kroah-Hartman
` (19 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sowmini Varadhan, David S. Miller,
Vegard Nossum, Santosh Shilimkar
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Vegard Nossum <vegard.nossum@oracle.com>
commit 3dad5424adfb346c871847d467f97dcdca64ea97 upstream.
If register_pernet_subsys() fails, we shouldn't try to call
unregister_pernet_subsys().
Fixes: 467fa15356 ("RDS-TCP: Support multiple RDS-TCP listen endpoints, one per netns.")
Cc: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
Acked-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/rds/tcp.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -544,7 +544,7 @@ static int rds_tcp_init(void)
ret = rds_tcp_recv_init();
if (ret)
- goto out_slab;
+ goto out_pernet;
ret = rds_trans_register(&rds_tcp_transport);
if (ret)
@@ -556,8 +556,9 @@ static int rds_tcp_init(void)
out_recv:
rds_tcp_recv_exit();
-out_slab:
+out_pernet:
unregister_pernet_subsys(&rds_tcp_net_ops);
+out_slab:
kmem_cache_destroy(rds_tcp_conn_slab);
out:
return ret;
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 78/96] irqchip/mips-gic: Map to VPs using HW VPNum
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (71 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 77/96] RDS: fix rds_tcp_init() error path Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 79/96] irqchip/mips-gic: Match IPI IRQ domain by bus token only Greg Kroah-Hartman
` (18 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul Burton, linux-mips,
Jason Cooper, Qais Yousef, Ralf Baechle, Marc Zyngier,
Thomas Gleixner
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Burton <paul.burton@imgtec.com>
commit 99ec8a3608330d202448085185cf28389b789b7b upstream.
When mapping an interrupt to a VP(E) we must use the identifier for the
VP that the hardware expects, and this does not always match up with the
Linux CPU number. Commit d46812bb0bef ("irqchip: mips-gic: Use HW IDs
for VPE_OTHER_ADDR") corrected this for the cases that existed at the
time it was written, but commit 2af70a962070 ("irqchip/mips-gic: Add a
IPI hierarchy domain") added another case before the former patch was
merged. This leads to incorrectly using Linux CPU numbers when mapping
interrupts to VPs, which breaks on certain systems such as those with
multi-core I6400 CPUs. Fix by adding the appropriate call to
mips_cm_vp_id() to retrieve the expected VP identifier.
Fixes: d46812bb0bef ("irqchip: mips-gic: Use HW IDs for VPE_OTHER_ADDR")
Fixes: 2af70a962070 ("irqchip/mips-gic: Add a IPI hierarchy domain")
Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: Jason Cooper <jason@lakedaemon.net>
Cc: Qais Yousef <qsyousef@gmail.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Link: http://lkml.kernel.org/r/20160705132600.27730-1-paul.burton@imgtec.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/irqchip/irq-mips-gic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -706,7 +706,7 @@ static int gic_shared_irq_domain_map(str
spin_lock_irqsave(&gic_lock, flags);
gic_map_to_pin(intr, gic_cpu_pin);
- gic_map_to_vpe(intr, vpe);
+ gic_map_to_vpe(intr, mips_cm_vp_id(vpe));
for (i = 0; i < min(gic_vpes, NR_CPUS); i++)
clear_bit(intr, pcpu_masks[i].pcpu_mask);
set_bit(intr, pcpu_masks[vpe].pcpu_mask);
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 79/96] irqchip/mips-gic: Match IPI IRQ domain by bus token only
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (72 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 78/96] irqchip/mips-gic: Map to VPs using HW VPNum Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 81/96] SCSI: fix new bug in scsi_dev_info_list string matching Greg Kroah-Hartman
` (17 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Paul Burton, linux-mips,
Jason Cooper, Qais Yousef, Ralf Baechle, Marc Zyngier,
Thomas Gleixner
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Paul Burton <paul.burton@imgtec.com>
commit 547aefc4db877e65245c3d95fcce703701bf3a0c upstream.
Commit fbde2d7d8290 ("MIPS: Add generic SMP IPI support") introduced
code which calls irq_find_matching_host with a NULL node parameter in
order to discover IPI IRQ domains which are not associated with the DT
root node's interrupt parent. This suggests that implementations of IPI
IRQ domains should effectively ignore the node parameter if it is NULL
and search purely based upon the bus token. Commit 2af70a962070
("irqchip/mips-gic: Add a IPI hierarchy domain") did not do this when
implementing the GIC IPI IRQ domain, and on MIPS Boston boards this
leads to no IPI domain being discovered and a NULL pointer dereference
when attempting to send an IPI:
CPU 0 Unable to handle kernel paging request at virtual address 0000000000000040, epc == ffffffff8016e70c, ra == ffffffff8010ff5c
Oops[#1]:
CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.7.0-rc6-00223-gad0d1b6 #945
task: a8000000ff066fc0 ti: a8000000ff068000 task.ti: a8000000ff068000
$ 0 : 0000000000000000 0000000000000001 ffffffff80730000 0000000000000003
$ 4 : 0000000000000000 ffffffff8057e5b0 a800000001e3ee00 0000000000000000
$ 8 : 0000000000000000 0000000000000023 0000000000000001 0000000000000001
$12 : 0000000000000000 ffffffff803323d0 0000000000000000 0000000000000000
$16 : 0000000000000000 0000000000000000 0000000000000001 ffffffff801108fc
$20 : 0000000000000000 ffffffff8057e5b0 0000000000000001 0000000000000000
$24 : 0000000000000000 ffffffff8012de28
$28 : a8000000ff068000 a8000000ff06fbc0 0000000000000000 ffffffff8010ff5c
Hi : ffffffff8014c174
Lo : a800000001e1e140
epc : ffffffff8016e70c __ipi_send_mask+0x24/0x11c
ra : ffffffff8010ff5c mips_smp_send_ipi_mask+0x68/0x178
Status: 140084e2 KX SX UX KERNEL EXL
Cause : 00800008 (ExcCode 02)
BadVA : 0000000000000040
PrId : 0001a920 (MIPS I6400)
Process swapper/0 (pid: 1, threadinfo=a8000000ff068000, task=a8000000ff066fc0, tls=0000000000000000)
Stack : 0000000000000000 0000000000000000 0000000000000001 ffffffff801108fc
0000000000000000 ffffffff8057e5b0 0000000000000001 ffffffff8010ff5c
0000000000000001 0000000000000020 0000000000000000 0000000000000000
0000000000000000 ffffffff801108fc 0000000000000000 0000000000000001
0000000000000001 0000000000000000 0000000000000000 ffffffff801865e8
a8000000ff0c7500 a8000000ff06fc90 0000000000000001 0000000000000002
ffffffff801108fc ffffffff801868b8 0000000000000000 ffffffff801108fc
0000000000000000 0000000000000003 ffffffff8068c700 0000000000000001
ffffffff80730000 0000000000000001 a8000000ff00a290 ffffffff80110c50
0000000000000003 a800000001e48308 0000000000000003 0000000000000008
...
Call Trace:
[<ffffffff8016e70c>] __ipi_send_mask+0x24/0x11c
[<ffffffff8010ff5c>] mips_smp_send_ipi_mask+0x68/0x178
[<ffffffff801865e8>] generic_exec_single+0x150/0x170
[<ffffffff801868b8>] smp_call_function_single+0x108/0x160
[<ffffffff80110c50>] cps_boot_secondary+0x328/0x394
[<ffffffff80110534>] __cpu_up+0x38/0x90
[<ffffffff8012de4c>] bringup_cpu+0x24/0xac
[<ffffffff8012df40>] cpuhp_up_callbacks+0x58/0xdc
[<ffffffff8012e648>] cpu_up+0x118/0x18c
[<ffffffff806dc158>] smp_init+0xbc/0xe8
[<ffffffff806d4c18>] kernel_init_freeable+0xa0/0x228
[<ffffffff8056c908>] kernel_init+0x10/0xf0
[<ffffffff80105098>] ret_from_kernel_thread+0x14/0x1c
Fix this by allowing the GIC IPI IRQ domain to match purely based upon
the bus token if the node provided is NULL.
Fixes: 2af70a962070 ("irqchip/mips-gic: Add a IPI hierarchy domain")
Signed-off-by: Paul Burton <paul.burton@imgtec.com>
Cc: linux-mips@linux-mips.org
Cc: Jason Cooper <jason@lakedaemon.net>
Cc: Qais Yousef <qsyousef@gmail.com>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Marc Zyngier <marc.zyngier@arm.com>
Link: http://lkml.kernel.org/r/20160705132600.27730-2-paul.burton@imgtec.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/irqchip/irq-mips-gic.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/irqchip/irq-mips-gic.c
+++ b/drivers/irqchip/irq-mips-gic.c
@@ -947,7 +947,7 @@ int gic_ipi_domain_match(struct irq_doma
switch (bus_token) {
case DOMAIN_BUS_IPI:
is_ipi = d->bus_token == bus_token;
- return to_of_node(d->fwnode) == node && is_ipi;
+ return (!node || to_of_node(d->fwnode) == node) && is_ipi;
break;
default:
return 0;
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 81/96] SCSI: fix new bug in scsi_dev_info_list string matching
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (73 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 79/96] irqchip/mips-gic: Match IPI IRQ domain by bus token only Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 82/96] ipr: Clear interrupt on croc/crocodile when running with LSI Greg Kroah-Hartman
` (16 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alan Stern, Wilfried Klaebe,
Martin K. Petersen
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <stern@rowland.harvard.edu>
commit 5e7ff2ca7f2da55fe777167849d0c93403bd0dc8 upstream.
Commit b704f70ce200 ("SCSI: fix bug in scsi_dev_info_list matching")
changed the way vendor- and model-string matching was carried out in the
routine that looks up entries in a SCSI devinfo list. The new matching
code failed to take into account the case of a maximum-length string; in
such cases it could end up testing for a terminating '\0' byte beyond
the end of the memory allocated to the string. This out-of-bounds bug
was detected by UBSAN.
I don't know if anybody has actually encountered this bug. The symptom
would be that a device entry in the blacklist might not be matched
properly if it contained an 8-character vendor name or a 16-character
model name. Such entries certainly exist in scsi_static_device_list.
This patch fixes the problem by adding a check for a maximum-length
string before the '\0' test.
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
Fixes: b704f70ce200 ("SCSI: fix bug in scsi_dev_info_list matching")
Tested-by: Wilfried Klaebe <linux-kernel@lebenslange-mailadresse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/scsi_devinfo.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
--- a/drivers/scsi/scsi_devinfo.c
+++ b/drivers/scsi/scsi_devinfo.c
@@ -429,7 +429,7 @@ static struct scsi_dev_info_list *scsi_d
* here, and we don't know what device it is
* trying to work with, leave it as-is.
*/
- vmax = 8; /* max length of vendor */
+ vmax = sizeof(devinfo->vendor);
vskip = vendor;
while (vmax > 0 && *vskip == ' ') {
vmax--;
@@ -439,7 +439,7 @@ static struct scsi_dev_info_list *scsi_d
while (vmax > 0 && vskip[vmax - 1] == ' ')
--vmax;
- mmax = 16; /* max length of model */
+ mmax = sizeof(devinfo->model);
mskip = model;
while (mmax > 0 && *mskip == ' ') {
mmax--;
@@ -455,10 +455,12 @@ static struct scsi_dev_info_list *scsi_d
* Behave like the older version of get_device_flags.
*/
if (memcmp(devinfo->vendor, vskip, vmax) ||
- devinfo->vendor[vmax])
+ (vmax < sizeof(devinfo->vendor) &&
+ devinfo->vendor[vmax]))
continue;
if (memcmp(devinfo->model, mskip, mmax) ||
- devinfo->model[mmax])
+ (mmax < sizeof(devinfo->model) &&
+ devinfo->model[mmax]))
continue;
return devinfo;
} else {
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 82/96] ipr: Clear interrupt on croc/crocodile when running with LSI
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (74 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 81/96] SCSI: fix new bug in scsi_dev_info_list string matching Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 83/96] media: fix airspy usb probe error path Greg Kroah-Hartman
` (15 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Benjamin Herrenschmidt, Brian King,
Martin K. Petersen
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Brian King <brking@linux.vnet.ibm.com>
commit 54e430bbd490e18ab116afa4cd90dcc45787b3df upstream.
If we fall back to using LSI on the Croc or Crocodile chip we need to
clear the interrupt so we don't hang the system.
Tested-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/scsi/ipr.c | 1 +
1 file changed, 1 insertion(+)
--- a/drivers/scsi/ipr.c
+++ b/drivers/scsi/ipr.c
@@ -10093,6 +10093,7 @@ static int ipr_probe_ioa(struct pci_dev
ioa_cfg->intr_flag = IPR_USE_MSI;
else {
ioa_cfg->intr_flag = IPR_USE_LSI;
+ ioa_cfg->clear_isr = 1;
ioa_cfg->nvectors = 1;
dev_info(&pdev->dev, "Cannot enable MSI.\n");
}
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 83/96] media: fix airspy usb probe error path
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (75 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 82/96] ipr: Clear interrupt on croc/crocodile when running with LSI Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 84/96] posix_cpu_timer: Exit early when process has been reaped Greg Kroah-Hartman
` (14 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, James Patrick-Evans, Kees Cook,
Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: James Patrick-Evans <james@jmp-e.com>
commit aa93d1fee85c890a34f2510a310e55ee76a27848 upstream.
Fix a memory leak on probe error of the airspy usb device driver.
The problem is triggered when more than 64 usb devices register with
v4l2 of type VFL_TYPE_SDR or VFL_TYPE_SUBDEV.
The memory leak is caused by the probe function of the airspy driver
mishandeling errors and not freeing the corresponding control structures
when an error occours registering the device to v4l2 core.
A badusb device can emulate 64 of these devices, and then through
continual emulated connect/disconnect of the 65th device, cause the
kernel to run out of RAM and crash the kernel, thus causing a local DOS
vulnerability.
Fixes CVE-2016-5400
Signed-off-by: James Patrick-Evans <james@jmp-e.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/usb/airspy/airspy.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
--- a/drivers/media/usb/airspy/airspy.c
+++ b/drivers/media/usb/airspy/airspy.c
@@ -1072,7 +1072,7 @@ static int airspy_probe(struct usb_inter
if (ret) {
dev_err(s->dev, "Failed to register as video device (%d)\n",
ret);
- goto err_unregister_v4l2_dev;
+ goto err_free_controls;
}
dev_info(s->dev, "Registered as %s\n",
video_device_node_name(&s->vdev));
@@ -1081,7 +1081,6 @@ static int airspy_probe(struct usb_inter
err_free_controls:
v4l2_ctrl_handler_free(&s->hdl);
-err_unregister_v4l2_dev:
v4l2_device_unregister(&s->v4l2_dev);
err_free_mem:
kfree(s);
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 84/96] posix_cpu_timer: Exit early when process has been reaped
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (76 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 83/96] media: fix airspy usb probe error path Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` Greg Kroah-Hartman
` (13 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexey Dobriyan, Thomas Gleixner
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexey Dobriyan <adobriyan@gmail.com>
commit 2c13ce8f6b2f6fd9ba2f9261b1939fc0f62d1307 upstream.
Variable "now" seems to be genuinely used unintialized
if branch
if (CPUCLOCK_PERTHREAD(timer->it_clock)) {
is not taken and branch
if (unlikely(sighand == NULL)) {
is taken. In this case the process has been reaped and the timer is marked as
disarmed anyway. So none of the postprocessing of the sample is
required. Return right away.
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Link: http://lkml.kernel.org/r/20160707223911.GA26483@p183.telecom.by
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/time/posix-cpu-timers.c | 1 +
1 file changed, 1 insertion(+)
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -777,6 +777,7 @@ static void posix_cpu_timer_get(struct k
timer->it.cpu.expires = 0;
sample_to_timespec(timer->it_clock, timer->it.cpu.expires,
&itp->it_value);
+ return;
} else {
cpu_timer_sample_group(timer->it_clock, p, &now);
unlock_task_sighand(p, &flags);
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 85/96] cpu/hotplug: Keep enough storage space if SMP=n to avoid array out of bounds scribble
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:10 ` [PATCH 4.6 03/96] x86/quirks: Reintroduce scanning of secondary buses Greg Kroah-Hartman
` (90 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kernel test robot, Thomas Gleixner,
Adam Borowski, Alexander Shishkin, Anna-Maria Gleixner,
Arnaldo Carvalho de Melo, Arnaldo Carvalho de Melo,
Borislav Petkov, Jiri Olsa, Kan Liang, Linus Torvalds,
Peter Zijlstra, Sebastian Andrzej Siewior, Stephane Eranian,
Vince Weaver, lkp, tipbuild, Ingo Molnar
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit a7c734140aa36413944eef0f8c660e0e2256357d upstream.
Xiaolong Ye reported lock debug warnings triggered by the following commit:
8de4a0066106 ("perf/x86: Convert the core to the hotplug state machine")
The bug is the following: the cpuhp_bp_states[] array is cut short when
CONFIG_SMP=n, but the dynamically registered callbacks are stored nevertheless
and happily scribble outside of the array bounds...
We need to store them in case that the state is unregistered so we can invoke
the teardown function. That's independent of CONFIG_SMP. Make sure the array
is large enough.
Reported-by: kernel test robot <xiaolong.ye@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Adam Borowski <kilobyte@angband.pl>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Anna-Maria Gleixner <anna-maria@linutronix.de>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Kan Liang <kan.liang@intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Stephane Eranian <eranian@google.com>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: lkp@01.org
Cc: tipbuild@zytor.com
Fixes: cff7d378d3fd "cpu/hotplug: Convert to a state machine for the control processor"
Link: http://lkml.kernel.org/r/alpine.DEB.2.11.1607122144560.4083@nanos
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/cpu.c | 2 ++
1 file changed, 2 insertions(+)
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -1218,6 +1218,8 @@ static struct cpuhp_step cpuhp_bp_states
.teardown = takedown_cpu,
.cant_stop = true,
},
+#else
+ [CPUHP_BRINGUP_CPU] = { },
#endif
};
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 85/96] cpu/hotplug: Keep enough storage space if SMP=n to avoid array out of bounds scribble
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
0 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: lkp
[-- Attachment #1: Type: text/plain, Size: 2063 bytes --]
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Thomas Gleixner <tglx@linutronix.de>
commit a7c734140aa36413944eef0f8c660e0e2256357d upstream.
Xiaolong Ye reported lock debug warnings triggered by the following commit:
8de4a0066106 ("perf/x86: Convert the core to the hotplug state machine")
The bug is the following: the cpuhp_bp_states[] array is cut short when
CONFIG_SMP=n, but the dynamically registered callbacks are stored nevertheless
and happily scribble outside of the array bounds...
We need to store them in case that the state is unregistered so we can invoke
the teardown function. That's independent of CONFIG_SMP. Make sure the array
is large enough.
Reported-by: kernel test robot <xiaolong.ye@intel.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Adam Borowski <kilobyte@angband.pl>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Anna-Maria Gleixner <anna-maria@linutronix.de>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Kan Liang <kan.liang@intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Stephane Eranian <eranian@google.com>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: lkp(a)01.org
Cc: tipbuild(a)zytor.com
Fixes: cff7d378d3fd "cpu/hotplug: Convert to a state machine for the control processor"
Link: http://lkml.kernel.org/r/alpine.DEB.2.11.1607122144560.4083(a)nanos
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
kernel/cpu.c | 2 ++
1 file changed, 2 insertions(+)
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -1218,6 +1218,8 @@ static struct cpuhp_step cpuhp_bp_states
.teardown = takedown_cpu,
.cant_stop = true,
},
+#else
+ [CPUHP_BRINGUP_CPU] = { },
#endif
};
^ permalink raw reply [flat|nested] 101+ messages in thread
* [PATCH 4.6 86/96] [media] adv7604: Dont ignore pad number in subdev DV timings pad operations
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (78 preceding siblings ...)
2016-08-08 19:11 ` Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 87/96] i2c: qup: Fix wrong value of index variable Greg Kroah-Hartman
` (11 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Laurent Pinchart, Hans Verkuil,
Mauro Carvalho Chehab
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
commit 6519c3d7b8621c9f4333c98ed4b703029b51ba79 upstream.
The dv_timings_cap() and enum_dv_timings() pad operations take a pad
number as an input argument and return the DV timings capabilities and
list of supported DV timings for that pad.
Commit bd3e275f3ec0 ("[media] media: i2c: adv7604: Use v4l2-dv-timings
helpers") broke this as it started ignoring the pad number, always
returning the information associated with the currently selected input.
Fix it.
Fixes: bd3e275f3ec0 ("[media] media: i2c: adv7604: Use v4l2-dv-timings helpers")
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/media/i2c/adv7604.c | 48 +++++++++++++++++++++++++++++++++-----------
1 file changed, 36 insertions(+), 12 deletions(-)
--- a/drivers/media/i2c/adv7604.c
+++ b/drivers/media/i2c/adv7604.c
@@ -779,11 +779,31 @@ static const struct v4l2_dv_timings_cap
V4L2_DV_BT_CAP_CUSTOM)
};
-static inline const struct v4l2_dv_timings_cap *
-adv76xx_get_dv_timings_cap(struct v4l2_subdev *sd)
-{
- return is_digital_input(sd) ? &adv76xx_timings_cap_digital :
- &adv7604_timings_cap_analog;
+/*
+ * Return the DV timings capabilities for the requested sink pad. As a special
+ * case, pad value -1 returns the capabilities for the currently selected input.
+ */
+static const struct v4l2_dv_timings_cap *
+adv76xx_get_dv_timings_cap(struct v4l2_subdev *sd, int pad)
+{
+ if (pad == -1) {
+ struct adv76xx_state *state = to_state(sd);
+
+ pad = state->selected_input;
+ }
+
+ switch (pad) {
+ case ADV76XX_PAD_HDMI_PORT_A:
+ case ADV7604_PAD_HDMI_PORT_B:
+ case ADV7604_PAD_HDMI_PORT_C:
+ case ADV7604_PAD_HDMI_PORT_D:
+ return &adv76xx_timings_cap_digital;
+
+ case ADV7604_PAD_VGA_RGB:
+ case ADV7604_PAD_VGA_COMP:
+ default:
+ return &adv7604_timings_cap_analog;
+ }
}
@@ -1329,7 +1349,7 @@ static int stdi2dv_timings(struct v4l2_s
const struct v4l2_bt_timings *bt = &v4l2_dv_timings_presets[i].bt;
if (!v4l2_valid_dv_timings(&v4l2_dv_timings_presets[i],
- adv76xx_get_dv_timings_cap(sd),
+ adv76xx_get_dv_timings_cap(sd, -1),
adv76xx_check_dv_timings, NULL))
continue;
if (vtotal(bt) != stdi->lcf + 1)
@@ -1430,18 +1450,22 @@ static int adv76xx_enum_dv_timings(struc
return -EINVAL;
return v4l2_enum_dv_timings_cap(timings,
- adv76xx_get_dv_timings_cap(sd), adv76xx_check_dv_timings, NULL);
+ adv76xx_get_dv_timings_cap(sd, timings->pad),
+ adv76xx_check_dv_timings, NULL);
}
static int adv76xx_dv_timings_cap(struct v4l2_subdev *sd,
struct v4l2_dv_timings_cap *cap)
{
struct adv76xx_state *state = to_state(sd);
+ unsigned int pad = cap->pad;
if (cap->pad >= state->source_pad)
return -EINVAL;
- *cap = *adv76xx_get_dv_timings_cap(sd);
+ *cap = *adv76xx_get_dv_timings_cap(sd, pad);
+ cap->pad = pad;
+
return 0;
}
@@ -1450,9 +1474,9 @@ static int adv76xx_dv_timings_cap(struct
static void adv76xx_fill_optional_dv_timings_fields(struct v4l2_subdev *sd,
struct v4l2_dv_timings *timings)
{
- v4l2_find_dv_timings_cap(timings, adv76xx_get_dv_timings_cap(sd),
- is_digital_input(sd) ? 250000 : 1000000,
- adv76xx_check_dv_timings, NULL);
+ v4l2_find_dv_timings_cap(timings, adv76xx_get_dv_timings_cap(sd, -1),
+ is_digital_input(sd) ? 250000 : 1000000,
+ adv76xx_check_dv_timings, NULL);
}
static unsigned int adv7604_read_hdmi_pixelclock(struct v4l2_subdev *sd)
@@ -1620,7 +1644,7 @@ static int adv76xx_s_dv_timings(struct v
bt = &timings->bt;
- if (!v4l2_valid_dv_timings(timings, adv76xx_get_dv_timings_cap(sd),
+ if (!v4l2_valid_dv_timings(timings, adv76xx_get_dv_timings_cap(sd, -1),
adv76xx_check_dv_timings, NULL))
return -ERANGE;
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 87/96] i2c: qup: Fix wrong value of index variable
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (79 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 86/96] [media] adv7604: Dont ignore pad number in subdev DV timings pad operations Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 88/96] i2c: mux: reg: wrong condition checked for of_address_to_resource return value Greg Kroah-Hartman
` (10 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Sricharan R, Wolfram Sang
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sricharan R <sricharan@codeaurora.org>
commit d4f56c7773483b8829e89cfc739b7a5a071f6da0 upstream.
index gets incremented during check to determine if the
messages can be transferred with dma. But not reset after
that, resulting in wrong start value in subsequent loop,
causing failure. Fix it.
Signed-off-by: Sricharan R <sricharan@codeaurora.org>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/busses/i2c-qup.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/i2c/busses/i2c-qup.c
+++ b/drivers/i2c/busses/i2c-qup.c
@@ -1268,6 +1268,8 @@ static int qup_i2c_xfer_v2(struct i2c_ad
}
}
+ idx = 0;
+
do {
if (msgs[idx].len == 0) {
ret = -EINVAL;
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 88/96] i2c: mux: reg: wrong condition checked for of_address_to_resource return value
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (80 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 87/96] i2c: qup: Fix wrong value of index variable Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 89/96] libata: LITE-ON CX1-JB256-HP needs lower max_sectors Greg Kroah-Hartman
` (9 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukasz Gemborowski,
Alexander Sverdlin, Wolfram Sang
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lukasz Gemborowski <lukasz.gemborowski@nokia.com>
commit 22ebf00eb56fe77922de8138aa9af9996582c2b3 upstream.
of_address_to_resource return 0 on successful call but
devm_ioremap_resource is called only if it returns non-zero value
Signed-off-by: Lukasz Gemborowski <lukasz.gemborowski@nokia.com>
Reviewed-by: Alexander Sverdlin <alexander.sverdlin@nokia.com>
Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/i2c/muxes/i2c-mux-reg.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/i2c/muxes/i2c-mux-reg.c
+++ b/drivers/i2c/muxes/i2c-mux-reg.c
@@ -150,7 +150,7 @@ static int i2c_mux_reg_probe_dt(struct r
mux->data.idle_in_use = true;
/* map address from "reg" if exists */
- if (of_address_to_resource(np, 0, &res)) {
+ if (of_address_to_resource(np, 0, &res) == 0) {
mux->data.reg_size = resource_size(&res);
mux->data.reg = devm_ioremap_resource(&pdev->dev, &res);
if (IS_ERR(mux->data.reg))
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 89/96] libata: LITE-ON CX1-JB256-HP needs lower max_sectors
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (81 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 88/96] i2c: mux: reg: wrong condition checked for of_address_to_resource return value Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 90/96] libceph: apply new_state before new_up_client on incrementals Greg Kroah-Hartman
` (8 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Tejun Heo, dgerasimov
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Tejun Heo <tj@kernel.org>
commit 1488a1e3828d60d74c9b802a05e24c0487babe4e upstream.
Since 34b48db66e08 ("block: remove artifical max_hw_sectors cap"),
max_sectors is no longer limited to BLK_DEF_MAX_SECTORS and LITE-ON
CX1-JB256-HP keeps timing out with higher max_sectors. Revert it to
the previous value.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: dgerasimov@gmail.com
Link: https://bugzilla.kernel.org/show_bug.cgi?id=121671
Fixes: 34b48db66e08 ("block: remove artifical max_hw_sectors cap")
Signed-off-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/ata/libata-core.c | 6 ++++++
1 file changed, 6 insertions(+)
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4141,6 +4141,12 @@ static const struct ata_blacklist_entry
*/
{ "ST380013AS", "3.20", ATA_HORKAGE_MAX_SEC_1024 },
+ /*
+ * Device times out with higher max sects.
+ * https://bugzilla.kernel.org/show_bug.cgi?id=121671
+ */
+ { "LITEON CX1-JB256-HP", NULL, ATA_HORKAGE_MAX_SEC_1024 },
+
/* Devices we expect to fail diagnostics */
/* Devices where NCQ should be avoided */
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 90/96] libceph: apply new_state before new_up_client on incrementals
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (82 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 89/96] libata: LITE-ON CX1-JB256-HP needs lower max_sectors Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 91/96] net: mvneta: set real interrupt per packet for tx_done Greg Kroah-Hartman
` (7 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Ilya Dryomov, Josh Durgin
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ilya Dryomov <idryomov@gmail.com>
commit 930c532869774ebf8af9efe9484c597f896a7d46 upstream.
Currently, osd_weight and osd_state fields are updated in the encoding
order. This is wrong, because an incremental map may look like e.g.
new_up_client: { osd=6, addr=... } # set osd_state and addr
new_state: { osd=6, xorstate=EXISTS } # clear osd_state
Suppose osd6's current osd_state is EXISTS (i.e. osd6 is down). After
applying new_up_client, osd_state is changed to EXISTS | UP. Carrying
on with the new_state update, we flip EXISTS and leave osd6 in a weird
"!EXISTS but UP" state. A non-existent OSD is considered down by the
mapping code
2087 for (i = 0; i < pg->pg_temp.len; i++) {
2088 if (ceph_osd_is_down(osdmap, pg->pg_temp.osds[i])) {
2089 if (ceph_can_shift_osds(pi))
2090 continue;
2091
2092 temp->osds[temp->size++] = CRUSH_ITEM_NONE;
and so requests get directed to the second OSD in the set instead of
the first, resulting in OSD-side errors like:
[WRN] : client.4239 192.168.122.21:0/2444980242 misdirected client.4239.1:2827 pg 2.5df899f2 to osd.4 not [1,4,6] in e680/680
and hung rbds on the client:
[ 493.566367] rbd: rbd0: write 400000 at 11cc00000 (0)
[ 493.566805] rbd: rbd0: result -6 xferred 400000
[ 493.567011] blk_update_request: I/O error, dev rbd0, sector 9330688
The fix is to decouple application from the decoding and:
- apply new_weight first
- apply new_state before new_up_client
- twiddle osd_state flags if marking in
- clear out some of the state if osd is destroyed
Fixes: http://tracker.ceph.com/issues/14901
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Reviewed-by: Josh Durgin <jdurgin@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/ceph/osdmap.c | 156 +++++++++++++++++++++++++++++++++++++++---------------
1 file changed, 113 insertions(+), 43 deletions(-)
--- a/net/ceph/osdmap.c
+++ b/net/ceph/osdmap.c
@@ -1201,6 +1201,115 @@ struct ceph_osdmap *ceph_osdmap_decode(v
}
/*
+ * Encoding order is (new_up_client, new_state, new_weight). Need to
+ * apply in the (new_weight, new_state, new_up_client) order, because
+ * an incremental map may look like e.g.
+ *
+ * new_up_client: { osd=6, addr=... } # set osd_state and addr
+ * new_state: { osd=6, xorstate=EXISTS } # clear osd_state
+ */
+static int decode_new_up_state_weight(void **p, void *end,
+ struct ceph_osdmap *map)
+{
+ void *new_up_client;
+ void *new_state;
+ void *new_weight_end;
+ u32 len;
+
+ new_up_client = *p;
+ ceph_decode_32_safe(p, end, len, e_inval);
+ len *= sizeof(u32) + sizeof(struct ceph_entity_addr);
+ ceph_decode_need(p, end, len, e_inval);
+ *p += len;
+
+ new_state = *p;
+ ceph_decode_32_safe(p, end, len, e_inval);
+ len *= sizeof(u32) + sizeof(u8);
+ ceph_decode_need(p, end, len, e_inval);
+ *p += len;
+
+ /* new_weight */
+ ceph_decode_32_safe(p, end, len, e_inval);
+ while (len--) {
+ s32 osd;
+ u32 w;
+
+ ceph_decode_need(p, end, 2*sizeof(u32), e_inval);
+ osd = ceph_decode_32(p);
+ w = ceph_decode_32(p);
+ BUG_ON(osd >= map->max_osd);
+ pr_info("osd%d weight 0x%x %s\n", osd, w,
+ w == CEPH_OSD_IN ? "(in)" :
+ (w == CEPH_OSD_OUT ? "(out)" : ""));
+ map->osd_weight[osd] = w;
+
+ /*
+ * If we are marking in, set the EXISTS, and clear the
+ * AUTOOUT and NEW bits.
+ */
+ if (w) {
+ map->osd_state[osd] |= CEPH_OSD_EXISTS;
+ map->osd_state[osd] &= ~(CEPH_OSD_AUTOOUT |
+ CEPH_OSD_NEW);
+ }
+ }
+ new_weight_end = *p;
+
+ /* new_state (up/down) */
+ *p = new_state;
+ len = ceph_decode_32(p);
+ while (len--) {
+ s32 osd;
+ u8 xorstate;
+ int ret;
+
+ osd = ceph_decode_32(p);
+ xorstate = ceph_decode_8(p);
+ if (xorstate == 0)
+ xorstate = CEPH_OSD_UP;
+ BUG_ON(osd >= map->max_osd);
+ if ((map->osd_state[osd] & CEPH_OSD_UP) &&
+ (xorstate & CEPH_OSD_UP))
+ pr_info("osd%d down\n", osd);
+ if ((map->osd_state[osd] & CEPH_OSD_EXISTS) &&
+ (xorstate & CEPH_OSD_EXISTS)) {
+ pr_info("osd%d does not exist\n", osd);
+ map->osd_weight[osd] = CEPH_OSD_IN;
+ ret = set_primary_affinity(map, osd,
+ CEPH_OSD_DEFAULT_PRIMARY_AFFINITY);
+ if (ret)
+ return ret;
+ memset(map->osd_addr + osd, 0, sizeof(*map->osd_addr));
+ map->osd_state[osd] = 0;
+ } else {
+ map->osd_state[osd] ^= xorstate;
+ }
+ }
+
+ /* new_up_client */
+ *p = new_up_client;
+ len = ceph_decode_32(p);
+ while (len--) {
+ s32 osd;
+ struct ceph_entity_addr addr;
+
+ osd = ceph_decode_32(p);
+ ceph_decode_copy(p, &addr, sizeof(addr));
+ ceph_decode_addr(&addr);
+ BUG_ON(osd >= map->max_osd);
+ pr_info("osd%d up\n", osd);
+ map->osd_state[osd] |= CEPH_OSD_EXISTS | CEPH_OSD_UP;
+ map->osd_addr[osd] = addr;
+ }
+
+ *p = new_weight_end;
+ return 0;
+
+e_inval:
+ return -EINVAL;
+}
+
+/*
* decode and apply an incremental map update.
*/
struct ceph_osdmap *osdmap_apply_incremental(void **p, void *end,
@@ -1299,49 +1408,10 @@ struct ceph_osdmap *osdmap_apply_increme
__remove_pg_pool(&map->pg_pools, pi);
}
- /* new_up */
- ceph_decode_32_safe(p, end, len, e_inval);
- while (len--) {
- u32 osd;
- struct ceph_entity_addr addr;
- ceph_decode_32_safe(p, end, osd, e_inval);
- ceph_decode_copy_safe(p, end, &addr, sizeof(addr), e_inval);
- ceph_decode_addr(&addr);
- pr_info("osd%d up\n", osd);
- BUG_ON(osd >= map->max_osd);
- map->osd_state[osd] |= CEPH_OSD_UP | CEPH_OSD_EXISTS;
- map->osd_addr[osd] = addr;
- }
-
- /* new_state */
- ceph_decode_32_safe(p, end, len, e_inval);
- while (len--) {
- u32 osd;
- u8 xorstate;
- ceph_decode_32_safe(p, end, osd, e_inval);
- xorstate = **(u8 **)p;
- (*p)++; /* clean flag */
- if (xorstate == 0)
- xorstate = CEPH_OSD_UP;
- if (xorstate & CEPH_OSD_UP)
- pr_info("osd%d down\n", osd);
- if (osd < map->max_osd)
- map->osd_state[osd] ^= xorstate;
- }
-
- /* new_weight */
- ceph_decode_32_safe(p, end, len, e_inval);
- while (len--) {
- u32 osd, off;
- ceph_decode_need(p, end, sizeof(u32)*2, e_inval);
- osd = ceph_decode_32(p);
- off = ceph_decode_32(p);
- pr_info("osd%d weight 0x%x %s\n", osd, off,
- off == CEPH_OSD_IN ? "(in)" :
- (off == CEPH_OSD_OUT ? "(out)" : ""));
- if (osd < map->max_osd)
- map->osd_weight[osd] = off;
- }
+ /* new_up_client, new_state, new_weight */
+ err = decode_new_up_state_weight(p, end, map);
+ if (err)
+ goto bad;
/* new_pg_temp */
err = decode_new_pg_temp(p, end, map);
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 91/96] net: mvneta: set real interrupt per packet for tx_done
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (83 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 90/96] libceph: apply new_state before new_up_client on incrementals Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 92/96] cfg80211: handle failed skb allocation Greg Kroah-Hartman
` (6 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dmitri Epshtein, Marcin Wojtas,
Willy Tarreau, David S. Miller
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dmitri Epshtein <dima@marvell.com>
commit 06708f81528725148473c0869d6af5f809c6824b upstream.
Commit aebea2ba0f74 ("net: mvneta: fix Tx interrupt delay") intended to
set coalescing threshold to a value guaranteeing interrupt generation
per each sent packet, so that buffers can be released with no delay.
In fact setting threshold to '1' was wrong, because it causes interrupt
every two packets. According to the documentation a reason behind it is
following - interrupt occurs once sent buffers counter reaches a value,
which is higher than one specified in MVNETA_TXQ_SIZE_REG(q). This
behavior was confirmed during tests. Also when testing the SoC working
as a NAS device, better performance was observed with int-per-packet,
as it strongly depends on the fact that all transmitted packets are
released immediately.
This commit enables NETA controller work in interrupt per sent packet mode
by setting coalescing threshold to 0.
Signed-off-by: Dmitri Epshtein <dima@marvell.com>
Signed-off-by: Marcin Wojtas <mw@semihalf.com>
Fixes aebea2ba0f74 ("net: mvneta: fix Tx interrupt delay")
Acked-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ethernet/marvell/mvneta.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/net/ethernet/marvell/mvneta.c
+++ b/drivers/net/ethernet/marvell/mvneta.c
@@ -244,7 +244,7 @@
/* Various constants */
/* Coalescing */
-#define MVNETA_TXDONE_COAL_PKTS 1
+#define MVNETA_TXDONE_COAL_PKTS 0 /* interrupt per packet */
#define MVNETA_RX_COAL_PKTS 32
#define MVNETA_RX_COAL_USEC 100
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 92/96] cfg80211: handle failed skb allocation
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (84 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 91/96] net: mvneta: set real interrupt per packet for tx_done Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 93/96] intel_th: pci: Add Kaby Lake PCH-H support Greg Kroah-Hartman
` (5 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Gregory Greenman, Luca Coelho, Johannes Berg
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Gregory Greenman <gregory.greenman@intel.com>
commit 16a910a6722b7a8680409e634c7c0dac073c01e4 upstream.
Handle the case when dev_alloc_skb returns NULL.
Fixes: 2b67f944f88c2 ("cfg80211: reuse existing page fragments in A-MSDU rx")
Signed-off-by: Gregory Greenman <gregory.greenman@intel.com>
Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
Signed-off-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/wireless/util.c | 2 ++
1 file changed, 2 insertions(+)
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -721,6 +721,8 @@ __ieee80211_amsdu_copy(struct sk_buff *s
* alignment since sizeof(struct ethhdr) is 14.
*/
frame = dev_alloc_skb(hlen + sizeof(struct ethhdr) + 2 + cur_len);
+ if (!frame)
+ return NULL;
skb_reserve(frame, hlen + sizeof(struct ethhdr) + 2);
skb_copy_bits(skb, offset, skb_put(frame, cur_len), cur_len);
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 93/96] intel_th: pci: Add Kaby Lake PCH-H support
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (85 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 92/96] cfg80211: handle failed skb allocation Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 94/96] intel_th: Fix a deadlock in modprobing Greg Kroah-Hartman
` (4 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexander Shishkin
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
commit 7a1a47ce35821b40f5b2ce46379ba14393bc3873 upstream.
This adds Intel(R) Trace Hub PCI ID for Kaby Lake PCH-H.
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwtracing/intel_th/pci.c | 5 +++++
1 file changed, 5 insertions(+)
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c
@@ -75,6 +75,11 @@ static const struct pci_device_id intel_
PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x0a80),
.driver_data = (kernel_ulong_t)0,
},
+ {
+ /* Kaby Lake PCH-H */
+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa2a6),
+ .driver_data = (kernel_ulong_t)0,
+ },
{ 0 },
};
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 94/96] intel_th: Fix a deadlock in modprobing
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (86 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 93/96] intel_th: pci: Add Kaby Lake PCH-H support Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 95/96] vfs: ioctl: prevent double-fetch in dedupe ioctl Greg Kroah-Hartman
` (3 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alexander Shishkin
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
commit a36aa80f3cb2540fb1dbad6240852de4365a2e82 upstream.
Driver initialization tries to request a hub (GTH) driver module from
its probe callback, resulting in a deadlock.
This patch solves the problem by adding a deferred work for requesting
the hub module.
Signed-off-by: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwtracing/intel_th/core.c | 35 +++++++++++++++++++++++++++++++++-
drivers/hwtracing/intel_th/intel_th.h | 3 ++
2 files changed, 37 insertions(+), 1 deletion(-)
--- a/drivers/hwtracing/intel_th/core.c
+++ b/drivers/hwtracing/intel_th/core.c
@@ -440,6 +440,38 @@ static struct intel_th_subdevice {
},
};
+#ifdef CONFIG_MODULES
+static void __intel_th_request_hub_module(struct work_struct *work)
+{
+ struct intel_th *th = container_of(work, struct intel_th,
+ request_module_work);
+
+ request_module("intel_th_%s", th->hub->name);
+}
+
+static int intel_th_request_hub_module(struct intel_th *th)
+{
+ INIT_WORK(&th->request_module_work, __intel_th_request_hub_module);
+ schedule_work(&th->request_module_work);
+
+ return 0;
+}
+
+static void intel_th_request_hub_module_flush(struct intel_th *th)
+{
+ flush_work(&th->request_module_work);
+}
+#else
+static inline int intel_th_request_hub_module(struct intel_th *th)
+{
+ return -EINVAL;
+}
+
+static inline void intel_th_request_hub_module_flush(struct intel_th *th)
+{
+}
+#endif /* CONFIG_MODULES */
+
static int intel_th_populate(struct intel_th *th, struct resource *devres,
unsigned int ndevres, int irq)
{
@@ -510,7 +542,7 @@ static int intel_th_populate(struct inte
/* need switch driver to be loaded to enumerate the rest */
if (subdev->type == INTEL_TH_SWITCH && !req) {
th->hub = thdev;
- err = request_module("intel_th_%s", subdev->name);
+ err = intel_th_request_hub_module(th);
if (!err)
req++;
}
@@ -627,6 +659,7 @@ void intel_th_free(struct intel_th *th)
{
int i;
+ intel_th_request_hub_module_flush(th);
for (i = 0; i < TH_SUBDEVICE_MAX; i++)
if (th->thdev[i] != th->hub)
intel_th_device_remove(th->thdev[i]);
--- a/drivers/hwtracing/intel_th/intel_th.h
+++ b/drivers/hwtracing/intel_th/intel_th.h
@@ -199,6 +199,9 @@ struct intel_th {
int id;
int major;
+#ifdef CONFIG_MODULES
+ struct work_struct request_module_work;
+#endif /* CONFIG_MODULES */
#ifdef CONFIG_INTEL_TH_DEBUG
struct dentry *dbg;
#endif
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 95/96] vfs: ioctl: prevent double-fetch in dedupe ioctl
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (87 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 94/96] intel_th: Fix a deadlock in modprobing Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-08 19:11 ` [PATCH 4.6 96/96] vfs: fix deadlock in file_remove_privs() on overlayfs Greg Kroah-Hartman
` (2 subsequent siblings)
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Scott Bauer, Linus Torvalds
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Scott Bauer <sbauer@plzdonthack.me>
commit 10eec60ce79187686e052092e5383c99b4420a20 upstream.
This prevents a double-fetch from user space that can lead to to an
undersized allocation and heap overflow.
Fixes: 54dbc1517237 ("vfs: hoist the btrfs deduplication ioctl to the vfs")
Signed-off-by: Scott Bauer <sbauer@plzdonthack.me>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/ioctl.c | 1 +
1 file changed, 1 insertion(+)
--- a/fs/ioctl.c
+++ b/fs/ioctl.c
@@ -590,6 +590,7 @@ static long ioctl_file_dedupe_range(stru
goto out;
}
+ same->dest_count = count;
ret = vfs_dedupe_file_range(file, same);
if (ret)
goto out;
^ permalink raw reply [flat|nested] 101+ messages in thread* [PATCH 4.6 96/96] vfs: fix deadlock in file_remove_privs() on overlayfs
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (88 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 95/96] vfs: ioctl: prevent double-fetch in dedupe ioctl Greg Kroah-Hartman
@ 2016-08-08 19:11 ` Greg Kroah-Hartman
2016-08-09 5:03 ` [PATCH 4.6 00/96] 4.6.6-stable review Guenter Roeck
2016-08-09 15:10 ` Shuah Khan
91 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-08 19:11 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miklos Szeredi
4.6-stable review patch. If anyone has any objections, please let me know.
------------------
From: Miklos Szeredi <mszeredi@redhat.com>
commit c1892c37769cf89c7e7ba57528ae2ccb5d153c9b upstream.
file_remove_privs() is called with inode lock on file_inode(), which
proceeds to calling notify_change() on file->f_path.dentry. Which triggers
the WARN_ON_ONCE(!inode_is_locked(inode)) in addition to deadlocking later
when ovl_setattr tries to lock the underlying inode again.
Fix this mess by not mixing the layers, but doing everything on underlying
dentry/inode.
Signed-off-by: Miklos Szeredi <mszeredi@redhat.com>
Fixes: 07a2daab49c5 ("ovl: Copy up underlying inode's ->i_mode to overlay inode")
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/inode.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -1739,8 +1739,8 @@ static int __remove_privs(struct dentry
*/
int file_remove_privs(struct file *file)
{
- struct dentry *dentry = file->f_path.dentry;
- struct inode *inode = d_inode(dentry);
+ struct dentry *dentry = file_dentry(file);
+ struct inode *inode = file_inode(file);
int kill;
int error = 0;
@@ -1748,7 +1748,7 @@ int file_remove_privs(struct file *file)
if (IS_NOSEC(inode))
return 0;
- kill = file_needs_remove_privs(file);
+ kill = dentry_needs_remove_privs(dentry);
if (kill < 0)
return kill;
if (kill)
^ permalink raw reply [flat|nested] 101+ messages in thread* Re: [PATCH 4.6 00/96] 4.6.6-stable review
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (89 preceding siblings ...)
2016-08-08 19:11 ` [PATCH 4.6 96/96] vfs: fix deadlock in file_remove_privs() on overlayfs Greg Kroah-Hartman
@ 2016-08-09 5:03 ` Guenter Roeck
2016-08-09 8:24 ` Greg Kroah-Hartman
2016-08-09 15:10 ` Shuah Khan
91 siblings, 1 reply; 101+ messages in thread
From: Guenter Roeck @ 2016-08-09 5:03 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, shuah.kh, patches, stable, Paul Burton, Thomas Gleixner
On 08/08/2016 12:10 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.6.6 release.
> There are 96 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed Aug 10 18:02:27 UTC 2016.
> Anything received after that time might be too late.
>
Build results:
total: 148 pass: 146 fail: 2
Failed builds:
unicore32:defconfig
unicore32:allnoconfig
Qemu test results:
total: 107 pass: 103 fail: 4
Failed tests:
mips:malta_defconfig:nosmp
mips64:malta_defconfig:nosmp
mipsel:malta_defconfig:nosmp
mipsel64:malta_defconfig:nosmp
The unicore32 build error is still not fixed in mainline.
mips:
Building mips:malta_defconfig:nosmp ... failed
------------
Error log:
drivers/built-in.o: In function `gic_shared_irq_domain_map.isra.0':
irq-mips-gic.c:(.text+0x1d58): undefined reference to `smp_num_siblings'
irq-mips-gic.c:(.text+0x1d5c): undefined reference to `smp_num_siblings'
irq-mips-gic.c:(.text+0x1de0): undefined reference to `smp_num_siblings'
irq-mips-gic.c:(.text+0x1de8): undefined reference to `smp_num_siblings'
Only seen with non-SMP builds. Tricky one, required bisect.
# bad: [0353fa20cb40ea75a7e3b7293b533bde4fa013e9] Linux 4.6.6-rc1
# good: [bed4c611a3b80fae04d75b9f85fcaf174bac1b06] Linux 4.6.5
git bisect start 'HEAD' 'v4.6.5'
# good: [8d3b41c18cff2db7ccea71243b945a33610b8cb5] cgroup: remove redundant cleanup in css_create
git bisect good 8d3b41c18cff2db7ccea71243b945a33610b8cb583c9f9e994f5c963fc652a52befc120699dcc591
# good: [3a255979bc75ffcc263928045df4b5f46df8a8ca] sched/fair: Fix effective_load() to consistently use smoothed load
git bisect good 3a255979bc75ffcc263928045df4b5f46df8a8ca
# bad: [6eafb1f777de375b52c8a83d262da2885a28579a] posix_cpu_timer: Exit early when process has been reaped
git bisect bad 6eafb1f777de375b52c8a83d262da2885a28579a
# bad: [83c9f9e994f5c963fc652a52befc120699dcc591] irqchip/mips-gic: Map to VPs using HW VPNum
git bisect bad 83c9f9e994f5c963fc652a52befc120699dcc591
# good: [3a1e9944db1570f9b654b7a187f13898e5c59529] can: fix handling of unmodifiable configuration options fix
git bisect good 3a1e9944db1570f9b654b7a187f13898e5c59529
# good: [f06b9b8071ae6e383931795e2a459d6abc0bc7bd] RDS: fix rds_tcp_init() error path
git bisect good f06b9b8071ae6e383931795e2a459d6abc0bc7bd
# first bad commit: [83c9f9e994f5c963fc652a52befc120699dcc591] irqchip/mips-gic: Map to VPs using HW VPNum
Reverting 83c9f9e994f5c963fc652a52befc120699dcc591 fixes the problem.
Its description suggests that it fixes a real bug, though, so copying Paul for input.
Guenter
^ permalink raw reply [flat|nested] 101+ messages in thread* Re: [PATCH 4.6 00/96] 4.6.6-stable review
2016-08-09 5:03 ` [PATCH 4.6 00/96] 4.6.6-stable review Guenter Roeck
@ 2016-08-09 8:24 ` Greg Kroah-Hartman
2016-08-09 8:33 ` Paul Burton
0 siblings, 1 reply; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-09 8:24 UTC (permalink / raw)
To: Guenter Roeck, Paul Burton
Cc: linux-kernel, torvalds, akpm, shuah.kh, patches, stable, Thomas Gleixner
On Mon, Aug 08, 2016 at 10:03:39PM -0700, Guenter Roeck wrote:
> On 08/08/2016 12:10 PM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.6.6 release.
> > There are 96 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed Aug 10 18:02:27 UTC 2016.
> > Anything received after that time might be too late.
> >
>
> Build results:
> total: 148 pass: 146 fail: 2
> Failed builds:
> unicore32:defconfig
> unicore32:allnoconfig
>
> Qemu test results:
> total: 107 pass: 103 fail: 4
> Failed tests:
> mips:malta_defconfig:nosmp
> mips64:malta_defconfig:nosmp
> mipsel:malta_defconfig:nosmp
> mipsel64:malta_defconfig:nosmp
>
> The unicore32 build error is still not fixed in mainline.
>
> mips:
>
> Building mips:malta_defconfig:nosmp ... failed
> ------------
> Error log:
> drivers/built-in.o: In function `gic_shared_irq_domain_map.isra.0':
> irq-mips-gic.c:(.text+0x1d58): undefined reference to `smp_num_siblings'
> irq-mips-gic.c:(.text+0x1d5c): undefined reference to `smp_num_siblings'
> irq-mips-gic.c:(.text+0x1de0): undefined reference to `smp_num_siblings'
> irq-mips-gic.c:(.text+0x1de8): undefined reference to `smp_num_siblings'
>
> Only seen with non-SMP builds. Tricky one, required bisect.
>
> # bad: [0353fa20cb40ea75a7e3b7293b533bde4fa013e9] Linux 4.6.6-rc1
> # good: [bed4c611a3b80fae04d75b9f85fcaf174bac1b06] Linux 4.6.5
> git bisect start 'HEAD' 'v4.6.5'
> # good: [8d3b41c18cff2db7ccea71243b945a33610b8cb5] cgroup: remove redundant cleanup in css_create
> git bisect good 8d3b41c18cff2db7ccea71243b945a33610b8cb583c9f9e994f5c963fc652a52befc120699dcc591
> # good: [3a255979bc75ffcc263928045df4b5f46df8a8ca] sched/fair: Fix effective_load() to consistently use smoothed load
> git bisect good 3a255979bc75ffcc263928045df4b5f46df8a8ca
> # bad: [6eafb1f777de375b52c8a83d262da2885a28579a] posix_cpu_timer: Exit early when process has been reaped
> git bisect bad 6eafb1f777de375b52c8a83d262da2885a28579a
> # bad: [83c9f9e994f5c963fc652a52befc120699dcc591] irqchip/mips-gic: Map to VPs using HW VPNum
> git bisect bad 83c9f9e994f5c963fc652a52befc120699dcc591
> # good: [3a1e9944db1570f9b654b7a187f13898e5c59529] can: fix handling of unmodifiable configuration options fix
> git bisect good 3a1e9944db1570f9b654b7a187f13898e5c59529
> # good: [f06b9b8071ae6e383931795e2a459d6abc0bc7bd] RDS: fix rds_tcp_init() error path
> git bisect good f06b9b8071ae6e383931795e2a459d6abc0bc7bd
> # first bad commit: [83c9f9e994f5c963fc652a52befc120699dcc591] irqchip/mips-gic: Map to VPs using HW VPNum
>
> Reverting 83c9f9e994f5c963fc652a52befc120699dcc591 fixes the problem.
> Its description suggests that it fixes a real bug, though, so copying Paul for input.
Thanks for the bisection and report.
Paul, any ideas? Why doesn't this also fail in 4.7?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 101+ messages in thread
* Re: [PATCH 4.6 00/96] 4.6.6-stable review
2016-08-09 8:24 ` Greg Kroah-Hartman
@ 2016-08-09 8:33 ` Paul Burton
2016-08-09 8:37 ` Greg Kroah-Hartman
0 siblings, 1 reply; 101+ messages in thread
From: Paul Burton @ 2016-08-09 8:33 UTC (permalink / raw)
To: Greg Kroah-Hartman, Guenter Roeck
Cc: linux-kernel, torvalds, akpm, shuah.kh, patches, stable, Thomas Gleixner
On 09/08/16 09:24, Greg Kroah-Hartman wrote:
> On Mon, Aug 08, 2016 at 10:03:39PM -0700, Guenter Roeck wrote:
>> On 08/08/2016 12:10 PM, Greg Kroah-Hartman wrote:
>>> This is the start of the stable review cycle for the 4.6.6 release.
>>> There are 96 patches in this series, all will be posted as a response
>>> to this one. If anyone has any issues with these being applied, please
>>> let me know.
>>>
>>> Responses should be made by Wed Aug 10 18:02:27 UTC 2016.
>>> Anything received after that time might be too late.
>>>
>>
>> Build results:
>> total: 148 pass: 146 fail: 2
>> Failed builds:
>> unicore32:defconfig
>> unicore32:allnoconfig
>>
>> Qemu test results:
>> total: 107 pass: 103 fail: 4
>> Failed tests:
>> mips:malta_defconfig:nosmp
>> mips64:malta_defconfig:nosmp
>> mipsel:malta_defconfig:nosmp
>> mipsel64:malta_defconfig:nosmp
>>
>> The unicore32 build error is still not fixed in mainline.
>>
>> mips:
>>
>> Building mips:malta_defconfig:nosmp ... failed
>> ------------
>> Error log:
>> drivers/built-in.o: In function `gic_shared_irq_domain_map.isra.0':
>> irq-mips-gic.c:(.text+0x1d58): undefined reference to `smp_num_siblings'
>> irq-mips-gic.c:(.text+0x1d5c): undefined reference to `smp_num_siblings'
>> irq-mips-gic.c:(.text+0x1de0): undefined reference to `smp_num_siblings'
>> irq-mips-gic.c:(.text+0x1de8): undefined reference to `smp_num_siblings'
>>
>> Only seen with non-SMP builds. Tricky one, required bisect.
>>
>> # bad: [0353fa20cb40ea75a7e3b7293b533bde4fa013e9] Linux 4.6.6-rc1
>> # good: [bed4c611a3b80fae04d75b9f85fcaf174bac1b06] Linux 4.6.5
>> git bisect start 'HEAD' 'v4.6.5'
>> # good: [8d3b41c18cff2db7ccea71243b945a33610b8cb5] cgroup: remove redundant cleanup in css_create
>> git bisect good 8d3b41c18cff2db7ccea71243b945a33610b8cb583c9f9e994f5c963fc652a52befc120699dcc591
>> # good: [3a255979bc75ffcc263928045df4b5f46df8a8ca] sched/fair: Fix effective_load() to consistently use smoothed load
>> git bisect good 3a255979bc75ffcc263928045df4b5f46df8a8ca
>> # bad: [6eafb1f777de375b52c8a83d262da2885a28579a] posix_cpu_timer: Exit early when process has been reaped
>> git bisect bad 6eafb1f777de375b52c8a83d262da2885a28579a
>> # bad: [83c9f9e994f5c963fc652a52befc120699dcc591] irqchip/mips-gic: Map to VPs using HW VPNum
>> git bisect bad 83c9f9e994f5c963fc652a52befc120699dcc591
>> # good: [3a1e9944db1570f9b654b7a187f13898e5c59529] can: fix handling of unmodifiable configuration options fix
>> git bisect good 3a1e9944db1570f9b654b7a187f13898e5c59529
>> # good: [f06b9b8071ae6e383931795e2a459d6abc0bc7bd] RDS: fix rds_tcp_init() error path
>> git bisect good f06b9b8071ae6e383931795e2a459d6abc0bc7bd
>> # first bad commit: [83c9f9e994f5c963fc652a52befc120699dcc591] irqchip/mips-gic: Map to VPs using HW VPNum
>>
>> Reverting 83c9f9e994f5c963fc652a52befc120699dcc591 fixes the problem.
>> Its description suggests that it fixes a real bug, though, so copying Paul for input.
>
> Thanks for the bisection and report.
>
> Paul, any ideas? Why doesn't this also fail in 4.7?
>
> thanks,
>
> greg k-h
>
Hi Greg, Guenter,
The easiest way to fix this is likely to backport a60ae81e5e59 ("MIPS:
CM: Fix mips_cm_max_vp_width for UP kernels") which went into mainline
in the 4.7 cycle. Apologies for overlooking the need for that one in stable.
Thanks,
Paul
^ permalink raw reply [flat|nested] 101+ messages in thread* Re: [PATCH 4.6 00/96] 4.6.6-stable review
2016-08-09 8:33 ` Paul Burton
@ 2016-08-09 8:37 ` Greg Kroah-Hartman
2016-08-09 16:19 ` Guenter Roeck
0 siblings, 1 reply; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-09 8:37 UTC (permalink / raw)
To: Paul Burton
Cc: Guenter Roeck, linux-kernel, torvalds, akpm, shuah.kh, patches,
stable, Thomas Gleixner
On Tue, Aug 09, 2016 at 09:33:26AM +0100, Paul Burton wrote:
> On 09/08/16 09:24, Greg Kroah-Hartman wrote:
> > On Mon, Aug 08, 2016 at 10:03:39PM -0700, Guenter Roeck wrote:
> > > On 08/08/2016 12:10 PM, Greg Kroah-Hartman wrote:
> > > > This is the start of the stable review cycle for the 4.6.6 release.
> > > > There are 96 patches in this series, all will be posted as a response
> > > > to this one. If anyone has any issues with these being applied, please
> > > > let me know.
> > > >
> > > > Responses should be made by Wed Aug 10 18:02:27 UTC 2016.
> > > > Anything received after that time might be too late.
> > > >
> > >
> > > Build results:
> > > total: 148 pass: 146 fail: 2
> > > Failed builds:
> > > unicore32:defconfig
> > > unicore32:allnoconfig
> > >
> > > Qemu test results:
> > > total: 107 pass: 103 fail: 4
> > > Failed tests:
> > > mips:malta_defconfig:nosmp
> > > mips64:malta_defconfig:nosmp
> > > mipsel:malta_defconfig:nosmp
> > > mipsel64:malta_defconfig:nosmp
> > >
> > > The unicore32 build error is still not fixed in mainline.
> > >
> > > mips:
> > >
> > > Building mips:malta_defconfig:nosmp ... failed
> > > ------------
> > > Error log:
> > > drivers/built-in.o: In function `gic_shared_irq_domain_map.isra.0':
> > > irq-mips-gic.c:(.text+0x1d58): undefined reference to `smp_num_siblings'
> > > irq-mips-gic.c:(.text+0x1d5c): undefined reference to `smp_num_siblings'
> > > irq-mips-gic.c:(.text+0x1de0): undefined reference to `smp_num_siblings'
> > > irq-mips-gic.c:(.text+0x1de8): undefined reference to `smp_num_siblings'
> > >
> > > Only seen with non-SMP builds. Tricky one, required bisect.
> > >
> > > # bad: [0353fa20cb40ea75a7e3b7293b533bde4fa013e9] Linux 4.6.6-rc1
> > > # good: [bed4c611a3b80fae04d75b9f85fcaf174bac1b06] Linux 4.6.5
> > > git bisect start 'HEAD' 'v4.6.5'
> > > # good: [8d3b41c18cff2db7ccea71243b945a33610b8cb5] cgroup: remove redundant cleanup in css_create
> > > git bisect good 8d3b41c18cff2db7ccea71243b945a33610b8cb583c9f9e994f5c963fc652a52befc120699dcc591
> > > # good: [3a255979bc75ffcc263928045df4b5f46df8a8ca] sched/fair: Fix effective_load() to consistently use smoothed load
> > > git bisect good 3a255979bc75ffcc263928045df4b5f46df8a8ca
> > > # bad: [6eafb1f777de375b52c8a83d262da2885a28579a] posix_cpu_timer: Exit early when process has been reaped
> > > git bisect bad 6eafb1f777de375b52c8a83d262da2885a28579a
> > > # bad: [83c9f9e994f5c963fc652a52befc120699dcc591] irqchip/mips-gic: Map to VPs using HW VPNum
> > > git bisect bad 83c9f9e994f5c963fc652a52befc120699dcc591
> > > # good: [3a1e9944db1570f9b654b7a187f13898e5c59529] can: fix handling of unmodifiable configuration options fix
> > > git bisect good 3a1e9944db1570f9b654b7a187f13898e5c59529
> > > # good: [f06b9b8071ae6e383931795e2a459d6abc0bc7bd] RDS: fix rds_tcp_init() error path
> > > git bisect good f06b9b8071ae6e383931795e2a459d6abc0bc7bd
> > > # first bad commit: [83c9f9e994f5c963fc652a52befc120699dcc591] irqchip/mips-gic: Map to VPs using HW VPNum
> > >
> > > Reverting 83c9f9e994f5c963fc652a52befc120699dcc591 fixes the problem.
> > > Its description suggests that it fixes a real bug, though, so copying Paul for input.
> >
> > Thanks for the bisection and report.
> >
> > Paul, any ideas? Why doesn't this also fail in 4.7?
> >
> > thanks,
> >
> > greg k-h
> >
>
> Hi Greg, Guenter,
>
> The easiest way to fix this is likely to backport a60ae81e5e59 ("MIPS: CM:
> Fix mips_cm_max_vp_width for UP kernels") which went into mainline in the
> 4.7 cycle. Apologies for overlooking the need for that one in stable.
No problem, now added to the 4.6 queue, thanks.
greg k-h
^ permalink raw reply [flat|nested] 101+ messages in thread* Re: [PATCH 4.6 00/96] 4.6.6-stable review
2016-08-09 8:37 ` Greg Kroah-Hartman
@ 2016-08-09 16:19 ` Guenter Roeck
2016-08-09 17:22 ` Greg Kroah-Hartman
0 siblings, 1 reply; 101+ messages in thread
From: Guenter Roeck @ 2016-08-09 16:19 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Paul Burton, linux-kernel, torvalds, akpm, shuah.kh, patches,
stable, Thomas Gleixner
On Tue, Aug 09, 2016 at 10:37:31AM +0200, Greg Kroah-Hartman wrote:
> On Tue, Aug 09, 2016 at 09:33:26AM +0100, Paul Burton wrote:
> > On 09/08/16 09:24, Greg Kroah-Hartman wrote:
> > > On Mon, Aug 08, 2016 at 10:03:39PM -0700, Guenter Roeck wrote:
> > > > On 08/08/2016 12:10 PM, Greg Kroah-Hartman wrote:
> > > > > This is the start of the stable review cycle for the 4.6.6 release.
> > > > > There are 96 patches in this series, all will be posted as a response
> > > > > to this one. If anyone has any issues with these being applied, please
> > > > > let me know.
> > > > >
> > > > > Responses should be made by Wed Aug 10 18:02:27 UTC 2016.
> > > > > Anything received after that time might be too late.
> > > > >
> > > >
> > > > Build results:
> > > > total: 148 pass: 146 fail: 2
> > > > Failed builds:
> > > > unicore32:defconfig
> > > > unicore32:allnoconfig
> > > >
> > > > Qemu test results:
> > > > total: 107 pass: 103 fail: 4
> > > > Failed tests:
> > > > mips:malta_defconfig:nosmp
> > > > mips64:malta_defconfig:nosmp
> > > > mipsel:malta_defconfig:nosmp
> > > > mipsel64:malta_defconfig:nosmp
> > > >
> > > > The unicore32 build error is still not fixed in mainline.
> > > >
> > > > mips:
> > > >
> > > > Building mips:malta_defconfig:nosmp ... failed
> > > > ------------
> > > > Error log:
> > > > drivers/built-in.o: In function `gic_shared_irq_domain_map.isra.0':
> > > > irq-mips-gic.c:(.text+0x1d58): undefined reference to `smp_num_siblings'
> > > > irq-mips-gic.c:(.text+0x1d5c): undefined reference to `smp_num_siblings'
> > > > irq-mips-gic.c:(.text+0x1de0): undefined reference to `smp_num_siblings'
> > > > irq-mips-gic.c:(.text+0x1de8): undefined reference to `smp_num_siblings'
> > > >
> > > > Only seen with non-SMP builds. Tricky one, required bisect.
> > > >
> > > > # bad: [0353fa20cb40ea75a7e3b7293b533bde4fa013e9] Linux 4.6.6-rc1
> > > > # good: [bed4c611a3b80fae04d75b9f85fcaf174bac1b06] Linux 4.6.5
> > > > git bisect start 'HEAD' 'v4.6.5'
> > > > # good: [8d3b41c18cff2db7ccea71243b945a33610b8cb5] cgroup: remove redundant cleanup in css_create
> > > > git bisect good 8d3b41c18cff2db7ccea71243b945a33610b8cb583c9f9e994f5c963fc652a52befc120699dcc591
> > > > # good: [3a255979bc75ffcc263928045df4b5f46df8a8ca] sched/fair: Fix effective_load() to consistently use smoothed load
> > > > git bisect good 3a255979bc75ffcc263928045df4b5f46df8a8ca
> > > > # bad: [6eafb1f777de375b52c8a83d262da2885a28579a] posix_cpu_timer: Exit early when process has been reaped
> > > > git bisect bad 6eafb1f777de375b52c8a83d262da2885a28579a
> > > > # bad: [83c9f9e994f5c963fc652a52befc120699dcc591] irqchip/mips-gic: Map to VPs using HW VPNum
> > > > git bisect bad 83c9f9e994f5c963fc652a52befc120699dcc591
> > > > # good: [3a1e9944db1570f9b654b7a187f13898e5c59529] can: fix handling of unmodifiable configuration options fix
> > > > git bisect good 3a1e9944db1570f9b654b7a187f13898e5c59529
> > > > # good: [f06b9b8071ae6e383931795e2a459d6abc0bc7bd] RDS: fix rds_tcp_init() error path
> > > > git bisect good f06b9b8071ae6e383931795e2a459d6abc0bc7bd
> > > > # first bad commit: [83c9f9e994f5c963fc652a52befc120699dcc591] irqchip/mips-gic: Map to VPs using HW VPNum
> > > >
> > > > Reverting 83c9f9e994f5c963fc652a52befc120699dcc591 fixes the problem.
> > > > Its description suggests that it fixes a real bug, though, so copying Paul for input.
> > >
> > > Thanks for the bisection and report.
> > >
> > > Paul, any ideas? Why doesn't this also fail in 4.7?
> > >
> > > thanks,
> > >
> > > greg k-h
> > >
> >
> > Hi Greg, Guenter,
> >
> > The easiest way to fix this is likely to backport a60ae81e5e59 ("MIPS: CM:
> > Fix mips_cm_max_vp_width for UP kernels") which went into mainline in the
> > 4.7 cycle. Apologies for overlooking the need for that one in stable.
>
> No problem, now added to the 4.6 queue, thanks.
>
Can you push it into the -rc repository ? I see the patch in the queue,
but not in the repository.
Thanks,
Guenter
^ permalink raw reply [flat|nested] 101+ messages in thread* Re: [PATCH 4.6 00/96] 4.6.6-stable review
2016-08-09 16:19 ` Guenter Roeck
@ 2016-08-09 17:22 ` Greg Kroah-Hartman
2016-08-10 1:25 ` Guenter Roeck
0 siblings, 1 reply; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-09 17:22 UTC (permalink / raw)
To: Guenter Roeck
Cc: Paul Burton, linux-kernel, torvalds, akpm, shuah.kh, patches,
stable, Thomas Gleixner
On Tue, Aug 09, 2016 at 09:19:26AM -0700, Guenter Roeck wrote:
> On Tue, Aug 09, 2016 at 10:37:31AM +0200, Greg Kroah-Hartman wrote:
> > On Tue, Aug 09, 2016 at 09:33:26AM +0100, Paul Burton wrote:
> > > On 09/08/16 09:24, Greg Kroah-Hartman wrote:
> > > > On Mon, Aug 08, 2016 at 10:03:39PM -0700, Guenter Roeck wrote:
> > > > > On 08/08/2016 12:10 PM, Greg Kroah-Hartman wrote:
> > > > > > This is the start of the stable review cycle for the 4.6.6 release.
> > > > > > There are 96 patches in this series, all will be posted as a response
> > > > > > to this one. If anyone has any issues with these being applied, please
> > > > > > let me know.
> > > > > >
> > > > > > Responses should be made by Wed Aug 10 18:02:27 UTC 2016.
> > > > > > Anything received after that time might be too late.
> > > > > >
> > > > >
> > > > > Build results:
> > > > > total: 148 pass: 146 fail: 2
> > > > > Failed builds:
> > > > > unicore32:defconfig
> > > > > unicore32:allnoconfig
> > > > >
> > > > > Qemu test results:
> > > > > total: 107 pass: 103 fail: 4
> > > > > Failed tests:
> > > > > mips:malta_defconfig:nosmp
> > > > > mips64:malta_defconfig:nosmp
> > > > > mipsel:malta_defconfig:nosmp
> > > > > mipsel64:malta_defconfig:nosmp
> > > > >
> > > > > The unicore32 build error is still not fixed in mainline.
> > > > >
> > > > > mips:
> > > > >
> > > > > Building mips:malta_defconfig:nosmp ... failed
> > > > > ------------
> > > > > Error log:
> > > > > drivers/built-in.o: In function `gic_shared_irq_domain_map.isra.0':
> > > > > irq-mips-gic.c:(.text+0x1d58): undefined reference to `smp_num_siblings'
> > > > > irq-mips-gic.c:(.text+0x1d5c): undefined reference to `smp_num_siblings'
> > > > > irq-mips-gic.c:(.text+0x1de0): undefined reference to `smp_num_siblings'
> > > > > irq-mips-gic.c:(.text+0x1de8): undefined reference to `smp_num_siblings'
> > > > >
> > > > > Only seen with non-SMP builds. Tricky one, required bisect.
> > > > >
> > > > > # bad: [0353fa20cb40ea75a7e3b7293b533bde4fa013e9] Linux 4.6.6-rc1
> > > > > # good: [bed4c611a3b80fae04d75b9f85fcaf174bac1b06] Linux 4.6.5
> > > > > git bisect start 'HEAD' 'v4.6.5'
> > > > > # good: [8d3b41c18cff2db7ccea71243b945a33610b8cb5] cgroup: remove redundant cleanup in css_create
> > > > > git bisect good 8d3b41c18cff2db7ccea71243b945a33610b8cb583c9f9e994f5c963fc652a52befc120699dcc591
> > > > > # good: [3a255979bc75ffcc263928045df4b5f46df8a8ca] sched/fair: Fix effective_load() to consistently use smoothed load
> > > > > git bisect good 3a255979bc75ffcc263928045df4b5f46df8a8ca
> > > > > # bad: [6eafb1f777de375b52c8a83d262da2885a28579a] posix_cpu_timer: Exit early when process has been reaped
> > > > > git bisect bad 6eafb1f777de375b52c8a83d262da2885a28579a
> > > > > # bad: [83c9f9e994f5c963fc652a52befc120699dcc591] irqchip/mips-gic: Map to VPs using HW VPNum
> > > > > git bisect bad 83c9f9e994f5c963fc652a52befc120699dcc591
> > > > > # good: [3a1e9944db1570f9b654b7a187f13898e5c59529] can: fix handling of unmodifiable configuration options fix
> > > > > git bisect good 3a1e9944db1570f9b654b7a187f13898e5c59529
> > > > > # good: [f06b9b8071ae6e383931795e2a459d6abc0bc7bd] RDS: fix rds_tcp_init() error path
> > > > > git bisect good f06b9b8071ae6e383931795e2a459d6abc0bc7bd
> > > > > # first bad commit: [83c9f9e994f5c963fc652a52befc120699dcc591] irqchip/mips-gic: Map to VPs using HW VPNum
> > > > >
> > > > > Reverting 83c9f9e994f5c963fc652a52befc120699dcc591 fixes the problem.
> > > > > Its description suggests that it fixes a real bug, though, so copying Paul for input.
> > > >
> > > > Thanks for the bisection and report.
> > > >
> > > > Paul, any ideas? Why doesn't this also fail in 4.7?
> > > >
> > > > thanks,
> > > >
> > > > greg k-h
> > > >
> > >
> > > Hi Greg, Guenter,
> > >
> > > The easiest way to fix this is likely to backport a60ae81e5e59 ("MIPS: CM:
> > > Fix mips_cm_max_vp_width for UP kernels") which went into mainline in the
> > > 4.7 cycle. Apologies for overlooking the need for that one in stable.
> >
> > No problem, now added to the 4.6 queue, thanks.
> >
> Can you push it into the -rc repository ? I see the patch in the queue,
> but not in the repository.
Sorry about that, now regenerated.
greg k-h
^ permalink raw reply [flat|nested] 101+ messages in thread* Re: [PATCH 4.6 00/96] 4.6.6-stable review
2016-08-09 17:22 ` Greg Kroah-Hartman
@ 2016-08-10 1:25 ` Guenter Roeck
0 siblings, 0 replies; 101+ messages in thread
From: Guenter Roeck @ 2016-08-10 1:25 UTC (permalink / raw)
To: Greg Kroah-Hartman
Cc: Paul Burton, linux-kernel, torvalds, akpm, shuah.kh, patches,
stable, Thomas Gleixner
On Tue, Aug 09, 2016 at 07:22:21PM +0200, Greg Kroah-Hartman wrote:
> > Can you push it into the -rc repository ? I see the patch in the queue,
> > but not in the repository.
>
> Sorry about that, now regenerated.
>
All but the unicore32 build problems are now fixed.
Guenter
^ permalink raw reply [flat|nested] 101+ messages in thread
* Re: [PATCH 4.6 00/96] 4.6.6-stable review
2016-08-08 19:10 ` [PATCH 4.6 00/96] 4.6.6-stable review Greg Kroah-Hartman
` (90 preceding siblings ...)
2016-08-09 5:03 ` [PATCH 4.6 00/96] 4.6.6-stable review Guenter Roeck
@ 2016-08-09 15:10 ` Shuah Khan
2016-08-09 17:22 ` Greg Kroah-Hartman
91 siblings, 1 reply; 101+ messages in thread
From: Shuah Khan @ 2016-08-09 15:10 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, linux, patches, stable, Shuah Khan
On 08/08/2016 01:10 PM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.6.6 release.
> There are 96 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Wed Aug 10 18:02:27 UTC 2016.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.6.6-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.6.y
> and the diffstat can be found below.
>
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
--
Shuah Khan
Sr. Linux Kernel Developer
Open Source Innovation Group
Samsung Research America(Silicon Valley)
shuah.kh@samsung.com
^ permalink raw reply [flat|nested] 101+ messages in thread* Re: [PATCH 4.6 00/96] 4.6.6-stable review
2016-08-09 15:10 ` Shuah Khan
@ 2016-08-09 17:22 ` Greg Kroah-Hartman
0 siblings, 0 replies; 101+ messages in thread
From: Greg Kroah-Hartman @ 2016-08-09 17:22 UTC (permalink / raw)
To: Shuah Khan; +Cc: linux-kernel, torvalds, akpm, linux, patches, stable
On Tue, Aug 09, 2016 at 09:10:58AM -0600, Shuah Khan wrote:
> On 08/08/2016 01:10 PM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.6.6 release.
> > There are 96 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Wed Aug 10 18:02:27 UTC 2016.
> > Anything received after that time might be too late.
> >
> > The whole patch series can be found in one patch at:
> > kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.6.6-rc1.gz
> > or in the git tree and branch at:
> > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.6.y
> > and the diffstat can be found below.
> >
>
> Compiled and booted on my test system. No dmesg regressions.
thanks for testing all of these and letting me know.
greg k-h
^ permalink raw reply [flat|nested] 101+ messages in thread