* [PATCH 4.4 01/62] net: Fix potential wrong skb->protocol in skb_vlan_untag()
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 02/62] tipc: fix uninit skb->data in tipc_nl_compat_dumpit() Greg Kroah-Hartman
` (61 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Miaohe Lin, David S. Miller
From: Miaohe Lin <linmiaohe@huawei.com>
[ Upstream commit 55eff0eb7460c3d50716ed9eccf22257b046ca92 ]
We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). So
we should pull VLAN_HLEN + sizeof(unsigned short) in skb_vlan_untag() or
we may access the wrong data.
Fixes: 0d5501c1c828 ("net: Always untag vlan-tagged traffic on input.")
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/core/skbuff.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4370,8 +4370,8 @@ struct sk_buff *skb_vlan_untag(struct sk
skb = skb_share_check(skb, GFP_ATOMIC);
if (unlikely(!skb))
goto err_free;
-
- if (unlikely(!pskb_may_pull(skb, VLAN_HLEN)))
+ /* We may access the two bytes after vlan_hdr in vlan_set_encap_proto(). */
+ if (unlikely(!pskb_may_pull(skb, VLAN_HLEN + sizeof(unsigned short))))
goto err_free;
vhdr = (struct vlan_hdr *)skb->data;
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 02/62] tipc: fix uninit skb->data in tipc_nl_compat_dumpit()
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 01/62] net: Fix potential wrong skb->protocol in skb_vlan_untag() Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 03/62] ipvlan: fix device features Greg Kroah-Hartman
` (60 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jon Maloy, Ying Xue, Richard Alpe,
Cong Wang, David S. Miller, syzbot+0e7181deafa7e0b79923
From: Cong Wang <xiyou.wangcong@gmail.com>
[ Upstream commit 47733f9daf4fe4f7e0eb9e273f21ad3a19130487 ]
__tipc_nl_compat_dumpit() has two callers, and it expects them to
pass a valid nlmsghdr via arg->data. This header is artificial and
crafted just for __tipc_nl_compat_dumpit().
tipc_nl_compat_publ_dump() does so by putting a genlmsghdr as well
as some nested attribute, TIPC_NLA_SOCK. But the other caller
tipc_nl_compat_dumpit() does not, this leaves arg->data uninitialized
on this call path.
Fix this by just adding a similar nlmsghdr without any payload in
tipc_nl_compat_dumpit().
This bug exists since day 1, but the recent commit 6ea67769ff33
("net: tipc: prepare attrs in __tipc_nl_compat_dumpit()") makes it
easier to appear.
Reported-and-tested-by: syzbot+0e7181deafa7e0b79923@syzkaller.appspotmail.com
Fixes: d0796d1ef63d ("tipc: convert legacy nl bearer dump to nl compat")
Cc: Jon Maloy <jmaloy@redhat.com>
Cc: Ying Xue <ying.xue@windriver.com>
Cc: Richard Alpe <richard.alpe@ericsson.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Acked-by: Ying Xue <ying.xue@windriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
net/tipc/netlink_compat.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -250,8 +250,9 @@ err_out:
static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
struct tipc_nl_compat_msg *msg)
{
- int err;
+ struct nlmsghdr *nlh;
struct sk_buff *arg;
+ int err;
if (msg->req_type && (!msg->req_size ||
!TLV_CHECK_TYPE(msg->req, msg->req_type)))
@@ -280,6 +281,15 @@ static int tipc_nl_compat_dumpit(struct
return -ENOMEM;
}
+ nlh = nlmsg_put(arg, 0, 0, tipc_genl_family.id, 0, NLM_F_MULTI);
+ if (!nlh) {
+ kfree_skb(arg);
+ kfree_skb(msg->rep);
+ msg->rep = NULL;
+ return -EMSGSIZE;
+ }
+ nlmsg_end(arg, nlh);
+
err = __tipc_nl_compat_dumpit(cmd, msg, arg);
if (err) {
kfree_skb(msg->rep);
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 03/62] ipvlan: fix device features
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 01/62] net: Fix potential wrong skb->protocol in skb_vlan_untag() Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 02/62] tipc: fix uninit skb->data in tipc_nl_compat_dumpit() Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 04/62] bonding: show saner speed for broadcast mode Greg Kroah-Hartman
` (59 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mahesh Bandewar, Eric Dumazet,
David S. Miller
From: Mahesh Bandewar <maheshb@google.com>
[ Upstream commit d0f5c7076e01fef6fcb86988d9508bf3ce258bd4 ]
Processing NETDEV_FEAT_CHANGE causes IPvlan links to lose
NETIF_F_LLTX feature because of the incorrect handling of
features in ipvlan_fix_features().
--before--
lpaa10:~# ethtool -k ipvl0 | grep tx-lockless
tx-lockless: on [fixed]
lpaa10:~# ethtool -K ipvl0 tso off
Cannot change tcp-segmentation-offload
Actual changes:
vlan-challenged: off [fixed]
tx-lockless: off [fixed]
lpaa10:~# ethtool -k ipvl0 | grep tx-lockless
tx-lockless: off [fixed]
lpaa10:~#
--after--
lpaa10:~# ethtool -k ipvl0 | grep tx-lockless
tx-lockless: on [fixed]
lpaa10:~# ethtool -K ipvl0 tso off
Cannot change tcp-segmentation-offload
Could not change any device features
lpaa10:~# ethtool -k ipvl0 | grep tx-lockless
tx-lockless: on [fixed]
lpaa10:~#
Fixes: 2ad7bf363841 ("ipvlan: Initial check-in of the IPVLAN driver.")
Signed-off-by: Mahesh Bandewar <maheshb@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/ipvlan/ipvlan_main.c | 25 +++++++++++++++++++++----
1 file changed, 21 insertions(+), 4 deletions(-)
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -87,12 +87,21 @@ static void ipvlan_port_destroy(struct n
static struct lock_class_key ipvlan_netdev_xmit_lock_key;
static struct lock_class_key ipvlan_netdev_addr_lock_key;
+#define IPVLAN_ALWAYS_ON_OFLOADS \
+ (NETIF_F_SG | NETIF_F_HW_CSUM | \
+ NETIF_F_GSO_ROBUST | NETIF_F_GSO_SOFTWARE | NETIF_F_GSO_ENCAP_ALL)
+
+#define IPVLAN_ALWAYS_ON \
+ (IPVLAN_ALWAYS_ON_OFLOADS | NETIF_F_LLTX | NETIF_F_VLAN_CHALLENGED)
+
#define IPVLAN_FEATURES \
(NETIF_F_SG | NETIF_F_ALL_CSUM | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST | \
NETIF_F_GSO | NETIF_F_TSO | NETIF_F_UFO | NETIF_F_GSO_ROBUST | \
NETIF_F_TSO_ECN | NETIF_F_TSO6 | NETIF_F_GRO | NETIF_F_RXCSUM | \
NETIF_F_HW_VLAN_CTAG_FILTER | NETIF_F_HW_VLAN_STAG_FILTER)
+ /* NETIF_F_GSO_ENCAP_ALL NETIF_F_GSO_SOFTWARE Newly added */
+
#define IPVLAN_STATE_MASK \
((1<<__LINK_STATE_NOCARRIER) | (1<<__LINK_STATE_DORMANT))
@@ -117,7 +126,9 @@ static int ipvlan_init(struct net_device
dev->state = (dev->state & ~IPVLAN_STATE_MASK) |
(phy_dev->state & IPVLAN_STATE_MASK);
dev->features = phy_dev->features & IPVLAN_FEATURES;
- dev->features |= NETIF_F_LLTX;
+ dev->features |= IPVLAN_ALWAYS_ON;
+ dev->vlan_features = phy_dev->vlan_features & IPVLAN_FEATURES;
+ dev->vlan_features |= IPVLAN_ALWAYS_ON_OFLOADS;
dev->gso_max_size = phy_dev->gso_max_size;
dev->hard_header_len = phy_dev->hard_header_len;
@@ -201,7 +212,14 @@ static netdev_features_t ipvlan_fix_feat
{
struct ipvl_dev *ipvlan = netdev_priv(dev);
- return features & (ipvlan->sfeatures | ~IPVLAN_FEATURES);
+ features |= NETIF_F_ALL_FOR_ALL;
+ features &= (ipvlan->sfeatures | ~IPVLAN_FEATURES);
+ features = netdev_increment_features(ipvlan->phy_dev->features,
+ features, features);
+ features |= IPVLAN_ALWAYS_ON;
+ features &= (IPVLAN_FEATURES | IPVLAN_ALWAYS_ON);
+
+ return features;
}
static void ipvlan_change_rx_flags(struct net_device *dev, int change)
@@ -590,9 +608,8 @@ static int ipvlan_device_event(struct no
case NETDEV_FEAT_CHANGE:
list_for_each_entry(ipvlan, &port->ipvlans, pnode) {
- ipvlan->dev->features = dev->features & IPVLAN_FEATURES;
ipvlan->dev->gso_max_size = dev->gso_max_size;
- netdev_features_change(ipvlan->dev);
+ netdev_update_features(ipvlan->dev);
}
break;
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 04/62] bonding: show saner speed for broadcast mode
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (2 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.4 03/62] ipvlan: fix device features Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 05/62] bonding: fix a potential double-unregister Greg Kroah-Hartman
` (58 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jay Vosburgh, Veaceslav Falico,
Andy Gospodarek, David S. Miller, netdev, Jay Vosburgh,
Jarod Wilson
From: Jarod Wilson <jarod@redhat.com>
[ Upstream commit 4ca0d9ac3fd8f9f90b72a15d8da2aca3ffb58418 ]
Broadcast mode bonds transmit a copy of all traffic simultaneously out of
all interfaces, so the "speed" of the bond isn't really the aggregate of
all interfaces, but rather, the speed of the slowest active interface.
Also, the type of the speed field is u32, not unsigned long, so adjust
that accordingly, as required to make min() function here without
complaining about mismatching types.
Fixes: bb5b052f751b ("bond: add support to read speed and duplex via ethtool")
CC: Jay Vosburgh <j.vosburgh@gmail.com>
CC: Veaceslav Falico <vfalico@gmail.com>
CC: Andy Gospodarek <andy@greyhouse.net>
CC: "David S. Miller" <davem@davemloft.net>
CC: netdev@vger.kernel.org
Acked-by: Jay Vosburgh <jay.vosburgh@canonical.com>
Signed-off-by: Jarod Wilson <jarod@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/bonding/bond_main.c | 21 ++++++++++++++++++---
1 file changed, 18 insertions(+), 3 deletions(-)
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -4057,13 +4057,23 @@ static netdev_tx_t bond_start_xmit(struc
return ret;
}
+static u32 bond_mode_bcast_speed(struct slave *slave, u32 speed)
+{
+ if (speed == 0 || speed == SPEED_UNKNOWN)
+ speed = slave->speed;
+ else
+ speed = min(speed, slave->speed);
+
+ return speed;
+}
+
static int bond_ethtool_get_settings(struct net_device *bond_dev,
struct ethtool_cmd *ecmd)
{
struct bonding *bond = netdev_priv(bond_dev);
- unsigned long speed = 0;
struct list_head *iter;
struct slave *slave;
+ u32 speed = 0;
ecmd->duplex = DUPLEX_UNKNOWN;
ecmd->port = PORT_OTHER;
@@ -4075,8 +4085,13 @@ static int bond_ethtool_get_settings(str
*/
bond_for_each_slave(bond, slave, iter) {
if (bond_slave_can_tx(slave)) {
- if (slave->speed != SPEED_UNKNOWN)
- speed += slave->speed;
+ if (slave->speed != SPEED_UNKNOWN) {
+ if (BOND_MODE(bond) == BOND_MODE_BROADCAST)
+ speed = bond_mode_bcast_speed(slave,
+ speed);
+ else
+ speed += slave->speed;
+ }
if (ecmd->duplex == DUPLEX_UNKNOWN &&
slave->duplex != DUPLEX_UNKNOWN)
ecmd->duplex = slave->duplex;
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 05/62] bonding: fix a potential double-unregister
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (3 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.4 04/62] bonding: show saner speed for broadcast mode Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 06/62] powerpc/pseries: Do not initiate shutdown when system is running on UPS Greg Kroah-Hartman
` (57 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+af23e7f3e0a7e10c8b67,
Eric Dumazet, Andy Gospodarek, Jay Vosburgh, Cong Wang,
David S. Miller
From: Cong Wang <xiyou.wangcong@gmail.com>
[ Upstream commit 832707021666411d04795c564a4adea5d6b94f17 ]
When we tear down a network namespace, we unregister all
the netdevices within it. So we may queue a slave device
and a bonding device together in the same unregister queue.
If the only slave device is non-ethernet, it would
automatically unregister the bonding device as well. Thus,
we may end up unregistering the bonding device twice.
Workaround this special case by checking reg_state.
Fixes: 9b5e383c11b0 ("net: Introduce unregister_netdevice_many()")
Reported-by: syzbot+af23e7f3e0a7e10c8b67@syzkaller.appspotmail.com
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Andy Gospodarek <andy@greyhouse.net>
Cc: Jay Vosburgh <j.vosburgh@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/bonding/bond_main.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1940,7 +1940,8 @@ static int bond_release_and_destroy(str
int ret;
ret = bond_release(bond_dev, slave_dev);
- if (ret == 0 && !bond_has_slaves(bond)) {
+ if (ret == 0 && !bond_has_slaves(bond) &&
+ bond_dev->reg_state != NETREG_UNREGISTERING) {
bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
netdev_info(bond_dev, "Destroying bond %s\n",
bond_dev->name);
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 06/62] powerpc/pseries: Do not initiate shutdown when system is running on UPS
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (4 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.4 05/62] bonding: fix a potential double-unregister Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 07/62] ALSA: pci: delete repeated words in comments Greg Kroah-Hartman
` (56 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Vasant Hegde, Michael Ellerman, Sasha Levin
From: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
commit 90a9b102eddf6a3f987d15f4454e26a2532c1c98 upstream.
As per PAPR we have to look for both EPOW sensor value and event
modifier to identify the type of event and take appropriate action.
In LoPAPR v1.1 section 10.2.2 includes table 136 "EPOW Action Codes":
SYSTEM_SHUTDOWN 3
The system must be shut down. An EPOW-aware OS logs the EPOW error
log information, then schedules the system to be shut down to begin
after an OS defined delay internal (default is 10 minutes.)
Then in section 10.3.2.2.8 there is table 146 "Platform Event Log
Format, Version 6, EPOW Section", which includes the "EPOW Event
Modifier":
For EPOW sensor value = 3
0x01 = Normal system shutdown with no additional delay
0x02 = Loss of utility power, system is running on UPS/Battery
0x03 = Loss of system critical functions, system should be shutdown
0x04 = Ambient temperature too high
All other values = reserved
We have a user space tool (rtas_errd) on LPAR to monitor for
EPOW_SHUTDOWN_ON_UPS. Once it gets an event it initiates shutdown
after predefined time. It also starts monitoring for any new EPOW
events. If it receives "Power restored" event before predefined time
it will cancel the shutdown. Otherwise after predefined time it will
shutdown the system.
Commit 79872e35469b ("powerpc/pseries: All events of
EPOW_SYSTEM_SHUTDOWN must initiate shutdown") changed our handling of
the "on UPS/Battery" case, to immediately shutdown the system. This
breaks existing setups that rely on the userspace tool to delay
shutdown and let the system run on the UPS.
Fixes: 79872e35469b ("powerpc/pseries: All events of EPOW_SYSTEM_SHUTDOWN must initiate shutdown")
Cc: stable@vger.kernel.org # v4.0+
Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
[mpe: Massage change log and add PAPR references]
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200820061844.306460-1-hegdevasant@linux.vnet.ibm.com
Signed-off-by: Vasant Hegde <hegdevasant@linux.vnet.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/pseries/ras.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
index 9e817c1b78087..1fa8e492ce27d 100644
--- a/arch/powerpc/platforms/pseries/ras.c
+++ b/arch/powerpc/platforms/pseries/ras.c
@@ -90,7 +90,6 @@ static void handle_system_shutdown(char event_modifier)
pr_emerg("Loss of power reported by firmware, system is "
"running on UPS/battery");
pr_emerg("Check RTAS error log for details");
- orderly_poweroff(true);
break;
case EPOW_SHUTDOWN_LOSS_OF_CRITICAL_FUNCTIONS:
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 07/62] ALSA: pci: delete repeated words in comments
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (5 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.4 06/62] powerpc/pseries: Do not initiate shutdown when system is running on UPS Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 08/62] ASoC: tegra: Fix reference count leaks Greg Kroah-Hartman
` (55 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Randy Dunlap, Takashi Iwai, Sasha Levin
From: Randy Dunlap <rdunlap@infradead.org>
[ Upstream commit c7fabbc51352f50cc58242a6dc3b9c1a3599849b ]
Drop duplicated words in sound/pci/.
{and, the, at}
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Link: https://lore.kernel.org/r/20200806021926.32418-1-rdunlap@infradead.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/pci/cs46xx/cs46xx_lib.c | 2 +-
sound/pci/cs46xx/dsp_spos_scb_lib.c | 2 +-
sound/pci/hda/hda_codec.c | 2 +-
sound/pci/hda/hda_generic.c | 2 +-
sound/pci/hda/patch_sigmatel.c | 2 +-
sound/pci/ice1712/prodigy192.c | 2 +-
sound/pci/oxygen/xonar_dg.c | 2 +-
7 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/sound/pci/cs46xx/cs46xx_lib.c b/sound/pci/cs46xx/cs46xx_lib.c
index 2706f271a83b0..8a174c170e0aa 100644
--- a/sound/pci/cs46xx/cs46xx_lib.c
+++ b/sound/pci/cs46xx/cs46xx_lib.c
@@ -780,7 +780,7 @@ static void snd_cs46xx_set_capture_sample_rate(struct snd_cs46xx *chip, unsigned
rate = 48000 / 9;
/*
- * We can not capture at at rate greater than the Input Rate (48000).
+ * We can not capture at a rate greater than the Input Rate (48000).
* Return an error if an attempt is made to stray outside that limit.
*/
if (rate > 48000)
diff --git a/sound/pci/cs46xx/dsp_spos_scb_lib.c b/sound/pci/cs46xx/dsp_spos_scb_lib.c
index 7488e1b7a7707..4e726d39b05d1 100644
--- a/sound/pci/cs46xx/dsp_spos_scb_lib.c
+++ b/sound/pci/cs46xx/dsp_spos_scb_lib.c
@@ -1742,7 +1742,7 @@ int cs46xx_iec958_pre_open (struct snd_cs46xx *chip)
struct dsp_spos_instance * ins = chip->dsp_spos_instance;
if ( ins->spdif_status_out & DSP_SPDIF_STATUS_OUTPUT_ENABLED ) {
- /* remove AsynchFGTxSCB and and PCMSerialInput_II */
+ /* remove AsynchFGTxSCB and PCMSerialInput_II */
cs46xx_dsp_disable_spdif_out (chip);
/* save state */
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 825d9b27dbe12..4962a9d8a572b 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -3496,7 +3496,7 @@ EXPORT_SYMBOL_GPL(snd_hda_set_power_save);
* @nid: NID to check / update
*
* Check whether the given NID is in the amp list. If it's in the list,
- * check the current AMP status, and update the the power-status according
+ * check the current AMP status, and update the power-status according
* to the mute status.
*
* This function is supposed to be set or called from the check_power_status
diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c
index 869c322ddae31..7cd1047a4edf3 100644
--- a/sound/pci/hda/hda_generic.c
+++ b/sound/pci/hda/hda_generic.c
@@ -837,7 +837,7 @@ static void activate_amp_in(struct hda_codec *codec, struct nid_path *path,
}
}
-/* sync power of each widget in the the given path */
+/* sync power of each widget in the given path */
static hda_nid_t path_power_update(struct hda_codec *codec,
struct nid_path *path,
bool allow_powerdown)
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index d1a6d20ace0da..80b72d0702c5e 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -862,7 +862,7 @@ static int stac_auto_create_beep_ctls(struct hda_codec *codec,
static struct snd_kcontrol_new beep_vol_ctl =
HDA_CODEC_VOLUME(NULL, 0, 0, 0);
- /* check for mute support for the the amp */
+ /* check for mute support for the amp */
if ((caps & AC_AMPCAP_MUTE) >> AC_AMPCAP_MUTE_SHIFT) {
const struct snd_kcontrol_new *temp;
if (spec->anabeep_nid == nid)
diff --git a/sound/pci/ice1712/prodigy192.c b/sound/pci/ice1712/prodigy192.c
index 3919aed39ca03..5e52086d7b986 100644
--- a/sound/pci/ice1712/prodigy192.c
+++ b/sound/pci/ice1712/prodigy192.c
@@ -31,7 +31,7 @@
* Experimentally I found out that only a combination of
* OCKS0=1, OCKS1=1 (128fs, 64fs output) and ice1724 -
* VT1724_MT_I2S_MCLK_128X=0 (256fs input) yields correct
- * sampling rate. That means the the FPGA doubles the
+ * sampling rate. That means that the FPGA doubles the
* MCK01 rate.
*
* Copyright (c) 2003 Takashi Iwai <tiwai@suse.de>
diff --git a/sound/pci/oxygen/xonar_dg.c b/sound/pci/oxygen/xonar_dg.c
index 4cf3200e988b0..df44135e1b0c9 100644
--- a/sound/pci/oxygen/xonar_dg.c
+++ b/sound/pci/oxygen/xonar_dg.c
@@ -39,7 +39,7 @@
* GPIO 4 <- headphone detect
* GPIO 5 -> enable ADC analog circuit for the left channel
* GPIO 6 -> enable ADC analog circuit for the right channel
- * GPIO 7 -> switch green rear output jack between CS4245 and and the first
+ * GPIO 7 -> switch green rear output jack between CS4245 and the first
* channel of CS4361 (mechanical relay)
* GPIO 8 -> enable output to speakers
*
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 08/62] ASoC: tegra: Fix reference count leaks.
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (6 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.4 07/62] ALSA: pci: delete repeated words in comments Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 09/62] media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq() Greg Kroah-Hartman
` (54 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Qiushi Wu, Jon Hunter, Mark Brown,
Sasha Levin
From: Qiushi Wu <wu000273@umn.edu>
[ Upstream commit deca195383a6085be62cb453079e03e04d618d6e ]
Calling pm_runtime_get_sync increments the counter even in case of
failure, causing incorrect ref count if pm_runtime_put is not called in
error handling paths. Call pm_runtime_put if pm_runtime_get_sync fails.
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Reviewed-by: Jon Hunter <jonathanh@nvidia.com>
Link: https://lore.kernel.org/r/20200613204422.24484-1-wu000273@umn.edu
Signed-off-by: Mark Brown <broonie@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
sound/soc/tegra/tegra30_ahub.c | 4 +++-
sound/soc/tegra/tegra30_i2s.c | 4 +++-
2 files changed, 6 insertions(+), 2 deletions(-)
diff --git a/sound/soc/tegra/tegra30_ahub.c b/sound/soc/tegra/tegra30_ahub.c
index fef3b9a21a667..e441e23a37e4f 100644
--- a/sound/soc/tegra/tegra30_ahub.c
+++ b/sound/soc/tegra/tegra30_ahub.c
@@ -656,8 +656,10 @@ static int tegra30_ahub_resume(struct device *dev)
int ret;
ret = pm_runtime_get_sync(dev);
- if (ret < 0)
+ if (ret < 0) {
+ pm_runtime_put(dev);
return ret;
+ }
ret = regcache_sync(ahub->regmap_ahub);
ret |= regcache_sync(ahub->regmap_apbif);
pm_runtime_put(dev);
diff --git a/sound/soc/tegra/tegra30_i2s.c b/sound/soc/tegra/tegra30_i2s.c
index 8e55583aa104e..516f37896092c 100644
--- a/sound/soc/tegra/tegra30_i2s.c
+++ b/sound/soc/tegra/tegra30_i2s.c
@@ -552,8 +552,10 @@ static int tegra30_i2s_resume(struct device *dev)
int ret;
ret = pm_runtime_get_sync(dev);
- if (ret < 0)
+ if (ret < 0) {
+ pm_runtime_put(dev);
return ret;
+ }
ret = regcache_sync(i2s->regmap);
pm_runtime_put(dev);
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 09/62] media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq()
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (7 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.4 08/62] ASoC: tegra: Fix reference count leaks Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 10/62] scsi: target: tcmu: Fix crash on ARM during cmd completion Greg Kroah-Hartman
` (53 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jia-Ju Bai, Sean Young,
Mauro Carvalho Chehab, Sasha Levin
From: Jia-Ju Bai <baijiaju@tsinghua.edu.cn>
[ Upstream commit 6499a0db9b0f1e903d52f8244eacc1d4be00eea2 ]
The value av7110->debi_virt is stored in DMA memory, and it is assigned
to data, and thus data[0] can be modified at any time by malicious
hardware. In this case, "if (data[0] < 2)" can be passed, but then
data[0] can be changed into a large number, which may cause buffer
overflow when the code "av7110->ci_slot[data[0]]" is used.
To fix this possible bug, data[0] is assigned to a local variable, which
replaces the use of data[0].
Signed-off-by: Jia-Ju Bai <baijiaju@tsinghua.edu.cn>
Signed-off-by: Sean Young <sean@mess.org>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/pci/ttpci/av7110.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/media/pci/ttpci/av7110.c b/drivers/media/pci/ttpci/av7110.c
index f89364951ebdf..fb13cc3c591da 100644
--- a/drivers/media/pci/ttpci/av7110.c
+++ b/drivers/media/pci/ttpci/av7110.c
@@ -426,14 +426,15 @@ static void debiirq(unsigned long cookie)
case DATA_CI_GET:
{
u8 *data = av7110->debi_virt;
+ u8 data_0 = data[0];
- if ((data[0] < 2) && data[2] == 0xff) {
+ if (data_0 < 2 && data[2] == 0xff) {
int flags = 0;
if (data[5] > 0)
flags |= CA_CI_MODULE_PRESENT;
if (data[5] > 5)
flags |= CA_CI_MODULE_READY;
- av7110->ci_slot[data[0]].flags = flags;
+ av7110->ci_slot[data_0].flags = flags;
} else
ci_get_data(&av7110->ci_rbuffer,
av7110->debi_virt,
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 10/62] scsi: target: tcmu: Fix crash on ARM during cmd completion
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (8 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.4 09/62] media: pci: ttpci: av7110: fix possible buffer overflow caused by bad DMA value in debiirq() Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 11/62] drm/amdkfd: Fix reference count leaks Greg Kroah-Hartman
` (52 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, JiangYu, Mike Christie,
Bodo Stroesser, Martin K. Petersen, Sasha Levin
From: Bodo Stroesser <bstroesser@ts.fujitsu.com>
[ Upstream commit 5a0c256d96f020e4771f6fd5524b80f89a2d3132 ]
If tcmu_handle_completions() has to process a padding shorter than
sizeof(struct tcmu_cmd_entry), the current call to
tcmu_flush_dcache_range() with sizeof(struct tcmu_cmd_entry) as length
param is wrong and causes crashes on e.g. ARM, because
tcmu_flush_dcache_range() in this case calls
flush_dcache_page(vmalloc_to_page(start)); with start being an invalid
address above the end of the vmalloc'ed area.
The fix is to use the minimum of remaining ring space and sizeof(struct
tcmu_cmd_entry) as the length param.
The patch was tested on kernel 4.19.118.
See https://bugzilla.kernel.org/show_bug.cgi?id=208045#c10
Link: https://lore.kernel.org/r/20200629093756.8947-1-bstroesser@ts.fujitsu.com
Tested-by: JiangYu <lnsyyj@hotmail.com>
Acked-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Bodo Stroesser <bstroesser@ts.fujitsu.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/target/target_core_user.c | 9 ++++++++-
1 file changed, 8 insertions(+), 1 deletion(-)
diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c
index c43c942e1f876..bccde58bc5e30 100644
--- a/drivers/target/target_core_user.c
+++ b/drivers/target/target_core_user.c
@@ -590,7 +590,14 @@ static unsigned int tcmu_handle_completions(struct tcmu_dev *udev)
struct tcmu_cmd_entry *entry = (void *) mb + CMDR_OFF + udev->cmdr_last_cleaned;
struct tcmu_cmd *cmd;
- tcmu_flush_dcache_range(entry, sizeof(*entry));
+ /*
+ * Flush max. up to end of cmd ring since current entry might
+ * be a padding that is shorter than sizeof(*entry)
+ */
+ size_t ring_left = head_to_end(udev->cmdr_last_cleaned,
+ udev->cmdr_size);
+ tcmu_flush_dcache_range(entry, ring_left < sizeof(*entry) ?
+ ring_left : sizeof(*entry));
if (tcmu_hdr_get_op(entry->hdr.len_op) == TCMU_OP_PAD) {
UPDATE_HEAD(udev->cmdr_last_cleaned,
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 11/62] drm/amdkfd: Fix reference count leaks.
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (9 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.4 10/62] scsi: target: tcmu: Fix crash on ARM during cmd completion Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 12/62] drm/radeon: fix multiple reference count leak Greg Kroah-Hartman
` (51 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Qiushi Wu, Felix Kuehling,
Alex Deucher, Sasha Levin
From: Qiushi Wu <wu000273@umn.edu>
[ Upstream commit 20eca0123a35305e38b344d571cf32768854168c ]
kobject_init_and_add() takes reference even when it fails.
If this function returns an error, kobject_put() must be called to
properly clean up the memory associated with the object.
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Reviewed-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Felix Kuehling <Felix.Kuehling@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdkfd/kfd_topology.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
index 2acbd43f9a531..965489b20429c 100644
--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
+++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c
@@ -841,8 +841,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
ret = kobject_init_and_add(dev->kobj_node, &node_type,
sys_props.kobj_nodes, "%d", id);
- if (ret < 0)
+ if (ret < 0) {
+ kobject_put(dev->kobj_node);
return ret;
+ }
dev->kobj_mem = kobject_create_and_add("mem_banks", dev->kobj_node);
if (!dev->kobj_mem)
@@ -885,8 +887,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
return -ENOMEM;
ret = kobject_init_and_add(mem->kobj, &mem_type,
dev->kobj_mem, "%d", i);
- if (ret < 0)
+ if (ret < 0) {
+ kobject_put(mem->kobj);
return ret;
+ }
mem->attr.name = "properties";
mem->attr.mode = KFD_SYSFS_FILE_MODE;
@@ -904,8 +908,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
return -ENOMEM;
ret = kobject_init_and_add(cache->kobj, &cache_type,
dev->kobj_cache, "%d", i);
- if (ret < 0)
+ if (ret < 0) {
+ kobject_put(cache->kobj);
return ret;
+ }
cache->attr.name = "properties";
cache->attr.mode = KFD_SYSFS_FILE_MODE;
@@ -923,8 +929,10 @@ static int kfd_build_sysfs_node_entry(struct kfd_topology_device *dev,
return -ENOMEM;
ret = kobject_init_and_add(iolink->kobj, &iolink_type,
dev->kobj_iolink, "%d", i);
- if (ret < 0)
+ if (ret < 0) {
+ kobject_put(iolink->kobj);
return ret;
+ }
iolink->attr.name = "properties";
iolink->attr.mode = KFD_SYSFS_FILE_MODE;
@@ -976,8 +984,10 @@ static int kfd_topology_update_sysfs(void)
ret = kobject_init_and_add(sys_props.kobj_topology,
&sysprops_type, &kfd_device->kobj,
"topology");
- if (ret < 0)
+ if (ret < 0) {
+ kobject_put(sys_props.kobj_topology);
return ret;
+ }
sys_props.kobj_nodes = kobject_create_and_add("nodes",
sys_props.kobj_topology);
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 12/62] drm/radeon: fix multiple reference count leak
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (10 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.4 11/62] drm/amdkfd: Fix reference count leaks Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 13/62] drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms Greg Kroah-Hartman
` (50 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aditya Pakki, Alex Deucher, Sasha Levin
From: Aditya Pakki <pakki001@umn.edu>
[ Upstream commit 6f2e8acdb48ed166b65d47837c31b177460491ec ]
On calling pm_runtime_get_sync() the reference count of the device
is incremented. In case of failure, decrement the
reference count before returning the error.
Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/radeon/radeon_connectors.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c
index bebcef2ce6b88..a9f1d99bb6f99 100644
--- a/drivers/gpu/drm/radeon/radeon_connectors.c
+++ b/drivers/gpu/drm/radeon/radeon_connectors.c
@@ -886,8 +886,10 @@ radeon_lvds_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
if (encoder) {
@@ -1021,8 +1023,10 @@ radeon_vga_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
encoder = radeon_best_single_encoder(connector);
@@ -1158,8 +1162,10 @@ radeon_tv_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
encoder = radeon_best_single_encoder(connector);
@@ -1241,8 +1247,10 @@ radeon_dvi_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
if (radeon_connector->detected_hpd_without_ddc) {
@@ -1681,8 +1689,10 @@ radeon_dp_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
if (!force && radeon_check_hpd_status_unchanged(connector)) {
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 13/62] drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (11 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.4 12/62] drm/radeon: fix multiple reference count leak Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 14/62] drm/amd/display: fix ref count leak in amdgpu_drm_ioctl Greg Kroah-Hartman
` (49 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Navid Emamdoost, Alex Deucher, Sasha Levin
From: Navid Emamdoost <navid.emamdoost@gmail.com>
[ Upstream commit 9ba8923cbbe11564dd1bf9f3602add9a9cfbb5c6 ]
in amdgpu_driver_open_kms the call to pm_runtime_get_sync increments the
counter even in case of failure, leading to incorrect
ref count. In case of failure, decrement the ref count before returning.
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
index 5bf98f0195fbd..6025c69871a86 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_kms.c
@@ -522,7 +522,7 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
r = pm_runtime_get_sync(dev->dev);
if (r < 0)
- return r;
+ goto pm_put;
fpriv = kzalloc(sizeof(*fpriv), GFP_KERNEL);
if (unlikely(!fpriv))
@@ -540,6 +540,7 @@ int amdgpu_driver_open_kms(struct drm_device *dev, struct drm_file *file_priv)
file_priv->driver_priv = fpriv;
pm_runtime_mark_last_busy(dev->dev);
+pm_put:
pm_runtime_put_autosuspend(dev->dev);
return 0;
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 14/62] drm/amd/display: fix ref count leak in amdgpu_drm_ioctl
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (12 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.4 13/62] drm/amdgpu: fix ref count leak in amdgpu_driver_open_kms Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 15/62] drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config Greg Kroah-Hartman
` (48 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Navid Emamdoost, Alex Deucher, Sasha Levin
From: Navid Emamdoost <navid.emamdoost@gmail.com>
[ Upstream commit 5509ac65f2fe5aa3c0003237ec629ca55024307c ]
in amdgpu_drm_ioctl the call to pm_runtime_get_sync increments the
counter even in case of failure, leading to incorrect
ref count. In case of failure, decrement the ref count before returning.
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
index 8d6668cedf6db..eb3c54e1f1ca8 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
@@ -443,11 +443,12 @@ long amdgpu_drm_ioctl(struct file *filp,
dev = file_priv->minor->dev;
ret = pm_runtime_get_sync(dev->dev);
if (ret < 0)
- return ret;
+ goto out;
ret = drm_ioctl(filp, cmd, arg);
pm_runtime_mark_last_busy(dev->dev);
+out:
pm_runtime_put_autosuspend(dev->dev);
return ret;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 15/62] drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (13 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.4 14/62] drm/amd/display: fix ref count leak in amdgpu_drm_ioctl Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:09 ` [PATCH 4.4 16/62] drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails Greg Kroah-Hartman
` (47 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Navid Emamdoost, Alex Deucher, Sasha Levin
From: Navid Emamdoost <navid.emamdoost@gmail.com>
[ Upstream commit e008fa6fb41544b63973a529b704ef342f47cc65 ]
in amdgpu_display_crtc_set_config, the call to pm_runtime_get_sync
increments the counter even in case of failure, leading to incorrect
ref count. In case of failure, decrement the ref count before returning.
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_display.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
index c555781685ea8..d3ee8f19f1ef9 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
@@ -296,7 +296,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set)
ret = pm_runtime_get_sync(dev->dev);
if (ret < 0)
- return ret;
+ goto out;
ret = drm_crtc_helper_set_config(set);
@@ -311,7 +311,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set)
take the current one */
if (active && !adev->have_disp_power_ref) {
adev->have_disp_power_ref = true;
- return ret;
+ goto out;
}
/* if we have no active crtcs, then drop the power ref
we got before */
@@ -320,6 +320,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set)
adev->have_disp_power_ref = false;
}
+out:
/* drop the power reference we got coming in here */
pm_runtime_put_autosuspend(dev->dev);
return ret;
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 16/62] drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (14 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.4 15/62] drm/amdgpu: fix ref count leak in amdgpu_display_crtc_set_config Greg Kroah-Hartman
@ 2020-09-01 15:09 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 17/62] scsi: lpfc: Fix shost refcount mismatch when deleting vport Greg Kroah-Hartman
` (46 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:09 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Navid Emamdoost, Alex Deucher, Sasha Levin
From: Navid Emamdoost <navid.emamdoost@gmail.com>
[ Upstream commit f79f94765f8c39db0b7dec1d335ab046aac03f20 ]
The call to pm_runtime_get_sync increments the counter even in case of
failure, leading to incorrect ref count.
In case of failure, decrement the ref count before returning.
Signed-off-by: Navid Emamdoost <navid.emamdoost@gmail.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
index 1f0e6ede120c4..1b3fda2331bee 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c
@@ -734,8 +734,10 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
if (encoder) {
@@ -863,8 +865,10 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
encoder = amdgpu_connector_best_single_encoder(connector);
@@ -986,8 +990,10 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
@@ -1360,8 +1366,10 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force)
if (!drm_kms_helper_is_poll_worker()) {
r = pm_runtime_get_sync(connector->dev->dev);
- if (r < 0)
+ if (r < 0) {
+ pm_runtime_put_autosuspend(connector->dev->dev);
return connector_status_disconnected;
+ }
}
if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) {
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 17/62] scsi: lpfc: Fix shost refcount mismatch when deleting vport
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (15 preceding siblings ...)
2020-09-01 15:09 ` [PATCH 4.4 16/62] drm/amdgpu/display: fix ref count leak when pm_runtime_get_sync fails Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 18/62] selftests/powerpc: Purge extra count_pmc() calls of ebb selftests Greg Kroah-Hartman
` (45 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Dick Kennedy, James Smart,
Martin K. Petersen, Sasha Levin
From: Dick Kennedy <dick.kennedy@broadcom.com>
[ Upstream commit 03dbfe0668e6692917ac278883e0586cd7f7d753 ]
When vports are deleted, it is observed that there is memory/kthread
leakage as the vport isn't fully being released.
There is a shost reference taken in scsi_add_host_dma that is not released
during scsi_remove_host. It was noticed that other drivers resolve this by
doing a scsi_host_put after calling scsi_remove_host.
The vport_delete routine is taking two references one that corresponds to
an access to the scsi_host in the vport_delete routine and another that is
released after the adapter mailbox command completes that destroys the VPI
that corresponds to the vport.
Remove one of the references taken such that the second reference that is
put will complete the missing scsi_add_host_dma reference and the shost
will be terminated.
Link: https://lore.kernel.org/r/20200630215001.70793-8-jsmart2021@gmail.com
Signed-off-by: Dick Kennedy <dick.kennedy@broadcom.com>
Signed-off-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/lpfc/lpfc_vport.c | 26 ++++++++------------------
1 file changed, 8 insertions(+), 18 deletions(-)
diff --git a/drivers/scsi/lpfc/lpfc_vport.c b/drivers/scsi/lpfc/lpfc_vport.c
index 861c57bc4520a..72248712949e0 100644
--- a/drivers/scsi/lpfc/lpfc_vport.c
+++ b/drivers/scsi/lpfc/lpfc_vport.c
@@ -615,27 +615,16 @@ lpfc_vport_delete(struct fc_vport *fc_vport)
vport->port_state < LPFC_VPORT_READY)
return -EAGAIN;
}
+
/*
- * This is a bit of a mess. We want to ensure the shost doesn't get
- * torn down until we're done with the embedded lpfc_vport structure.
- *
- * Beyond holding a reference for this function, we also need a
- * reference for outstanding I/O requests we schedule during delete
- * processing. But once we scsi_remove_host() we can no longer obtain
- * a reference through scsi_host_get().
- *
- * So we take two references here. We release one reference at the
- * bottom of the function -- after delinking the vport. And we
- * release the other at the completion of the unreg_vpi that get's
- * initiated after we've disposed of all other resources associated
- * with the port.
+ * Take early refcount for outstanding I/O requests we schedule during
+ * delete processing for unreg_vpi. Always keep this before
+ * scsi_remove_host() as we can no longer obtain a reference through
+ * scsi_host_get() after scsi_host_remove as shost is set to SHOST_DEL.
*/
if (!scsi_host_get(shost))
return VPORT_INVAL;
- if (!scsi_host_get(shost)) {
- scsi_host_put(shost);
- return VPORT_INVAL;
- }
+
lpfc_free_sysfs_attr(vport);
lpfc_debugfs_terminate(vport);
@@ -783,8 +772,9 @@ skip_logo:
if (!(vport->vpi_state & LPFC_VPI_REGISTERED) ||
lpfc_mbx_unreg_vpi(vport))
scsi_host_put(shost);
- } else
+ } else {
scsi_host_put(shost);
+ }
lpfc_free_vpi(phba, vport->vpi);
vport->work_port_events = 0;
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 18/62] selftests/powerpc: Purge extra count_pmc() calls of ebb selftests
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (16 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 17/62] scsi: lpfc: Fix shost refcount mismatch when deleting vport Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 19/62] PCI: Fix pci_create_slot() reference count leak Greg Kroah-Hartman
` (44 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Desnes A. Nunes do Rosario,
Sachin Sant, Michael Ellerman, Sasha Levin
From: Desnes A. Nunes do Rosario <desnesn@linux.ibm.com>
[ Upstream commit 3337bf41e0dd70b4064cdf60acdfcdc2d050066c ]
An extra count on ebb_state.stats.pmc_count[PMC_INDEX(pmc)] is being per-
formed when count_pmc() is used to reset PMCs on a few selftests. This
extra pmc_count can occasionally invalidate results, such as the ones from
cycles_test shown hereafter. The ebb_check_count() failed with an above
the upper limit error due to the extra value on ebb_state.stats.pmc_count.
Furthermore, this extra count is also indicated by extra PMC1 trace_log on
the output of the cycle test (as well as on pmc56_overflow_test):
==========
...
[21]: counter = 8
[22]: register SPRN_MMCR0 = 0x0000000080000080
[23]: register SPRN_PMC1 = 0x0000000080000004
[24]: counter = 9
[25]: register SPRN_MMCR0 = 0x0000000080000080
[26]: register SPRN_PMC1 = 0x0000000080000004
[27]: counter = 10
[28]: register SPRN_MMCR0 = 0x0000000080000080
[29]: register SPRN_PMC1 = 0x0000000080000004
>> [30]: register SPRN_PMC1 = 0x000000004000051e
PMC1 count (0x280000546) above upper limit 0x2800003e8 (+0x15e)
[FAIL] Test FAILED on line 52
failure: cycles
==========
Signed-off-by: Desnes A. Nunes do Rosario <desnesn@linux.ibm.com>
Tested-by: Sachin Sant <sachinp@linux.vnet.ibm.com>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200626164737.21943-1-desnesn@linux.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
.../selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c | 2 --
tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c | 2 --
.../selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c | 2 --
.../selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c | 2 --
tools/testing/selftests/powerpc/pmu/ebb/ebb.c | 2 --
.../selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c | 2 --
.../selftests/powerpc/pmu/ebb/lost_exception_test.c | 1 -
.../testing/selftests/powerpc/pmu/ebb/multi_counter_test.c | 7 -------
.../selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c | 2 --
.../testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c | 2 --
.../selftests/powerpc/pmu/ebb/pmc56_overflow_test.c | 2 --
11 files changed, 26 deletions(-)
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c
index 94110b1dcd3d8..031baa43646fb 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/back_to_back_ebbs_test.c
@@ -91,8 +91,6 @@ int back_to_back_ebbs(void)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(1, sample_period);
-
dump_ebb_state();
event_close(&event);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c
index 7c57a8d79535d..361e0be9df9ae 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_test.c
@@ -42,8 +42,6 @@ int cycles(void)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(1, sample_period);
-
dump_ebb_state();
event_close(&event);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c
index ecf5ee3283a3e..fe7d0dc2a1a26 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_freeze_test.c
@@ -99,8 +99,6 @@ int cycles_with_freeze(void)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(1, sample_period);
-
dump_ebb_state();
printf("EBBs while frozen %d\n", ebbs_while_frozen);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c
index c0faba520b35c..b9b30f974b5ea 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/cycles_with_mmcr2_test.c
@@ -71,8 +71,6 @@ int cycles_with_mmcr2(void)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(1, sample_period);
-
dump_ebb_state();
event_close(&event);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c
index 9729d9f902187..4154498bc5dc5 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/ebb.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb.c
@@ -398,8 +398,6 @@ int ebb_child(union pipe read_pipe, union pipe write_pipe)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(1, sample_period);
-
dump_ebb_state();
event_close(&event);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c
index a991d2ea8d0a1..174e4f4dae6c0 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/ebb_on_willing_child_test.c
@@ -38,8 +38,6 @@ static int victim_child(union pipe read_pipe, union pipe write_pipe)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(1, sample_period);
-
dump_ebb_state();
FAIL_IF(ebb_state.stats.ebb_count == 0);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c
index eb8acb78bc6c1..531083accfcad 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/lost_exception_test.c
@@ -75,7 +75,6 @@ static int test_body(void)
ebb_freeze_pmcs();
ebb_global_disable();
- count_pmc(4, sample_period);
mtspr(SPRN_PMC4, 0xdead);
dump_summary_ebb_state();
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c
index 6ff8c8ff27d66..035c02273cd49 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_counter_test.c
@@ -70,13 +70,6 @@ int multi_counter(void)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(1, sample_period);
- count_pmc(2, sample_period);
- count_pmc(3, sample_period);
- count_pmc(4, sample_period);
- count_pmc(5, sample_period);
- count_pmc(6, sample_period);
-
dump_ebb_state();
for (i = 0; i < 6; i++)
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c
index 037cb6154f360..3e9d4ac965c85 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/multi_ebb_procs_test.c
@@ -61,8 +61,6 @@ static int cycles_child(void)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(1, sample_period);
-
dump_summary_ebb_state();
event_close(&event);
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c
index c5fa64790c22e..d90891fe96a32 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/pmae_handling_test.c
@@ -82,8 +82,6 @@ static int test_body(void)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(1, sample_period);
-
dump_ebb_state();
if (mmcr0_mismatch)
diff --git a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
index 30e1ac62e8cb4..8ca92b9ee5b01 100644
--- a/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
+++ b/tools/testing/selftests/powerpc/pmu/ebb/pmc56_overflow_test.c
@@ -76,8 +76,6 @@ int pmc56_overflow(void)
ebb_global_disable();
ebb_freeze_pmcs();
- count_pmc(2, sample_period);
-
dump_ebb_state();
printf("PMC5/6 overflow %d\n", pmc56_overflowed);
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 19/62] PCI: Fix pci_create_slot() reference count leak
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (17 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 18/62] selftests/powerpc: Purge extra count_pmc() calls of ebb selftests Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 20/62] rtlwifi: rtl8192cu: Prevent leaking urb Greg Kroah-Hartman
` (43 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Qiushi Wu, Bjorn Helgaas, Sasha Levin
From: Qiushi Wu <wu000273@umn.edu>
[ Upstream commit 8a94644b440eef5a7b9c104ac8aa7a7f413e35e5 ]
kobject_init_and_add() takes a reference even when it fails. If it returns
an error, kobject_put() must be called to clean up the memory associated
with the object.
When kobject_init_and_add() fails, call kobject_put() instead of kfree().
b8eb718348b8 ("net-sysfs: Fix reference count leak in
rx|netdev_queue_add_kobject") fixed a similar problem.
Link: https://lore.kernel.org/r/20200528021322.1984-1-wu000273@umn.edu
Signed-off-by: Qiushi Wu <wu000273@umn.edu>
Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/pci/slot.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/drivers/pci/slot.c b/drivers/pci/slot.c
index 429d34c348b9f..01a343ad7155c 100644
--- a/drivers/pci/slot.c
+++ b/drivers/pci/slot.c
@@ -303,13 +303,16 @@ placeholder:
slot_name = make_slot_name(name);
if (!slot_name) {
err = -ENOMEM;
+ kfree(slot);
goto err;
}
err = kobject_init_and_add(&slot->kobj, &pci_slot_ktype, NULL,
"%s", slot_name);
- if (err)
+ if (err) {
+ kobject_put(&slot->kobj);
goto err;
+ }
INIT_LIST_HEAD(&slot->list);
list_add(&slot->list, &parent->slots);
@@ -328,7 +331,6 @@ out:
mutex_unlock(&pci_slot_mutex);
return slot;
err:
- kfree(slot);
slot = ERR_PTR(err);
goto out;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 20/62] rtlwifi: rtl8192cu: Prevent leaking urb
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (18 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 19/62] PCI: Fix pci_create_slot() reference count leak Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 21/62] mips/vdso: Fix resource leaks in genvdso.c Greg Kroah-Hartman
` (42 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Reto Schneider, Kalle Valo, Sasha Levin
From: Reto Schneider <code@reto-schneider.ch>
[ Upstream commit 03128643eb5453a798db5770952c73dc64fcaf00 ]
If usb_submit_urb fails the allocated urb should be unanchored and
released.
Signed-off-by: Reto Schneider <code@reto-schneider.ch>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20200622132113.14508-3-code@reto-schneider.ch
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/realtek/rtlwifi/usb.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c
index 9408c1f8e3977..f01ef8ecfaf39 100644
--- a/drivers/net/wireless/realtek/rtlwifi/usb.c
+++ b/drivers/net/wireless/realtek/rtlwifi/usb.c
@@ -755,8 +755,11 @@ static int _rtl_usb_receive(struct ieee80211_hw *hw)
usb_anchor_urb(urb, &rtlusb->rx_submitted);
err = usb_submit_urb(urb, GFP_KERNEL);
- if (err)
+ if (err) {
+ usb_unanchor_urb(urb);
+ usb_free_urb(urb);
goto err_out;
+ }
usb_free_urb(urb);
}
return 0;
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 21/62] mips/vdso: Fix resource leaks in genvdso.c
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (19 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 20/62] rtlwifi: rtl8192cu: Prevent leaking urb Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 22/62] drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open Greg Kroah-Hartman
` (41 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peng Fan, Thomas Bogendoerfer, Sasha Levin
From: Peng Fan <fanpeng@loongson.cn>
[ Upstream commit a859647b4e6bfeb192284d27d24b6a0c914cae1d ]
Close "fd" before the return of map_vdso() and close "out_file"
in main().
Signed-off-by: Peng Fan <fanpeng@loongson.cn>
Signed-off-by: Thomas Bogendoerfer <tsbogend@alpha.franken.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/mips/vdso/genvdso.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/arch/mips/vdso/genvdso.c b/arch/mips/vdso/genvdso.c
index 530a36f465ced..afcc86726448e 100644
--- a/arch/mips/vdso/genvdso.c
+++ b/arch/mips/vdso/genvdso.c
@@ -126,6 +126,7 @@ static void *map_vdso(const char *path, size_t *_size)
if (fstat(fd, &stat) != 0) {
fprintf(stderr, "%s: Failed to stat '%s': %s\n", program_name,
path, strerror(errno));
+ close(fd);
return NULL;
}
@@ -134,6 +135,7 @@ static void *map_vdso(const char *path, size_t *_size)
if (addr == MAP_FAILED) {
fprintf(stderr, "%s: Failed to map '%s': %s\n", program_name,
path, strerror(errno));
+ close(fd);
return NULL;
}
@@ -143,6 +145,7 @@ static void *map_vdso(const char *path, size_t *_size)
if (memcmp(ehdr->e_ident, ELFMAG, SELFMAG) != 0) {
fprintf(stderr, "%s: '%s' is not an ELF file\n", program_name,
path);
+ close(fd);
return NULL;
}
@@ -154,6 +157,7 @@ static void *map_vdso(const char *path, size_t *_size)
default:
fprintf(stderr, "%s: '%s' has invalid ELF class\n",
program_name, path);
+ close(fd);
return NULL;
}
@@ -165,6 +169,7 @@ static void *map_vdso(const char *path, size_t *_size)
default:
fprintf(stderr, "%s: '%s' has invalid ELF data order\n",
program_name, path);
+ close(fd);
return NULL;
}
@@ -172,15 +177,18 @@ static void *map_vdso(const char *path, size_t *_size)
fprintf(stderr,
"%s: '%s' has invalid ELF machine (expected EM_MIPS)\n",
program_name, path);
+ close(fd);
return NULL;
} else if (swap_uint16(ehdr->e_type) != ET_DYN) {
fprintf(stderr,
"%s: '%s' has invalid ELF type (expected ET_DYN)\n",
program_name, path);
+ close(fd);
return NULL;
}
*_size = stat.st_size;
+ close(fd);
return addr;
}
@@ -284,10 +292,12 @@ int main(int argc, char **argv)
/* Calculate and write symbol offsets to <output file> */
if (!get_symbols(dbg_vdso_path, dbg_vdso)) {
unlink(out_path);
+ fclose(out_file);
return EXIT_FAILURE;
}
fprintf(out_file, "};\n");
+ fclose(out_file);
return EXIT_SUCCESS;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 22/62] drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (20 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 21/62] mips/vdso: Fix resource leaks in genvdso.c Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 23/62] drm/nouveau: Fix reference count leak in nouveau_connector_detect Greg Kroah-Hartman
` (40 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aditya Pakki, Ben Skeggs, Sasha Levin
From: Aditya Pakki <pakki001@umn.edu>
[ Upstream commit bfad51c7633325b5d4b32444efe04329d53297b2 ]
nouveau_fbcon_open() calls calls pm_runtime_get_sync() that
increments the reference count. In case of failure, decrement the
ref count before returning the error.
Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nouveau_fbcon.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
index edb3a23ded5d5..11183839f6fad 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
@@ -184,8 +184,10 @@ nouveau_fbcon_open(struct fb_info *info, int user)
struct nouveau_fbdev *fbcon = info->par;
struct nouveau_drm *drm = nouveau_drm(fbcon->dev);
int ret = pm_runtime_get_sync(drm->dev->dev);
- if (ret < 0 && ret != -EACCES)
+ if (ret < 0 && ret != -EACCES) {
+ pm_runtime_put(drm->dev->dev);
return ret;
+ }
return 0;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 23/62] drm/nouveau: Fix reference count leak in nouveau_connector_detect
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (21 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 22/62] drm/nouveau/drm/noveau: fix reference count leak in nouveau_fbcon_open Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 24/62] locking/lockdep: Fix overflow in presentation of average lock-time Greg Kroah-Hartman
` (39 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Aditya Pakki, Ben Skeggs, Sasha Levin
From: Aditya Pakki <pakki001@umn.edu>
[ Upstream commit 990a1162986e8eff7ca18cc5a0e03b4304392ae2 ]
nouveau_connector_detect() calls pm_runtime_get_sync and in turn
increments the reference count. In case of failure, decrement the
ref count before returning the error.
Signed-off-by: Aditya Pakki <pakki001@umn.edu>
Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/gpu/drm/nouveau/nouveau_connector.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
index 1855b475cc0b2..42be04813b682 100644
--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
+++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
@@ -263,8 +263,10 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)
pm_runtime_get_noresume(dev->dev);
} else {
ret = pm_runtime_get_sync(dev->dev);
- if (ret < 0 && ret != -EACCES)
+ if (ret < 0 && ret != -EACCES) {
+ pm_runtime_put_autosuspend(dev->dev);
return conn_status;
+ }
}
nv_encoder = nouveau_connector_ddc_detect(connector);
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 24/62] locking/lockdep: Fix overflow in presentation of average lock-time
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (22 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 23/62] drm/nouveau: Fix reference count leak in nouveau_connector_detect Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 25/62] scsi: iscsi: Do not put host in iscsi_set_flashnode_param() Greg Kroah-Hartman
` (38 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Chris Wilson, Ingo Molnar,
Peter Zijlstra, Sasha Levin
From: Chris Wilson <chris@chris-wilson.co.uk>
[ Upstream commit a7ef9b28aa8d72a1656fa6f0a01bbd1493886317 ]
Though the number of lock-acquisitions is tracked as unsigned long, this
is passed as the divisor to div_s64() which interprets it as a s32,
giving nonsense values with more than 2 billion acquisitons. E.g.
acquisitions holdtime-min holdtime-max holdtime-total holdtime-avg
-------------------------------------------------------------------------
2350439395 0.07 353.38 649647067.36 0.-32
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/r/20200725185110.11588-1-chris@chris-wilson.co.uk
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/locking/lockdep_proc.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/locking/lockdep_proc.c b/kernel/locking/lockdep_proc.c
index 35b34eccdd109..9484f934aa349 100644
--- a/kernel/locking/lockdep_proc.c
+++ b/kernel/locking/lockdep_proc.c
@@ -423,7 +423,7 @@ static void seq_lock_time(struct seq_file *m, struct lock_time *lt)
seq_time(m, lt->min);
seq_time(m, lt->max);
seq_time(m, lt->total);
- seq_time(m, lt->nr ? div_s64(lt->total, lt->nr) : 0);
+ seq_time(m, lt->nr ? div64_u64(lt->total, lt->nr) : 0);
}
static void seq_stats(struct seq_file *m, struct lock_stat_data *data)
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 25/62] scsi: iscsi: Do not put host in iscsi_set_flashnode_param()
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (23 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 24/62] locking/lockdep: Fix overflow in presentation of average lock-time Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 26/62] ceph: fix potential mdsc use-after-free crash Greg Kroah-Hartman
` (37 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Mike Christie, Jing Xiangfeng,
Martin K. Petersen, Sasha Levin
From: Jing Xiangfeng <jingxiangfeng@huawei.com>
[ Upstream commit 68e12e5f61354eb42cfffbc20a693153fc39738e ]
If scsi_host_lookup() fails we will jump to put_host which may cause a
panic. Jump to exit_set_fnode instead.
Link: https://lore.kernel.org/r/20200615081226.183068-1-jingxiangfeng@huawei.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Jing Xiangfeng <jingxiangfeng@huawei.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/scsi_transport_iscsi.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c
index de10b461ec7ef..4903640316480 100644
--- a/drivers/scsi/scsi_transport_iscsi.c
+++ b/drivers/scsi/scsi_transport_iscsi.c
@@ -3192,7 +3192,7 @@ static int iscsi_set_flashnode_param(struct iscsi_transport *transport,
pr_err("%s could not find host no %u\n",
__func__, ev->u.set_flashnode.host_no);
err = -ENODEV;
- goto put_host;
+ goto exit_set_fnode;
}
idx = ev->u.set_flashnode.flashnode_idx;
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 26/62] ceph: fix potential mdsc use-after-free crash
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (24 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 25/62] scsi: iscsi: Do not put host in iscsi_set_flashnode_param() Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 27/62] scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del() Greg Kroah-Hartman
` (36 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Xiubo Li, Jeff Layton, Ilya Dryomov,
Sasha Levin
From: Xiubo Li <xiubli@redhat.com>
[ Upstream commit fa9967734227b44acb1b6918033f9122dc7825b9 ]
Make sure the delayed work stopped before releasing the resources.
cancel_delayed_work_sync() will only guarantee that the work finishes
executing if the work is already in the ->worklist. That means after
the cancel_delayed_work_sync() returns, it will leave the work requeued
if it was rearmed at the end. That can lead to a use after free once the
work struct is freed.
Fix it by flushing the delayed work instead of trying to cancel it, and
ensure that the work doesn't rearm if the mdsc is stopping.
URL: https://tracker.ceph.com/issues/46293
Signed-off-by: Xiubo Li <xiubli@redhat.com>
Reviewed-by: Jeff Layton <jlayton@kernel.org>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/ceph/mds_client.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
index a5de8e22629ba..b7fd7d69be075 100644
--- a/fs/ceph/mds_client.c
+++ b/fs/ceph/mds_client.c
@@ -3428,6 +3428,9 @@ static void delayed_work(struct work_struct *work)
dout("mdsc delayed_work\n");
ceph_check_delayed_caps(mdsc);
+ if (mdsc->stopping)
+ return;
+
mutex_lock(&mdsc->mutex);
renew_interval = mdsc->mdsmap->m_session_timeout >> 2;
renew_caps = time_after_eq(jiffies, HZ*renew_interval +
@@ -3752,7 +3755,16 @@ void ceph_mdsc_force_umount(struct ceph_mds_client *mdsc)
static void ceph_mdsc_stop(struct ceph_mds_client *mdsc)
{
dout("stop\n");
- cancel_delayed_work_sync(&mdsc->delayed_work); /* cancel timer */
+ /*
+ * Make sure the delayed work stopped before releasing
+ * the resources.
+ *
+ * Because the cancel_delayed_work_sync() will only
+ * guarantee that the work finishes executing. But the
+ * delayed work will re-arm itself again after that.
+ */
+ flush_delayed_work(&mdsc->delayed_work);
+
if (mdsc->mdsmap)
ceph_mdsmap_destroy(mdsc->mdsmap);
kfree(mdsc->sessions);
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 27/62] scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del()
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (25 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 26/62] ceph: fix potential mdsc use-after-free crash Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 28/62] EDAC/ie31200: Fallback if host bridge device is already initialized Greg Kroah-Hartman
` (35 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Girish Basrur, Santosh Vernekar,
Saurav Kashyap, Shyam Sundar, Javed Hasan, Martin K. Petersen,
Sasha Levin
From: Javed Hasan <jhasan@marvell.com>
[ Upstream commit e95b4789ff4380733006836d28e554dc296b2298 ]
In fcoe_sysfs_fcf_del(), we first deleted the fcf from the list and then
freed it if ctlr_dev was not NULL. This was causing a memory leak.
Free the fcf even if ctlr_dev is NULL.
Link: https://lore.kernel.org/r/20200729081824.30996-3-jhasan@marvell.com
Reviewed-by: Girish Basrur <gbasrur@marvell.com>
Reviewed-by: Santosh Vernekar <svernekar@marvell.com>
Reviewed-by: Saurav Kashyap <skashyap@marvell.com>
Reviewed-by: Shyam Sundar <ssundar@marvell.com>
Signed-off-by: Javed Hasan <jhasan@marvell.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/fcoe/fcoe_ctlr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/scsi/fcoe/fcoe_ctlr.c b/drivers/scsi/fcoe/fcoe_ctlr.c
index 3bc610d160f57..53afdbe17d71d 100644
--- a/drivers/scsi/fcoe/fcoe_ctlr.c
+++ b/drivers/scsi/fcoe/fcoe_ctlr.c
@@ -264,9 +264,9 @@ static void fcoe_sysfs_fcf_del(struct fcoe_fcf *new)
WARN_ON(!fcf_dev);
new->fcf_dev = NULL;
fcoe_fcf_device_delete(fcf_dev);
- kfree(new);
mutex_unlock(&cdev->lock);
}
+ kfree(new);
}
/**
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 28/62] EDAC/ie31200: Fallback if host bridge device is already initialized
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (26 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 27/62] scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del() Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 29/62] media: davinci: vpif_capture: fix potential double free Greg Kroah-Hartman
` (34 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Jason Baron, Borislav Petkov,
Mauro Carvalho Chehab, linux-edac, Tony Luck, Sasha Levin
From: Jason Baron <jbaron@akamai.com>
[ Upstream commit 709ed1bcef12398ac1a35c149f3e582db04456c2 ]
The Intel uncore driver may claim some of the pci ids from ie31200 which
means that the ie31200 edac driver will not initialize them as part of
pci_register_driver().
Let's add a fallback for this case to 'pci_get_device()' to get a
reference on the device such that it can still be configured. This is
similar in approach to other edac drivers.
Signed-off-by: Jason Baron <jbaron@akamai.com>
Cc: Borislav Petkov <bp@suse.de>
Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
Cc: linux-edac <linux-edac@vger.kernel.org>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Link: https://lore.kernel.org/r/1594923911-10885-1-git-send-email-jbaron@akamai.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/edac/ie31200_edac.c | 50 ++++++++++++++++++++++++++++++++++---
1 file changed, 47 insertions(+), 3 deletions(-)
diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c
index 18d77ace4813c..30f83fb6b145a 100644
--- a/drivers/edac/ie31200_edac.c
+++ b/drivers/edac/ie31200_edac.c
@@ -131,6 +131,8 @@
#define IE31200_PAGES(n) (n << (28 - PAGE_SHIFT))
static int nr_channels;
+static struct pci_dev *mci_pdev;
+static int ie31200_registered = 1;
struct ie31200_priv {
void __iomem *window;
@@ -456,12 +458,16 @@ fail_free:
static int ie31200_init_one(struct pci_dev *pdev,
const struct pci_device_id *ent)
{
- edac_dbg(0, "MC:\n");
+ int rc;
+ edac_dbg(0, "MC:\n");
if (pci_enable_device(pdev) < 0)
return -EIO;
+ rc = ie31200_probe1(pdev, ent->driver_data);
+ if (rc == 0 && !mci_pdev)
+ mci_pdev = pci_dev_get(pdev);
- return ie31200_probe1(pdev, ent->driver_data);
+ return rc;
}
static void ie31200_remove_one(struct pci_dev *pdev)
@@ -470,6 +476,8 @@ static void ie31200_remove_one(struct pci_dev *pdev)
struct ie31200_priv *priv;
edac_dbg(0, "\n");
+ pci_dev_put(mci_pdev);
+ mci_pdev = NULL;
mci = edac_mc_del_mc(&pdev->dev);
if (!mci)
return;
@@ -515,17 +523,53 @@ static struct pci_driver ie31200_driver = {
static int __init ie31200_init(void)
{
+ int pci_rc, i;
+
edac_dbg(3, "MC:\n");
/* Ensure that the OPSTATE is set correctly for POLL or NMI */
opstate_init();
- return pci_register_driver(&ie31200_driver);
+ pci_rc = pci_register_driver(&ie31200_driver);
+ if (pci_rc < 0)
+ goto fail0;
+
+ if (!mci_pdev) {
+ ie31200_registered = 0;
+ for (i = 0; ie31200_pci_tbl[i].vendor != 0; i++) {
+ mci_pdev = pci_get_device(ie31200_pci_tbl[i].vendor,
+ ie31200_pci_tbl[i].device,
+ NULL);
+ if (mci_pdev)
+ break;
+ }
+ if (!mci_pdev) {
+ edac_dbg(0, "ie31200 pci_get_device fail\n");
+ pci_rc = -ENODEV;
+ goto fail1;
+ }
+ pci_rc = ie31200_init_one(mci_pdev, &ie31200_pci_tbl[i]);
+ if (pci_rc < 0) {
+ edac_dbg(0, "ie31200 init fail\n");
+ pci_rc = -ENODEV;
+ goto fail1;
+ }
+ }
+ return 0;
+
+fail1:
+ pci_unregister_driver(&ie31200_driver);
+fail0:
+ pci_dev_put(mci_pdev);
+
+ return pci_rc;
}
static void __exit ie31200_exit(void)
{
edac_dbg(3, "MC:\n");
pci_unregister_driver(&ie31200_driver);
+ if (!ie31200_registered)
+ ie31200_remove_one(mci_pdev);
}
module_init(ie31200_init);
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 29/62] media: davinci: vpif_capture: fix potential double free
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (27 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 28/62] EDAC/ie31200: Fallback if host bridge device is already initialized Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 30/62] powerpc/spufs: add CONFIG_COREDUMP dependency Greg Kroah-Hartman
` (33 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Evgeny Novikov, Hans Verkuil,
Mauro Carvalho Chehab, Sasha Levin
From: Evgeny Novikov <novikov@ispras.ru>
[ Upstream commit 602649eadaa0c977e362e641f51ec306bc1d365d ]
In case of errors vpif_probe_complete() releases memory for vpif_obj.sd
and unregisters the V4L2 device. But then this is done again by
vpif_probe() itself. The patch removes the cleaning from
vpif_probe_complete().
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Signed-off-by: Hans Verkuil <hverkuil-cisco@xs4all.nl>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/media/platform/davinci/vpif_capture.c | 2 --
1 file changed, 2 deletions(-)
diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c
index c1e573b7cc6fb..50122ac2ac028 100644
--- a/drivers/media/platform/davinci/vpif_capture.c
+++ b/drivers/media/platform/davinci/vpif_capture.c
@@ -1417,8 +1417,6 @@ probe_out:
/* Unregister video device */
video_unregister_device(&ch->video_dev);
}
- kfree(vpif_obj.sd);
- v4l2_device_unregister(&vpif_obj.v4l2_dev);
return err;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 30/62] powerpc/spufs: add CONFIG_COREDUMP dependency
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (28 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 29/62] media: davinci: vpif_capture: fix potential double free Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 31/62] USB: sisusbvga: Fix a potential UB casued by left shifting a negative value Greg Kroah-Hartman
` (32 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, kernel test robot, Arnd Bergmann,
Jeremy Kerr, Michael Ellerman, Sasha Levin
From: Arnd Bergmann <arnd@arndb.de>
[ Upstream commit b648a5132ca3237a0f1ce5d871fff342b0efcf8a ]
The kernel test robot pointed out a slightly different error message
after recent commit 5456ffdee666 ("powerpc/spufs: simplify spufs core
dumping") to spufs for a configuration that never worked:
powerpc64-linux-ld: arch/powerpc/platforms/cell/spufs/file.o: in function `.spufs_proxydma_info_dump':
>> file.c:(.text+0x4c68): undefined reference to `.dump_emit'
powerpc64-linux-ld: arch/powerpc/platforms/cell/spufs/file.o: in function `.spufs_dma_info_dump':
file.c:(.text+0x4d70): undefined reference to `.dump_emit'
powerpc64-linux-ld: arch/powerpc/platforms/cell/spufs/file.o: in function `.spufs_wbox_info_dump':
file.c:(.text+0x4df4): undefined reference to `.dump_emit'
Add a Kconfig dependency to prevent this from happening again.
Reported-by: kernel test robot <lkp@intel.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Jeremy Kerr <jk@ozlabs.org>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/20200706132302.3885935-1-arnd@arndb.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/platforms/cell/Kconfig | 1 +
1 file changed, 1 insertion(+)
diff --git a/arch/powerpc/platforms/cell/Kconfig b/arch/powerpc/platforms/cell/Kconfig
index 429fc59d2a476..9acca9c79ef62 100644
--- a/arch/powerpc/platforms/cell/Kconfig
+++ b/arch/powerpc/platforms/cell/Kconfig
@@ -50,6 +50,7 @@ config SPU_FS
tristate "SPU file system"
default m
depends on PPC_CELL
+ depends on COREDUMP
select SPU_BASE
select MEMORY_HOTPLUG
help
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 31/62] USB: sisusbvga: Fix a potential UB casued by left shifting a negative value
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (29 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 30/62] powerpc/spufs: add CONFIG_COREDUMP dependency Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 32/62] Revert "ath10k: fix DMA related firmware crashes on multiple devices" Greg Kroah-Hartman
` (31 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Changming Liu, Sasha Levin
From: Changming Liu <charley.ashbringer@gmail.com>
[ Upstream commit 2b53a19284f537168fb506f2f40d7fda40a01162 ]
The char buffer buf, receives data directly from user space,
so its content might be negative and its elements are left
shifted to form an unsigned integer.
Since left shifting a negative value is undefined behavior, thus
change the char to u8 to elimintate this UB.
Signed-off-by: Changming Liu <charley.ashbringer@gmail.com>
Link: https://lore.kernel.org/r/20200711043018.928-1-charley.ashbringer@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/usb/misc/sisusbvga/sisusb.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/usb/misc/sisusbvga/sisusb.c b/drivers/usb/misc/sisusbvga/sisusb.c
index 22da70fada5e5..971f1165dc4bb 100644
--- a/drivers/usb/misc/sisusbvga/sisusb.c
+++ b/drivers/usb/misc/sisusbvga/sisusb.c
@@ -790,7 +790,7 @@ static int sisusb_write_mem_bulk(struct sisusb_usb_data *sisusb, u32 addr,
u8 swap8, fromkern = kernbuffer ? 1 : 0;
u16 swap16;
u32 swap32, flag = (length >> 28) & 1;
- char buf[4];
+ u8 buf[4];
/* if neither kernbuffer not userbuffer are given, assume
* data in obuf
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 32/62] Revert "ath10k: fix DMA related firmware crashes on multiple devices"
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (30 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 31/62] USB: sisusbvga: Fix a potential UB casued by left shifting a negative value Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 33/62] i2c: rcar: in slave mode, clear NACK earlier Greg Kroah-Hartman
` (30 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhi Chen, Kalle Valo, Sasha Levin
From: Zhi Chen <zhichen@codeaurora.org>
[ Upstream commit a1769bb68a850508a492e3674ab1e5e479b11254 ]
This reverts commit 76d164f582150fd0259ec0fcbc485470bcd8033e.
PCIe hung issue was observed on multiple platforms. The issue was reproduced
when DUT was configured as AP and associated with 50+ STAs.
For QCA9984/QCA9888, the DMA_BURST_SIZE register controls the AXI burst size
of the RD/WR access to the HOST MEM.
0 - No split , RAW read/write transfer size from MAC is put out on bus
as burst length
1 - Split at 256 byte boundary
2,3 - Reserved
With PCIe protocol analyzer, we can see DMA Read crossing 4KB boundary when
issue happened. It broke PCIe spec and caused PCIe stuck. So revert
the default value from 0 to 1.
Tested: IPQ8064 + QCA9984 with firmware 10.4-3.10-00047
QCS404 + QCA9984 with firmware 10.4-3.9.0.2--00044
Synaptics AS370 + QCA9888 with firmware 10.4-3.9.0.2--00040
Signed-off-by: Zhi Chen <zhichen@codeaurora.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/wireless/ath/ath10k/hw.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath10k/hw.h b/drivers/net/wireless/ath/ath10k/hw.h
index 713c2bcea1782..8ec5c579d7fa8 100644
--- a/drivers/net/wireless/ath/ath10k/hw.h
+++ b/drivers/net/wireless/ath/ath10k/hw.h
@@ -429,7 +429,7 @@ enum ath10k_hw_rate_cck {
#define TARGET_10_4_TX_DBG_LOG_SIZE 1024
#define TARGET_10_4_NUM_WDS_ENTRIES 32
-#define TARGET_10_4_DMA_BURST_SIZE 0
+#define TARGET_10_4_DMA_BURST_SIZE 1
#define TARGET_10_4_MAC_AGGR_DELIM 0
#define TARGET_10_4_RX_SKIP_DEFRAG_TIMEOUT_DUP_DETECTION_CHECK 1
#define TARGET_10_4_VOW_CONFIG 0
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 33/62] i2c: rcar: in slave mode, clear NACK earlier
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (31 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 32/62] Revert "ath10k: fix DMA related firmware crashes on multiple devices" Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 34/62] jbd2: make sure jh have b_transaction set in refile/unfile_buffer Greg Kroah-Hartman
` (29 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Wolfram Sang, Wolfram Sang, Sasha Levin
From: Wolfram Sang <wsa+renesas@sang-engineering.com>
[ Upstream commit 914a7b3563b8fb92f976619bbd0fa3a4a708baae ]
Currently, a NACK in slave mode is set/cleared when SCL is held low by
the IP core right before the bit is about to be pushed out. This is too
late for clearing and then a NACK from the previous byte is still used
for the current one. Now, let's clear the NACK right after we detected
the STOP condition following the NACK.
Fixes: de20d1857dd6 ("i2c: rcar: add slave support")
Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
Signed-off-by: Wolfram Sang <wsa@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/i2c/busses/i2c-rcar.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/i2c/busses/i2c-rcar.c b/drivers/i2c/busses/i2c-rcar.c
index ddfb08a3e6c20..00b3178c36a7a 100644
--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
@@ -393,6 +393,7 @@ static bool rcar_i2c_slave_irq(struct rcar_i2c_priv *priv)
/* master sent stop */
if (ssr_filtered & SSR) {
i2c_slave_event(priv->slave, I2C_SLAVE_STOP, &value);
+ rcar_i2c_write(priv, ICSCR, SIE | SDBS); /* clear our NACK */
rcar_i2c_write(priv, ICSIER, SAR);
rcar_i2c_write(priv, ICSSR, ~SSR & 0xff);
}
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 34/62] jbd2: make sure jh have b_transaction set in refile/unfile_buffer
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (32 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 33/62] i2c: rcar: in slave mode, clear NACK earlier Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 35/62] jbd2: abort journal if free a async write error metadata buffer Greg Kroah-Hartman
` (28 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Lukas Czerner, Jan Kara,
Theodore Tso, Sasha Levin
From: Lukas Czerner <lczerner@redhat.com>
[ Upstream commit 24dc9864914eb5813173cfa53313fcd02e4aea7d ]
Callers of __jbd2_journal_unfile_buffer() and
__jbd2_journal_refile_buffer() assume that the b_transaction is set. In
fact if it's not, we can end up with journal_head refcounting errors
leading to crash much later that might be very hard to track down. Add
asserts to make sure that is the case.
We also make sure that b_next_transaction is NULL in
__jbd2_journal_unfile_buffer() since the callers expect that as well and
we should not get into that stage in this state anyway, leading to
problems later on if we do.
Tested with fstests.
Signed-off-by: Lukas Czerner <lczerner@redhat.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Link: https://lore.kernel.org/r/20200617092549.6712-1-lczerner@redhat.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jbd2/transaction.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 3233e5ac9774f..622610934c9ad 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -1906,6 +1906,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh)
*/
static void __jbd2_journal_unfile_buffer(struct journal_head *jh)
{
+ J_ASSERT_JH(jh, jh->b_transaction != NULL);
+ J_ASSERT_JH(jh, jh->b_next_transaction == NULL);
+
__jbd2_journal_temp_unlink_buffer(jh);
jh->b_transaction = NULL;
jbd2_journal_put_journal_head(jh);
@@ -2453,6 +2456,13 @@ void __jbd2_journal_refile_buffer(struct journal_head *jh)
was_dirty = test_clear_buffer_jbddirty(bh);
__jbd2_journal_temp_unlink_buffer(jh);
+
+ /*
+ * b_transaction must be set, otherwise the new b_transaction won't
+ * be holding jh reference
+ */
+ J_ASSERT_JH(jh, jh->b_transaction != NULL);
+
/*
* We set b_transaction here because b_next_transaction will inherit
* our jh reference and thus __jbd2_journal_file_buffer() must not
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 35/62] jbd2: abort journal if free a async write error metadata buffer
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (33 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 34/62] jbd2: make sure jh have b_transaction set in refile/unfile_buffer Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 36/62] s390/cio: add cond_resched() in the slow_eval_known_fn() loop Greg Kroah-Hartman
` (27 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, zhangyi (F), Theodore Tso, Sasha Levin
From: zhangyi (F) <yi.zhang@huawei.com>
[ Upstream commit c044f3d8360d2ecf831ba2cc9f08cf9fb2c699fb ]
If we free a metadata buffer which has been failed to async write out
in the background, the jbd2 checkpoint procedure will not detect this
failure in jbd2_log_do_checkpoint(), so it may lead to filesystem
inconsistency after cleanup journal tail. This patch abort the journal
if free a buffer has write_io_error flag to prevent potential further
inconsistency.
Signed-off-by: zhangyi (F) <yi.zhang@huawei.com>
Link: https://lore.kernel.org/r/20200620025427.1756360-5-yi.zhang@huawei.com
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/jbd2/transaction.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
index 622610934c9ad..ce2bf9d74224c 100644
--- a/fs/jbd2/transaction.c
+++ b/fs/jbd2/transaction.c
@@ -2000,6 +2000,7 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal,
{
struct buffer_head *head;
struct buffer_head *bh;
+ bool has_write_io_error = false;
int ret = 0;
J_ASSERT(PageLocked(page));
@@ -2024,11 +2025,26 @@ int jbd2_journal_try_to_free_buffers(journal_t *journal,
jbd_unlock_bh_state(bh);
if (buffer_jbd(bh))
goto busy;
+
+ /*
+ * If we free a metadata buffer which has been failed to
+ * write out, the jbd2 checkpoint procedure will not detect
+ * this failure and may lead to filesystem inconsistency
+ * after cleanup journal tail.
+ */
+ if (buffer_write_io_error(bh)) {
+ pr_err("JBD2: Error while async write back metadata bh %llu.",
+ (unsigned long long)bh->b_blocknr);
+ has_write_io_error = true;
+ }
} while ((bh = bh->b_this_page) != head);
ret = try_to_free_buffers(page);
busy:
+ if (has_write_io_error)
+ jbd2_journal_abort(journal, -EIO);
+
return ret;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 36/62] s390/cio: add cond_resched() in the slow_eval_known_fn() loop
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (34 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 35/62] jbd2: abort journal if free a async write error metadata buffer Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 37/62] scsi: ufs: Fix possible infinite loop in ufshcd_hold Greg Kroah-Hartman
` (26 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Peter Oberparleiter, Vineeth Vijayan,
Heiko Carstens, Sasha Levin
From: Vineeth Vijayan <vneethv@linux.ibm.com>
[ Upstream commit 0b8eb2ee9da1e8c9b8082f404f3948aa82a057b2 ]
The scanning through subchannels during the time of an event could
take significant amount of time in case of platforms with lots of
known subchannels. This might result in higher scheduling latencies
for other tasks especially on systems with a single CPU. Add
cond_resched() call, as the loop in slow_eval_known_fn() can be
executed for a longer duration.
Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
Signed-off-by: Vineeth Vijayan <vneethv@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/s390/cio/css.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/s390/cio/css.c b/drivers/s390/cio/css.c
index 8ecc956ecb59c..370a3a2c6de73 100644
--- a/drivers/s390/cio/css.c
+++ b/drivers/s390/cio/css.c
@@ -529,6 +529,11 @@ static int slow_eval_known_fn(struct subchannel *sch, void *data)
rc = css_evaluate_known_subchannel(sch, 1);
if (rc == -EAGAIN)
css_schedule_eval(sch->schid);
+ /*
+ * The loop might take long time for platforms with lots of
+ * known devices. Allow scheduling here.
+ */
+ cond_resched();
}
return 0;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 37/62] scsi: ufs: Fix possible infinite loop in ufshcd_hold
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (35 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 36/62] s390/cio: add cond_resched() in the slow_eval_known_fn() loop Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 38/62] net: gianfar: Add of_node_put() before goto statement Greg Kroah-Hartman
` (25 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Avri Altman, Andy Teng, Stanley Chu,
Martin K. Petersen, Sasha Levin
From: Stanley Chu <stanley.chu@mediatek.com>
[ Upstream commit 93b6c5db06028a3b55122bbb74d0715dd8ca4ae0 ]
In ufshcd_suspend(), after clk-gating is suspended and link is set
as Hibern8 state, ufshcd_hold() is still possibly invoked before
ufshcd_suspend() returns. For example, MediaTek's suspend vops may
issue UIC commands which would call ufshcd_hold() during the command
issuing flow.
Now if UFSHCD_CAP_HIBERN8_WITH_CLK_GATING capability is enabled,
then ufshcd_hold() may enter infinite loops because there is no
clk-ungating work scheduled or pending. In this case, ufshcd_hold()
shall just bypass, and keep the link as Hibern8 state.
Link: https://lore.kernel.org/r/20200809050734.18740-1-stanley.chu@mediatek.com
Reviewed-by: Avri Altman <avri.altman@wdc.com>
Co-developed-by: Andy Teng <andy.teng@mediatek.com>
Signed-off-by: Andy Teng <andy.teng@mediatek.com>
Signed-off-by: Stanley Chu <stanley.chu@mediatek.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/scsi/ufs/ufshcd.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index d15cd7a02f9b4..d7a0a64f64536 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c
@@ -575,6 +575,7 @@ unblock_reqs:
int ufshcd_hold(struct ufs_hba *hba, bool async)
{
int rc = 0;
+ bool flush_result;
unsigned long flags;
if (!ufshcd_is_clkgating_allowed(hba))
@@ -601,7 +602,9 @@ start:
break;
}
spin_unlock_irqrestore(hba->host->host_lock, flags);
- flush_work(&hba->clk_gating.ungate_work);
+ flush_result = flush_work(&hba->clk_gating.ungate_work);
+ if (hba->clk_gating.is_suspended && !flush_result)
+ goto out;
spin_lock_irqsave(hba->host->host_lock, flags);
goto start;
}
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 38/62] net: gianfar: Add of_node_put() before goto statement
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (36 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 37/62] scsi: ufs: Fix possible infinite loop in ufshcd_hold Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 39/62] powerpc/perf: Fix soft lockups due to missed interrupt accounting Greg Kroah-Hartman
` (24 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sumera Priyadarsini, David S. Miller,
Sasha Levin
From: Sumera Priyadarsini <sylphrenadin@gmail.com>
[ Upstream commit 989e4da042ca4a56bbaca9223d1a93639ad11e17 ]
Every iteration of for_each_available_child_of_node() decrements
reference count of the previous node, however when control
is transferred from the middle of the loop, as in the case of
a return or break or goto, there is no decrement thus ultimately
resulting in a memory leak.
Fix a potential memory leak in gianfar.c by inserting of_node_put()
before the goto statement.
Issue found with Coccinelle.
Signed-off-by: Sumera Priyadarsini <sylphrenadin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/ethernet/freescale/gianfar.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index 37cc1f838dd8b..96310e2ee5458 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -845,8 +845,10 @@ static int gfar_of_init(struct platform_device *ofdev, struct net_device **pdev)
continue;
err = gfar_parse_group(child, priv, model);
- if (err)
+ if (err) {
+ of_node_put(child);
goto err_grp_init;
+ }
}
} else { /* SQ_SG_MODE */
err = gfar_parse_group(np, priv, model);
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 39/62] powerpc/perf: Fix soft lockups due to missed interrupt accounting
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (37 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 38/62] net: gianfar: Add of_node_put() before goto statement Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 40/62] fbcon: prevent user font height or width change from causing potential out-of-bounds access Greg Kroah-Hartman
` (23 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alexey Kardashevskiy, Athira Rajeev,
Michael Ellerman, Sasha Levin
From: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
[ Upstream commit 17899eaf88d689529b866371344c8f269ba79b5f ]
Performance monitor interrupt handler checks if any counter has
overflown and calls record_and_restart() in core-book3s which invokes
perf_event_overflow() to record the sample information. Apart from
creating sample, perf_event_overflow() also does the interrupt and
period checks via perf_event_account_interrupt().
Currently we record information only if the SIAR (Sampled Instruction
Address Register) valid bit is set (using siar_valid() check) and
hence the interrupt check.
But it is possible that we do sampling for some events that are not
generating valid SIAR, and hence there is no chance to disable the
event if interrupts are more than max_samples_per_tick. This leads to
soft lockup.
Fix this by adding perf_event_account_interrupt() in the invalid SIAR
code path for a sampling event. ie if SIAR is invalid, just do
interrupt check and don't record the sample information.
Reported-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
Link: https://lore.kernel.org/r/1596717992-7321-1-git-send-email-atrajeev@linux.vnet.ibm.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
arch/powerpc/perf/core-book3s.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -2040,6 +2040,10 @@ static void record_and_restart(struct pe
if (perf_event_overflow(event, &data, regs))
power_pmu_stop(event, 0);
+ } else if (period) {
+ /* Account for interrupt in case of invalid SIAR */
+ if (perf_event_account_interrupt(event))
+ power_pmu_stop(event, 0);
}
}
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 40/62] fbcon: prevent user font height or width change from causing potential out-of-bounds access
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (38 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 39/62] powerpc/perf: Fix soft lockups due to missed interrupt accounting Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 41/62] USB: lvtest: return proper error code in probe Greg Kroah-Hartman
` (22 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, George Kennedy, syzbot+38a3699c7eaf165b97a6
From: George Kennedy <george.kennedy@oracle.com>
commit 39b3cffb8cf3111738ea993e2757ab382253d86a upstream.
Add a check to fbcon_resize() to ensure that a possible change to user font
height or user font width will not allow a font data out-of-bounds access.
NOTE: must use original charcount in calculation as font charcount can
change and cannot be used to determine the font data allocated size.
Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Cc: stable <stable@vger.kernel.org>
Reported-by: syzbot+38a3699c7eaf165b97a6@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/1596213192-6635-1-git-send-email-george.kennedy@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/video/console/fbcon.c | 25 +++++++++++++++++++++++--
1 file changed, 23 insertions(+), 2 deletions(-)
--- a/drivers/video/console/fbcon.c
+++ b/drivers/video/console/fbcon.c
@@ -2117,6 +2117,9 @@ static void updatescrollmode(struct disp
}
}
+#define PITCH(w) (((w) + 7) >> 3)
+#define CALC_FONTSZ(h, p, c) ((h) * (p) * (c)) /* size = height * pitch * charcount */
+
static int fbcon_resize(struct vc_data *vc, unsigned int width,
unsigned int height, unsigned int user)
{
@@ -2126,6 +2129,24 @@ static int fbcon_resize(struct vc_data *
struct fb_var_screeninfo var = info->var;
int x_diff, y_diff, virt_w, virt_h, virt_fw, virt_fh;
+ if (ops->p && ops->p->userfont && FNTSIZE(vc->vc_font.data)) {
+ int size;
+ int pitch = PITCH(vc->vc_font.width);
+
+ /*
+ * If user font, ensure that a possible change to user font
+ * height or width will not allow a font data out-of-bounds access.
+ * NOTE: must use original charcount in calculation as font
+ * charcount can change and cannot be used to determine the
+ * font data allocated size.
+ */
+ if (pitch <= 0)
+ return -EINVAL;
+ size = CALC_FONTSZ(vc->vc_font.height, pitch, FNTCHARCNT(vc->vc_font.data));
+ if (size > FNTSIZE(vc->vc_font.data))
+ return -EINVAL;
+ }
+
virt_w = FBCON_SWAP(ops->rotate, width, height);
virt_h = FBCON_SWAP(ops->rotate, height, width);
virt_fw = FBCON_SWAP(ops->rotate, vc->vc_font.width,
@@ -2587,7 +2608,7 @@ static int fbcon_set_font(struct vc_data
int size;
int i, csum;
u8 *new_data, *data = font->data;
- int pitch = (font->width+7) >> 3;
+ int pitch = PITCH(font->width);
/* Is there a reason why fbconsole couldn't handle any charcount >256?
* If not this check should be changed to charcount < 256 */
@@ -2603,7 +2624,7 @@ static int fbcon_set_font(struct vc_data
if (fbcon_invalid_charcount(info, charcount))
return -EINVAL;
- size = h * pitch * charcount;
+ size = CALC_FONTSZ(h, pitch, charcount);
new_data = kmalloc(FONT_EXTRA_WORDS * sizeof(int) + size, GFP_USER);
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 41/62] USB: lvtest: return proper error code in probe
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (39 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 40/62] fbcon: prevent user font height or width change from causing potential out-of-bounds access Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 42/62] vt: defer kfree() of vc_screenbuf in vc_do_resize() Greg Kroah-Hartman
` (21 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Evgeny Novikov
From: Evgeny Novikov <novikov@ispras.ru>
commit 531412492ce93ea29b9ca3b4eb5e3ed771f851dd upstream.
lvs_rh_probe() can return some nonnegative value from usb_control_msg()
when it is less than "USB_DT_HUB_NONVAR_SIZE + 2" that is considered as
a failure. Make lvs_rh_probe() return -EINVAL in this case.
Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: Evgeny Novikov <novikov@ispras.ru>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200805090643.3432-1-novikov@ispras.ru
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/lvstest.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/misc/lvstest.c
+++ b/drivers/usb/misc/lvstest.c
@@ -396,7 +396,7 @@ static int lvs_rh_probe(struct usb_inter
USB_DT_SS_HUB_SIZE, USB_CTRL_GET_TIMEOUT);
if (ret < (USB_DT_HUB_NONVAR_SIZE + 2)) {
dev_err(&hdev->dev, "wrong root hub descriptor read %d\n", ret);
- return ret;
+ return ret < 0 ? ret : -EINVAL;
}
/* submit urb to poll interrupt endpoint */
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 42/62] vt: defer kfree() of vc_screenbuf in vc_do_resize()
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (40 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 41/62] USB: lvtest: return proper error code in probe Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 43/62] vt_ioctl: change VT_RESIZEX ioctl to check for error return from vc_resize() Greg Kroah-Hartman
` (20 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, syzbot, Tetsuo Handa
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
commit f8d1653daec02315e06d30246cff4af72e76e54e upstream.
syzbot is reporting UAF bug in set_origin() from vc_do_resize() [1], for
vc_do_resize() calls kfree(vc->vc_screenbuf) before calling set_origin().
Unfortunately, in set_origin(), vc->vc_sw->con_set_origin() might access
vc->vc_pos when scroll is involved in order to manipulate cursor, but
vc->vc_pos refers already released vc->vc_screenbuf until vc->vc_pos gets
updated based on the result of vc->vc_sw->con_set_origin().
Preserving old buffer and tolerating outdated vc members until set_origin()
completes would be easier than preventing vc->vc_sw->con_set_origin() from
accessing outdated vc members.
[1] https://syzkaller.appspot.com/bug?id=6649da2081e2ebdc65c0642c214b27fe91099db3
Reported-by: syzbot <syzbot+9116ecc1978ca3a12f43@syzkaller.appspotmail.com>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/1596034621-4714-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/vt/vt.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/tty/vt/vt.c
+++ b/drivers/tty/vt/vt.c
@@ -864,7 +864,7 @@ static int vc_do_resize(struct tty_struc
unsigned int old_rows, old_row_size;
unsigned int new_cols, new_rows, new_row_size, new_screen_size;
unsigned int user;
- unsigned short *newscreen;
+ unsigned short *oldscreen, *newscreen;
WARN_CONSOLE_UNLOCKED();
@@ -946,10 +946,11 @@ static int vc_do_resize(struct tty_struc
if (new_scr_end > new_origin)
scr_memsetw((void *)new_origin, vc->vc_video_erase_char,
new_scr_end - new_origin);
- kfree(vc->vc_screenbuf);
+ oldscreen = vc->vc_screenbuf;
vc->vc_screenbuf = newscreen;
vc->vc_screenbuf_size = new_screen_size;
set_origin(vc);
+ kfree(oldscreen);
/* do part of a reset_terminal() */
vc->vc_top = 0;
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 43/62] vt_ioctl: change VT_RESIZEX ioctl to check for error return from vc_resize()
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (41 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 42/62] vt: defer kfree() of vc_screenbuf in vc_do_resize() Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 44/62] serial: samsung: Removes the IRQ not found warning Greg Kroah-Hartman
` (19 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, George Kennedy, syzbot+38a3699c7eaf165b97a6
From: George Kennedy <george.kennedy@oracle.com>
commit bc5269ca765057a1b762e79a1cfd267cd7bf1c46 upstream.
vc_resize() can return with an error after failure. Change VT_RESIZEX ioctl
to save struct vc_data values that are modified and restore the original
values in case of error.
Signed-off-by: George Kennedy <george.kennedy@oracle.com>
Cc: stable <stable@vger.kernel.org>
Reported-by: syzbot+38a3699c7eaf165b97a6@syzkaller.appspotmail.com
Link: https://lore.kernel.org/r/1596213192-6635-2-git-send-email-george.kennedy@oracle.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/vt/vt_ioctl.c | 12 +++++++++++-
1 file changed, 11 insertions(+), 1 deletion(-)
--- a/drivers/tty/vt/vt_ioctl.c
+++ b/drivers/tty/vt/vt_ioctl.c
@@ -896,12 +896,22 @@ int vt_ioctl(struct tty_struct *tty,
console_lock();
vcp = vc_cons[i].d;
if (vcp) {
+ int ret;
+ int save_scan_lines = vcp->vc_scan_lines;
+ int save_font_height = vcp->vc_font.height;
+
if (v.v_vlin)
vcp->vc_scan_lines = v.v_vlin;
if (v.v_clin)
vcp->vc_font.height = v.v_clin;
vcp->vc_resize_user = 1;
- vc_resize(vcp, v.v_cols, v.v_rows);
+ ret = vc_resize(vcp, v.v_cols, v.v_rows);
+ if (ret) {
+ vcp->vc_scan_lines = save_scan_lines;
+ vcp->vc_font.height = save_font_height;
+ console_unlock();
+ return ret;
+ }
}
console_unlock();
}
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 44/62] serial: samsung: Removes the IRQ not found warning
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (42 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 43/62] vt_ioctl: change VT_RESIZEX ioctl to check for error return from vc_resize() Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 45/62] serial: pl011: Dont leak amba_ports entry on driver register error Greg Kroah-Hartman
` (18 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alim Akhtar, Marek Szyprowski,
Krzysztof Kozlowski, Tamseel Shams
From: Tamseel Shams <m.shams@samsung.com>
commit 8c6c378b0cbe0c9f1390986b5f8ffb5f6ff7593b upstream.
In few older Samsung SoCs like s3c2410, s3c2412
and s3c2440, UART IP is having 2 interrupt lines.
However, in other SoCs like s3c6400, s5pv210,
exynos5433, and exynos4210 UART is having only 1
interrupt line. Due to this, "platform_get_irq(platdev, 1)"
call in the driver gives the following false-positive error:
"IRQ index 1 not found" on newer SoC's.
This patch adds the condition to check for Tx interrupt
only for the those SoC's which have 2 interrupt lines.
Tested-by: Alim Akhtar <alim.akhtar@samsung.com>
Tested-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Reviewed-by: Alim Akhtar <alim.akhtar@samsung.com>
Signed-off-by: Tamseel Shams <m.shams@samsung.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200810030021.45348-1-m.shams@samsung.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/samsung.c | 8 +++++---
1 file changed, 5 insertions(+), 3 deletions(-)
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -1719,9 +1719,11 @@ static int s3c24xx_serial_init_port(stru
ourport->tx_irq = ret + 1;
}
- ret = platform_get_irq(platdev, 1);
- if (ret > 0)
- ourport->tx_irq = ret;
+ if (!s3c24xx_serial_has_interrupt_mask(port)) {
+ ret = platform_get_irq(platdev, 1);
+ if (ret > 0)
+ ourport->tx_irq = ret;
+ }
/*
* DMA is currently supported only on DT platforms, if DMA properties
* are specified.
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 45/62] serial: pl011: Dont leak amba_ports entry on driver register error
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (43 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 44/62] serial: samsung: Removes the IRQ not found warning Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 46/62] serial: 8250: change lock order in serial8250_do_startup() Greg Kroah-Hartman
` (17 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Lukas Wunner, Tushar Behera
From: Lukas Wunner <lukas@wunner.de>
commit 89efbe70b27dd325d8a8c177743a26b885f7faec upstream.
pl011_probe() calls pl011_setup_port() to reserve an amba_ports[] entry,
then calls pl011_register_port() to register the uart driver with the
tty layer.
If registration of the uart driver fails, the amba_ports[] entry is not
released. If this happens 14 times (value of UART_NR macro), then all
amba_ports[] entries will have been leaked and driver probing is no
longer possible. (To be fair, that can only happen if the DeviceTree
doesn't contain alias IDs since they cause the same entry to be used for
a given port.) Fix it.
Fixes: ef2889f7ffee ("serial: pl011: Move uart_register_driver call to device")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v3.15+
Cc: Tushar Behera <tushar.behera@linaro.org>
Link: https://lore.kernel.org/r/138f8c15afb2f184d8102583f8301575566064a6.1597316167.git.lukas@wunner.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/amba-pl011.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
--- a/drivers/tty/serial/amba-pl011.c
+++ b/drivers/tty/serial/amba-pl011.c
@@ -2332,7 +2332,7 @@ static int pl011_setup_port(struct devic
static int pl011_register_port(struct uart_amba_port *uap)
{
- int ret;
+ int ret, i;
/* Ensure interrupts from this UART are masked and cleared */
writew(0, uap->port.membase + UART011_IMSC);
@@ -2343,6 +2343,9 @@ static int pl011_register_port(struct ua
if (ret < 0) {
dev_err(uap->port.dev,
"Failed to register AMBA-PL011 driver\n");
+ for (i = 0; i < ARRAY_SIZE(amba_ports); i++)
+ if (amba_ports[i] == uap)
+ amba_ports[i] = NULL;
return ret;
}
}
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 46/62] serial: 8250: change lock order in serial8250_do_startup()
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (44 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 45/62] serial: pl011: Dont leak amba_ports entry on driver register error Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 47/62] writeback: Protect inode->i_io_list with inode->i_lock Greg Kroah-Hartman
` (16 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Sergey Senozhatsky, Guenter Roeck,
Raul Rangel, Andy Shevchenko
From: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
commit 205d300aea75623e1ae4aa43e0d265ab9cf195fd upstream.
We have a number of "uart.port->desc.lock vs desc.lock->uart.port"
lockdep reports coming from 8250 driver; this causes a bit of trouble
to people, so let's fix it.
The problem is reverse lock order in two different call paths:
chain #1:
serial8250_do_startup()
spin_lock_irqsave(&port->lock);
disable_irq_nosync(port->irq);
raw_spin_lock_irqsave(&desc->lock)
chain #2:
__report_bad_irq()
raw_spin_lock_irqsave(&desc->lock)
for_each_action_of_desc()
printk()
spin_lock_irqsave(&port->lock);
Fix this by changing the order of locks in serial8250_do_startup():
do disable_irq_nosync() first, which grabs desc->lock, and grab
uart->port after that, so that chain #1 and chain #2 have same lock
order.
Full lockdep splat:
======================================================
WARNING: possible circular locking dependency detected
5.4.39 #55 Not tainted
======================================================
swapper/0/0 is trying to acquire lock:
ffffffffab65b6c0 (console_owner){-...}, at: console_lock_spinning_enable+0x31/0x57
but task is already holding lock:
ffff88810a8e34c0 (&irq_desc_lock_class){-.-.}, at: __report_bad_irq+0x5b/0xba
which lock already depends on the new lock.
the existing dependency chain (in reverse order) is:
-> #2 (&irq_desc_lock_class){-.-.}:
_raw_spin_lock_irqsave+0x61/0x8d
__irq_get_desc_lock+0x65/0x89
__disable_irq_nosync+0x3b/0x93
serial8250_do_startup+0x451/0x75c
uart_startup+0x1b4/0x2ff
uart_port_activate+0x73/0xa0
tty_port_open+0xae/0x10a
uart_open+0x1b/0x26
tty_open+0x24d/0x3a0
chrdev_open+0xd5/0x1cc
do_dentry_open+0x299/0x3c8
path_openat+0x434/0x1100
do_filp_open+0x9b/0x10a
do_sys_open+0x15f/0x3d7
kernel_init_freeable+0x157/0x1dd
kernel_init+0xe/0x105
ret_from_fork+0x27/0x50
-> #1 (&port_lock_key){-.-.}:
_raw_spin_lock_irqsave+0x61/0x8d
serial8250_console_write+0xa7/0x2a0
console_unlock+0x3b7/0x528
vprintk_emit+0x111/0x17f
printk+0x59/0x73
register_console+0x336/0x3a4
uart_add_one_port+0x51b/0x5be
serial8250_register_8250_port+0x454/0x55e
dw8250_probe+0x4dc/0x5b9
platform_drv_probe+0x67/0x8b
really_probe+0x14a/0x422
driver_probe_device+0x66/0x130
device_driver_attach+0x42/0x5b
__driver_attach+0xca/0x139
bus_for_each_dev+0x97/0xc9
bus_add_driver+0x12b/0x228
driver_register+0x64/0xed
do_one_initcall+0x20c/0x4a6
do_initcall_level+0xb5/0xc5
do_basic_setup+0x4c/0x58
kernel_init_freeable+0x13f/0x1dd
kernel_init+0xe/0x105
ret_from_fork+0x27/0x50
-> #0 (console_owner){-...}:
__lock_acquire+0x118d/0x2714
lock_acquire+0x203/0x258
console_lock_spinning_enable+0x51/0x57
console_unlock+0x25d/0x528
vprintk_emit+0x111/0x17f
printk+0x59/0x73
__report_bad_irq+0xa3/0xba
note_interrupt+0x19a/0x1d6
handle_irq_event_percpu+0x57/0x79
handle_irq_event+0x36/0x55
handle_fasteoi_irq+0xc2/0x18a
do_IRQ+0xb3/0x157
ret_from_intr+0x0/0x1d
cpuidle_enter_state+0x12f/0x1fd
cpuidle_enter+0x2e/0x3d
do_idle+0x1ce/0x2ce
cpu_startup_entry+0x1d/0x1f
start_kernel+0x406/0x46a
secondary_startup_64+0xa4/0xb0
other info that might help us debug this:
Chain exists of:
console_owner --> &port_lock_key --> &irq_desc_lock_class
Possible unsafe locking scenario:
CPU0 CPU1
---- ----
lock(&irq_desc_lock_class);
lock(&port_lock_key);
lock(&irq_desc_lock_class);
lock(console_owner);
*** DEADLOCK ***
2 locks held by swapper/0/0:
#0: ffff88810a8e34c0 (&irq_desc_lock_class){-.-.}, at: __report_bad_irq+0x5b/0xba
#1: ffffffffab65b5c0 (console_lock){+.+.}, at: console_trylock_spinning+0x20/0x181
stack backtrace:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.4.39 #55
Hardware name: XXXXXX
Call Trace:
<IRQ>
dump_stack+0xbf/0x133
? print_circular_bug+0xd6/0xe9
check_noncircular+0x1b9/0x1c3
__lock_acquire+0x118d/0x2714
lock_acquire+0x203/0x258
? console_lock_spinning_enable+0x31/0x57
console_lock_spinning_enable+0x51/0x57
? console_lock_spinning_enable+0x31/0x57
console_unlock+0x25d/0x528
? console_trylock+0x18/0x4e
vprintk_emit+0x111/0x17f
? lock_acquire+0x203/0x258
printk+0x59/0x73
__report_bad_irq+0xa3/0xba
note_interrupt+0x19a/0x1d6
handle_irq_event_percpu+0x57/0x79
handle_irq_event+0x36/0x55
handle_fasteoi_irq+0xc2/0x18a
do_IRQ+0xb3/0x157
common_interrupt+0xf/0xf
</IRQ>
Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Fixes: 768aec0b5bcc ("serial: 8250: fix shared interrupts issues with SMP and RT kernels")
Reported-by: Guenter Roeck <linux@roeck-us.net>
Reported-by: Raul Rangel <rrangel@google.com>
BugLink: https://bugs.chromium.org/p/chromium/issues/detail?id=1114800
Link: https://lore.kernel.org/lkml/CAHQZ30BnfX+gxjPm1DUd5psOTqbyDh4EJE=2=VAMW_VDafctkA@mail.gmail.com/T/#u
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200817022646.1484638-1-sergey.senozhatsky@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/tty/serial/8250/8250_port.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
--- a/drivers/tty/serial/8250/8250_port.c
+++ b/drivers/tty/serial/8250/8250_port.c
@@ -1902,6 +1902,10 @@ int serial8250_do_startup(struct uart_po
if (port->irq) {
unsigned char iir1;
+
+ if (port->irqflags & IRQF_SHARED)
+ disable_irq_nosync(port->irq);
+
/*
* Test for UARTs that do not reassert THRE when the
* transmitter is idle and the interrupt has already
@@ -1911,8 +1915,6 @@ int serial8250_do_startup(struct uart_po
* allow register changes to become visible.
*/
spin_lock_irqsave(&port->lock, flags);
- if (up->port.irqflags & IRQF_SHARED)
- disable_irq_nosync(port->irq);
wait_for_xmitr(up, UART_LSR_THRE);
serial_port_out_sync(port, UART_IER, UART_IER_THRI);
@@ -1924,9 +1926,10 @@ int serial8250_do_startup(struct uart_po
iir = serial_port_in(port, UART_IIR);
serial_port_out(port, UART_IER, 0);
+ spin_unlock_irqrestore(&port->lock, flags);
+
if (port->irqflags & IRQF_SHARED)
enable_irq(port->irq);
- spin_unlock_irqrestore(&port->lock, flags);
/*
* If the interrupt is not reasserted, or we otherwise
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 47/62] writeback: Protect inode->i_io_list with inode->i_lock
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (45 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 46/62] serial: 8250: change lock order in serial8250_do_startup() Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 48/62] writeback: Avoid skipping inode writeback Greg Kroah-Hartman
` (15 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Martijn Coenen, Christoph Hellwig, Jan Kara
From: Jan Kara <jack@suse.cz>
commit b35250c0816c7cf7d0a8de92f5fafb6a7508a708 upstream.
Currently, operations on inode->i_io_list are protected by
wb->list_lock. In the following patches we'll need to maintain
consistency between inode->i_state and inode->i_io_list so change the
code so that inode->i_lock protects also all inode's i_io_list handling.
Reviewed-by: Martijn Coenen <maco@android.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
CC: stable@vger.kernel.org # Prerequisite for "writeback: Avoid skipping inode writeback"
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fs-writeback.c | 22 +++++++++++++++++-----
1 file changed, 17 insertions(+), 5 deletions(-)
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -160,6 +160,7 @@ static void inode_io_list_del_locked(str
struct bdi_writeback *wb)
{
assert_spin_locked(&wb->list_lock);
+ assert_spin_locked(&inode->i_lock);
list_del_init(&inode->i_io_list);
wb_io_lists_depopulated(wb);
@@ -1034,7 +1035,9 @@ void inode_io_list_del(struct inode *ino
struct bdi_writeback *wb;
wb = inode_to_wb_and_lock_list(inode);
+ spin_lock(&inode->i_lock);
inode_io_list_del_locked(inode, wb);
+ spin_unlock(&inode->i_lock);
spin_unlock(&wb->list_lock);
}
@@ -1047,8 +1050,10 @@ void inode_io_list_del(struct inode *ino
* the case then the inode must have been redirtied while it was being written
* out and we don't reset its dirtied_when.
*/
-static void redirty_tail(struct inode *inode, struct bdi_writeback *wb)
+static void redirty_tail_locked(struct inode *inode, struct bdi_writeback *wb)
{
+ assert_spin_locked(&inode->i_lock);
+
if (!list_empty(&wb->b_dirty)) {
struct inode *tail;
@@ -1059,6 +1064,13 @@ static void redirty_tail(struct inode *i
inode_io_list_move_locked(inode, wb, &wb->b_dirty);
}
+static void redirty_tail(struct inode *inode, struct bdi_writeback *wb)
+{
+ spin_lock(&inode->i_lock);
+ redirty_tail_locked(inode, wb);
+ spin_unlock(&inode->i_lock);
+}
+
/*
* requeue inode for re-scanning after bdi->b_io list is exhausted.
*/
@@ -1269,7 +1281,7 @@ static void requeue_inode(struct inode *
* writeback is not making progress due to locked
* buffers. Skip this inode for now.
*/
- redirty_tail(inode, wb);
+ redirty_tail_locked(inode, wb);
return;
}
@@ -1289,7 +1301,7 @@ static void requeue_inode(struct inode *
* retrying writeback of the dirty page/inode
* that cannot be performed immediately.
*/
- redirty_tail(inode, wb);
+ redirty_tail_locked(inode, wb);
}
} else if (inode->i_state & I_DIRTY) {
/*
@@ -1297,7 +1309,7 @@ static void requeue_inode(struct inode *
* such as delayed allocation during submission or metadata
* updates after data IO completion.
*/
- redirty_tail(inode, wb);
+ redirty_tail_locked(inode, wb);
} else if (inode->i_state & I_DIRTY_TIME) {
inode->dirtied_when = jiffies;
inode_io_list_move_locked(inode, wb, &wb->b_dirty_time);
@@ -1543,8 +1555,8 @@ static long writeback_sb_inodes(struct s
*/
spin_lock(&inode->i_lock);
if (inode->i_state & (I_NEW | I_FREEING | I_WILL_FREE)) {
+ redirty_tail_locked(inode, wb);
spin_unlock(&inode->i_lock);
- redirty_tail(inode, wb);
continue;
}
if ((inode->i_state & I_SYNC) && wbc.sync_mode != WB_SYNC_ALL) {
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 48/62] writeback: Avoid skipping inode writeback
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (46 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 47/62] writeback: Protect inode->i_io_list with inode->i_lock Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 49/62] writeback: Fix sync livelock due to b_dirty_time processing Greg Kroah-Hartman
` (14 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Martijn Coenen, Christoph Hellwig, Jan Kara
From: Jan Kara <jack@suse.cz>
commit 5afced3bf28100d81fb2fe7e98918632a08feaf5 upstream.
Inode's i_io_list list head is used to attach inode to several different
lists - wb->{b_dirty, b_dirty_time, b_io, b_more_io}. When flush worker
prepares a list of inodes to writeback e.g. for sync(2), it moves inodes
to b_io list. Thus it is critical for sync(2) data integrity guarantees
that inode is not requeued to any other writeback list when inode is
queued for processing by flush worker. That's the reason why
writeback_single_inode() does not touch i_io_list (unless the inode is
completely clean) and why __mark_inode_dirty() does not touch i_io_list
if I_SYNC flag is set.
However there are two flaws in the current logic:
1) When inode has only I_DIRTY_TIME set but it is already queued in b_io
list due to sync(2), concurrent __mark_inode_dirty(inode, I_DIRTY_SYNC)
can still move inode back to b_dirty list resulting in skipping
writeback of inode time stamps during sync(2).
2) When inode is on b_dirty_time list and writeback_single_inode() races
with __mark_inode_dirty() like:
writeback_single_inode() __mark_inode_dirty(inode, I_DIRTY_PAGES)
inode->i_state |= I_SYNC
__writeback_single_inode()
inode->i_state |= I_DIRTY_PAGES;
if (inode->i_state & I_SYNC)
bail
if (!(inode->i_state & I_DIRTY_ALL))
- not true so nothing done
We end up with I_DIRTY_PAGES inode on b_dirty_time list and thus
standard background writeback will not writeback this inode leading to
possible dirty throttling stalls etc. (thanks to Martijn Coenen for this
analysis).
Fix these problems by tracking whether inode is queued in b_io or
b_more_io lists in a new I_SYNC_QUEUED flag. When this flag is set, we
know flush worker has queued inode and we should not touch i_io_list.
On the other hand we also know that once flush worker is done with the
inode it will requeue the inode to appropriate dirty list. When
I_SYNC_QUEUED is not set, __mark_inode_dirty() can (and must) move inode
to appropriate dirty list.
Reported-by: Martijn Coenen <maco@android.com>
Reviewed-by: Martijn Coenen <maco@android.com>
Tested-by: Martijn Coenen <maco@android.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Fixes: 0ae45f63d4ef ("vfs: add support for a lazytime mount option")
CC: stable@vger.kernel.org
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fs-writeback.c | 17 ++++++++++++-----
include/linux/fs.h | 8 ++++++--
2 files changed, 18 insertions(+), 7 deletions(-)
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -162,6 +162,7 @@ static void inode_io_list_del_locked(str
assert_spin_locked(&wb->list_lock);
assert_spin_locked(&inode->i_lock);
+ inode->i_state &= ~I_SYNC_QUEUED;
list_del_init(&inode->i_io_list);
wb_io_lists_depopulated(wb);
}
@@ -1062,6 +1063,7 @@ static void redirty_tail_locked(struct i
inode->dirtied_when = jiffies;
}
inode_io_list_move_locked(inode, wb, &wb->b_dirty);
+ inode->i_state &= ~I_SYNC_QUEUED;
}
static void redirty_tail(struct inode *inode, struct bdi_writeback *wb)
@@ -1137,8 +1139,11 @@ static int move_expired_inodes(struct li
break;
list_move(&inode->i_io_list, &tmp);
moved++;
+ spin_lock(&inode->i_lock);
if (flags & EXPIRE_DIRTY_ATIME)
- set_bit(__I_DIRTY_TIME_EXPIRED, &inode->i_state);
+ inode->i_state |= I_DIRTY_TIME_EXPIRED;
+ inode->i_state |= I_SYNC_QUEUED;
+ spin_unlock(&inode->i_lock);
if (sb_is_blkdev_sb(inode->i_sb))
continue;
if (sb && sb != inode->i_sb)
@@ -1313,6 +1318,7 @@ static void requeue_inode(struct inode *
} else if (inode->i_state & I_DIRTY_TIME) {
inode->dirtied_when = jiffies;
inode_io_list_move_locked(inode, wb, &wb->b_dirty_time);
+ inode->i_state &= ~I_SYNC_QUEUED;
} else {
/* The inode is clean. Remove from writeback lists. */
inode_io_list_del_locked(inode, wb);
@@ -2140,11 +2146,12 @@ void __mark_inode_dirty(struct inode *in
inode->i_state |= flags;
/*
- * If the inode is being synced, just update its dirty state.
- * The unlocker will place the inode on the appropriate
- * superblock list, based upon its state.
+ * If the inode is queued for writeback by flush worker, just
+ * update its dirty state. Once the flush worker is done with
+ * the inode it will place it on the appropriate superblock
+ * list, based upon its state.
*/
- if (inode->i_state & I_SYNC)
+ if (inode->i_state & I_SYNC_QUEUED)
goto out_unlock_inode;
/*
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -1882,6 +1882,10 @@ struct super_operations {
* wb stat updates to grab mapping->tree_lock. See
* inode_switch_wb_work_fn() for details.
*
+ * I_SYNC_QUEUED Inode is queued in b_io or b_more_io writeback lists.
+ * Used to detect that mark_inode_dirty() should not move
+ * inode between dirty lists.
+ *
* Q: What is the difference between I_WILL_FREE and I_FREEING?
*/
#define I_DIRTY_SYNC (1 << 0)
@@ -1899,9 +1903,9 @@ struct super_operations {
#define I_DIO_WAKEUP (1 << __I_DIO_WAKEUP)
#define I_LINKABLE (1 << 10)
#define I_DIRTY_TIME (1 << 11)
-#define __I_DIRTY_TIME_EXPIRED 12
-#define I_DIRTY_TIME_EXPIRED (1 << __I_DIRTY_TIME_EXPIRED)
+#define I_DIRTY_TIME_EXPIRED (1 << 12)
#define I_WB_SWITCH (1 << 13)
+#define I_SYNC_QUEUED (1 << 17)
#define I_DIRTY (I_DIRTY_SYNC | I_DIRTY_DATASYNC | I_DIRTY_PAGES)
#define I_DIRTY_ALL (I_DIRTY | I_DIRTY_TIME)
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 49/62] writeback: Fix sync livelock due to b_dirty_time processing
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (47 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 48/62] writeback: Avoid skipping inode writeback Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 50/62] XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information Greg Kroah-Hartman
` (13 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Christoph Hellwig, Jan Kara
From: Jan Kara <jack@suse.cz>
commit f9cae926f35e8230330f28c7b743ad088611a8de upstream.
When we are processing writeback for sync(2), move_expired_inodes()
didn't set any inode expiry value (older_than_this). This can result in
writeback never completing if there's steady stream of inodes added to
b_dirty_time list as writeback rechecks dirty lists after each writeback
round whether there's more work to be done. Fix the problem by using
sync(2) start time is inode expiry value when processing b_dirty_time
list similarly as for ordinarily dirtied inodes. This requires some
refactoring of older_than_this handling which simplifies the code
noticeably as a bonus.
Fixes: 0ae45f63d4ef ("vfs: add support for a lazytime mount option")
CC: stable@vger.kernel.org
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jan Kara <jack@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
fs/fs-writeback.c | 44 +++++++++++++++------------------------
include/trace/events/writeback.h | 13 +++++------
2 files changed, 23 insertions(+), 34 deletions(-)
--- a/fs/fs-writeback.c
+++ b/fs/fs-writeback.c
@@ -45,7 +45,6 @@ struct wb_completion {
struct wb_writeback_work {
long nr_pages;
struct super_block *sb;
- unsigned long *older_than_this;
enum writeback_sync_modes sync_mode;
unsigned int tagged_writepages:1;
unsigned int for_kupdate:1;
@@ -1109,16 +1108,13 @@ static bool inode_dirtied_after(struct i
#define EXPIRE_DIRTY_ATIME 0x0001
/*
- * Move expired (dirtied before work->older_than_this) dirty inodes from
+ * Move expired (dirtied before dirtied_before) dirty inodes from
* @delaying_queue to @dispatch_queue.
*/
static int move_expired_inodes(struct list_head *delaying_queue,
struct list_head *dispatch_queue,
- int flags,
- struct wb_writeback_work *work)
+ int flags, unsigned long dirtied_before)
{
- unsigned long *older_than_this = NULL;
- unsigned long expire_time;
LIST_HEAD(tmp);
struct list_head *pos, *node;
struct super_block *sb = NULL;
@@ -1126,16 +1122,9 @@ static int move_expired_inodes(struct li
int do_sb_sort = 0;
int moved = 0;
- if ((flags & EXPIRE_DIRTY_ATIME) == 0)
- older_than_this = work->older_than_this;
- else if (!work->for_sync) {
- expire_time = jiffies - (dirtytime_expire_interval * HZ);
- older_than_this = &expire_time;
- }
while (!list_empty(delaying_queue)) {
inode = wb_inode(delaying_queue->prev);
- if (older_than_this &&
- inode_dirtied_after(inode, *older_than_this))
+ if (inode_dirtied_after(inode, dirtied_before))
break;
list_move(&inode->i_io_list, &tmp);
moved++;
@@ -1181,18 +1170,22 @@ out:
* |
* +--> dequeue for IO
*/
-static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work)
+static void queue_io(struct bdi_writeback *wb, struct wb_writeback_work *work,
+ unsigned long dirtied_before)
{
int moved;
+ unsigned long time_expire_jif = dirtied_before;
assert_spin_locked(&wb->list_lock);
list_splice_init(&wb->b_more_io, &wb->b_io);
- moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, work);
+ moved = move_expired_inodes(&wb->b_dirty, &wb->b_io, 0, dirtied_before);
+ if (!work->for_sync)
+ time_expire_jif = jiffies - dirtytime_expire_interval * HZ;
moved += move_expired_inodes(&wb->b_dirty_time, &wb->b_io,
- EXPIRE_DIRTY_ATIME, work);
+ EXPIRE_DIRTY_ATIME, time_expire_jif);
if (moved)
wb_io_lists_populated(wb);
- trace_writeback_queue_io(wb, work, moved);
+ trace_writeback_queue_io(wb, work, dirtied_before, moved);
}
static int write_inode(struct inode *inode, struct writeback_control *wbc)
@@ -1703,7 +1696,7 @@ static long writeback_inodes_wb(struct b
blk_start_plug(&plug);
spin_lock(&wb->list_lock);
if (list_empty(&wb->b_io))
- queue_io(wb, &work);
+ queue_io(wb, &work, jiffies);
__writeback_inodes_wb(wb, &work);
spin_unlock(&wb->list_lock);
blk_finish_plug(&plug);
@@ -1723,7 +1716,7 @@ static long writeback_inodes_wb(struct b
* takes longer than a dirty_writeback_interval interval, then leave a
* one-second gap.
*
- * older_than_this takes precedence over nr_to_write. So we'll only write back
+ * dirtied_before takes precedence over nr_to_write. So we'll only write back
* all dirty pages if they are all attached to "old" mappings.
*/
static long wb_writeback(struct bdi_writeback *wb,
@@ -1731,14 +1724,11 @@ static long wb_writeback(struct bdi_writ
{
unsigned long wb_start = jiffies;
long nr_pages = work->nr_pages;
- unsigned long oldest_jif;
+ unsigned long dirtied_before = jiffies;
struct inode *inode;
long progress;
struct blk_plug plug;
- oldest_jif = jiffies;
- work->older_than_this = &oldest_jif;
-
blk_start_plug(&plug);
spin_lock(&wb->list_lock);
for (;;) {
@@ -1772,14 +1762,14 @@ static long wb_writeback(struct bdi_writ
* safe.
*/
if (work->for_kupdate) {
- oldest_jif = jiffies -
+ dirtied_before = jiffies -
msecs_to_jiffies(dirty_expire_interval * 10);
} else if (work->for_background)
- oldest_jif = jiffies;
+ dirtied_before = jiffies;
trace_writeback_start(wb, work);
if (list_empty(&wb->b_io))
- queue_io(wb, work);
+ queue_io(wb, work, dirtied_before);
if (work->sb)
progress = writeback_sb_inodes(work->sb, wb, work);
else
--- a/include/trace/events/writeback.h
+++ b/include/trace/events/writeback.h
@@ -390,8 +390,9 @@ DEFINE_WBC_EVENT(wbc_writepage);
TRACE_EVENT(writeback_queue_io,
TP_PROTO(struct bdi_writeback *wb,
struct wb_writeback_work *work,
+ unsigned long dirtied_before,
int moved),
- TP_ARGS(wb, work, moved),
+ TP_ARGS(wb, work, dirtied_before, moved),
TP_STRUCT__entry(
__array(char, name, 32)
__field(unsigned long, older)
@@ -401,19 +402,17 @@ TRACE_EVENT(writeback_queue_io,
__dynamic_array(char, cgroup, __trace_wb_cgroup_size(wb))
),
TP_fast_assign(
- unsigned long *older_than_this = work->older_than_this;
strncpy(__entry->name, dev_name(wb->bdi->dev), 32);
- __entry->older = older_than_this ? *older_than_this : 0;
- __entry->age = older_than_this ?
- (jiffies - *older_than_this) * 1000 / HZ : -1;
+ __entry->older = dirtied_before;
+ __entry->age = (jiffies - dirtied_before) * 1000 / HZ;
__entry->moved = moved;
__entry->reason = work->reason;
__trace_wb_assign_cgroup(__get_str(cgroup), wb);
),
TP_printk("bdi %s: older=%lu age=%ld enqueue=%d reason=%s cgroup=%s",
__entry->name,
- __entry->older, /* older_than_this in jiffies */
- __entry->age, /* older_than_this in relative milliseconds */
+ __entry->older, /* dirtied_before in jiffies */
+ __entry->age, /* dirtied_before in relative milliseconds */
__entry->moved,
__print_symbolic(__entry->reason, WB_WORK_REASON),
__get_str(cgroup)
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 50/62] XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (48 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 49/62] writeback: Fix sync livelock due to b_dirty_time processing Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-29 13:13 ` Stefan Bader
2020-09-01 15:10 ` [PATCH 4.4 51/62] xhci: Do warm-reset when both CAS and XDEV_RESUME are set Greg Kroah-Hartman
` (12 subsequent siblings)
62 siblings, 1 reply; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Roman Shaposhnik, Thomas Gleixner,
Juergen Gross
From: Thomas Gleixner <tglx@linutronix.de>
commit c330fb1ddc0a922f044989492b7fcca77ee1db46 upstream.
handler data is meant for interrupt handlers and not for storing irq chip
specific information as some devices require handler data to store internal
per interrupt information, e.g. pinctrl/GPIO chained interrupt handlers.
This obviously creates a conflict of interests and crashes the machine
because the XEN pointer is overwritten by the driver pointer.
As the XEN data is not handler specific it should be stored in
irqdesc::irq_data::chip_data instead.
A simple sed s/irq_[sg]et_handler_data/irq_[sg]et_chip_data/ cures that.
Cc: stable@vger.kernel.org
Reported-by: Roman Shaposhnik <roman@zededa.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Tested-by: Roman Shaposhnik <roman@zededa.com>
Reviewed-by: Juergen Gross <jgross@suse.com>
Link: https://lore.kernel.org/r/87lfi2yckt.fsf@nanos.tec.linutronix.de
Signed-off-by: Juergen Gross <jgross@suse.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/xen/events/events_base.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -155,7 +155,7 @@ int get_evtchn_to_irq(unsigned evtchn)
/* Get info for IRQ */
struct irq_info *info_for_irq(unsigned irq)
{
- return irq_get_handler_data(irq);
+ return irq_get_chip_data(irq);
}
/* Constructors for packed IRQ information. */
@@ -384,7 +384,7 @@ static void xen_irq_init(unsigned irq)
info->type = IRQT_UNBOUND;
info->refcnt = -1;
- irq_set_handler_data(irq, info);
+ irq_set_chip_data(irq, info);
list_add_tail(&info->list, &xen_irq_list_head);
}
@@ -433,14 +433,14 @@ static int __must_check xen_allocate_irq
static void xen_free_irq(unsigned irq)
{
- struct irq_info *info = irq_get_handler_data(irq);
+ struct irq_info *info = irq_get_chip_data(irq);
if (WARN_ON(!info))
return;
list_del(&info->list);
- irq_set_handler_data(irq, NULL);
+ irq_set_chip_data(irq, NULL);
WARN_ON(info->refcnt > 0);
@@ -610,7 +610,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi);
static void __unbind_from_irq(unsigned int irq)
{
int evtchn = evtchn_from_irq(irq);
- struct irq_info *info = irq_get_handler_data(irq);
+ struct irq_info *info = irq_get_chip_data(irq);
if (info->refcnt > 0) {
info->refcnt--;
@@ -1114,7 +1114,7 @@ int bind_ipi_to_irqhandler(enum ipi_vect
void unbind_from_irqhandler(unsigned int irq, void *dev_id)
{
- struct irq_info *info = irq_get_handler_data(irq);
+ struct irq_info *info = irq_get_chip_data(irq);
if (WARN_ON(!info))
return;
@@ -1148,7 +1148,7 @@ int evtchn_make_refcounted(unsigned int
if (irq == -1)
return -ENOENT;
- info = irq_get_handler_data(irq);
+ info = irq_get_chip_data(irq);
if (!info)
return -ENOENT;
@@ -1176,7 +1176,7 @@ int evtchn_get(unsigned int evtchn)
if (irq == -1)
goto done;
- info = irq_get_handler_data(irq);
+ info = irq_get_chip_data(irq);
if (!info)
goto done;
^ permalink raw reply [flat|nested] 70+ messages in thread* Re: [PATCH 4.4 50/62] XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.
2020-09-01 15:10 ` [PATCH 4.4 50/62] XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information Greg Kroah-Hartman
@ 2020-09-29 13:13 ` Stefan Bader
2020-09-29 14:05 ` Jürgen Groß
0 siblings, 1 reply; 70+ messages in thread
From: Stefan Bader @ 2020-09-29 13:13 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: stable, Roman Shaposhnik, Thomas Gleixner, Juergen Gross
[-- Attachment #1.1: Type: text/plain, Size: 8255 bytes --]
On 01.09.20 17:10, Greg Kroah-Hartman wrote:
> From: Thomas Gleixner <tglx@linutronix.de>
>
> commit c330fb1ddc0a922f044989492b7fcca77ee1db46 upstream.
>
> handler data is meant for interrupt handlers and not for storing irq chip
> specific information as some devices require handler data to store internal
> per interrupt information, e.g. pinctrl/GPIO chained interrupt handlers.
>
> This obviously creates a conflict of interests and crashes the machine
> because the XEN pointer is overwritten by the driver pointer.
I cannot say whether this applies the same for the vanilla 4.4 stable kernels
but once this had been applied to our 4.4 based kernels, we observed Xen HVM
guests crashing on boot with:
[ 0.927538] ACPI: bus type PCI registered
[ 0.936008] acpiphp: ACPI Hot Plug PCI Controller Driver version: 0.5
[ 0.948739] PCI: Using configuration type 1 for base access
[ 0.960007] PCI: Using configuration type 1 for extended access
[ 0.984340] ACPI: Added _OSI(Module Device)
[ 0.988010] ACPI: Added _OSI(Processor Device)
[ 0.992007] ACPI: Added _OSI(3.0 _SCP Extensions)
[ 0.996013] ACPI: Added _OSI(Processor Aggregator Device)
[ 1.002103] BUG: unable to handle kernel paging request at ffffffffff5f3000
[ 1.004000] IP: [<ffffffff810592ff>] mp_irqdomain_activate+0x5f/0xa0
[ 1.004000] PGD 1e0f067 PUD 1e11067 PMD 1e12067 PTE 0
[ 1.004000] Oops: 0002 [#1] SMP
[ 1.004000] Modules linked in:
[ 1.004000] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 4.4.0-191-generic
#221-Ubuntu
[ 1.004000] Hardware name: Xen HVM domU, BIOS 4.6.5 04/18/2018
[ 1.004000] task: ffff880107db0000 ti: ffff880107dac000 task.ti: ffff880107dac000
[ 1.004000] RIP: 0010:[<ffffffff810592ff>] [<ffffffff810592ff>]
mp_irqdomain_activate+0x5f/0xa0
[ 1.004000] RSP: 0018:ffff880107dafc48 EFLAGS: 00010086
[ 1.004000] RAX: 0000000000000086 RBX: ffff8800eb852140 RCX: 0000000000000000
[ 1.004000] RDX: ffffffffff5f3000 RSI: 0000000000000001 RDI: 000000000020c000
[ 1.004000] RBP: ffff880107dafc50 R08: ffffffff81ebdfd0 R09: 00000000ffffffff
[ 1.004000] R10: 0000000000000011 R11: 0000000000000009 R12: ffff88010880d400
[ 1.004000] R13: 0000000000000001 R14: 0000000000000009 R15: ffff8800eb880080
[ 1.004000] FS: 0000000000000000(0000) GS:ffff880108ec0000(0000)
knlGS:0000000000000000
[ 1.004000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1.004000] CR2: ffffffffff5f3000 CR3: 0000000001e0a000 CR4: 00000000000006f0
[ 1.004000] Stack:
[ 1.004000] ffff88010880bc58 ffff880107dafc70 ffffffff810ea644 ffff88010880bc00
[ 1.004000] ffff88010880bc58 ffff880107dafca0 ffffffff810e6d88 ffffffff810e1009
[ 1.004000] ffff88010880bc00 ffff88010880bca0 ffff8800eb880080 ffff880107dafd38
[ 1.004000] Call Trace:
[ 1.004000] [<ffffffff810ea644>] irq_domain_activate_irq+0x44/0x50
[ 1.004000] [<ffffffff810e6d88>] irq_startup+0x38/0x90
[ 1.004000] [<ffffffff810e1009>] ? vprintk_default+0x29/0x40
[ 1.004000] [<ffffffff810e55e2>] __setup_irq+0x5a2/0x650
[ 1.004000] [<ffffffff811fc064>] ? kmem_cache_alloc_trace+0x1d4/0x1f0
[ 1.004000] [<ffffffff814a3870>] ? acpi_osi_handler+0xb0/0xb0
[ 1.004000] [<ffffffff810e582b>] request_threaded_irq+0xfb/0x1a0
[ 1.004000] [<ffffffff814a3870>] ? acpi_osi_handler+0xb0/0xb0
[ 1.004000] [<ffffffff814bf624>] ? acpi_ev_sci_dispatch+0x64/0x64
[ 1.004000] [<ffffffff814a3f0a>] acpi_os_install_interrupt_handler+0xaa/0x100
[ 1.004000] [<ffffffff81fb26e1>] ? acpi_sleep_proc_init+0x28/0x28
[ 1.004000] [<ffffffff814bf689>] acpi_ev_install_sci_handler+0x23/0x25
[ 1.004000] [<ffffffff814bcf03>] acpi_ev_install_xrupt_handlers+0x1c/0x6c
[ 1.004000] [<ffffffff81fb3e9d>] acpi_enable_subsystem+0x8f/0x93
[ 1.004000] [<ffffffff81fb276c>] acpi_init+0x8b/0x2c4
[ 1.004000] [<ffffffff8141ee1e>] ? kasprintf+0x4e/0x70
[ 1.004000] [<ffffffff81fb26e1>] ? acpi_sleep_proc_init+0x28/0x28
[ 1.004000] [<ffffffff810021f5>] do_one_initcall+0xb5/0x200
[ 1.004000] [<ffffffff810a6fda>] ? parse_args+0x29a/0x4a0
[ 1.004000] [<ffffffff81f69152>] kernel_init_freeable+0x177/0x218
[ 1.004000] [<ffffffff8185dcf0>] ? rest_init+0x80/0x80
[ 1.004000] [<ffffffff8185dcfe>] kernel_init+0xe/0xe0
[ 1.004000] [<ffffffff8186ae92>] ret_from_fork+0x42/0x80
[ 1.004000] [<ffffffff8185dcf0>] ? rest_init+0x80/0x80
[ 1.004000] Code: 8d 1c d2 8d ba 0b 02 00 00 44 8d 51 11 42 8b 14 dd 74 ec 10
82 c1 e7 0c 48 63 ff 81 e2 ff 0f 00 00 48 81 ea 00 10 80 00 48 29 fa <44> 89 12
89 72 10 42 8b 14 dd 74 ec 10 82 83 c1 10 81 e2 ff 0f
[ 1.004000] RIP [<ffffffff810592ff>] mp_irqdomain_activate+0x5f/0xa0
[ 1.004000] RSP <ffff880107dafc48>
[ 1.004000] CR2: ffffffffff5f3000
[ 1.004000] ---[ end trace 3201cae5b6bd7be1 ]---
[ 1.592027] Kernel panic - not syncing: Attempted to kill init!
exitcode=0x00000009
[ 1.592027]
This is from a local server but same stack-trace happens on AWS instances while
initializing ACPI SCI. mp_irqdomain_activate is accessing chip_data expecting
ioapic data there. Oddly enough more recent kernels seem to do the same but not
crashing as HVM guest (neither seen for our 4.15 nor the 5.4).
Maybe someone could make sure the 4.4.y stable series is not also broken.
-Stefan
>
> As the XEN data is not handler specific it should be stored in
> irqdesc::irq_data::chip_data instead.
>
> A simple sed s/irq_[sg]et_handler_data/irq_[sg]et_chip_data/ cures that.
>
> Cc: stable@vger.kernel.org
> Reported-by: Roman Shaposhnik <roman@zededa.com>
> Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
> Tested-by: Roman Shaposhnik <roman@zededa.com>
> Reviewed-by: Juergen Gross <jgross@suse.com>
> Link: https://lore.kernel.org/r/87lfi2yckt.fsf@nanos.tec.linutronix.de
> Signed-off-by: Juergen Gross <jgross@suse.com>
> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
>
> ---
> drivers/xen/events/events_base.c | 16 ++++++++--------
> 1 file changed, 8 insertions(+), 8 deletions(-)
>
> --- a/drivers/xen/events/events_base.c
> +++ b/drivers/xen/events/events_base.c
> @@ -155,7 +155,7 @@ int get_evtchn_to_irq(unsigned evtchn)
> /* Get info for IRQ */
> struct irq_info *info_for_irq(unsigned irq)
> {
> - return irq_get_handler_data(irq);
> + return irq_get_chip_data(irq);
> }
>
> /* Constructors for packed IRQ information. */
> @@ -384,7 +384,7 @@ static void xen_irq_init(unsigned irq)
> info->type = IRQT_UNBOUND;
> info->refcnt = -1;
>
> - irq_set_handler_data(irq, info);
> + irq_set_chip_data(irq, info);
>
> list_add_tail(&info->list, &xen_irq_list_head);
> }
> @@ -433,14 +433,14 @@ static int __must_check xen_allocate_irq
>
> static void xen_free_irq(unsigned irq)
> {
> - struct irq_info *info = irq_get_handler_data(irq);
> + struct irq_info *info = irq_get_chip_data(irq);
>
> if (WARN_ON(!info))
> return;
>
> list_del(&info->list);
>
> - irq_set_handler_data(irq, NULL);
> + irq_set_chip_data(irq, NULL);
>
> WARN_ON(info->refcnt > 0);
>
> @@ -610,7 +610,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi);
> static void __unbind_from_irq(unsigned int irq)
> {
> int evtchn = evtchn_from_irq(irq);
> - struct irq_info *info = irq_get_handler_data(irq);
> + struct irq_info *info = irq_get_chip_data(irq);
>
> if (info->refcnt > 0) {
> info->refcnt--;
> @@ -1114,7 +1114,7 @@ int bind_ipi_to_irqhandler(enum ipi_vect
>
> void unbind_from_irqhandler(unsigned int irq, void *dev_id)
> {
> - struct irq_info *info = irq_get_handler_data(irq);
> + struct irq_info *info = irq_get_chip_data(irq);
>
> if (WARN_ON(!info))
> return;
> @@ -1148,7 +1148,7 @@ int evtchn_make_refcounted(unsigned int
> if (irq == -1)
> return -ENOENT;
>
> - info = irq_get_handler_data(irq);
> + info = irq_get_chip_data(irq);
>
> if (!info)
> return -ENOENT;
> @@ -1176,7 +1176,7 @@ int evtchn_get(unsigned int evtchn)
> if (irq == -1)
> goto done;
>
> - info = irq_get_handler_data(irq);
> + info = irq_get_chip_data(irq);
>
> if (!info)
> goto done;
>
>
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 70+ messages in thread* Re: [PATCH 4.4 50/62] XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.
2020-09-29 13:13 ` Stefan Bader
@ 2020-09-29 14:05 ` Jürgen Groß
2020-09-29 14:21 ` Stefan Bader
2020-09-30 8:52 ` Stefan Bader
0 siblings, 2 replies; 70+ messages in thread
From: Jürgen Groß @ 2020-09-29 14:05 UTC (permalink / raw)
To: Stefan Bader, Greg Kroah-Hartman, linux-kernel
Cc: stable, Roman Shaposhnik, Thomas Gleixner
[-- Attachment #1: Type: text/plain, Size: 5605 bytes --]
On 29.09.20 15:13, Stefan Bader wrote:
> On 01.09.20 17:10, Greg Kroah-Hartman wrote:
>> From: Thomas Gleixner <tglx@linutronix.de>
>>
>> commit c330fb1ddc0a922f044989492b7fcca77ee1db46 upstream.
>>
>> handler data is meant for interrupt handlers and not for storing irq chip
>> specific information as some devices require handler data to store internal
>> per interrupt information, e.g. pinctrl/GPIO chained interrupt handlers.
>>
>> This obviously creates a conflict of interests and crashes the machine
>> because the XEN pointer is overwritten by the driver pointer.
>
> I cannot say whether this applies the same for the vanilla 4.4 stable kernels
> but once this had been applied to our 4.4 based kernels, we observed Xen HVM
> guests crashing on boot with:
>
> [ 0.927538] ACPI: bus type PCI registered
> [ 0.936008] acpiphp: ACPI Hot Plug PCI Controller Driver version: 0.5
> [ 0.948739] PCI: Using configuration type 1 for base access
> [ 0.960007] PCI: Using configuration type 1 for extended access
> [ 0.984340] ACPI: Added _OSI(Module Device)
> [ 0.988010] ACPI: Added _OSI(Processor Device)
> [ 0.992007] ACPI: Added _OSI(3.0 _SCP Extensions)
> [ 0.996013] ACPI: Added _OSI(Processor Aggregator Device)
> [ 1.002103] BUG: unable to handle kernel paging request at ffffffffff5f3000
> [ 1.004000] IP: [<ffffffff810592ff>] mp_irqdomain_activate+0x5f/0xa0
> [ 1.004000] PGD 1e0f067 PUD 1e11067 PMD 1e12067 PTE 0
> [ 1.004000] Oops: 0002 [#1] SMP
> [ 1.004000] Modules linked in:
> [ 1.004000] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 4.4.0-191-generic
> #221-Ubuntu
> [ 1.004000] Hardware name: Xen HVM domU, BIOS 4.6.5 04/18/2018
> [ 1.004000] task: ffff880107db0000 ti: ffff880107dac000 task.ti: ffff880107dac000
> [ 1.004000] RIP: 0010:[<ffffffff810592ff>] [<ffffffff810592ff>]
> mp_irqdomain_activate+0x5f/0xa0
> [ 1.004000] RSP: 0018:ffff880107dafc48 EFLAGS: 00010086
> [ 1.004000] RAX: 0000000000000086 RBX: ffff8800eb852140 RCX: 0000000000000000
> [ 1.004000] RDX: ffffffffff5f3000 RSI: 0000000000000001 RDI: 000000000020c000
> [ 1.004000] RBP: ffff880107dafc50 R08: ffffffff81ebdfd0 R09: 00000000ffffffff
> [ 1.004000] R10: 0000000000000011 R11: 0000000000000009 R12: ffff88010880d400
> [ 1.004000] R13: 0000000000000001 R14: 0000000000000009 R15: ffff8800eb880080
> [ 1.004000] FS: 0000000000000000(0000) GS:ffff880108ec0000(0000)
> knlGS:0000000000000000
> [ 1.004000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 1.004000] CR2: ffffffffff5f3000 CR3: 0000000001e0a000 CR4: 00000000000006f0
> [ 1.004000] Stack:
> [ 1.004000] ffff88010880bc58 ffff880107dafc70 ffffffff810ea644 ffff88010880bc00
> [ 1.004000] ffff88010880bc58 ffff880107dafca0 ffffffff810e6d88 ffffffff810e1009
> [ 1.004000] ffff88010880bc00 ffff88010880bca0 ffff8800eb880080 ffff880107dafd38
> [ 1.004000] Call Trace:
> [ 1.004000] [<ffffffff810ea644>] irq_domain_activate_irq+0x44/0x50
> [ 1.004000] [<ffffffff810e6d88>] irq_startup+0x38/0x90
> [ 1.004000] [<ffffffff810e1009>] ? vprintk_default+0x29/0x40
> [ 1.004000] [<ffffffff810e55e2>] __setup_irq+0x5a2/0x650
> [ 1.004000] [<ffffffff811fc064>] ? kmem_cache_alloc_trace+0x1d4/0x1f0
> [ 1.004000] [<ffffffff814a3870>] ? acpi_osi_handler+0xb0/0xb0
> [ 1.004000] [<ffffffff810e582b>] request_threaded_irq+0xfb/0x1a0
> [ 1.004000] [<ffffffff814a3870>] ? acpi_osi_handler+0xb0/0xb0
> [ 1.004000] [<ffffffff814bf624>] ? acpi_ev_sci_dispatch+0x64/0x64
> [ 1.004000] [<ffffffff814a3f0a>] acpi_os_install_interrupt_handler+0xaa/0x100
> [ 1.004000] [<ffffffff81fb26e1>] ? acpi_sleep_proc_init+0x28/0x28
> [ 1.004000] [<ffffffff814bf689>] acpi_ev_install_sci_handler+0x23/0x25
> [ 1.004000] [<ffffffff814bcf03>] acpi_ev_install_xrupt_handlers+0x1c/0x6c
> [ 1.004000] [<ffffffff81fb3e9d>] acpi_enable_subsystem+0x8f/0x93
> [ 1.004000] [<ffffffff81fb276c>] acpi_init+0x8b/0x2c4
> [ 1.004000] [<ffffffff8141ee1e>] ? kasprintf+0x4e/0x70
> [ 1.004000] [<ffffffff81fb26e1>] ? acpi_sleep_proc_init+0x28/0x28
> [ 1.004000] [<ffffffff810021f5>] do_one_initcall+0xb5/0x200
> [ 1.004000] [<ffffffff810a6fda>] ? parse_args+0x29a/0x4a0
> [ 1.004000] [<ffffffff81f69152>] kernel_init_freeable+0x177/0x218
> [ 1.004000] [<ffffffff8185dcf0>] ? rest_init+0x80/0x80
> [ 1.004000] [<ffffffff8185dcfe>] kernel_init+0xe/0xe0
> [ 1.004000] [<ffffffff8186ae92>] ret_from_fork+0x42/0x80
> [ 1.004000] [<ffffffff8185dcf0>] ? rest_init+0x80/0x80
> [ 1.004000] Code: 8d 1c d2 8d ba 0b 02 00 00 44 8d 51 11 42 8b 14 dd 74 ec 10
> 82 c1 e7 0c 48 63 ff 81 e2 ff 0f 00 00 48 81 ea 00 10 80 00 48 29 fa <44> 89 12
> 89 72 10 42 8b 14 dd 74 ec 10 82 83 c1 10 81 e2 ff 0f
> [ 1.004000] RIP [<ffffffff810592ff>] mp_irqdomain_activate+0x5f/0xa0
> [ 1.004000] RSP <ffff880107dafc48>
> [ 1.004000] CR2: ffffffffff5f3000
> [ 1.004000] ---[ end trace 3201cae5b6bd7be1 ]---
> [ 1.592027] Kernel panic - not syncing: Attempted to kill init!
> exitcode=0x00000009
> [ 1.592027]
>
> This is from a local server but same stack-trace happens on AWS instances while
> initializing ACPI SCI. mp_irqdomain_activate is accessing chip_data expecting
> ioapic data there. Oddly enough more recent kernels seem to do the same but not
> crashing as HVM guest (neither seen for our 4.15 nor the 5.4).
Hmm, could it be that calling irq_set_chip_data() for a legacy irq is
a rather bad idea?
Could you please try the attached patch (might need some backport, but
should be rather easy)?
Juergen
[-- Attachment #2: 0001-xen-events-don-t-use-chip_data-for-legacy-IRQs.patch --]
[-- Type: text/x-patch, Size: 3165 bytes --]
From 35b71ae9cc69cdd151cc3a4d587f67eb8d86007d Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 29 Sep 2020 15:47:21 +0200
Subject: [PATCH] xen/events: don't use chip_data for legacy IRQs
Storing Xen specific data via chip_data is fine, as long as this isn't
done for a legacy IRQ.
Use a local array for this purpose in case of legacy IRQs.
Signed-off-by: Juergen Gross <jgross@suse.com>
---
drivers/xen/events/events_base.c | 29 +++++++++++++++++++++--------
1 file changed, 21 insertions(+), 8 deletions(-)
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index 90b8f56fbadb..6f02c18fa65c 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -92,6 +92,8 @@ static bool (*pirq_needs_eoi)(unsigned irq);
/* Xen will never allocate port zero for any purpose. */
#define VALID_EVTCHN(chn) ((chn) != 0)
+static struct irq_info *legacy_info_ptrs[NR_IRQS_LEGACY];
+
static struct irq_chip xen_dynamic_chip;
static struct irq_chip xen_percpu_chip;
static struct irq_chip xen_pirq_chip;
@@ -156,7 +158,18 @@ int get_evtchn_to_irq(evtchn_port_t evtchn)
/* Get info for IRQ */
struct irq_info *info_for_irq(unsigned irq)
{
- return irq_get_chip_data(irq);
+ if (irq < nr_legacy_irqs())
+ return legacy_info_ptrs[irq];
+ else
+ return irq_get_chip_data(irq);
+}
+
+static void set_info_for_irq(unsigned int irq, struct irq_info *info)
+{
+ if (irq < nr_legacy_irqs())
+ legacy_info_ptrs[irq] = info;
+ else
+ irq_set_chip_data(irq, info);
}
/* Constructors for packed IRQ information. */
@@ -377,7 +390,7 @@ static void xen_irq_init(unsigned irq)
info->type = IRQT_UNBOUND;
info->refcnt = -1;
- irq_set_chip_data(irq, info);
+ set_info_for_irq(irq, info);
list_add_tail(&info->list, &xen_irq_list_head);
}
@@ -426,14 +439,14 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi)
static void xen_free_irq(unsigned irq)
{
- struct irq_info *info = irq_get_chip_data(irq);
+ struct irq_info *info = info_for_irq(irq);
if (WARN_ON(!info))
return;
list_del(&info->list);
- irq_set_chip_data(irq, NULL);
+ set_info_for_irq(irq, NULL);
WARN_ON(info->refcnt > 0);
@@ -603,7 +616,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi);
static void __unbind_from_irq(unsigned int irq)
{
evtchn_port_t evtchn = evtchn_from_irq(irq);
- struct irq_info *info = irq_get_chip_data(irq);
+ struct irq_info *info = info_for_irq(irq);
if (info->refcnt > 0) {
info->refcnt--;
@@ -1108,7 +1121,7 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi,
void unbind_from_irqhandler(unsigned int irq, void *dev_id)
{
- struct irq_info *info = irq_get_chip_data(irq);
+ struct irq_info *info = info_for_irq(irq);
if (WARN_ON(!info))
return;
@@ -1142,7 +1155,7 @@ int evtchn_make_refcounted(evtchn_port_t evtchn)
if (irq == -1)
return -ENOENT;
- info = irq_get_chip_data(irq);
+ info = info_for_irq(irq);
if (!info)
return -ENOENT;
@@ -1170,7 +1183,7 @@ int evtchn_get(evtchn_port_t evtchn)
if (irq == -1)
goto done;
- info = irq_get_chip_data(irq);
+ info = info_for_irq(irq);
if (!info)
goto done;
--
2.26.2
^ permalink raw reply related [flat|nested] 70+ messages in thread* Re: [PATCH 4.4 50/62] XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.
2020-09-29 14:05 ` Jürgen Groß
@ 2020-09-29 14:21 ` Stefan Bader
2020-09-30 8:52 ` Stefan Bader
1 sibling, 0 replies; 70+ messages in thread
From: Stefan Bader @ 2020-09-29 14:21 UTC (permalink / raw)
To: Jürgen Groß, Greg Kroah-Hartman, linux-kernel
Cc: stable, Roman Shaposhnik, Thomas Gleixner
[-- Attachment #1.1: Type: text/plain, Size: 6209 bytes --]
On 29.09.20 16:05, Jürgen Groß wrote:
> On 29.09.20 15:13, Stefan Bader wrote:
>> On 01.09.20 17:10, Greg Kroah-Hartman wrote:
>>> From: Thomas Gleixner <tglx@linutronix.de>
>>>
>>> commit c330fb1ddc0a922f044989492b7fcca77ee1db46 upstream.
>>>
>>> handler data is meant for interrupt handlers and not for storing irq chip
>>> specific information as some devices require handler data to store internal
>>> per interrupt information, e.g. pinctrl/GPIO chained interrupt handlers.
>>>
>>> This obviously creates a conflict of interests and crashes the machine
>>> because the XEN pointer is overwritten by the driver pointer.
>>
>> I cannot say whether this applies the same for the vanilla 4.4 stable kernels
>> but once this had been applied to our 4.4 based kernels, we observed Xen HVM
>> guests crashing on boot with:
>>
>> [ 0.927538] ACPI: bus type PCI registered
>> [ 0.936008] acpiphp: ACPI Hot Plug PCI Controller Driver version: 0.5
>> [ 0.948739] PCI: Using configuration type 1 for base access
>> [ 0.960007] PCI: Using configuration type 1 for extended access
>> [ 0.984340] ACPI: Added _OSI(Module Device)
>> [ 0.988010] ACPI: Added _OSI(Processor Device)
>> [ 0.992007] ACPI: Added _OSI(3.0 _SCP Extensions)
>> [ 0.996013] ACPI: Added _OSI(Processor Aggregator Device)
>> [ 1.002103] BUG: unable to handle kernel paging request at ffffffffff5f3000
>> [ 1.004000] IP: [<ffffffff810592ff>] mp_irqdomain_activate+0x5f/0xa0
>> [ 1.004000] PGD 1e0f067 PUD 1e11067 PMD 1e12067 PTE 0
>> [ 1.004000] Oops: 0002 [#1] SMP
>> [ 1.004000] Modules linked in:
>> [ 1.004000] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 4.4.0-191-generic
>> #221-Ubuntu
>> [ 1.004000] Hardware name: Xen HVM domU, BIOS 4.6.5 04/18/2018
>> [ 1.004000] task: ffff880107db0000 ti: ffff880107dac000 task.ti:
>> ffff880107dac000
>> [ 1.004000] RIP: 0010:[<ffffffff810592ff>] [<ffffffff810592ff>]
>> mp_irqdomain_activate+0x5f/0xa0
>> [ 1.004000] RSP: 0018:ffff880107dafc48 EFLAGS: 00010086
>> [ 1.004000] RAX: 0000000000000086 RBX: ffff8800eb852140 RCX: 0000000000000000
>> [ 1.004000] RDX: ffffffffff5f3000 RSI: 0000000000000001 RDI: 000000000020c000
>> [ 1.004000] RBP: ffff880107dafc50 R08: ffffffff81ebdfd0 R09: 00000000ffffffff
>> [ 1.004000] R10: 0000000000000011 R11: 0000000000000009 R12: ffff88010880d400
>> [ 1.004000] R13: 0000000000000001 R14: 0000000000000009 R15: ffff8800eb880080
>> [ 1.004000] FS: 0000000000000000(0000) GS:ffff880108ec0000(0000)
>> knlGS:0000000000000000
>> [ 1.004000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [ 1.004000] CR2: ffffffffff5f3000 CR3: 0000000001e0a000 CR4: 00000000000006f0
>> [ 1.004000] Stack:
>> [ 1.004000] ffff88010880bc58 ffff880107dafc70 ffffffff810ea644
>> ffff88010880bc00
>> [ 1.004000] ffff88010880bc58 ffff880107dafca0 ffffffff810e6d88
>> ffffffff810e1009
>> [ 1.004000] ffff88010880bc00 ffff88010880bca0 ffff8800eb880080
>> ffff880107dafd38
>> [ 1.004000] Call Trace:
>> [ 1.004000] [<ffffffff810ea644>] irq_domain_activate_irq+0x44/0x50
>> [ 1.004000] [<ffffffff810e6d88>] irq_startup+0x38/0x90
>> [ 1.004000] [<ffffffff810e1009>] ? vprintk_default+0x29/0x40
>> [ 1.004000] [<ffffffff810e55e2>] __setup_irq+0x5a2/0x650
>> [ 1.004000] [<ffffffff811fc064>] ? kmem_cache_alloc_trace+0x1d4/0x1f0
>> [ 1.004000] [<ffffffff814a3870>] ? acpi_osi_handler+0xb0/0xb0
>> [ 1.004000] [<ffffffff810e582b>] request_threaded_irq+0xfb/0x1a0
>> [ 1.004000] [<ffffffff814a3870>] ? acpi_osi_handler+0xb0/0xb0
>> [ 1.004000] [<ffffffff814bf624>] ? acpi_ev_sci_dispatch+0x64/0x64
>> [ 1.004000] [<ffffffff814a3f0a>] acpi_os_install_interrupt_handler+0xaa/0x100
>> [ 1.004000] [<ffffffff81fb26e1>] ? acpi_sleep_proc_init+0x28/0x28
>> [ 1.004000] [<ffffffff814bf689>] acpi_ev_install_sci_handler+0x23/0x25
>> [ 1.004000] [<ffffffff814bcf03>] acpi_ev_install_xrupt_handlers+0x1c/0x6c
>> [ 1.004000] [<ffffffff81fb3e9d>] acpi_enable_subsystem+0x8f/0x93
>> [ 1.004000] [<ffffffff81fb276c>] acpi_init+0x8b/0x2c4
>> [ 1.004000] [<ffffffff8141ee1e>] ? kasprintf+0x4e/0x70
>> [ 1.004000] [<ffffffff81fb26e1>] ? acpi_sleep_proc_init+0x28/0x28
>> [ 1.004000] [<ffffffff810021f5>] do_one_initcall+0xb5/0x200
>> [ 1.004000] [<ffffffff810a6fda>] ? parse_args+0x29a/0x4a0
>> [ 1.004000] [<ffffffff81f69152>] kernel_init_freeable+0x177/0x218
>> [ 1.004000] [<ffffffff8185dcf0>] ? rest_init+0x80/0x80
>> [ 1.004000] [<ffffffff8185dcfe>] kernel_init+0xe/0xe0
>> [ 1.004000] [<ffffffff8186ae92>] ret_from_fork+0x42/0x80
>> [ 1.004000] [<ffffffff8185dcf0>] ? rest_init+0x80/0x80
>> [ 1.004000] Code: 8d 1c d2 8d ba 0b 02 00 00 44 8d 51 11 42 8b 14 dd 74 ec 10
>> 82 c1 e7 0c 48 63 ff 81 e2 ff 0f 00 00 48 81 ea 00 10 80 00 48 29 fa <44> 89 12
>> 89 72 10 42 8b 14 dd 74 ec 10 82 83 c1 10 81 e2 ff 0f
>> [ 1.004000] RIP [<ffffffff810592ff>] mp_irqdomain_activate+0x5f/0xa0
>> [ 1.004000] RSP <ffff880107dafc48>
>> [ 1.004000] CR2: ffffffffff5f3000
>> [ 1.004000] ---[ end trace 3201cae5b6bd7be1 ]---
>> [ 1.592027] Kernel panic - not syncing: Attempted to kill init!
>> exitcode=0x00000009
>> [ 1.592027]
>>
>> This is from a local server but same stack-trace happens on AWS instances while
>> initializing ACPI SCI. mp_irqdomain_activate is accessing chip_data expecting
>> ioapic data there. Oddly enough more recent kernels seem to do the same but not
>> crashing as HVM guest (neither seen for our 4.15 nor the 5.4).
>
> Hmm, could it be that calling irq_set_chip_data() for a legacy irq is
> a rather bad idea?
>
> Could you please try the attached patch (might need some backport, but
> should be rather easy)?
Will give it a try once I got some time to squeeze it in. Might take till
tomorow or the day after...
-Stefan
>
>
> Juergen
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 70+ messages in thread
* Re: [PATCH 4.4 50/62] XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.
2020-09-29 14:05 ` Jürgen Groß
2020-09-29 14:21 ` Stefan Bader
@ 2020-09-30 8:52 ` Stefan Bader
2020-09-30 9:01 ` Jürgen Groß
1 sibling, 1 reply; 70+ messages in thread
From: Stefan Bader @ 2020-09-30 8:52 UTC (permalink / raw)
To: Jürgen Groß, Greg Kroah-Hartman, linux-kernel
Cc: stable, Roman Shaposhnik, Thomas Gleixner
[-- Attachment #1.1.1: Type: text/plain, Size: 6403 bytes --]
On 29.09.20 16:05, Jürgen Groß wrote:
> On 29.09.20 15:13, Stefan Bader wrote:
>> On 01.09.20 17:10, Greg Kroah-Hartman wrote:
>>> From: Thomas Gleixner <tglx@linutronix.de>
>>>
>>> commit c330fb1ddc0a922f044989492b7fcca77ee1db46 upstream.
>>>
>>> handler data is meant for interrupt handlers and not for storing irq chip
>>> specific information as some devices require handler data to store internal
>>> per interrupt information, e.g. pinctrl/GPIO chained interrupt handlers.
>>>
>>> This obviously creates a conflict of interests and crashes the machine
>>> because the XEN pointer is overwritten by the driver pointer.
>>
>> I cannot say whether this applies the same for the vanilla 4.4 stable kernels
>> but once this had been applied to our 4.4 based kernels, we observed Xen HVM
>> guests crashing on boot with:
>>
>> [ 0.927538] ACPI: bus type PCI registered
>> [ 0.936008] acpiphp: ACPI Hot Plug PCI Controller Driver version: 0.5
>> [ 0.948739] PCI: Using configuration type 1 for base access
>> [ 0.960007] PCI: Using configuration type 1 for extended access
>> [ 0.984340] ACPI: Added _OSI(Module Device)
>> [ 0.988010] ACPI: Added _OSI(Processor Device)
>> [ 0.992007] ACPI: Added _OSI(3.0 _SCP Extensions)
>> [ 0.996013] ACPI: Added _OSI(Processor Aggregator Device)
>> [ 1.002103] BUG: unable to handle kernel paging request at ffffffffff5f3000
>> [ 1.004000] IP: [<ffffffff810592ff>] mp_irqdomain_activate+0x5f/0xa0
>> [ 1.004000] PGD 1e0f067 PUD 1e11067 PMD 1e12067 PTE 0
>> [ 1.004000] Oops: 0002 [#1] SMP
>> [ 1.004000] Modules linked in:
>> [ 1.004000] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 4.4.0-191-generic
>> #221-Ubuntu
>> [ 1.004000] Hardware name: Xen HVM domU, BIOS 4.6.5 04/18/2018
>> [ 1.004000] task: ffff880107db0000 ti: ffff880107dac000 task.ti:
>> ffff880107dac000
>> [ 1.004000] RIP: 0010:[<ffffffff810592ff>] [<ffffffff810592ff>]
>> mp_irqdomain_activate+0x5f/0xa0
>> [ 1.004000] RSP: 0018:ffff880107dafc48 EFLAGS: 00010086
>> [ 1.004000] RAX: 0000000000000086 RBX: ffff8800eb852140 RCX: 0000000000000000
>> [ 1.004000] RDX: ffffffffff5f3000 RSI: 0000000000000001 RDI: 000000000020c000
>> [ 1.004000] RBP: ffff880107dafc50 R08: ffffffff81ebdfd0 R09: 00000000ffffffff
>> [ 1.004000] R10: 0000000000000011 R11: 0000000000000009 R12: ffff88010880d400
>> [ 1.004000] R13: 0000000000000001 R14: 0000000000000009 R15: ffff8800eb880080
>> [ 1.004000] FS: 0000000000000000(0000) GS:ffff880108ec0000(0000)
>> knlGS:0000000000000000
>> [ 1.004000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [ 1.004000] CR2: ffffffffff5f3000 CR3: 0000000001e0a000 CR4: 00000000000006f0
>> [ 1.004000] Stack:
>> [ 1.004000] ffff88010880bc58 ffff880107dafc70 ffffffff810ea644
>> ffff88010880bc00
>> [ 1.004000] ffff88010880bc58 ffff880107dafca0 ffffffff810e6d88
>> ffffffff810e1009
>> [ 1.004000] ffff88010880bc00 ffff88010880bca0 ffff8800eb880080
>> ffff880107dafd38
>> [ 1.004000] Call Trace:
>> [ 1.004000] [<ffffffff810ea644>] irq_domain_activate_irq+0x44/0x50
>> [ 1.004000] [<ffffffff810e6d88>] irq_startup+0x38/0x90
>> [ 1.004000] [<ffffffff810e1009>] ? vprintk_default+0x29/0x40
>> [ 1.004000] [<ffffffff810e55e2>] __setup_irq+0x5a2/0x650
>> [ 1.004000] [<ffffffff811fc064>] ? kmem_cache_alloc_trace+0x1d4/0x1f0
>> [ 1.004000] [<ffffffff814a3870>] ? acpi_osi_handler+0xb0/0xb0
>> [ 1.004000] [<ffffffff810e582b>] request_threaded_irq+0xfb/0x1a0
>> [ 1.004000] [<ffffffff814a3870>] ? acpi_osi_handler+0xb0/0xb0
>> [ 1.004000] [<ffffffff814bf624>] ? acpi_ev_sci_dispatch+0x64/0x64
>> [ 1.004000] [<ffffffff814a3f0a>] acpi_os_install_interrupt_handler+0xaa/0x100
>> [ 1.004000] [<ffffffff81fb26e1>] ? acpi_sleep_proc_init+0x28/0x28
>> [ 1.004000] [<ffffffff814bf689>] acpi_ev_install_sci_handler+0x23/0x25
>> [ 1.004000] [<ffffffff814bcf03>] acpi_ev_install_xrupt_handlers+0x1c/0x6c
>> [ 1.004000] [<ffffffff81fb3e9d>] acpi_enable_subsystem+0x8f/0x93
>> [ 1.004000] [<ffffffff81fb276c>] acpi_init+0x8b/0x2c4
>> [ 1.004000] [<ffffffff8141ee1e>] ? kasprintf+0x4e/0x70
>> [ 1.004000] [<ffffffff81fb26e1>] ? acpi_sleep_proc_init+0x28/0x28
>> [ 1.004000] [<ffffffff810021f5>] do_one_initcall+0xb5/0x200
>> [ 1.004000] [<ffffffff810a6fda>] ? parse_args+0x29a/0x4a0
>> [ 1.004000] [<ffffffff81f69152>] kernel_init_freeable+0x177/0x218
>> [ 1.004000] [<ffffffff8185dcf0>] ? rest_init+0x80/0x80
>> [ 1.004000] [<ffffffff8185dcfe>] kernel_init+0xe/0xe0
>> [ 1.004000] [<ffffffff8186ae92>] ret_from_fork+0x42/0x80
>> [ 1.004000] [<ffffffff8185dcf0>] ? rest_init+0x80/0x80
>> [ 1.004000] Code: 8d 1c d2 8d ba 0b 02 00 00 44 8d 51 11 42 8b 14 dd 74 ec 10
>> 82 c1 e7 0c 48 63 ff 81 e2 ff 0f 00 00 48 81 ea 00 10 80 00 48 29 fa <44> 89 12
>> 89 72 10 42 8b 14 dd 74 ec 10 82 83 c1 10 81 e2 ff 0f
>> [ 1.004000] RIP [<ffffffff810592ff>] mp_irqdomain_activate+0x5f/0xa0
>> [ 1.004000] RSP <ffff880107dafc48>
>> [ 1.004000] CR2: ffffffffff5f3000
>> [ 1.004000] ---[ end trace 3201cae5b6bd7be1 ]---
>> [ 1.592027] Kernel panic - not syncing: Attempted to kill init!
>> exitcode=0x00000009
>> [ 1.592027]
>>
>> This is from a local server but same stack-trace happens on AWS instances while
>> initializing ACPI SCI. mp_irqdomain_activate is accessing chip_data expecting
>> ioapic data there. Oddly enough more recent kernels seem to do the same but not
>> crashing as HVM guest (neither seen for our 4.15 nor the 5.4).
>
> Hmm, could it be that calling irq_set_chip_data() for a legacy irq is
> a rather bad idea?
>
> Could you please try the attached patch (might need some backport, but
> should be rather easy)?
Ok, I can confirm that adding your patch (minor backport to 4.4 attached) on top
of the change to use chip_data generally, the HVM guest does come up
successfully. Again, I was unable to figure out why this fixup is not needed in
more recent kernels, but for 4.4.y it seems to be needed.
Thanks,
Stefan
>
>
> Juergen
[-- Attachment #1.1.2: 0001-xen-events-don-t-use-chip_data-for-legacy-IRQs.patch --]
[-- Type: text/x-patch, Size: 3376 bytes --]
From b7a74e75bbee9b70ec0b281d0399e9c6c25bd610 Mon Sep 17 00:00:00 2001
From: Juergen Gross <jgross@suse.com>
Date: Tue, 29 Sep 2020 15:47:21 +0200
Subject: [PATCH] xen/events: don't use chip_data for legacy IRQs
Storing Xen specific data via chip_data is fine, as long as this isn't
done for a legacy IRQ.
Use a local array for this purpose in case of legacy IRQs.
Signed-off-by: Juergen Gross <jgross@suse.com>
[smb: backport adjust context around __unbind_from_irq]
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
---
drivers/xen/events/events_base.c | 29 +++++++++++++++++++++--------
1 file changed, 21 insertions(+), 8 deletions(-)
diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
index e4dd991e2888..9a126732d5d9 100644
--- a/drivers/xen/events/events_base.c
+++ b/drivers/xen/events/events_base.c
@@ -91,6 +91,8 @@ static bool (*pirq_needs_eoi)(unsigned irq);
/* Xen will never allocate port zero for any purpose. */
#define VALID_EVTCHN(chn) ((chn) != 0)
+static struct irq_info *legacy_info_ptrs[NR_IRQS_LEGACY];
+
static struct irq_chip xen_dynamic_chip;
static struct irq_chip xen_percpu_chip;
static struct irq_chip xen_pirq_chip;
@@ -155,7 +157,18 @@ int get_evtchn_to_irq(unsigned evtchn)
/* Get info for IRQ */
struct irq_info *info_for_irq(unsigned irq)
{
- return irq_get_chip_data(irq);
+ if (irq < nr_legacy_irqs())
+ return legacy_info_ptrs[irq];
+ else
+ return irq_get_chip_data(irq);
+}
+
+static void set_info_for_irq(unsigned int irq, struct irq_info *info)
+{
+ if (irq < nr_legacy_irqs())
+ legacy_info_ptrs[irq] = info;
+ else
+ irq_set_chip_data(irq, info);
}
/* Constructors for packed IRQ information. */
@@ -384,7 +397,7 @@ static void xen_irq_init(unsigned irq)
info->type = IRQT_UNBOUND;
info->refcnt = -1;
- irq_set_chip_data(irq, info);
+ set_info_for_irq(irq, info);
list_add_tail(&info->list, &xen_irq_list_head);
}
@@ -433,14 +446,14 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi)
static void xen_free_irq(unsigned irq)
{
- struct irq_info *info = irq_get_chip_data(irq);
+ struct irq_info *info = info_for_irq(irq);
if (WARN_ON(!info))
return;
list_del(&info->list);
- irq_set_chip_data(irq, NULL);
+ set_info_for_irq(irq, NULL);
WARN_ON(info->refcnt > 0);
@@ -610,7 +623,7 @@ EXPORT_SYMBOL_GPL(xen_irq_from_gsi);
static void __unbind_from_irq(unsigned int irq)
{
int evtchn = evtchn_from_irq(irq);
- struct irq_info *info = irq_get_chip_data(irq);
+ struct irq_info *info = info_for_irq(irq);
if (info->refcnt > 0) {
info->refcnt--;
@@ -1114,7 +1127,7 @@ int bind_ipi_to_irqhandler(enum ipi_vector ipi,
void unbind_from_irqhandler(unsigned int irq, void *dev_id)
{
- struct irq_info *info = irq_get_chip_data(irq);
+ struct irq_info *info = info_for_irq(irq);
if (WARN_ON(!info))
return;
@@ -1148,7 +1161,7 @@ int evtchn_make_refcounted(unsigned int evtchn)
if (irq == -1)
return -ENOENT;
- info = irq_get_chip_data(irq);
+ info = info_for_irq(irq);
if (!info)
return -ENOENT;
@@ -1176,7 +1189,7 @@ int evtchn_get(unsigned int evtchn)
if (irq == -1)
goto done;
- info = irq_get_chip_data(irq);
+ info = info_for_irq(irq);
if (!info)
goto done;
--
2.25.1
[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply related [flat|nested] 70+ messages in thread* Re: [PATCH 4.4 50/62] XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information.
2020-09-30 8:52 ` Stefan Bader
@ 2020-09-30 9:01 ` Jürgen Groß
0 siblings, 0 replies; 70+ messages in thread
From: Jürgen Groß @ 2020-09-30 9:01 UTC (permalink / raw)
To: Stefan Bader, Greg Kroah-Hartman, linux-kernel
Cc: stable, Roman Shaposhnik, Thomas Gleixner
On 30.09.20 10:52, Stefan Bader wrote:
> On 29.09.20 16:05, Jürgen Groß wrote:
>> On 29.09.20 15:13, Stefan Bader wrote:
>>> On 01.09.20 17:10, Greg Kroah-Hartman wrote:
>>>> From: Thomas Gleixner <tglx@linutronix.de>
>>>>
>>>> commit c330fb1ddc0a922f044989492b7fcca77ee1db46 upstream.
>>>>
>>>> handler data is meant for interrupt handlers and not for storing irq chip
>>>> specific information as some devices require handler data to store internal
>>>> per interrupt information, e.g. pinctrl/GPIO chained interrupt handlers.
>>>>
>>>> This obviously creates a conflict of interests and crashes the machine
>>>> because the XEN pointer is overwritten by the driver pointer.
>>>
>>> I cannot say whether this applies the same for the vanilla 4.4 stable kernels
>>> but once this had been applied to our 4.4 based kernels, we observed Xen HVM
>>> guests crashing on boot with:
>>>
>>> [ 0.927538] ACPI: bus type PCI registered
>>> [ 0.936008] acpiphp: ACPI Hot Plug PCI Controller Driver version: 0.5
>>> [ 0.948739] PCI: Using configuration type 1 for base access
>>> [ 0.960007] PCI: Using configuration type 1 for extended access
>>> [ 0.984340] ACPI: Added _OSI(Module Device)
>>> [ 0.988010] ACPI: Added _OSI(Processor Device)
>>> [ 0.992007] ACPI: Added _OSI(3.0 _SCP Extensions)
>>> [ 0.996013] ACPI: Added _OSI(Processor Aggregator Device)
>>> [ 1.002103] BUG: unable to handle kernel paging request at ffffffffff5f3000
>>> [ 1.004000] IP: [<ffffffff810592ff>] mp_irqdomain_activate+0x5f/0xa0
>>> [ 1.004000] PGD 1e0f067 PUD 1e11067 PMD 1e12067 PTE 0
>>> [ 1.004000] Oops: 0002 [#1] SMP
>>> [ 1.004000] Modules linked in:
>>> [ 1.004000] CPU: 3 PID: 1 Comm: swapper/0 Not tainted 4.4.0-191-generic
>>> #221-Ubuntu
>>> [ 1.004000] Hardware name: Xen HVM domU, BIOS 4.6.5 04/18/2018
>>> [ 1.004000] task: ffff880107db0000 ti: ffff880107dac000 task.ti:
>>> ffff880107dac000
>>> [ 1.004000] RIP: 0010:[<ffffffff810592ff>] [<ffffffff810592ff>]
>>> mp_irqdomain_activate+0x5f/0xa0
>>> [ 1.004000] RSP: 0018:ffff880107dafc48 EFLAGS: 00010086
>>> [ 1.004000] RAX: 0000000000000086 RBX: ffff8800eb852140 RCX: 0000000000000000
>>> [ 1.004000] RDX: ffffffffff5f3000 RSI: 0000000000000001 RDI: 000000000020c000
>>> [ 1.004000] RBP: ffff880107dafc50 R08: ffffffff81ebdfd0 R09: 00000000ffffffff
>>> [ 1.004000] R10: 0000000000000011 R11: 0000000000000009 R12: ffff88010880d400
>>> [ 1.004000] R13: 0000000000000001 R14: 0000000000000009 R15: ffff8800eb880080
>>> [ 1.004000] FS: 0000000000000000(0000) GS:ffff880108ec0000(0000)
>>> knlGS:0000000000000000
>>> [ 1.004000] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> [ 1.004000] CR2: ffffffffff5f3000 CR3: 0000000001e0a000 CR4: 00000000000006f0
>>> [ 1.004000] Stack:
>>> [ 1.004000] ffff88010880bc58 ffff880107dafc70 ffffffff810ea644
>>> ffff88010880bc00
>>> [ 1.004000] ffff88010880bc58 ffff880107dafca0 ffffffff810e6d88
>>> ffffffff810e1009
>>> [ 1.004000] ffff88010880bc00 ffff88010880bca0 ffff8800eb880080
>>> ffff880107dafd38
>>> [ 1.004000] Call Trace:
>>> [ 1.004000] [<ffffffff810ea644>] irq_domain_activate_irq+0x44/0x50
>>> [ 1.004000] [<ffffffff810e6d88>] irq_startup+0x38/0x90
>>> [ 1.004000] [<ffffffff810e1009>] ? vprintk_default+0x29/0x40
>>> [ 1.004000] [<ffffffff810e55e2>] __setup_irq+0x5a2/0x650
>>> [ 1.004000] [<ffffffff811fc064>] ? kmem_cache_alloc_trace+0x1d4/0x1f0
>>> [ 1.004000] [<ffffffff814a3870>] ? acpi_osi_handler+0xb0/0xb0
>>> [ 1.004000] [<ffffffff810e582b>] request_threaded_irq+0xfb/0x1a0
>>> [ 1.004000] [<ffffffff814a3870>] ? acpi_osi_handler+0xb0/0xb0
>>> [ 1.004000] [<ffffffff814bf624>] ? acpi_ev_sci_dispatch+0x64/0x64
>>> [ 1.004000] [<ffffffff814a3f0a>] acpi_os_install_interrupt_handler+0xaa/0x100
>>> [ 1.004000] [<ffffffff81fb26e1>] ? acpi_sleep_proc_init+0x28/0x28
>>> [ 1.004000] [<ffffffff814bf689>] acpi_ev_install_sci_handler+0x23/0x25
>>> [ 1.004000] [<ffffffff814bcf03>] acpi_ev_install_xrupt_handlers+0x1c/0x6c
>>> [ 1.004000] [<ffffffff81fb3e9d>] acpi_enable_subsystem+0x8f/0x93
>>> [ 1.004000] [<ffffffff81fb276c>] acpi_init+0x8b/0x2c4
>>> [ 1.004000] [<ffffffff8141ee1e>] ? kasprintf+0x4e/0x70
>>> [ 1.004000] [<ffffffff81fb26e1>] ? acpi_sleep_proc_init+0x28/0x28
>>> [ 1.004000] [<ffffffff810021f5>] do_one_initcall+0xb5/0x200
>>> [ 1.004000] [<ffffffff810a6fda>] ? parse_args+0x29a/0x4a0
>>> [ 1.004000] [<ffffffff81f69152>] kernel_init_freeable+0x177/0x218
>>> [ 1.004000] [<ffffffff8185dcf0>] ? rest_init+0x80/0x80
>>> [ 1.004000] [<ffffffff8185dcfe>] kernel_init+0xe/0xe0
>>> [ 1.004000] [<ffffffff8186ae92>] ret_from_fork+0x42/0x80
>>> [ 1.004000] [<ffffffff8185dcf0>] ? rest_init+0x80/0x80
>>> [ 1.004000] Code: 8d 1c d2 8d ba 0b 02 00 00 44 8d 51 11 42 8b 14 dd 74 ec 10
>>> 82 c1 e7 0c 48 63 ff 81 e2 ff 0f 00 00 48 81 ea 00 10 80 00 48 29 fa <44> 89 12
>>> 89 72 10 42 8b 14 dd 74 ec 10 82 83 c1 10 81 e2 ff 0f
>>> [ 1.004000] RIP [<ffffffff810592ff>] mp_irqdomain_activate+0x5f/0xa0
>>> [ 1.004000] RSP <ffff880107dafc48>
>>> [ 1.004000] CR2: ffffffffff5f3000
>>> [ 1.004000] ---[ end trace 3201cae5b6bd7be1 ]---
>>> [ 1.592027] Kernel panic - not syncing: Attempted to kill init!
>>> exitcode=0x00000009
>>> [ 1.592027]
>>>
>>> This is from a local server but same stack-trace happens on AWS instances while
>>> initializing ACPI SCI. mp_irqdomain_activate is accessing chip_data expecting
>>> ioapic data there. Oddly enough more recent kernels seem to do the same but not
>>> crashing as HVM guest (neither seen for our 4.15 nor the 5.4).
>>
>> Hmm, could it be that calling irq_set_chip_data() for a legacy irq is
>> a rather bad idea?
>>
>> Could you please try the attached patch (might need some backport, but
>> should be rather easy)?
>
> Ok, I can confirm that adding your patch (minor backport to 4.4 attached) on top
> of the change to use chip_data generally, the HVM guest does come up
> successfully. Again, I was unable to figure out why this fixup is not needed in
> more recent kernels, but for 4.4.y it seems to be needed.
It seems to be more subtle in newer kernels. I have got another
report for newer kernels where only the floppy driver is showing
the problem.
Thanks for testing.
Juergen
^ permalink raw reply [flat|nested] 70+ messages in thread
* [PATCH 4.4 51/62] xhci: Do warm-reset when both CAS and XDEV_RESUME are set
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (49 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 50/62] XEN uses irqdesc::irq_data_common::handler_data to store a per interrupt XEN data pointer which contains XEN specific information Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 52/62] PM: sleep: core: Fix the handling of pending runtime resume requests Greg Kroah-Hartman
` (11 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kai-Heng Feng, Mathias Nyman
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
commit 904df64a5f4d5ebd670801d869ca0a6d6a6e8df6 upstream.
Sometimes re-plugging a USB device during system sleep renders the device
useless:
[ 173.418345] xhci_hcd 0000:00:14.0: Get port status 2-4 read: 0x14203e2, return 0x10262
...
[ 176.496485] usb 2-4: Waited 2000ms for CONNECT
[ 176.496781] usb usb2-port4: status 0000.0262 after resume, -19
[ 176.497103] usb 2-4: can't resume, status -19
[ 176.497438] usb usb2-port4: logical disconnect
Because PLS equals to XDEV_RESUME, xHCI driver reports U3 to usbcore,
despite of CAS bit is flagged.
So proritize CAS over XDEV_RESUME to let usbcore handle warm-reset for
the port.
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
Link: https://lore.kernel.org/r/20200821091549.20556-3-mathias.nyman@linux.intel.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/xhci-hub.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)
--- a/drivers/usb/host/xhci-hub.c
+++ b/drivers/usb/host/xhci-hub.c
@@ -599,15 +599,6 @@ static void xhci_hub_report_usb3_link_st
{
u32 pls = status_reg & PORT_PLS_MASK;
- /* resume state is a xHCI internal state.
- * Do not report it to usb core, instead, pretend to be U3,
- * thus usb core knows it's not ready for transfer
- */
- if (pls == XDEV_RESUME) {
- *status |= USB_SS_PORT_LS_U3;
- return;
- }
-
/* When the CAS bit is set then warm reset
* should be performed on port
*/
@@ -630,6 +621,16 @@ static void xhci_hub_report_usb3_link_st
pls |= USB_PORT_STAT_CONNECTION;
} else {
/*
+ * Resume state is an xHCI internal state. Do not report it to
+ * usb core, instead, pretend to be U3, thus usb core knows
+ * it's not ready for transfer.
+ */
+ if (pls == XDEV_RESUME) {
+ *status |= USB_SS_PORT_LS_U3;
+ return;
+ }
+
+ /*
* If CAS bit isn't set but the Port is already at
* Compliance Mode, fake a connection so the USB core
* notices the Compliance state and resets the port.
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 52/62] PM: sleep: core: Fix the handling of pending runtime resume requests
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (50 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 51/62] xhci: Do warm-reset when both CAS and XDEV_RESUME are set Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 53/62] device property: Fix the secondary firmware node handling in set_primary_fwnode() Greg Kroah-Hartman
` (10 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Rafael J. Wysocki, Alan Stern,
Utkarsh H Patel, Pengfei Xu
From: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
commit e3eb6e8fba65094328b8dca635d00de74ba75b45 upstream.
It has been reported that system-wide suspend may be aborted in the
absence of any wakeup events due to unforseen interactions of it with
the runtume PM framework.
One failing scenario is when there are multiple devices sharing an
ACPI power resource and runtime-resume needs to be carried out for
one of them during system-wide suspend (for example, because it needs
to be reconfigured before the whole system goes to sleep). In that
case, the runtime-resume of that device involves turning the ACPI
power resource "on" which in turn causes runtime-resume requests
to be queued up for all of the other devices sharing it. Those
requests go to the runtime PM workqueue which is frozen during
system-wide suspend, so they are not actually taken care of until
the resume of the whole system, but the pm_runtime_barrier()
call in __device_suspend() sees them and triggers system wakeup
events for them which then cause the system-wide suspend to be
aborted if wakeup source objects are in active use.
Of course, the logic that leads to triggering those wakeup events is
questionable in the first place, because clearly there are cases in
which a pending runtime resume request for a device is not connected
to any real wakeup events in any way (like the one above). Moreover,
it is racy, because the device may be resuming already by the time
the pm_runtime_barrier() runs and so if the driver doesn't take care
of signaling the wakeup event as appropriate, it will be lost.
However, if the driver does take care of that, the extra
pm_wakeup_event() call in the core is redundant.
Accordingly, drop the conditional pm_wakeup_event() call fron
__device_suspend() and make the latter call pm_runtime_barrier()
alone. Also modify the comment next to that call to reflect the new
code and extend it to mention the need to avoid unwanted interactions
between runtime PM and system-wide device suspend callbacks.
Fixes: 1e2ef05bb8cf8 ("PM: Limit race conditions between runtime PM and system sleep (v2)")
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Acked-by: Alan Stern <stern@rowland.harvard.edu>
Reported-by: Utkarsh H Patel <utkarsh.h.patel@intel.com>
Tested-by: Utkarsh H Patel <utkarsh.h.patel@intel.com>
Tested-by: Pengfei Xu <pengfei.xu@intel.com>
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/power/main.c | 16 ++++++++++------
1 file changed, 10 insertions(+), 6 deletions(-)
--- a/drivers/base/power/main.c
+++ b/drivers/base/power/main.c
@@ -1361,13 +1361,17 @@ static int __device_suspend(struct devic
}
/*
- * If a device configured to wake up the system from sleep states
- * has been suspended at run time and there's a resume request pending
- * for it, this is equivalent to the device signaling wakeup, so the
- * system suspend operation should be aborted.
+ * Wait for possible runtime PM transitions of the device in progress
+ * to complete and if there's a runtime resume request pending for it,
+ * resume it before proceeding with invoking the system-wide suspend
+ * callbacks for it.
+ *
+ * If the system-wide suspend callbacks below change the configuration
+ * of the device, they must disable runtime PM for it or otherwise
+ * ensure that its runtime-resume callbacks will not be confused by that
+ * change in case they are invoked going forward.
*/
- if (pm_runtime_barrier(dev) && device_may_wakeup(dev))
- pm_wakeup_event(dev, 0);
+ pm_runtime_barrier(dev);
if (pm_wakeup_pending()) {
dev->power.direct_complete = false;
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 53/62] device property: Fix the secondary firmware node handling in set_primary_fwnode()
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (51 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 52/62] PM: sleep: core: Fix the handling of pending runtime resume requests Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 54/62] USB: yurex: Fix bad gfp argument Greg Kroah-Hartman
` (9 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Heikki Krogerus, Rafael J. Wysocki
From: Heikki Krogerus <heikki.krogerus@linux.intel.com>
commit c15e1bdda4365a5f17cdadf22bf1c1df13884a9e upstream.
When the primary firmware node pointer is removed from a
device (set to NULL) the secondary firmware node pointer,
when it exists, is made the primary node for the device.
However, the secondary firmware node pointer of the original
primary firmware node is never cleared (set to NULL).
To avoid situation where the secondary firmware node pointer
is pointing to a non-existing object, clearing it properly
when the primary node is removed from a device in
set_primary_fwnode().
Fixes: 97badf873ab6 ("device property: Make it possible to use secondary firmware nodes")
Cc: All applicable <stable@vger.kernel.org>
Signed-off-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/base/core.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
--- a/drivers/base/core.c
+++ b/drivers/base/core.c
@@ -2344,17 +2344,21 @@ static inline bool fwnode_is_primary(str
*/
void set_primary_fwnode(struct device *dev, struct fwnode_handle *fwnode)
{
- if (fwnode) {
- struct fwnode_handle *fn = dev->fwnode;
+ struct fwnode_handle *fn = dev->fwnode;
+ if (fwnode) {
if (fwnode_is_primary(fn))
fn = fn->secondary;
fwnode->secondary = fn;
dev->fwnode = fwnode;
} else {
- dev->fwnode = fwnode_is_primary(dev->fwnode) ?
- dev->fwnode->secondary : NULL;
+ if (fwnode_is_primary(fn)) {
+ dev->fwnode = fn->secondary;
+ fn->secondary = NULL;
+ } else {
+ dev->fwnode = NULL;
+ }
}
}
EXPORT_SYMBOL_GPL(set_primary_fwnode);
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 54/62] USB: yurex: Fix bad gfp argument
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (52 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 53/62] device property: Fix the secondary firmware node handling in set_primary_fwnode() Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 55/62] usb: uas: Add quirk for PNY Pro Elite Greg Kroah-Hartman
` (8 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Alan Stern, syzbot+c2c3302f9c601a4b1be2
From: Alan Stern <stern@rowland.harvard.edu>
commit f176ede3a3bde5b398a6777a7f9ff091baa2d3ff upstream.
The syzbot fuzzer identified a bug in the yurex driver: It passes
GFP_KERNEL as a memory-allocation flag to usb_submit_urb() at a time
when its state is TASK_INTERRUPTIBLE, not TASK_RUNNING:
do not call blocking ops when !TASK_RUNNING; state=1 set at [<00000000370c7c68>] prepare_to_wait+0xb1/0x2a0 kernel/sched/wait.c:247
WARNING: CPU: 1 PID: 340 at kernel/sched/core.c:7253 __might_sleep+0x135/0x190
kernel/sched/core.c:7253
Kernel panic - not syncing: panic_on_warn set ...
CPU: 1 PID: 340 Comm: syz-executor677 Not tainted 5.8.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google
01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0xf6/0x16e lib/dump_stack.c:118
panic+0x2aa/0x6e1 kernel/panic.c:231
__warn.cold+0x20/0x50 kernel/panic.c:600
report_bug+0x1bd/0x210 lib/bug.c:198
handle_bug+0x41/0x80 arch/x86/kernel/traps.c:234
exc_invalid_op+0x14/0x40 arch/x86/kernel/traps.c:254
asm_exc_invalid_op+0x12/0x20 arch/x86/include/asm/idtentry.h:536
RIP: 0010:__might_sleep+0x135/0x190 kernel/sched/core.c:7253
Code: 65 48 8b 1c 25 40 ef 01 00 48 8d 7b 10 48 89 fe 48 c1 ee 03 80 3c 06 00 75
2b 48 8b 73 10 48 c7 c7 e0 9e 06 86 e8 ed 12 f6 ff <0f> 0b e9 46 ff ff ff e8 1f
b2 4b 00 e9 29 ff ff ff e8 15 b2 4b 00
RSP: 0018:ffff8881cdb77a28 EFLAGS: 00010282
RAX: 0000000000000000 RBX: ffff8881c6458000 RCX: 0000000000000000
RDX: ffff8881c6458000 RSI: ffffffff8129ec93 RDI: ffffed1039b6ef37
RBP: ffffffff86fdade2 R08: 0000000000000001 R09: ffff8881db32f54f
R10: 0000000000000000 R11: 0000000030343354 R12: 00000000000001f2
R13: 0000000000000000 R14: 0000000000000068 R15: ffffffff83c1b1aa
slab_pre_alloc_hook.constprop.0+0xea/0x200 mm/slab.h:498
slab_alloc_node mm/slub.c:2816 [inline]
slab_alloc mm/slub.c:2900 [inline]
kmem_cache_alloc_trace+0x46/0x220 mm/slub.c:2917
kmalloc include/linux/slab.h:554 [inline]
dummy_urb_enqueue+0x7a/0x880 drivers/usb/gadget/udc/dummy_hcd.c:1251
usb_hcd_submit_urb+0x2b2/0x22d0 drivers/usb/core/hcd.c:1547
usb_submit_urb+0xb4e/0x13e0 drivers/usb/core/urb.c:570
yurex_write+0x3ea/0x820 drivers/usb/misc/yurex.c:495
This patch changes the call to use GFP_ATOMIC instead of GFP_KERNEL.
Reported-and-tested-by: syzbot+c2c3302f9c601a4b1be2@syzkaller.appspotmail.com
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200810182954.GB307778@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/misc/yurex.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/misc/yurex.c
+++ b/drivers/usb/misc/yurex.c
@@ -510,7 +510,7 @@ static ssize_t yurex_write(struct file *
prepare_to_wait(&dev->waitq, &wait, TASK_INTERRUPTIBLE);
dev_dbg(&dev->interface->dev, "%s - submit %c\n", __func__,
dev->cntl_buffer[0]);
- retval = usb_submit_urb(dev->cntl_urb, GFP_KERNEL);
+ retval = usb_submit_urb(dev->cntl_urb, GFP_ATOMIC);
if (retval >= 0)
timeout = schedule_timeout(YUREX_WRITE_TIMEOUT);
finish_wait(&dev->waitq, &wait);
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 55/62] usb: uas: Add quirk for PNY Pro Elite
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (53 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 54/62] USB: yurex: Fix bad gfp argument Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 56/62] USB: quirks: Add no-lpm quirk for another Raydium touchscreen Greg Kroah-Hartman
` (7 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Thinh Nguyen
From: Thinh Nguyen <Thinh.Nguyen@synopsys.com>
commit 9a469bc9f32dd33c7aac5744669d21a023a719cd upstream.
PNY Pro Elite USB 3.1 Gen 2 device (SSD) doesn't respond to ATA_12
pass-through command (i.e. it just hangs). If it doesn't support this
command, it should respond properly to the host. Let's just add a quirk
to be able to move forward with other operations.
Cc: stable@vger.kernel.org
Signed-off-by: Thinh Nguyen <thinhn@synopsys.com>
Link: https://lore.kernel.org/r/2b0585228b003eedcc82db84697b31477df152e0.1597803605.git.thinhn@synopsys.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/unusual_uas.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -155,6 +155,13 @@ UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x99
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
US_FL_BROKEN_FUA),
+/* Reported-by: Thinh Nguyen <thinhn@synopsys.com> */
+UNUSUAL_DEV(0x154b, 0xf00d, 0x0000, 0x9999,
+ "PNY",
+ "Pro Elite SSD",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_ATA_1X),
+
/* Reported-by: Hans de Goede <hdegoede@redhat.com> */
UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
"VIA",
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 56/62] USB: quirks: Add no-lpm quirk for another Raydium touchscreen
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (54 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 55/62] usb: uas: Add quirk for PNY Pro Elite Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 57/62] USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge Greg Kroah-Hartman
` (6 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Kai-Heng Feng
From: Kai-Heng Feng <kai.heng.feng@canonical.com>
commit 5967116e8358899ebaa22702d09b0af57fef23e1 upstream.
There's another Raydium touchscreen needs the no-lpm quirk:
[ 1.339149] usb 1-9: New USB device found, idVendor=2386, idProduct=350e, bcdDevice= 0.00
[ 1.339150] usb 1-9: New USB device strings: Mfr=1, Product=2, SerialNumber=0
[ 1.339151] usb 1-9: Product: Raydium Touch System
[ 1.339152] usb 1-9: Manufacturer: Raydium Corporation
...
[ 6.450497] usb 1-9: can't set config #1, error -110
BugLink: https://bugs.launchpad.net/bugs/1889446
Signed-off-by: Kai-Heng Feng <kai.heng.feng@canonical.com>
Cc: stable <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200731051622.28643-1-kai.heng.feng@canonical.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/core/quirks.c | 2 ++
1 file changed, 2 insertions(+)
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -299,6 +299,8 @@ static const struct usb_device_id usb_qu
{ USB_DEVICE(0x2386, 0x3119), .driver_info = USB_QUIRK_NO_LPM },
+ { USB_DEVICE(0x2386, 0x350e), .driver_info = USB_QUIRK_NO_LPM },
+
/* DJI CineSSD */
{ USB_DEVICE(0x2ca3, 0x0031), .driver_info = USB_QUIRK_NO_LPM },
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 57/62] USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (55 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 56/62] USB: quirks: Add no-lpm quirk for another Raydium touchscreen Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 58/62] usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe() Greg Kroah-Hartman
` (5 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Brice Goglin, Alan Stern, Cyril Roelandt
From: Cyril Roelandt <tipecaml@gmail.com>
commit 9aa37788e7ebb3f489fb4b71ce07adadd444264a upstream.
This device does not support UAS properly and a similar entry already
exists in drivers/usb/storage/unusual_uas.h. Without this patch,
storage_probe() defers the handling of this device to UAS, which cannot
handle it either.
Tested-by: Brice Goglin <brice.goglin@gmail.com>
Fixes: bc3bdb12bbb3 ("usb-storage: Disable UAS on JMicron SATA enclosure")
Acked-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Signed-off-by: Cyril Roelandt <tipecaml@gmail.com>
Link: https://lore.kernel.org/r/20200825212231.46309-1-tipecaml@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/unusual_devs.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -2213,7 +2213,7 @@ UNUSUAL_DEV( 0x357d, 0x7788, 0x0114, 0x
"JMicron",
"USB to ATA/ATAPI Bridge",
USB_SC_DEVICE, USB_PR_DEVICE, NULL,
- US_FL_BROKEN_FUA ),
+ US_FL_BROKEN_FUA | US_FL_IGNORE_UAS ),
/* Reported by Andrey Rahmatullin <wrar@altlinux.org> */
UNUSUAL_DEV( 0x4102, 0x1020, 0x0100, 0x0100,
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 58/62] usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe()
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (56 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 57/62] USB: Ignore UAS for JMicron JMS567 ATA/ATAPI Bridge Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 59/62] usb: storage: Add unusual_uas entry for Sony PSZ drives Greg Kroah-Hartman
` (4 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Zhang Shengju, Tang Bin, Krzysztof Kozlowski
From: Tang Bin <tangbin@cmss.chinamobile.com>
commit 1d4169834628d18b2392a2da92b7fbf5e8e2ce89 upstream.
If the function platform_get_irq() failed, the negative value
returned will not be detected here. So fix error handling in
exynos_ohci_probe(). And when get irq failed, the function
platform_get_irq() logs an error message, so remove redundant
message here.
Fixes: 62194244cf87 ("USB: Add Samsung Exynos OHCI diver")
Signed-off-by: Zhang Shengju <zhangshengju@cmss.chinamobile.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Tang Bin <tangbin@cmss.chinamobile.com>
Reviewed-by: Krzysztof Kozlowski <krzk@kernel.org>
Link: https://lore.kernel.org/r/20200826144931.1828-1-tangbin@cmss.chinamobile.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/host/ohci-exynos.c | 5 ++---
1 file changed, 2 insertions(+), 3 deletions(-)
--- a/drivers/usb/host/ohci-exynos.c
+++ b/drivers/usb/host/ohci-exynos.c
@@ -166,9 +166,8 @@ skip_phy:
hcd->rsrc_len = resource_size(res);
irq = platform_get_irq(pdev, 0);
- if (!irq) {
- dev_err(&pdev->dev, "Failed to get IRQ\n");
- err = -ENODEV;
+ if (irq < 0) {
+ err = irq;
goto fail_io;
}
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 59/62] usb: storage: Add unusual_uas entry for Sony PSZ drives
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (57 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 58/62] usb: host: ohci-exynos: Fix error handling in exynos_ohci_probe() Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 60/62] btrfs: check the right error variable in btrfs_del_dir_entries_in_log Greg Kroah-Hartman
` (3 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Alan Stern, Till Dörges
From: Alan Stern <stern@rowland.harvard.edu>
commit 20934c0de13b49a072fb1e0ca79fe0fe0e40eae5 upstream.
The PSZ-HA* family of USB disk drives from Sony can't handle the
REPORT OPCODES command when using the UAS protocol. This patch adds
an appropriate quirks entry.
Reported-and-tested-by: Till Dörges <doerges@pre-sense.de>
Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
CC: <stable@vger.kernel.org>
Link: https://lore.kernel.org/r/20200826143229.GB400430@rowland.harvard.edu
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/usb/storage/unusual_uas.h | 7 +++++++
1 file changed, 7 insertions(+)
--- a/drivers/usb/storage/unusual_uas.h
+++ b/drivers/usb/storage/unusual_uas.h
@@ -40,6 +40,13 @@
* and don't forget to CC: the USB development list <linux-usb@vger.kernel.org>
*/
+/* Reported-by: Till Dörges <doerges@pre-sense.de> */
+UNUSUAL_DEV(0x054c, 0x087d, 0x0000, 0x9999,
+ "Sony",
+ "PSZ-HA*",
+ USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ US_FL_NO_REPORT_OPCODES),
+
/* Reported-by: Julian Groß <julian.g@posteo.de> */
UNUSUAL_DEV(0x059f, 0x105f, 0x0000, 0x9999,
"LaCie",
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 60/62] btrfs: check the right error variable in btrfs_del_dir_entries_in_log
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (58 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 59/62] usb: storage: Add unusual_uas entry for Sony PSZ drives Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 61/62] HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage() Greg Kroah-Hartman
` (2 subsequent siblings)
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, Filipe Manana, Josef Bacik,
David Sterba, Sasha Levin
From: Josef Bacik <josef@toxicpanda.com>
[ Upstream commit fb2fecbad50964b9f27a3b182e74e437b40753ef ]
With my new locking code dbench is so much faster that I tripped over a
transaction abort from ENOSPC. This turned out to be because
btrfs_del_dir_entries_in_log was checking for ret == -ENOSPC, but this
function sets err on error, and returns err. So instead of properly
marking the inode as needing a full commit, we were returning -ENOSPC
and aborting in __btrfs_unlink_inode. Fix this by checking the proper
variable so that we return the correct thing in the case of ENOSPC.
The ENOENT needs to be checked, because btrfs_lookup_dir_item_index()
can return -ENOENT if the dir item isn't in the tree log (which would
happen if we hadn't fsync'ed this guy). We actually handle that case in
__btrfs_unlink_inode, so it's an expected error to get back.
Fixes: 4a500fd178c8 ("Btrfs: Metadata ENOSPC handling for tree log")
CC: stable@vger.kernel.org # 4.4+
Reviewed-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: David Sterba <dsterba@suse.com>
[ add note and comment about ENOENT ]
Signed-off-by: David Sterba <dsterba@suse.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
fs/btrfs/tree-log.c | 10 ++++++----
1 file changed, 6 insertions(+), 4 deletions(-)
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index 820d3b5bc4150..8f0f91de436d5 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -3169,11 +3169,13 @@ int btrfs_del_dir_entries_in_log(struct btrfs_trans_handle *trans,
btrfs_free_path(path);
out_unlock:
mutex_unlock(&BTRFS_I(dir)->log_mutex);
- if (ret == -ENOSPC) {
+ if (err == -ENOSPC) {
btrfs_set_log_full_commit(root->fs_info, trans);
- ret = 0;
- } else if (ret < 0)
- btrfs_abort_transaction(trans, root, ret);
+ err = 0;
+ } else if (err < 0 && err != -ENOENT) {
+ /* ENOENT can be returned if the entry hasn't been fsynced yet */
+ btrfs_abort_transaction(trans, root, err);
+ }
btrfs_end_log_trans(root);
--
2.25.1
^ permalink raw reply related [flat|nested] 70+ messages in thread* [PATCH 4.4 61/62] HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage()
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (59 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 60/62] btrfs: check the right error variable in btrfs_del_dir_entries_in_log Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 15:10 ` [PATCH 4.4 62/62] ALSA: usb-audio: Update documentation comment for MS2109 quirk Greg Kroah-Hartman
2020-09-01 18:58 ` [PATCH 4.4 00/62] 4.4.235-rc1 review Guenter Roeck
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel
Cc: Greg Kroah-Hartman, stable, syzbot+34ee1b45d88571c2fa8b,
Dan Carpenter, Peilin Ye, Jiri Kosina
From: Peilin Ye <yepeilin.cs@gmail.com>
commit 25a097f5204675550afb879ee18238ca917cba7a upstream.
`uref->usage_index` is not always being properly checked, causing
hiddev_ioctl_usage() to go out of bounds under some cases. Fix it.
Reported-by: syzbot+34ee1b45d88571c2fa8b@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?id=f2aebe90b8c56806b050a20b36f51ed6acabe802
Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Peilin Ye <yepeilin.cs@gmail.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hid/usbhid/hiddev.c | 4 ++++
1 file changed, 4 insertions(+)
--- a/drivers/hid/usbhid/hiddev.c
+++ b/drivers/hid/usbhid/hiddev.c
@@ -554,12 +554,16 @@ static noinline int hiddev_ioctl_usage(s
switch (cmd) {
case HIDIOCGUSAGE:
+ if (uref->usage_index >= field->report_count)
+ goto inval;
uref->value = field->value[uref->usage_index];
if (copy_to_user(user_arg, uref, sizeof(*uref)))
goto fault;
goto goodreturn;
case HIDIOCSUSAGE:
+ if (uref->usage_index >= field->report_count)
+ goto inval;
field->value[uref->usage_index] = uref->value;
goto goodreturn;
^ permalink raw reply [flat|nested] 70+ messages in thread* [PATCH 4.4 62/62] ALSA: usb-audio: Update documentation comment for MS2109 quirk
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (60 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 61/62] HID: hiddev: Fix slab-out-of-bounds write in hiddev_ioctl_usage() Greg Kroah-Hartman
@ 2020-09-01 15:10 ` Greg Kroah-Hartman
2020-09-01 18:58 ` [PATCH 4.4 00/62] 4.4.235-rc1 review Guenter Roeck
62 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-01 15:10 UTC (permalink / raw)
To: linux-kernel; +Cc: Greg Kroah-Hartman, stable, Hector Martin, Takashi Iwai
From: Hector Martin <marcan@marcan.st>
commit 74a2a7de81a2ef20732ec02087314e92692a7a1b upstream.
As the recent fix addressed the channel swap problem more properly,
update the comment as well.
Fixes: 1b7ecc241a67 ("ALSA: usb-audio: work around streaming quirk for MacroSilicon MS2109")
Signed-off-by: Hector Martin <marcan@marcan.st>
Link: https://lore.kernel.org/r/20200816084431.102151-1-marcan@marcan.st
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
sound/usb/quirks-table.h | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/sound/usb/quirks-table.h
+++ b/sound/usb/quirks-table.h
@@ -3331,8 +3331,8 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge
* they pretend to be 96kHz mono as a workaround for stereo being broken
* by that...
*
- * They also have swapped L-R channels, but that's for userspace to deal
- * with.
+ * They also have an issue with initial stream alignment that causes the
+ * channels to be swapped and out of phase, which is dealt with in quirks.c.
*/
{
.match_flags = USB_DEVICE_ID_MATCH_DEVICE |
^ permalink raw reply [flat|nested] 70+ messages in thread* Re: [PATCH 4.4 00/62] 4.4.235-rc1 review
2020-09-01 15:09 [PATCH 4.4 00/62] 4.4.235-rc1 review Greg Kroah-Hartman
` (61 preceding siblings ...)
2020-09-01 15:10 ` [PATCH 4.4 62/62] ALSA: usb-audio: Update documentation comment for MS2109 quirk Greg Kroah-Hartman
@ 2020-09-01 18:58 ` Guenter Roeck
2020-09-02 7:37 ` Greg Kroah-Hartman
62 siblings, 1 reply; 70+ messages in thread
From: Guenter Roeck @ 2020-09-01 18:58 UTC (permalink / raw)
To: Greg Kroah-Hartman, linux-kernel
Cc: torvalds, akpm, shuah, patches, ben.hutchings, lkft-triage, stable
On 9/1/20 8:09 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.4.235 release.
> There are 62 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Thu, 03 Sep 2020 15:09:01 +0000.
> Anything received after that time might be too late.
>
Building powerpc:defconfig ... failed
--------------
Error log:
arch/powerpc/perf/core-book3s.c: In function ‘record_and_restart’:
arch/powerpc/perf/core-book3s.c:2045:7: error: implicit declaration of function ‘perf_event_account_interrupt’; did you mean ‘perf_event_interrupt’? [-Werror=implicit-function-declaration]
if (perf_event_account_interrupt(event))
Caused by commit 91d6f90ac6d5 ("powerpc/perf: Fix soft lockups due
to missed interrupt accounting"). perf_event_account_interrupt()
does not exist in v4.4.y.
Guenter
^ permalink raw reply [flat|nested] 70+ messages in thread* Re: [PATCH 4.4 00/62] 4.4.235-rc1 review
2020-09-01 18:58 ` [PATCH 4.4 00/62] 4.4.235-rc1 review Guenter Roeck
@ 2020-09-02 7:37 ` Greg Kroah-Hartman
0 siblings, 0 replies; 70+ messages in thread
From: Greg Kroah-Hartman @ 2020-09-02 7:37 UTC (permalink / raw)
To: Guenter Roeck
Cc: linux-kernel, torvalds, akpm, shuah, patches, ben.hutchings,
lkft-triage, stable
On Tue, Sep 01, 2020 at 11:58:21AM -0700, Guenter Roeck wrote:
> On 9/1/20 8:09 AM, Greg Kroah-Hartman wrote:
> > This is the start of the stable review cycle for the 4.4.235 release.
> > There are 62 patches in this series, all will be posted as a response
> > to this one. If anyone has any issues with these being applied, please
> > let me know.
> >
> > Responses should be made by Thu, 03 Sep 2020 15:09:01 +0000.
> > Anything received after that time might be too late.
> >
>
> Building powerpc:defconfig ... failed
> --------------
> Error log:
> arch/powerpc/perf/core-book3s.c: In function ‘record_and_restart’:
> arch/powerpc/perf/core-book3s.c:2045:7: error: implicit declaration of function ‘perf_event_account_interrupt’; did you mean ‘perf_event_interrupt’? [-Werror=implicit-function-declaration]
> if (perf_event_account_interrupt(event))
>
> Caused by commit 91d6f90ac6d5 ("powerpc/perf: Fix soft lockups due
> to missed interrupt accounting"). perf_event_account_interrupt()
> does not exist in v4.4.y.
Ah, good catch. Sasha, I thought your builder would have got this one?
Anyway, now dropped, I'll push out a -rc2 for this as well soon.
thanks,
greg k-h
^ permalink raw reply [flat|nested] 70+ messages in thread