mm-commits.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* incoming
@ 2020-06-26  3:28 Andrew Morton
  2020-06-26  3:29 ` [patch 01/32] openrisc: fix boot oops when DEBUG_VM is enabled Andrew Morton
                   ` (64 more replies)
  0 siblings, 65 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:28 UTC (permalink / raw)
  To: Linus Torvalds; +Cc: linux-mm, mm-commits

32 patches, based on 908f7d12d3ba51dfe0449b9723199b423f97ca9a.

Subsystems affected by this patch series:

  hotfixes
  mm/pagealloc
  kexec
  ocfs2
  lib
  misc
  mm/slab
  mm/slab
  mm/slub
  mm/swap
  mm/pagemap
  mm/vmalloc
  mm/memcg
  mm/gup
  mm/thp
  mm/vmscan
  x86
  mm/memory-hotplug
  MAINTAINERS

Subsystem: hotfixes

    Stafford Horne <shorne@gmail.com>:
      openrisc: fix boot oops when DEBUG_VM is enabled

    Michal Hocko <mhocko@suse.com>:
      mm: do_swap_page(): fix up the error code

Subsystem: mm/pagealloc

    Vlastimil Babka <vbabka@suse.cz>:
      mm, compaction: make capture control handling safe wrt interrupts

Subsystem: kexec

    Lianbo Jiang <lijiang@redhat.com>:
      kexec: do not verify the signature without the lockdown or mandatory signature

Subsystem: ocfs2

    Junxiao Bi <junxiao.bi@oracle.com>:
    Patch series "ocfs2: fix nfsd over ocfs2 issues", v2:
      ocfs2: avoid inode removal while nfsd is accessing it
      ocfs2: load global_inode_alloc
      ocfs2: fix panic on nfs server over ocfs2
      ocfs2: fix value of OCFS2_INVALID_SLOT

Subsystem: lib

    Randy Dunlap <rdunlap@infradead.org>:
      lib: fix test_hmm.c reference after free

Subsystem: misc

    Rikard Falkeborn <rikard.falkeborn@gmail.com>:
      linux/bits.h: fix unsigned less than zero warnings

Subsystem: mm/slab

    Waiman Long <longman@redhat.com>:
      mm, slab: fix sign conversion problem in memcg_uncharge_slab()

Subsystem: mm/slab

    Waiman Long <longman@redhat.com>:
      mm/slab: use memzero_explicit() in kzfree()

Subsystem: mm/slub

    Sebastian Andrzej Siewior <bigeasy@linutronix.de>:
      slub: cure list_slab_objects() from double fix

Subsystem: mm/swap

    Hugh Dickins <hughd@google.com>:
      mm: fix swap cache node allocation mask

Subsystem: mm/pagemap

    Arjun Roy <arjunroy@google.com>:
      mm/memory.c: properly pte_offset_map_lock/unlock in vm_insert_pages()

    Christophe Leroy <christophe.leroy@csgroup.eu>:
      mm/debug_vm_pgtable: fix build failure with powerpc 8xx

    Stephen Rothwell <sfr@canb.auug.org.au>:
      make asm-generic/cacheflush.h more standalone

    Nathan Chancellor <natechancellor@gmail.com>:
      media: omap3isp: remove cacheflush.h

Subsystem: mm/vmalloc

    Masanari Iida <standby24x7@gmail.com>:
      mm/vmalloc.c: fix a warning while make xmldocs

Subsystem: mm/memcg

    Johannes Weiner <hannes@cmpxchg.org>:
      mm: memcontrol: handle div0 crash race condition in memory.low

    Muchun Song <songmuchun@bytedance.com>:
      mm/memcontrol.c: add missed css_put()

    Chris Down <chris@chrisdown.name>:
      mm/memcontrol.c: prevent missed memory.low load tears

Subsystem: mm/gup

    Souptick Joarder <jrdr.linux@gmail.com>:
      docs: mm/gup: minor documentation update

Subsystem: mm/thp

    Yang Shi <yang.shi@linux.alibaba.com>:
      doc: THP CoW fault no longer allocate THP

Subsystem: mm/vmscan

    Johannes Weiner <hannes@cmpxchg.org>:
    Patch series "fix for "mm: balance LRU lists based on relative thrashing" patchset":
      mm: workingset: age nonresident information alongside anonymous pages

    Joonsoo Kim <iamjoonsoo.kim@lge.com>:
      mm/swap: fix for "mm: workingset: age nonresident information alongside anonymous pages"
      mm/memory: fix IO cost for anonymous page

Subsystem: x86

    Christoph Hellwig <hch@lst.de>:
    Patch series "fix a hyperv W^X violation and remove vmalloc_exec":
      x86/hyperv: allocate the hypercall page with only read and execute bits
      arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page
      mm: remove vmalloc_exec

Subsystem: mm/memory-hotplug

    Ben Widawsky <ben.widawsky@intel.com>:
      mm/memory_hotplug.c: fix false softlockup during pfn range removal

Subsystem: MAINTAINERS

    Luc Van Oostenryck <luc.vanoostenryck@gmail.com>:
      MAINTAINERS: update info for sparse

 Documentation/admin-guide/cgroup-v2.rst    |    4 +-
 Documentation/admin-guide/mm/transhuge.rst |    3 -
 Documentation/core-api/pin_user_pages.rst  |    2 -
 MAINTAINERS                                |    4 +-
 arch/arm64/kernel/probes/kprobes.c         |   12 +------
 arch/openrisc/kernel/dma.c                 |    5 +++
 arch/x86/hyperv/hv_init.c                  |    4 +-
 arch/x86/include/asm/pgtable_types.h       |    2 +
 drivers/media/platform/omap3isp/isp.c      |    2 -
 drivers/media/platform/omap3isp/ispvideo.c |    1 
 fs/ocfs2/dlmglue.c                         |   17 ++++++++++
 fs/ocfs2/ocfs2.h                           |    1 
 fs/ocfs2/ocfs2_fs.h                        |    4 +-
 fs/ocfs2/suballoc.c                        |    9 +++--
 include/asm-generic/cacheflush.h           |    5 +++
 include/linux/bits.h                       |    3 +
 include/linux/mmzone.h                     |    4 +-
 include/linux/swap.h                       |    1 
 include/linux/vmalloc.h                    |    1 
 kernel/kexec_file.c                        |   36 ++++------------------
 kernel/module.c                            |    4 +-
 lib/test_hmm.c                             |    3 -
 mm/compaction.c                            |   17 ++++++++--
 mm/debug_vm_pgtable.c                      |    4 +-
 mm/memcontrol.c                            |   18 ++++++++---
 mm/memory.c                                |   33 +++++++++++++-------
 mm/memory_hotplug.c                        |   13 ++++++--
 mm/nommu.c                                 |   17 ----------
 mm/slab.h                                  |    4 +-
 mm/slab_common.c                           |    2 -
 mm/slub.c                                  |   19 ++---------
 mm/swap.c                                  |    3 -
 mm/swap_state.c                            |    4 +-
 mm/vmalloc.c                               |   21 -------------
 mm/vmscan.c                                |    3 +
 mm/workingset.c                            |   46 +++++++++++++++++------------
 36 files changed, 168 insertions(+), 163 deletions(-)

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 01/32] openrisc: fix boot oops when DEBUG_VM is enabled
  2020-06-26  3:28 incoming Andrew Morton
@ 2020-06-26  3:29 ` Andrew Morton
  2020-06-26  3:29 ` [patch 02/32] mm: do_swap_page(): fix up the error code Andrew Morton
                   ` (63 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:29 UTC (permalink / raw)
  To: akpm, daniel.m.jordan, jgg, jonas, mm-commits, robin.murphy,
	shorne, stefan.kristiansson, steven.price, thellstrom, torvalds,
	vbabka, walken

From: Stafford Horne <shorne@gmail.com>
Subject: openrisc: fix boot oops when DEBUG_VM is enabled

Since v5.8-rc1 OpenRISC Linux fails to boot when DEBUG_VM is enabled. 
This has been bisected to commit 42fc541404f2 ("mmap locking API: add
mmap_assert_locked() and mmap_assert_write_locked()").

The added locking checks exposed the issue that OpenRISC was not taking
this mmap lock when during page walks for DMA operations.  This patch
locks and unlocks the mmap lock for page walking.

Link: http://lkml.kernel.org/r/20200617090247.1680188-1-shorne@gmail.com
Fixes: 42fc541404f2 ("mmap locking API: add mmap_assert_locked() and mmap_assert_write_locked()"
Signed-off-by: Stafford Horne <shorne@gmail.com>
Reviewed-by: Michel Lespinasse <walken@google.com>
Cc: Jonas Bonn <jonas@southpole.se>
Cc: Stefan Kristiansson <stefan.kristiansson@saunalahti.fi>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Steven Price <steven.price@arm.com>
Cc: Thomas Hellstrom <thellstrom@vmware.com>
Cc: Robin Murphy <robin.murphy@arm.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Daniel Jordan <daniel.m.jordan@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 arch/openrisc/kernel/dma.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/arch/openrisc/kernel/dma.c~openrisc-fix-boot-oops-when-debug_vm-is-enabled
+++ a/arch/openrisc/kernel/dma.c
@@ -74,8 +74,11 @@ void *arch_dma_set_uncached(void *cpu_ad
 	 * We need to iterate through the pages, clearing the dcache for
 	 * them and setting the cache-inhibit bit.
 	 */
+	mmap_read_lock(&init_mm);
 	error = walk_page_range(&init_mm, va, va + size, &set_nocache_walk_ops,
 			NULL);
+	mmap_read_unlock(&init_mm);
+
 	if (error)
 		return ERR_PTR(error);
 	return cpu_addr;
@@ -85,9 +88,11 @@ void arch_dma_clear_uncached(void *cpu_a
 {
 	unsigned long va = (unsigned long)cpu_addr;
 
+	mmap_read_lock(&init_mm);
 	/* walk_page_range shouldn't be able to fail here */
 	WARN_ON(walk_page_range(&init_mm, va, va + size,
 			&clear_nocache_walk_ops, NULL));
+	mmap_read_unlock(&init_mm);
 }
 
 void arch_sync_dma_for_device(phys_addr_t addr, size_t size,
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 02/32] mm: do_swap_page(): fix up the error code
  2020-06-26  3:28 incoming Andrew Morton
  2020-06-26  3:29 ` [patch 01/32] openrisc: fix boot oops when DEBUG_VM is enabled Andrew Morton
@ 2020-06-26  3:29 ` Andrew Morton
  2020-06-26  3:29 ` [patch 03/32] mm, compaction: make capture control handling safe wrt interrupts Andrew Morton
                   ` (62 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:29 UTC (permalink / raw)
  To: akpm, alex.shi, guro, hannes, hughd, js1304, kirill, mhocko,
	mm-commits, shakeelb, torvalds

From: Michal Hocko <mhocko@suse.com>
Subject: mm: do_swap_page(): fix up the error code

do_swap_page() returns error codes from the VM_FAULT* space.  try_charge()
might return -ENOMEM, though, and then do_swap_page() simply returns 0
which means a success.

We almost never return ENOMEM for GFP_KERNEL single page charge.  Except
for async OOM handling (oom_disabled v1).  So this needs translation to
VM_FAULT_OOM otherwise the the page fault path will not notify the
userspace and wait for an action.

Link: http://lkml.kernel.org/r/20200617090238.GL9499@dhcp22.suse.cz
Fixes: 4c6355b25e8b ("mm: memcontrol: charge swapin pages on instantiation")
Signed-off-by: Michal Hocko <mhocko@suse.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Alex Shi <alex.shi@linux.alibaba.com>
Cc: Joonsoo Kim <js1304@gmail.com>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
Cc: Roman Gushchin <guro@fb.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/memory.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/mm/memory.c~mm-do_swap_page-fix-up-the-error-code-instantiation
+++ a/mm/memory.c
@@ -3140,8 +3140,10 @@ vm_fault_t do_swap_page(struct vm_fault
 				err = mem_cgroup_charge(page, vma->vm_mm,
 							GFP_KERNEL);
 				ClearPageSwapCache(page);
-				if (err)
+				if (err) {
+					ret = VM_FAULT_OOM;
 					goto out_page;
+				}
 
 				lru_cache_add(page);
 				swap_readpage(page, true);
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 03/32] mm, compaction: make capture control handling safe wrt interrupts
  2020-06-26  3:28 incoming Andrew Morton
  2020-06-26  3:29 ` [patch 01/32] openrisc: fix boot oops when DEBUG_VM is enabled Andrew Morton
  2020-06-26  3:29 ` [patch 02/32] mm: do_swap_page(): fix up the error code Andrew Morton
@ 2020-06-26  3:29 ` Andrew Morton
  2020-06-26  3:29 ` [patch 04/32] kexec: do not verify the signature without the lockdown or mandatory signature Andrew Morton
                   ` (61 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:29 UTC (permalink / raw)
  To: akpm, alex.shi, hughd, liwang, mgorman, mm-commits, stable,
	torvalds, vbabka

From: Vlastimil Babka <vbabka@suse.cz>
Subject: mm, compaction: make capture control handling safe wrt interrupts

Hugh reports:

: While stressing compaction, one run oopsed on NULL capc->cc in
: __free_one_page()'s task_capc(zone): compact_zone_order() had been
: interrupted, and a page was being freed in the return from interrupt.
: 
: Though you would not expect it from the source, both gccs I was using (a
: 4.8.1 and a 7.5.0) had chosen to compile compact_zone_order() with the
: ".cc = &cc" implemented by mov %rbx,-0xb0(%rbp) immediately before callq
: compact_zone - long after the "current->capture_control = &capc".  An
: interrupt in between those finds capc->cc NULL (zeroed by an earlier rep
: stos).
: 
: This could presumably be fixed by a barrier() before setting
: current->capture_control in compact_zone_order(); but would also need more
: care on return from compact_zone(), in order not to risk leaking a page
: captured by interrupt just before capture_control is reset.
: 
: Maybe that is the preferable fix, but I felt safer for task_capc() to
: exclude the rather surprising possibility of capture at interrupt time.

I have checked that gcc10 also behaves the same.

The advantage of fix in compact_zone_order() is that we don't add another
test in the page freeing hot path, and that it might prevent future
problems if we stop exposing pointers to uninitialized structures in
current task.

So this patch implements the suggestion for compact_zone_order() with
barrier() (and WRITE_ONCE() to prevent store tearing) for setting
current->capture_control, and prevents page leaking with
WRITE_ONCE/READ_ONCE in the proper order.

Link: http://lkml.kernel.org/r/20200616082649.27173-1-vbabka@suse.cz
Fixes: 5e1f0f098b46 ("mm, compaction: capture a page under direct compaction")
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Reported-by: Hugh Dickins <hughd@google.com>
Suggested-by: Hugh Dickins <hughd@google.com>
Acked-by: Hugh Dickins <hughd@google.com>
Cc: Alex Shi <alex.shi@linux.alibaba.com>
Cc: Li Wang <liwang@redhat.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: <stable@vger.kernel.org>	[5.1+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/compaction.c |   17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

--- a/mm/compaction.c~mm-compaction-make-capture-control-handling-safe-wrt-interrupts
+++ a/mm/compaction.c
@@ -2316,15 +2316,26 @@ static enum compact_result compact_zone_
 		.page = NULL,
 	};
 
-	current->capture_control = &capc;
+	/*
+	 * Make sure the structs are really initialized before we expose the
+	 * capture control, in case we are interrupted and the interrupt handler
+	 * frees a page.
+	 */
+	barrier();
+	WRITE_ONCE(current->capture_control, &capc);
 
 	ret = compact_zone(&cc, &capc);
 
 	VM_BUG_ON(!list_empty(&cc.freepages));
 	VM_BUG_ON(!list_empty(&cc.migratepages));
 
-	*capture = capc.page;
-	current->capture_control = NULL;
+	/*
+	 * Make sure we hide capture control first before we read the captured
+	 * page pointer, otherwise an interrupt could free and capture a page
+	 * and we would leak it.
+	 */
+	WRITE_ONCE(current->capture_control, NULL);
+	*capture = READ_ONCE(capc.page);
 
 	return ret;
 }
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 04/32] kexec: do not verify the signature without the lockdown or mandatory signature
  2020-06-26  3:28 incoming Andrew Morton
                   ` (2 preceding siblings ...)
  2020-06-26  3:29 ` [patch 03/32] mm, compaction: make capture control handling safe wrt interrupts Andrew Morton
@ 2020-06-26  3:29 ` Andrew Morton
  2020-06-26  3:29 ` [patch 05/32] ocfs2: avoid inode removal while nfsd is accessing it Andrew Morton
                   ` (60 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:29 UTC (permalink / raw)
  To: akpm, bhe, dyoung, ebiederm, jbohac, jmorris, lijiang, mjg59,
	mm-commits, torvalds

From: Lianbo Jiang <lijiang@redhat.com>
Subject: kexec: do not verify the signature without the lockdown or mandatory signature

Signature verification is an important security feature, to protect system
from being attacked with a kernel of unknown origin.  Kexec rebooting is a
way to replace the running kernel, hence need be secured carefully.

In the current code of handling signature verification of kexec kernel,
the logic is very twisted.  It mixes signature verification, IMA signature
appraising and kexec lockdown.

If there is no KEXEC_SIG_FORCE, kexec kernel image doesn't have one of
signature, the supported crypto, and key, we don't think this is wrong,
Unless kexec lockdown is executed.  IMA is considered as another kind of
signature appraising method.

If kexec kernel image has signature/crypto/key, it has to go through the
signature verification and pass.  Otherwise it's seen as verification
failure, and won't be loaded.

Seems kexec kernel image with an unqualified signature is even worse than
those w/o signature at all, this sounds very unreasonable.  E.g.  If
people get a unsigned kernel to load, or a kernel signed with expired key,
which one is more dangerous?

So, here, let's simplify the logic to improve code readability.  If the
KEXEC_SIG_FORCE enabled or kexec lockdown enabled, signature verification
is mandated.  Otherwise, we lift the bar for any kernel image.

Link: http://lkml.kernel.org/r/20200602045952.27487-1-lijiang@redhat.com
Signed-off-by: Lianbo Jiang <lijiang@redhat.com>
Reviewed-by: Jiri Bohac <jbohac@suse.cz>
Acked-by: Dave Young <dyoung@redhat.com>
Acked-by: Baoquan He <bhe@redhat.com>
Cc: James Morris <jmorris@namei.org>
Cc: Matthew Garrett <mjg59@google.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 kernel/kexec_file.c |   36 +++++++-----------------------------
 1 file changed, 7 insertions(+), 29 deletions(-)

--- a/kernel/kexec_file.c~kexec-do-not-verify-the-signature-without-the-lockdown-or-mandatory-signature
+++ a/kernel/kexec_file.c
@@ -181,34 +181,19 @@ void kimage_file_post_load_cleanup(struc
 static int
 kimage_validate_signature(struct kimage *image)
 {
-	const char *reason;
 	int ret;
 
 	ret = arch_kexec_kernel_verify_sig(image, image->kernel_buf,
 					   image->kernel_buf_len);
-	switch (ret) {
-	case 0:
-		break;
-
-		/* Certain verification errors are non-fatal if we're not
-		 * checking errors, provided we aren't mandating that there
-		 * must be a valid signature.
-		 */
-	case -ENODATA:
-		reason = "kexec of unsigned image";
-		goto decide;
-	case -ENOPKG:
-		reason = "kexec of image with unsupported crypto";
-		goto decide;
-	case -ENOKEY:
-		reason = "kexec of image with unavailable key";
-	decide:
+	if (ret) {
+
 		if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) {
-			pr_notice("%s rejected\n", reason);
+			pr_notice("Enforced kernel signature verification failed (%d).\n", ret);
 			return ret;
 		}
 
-		/* If IMA is guaranteed to appraise a signature on the kexec
+		/*
+		 * If IMA is guaranteed to appraise a signature on the kexec
 		 * image, permit it even if the kernel is otherwise locked
 		 * down.
 		 */
@@ -216,17 +201,10 @@ kimage_validate_signature(struct kimage
 		    security_locked_down(LOCKDOWN_KEXEC))
 			return -EPERM;
 
-		return 0;

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 05/32] ocfs2: avoid inode removal while nfsd is accessing it
  2020-06-26  3:28 incoming Andrew Morton
                   ` (3 preceding siblings ...)
  2020-06-26  3:29 ` [patch 04/32] kexec: do not verify the signature without the lockdown or mandatory signature Andrew Morton
@ 2020-06-26  3:29 ` Andrew Morton
  2020-06-26  3:29 ` [patch 06/32] ocfs2: load global_inode_alloc Andrew Morton
                   ` (59 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:29 UTC (permalink / raw)
  To: akpm, gechangwei, ghe, jlbec, joseph.qi, junxiao.bi, mark,
	mm-commits, piaojun, stable, torvalds

From: Junxiao Bi <junxiao.bi@oracle.com>
Subject: ocfs2: avoid inode removal while nfsd is accessing it

Patch series "ocfs2: fix nfsd over ocfs2 issues", v2.

This is a series of patches to fix issues on nfsd over ocfs2.  patch 1 is
to avoid inode removed while nfsd access it patch 2 & 3 is to fix a panic
issue.


This patch (of 4):

When nfsd is getting file dentry using handle or parent dentry of some
dentry, one cluster lock is used to avoid inode removed from other node,
but it still could be removed from local node, so use a rw lock to avoid
this.

Link: http://lkml.kernel.org/r/20200616183829.87211-1-junxiao.bi@oracle.com
Link: http://lkml.kernel.org/r/20200616183829.87211-2-junxiao.bi@oracle.com
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 fs/ocfs2/dlmglue.c |   17 ++++++++++++++++-
 fs/ocfs2/ocfs2.h   |    1 +
 2 files changed, 17 insertions(+), 1 deletion(-)

--- a/fs/ocfs2/dlmglue.c~ocfs2-avoid-inode-removed-while-nfsd-access-it
+++ a/fs/ocfs2/dlmglue.c
@@ -689,6 +689,12 @@ static void ocfs2_nfs_sync_lock_res_init
 				   &ocfs2_nfs_sync_lops, osb);
 }
 
+static void ocfs2_nfs_sync_lock_init(struct ocfs2_super *osb)
+{
+	ocfs2_nfs_sync_lock_res_init(&osb->osb_nfs_sync_lockres, osb);
+	init_rwsem(&osb->nfs_sync_rwlock);
+}
+
 void ocfs2_trim_fs_lock_res_init(struct ocfs2_super *osb)
 {
 	struct ocfs2_lock_res *lockres = &osb->osb_trim_fs_lockres;
@@ -2855,6 +2861,11 @@ int ocfs2_nfs_sync_lock(struct ocfs2_sup
 	if (ocfs2_is_hard_readonly(osb))
 		return -EROFS;
 
+	if (ex)
+		down_write(&osb->nfs_sync_rwlock);
+	else
+		down_read(&osb->nfs_sync_rwlock);
+
 	if (ocfs2_mount_local(osb))
 		return 0;
 
@@ -2873,6 +2884,10 @@ void ocfs2_nfs_sync_unlock(struct ocfs2_
 	if (!ocfs2_mount_local(osb))
 		ocfs2_cluster_unlock(osb, lockres,
 				     ex ? LKM_EXMODE : LKM_PRMODE);
+	if (ex)
+		up_write(&osb->nfs_sync_rwlock);
+	else
+		up_read(&osb->nfs_sync_rwlock);
 }
 
 int ocfs2_trim_fs_lock(struct ocfs2_super *osb,
@@ -3340,7 +3355,7 @@ int ocfs2_dlm_init(struct ocfs2_super *o
 local:
 	ocfs2_super_lock_res_init(&osb->osb_super_lockres, osb);
 	ocfs2_rename_lock_res_init(&osb->osb_rename_lockres, osb);
-	ocfs2_nfs_sync_lock_res_init(&osb->osb_nfs_sync_lockres, osb);
+	ocfs2_nfs_sync_lock_init(osb);
 	ocfs2_orphan_scan_lock_res_init(&osb->osb_orphan_scan.os_lockres, osb);
 
 	osb->cconn = conn;
--- a/fs/ocfs2/ocfs2.h~ocfs2-avoid-inode-removed-while-nfsd-access-it
+++ a/fs/ocfs2/ocfs2.h
@@ -395,6 +395,7 @@ struct ocfs2_super
 	struct ocfs2_lock_res osb_super_lockres;
 	struct ocfs2_lock_res osb_rename_lockres;
 	struct ocfs2_lock_res osb_nfs_sync_lockres;
+	struct rw_semaphore nfs_sync_rwlock;
 	struct ocfs2_lock_res osb_trim_fs_lockres;
 	struct mutex obs_trim_fs_mutex;
 	struct ocfs2_dlm_debug *osb_dlm_debug;
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 06/32] ocfs2: load global_inode_alloc
  2020-06-26  3:28 incoming Andrew Morton
                   ` (4 preceding siblings ...)
  2020-06-26  3:29 ` [patch 05/32] ocfs2: avoid inode removal while nfsd is accessing it Andrew Morton
@ 2020-06-26  3:29 ` Andrew Morton
  2020-06-26  3:29 ` [patch 07/32] ocfs2: fix panic on nfs server over ocfs2 Andrew Morton
                   ` (58 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:29 UTC (permalink / raw)
  To: akpm, gechangwei, ghe, jlbec, joseph.qi, junxiao.bi, mark,
	mm-commits, piaojun, stable, torvalds

From: Junxiao Bi <junxiao.bi@oracle.com>
Subject: ocfs2: load global_inode_alloc

Set global_inode_alloc as OCFS2_FIRST_ONLINE_SYSTEM_INODE, that will make
it load during mount.  It can be used to test whether some global/system
inodes are valid.  One use case is that nfsd will test whether root inode
is valid.

Link: http://lkml.kernel.org/r/20200616183829.87211-3-junxiao.bi@oracle.com
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 fs/ocfs2/ocfs2_fs.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/ocfs2/ocfs2_fs.h~ocfs2-load-global_inode_alloc
+++ a/fs/ocfs2/ocfs2_fs.h
@@ -326,8 +326,8 @@ struct ocfs2_system_inode_info {
 enum {
 	BAD_BLOCK_SYSTEM_INODE = 0,
 	GLOBAL_INODE_ALLOC_SYSTEM_INODE,
+#define OCFS2_FIRST_ONLINE_SYSTEM_INODE GLOBAL_INODE_ALLOC_SYSTEM_INODE
 	SLOT_MAP_SYSTEM_INODE,
-#define OCFS2_FIRST_ONLINE_SYSTEM_INODE SLOT_MAP_SYSTEM_INODE
 	HEARTBEAT_SYSTEM_INODE,
 	GLOBAL_BITMAP_SYSTEM_INODE,
 	USER_QUOTA_SYSTEM_INODE,
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 07/32] ocfs2: fix panic on nfs server over ocfs2
  2020-06-26  3:28 incoming Andrew Morton
                   ` (5 preceding siblings ...)
  2020-06-26  3:29 ` [patch 06/32] ocfs2: load global_inode_alloc Andrew Morton
@ 2020-06-26  3:29 ` Andrew Morton
  2020-06-26  3:29 ` [patch 08/32] ocfs2: fix value of OCFS2_INVALID_SLOT Andrew Morton
                   ` (57 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:29 UTC (permalink / raw)
  To: akpm, gechangwei, ghe, jlbec, joseph.qi, junxiao.bi, mark,
	mm-commits, piaojun, stable, torvalds

From: Junxiao Bi <junxiao.bi@oracle.com>
Subject: ocfs2: fix panic on nfs server over ocfs2

The following kernel panic was captured when running nfs server over
ocfs2, at that time ocfs2_test_inode_bit() was checking whether one inode
locating at "blkno" 5 was valid, that is ocfs2 root inode, its
"suballoc_slot" was OCFS2_INVALID_SLOT(65535) and it was allocted from
//global_inode_alloc, but here it wrongly assumed that it was got from per
slot inode alloctor which would cause array overflow and trigger kernel
panic.

[430033.469151] BUG: unable to handle kernel paging request at
0000000000001088
[430033.469367] IP: [<ffffffff816f6898>] _raw_spin_lock+0x18/0xf0
[430033.469567] PGD 1e06ba067 PUD 1e9e7d067 PMD 0
[430033.469769] Oops: 0002 [#1] SMP
[430033.469975] Modules linked in: tun nfsd lockd grace nfs_acl auth_rpcgss
ocfs2 xen_netback xen_blkback xen_gntalloc xen_gntdev xen_evtchn xenfs
xen_privcmd ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager
ocfs2_stackglue configfs bnx2fc fcoe libfcoe libfc sunrpc bridge 8021q mrp
garp stp llc bonding dm_round_robin scsi_dh_emc dm_multipath iTCO_wdt
iTCO_vendor_support pcspkr sb_edac edac_core i2c_i801 i2c_core lpc_ich
mfd_core sg ext4 jbd2 mbcache2 sd_mod ahci libahci lpfc scsi_transport_fc
be2net vxlan udp_tunnel ip6_udp_tunnel mpt3sas scsi_transport_sas raid_class
crc32c_intel be2iscsi bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi ipv6 cxgb3
mdio libiscsi_tcp qla4xxx iscsi_boot_sysfs libiscsi scsi_transport_iscsi
dm_mirror dm_region_hash dm_log dm_mod
[430033.472350] CPU: 6 PID: 24873 Comm: nfsd Not tainted
4.1.12-124.36.1.el6uek.x86_64 #2
[430033.472719] Hardware name: Huawei CH121 V3/IT11SGCA1, BIOS 3.87
02/02/2018
[430033.472910] task: ffff88005ae98000 ti: ffff88005ae94000 task.ti:
ffff88005ae94000
[430033.473277] RIP: e030:[<ffffffff816f6898>]  [<ffffffff816f6898>]
_raw_spin_lock+0x18/0xf0
[430033.473655] RSP: e02b:ffff88005ae97908  EFLAGS: 00010206
[430033.473850] RAX: ffff88005ae98000 RBX: 0000000000001088 RCX:
0000000000000000
[430033.474205] RDX: 0000000000020000 RSI: 0000000000000009 RDI:
0000000000001088
[430033.474574] RBP: ffff88005ae97928 R08: 0000000000000000 R09:
ffff880212878e00
[430033.474938] R10: 0000000000007ff0 R11: 0000000000000000 R12:
0000000000001088
[430033.475324] R13: ffff8800063c0aa8 R14: ffff8800650c27d0 R15:
000000000000ffff
[430033.475721] FS:  0000000000000000(0000) GS:ffff880218180000(0000)
knlGS:ffff880218180000
[430033.476199] CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033
[430033.476390] CR2: 0000000000001088 CR3: 00000002033d0000 CR4:
0000000000042660
[430033.476760] Stack:
[430033.476942]  0000000000001000 0000000000001088 ffff8800063c0aa8
ffff8800650c27d0
[430033.477329]  ffff88005ae97948 ffffffff8122a3de 0000000000000009
ffff8800063c0000
[430033.477718]  ffff88005ae979e8 ffffffffc0714e43 ffff88005ae97968
ffff88019de8f958
[430033.478104] Call Trace:
[430033.478286]  [<ffffffff8122a3de>] igrab+0x1e/0x60
[430033.478494]  [<ffffffffc0714e43>] ocfs2_get_system_file_inode+0x63/0x3a0
[ocfs2]
[430033.478870]  [<ffffffffc06a87df>] ? ocfs2_read_blocks_sync+0x13f/0x3c0
[ocfs2]
[430033.479267]  [<ffffffffc06ff2d8>] ocfs2_test_inode_bit+0x328/0xa00
[ocfs2]
[430033.479498]  [<ffffffffc06bef5a>] ocfs2_get_parent+0xba/0x3e0 [ocfs2]
[430033.479730]  [<ffffffff8129b305>] reconnect_path+0xb5/0x300
[430033.479933]  [<ffffffff8129b646>] exportfs_decode_fh+0xf6/0x2b0
[430033.480124]  [<ffffffffc0814af0>] ? nfsd_proc_getattr+0xa0/0xa0 [nfsd]
[430033.480294]  [<ffffffffc081a682>] ? exp_find+0xe2/0x190 [nfsd]
[430033.480461]  [<ffffffff810e5a7e>] ? irq_get_irq_data+0xe/0x10
[430033.480627]  [<ffffffff810ea1a7>] ? __call_rcu_nocb_enqueue+0xd7/0xe0
[430033.480794]  [<ffffffff810eb9e8>] ? __call_rcu+0xe8/0x360
[430033.480959]  [<ffffffffc0815860>] fh_verify+0x350/0x660 [nfsd]
[430033.481134]  [<ffffffffc0535076>] ? cache_check+0x56/0x3a0 [sunrpc]
[430033.481317]  [<ffffffffc0823a4d>] nfsd4_putfh+0x4d/0x60 [nfsd]
[430033.481505]  [<ffffffffc0826003>] nfsd4_proc_compound+0x3d3/0x6f0 [nfsd]
[430033.481730]  [<ffffffffc0811f60>] nfsd_dispatch+0xe0/0x290 [nfsd]
[430033.481950]  [<ffffffffc052b752>] ? svc_tcp_adjust_wspace+0x12/0x30
[sunrpc]
[430033.482152]  [<ffffffffc052a512>] svc_process_common+0x412/0x6a0 [sunrpc]
[430033.482351]  [<ffffffffc052a8c3>] svc_process+0x123/0x210 [sunrpc]
[430033.482550]  [<ffffffffc081190f>] nfsd+0xff/0x170 [nfsd]
[430033.482744]  [<ffffffffc0811810>] ? nfsd_destroy+0x80/0x80 [nfsd]
[430033.482943]  [<ffffffff810a7aeb>] kthread+0xcb/0xf0
[430033.483151]  [<ffffffff816f10ea>] ? __schedule+0x24a/0x810
[430033.483354]  [<ffffffff816f10ea>] ? __schedule+0x24a/0x810
[430033.483553]  [<ffffffff810a7a20>] ? kthread_create_on_node+0x180/0x180
[430033.483777]  [<ffffffff816f72a1>] ret_from_fork+0x61/0x90
[430033.483976]  [<ffffffff810a7a20>] ? kthread_create_on_node+0x180/0x180
[430033.484191] Code: 83 c2 02 0f b7 f2 e8 18 dc 91 ff 66 90 eb bf 0f 1f 40
00 55 48 89 e5 41 56 41 55 41 54 53 0f 1f 44 00 00 48 89 fb ba 00 00 02 00
<f0> 0f c1 17 89 d0 45 31 e4 45 31 ed c1 e8 10 66 39 d0 41 89 c6
[430033.485174] RIP  [<ffffffff816f6898>] _raw_spin_lock+0x18/0xf0
[430033.485370]  RSP <ffff88005ae97908>
[430033.485566] CR2: 0000000000001088
[430033.486223] ---[ end trace 7264463cd1aac8f9 ]---
[430033.666368] Kernel panic - not syncing: Fatal exception

Link: http://lkml.kernel.org/r/20200616183829.87211-4-junxiao.bi@oracle.com
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 fs/ocfs2/suballoc.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/fs/ocfs2/suballoc.c~ocfs2-fix-panic-on-nfs-server-over-ocfs2
+++ a/fs/ocfs2/suballoc.c
@@ -2825,9 +2825,12 @@ int ocfs2_test_inode_bit(struct ocfs2_su
 		goto bail;
 	}
 
-	inode_alloc_inode =
-		ocfs2_get_system_file_inode(osb, INODE_ALLOC_SYSTEM_INODE,
-					    suballoc_slot);
+	if (suballoc_slot == (u16)OCFS2_INVALID_SLOT)
+		inode_alloc_inode = ocfs2_get_system_file_inode(osb,
+			GLOBAL_INODE_ALLOC_SYSTEM_INODE, suballoc_slot);
+	else
+		inode_alloc_inode = ocfs2_get_system_file_inode(osb,
+			INODE_ALLOC_SYSTEM_INODE, suballoc_slot);
 	if (!inode_alloc_inode) {
 		/* the error code could be inaccurate, but we are not able to
 		 * get the correct one. */
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 08/32] ocfs2: fix value of OCFS2_INVALID_SLOT
  2020-06-26  3:28 incoming Andrew Morton
                   ` (6 preceding siblings ...)
  2020-06-26  3:29 ` [patch 07/32] ocfs2: fix panic on nfs server over ocfs2 Andrew Morton
@ 2020-06-26  3:29 ` Andrew Morton
  2020-06-26  3:29 ` [patch 09/32] lib: fix test_hmm.c reference after free Andrew Morton
                   ` (56 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:29 UTC (permalink / raw)
  To: akpm, gechangwei, ghe, jlbec, joseph.qi, junxiao.bi, mark,
	mm-commits, piaojun, stable, torvalds

From: Junxiao Bi <junxiao.bi@oracle.com>
Subject: ocfs2: fix value of OCFS2_INVALID_SLOT

In the ocfs2 disk layout, slot number is 16 bits, but in ocfs2
implementation, slot number is 32 bits.  Usually this will not cause any
issue, because slot number is converted from u16 to u32, but
OCFS2_INVALID_SLOT was defined as -1, when an invalid slot number from
disk was obtained, its value was (u16)-1, and it was converted to u32. 
Then the following checking in get_local_system_inode will be always
skipped:

 static struct inode **get_local_system_inode(struct ocfs2_super *osb,
                                               int type,
                                               u32 slot)
 {
 	BUG_ON(slot == OCFS2_INVALID_SLOT);
	...
 }

Link: http://lkml.kernel.org/r/20200616183829.87211-5-junxiao.bi@oracle.com
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 fs/ocfs2/ocfs2_fs.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/ocfs2/ocfs2_fs.h~ocfs2-fix-value-of-ocfs2_invalid_slot
+++ a/fs/ocfs2/ocfs2_fs.h
@@ -290,7 +290,7 @@
 #define OCFS2_MAX_SLOTS			255
 
 /* Slot map indicator for an empty slot */
-#define OCFS2_INVALID_SLOT		-1
+#define OCFS2_INVALID_SLOT		((u16)-1)
 
 #define OCFS2_VOL_UUID_LEN		16
 #define OCFS2_MAX_VOL_LABEL_LEN		64
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 09/32] lib: fix test_hmm.c reference after free
  2020-06-26  3:28 incoming Andrew Morton
                   ` (7 preceding siblings ...)
  2020-06-26  3:29 ` [patch 08/32] ocfs2: fix value of OCFS2_INVALID_SLOT Andrew Morton
@ 2020-06-26  3:29 ` Andrew Morton
  2020-06-26  3:29 ` [patch 10/32] linux/bits.h: fix unsigned less than zero warnings Andrew Morton
                   ` (55 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:29 UTC (permalink / raw)
  To: akpm, jglisse, mm-commits, rcampbell, rdunlap, torvalds

From: Randy Dunlap <rdunlap@infradead.org>
Subject: lib: fix test_hmm.c reference after free

Coccinelle scripts report the following errors:

lib/test_hmm.c:523:20-26: ERROR: reference preceded by free on line 521
lib/test_hmm.c:524:21-27: ERROR: reference preceded by free on line 521
lib/test_hmm.c:523:28-35: ERROR: devmem is NULL but dereferenced.
lib/test_hmm.c:524:29-36: ERROR: devmem is NULL but dereferenced.

Fix these by using the local variable 'res' instead of devmem.

Link: http://lkml.kernel.org/r/c845c158-9c65-9665-0d0b-00342846dd07@infradead.org
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Ralph Campbell <rcampbell@nvidia.com>
Cc: Jérôme Glisse <jglisse@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 lib/test_hmm.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/lib/test_hmm.c~lib-fix-test_hmmc-reference-after-free
+++ a/lib/test_hmm.c
@@ -520,8 +520,7 @@ static bool dmirror_allocate_chunk(struc
 err_free:
 	kfree(devmem);
 err_release:
-	release_mem_region(devmem->pagemap.res.start,
-			   resource_size(&devmem->pagemap.res));
+	release_mem_region(res->start, resource_size(res));
 err:
 	mutex_unlock(&mdevice->devmem_lock);
 	return false;
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 10/32] linux/bits.h: fix unsigned less than zero warnings
  2020-06-26  3:28 incoming Andrew Morton
                   ` (8 preceding siblings ...)
  2020-06-26  3:29 ` [patch 09/32] lib: fix test_hmm.c reference after free Andrew Morton
@ 2020-06-26  3:29 ` Andrew Morton
  2020-06-26  3:29 ` [patch 11/32] mm, slab: fix sign conversion problem in memcg_uncharge_slab() Andrew Morton
                   ` (54 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:29 UTC (permalink / raw)
  To: akpm, andy.shevchenko, arnd, emil.l.velikov, geert, keescook,
	linus.walleij, lkp, mm-commits, rikard.falkeborn, syednwaris,
	torvalds, vilhelm.gray, yamada.masahiro

From: Rikard Falkeborn <rikard.falkeborn@gmail.com>
Subject: linux/bits.h: fix unsigned less than zero warnings

When calling the GENMASK and GENMASK_ULL macros with zero lower bit and an
unsigned unknown high bit, some gcc versions warn due to the comparisons
of the high and low bit in GENMASK_INPUT_CHECK.

To silence the warnings, only perform the check if both inputs are known. 
This does not trigger any warnings, from the Wtype-limits help:

	Warn if a comparison is always true or always false due to the
	limited range of the data type, but do not warn for constant
	expressions.

As an example of the warning, kindly reported by the kbuild test robot:

from drivers/mfd/atmel-smc.c:11:
drivers/mfd/atmel-smc.c: In function 'atmel_smc_cs_encode_ncycles':
include/linux/bits.h:26:28: warning: comparison of unsigned expression < 0 is always false [-Wtype-limits]
26 |   __builtin_constant_p((l) > (h)), (l) > (h), 0)))
|                            ^
include/linux/build_bug.h:16:62: note: in definition of macro 'BUILD_BUG_ON_ZERO'
16 | #define BUILD_BUG_ON_ZERO(e) ((int)(sizeof(struct { int:(-!!(e)); })))
|                                                              ^
include/linux/bits.h:39:3: note: in expansion of macro 'GENMASK_INPUT_CHECK'
39 |  (GENMASK_INPUT_CHECK(h, l) + __GENMASK(h, l))
|   ^~~~~~~~~~~~~~~~~~~
>> drivers/mfd/atmel-smc.c:49:25: note: in expansion of macro 'GENMASK'
49 |  unsigned int lsbmask = GENMASK(msbpos - 1, 0);
|                         ^~~~~~~

Link: http://lkml.kernel.org/r/20200621054210.14804-1-rikard.falkeborn@gmail.com
Link: http://lkml.kernel.org/r/20200608221823.35799-1-rikard.falkeborn@gmail.com
Fixes: 295bcca84916 ("linux/bits.h: add compile time sanity check of GENMASK inputs")
Signed-off-by: Rikard Falkeborn <rikard.falkeborn@gmail.com>
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Emil Velikov <emil.l.velikov@gmail.com>
Reported-by: Syed Nayyar Waris <syednwaris@gmail.com>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Reviewed-by: Emil Velikov <emil.l.velikov@gmail.com>
Cc: Arnd Bergmann <arnd@arndb.de>
Cc: Geert Uytterhoeven <geert@linux-m68k.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: Linus Walleij <linus.walleij@linaro.org>
Cc: William Breathitt Gray <vilhelm.gray@gmail.com>
Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 include/linux/bits.h |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/include/linux/bits.h~linux-bitsh-fix-unsigned-less-than-zero-warnings
+++ a/include/linux/bits.h
@@ -23,7 +23,8 @@
 #include <linux/build_bug.h>
 #define GENMASK_INPUT_CHECK(h, l) \
 	(BUILD_BUG_ON_ZERO(__builtin_choose_expr( \
-		__builtin_constant_p((l) > (h)), (l) > (h), 0)))
+		__builtin_constant_p(l) && __builtin_constant_p(h), \
+		(l) > (h), 0)))
 #else
 /*
  * BUILD_BUG_ON_ZERO is not available in h files included from asm files,
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 11/32] mm, slab: fix sign conversion problem in memcg_uncharge_slab()
  2020-06-26  3:28 incoming Andrew Morton
                   ` (9 preceding siblings ...)
  2020-06-26  3:29 ` [patch 10/32] linux/bits.h: fix unsigned less than zero warnings Andrew Morton
@ 2020-06-26  3:29 ` Andrew Morton
  2020-06-26  3:29 ` [patch 12/32] mm/slab: use memzero_explicit() in kzfree() Andrew Morton
                   ` (53 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:29 UTC (permalink / raw)
  To: akpm, cl, guro, hannes, iamjoonsoo.kim, longman, mhocko,
	mm-commits, penberg, rientjes, shakeelb, stable, torvalds,
	vdavydov.dev

From: Waiman Long <longman@redhat.com>
Subject: mm, slab: fix sign conversion problem in memcg_uncharge_slab()

It was found that running the LTP test on a PowerPC system could produce
erroneous values in /proc/meminfo, like:

  MemTotal:       531915072 kB
  MemFree:        507962176 kB
  MemAvailable:   1100020596352 kB

Using bisection, the problem is tracked down to commit 9c315e4d7d8c ("mm:
memcg/slab: cache page number in memcg_(un)charge_slab()").

In memcg_uncharge_slab() with a "int order" argument:

  unsigned int nr_pages = 1 << order;
    :
  mod_lruvec_state(lruvec, cache_vmstat_idx(s), -nr_pages);

The mod_lruvec_state() function will eventually call the
__mod_zone_page_state() which accepts a long argument.  Depending on the
compiler and how inlining is done, "-nr_pages" may be treated as a
negative number or a very large positive number.  Apparently, it was
treated as a large positive number in that PowerPC system leading to
incorrect stat counts.  This problem hasn't been seen in x86-64 yet,
perhaps the gcc compiler there has some slight difference in behavior.

It is fixed by making nr_pages a signed value.  For consistency, a similar
change is applied to memcg_charge_slab() as well.

Link: http://lkml.kernel.org/r/20200620184719.10994-1-longman@redhat.com
Fixes: 9c315e4d7d8c ("mm: memcg/slab: cache page number in memcg_(un)charge_slab()").
Signed-off-by: Waiman Long <longman@redhat.com>
Acked-by: Roman Gushchin <guro@fb.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/slab.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/mm/slab.h~mm-slab-fix-sign-conversion-problem-in-memcg_uncharge_slab
+++ a/mm/slab.h
@@ -348,7 +348,7 @@ static __always_inline int memcg_charge_
 					     gfp_t gfp, int order,
 					     struct kmem_cache *s)
 {
-	unsigned int nr_pages = 1 << order;
+	int nr_pages = 1 << order;
 	struct mem_cgroup *memcg;
 	struct lruvec *lruvec;
 	int ret;
@@ -388,7 +388,7 @@ out:
 static __always_inline void memcg_uncharge_slab(struct page *page, int order,
 						struct kmem_cache *s)
 {
-	unsigned int nr_pages = 1 << order;
+	int nr_pages = 1 << order;
 	struct mem_cgroup *memcg;
 	struct lruvec *lruvec;
 
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 12/32] mm/slab: use memzero_explicit() in kzfree()
  2020-06-26  3:28 incoming Andrew Morton
                   ` (10 preceding siblings ...)
  2020-06-26  3:29 ` [patch 11/32] mm, slab: fix sign conversion problem in memcg_uncharge_slab() Andrew Morton
@ 2020-06-26  3:29 ` Andrew Morton
  2020-06-26  3:29 ` [patch 13/32] slub: cure list_slab_objects() from double fix Andrew Morton
                   ` (52 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:29 UTC (permalink / raw)
  To: akpm, dan.carpenter, dhowells, hannes, jarkko.sakkinen, Jason,
	jmorris, joe, longman, mhocko, mm-commits, rientjes, serge,
	stable, torvalds, willy

From: Waiman Long <longman@redhat.com>
Subject: mm/slab: use memzero_explicit() in kzfree()

The kzfree() function is normally used to clear some sensitive
information, like encryption keys, in the buffer before freeing it back to
the pool.  Memset() is currently used for buffer clearing.  However
unlikely, there is still a non-zero probability that the compiler may
choose to optimize away the memory clearing especially if LTO is being
used in the future.  To make sure that this optimization will never
happen, memzero_explicit(), which is introduced in v3.18, is now used in
kzfree() to future-proof it.

Link: http://lkml.kernel.org/r/20200616154311.12314-2-longman@redhat.com
Fixes: 3ef0e5ba4673 ("slab: introduce kzfree()")
Signed-off-by: Waiman Long <longman@redhat.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Cc: James Morris <jmorris@namei.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Cc: Joe Perches <joe@perches.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: "Jason A . Donenfeld" <Jason@zx2c4.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/slab_common.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/mm/slab_common.c~mm-slab-use-memzero_explicit-in-kzfree
+++ a/mm/slab_common.c
@@ -1726,7 +1726,7 @@ void kzfree(const void *p)
 	if (unlikely(ZERO_OR_NULL_PTR(mem)))
 		return;
 	ks = ksize(mem);
-	memset(mem, 0, ks);
+	memzero_explicit(mem, ks);
 	kfree(mem);
 }
 EXPORT_SYMBOL(kzfree);
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 13/32] slub: cure list_slab_objects() from double fix
  2020-06-26  3:28 incoming Andrew Morton
                   ` (11 preceding siblings ...)
  2020-06-26  3:29 ` [patch 12/32] mm/slab: use memzero_explicit() in kzfree() Andrew Morton
@ 2020-06-26  3:29 ` Andrew Morton
  2020-06-26  3:29 ` [patch 14/32] mm: fix swap cache node allocation mask Andrew Morton
                   ` (51 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:29 UTC (permalink / raw)
  To: akpm, bigeasy, iamjoonsoo.kim, mm-commits, penberg, rientjes,
	tglx, torvalds, yuzhao

From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Subject: slub: cure list_slab_objects() from double fix

According to Christopher Lameter two fixes have been merged for the same
problem.  As far as I can tell, the code does not acquire the list_lock
and invoke kmalloc().  list_slab_objects() misses an unlock (the
counterpart to get_map()) and the memory allocated in free_partial() isn't
used.

Revert the mentioned commit.

Link: http://lkml.kernel.org/r/20200618201234.795692-1-bigeasy@linutronix.de
Fixes: aa456c7aebb14 ("slub: remove kmalloc under list_lock from list_slab_objects() V2")
Link: https://lkml.kernel.org/r/alpine.DEB.2.22.394.2006181501480.12014@www.lameter.com
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Yu Zhao <yuzhao@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/slub.c |   19 ++++---------------
 1 file changed, 4 insertions(+), 15 deletions(-)

--- a/mm/slub.c~slub-cure-list_slab_objects-from-double-fix
+++ a/mm/slub.c
@@ -3766,15 +3766,13 @@ error:
 }
 
 static void list_slab_objects(struct kmem_cache *s, struct page *page,
-			      const char *text, unsigned long *map)
+			      const char *text)
 {
 #ifdef CONFIG_SLUB_DEBUG
 	void *addr = page_address(page);
+	unsigned long *map;
 	void *p;
 
-	if (!map)
-		return;
-
 	slab_err(s, page, text, s->name);
 	slab_lock(page);
 
@@ -3786,6 +3784,7 @@ static void list_slab_objects(struct kme
 			print_tracking(s, p);
 		}
 	}
+	put_map(map);
 	slab_unlock(page);
 #endif
 }
@@ -3799,11 +3798,6 @@ static void free_partial(struct kmem_cac
 {
 	LIST_HEAD(discard);
 	struct page *page, *h;
-	unsigned long *map = NULL;
-
-#ifdef CONFIG_SLUB_DEBUG
-	map = bitmap_alloc(oo_objects(s->max), GFP_KERNEL);
-#endif
 
 	BUG_ON(irqs_disabled());
 	spin_lock_irq(&n->list_lock);
@@ -3813,16 +3807,11 @@ static void free_partial(struct kmem_cac
 			list_add(&page->slab_list, &discard);
 		} else {
 			list_slab_objects(s, page,
-			  "Objects remaining in %s on __kmem_cache_shutdown()",
-			  map);
+			  "Objects remaining in %s on __kmem_cache_shutdown()");
 		}
 	}
 	spin_unlock_irq(&n->list_lock);
 
-#ifdef CONFIG_SLUB_DEBUG
-	bitmap_free(map);
-#endif

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 14/32] mm: fix swap cache node allocation mask
  2020-06-26  3:28 incoming Andrew Morton
                   ` (12 preceding siblings ...)
  2020-06-26  3:29 ` [patch 13/32] slub: cure list_slab_objects() from double fix Andrew Morton
@ 2020-06-26  3:29 ` Andrew Morton
  2020-06-26  3:30 ` [patch 15/32] mm/memory.c: properly pte_offset_map_lock/unlock in vm_insert_pages() Andrew Morton
                   ` (50 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:29 UTC (permalink / raw)
  To: akpm, hughd, lists, mm-commits, stable, torvalds, vbabka, willy

From: Hugh Dickins <hughd@google.com>
Subject: mm: fix swap cache node allocation mask

https://bugzilla.kernel.org/show_bug.cgi?id=208085 reports that a slightly
overcommitted load, testing swap and zram along with i915, splats and
keeps on splatting, when it had better fail less noisily:

gnome-shell: page allocation failure: order:0,
mode:0x400d0(__GFP_IO|__GFP_FS|__GFP_COMP|__GFP_RECLAIMABLE),
nodemask=(null),cpuset=/,mems_allowed=0
CPU: 2 PID: 1155 Comm: gnome-shell Not tainted 5.7.0-1.fc33.x86_64 #1
Call Trace:
dump_stack+0x64/0x88
warn_alloc.cold+0x75/0xd9
__alloc_pages_slowpath.constprop.0+0xcfa/0xd30
__alloc_pages_nodemask+0x2df/0x320
alloc_slab_page+0x195/0x310
allocate_slab+0x3c5/0x440
___slab_alloc+0x40c/0x5f0
__slab_alloc+0x1c/0x30
kmem_cache_alloc+0x20e/0x220
xas_nomem+0x28/0x70
add_to_swap_cache+0x321/0x400
__read_swap_cache_async+0x105/0x240
swap_cluster_readahead+0x22c/0x2e0
shmem_swapin+0x8e/0xc0
shmem_swapin_page+0x196/0x740
shmem_getpage_gfp+0x3a2/0xa60
shmem_read_mapping_page_gfp+0x32/0x60
shmem_get_pages+0x155/0x5e0 [i915]
__i915_gem_object_get_pages+0x68/0xa0 [i915]
i915_vma_pin+0x3fe/0x6c0 [i915]
eb_add_vma+0x10b/0x2c0 [i915]
i915_gem_do_execbuffer+0x704/0x3430 [i915]
i915_gem_execbuffer2_ioctl+0x1ea/0x3e0 [i915]
drm_ioctl_kernel+0x86/0xd0 [drm]
drm_ioctl+0x206/0x390 [drm]
ksys_ioctl+0x82/0xc0
__x64_sys_ioctl+0x16/0x20
do_syscall_64+0x5b/0xf0
entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported on 5.7, but it goes back really to 3.1: when
shmem_read_mapping_page_gfp() was implemented for use by i915, and
allowed for __GFP_NORETRY and __GFP_NOWARN flags in most places, but
missed swapin's "& GFP_KERNEL" mask for page tree node allocation in
__read_swap_cache_async() - that was to mask off HIGHUSER_MOVABLE bits
from what page cache uses, but GFP_RECLAIM_MASK is now what's needed.

Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2006151330070.11064@eggly.anvils
Fixes: 68da9f055755 ("tmpfs: pass gfp to shmem_getpage_gfp")
Signed-off-by: Hugh Dickins <hughd@google.com>
Reviewed-by: Vlastimil Babka <vbabka@suse.cz>
Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reported-by: Chris Murphy <lists@colorremedies.com>
Analyzed-by: Vlastimil Babka <vbabka@suse.cz>
Analyzed-by: Matthew Wilcox <willy@infradead.org>
Tested-by: Chris Murphy <lists@colorremedies.com>
Cc: <stable@vger.kernel.org>	[3.1+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/swap_state.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/mm/swap_state.c~mm-fix-swap-cache-node-allocation-mask
+++ a/mm/swap_state.c
@@ -21,7 +21,7 @@
 #include <linux/vmalloc.h>
 #include <linux/swap_slots.h>
 #include <linux/huge_mm.h>

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 15/32] mm/memory.c: properly pte_offset_map_lock/unlock in vm_insert_pages()
  2020-06-26  3:28 incoming Andrew Morton
                   ` (13 preceding siblings ...)
  2020-06-26  3:29 ` [patch 14/32] mm: fix swap cache node allocation mask Andrew Morton
@ 2020-06-26  3:30 ` Andrew Morton
  2020-06-26  3:30 ` [patch 16/32] mm/debug_vm_pgtable: fix build failure with powerpc 8xx Andrew Morton
                   ` (49 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:30 UTC (permalink / raw)
  To: akpm, arjunroy, edumazet, hughd, mm-commits, rientjes, soheil, torvalds

From: Arjun Roy <arjunroy@google.com>
Subject: mm/memory.c: properly pte_offset_map_lock/unlock in vm_insert_pages()

Calls to pte_offset_map() in vm_insert_pages() are erroneously not matched
with a call to pte_unmap().  This would cause problems on architectures
where that is not a no-op.

This patch does away with the non-traditional locking in the existing
code, and instead uses pte_offset_map_lock/unlock() as usual, incrementing
PTE as necessary.  The PTE pointer is kept within bounds since we clamp it
with PTRS_PER_PTE.

Link: http://lkml.kernel.org/r/20200618220446.20284-1-arjunroy.kdev@gmail.com
Fixes: 8cd3984d81d5 ("mm/memory.c: add vm_insert_pages()")
Signed-off-by: Arjun Roy <arjunroy@google.com>
Acked-by: David Rientjes <rientjes@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/memory.c |   21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

--- a/mm/memory.c~mm-memoryc-properly-pte_offset_map_lock-unlock-in-vm_insert_pages
+++ a/mm/memory.c
@@ -1498,7 +1498,7 @@ out:
 }
 
 #ifdef pte_index
-static int insert_page_in_batch_locked(struct mm_struct *mm, pmd_t *pmd,
+static int insert_page_in_batch_locked(struct mm_struct *mm, pte_t *pte,
 			unsigned long addr, struct page *page, pgprot_t prot)
 {
 	int err;
@@ -1506,8 +1506,9 @@ static int insert_page_in_batch_locked(s
 	if (!page_count(page))
 		return -EINVAL;
 	err = validate_page_before_insert(page);
-	return err ? err : insert_page_into_pte_locked(
-		mm, pte_offset_map(pmd, addr), addr, page, prot);
+	if (err)
+		return err;
+	return insert_page_into_pte_locked(mm, pte, addr, page, prot);
 }
 
 /* insert_pages() amortizes the cost of spinlock operations
@@ -1517,7 +1518,8 @@ static int insert_pages(struct vm_area_s
 			struct page **pages, unsigned long *num, pgprot_t prot)
 {
 	pmd_t *pmd = NULL;
-	spinlock_t *pte_lock = NULL;
+	pte_t *start_pte, *pte;
+	spinlock_t *pte_lock;
 	struct mm_struct *const mm = vma->vm_mm;
 	unsigned long curr_page_idx = 0;
 	unsigned long remaining_pages_total = *num;
@@ -1536,18 +1538,17 @@ more:
 	ret = -ENOMEM;
 	if (pte_alloc(mm, pmd))
 		goto out;
-	pte_lock = pte_lockptr(mm, pmd);
 
 	while (pages_to_write_in_pmd) {
 		int pte_idx = 0;
 		const int batch_size = min_t(int, pages_to_write_in_pmd, 8);
 
-		spin_lock(pte_lock);
-		for (; pte_idx < batch_size; ++pte_idx) {
-			int err = insert_page_in_batch_locked(mm, pmd,
+		start_pte = pte_offset_map_lock(mm, pmd, addr, &pte_lock);
+		for (pte = start_pte; pte_idx < batch_size; ++pte, ++pte_idx) {
+			int err = insert_page_in_batch_locked(mm, pte,
 				addr, pages[curr_page_idx], prot);
 			if (unlikely(err)) {
-				spin_unlock(pte_lock);
+				pte_unmap_unlock(start_pte, pte_lock);
 				ret = err;
 				remaining_pages_total -= pte_idx;
 				goto out;
@@ -1555,7 +1556,7 @@ more:
 			addr += PAGE_SIZE;
 			++curr_page_idx;
 		}
-		spin_unlock(pte_lock);
+		pte_unmap_unlock(start_pte, pte_lock);
 		pages_to_write_in_pmd -= batch_size;
 		remaining_pages_total -= batch_size;
 	}
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 16/32] mm/debug_vm_pgtable: fix build failure with powerpc 8xx
  2020-06-26  3:28 incoming Andrew Morton
                   ` (14 preceding siblings ...)
  2020-06-26  3:30 ` [patch 15/32] mm/memory.c: properly pte_offset_map_lock/unlock in vm_insert_pages() Andrew Morton
@ 2020-06-26  3:30 ` Andrew Morton
  2020-06-26  3:30 ` [patch 17/32] make asm-generic/cacheflush.h more standalone Andrew Morton
                   ` (48 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:30 UTC (permalink / raw)
  To: akpm, anshuman.khandual, benh, christophe.leroy, mm-commits, mpe,
	paulus, peterz, torvalds, will

From: Christophe Leroy <christophe.leroy@csgroup.eu>
Subject: mm/debug_vm_pgtable: fix build failure with powerpc 8xx

Since commit 9e343b467c70 ("READ_ONCE: Enforce atomicity for
{READ,WRITE}_ONCE() memory accesses"), READ_ONCE() cannot be used anymore
to read complex page table entries.  This leads to:

  CC      mm/debug_vm_pgtable.o
In file included from ./include/asm-generic/bug.h:5,
                 from ./arch/powerpc/include/asm/bug.h:109,
                 from ./include/linux/bug.h:5,
                 from ./include/linux/mmdebug.h:5,
                 from ./include/linux/gfp.h:5,
                 from mm/debug_vm_pgtable.c:13:
In function 'pte_clear_tests',
    inlined from 'debug_vm_pgtable' at mm/debug_vm_pgtable.c:363:2:
./include/linux/compiler.h:392:38: error: call to '__compiletime_assert_210' declared with attribute error: Unsupported access size for {READ,WRITE}_ONCE().
  392 |  _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
      |                                      ^
./include/linux/compiler.h:373:4: note: in definition of macro '__compiletime_assert'
  373 |    prefix ## suffix();    \
      |    ^~~~~~
./include/linux/compiler.h:392:2: note: in expansion of macro '_compiletime_assert'
  392 |  _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
      |  ^~~~~~~~~~~~~~~~~~~
./include/linux/compiler.h:405:2: note: in expansion of macro 'compiletime_assert'
  405 |  compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
      |  ^~~~~~~~~~~~~~~~~~
./include/linux/compiler.h:291:2: note: in expansion of macro 'compiletime_assert_rwonce_type'
  291 |  compiletime_assert_rwonce_type(x);    \
      |  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
mm/debug_vm_pgtable.c:249:14: note: in expansion of macro 'READ_ONCE'
  249 |  pte_t pte = READ_ONCE(*ptep);
      |              ^~~~~~~~~
make[2]: *** [mm/debug_vm_pgtable.o] Error 1

Fix it by using the recently added ptep_get() helper.

Link: http://lkml.kernel.org/r/6ca8c972e6c920dc4ae0d4affbed9703afa4d010.1592490570.git.christophe.leroy@csgroup.eu
Fixes: 9e343b467c70 ("READ_ONCE: Enforce atomicity for {READ,WRITE}_ONCE() memory accesses")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Acked-by: Will Deacon <will@kernel.org>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: "Peter Zijlstra (Intel)" <peterz@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/debug_vm_pgtable.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/mm/debug_vm_pgtable.c~mm-debug_vm_pgtable-fix-build-failure-with-powerpc-8xx
+++ a/mm/debug_vm_pgtable.c
@@ -246,13 +246,13 @@ static void __init pgd_populate_tests(st
 static void __init pte_clear_tests(struct mm_struct *mm, pte_t *ptep,
 				   unsigned long vaddr)
 {
-	pte_t pte = READ_ONCE(*ptep);
+	pte_t pte = ptep_get(ptep);
 
 	pte = __pte(pte_val(pte) | RANDOM_ORVALUE);
 	set_pte_at(mm, vaddr, ptep, pte);
 	barrier();
 	pte_clear(mm, vaddr, ptep);
-	pte = READ_ONCE(*ptep);
+	pte = ptep_get(ptep);
 	WARN_ON(!pte_none(pte));
 }
 
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 17/32] make asm-generic/cacheflush.h more standalone
  2020-06-26  3:28 incoming Andrew Morton
                   ` (15 preceding siblings ...)
  2020-06-26  3:30 ` [patch 16/32] mm/debug_vm_pgtable: fix build failure with powerpc 8xx Andrew Morton
@ 2020-06-26  3:30 ` Andrew Morton
  2020-06-26  3:30 ` [patch 18/32] media: omap3isp: remove cacheflush.h Andrew Morton
                   ` (47 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:30 UTC (permalink / raw)
  To: akpm, arnd, borntraeger, gor, hch, heiko.carstens, mm-commits,
	sfr, torvalds

From: Stephen Rothwell <sfr@canb.auug.org.au>
Subject: make asm-generic/cacheflush.h more standalone

Some s390 builds get these warnings:

include/asm-generic/cacheflush.h:16:42: warning: 'struct mm_struct' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:22:46: warning: 'struct mm_struct' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:28:45: warning: 'struct vm_area_struct' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:36:44: warning: 'struct vm_area_struct' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:44:45: warning: 'struct page' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:52:50: warning: 'struct address_space' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:58:52: warning: 'struct address_space' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:75:17: warning: 'struct page' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:74:45: warning: 'struct vm_area_struct' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:82:16: warning: 'struct page' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:81:50: warning: 'struct vm_area_struct' declared inside parameter list will not be visible outside of this definition or declaration

Forward declare the named structs to get rid of these.

Link: http://lkml.kernel.org/r/20200623135714.4dae4b8a@canb.auug.org.au
Fixes: e0cf615d725c ("asm-generic: don't include <linux/mm.h> in cacheflush.h")
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 include/asm-generic/cacheflush.h |    5 +++++
 1 file changed, 5 insertions(+)

--- a/include/asm-generic/cacheflush.h~make-asm-generic-cacheflushh-more-standalone
+++ a/include/asm-generic/cacheflush.h
@@ -2,6 +2,11 @@
 #ifndef _ASM_GENERIC_CACHEFLUSH_H
 #define _ASM_GENERIC_CACHEFLUSH_H
 
+struct mm_struct;
+struct vm_area_struct;
+struct page;
+struct address_space;
+
 /*
  * The cache doesn't need to be flushed when TLB entries change when
  * the cache is mapped to physical memory, not virtual memory
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 18/32] media: omap3isp: remove cacheflush.h
  2020-06-26  3:28 incoming Andrew Morton
                   ` (16 preceding siblings ...)
  2020-06-26  3:30 ` [patch 17/32] make asm-generic/cacheflush.h more standalone Andrew Morton
@ 2020-06-26  3:30 ` Andrew Morton
  2020-06-26  3:30 ` [patch 19/32] mm/vmalloc.c: fix a warning while make xmldocs Andrew Morton
                   ` (46 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:30 UTC (permalink / raw)
  To: akpm, geert, hch, laurent.pinchart, mchehab+huawei, mm-commits,
	natechancellor, torvalds

From: Nathan Chancellor <natechancellor@gmail.com>
Subject: media: omap3isp: remove cacheflush.h

After mm.h was removed from the asm-generic version of cacheflush.h, s390
allyesconfig shows several warnings of the following nature:

In file included from ./arch/s390/include/generated/asm/cacheflush.h:1,
                 from drivers/media/platform/omap3isp/isp.c:42:
./include/asm-generic/cacheflush.h:16:42: warning: 'struct mm_struct'
declared inside parameter list will not be visible outside of this
definition or declaration

As Geert and Laurent point out, this driver does not need this header in
the two files that include it.  Remove it so there are no warnings.

Link: http://lkml.kernel.org/r/20200622234740.72825-2-natechancellor@gmail.com
Fixes: e0cf615d725c ("asm-generic: don't include <linux/mm.h> in cacheflush.h")
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Suggested-by: Geert Uytterhoeven <geert@linux-m68k.org>
Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 drivers/media/platform/omap3isp/isp.c      |    2 --
 drivers/media/platform/omap3isp/ispvideo.c |    1 -
 2 files changed, 3 deletions(-)

--- a/drivers/media/platform/omap3isp/isp.c~media-omap3isp-remove-cacheflushh
+++ a/drivers/media/platform/omap3isp/isp.c
@@ -39,8 +39,6 @@
  *	Troy Laramy <t-laramy@ti.com>
  */
 
-#include <asm/cacheflush.h>

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 19/32] mm/vmalloc.c: fix a warning while make xmldocs
  2020-06-26  3:28 incoming Andrew Morton
                   ` (17 preceding siblings ...)
  2020-06-26  3:30 ` [patch 18/32] media: omap3isp: remove cacheflush.h Andrew Morton
@ 2020-06-26  3:30 ` Andrew Morton
  2020-06-26  3:30 ` [patch 20/32] mm: memcontrol: handle div0 crash race condition in memory.low Andrew Morton
                   ` (45 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:30 UTC (permalink / raw)
  To: akpm, mm-commits, standby24x7, torvalds

From: Masanari Iida <standby24x7@gmail.com>
Subject: mm/vmalloc.c: fix a warning while make xmldocs

This patch fixes following warning while "make xmldocs"

./mm/vmalloc.c:1877: warning: Excess function parameter
'prot' description in 'vm_map_ram'

This warning started since a patch was merged in 5.8-rc1.
Link: http://lkml.kernel.org/r/20200622152850.140871-1-standby24x7@gmail.com
Fixes: d4efd79a81ab ("mm: remove the prot argument from vm_map_ram")

Signed-off-by: Masanari Iida <standby24x7@gmail.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/vmalloc.c |    1 -
 1 file changed, 1 deletion(-)

--- a/mm/vmalloc.c~mm-fix-a-warning-while-make-xmldocs
+++ a/mm/vmalloc.c
@@ -1862,7 +1862,6 @@ EXPORT_SYMBOL(vm_unmap_ram);
  * @pages: an array of pointers to the pages to be mapped
  * @count: number of pages
  * @node: prefer to allocate data structures on this node
- * @prot: memory protection to use. PAGE_KERNEL for regular RAM
  *
  * If you use this function for less than VMAP_MAX_ALLOC pages, it could be
  * faster than vmap so it's good.  But if you mix long-life and short-life
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 20/32] mm: memcontrol: handle div0 crash race condition in memory.low
  2020-06-26  3:28 incoming Andrew Morton
                   ` (18 preceding siblings ...)
  2020-06-26  3:30 ` [patch 19/32] mm/vmalloc.c: fix a warning while make xmldocs Andrew Morton
@ 2020-06-26  3:30 ` Andrew Morton
  2020-06-26  3:30 ` [patch 21/32] mm/memcontrol.c: add missed css_put() Andrew Morton
                   ` (44 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:30 UTC (permalink / raw)
  To: akpm, chris, guro, hannes, mhocko, mm-commits, stable, tj, torvalds

From: Johannes Weiner <hannes@cmpxchg.org>
Subject: mm: memcontrol: handle div0 crash race condition in memory.low

Tejun reports seeing rare div0 crashes in memory.low stress testing:

[37228.504582] RIP: 0010:mem_cgroup_calculate_protection+0xed/0x150
[37228.505059] Code: 0f 46 d1 4c 39 d8 72 57 f6 05 16 d6 42 01 40 74 1f 4c 39 d8 76 1a 4c 39 d1 76 15 4c 29 d1 4c 29 d8 4d 29 d9 31 d2 48 0f af c1 <49> f7 f1 49 01 c2 4c 89 96 38 01 00 00 5d c3 48 0f af c7 31 d2 49
[37228.506254] RSP: 0018:ffffa14e01d6fcd0 EFLAGS: 00010246
[37228.506769] RAX: 000000000243e384 RBX: 0000000000000000 RCX: 0000000000008f4b
[37228.507319] RDX: 0000000000000000 RSI: ffff8b89bee84000 RDI: 0000000000000000
[37228.507869] RBP: ffffa14e01d6fcd0 R08: ffff8b89ca7d40f8 R09: 0000000000000000
[37228.508376] R10: 0000000000000000 R11: 00000000006422f7 R12: 0000000000000000
[37228.508881] R13: ffff8b89d9617000 R14: ffff8b89bee84000 R15: ffffa14e01d6fdb8
[37228.509397] FS:  0000000000000000(0000) GS:ffff8b8a1f1c0000(0000) knlGS:0000000000000000
[37228.509917] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[37228.510442] CR2: 00007f93b1fc175b CR3: 000000016100a000 CR4: 0000000000340ea0
[37228.511076] Call Trace:
[37228.511561]  shrink_node+0x1e5/0x6c0
[37228.512044]  balance_pgdat+0x32d/0x5f0
[37228.512521]  kswapd+0x1d7/0x3d0
[37228.513346]  ? wait_woken+0x80/0x80
[37228.514170]  kthread+0x11c/0x160
[37228.514983]  ? balance_pgdat+0x5f0/0x5f0
[37228.515797]  ? kthread_park+0x90/0x90
[37228.516593]  ret_from_fork+0x1f/0x30

This happens when parent_usage == siblings_protected.  We check that usage
is bigger than protected, which should imply parent_usage being bigger
than siblings_protected.  However, we don't read (or even update) these
values atomically, and they can be out of sync as the memory state changes
under us.  A bit of fluctuation around the target protection isn't a big
deal, but we need to handle the div0 case.

Check the parent state explicitly to make sure we have a reasonable
positive value for the divisor.

Link: http://lkml.kernel.org/r/20200615140658.601684-1-hannes@cmpxchg.org
Fixes: 8a931f801340 ("mm: memcontrol: recursive memory.low protection")
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Reported-by: Tejun Heo <tj@kernel.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Chris Down <chris@chrisdown.name>
Cc: Roman Gushchin <guro@fb.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/memcontrol.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/mm/memcontrol.c~mm-memcontrol-handle-div0-crash-race-condition-in-memorylow
+++ a/mm/memcontrol.c
@@ -6360,11 +6360,16 @@ static unsigned long effective_protectio
 	 * We're using unprotected memory for the weight so that if
 	 * some cgroups DO claim explicit protection, we don't protect
 	 * the same bytes twice.
+	 *
+	 * Check both usage and parent_usage against the respective
+	 * protected values. One should imply the other, but they
+	 * aren't read atomically - make sure the division is sane.
 	 */
 	if (!(cgrp_dfl_root.flags & CGRP_ROOT_MEMORY_RECURSIVE_PROT))
 		return ep;

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 21/32] mm/memcontrol.c: add missed css_put()
  2020-06-26  3:28 incoming Andrew Morton
                   ` (19 preceding siblings ...)
  2020-06-26  3:30 ` [patch 20/32] mm: memcontrol: handle div0 crash race condition in memory.low Andrew Morton
@ 2020-06-26  3:30 ` Andrew Morton
  2020-06-26  3:30 ` [patch 22/32] mm/memcontrol.c: prevent missed memory.low load tears Andrew Morton
                   ` (43 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:30 UTC (permalink / raw)
  To: akpm, cai, guro, hannes, mhocko, mm-commits, songmuchun, stable,
	torvalds, vdavydov.dev

From: Muchun Song <songmuchun@bytedance.com>
Subject: mm/memcontrol.c: add missed css_put()

We should put the css reference when memory allocation failed.

Link: http://lkml.kernel.org/r/20200614122653.98829-1-songmuchun@bytedance.com
Fixes: f0a3a24b532d ("mm: memcg/slab: rework non-root kmem_cache lifecycle management")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Acked-by: Roman Gushchin <guro@fb.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Qian Cai <cai@lca.pw>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/memcontrol.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/mm/memcontrol.c~mm-memcontrol-fix-do-not-put-the-css-reference
+++ a/mm/memcontrol.c
@@ -2772,8 +2772,10 @@ static void memcg_schedule_kmem_cache_cr
 		return;
 
 	cw = kmalloc(sizeof(*cw), GFP_NOWAIT | __GFP_NOWARN);
-	if (!cw)
+	if (!cw) {
+		css_put(&memcg->css);
 		return;
+	}
 
 	cw->memcg = memcg;
 	cw->cachep = cachep;
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 22/32] mm/memcontrol.c: prevent missed memory.low load tears
  2020-06-26  3:28 incoming Andrew Morton
                   ` (20 preceding siblings ...)
  2020-06-26  3:30 ` [patch 21/32] mm/memcontrol.c: add missed css_put() Andrew Morton
@ 2020-06-26  3:30 ` Andrew Morton
  2020-06-26  3:30 ` [patch 23/32] docs: mm/gup: minor documentation update Andrew Morton
                   ` (42 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:30 UTC (permalink / raw)
  To: akpm, chris, mhocko, mkoutny, mm-commits, torvalds

From: Chris Down <chris@chrisdown.name>
Subject: mm/memcontrol.c: prevent missed memory.low load tears

Looks like one of these got missed when massaging in f86b810c2610 ("mm,
memcg: prevent memory.low load/store tearing") with other linux-mm
changes.

Link: http://lkml.kernel.org/r/20200612174437.GA391453@chrisdown.name
Signed-off-by: Chris Down <chris@chrisdown.name>
Reported-by: Michal Koutny <mkoutny@suse.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/memcontrol.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/mm/memcontrol.c~mm-memcg-prevent-missed-memorylow-load-tears
+++ a/mm/memcontrol.c
@@ -6423,7 +6423,7 @@ enum mem_cgroup_protection mem_cgroup_pr
 
 	if (parent == root) {
 		memcg->memory.emin = READ_ONCE(memcg->memory.min);
-		memcg->memory.elow = memcg->memory.low;
+		memcg->memory.elow = READ_ONCE(memcg->memory.low);
 		goto out;
 	}
 
@@ -6435,7 +6435,8 @@ enum mem_cgroup_protection mem_cgroup_pr
 			atomic_long_read(&parent->memory.children_min_usage)));
 
 	WRITE_ONCE(memcg->memory.elow, effective_protection(usage, parent_usage,
-			memcg->memory.low, READ_ONCE(parent->memory.elow),
+			READ_ONCE(memcg->memory.low),
+			READ_ONCE(parent->memory.elow),
 			atomic_long_read(&parent->memory.children_low_usage)));
 
 out:
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 23/32] docs: mm/gup: minor documentation update
  2020-06-26  3:28 incoming Andrew Morton
                   ` (21 preceding siblings ...)
  2020-06-26  3:30 ` [patch 22/32] mm/memcontrol.c: prevent missed memory.low load tears Andrew Morton
@ 2020-06-26  3:30 ` Andrew Morton
  2020-06-26  3:30 ` [patch 24/32] doc: THP CoW fault no longer allocate THP Andrew Morton
                   ` (41 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:30 UTC (permalink / raw)
  To: akpm, corbet, jack, jhubbard, jrdr.linux, kirill.shutemov,
	mm-commits, torvalds

From: Souptick Joarder <jrdr.linux@gmail.com>
Subject: docs: mm/gup: minor documentation update

Now there are 5 cases. Updated the same.

Link: http://lkml.kernel.org/r/1592422023-7401-1-git-send-email-jrdr.linux@gmail.com
Signed-off-by: Souptick Joarder <jrdr.linux@gmail.com>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Jan Kara <jack@suse.cz>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 Documentation/core-api/pin_user_pages.rst |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/Documentation/core-api/pin_user_pages.rst~docs-mm-gup-minor-documentation-update
+++ a/Documentation/core-api/pin_user_pages.rst
@@ -33,7 +33,7 @@ all combinations of get*(), pin*(), FOLL
 pin_user_pages*() APIs are clearly distinct from the get_user_pages*() APIs, so
 that's a natural dividing line, and a good point to make separate wrapper calls.
 In other words, use pin_user_pages*() for DMA-pinned pages, and
-get_user_pages*() for other cases. There are four cases described later on in
+get_user_pages*() for other cases. There are five cases described later on in
 this document, to further clarify that concept.
 
 FOLL_PIN and FOLL_GET are mutually exclusive for a given gup call. However,
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 24/32] doc: THP CoW fault no longer allocate THP
  2020-06-26  3:28 incoming Andrew Morton
                   ` (22 preceding siblings ...)
  2020-06-26  3:30 ` [patch 23/32] docs: mm/gup: minor documentation update Andrew Morton
@ 2020-06-26  3:30 ` Andrew Morton
  2020-06-26  3:30 ` [patch 25/32] mm: workingset: age nonresident information alongside anonymous pages Andrew Morton
                   ` (40 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:30 UTC (permalink / raw)
  To: akpm, corbet, kirill.shutemov, mm-commits, torvalds, yang.shi, ziy

From: Yang Shi <yang.shi@linux.alibaba.com>
Subject: doc: THP CoW fault no longer allocate THP

Since commit 3917c80280c93a7123f ("thp: change CoW semantics for
anon-THP"), THP CoW page fault is rewritten.  Now it just splits pmd then
fallback to base page fault, it doesn't try to allocate THP anymore.  So
it is no longer counted in THP_FAULT_ALLOC.

Remove the obsolete statement in documentation about THP CoW allocation to
avoid confusion.

Link: http://lkml.kernel.org/r/1592424895-5421-1-git-send-email-yang.shi@linux.alibaba.com
Signed-off-by: Yang Shi <yang.shi@linux.alibaba.com>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 Documentation/admin-guide/cgroup-v2.rst    |    4 ++--
 Documentation/admin-guide/mm/transhuge.rst |    3 +--
 2 files changed, 3 insertions(+), 4 deletions(-)

--- a/Documentation/admin-guide/cgroup-v2.rst~doc-thp-cow-fault-no-longer-allocate-thp
+++ a/Documentation/admin-guide/cgroup-v2.rst
@@ -1356,8 +1356,8 @@ PAGE_SIZE multiple when read back.
 
 	  thp_fault_alloc
 		Number of transparent hugepages which were allocated to satisfy
-		a page fault, including COW faults. This counter is not present
-		when CONFIG_TRANSPARENT_HUGEPAGE is not set.
+		a page fault. This counter is not present when CONFIG_TRANSPARENT_HUGEPAGE
+                is not set.
 
 	  thp_collapse_alloc
 		Number of transparent hugepages which were allocated to allow
--- a/Documentation/admin-guide/mm/transhuge.rst~doc-thp-cow-fault-no-longer-allocate-thp
+++ a/Documentation/admin-guide/mm/transhuge.rst
@@ -305,8 +305,7 @@ monitor how successfully the system is p
 
 thp_fault_alloc
 	is incremented every time a huge page is successfully
-	allocated to handle a page fault. This applies to both the
-	first time a page is faulted and for COW faults.
+	allocated to handle a page fault.
 
 thp_collapse_alloc
 	is incremented by khugepaged when it has found
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 25/32] mm: workingset: age nonresident information alongside anonymous pages
  2020-06-26  3:28 incoming Andrew Morton
                   ` (23 preceding siblings ...)
  2020-06-26  3:30 ` [patch 24/32] doc: THP CoW fault no longer allocate THP Andrew Morton
@ 2020-06-26  3:30 ` Andrew Morton
  2020-06-26  3:30 ` [patch 26/32] mm/swap: fix for "mm: workingset: age nonresident information alongside anonymous pages" Andrew Morton
                   ` (39 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:30 UTC (permalink / raw)
  To: akpm, hannes, iamjoonsoo.kim, js1304, mhocko, minchan.kim,
	mm-commits, riel, torvalds

From: Johannes Weiner <hannes@cmpxchg.org>
Subject: mm: workingset: age nonresident information alongside anonymous pages

Patch series "fix for "mm: balance LRU lists based on relative thrashing" patchset"

This patchset fixes some problems of the patchset, "mm: balance LRU lists
based on relative thrashing", which is now merged on the mainline.

Patch "mm: workingset: let cache workingset challenge anon fix" is the
result of discussion with Johannes.  See following link.

http://lkml.kernel.org/r/20200520232525.798933-6-hannes@cmpxchg.org

And, the other two are minor things which are found when I try to rebase
my patchset.


This patch (of 3):
After ("mm: workingset: let cache workingset challenge anon fix"), we
compare refault distances to active_file + anon.  But age of the
non-resident information is only driven by the file LRU.  As a result, we
may overestimate the recency of any incoming refaults and activate them
too eagerly, causing unnecessary LRU churn in certain situations.

Make anon aging drive nonresident age as well to address that.

Link: http://lkml.kernel.org/r/1592288204-27734-1-git-send-email-iamjoonsoo.kim@lge.com
Link: http://lkml.kernel.org/r/1592288204-27734-2-git-send-email-iamjoonsoo.kim@lge.com
Fixes: 34e58cac6d8f2a ("mm: workingset: let cache workingset challenge anon")
Reported-by: Joonsoo Kim <js1304@gmail.com>
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Minchan Kim <minchan.kim@gmail.com>
Cc: Michal Hocko <mhocko@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 include/linux/mmzone.h |    4 +--
 include/linux/swap.h   |    1 
 mm/vmscan.c            |    3 ++
 mm/workingset.c        |   46 ++++++++++++++++++++++-----------------
 4 files changed, 33 insertions(+), 21 deletions(-)

--- a/include/linux/mmzone.h~mm-workingset-age-nonresident-information-alongside-anonymous-pages
+++ a/include/linux/mmzone.h
@@ -257,8 +257,8 @@ struct lruvec {
 	 */
 	unsigned long			anon_cost;
 	unsigned long			file_cost;
-	/* Evictions & activations on the inactive file list */
-	atomic_long_t			inactive_age;
+	/* Non-resident age, driven by LRU movement */
+	atomic_long_t			nonresident_age;
 	/* Refaults at the time of last reclaim cycle */
 	unsigned long			refaults;
 	/* Various lruvec state flags (enum lruvec_flags) */
--- a/include/linux/swap.h~mm-workingset-age-nonresident-information-alongside-anonymous-pages
+++ a/include/linux/swap.h
@@ -313,6 +313,7 @@ struct vma_swap_readahead {
 };
 
 /* linux/mm/workingset.c */
+void workingset_age_nonresident(struct lruvec *lruvec, unsigned long nr_pages);
 void *workingset_eviction(struct page *page, struct mem_cgroup *target_memcg);
 void workingset_refault(struct page *page, void *shadow);
 void workingset_activation(struct page *page);
--- a/mm/vmscan.c~mm-workingset-age-nonresident-information-alongside-anonymous-pages
+++ a/mm/vmscan.c
@@ -904,6 +904,7 @@ static int __remove_mapping(struct addre
 		__delete_from_swap_cache(page, swap);
 		xa_unlock_irqrestore(&mapping->i_pages, flags);
 		put_swap_page(page, swap);
+		workingset_eviction(page, target_memcg);
 	} else {
 		void (*freepage)(struct page *);
 		void *shadow = NULL;
@@ -1884,6 +1885,8 @@ static unsigned noinline_for_stack move_
 				list_add(&page->lru, &pages_to_free);
 		} else {
 			nr_moved += nr_pages;
+			if (PageActive(page))
+				workingset_age_nonresident(lruvec, nr_pages);
 		}
 	}
 
--- a/mm/workingset.c~mm-workingset-age-nonresident-information-alongside-anonymous-pages
+++ a/mm/workingset.c
@@ -156,8 +156,8 @@
  *
  *		Implementation
  *
- * For each node's file LRU lists, a counter for inactive evictions
- * and activations is maintained (node->inactive_age).
+ * For each node's LRU lists, a counter for inactive evictions and
+ * activations is maintained (node->nonresident_age).
  *
  * On eviction, a snapshot of this counter (along with some bits to
  * identify the node) is stored in the now empty page cache
@@ -213,7 +213,17 @@ static void unpack_shadow(void *shadow,
 	*workingsetp = workingset;
 }
 
-static void advance_inactive_age(struct mem_cgroup *memcg, pg_data_t *pgdat)
+/**
+ * workingset_age_nonresident - age non-resident entries as LRU ages
+ * @memcg: the lruvec that was aged
+ * @nr_pages: the number of pages to count
+ *
+ * As in-memory pages are aged, non-resident pages need to be aged as
+ * well, in order for the refault distances later on to be comparable
+ * to the in-memory dimensions. This function allows reclaim and LRU
+ * operations to drive the non-resident aging along in parallel.
+ */
+void workingset_age_nonresident(struct lruvec *lruvec, unsigned long nr_pages)
 {
 	/*
 	 * Reclaiming a cgroup means reclaiming all its children in a
@@ -227,11 +237,8 @@ static void advance_inactive_age(struct
 	 * the root cgroup's, age as well.
 	 */
 	do {
-		struct lruvec *lruvec;
-
-		lruvec = mem_cgroup_lruvec(memcg, pgdat);
-		atomic_long_inc(&lruvec->inactive_age);
-	} while (memcg && (memcg = parent_mem_cgroup(memcg)));
+		atomic_long_add(nr_pages, &lruvec->nonresident_age);
+	} while ((lruvec = parent_lruvec(lruvec)));
 }
 
 /**
@@ -254,12 +261,11 @@ void *workingset_eviction(struct page *p
 	VM_BUG_ON_PAGE(page_count(page), page);
 	VM_BUG_ON_PAGE(!PageLocked(page), page);
 
-	advance_inactive_age(page_memcg(page), pgdat);
-
 	lruvec = mem_cgroup_lruvec(target_memcg, pgdat);
+	workingset_age_nonresident(lruvec, hpage_nr_pages(page));
 	/* XXX: target_memcg can be NULL, go through lruvec */
 	memcgid = mem_cgroup_id(lruvec_memcg(lruvec));
-	eviction = atomic_long_read(&lruvec->inactive_age);
+	eviction = atomic_long_read(&lruvec->nonresident_age);
 	return pack_shadow(memcgid, pgdat, eviction, PageWorkingset(page));
 }
 
@@ -309,20 +315,20 @@ void workingset_refault(struct page *pag
 	if (!mem_cgroup_disabled() && !eviction_memcg)
 		goto out;
 	eviction_lruvec = mem_cgroup_lruvec(eviction_memcg, pgdat);
-	refault = atomic_long_read(&eviction_lruvec->inactive_age);
+	refault = atomic_long_read(&eviction_lruvec->nonresident_age);
 
 	/*
 	 * Calculate the refault distance
 	 *
 	 * The unsigned subtraction here gives an accurate distance
-	 * across inactive_age overflows in most cases. There is a
+	 * across nonresident_age overflows in most cases. There is a
 	 * special case: usually, shadow entries have a short lifetime
 	 * and are either refaulted or reclaimed along with the inode
 	 * before they get too old.  But it is not impossible for the
-	 * inactive_age to lap a shadow entry in the field, which can
-	 * then result in a false small refault distance, leading to a
-	 * false activation should this old entry actually refault
-	 * again.  However, earlier kernels used to deactivate
+	 * nonresident_age to lap a shadow entry in the field, which
+	 * can then result in a false small refault distance, leading
+	 * to a false activation should this old entry actually
+	 * refault again.  However, earlier kernels used to deactivate
 	 * unconditionally with *every* reclaim invocation for the
 	 * longest time, so the occasional inappropriate activation
 	 * leading to pressure on the active list is not a problem.
@@ -359,7 +365,7 @@ void workingset_refault(struct page *pag
 		goto out;
 
 	SetPageActive(page);
-	advance_inactive_age(memcg, pgdat);
+	workingset_age_nonresident(lruvec, hpage_nr_pages(page));
 	inc_lruvec_state(lruvec, WORKINGSET_ACTIVATE);
 
 	/* Page was active prior to eviction */
@@ -382,6 +388,7 @@ out:
 void workingset_activation(struct page *page)
 {
 	struct mem_cgroup *memcg;
+	struct lruvec *lruvec;
 
 	rcu_read_lock();
 	/*
@@ -394,7 +401,8 @@ void workingset_activation(struct page *
 	memcg = page_memcg_rcu(page);
 	if (!mem_cgroup_disabled() && !memcg)
 		goto out;
-	advance_inactive_age(memcg, page_pgdat(page));
+	lruvec = mem_cgroup_page_lruvec(page, page_pgdat(page));
+	workingset_age_nonresident(lruvec, hpage_nr_pages(page));
 out:
 	rcu_read_unlock();
 }
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 26/32] mm/swap: fix for "mm: workingset: age nonresident information alongside anonymous pages"
  2020-06-26  3:28 incoming Andrew Morton
                   ` (24 preceding siblings ...)
  2020-06-26  3:30 ` [patch 25/32] mm: workingset: age nonresident information alongside anonymous pages Andrew Morton
@ 2020-06-26  3:30 ` Andrew Morton
  2020-06-26  3:30 ` [patch 27/32] mm/memory: fix IO cost for anonymous page Andrew Morton
                   ` (38 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:30 UTC (permalink / raw)
  To: akpm, hannes, iamjoonsoo.kim, js1304, mhocko, minchan.kim,
	mm-commits, riel, torvalds

From: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Subject: mm/swap: fix for "mm: workingset: age nonresident information alongside anonymous pages"

Non-file-lru page could also be activated in mark_page_accessed()
and we need to count this activation for nonresident_age.

Note that it's better for this patch to be squashed into the patch
"mm: workingset: age nonresident information alongside anonymous pages".

Link: http://lkml.kernel.org/r/1592288204-27734-3-git-send-email-iamjoonsoo.kim@lge.com
Signed-off-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Joonsoo Kim <js1304@gmail.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Minchan Kim <minchan.kim@gmail.com>
Cc: Rik van Riel <riel@surriel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/swap.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/mm/swap.c~mm-swap-fix-for-mm-workingset-age-nonresident-information-alongside-anonymous-pages
+++ a/mm/swap.c
@@ -443,8 +443,7 @@ void mark_page_accessed(struct page *pag
 		else
 			__lru_cache_activate_page(page);
 		ClearPageReferenced(page);
-		if (page_is_file_lru(page))
-			workingset_activation(page);
+		workingset_activation(page);
 	}
 	if (page_is_idle(page))
 		clear_page_idle(page);
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 27/32] mm/memory: fix IO cost for anonymous page
  2020-06-26  3:28 incoming Andrew Morton
                   ` (25 preceding siblings ...)
  2020-06-26  3:30 ` [patch 26/32] mm/swap: fix for "mm: workingset: age nonresident information alongside anonymous pages" Andrew Morton
@ 2020-06-26  3:30 ` Andrew Morton
  2020-06-26  3:30 ` [patch 28/32] x86/hyperv: allocate the hypercall page with only read and execute bits Andrew Morton
                   ` (37 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:30 UTC (permalink / raw)
  To: akpm, hannes, iamjoonsoo.kim, js1304, mhocko, minchan.kim,
	mm-commits, riel, torvalds

From: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Subject: mm/memory: fix IO cost for anonymous page

With synchronous IO swap device, swap-in is directly handled in fault
code.  Since IO cost notation isn't added there, with synchronous IO swap
device, LRU balancing could be wrongly biased.  Fix it to count it in
fault code.

Link: http://lkml.kernel.org/r/1592288204-27734-4-git-send-email-iamjoonsoo.kim@lge.com
Fixes: 314b57fb0460001 ("mm: balance LRU lists based on relative thrashing cache sizing")
Signed-off-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Joonsoo Kim <js1304@gmail.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Minchan Kim <minchan.kim@gmail.com>
Cc: Rik van Riel <riel@surriel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/memory.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/mm/memory.c~mm-memory-fix-io-cost-for-anonymous-page
+++ a/mm/memory.c
@@ -3146,6 +3146,14 @@ vm_fault_t do_swap_page(struct vm_fault
 					goto out_page;
 				}
 
+				/*
+				 * XXX: Move to lru_cache_add() when it
+				 * supports new vs putback
+				 */
+				spin_lock_irq(&page_pgdat(page)->lru_lock);
+				lru_note_cost_page(page);
+				spin_unlock_irq(&page_pgdat(page)->lru_lock);
+
 				lru_cache_add(page);
 				swap_readpage(page, true);
 			}
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 28/32] x86/hyperv: allocate the hypercall page with only read and execute bits
  2020-06-26  3:28 incoming Andrew Morton
                   ` (26 preceding siblings ...)
  2020-06-26  3:30 ` [patch 27/32] mm/memory: fix IO cost for anonymous page Andrew Morton
@ 2020-06-26  3:30 ` Andrew Morton
  2020-06-26  3:30 ` [patch 29/32] arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page Andrew Morton
                   ` (36 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:30 UTC (permalink / raw)
  To: akpm, catalin.marinas, david, decui, hch, jeyu, mm-commits,
	peterz, torvalds, vkuznets, wei.liu, will

From: Christoph Hellwig <hch@lst.de>
Subject: x86/hyperv: allocate the hypercall page with only read and execute bits

Patch series "fix a hyperv W^X violation and remove vmalloc_exec"

Dexuan reported a W^X violation due to the fact that the hyper hypercall
page due switching it to be allocated using vmalloc_exec.  The problem is
that PAGE_KERNEL_EXEC as used by vmalloc_exec actually sets writable
permissions in the pte.  This series fixes the issue by switching to the
low-level __vmalloc_node_range interface that allows specifing more
detailed permissions instead.  It then also open codes the other two
callers and removes the somewhat confusing vmalloc_exec interface.

Peter noted that the hyper hypercall page allocation also has another long
standing issue in that it shouldn't use the full vmalloc but just the
module space.  This issue is so far theoretical as the allocation is done
early in the boot process.  I plan to fix it with another bigger series
for 5.9.


This patch (of 3):

Avoid a W^X violation cause by the fact that PAGE_KERNEL_EXEC includes the
writable bit.

For this resurrect the removed PAGE_KERNEL_RX definitіon, but as
PAGE_KERNEL_ROX to match arm64 and powerpc.

Link: http://lkml.kernel.org/r/20200618064307.32739-2-hch@lst.de
Fixes: 78bb17f76edc ("x86/hyperv: use vmalloc_exec for the hypercall page")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reported-by: Dexuan Cui <decui@microsoft.com>
Tested-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Acked-by: Wei Liu <wei.liu@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Jessica Yu <jeyu@kernel.org>
Cc: David Hildenbrand <david@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 arch/x86/hyperv/hv_init.c            |    4 +++-
 arch/x86/include/asm/pgtable_types.h |    2 ++
 2 files changed, 5 insertions(+), 1 deletion(-)

--- a/arch/x86/hyperv/hv_init.c~x86-hyperv-allocate-the-hypercall-page-with-only-read-and-execute-bits
+++ a/arch/x86/hyperv/hv_init.c
@@ -375,7 +375,9 @@ void __init hyperv_init(void)
 	guest_id = generate_guest_id(0, LINUX_VERSION_CODE, 0);
 	wrmsrl(HV_X64_MSR_GUEST_OS_ID, guest_id);
 
-	hv_hypercall_pg = vmalloc_exec(PAGE_SIZE);
+	hv_hypercall_pg = __vmalloc_node_range(PAGE_SIZE, 1, VMALLOC_START,
+			VMALLOC_END, GFP_KERNEL, PAGE_KERNEL_ROX,
+			VM_FLUSH_RESET_PERMS, NUMA_NO_NODE, __func__);
 	if (hv_hypercall_pg == NULL) {
 		wrmsrl(HV_X64_MSR_GUEST_OS_ID, 0);
 		goto remove_cpuhp_state;
--- a/arch/x86/include/asm/pgtable_types.h~x86-hyperv-allocate-the-hypercall-page-with-only-read-and-execute-bits
+++ a/arch/x86/include/asm/pgtable_types.h
@@ -194,6 +194,7 @@ enum page_cache_mode {
 #define _PAGE_TABLE_NOENC	 (__PP|__RW|_USR|___A|   0|___D|   0|   0)
 #define _PAGE_TABLE		 (__PP|__RW|_USR|___A|   0|___D|   0|   0| _ENC)
 #define __PAGE_KERNEL_RO	 (__PP|   0|   0|___A|__NX|___D|   0|___G)
+#define __PAGE_KERNEL_ROX	 (__PP|   0|   0|___A|   0|___D|   0|___G)
 #define __PAGE_KERNEL_NOCACHE	 (__PP|__RW|   0|___A|__NX|___D|   0|___G| __NC)
 #define __PAGE_KERNEL_VVAR	 (__PP|   0|_USR|___A|__NX|___D|   0|___G)
 #define __PAGE_KERNEL_LARGE	 (__PP|__RW|   0|___A|__NX|___D|_PSE|___G)
@@ -219,6 +220,7 @@ enum page_cache_mode {
 #define PAGE_KERNEL_RO		__pgprot_mask(__PAGE_KERNEL_RO         | _ENC)
 #define PAGE_KERNEL_EXEC	__pgprot_mask(__PAGE_KERNEL_EXEC       | _ENC)
 #define PAGE_KERNEL_EXEC_NOENC	__pgprot_mask(__PAGE_KERNEL_EXEC       |    0)
+#define PAGE_KERNEL_ROX		__pgprot_mask(__PAGE_KERNEL_ROX        | _ENC)
 #define PAGE_KERNEL_NOCACHE	__pgprot_mask(__PAGE_KERNEL_NOCACHE    | _ENC)
 #define PAGE_KERNEL_LARGE	__pgprot_mask(__PAGE_KERNEL_LARGE      | _ENC)
 #define PAGE_KERNEL_LARGE_EXEC	__pgprot_mask(__PAGE_KERNEL_LARGE_EXEC | _ENC)
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 29/32] arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page
  2020-06-26  3:28 incoming Andrew Morton
                   ` (27 preceding siblings ...)
  2020-06-26  3:30 ` [patch 28/32] x86/hyperv: allocate the hypercall page with only read and execute bits Andrew Morton
@ 2020-06-26  3:30 ` Andrew Morton
  2020-06-26  3:30 ` [patch 30/32] mm: remove vmalloc_exec Andrew Morton
                   ` (35 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:30 UTC (permalink / raw)
  To: akpm, catalin.marinas, david, decui, hch, jeyu, mm-commits,
	peterz, torvalds, vkuznets, wei.liu, will

From: Christoph Hellwig <hch@lst.de>
Subject: arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page

Use PAGE_KERNEL_ROX directly instead of allocating RWX and setting the
page read-only just after the allocation.

Link: http://lkml.kernel.org/r/20200618064307.32739-3-hch@lst.de
Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dexuan Cui <decui@microsoft.com>
Cc: Jessica Yu <jeyu@kernel.org>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Cc: Wei Liu <wei.liu@kernel.org>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 arch/arm64/kernel/probes/kprobes.c |   12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

--- a/arch/arm64/kernel/probes/kprobes.c~arm64-use-page_kernel_rox-directly-in-alloc_insn_page
+++ a/arch/arm64/kernel/probes/kprobes.c
@@ -120,15 +120,9 @@ int __kprobes arch_prepare_kprobe(struct
 
 void *alloc_insn_page(void)
 {
-	void *page;
-
-	page = vmalloc_exec(PAGE_SIZE);
-	if (page) {
-		set_memory_ro((unsigned long)page, 1);
-		set_vm_flush_reset_perms(page);
-	}

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 30/32] mm: remove vmalloc_exec
  2020-06-26  3:28 incoming Andrew Morton
                   ` (28 preceding siblings ...)
  2020-06-26  3:30 ` [patch 29/32] arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page Andrew Morton
@ 2020-06-26  3:30 ` Andrew Morton
  2020-06-26  3:30 ` [patch 31/32] mm/memory_hotplug.c: fix false softlockup during pfn range removal Andrew Morton
                   ` (34 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:30 UTC (permalink / raw)
  To: akpm, catalin.marinas, david, decui, hch, jeyu, mm-commits,
	peterz, torvalds, vkuznets, wei.liu, will

From: Christoph Hellwig <hch@lst.de>
Subject: mm: remove vmalloc_exec

Merge vmalloc_exec into its only caller.  Note that for !CONFIG_MMU
__vmalloc_node_range maps to __vmalloc, which directly clears the
__GFP_HIGHMEM added by the vmalloc_exec stub anyway.

Link: http://lkml.kernel.org/r/20200618064307.32739-4-hch@lst.de
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: David Hildenbrand <david@redhat.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dexuan Cui <decui@microsoft.com>
Cc: Jessica Yu <jeyu@kernel.org>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Cc: Wei Liu <wei.liu@kernel.org>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 include/linux/vmalloc.h |    1 -
 kernel/module.c         |    4 +++-
 mm/nommu.c              |   17 -----------------
 mm/vmalloc.c            |   20 --------------------
 4 files changed, 3 insertions(+), 39 deletions(-)

--- a/include/linux/vmalloc.h~mm-remove-vmalloc_exec
+++ a/include/linux/vmalloc.h
@@ -106,7 +106,6 @@ extern void *vzalloc(unsigned long size)
 extern void *vmalloc_user(unsigned long size);
 extern void *vmalloc_node(unsigned long size, int node);
 extern void *vzalloc_node(unsigned long size, int node);
-extern void *vmalloc_exec(unsigned long size);
 extern void *vmalloc_32(unsigned long size);
 extern void *vmalloc_32_user(unsigned long size);
 extern void *__vmalloc(unsigned long size, gfp_t gfp_mask);
--- a/kernel/module.c~mm-remove-vmalloc_exec
+++ a/kernel/module.c
@@ -2783,7 +2783,9 @@ static void dynamic_debug_remove(struct
 
 void * __weak module_alloc(unsigned long size)
 {
-	return vmalloc_exec(size);
+	return __vmalloc_node_range(size, 1, VMALLOC_START, VMALLOC_END,
+			GFP_KERNEL, PAGE_KERNEL_EXEC, VM_FLUSH_RESET_PERMS,
+			NUMA_NO_NODE, __func__);
 }
 
 bool __weak module_init_section(const char *name)
--- a/mm/nommu.c~mm-remove-vmalloc_exec
+++ a/mm/nommu.c
@@ -291,23 +291,6 @@ void *vzalloc_node(unsigned long size, i
 EXPORT_SYMBOL(vzalloc_node);
 
 /**
- *	vmalloc_exec  -  allocate virtually contiguous, executable memory
- *	@size:		allocation size
- *
- *	Kernel-internal function to allocate enough pages to cover @size
- *	the page level allocator and map them into contiguous and
- *	executable kernel virtual space.
- *
- *	For tight control over page level allocator and protection flags
- *	use __vmalloc() instead.
- */
-
-void *vmalloc_exec(unsigned long size)
-{
-	return __vmalloc(size, GFP_KERNEL | __GFP_HIGHMEM);
-}
-
-/**
  * vmalloc_32  -  allocate virtually contiguous memory (32bit addressable)
  *	@size:		allocation size
  *
--- a/mm/vmalloc.c~mm-remove-vmalloc_exec
+++ a/mm/vmalloc.c
@@ -2695,26 +2695,6 @@ void *vzalloc_node(unsigned long size, i
 }
 EXPORT_SYMBOL(vzalloc_node);
 
-/**
- * vmalloc_exec - allocate virtually contiguous, executable memory
- * @size:	  allocation size
- *
- * Kernel-internal function to allocate enough pages to cover @size
- * the page level allocator and map them into contiguous and
- * executable kernel virtual space.
- *
- * For tight control over page level allocator and protection flags
- * use __vmalloc() instead.
- *
- * Return: pointer to the allocated memory or %NULL on error
- */
-void *vmalloc_exec(unsigned long size)
-{
-	return __vmalloc_node_range(size, 1, VMALLOC_START, VMALLOC_END,
-			GFP_KERNEL, PAGE_KERNEL_EXEC, VM_FLUSH_RESET_PERMS,
-			NUMA_NO_NODE, __builtin_return_address(0));
-}

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 31/32] mm/memory_hotplug.c: fix false softlockup during pfn range removal
  2020-06-26  3:28 incoming Andrew Morton
                   ` (29 preceding siblings ...)
  2020-06-26  3:30 ` [patch 30/32] mm: remove vmalloc_exec Andrew Morton
@ 2020-06-26  3:30 ` Andrew Morton
  2020-06-26  3:30 ` [patch 32/32] MAINTAINERS: update info for sparse Andrew Morton
                   ` (33 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:30 UTC (permalink / raw)
  To: akpm, ben.widawsky, dan.j.williams, david, mm-commits, stable,
	steve.scargall, torvalds, vishal.l.verma

From: Ben Widawsky <ben.widawsky@intel.com>
Subject: mm/memory_hotplug.c: fix false softlockup during pfn range removal

When working with very large nodes, poisoning the struct pages (for which
there will be very many) can take a very long time.  If the system is
using voluntary preemptions, the software watchdog will not be able to
detect forward progress.  This patch addresses this issue by offering to
give up time like __remove_pages() does.  This behavior was introduced in
v5.6 with: commit d33695b16a9f ("mm/memory_hotplug: poison memmap in
remove_pfn_range_from_zone()")

Alternately, init_page_poison could do this cond_resched(), but it seems
to me that the caller of init_page_poison() is what actually knows whether
or not it should relax its own priority.

Based on Dan's notes, I think this is perfectly safe: commit f931ab479dd2
("mm: fix devm_memremap_pages crash, use mem_hotplug_{begin, done}")

Aside from fixing the lockup, it is also a friendlier thing to do on lower
core systems that might wipe out large chunks of hotplug memory (probably
not a very common case).

Fixes this kind of splat:
[  352.142079] watchdog: BUG: soft lockup - CPU#46 stuck for 22s! [daxctl:9922]
[  352.150067] Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_tables ebtable_nat ebtable_broute ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_raw iptable_security rfkill ip_set nfnetlink ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ib_isert iscsi_target_mod ib_srpt target_core_mod ib_srp scsi_transport_srp ib_ipoib ib_umad vfat fat kmem intel_rapl_msr intel_rapl_common rpcrdma sunrpc rdma_ucm ib_iser isst_if_common rdma_cm skx_edac iw_cm ib_cm x86_pkg_temp_thermal libiscsi intel_powerclamp scsi_transport_iscsi coretemp kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel i40iw intel_cstate iTCO_wdt ib_uverbs iTCO_vendor_support device_dax ib_core joydev intel_uncore i2c_i801 lpc_ich ipmi_ssif ioatdma dca wmi ipmi_si ipmi_devintf ipmi_msghandler dax_pmem
[  352.150123]  dax_pmem_core acpi_pad acpi_power_meter drm ip_tables xfs libcrc32c nd_pmem nd_btt i40e e1000e crc32c_intel nfit
[  352.260774] irq event stamp: 138450
[  352.264692] hardirqs last  enabled at (138449): [<ffffffffa1001f26>] trace_hardirqs_on_thunk+0x1a/0x1c
[  352.275134] hardirqs last disabled at (138450): [<ffffffffa1001f42>] trace_hardirqs_off_thunk+0x1a/0x1c
[  352.285662] softirqs last  enabled at (138448): [<ffffffffa1e00347>] __do_softirq+0x347/0x456
[  352.295233] softirqs last disabled at (138443): [<ffffffffa10c416d>] irq_exit+0x7d/0xb0
[  352.304210] CPU: 46 PID: 9922 Comm: daxctl Not tainted 5.7.0-BEN-14238-g373c6049b336 #30
[  352.313283] Hardware name: Intel Corporation PURLEY/PURLEY, BIOS PLYXCRB1.86B.0578.D07.1902280810 02/28/2019
[  352.324308] RIP: 0010:memset_erms+0x9/0x10
[  352.328905] Code: c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 f3 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 <f3> aa 4c 89 c8 c3 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 01
[  352.349953] RSP: 0018:ffffc90021b5fd50 EFLAGS: 00010202 ORIG_RAX: ffffffffffffff13
[  352.358450] RAX: 00000000000000ff RBX: ffff88983ffd5000 RCX: 0000000065df0e40
[  352.366457] RDX: 00000003a0000000 RSI: 00000000ffffffff RDI: ffffea039b20f1c0
[  352.374465] RBP: ffff88983ffd6c00 R08: 0000000000000000 R09: ffffea0061000000
[  352.382473] R10: 0000000000000001 R11: 0000000000000000 R12: ffffea006f808000
[  352.390480] R13: 0000000001840000 R14: 000000000e800000 R15: ffff8997d7b764e0
[  352.398487] FS:  00007f724ef81780(0000) GS:ffff8997df100000(0000) knlGS:0000000000000000
[  352.407562] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  352.414011] CR2: 00007ffcd4070768 CR3: 000001178c722002 CR4: 00000000003606e0
[  352.422056] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  352.430092] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  352.438115] Call Trace:
[  352.440865]  remove_pfn_range_from_zone+0x3a/0x380
[  352.446244]  ? cpumask_next+0x17/0x20
[  352.450361]  memunmap_pages+0x17f/0x280
[  352.454670]  release_nodes+0x22a/0x260
[  352.458888]  __device_release_driver+0x172/0x220
[  352.464070]  device_driver_detach+0x3e/0xa0
[  352.468753]  unbind_store+0x113/0x130
[  352.472868]  kernfs_fop_write+0xdc/0x1c0
[  352.477273]  vfs_write+0xde/0x1d0
[  352.482218]  ksys_write+0x58/0xd0
[  352.487207]  do_syscall_64+0x5a/0x120
[  352.492529]  entry_SYSCALL_64_after_hwframe+0x49/0xb3
[  352.499446] RIP: 0033:0x7f724f40b5e7
[  352.504673] Code: Bad RIP value.
[  352.509484] RSP: 002b:00007ffcd40738f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  352.519213] RAX: ffffffffffffffda RBX: 00007f724ef816a8 RCX: 00007f724f40b5e7
[  352.528410] RDX: 0000000000000007 RSI: 00005617d7cd1277 RDI: 0000000000000003
[  352.537573] RBP: 0000000000000003 R08: 00000000ffffffff R09: 00007ffcd40737d0
[  352.546764] R10: 0000000000000000 R11: 0000000000000246 R12: 00005617d7cd1277
[  352.555929] R13: 0000000000000000 R14: 0000000000000007 R15: 00005617d7cd1230
[  370.353742] Built 2 zonelists, mobility grouping on.  Total pages: 49050381
[  370.373317] Policy zone: Normal
[  374.948164] Built 3 zonelists, mobility grouping on.  Total pages: 49312525
[  375.017496] Policy zone: Normal

David said: "It really only is an issue for devmem.  Ordinary
hotplugged system memory is not affected (onlined/offlined in memory
block granularity)."

Link: http://lkml.kernel.org/r/20200619231213.1160351-1-ben.widawsky@intel.com
Fixes: commit d33695b16a9f ("mm/memory_hotplug: poison memmap in remove_pfn_range_from_zone()")
Signed-off-by: Ben Widawsky <ben.widawsky@intel.com>
Reported-by: "Scargall, Steve" <steve.scargall@intel.com>
Reported-by: Ben Widawsky <ben.widawsky@intel.com>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/memory_hotplug.c |   13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

--- a/mm/memory_hotplug.c~mm-fix-false-softlockup-during-pfn-range-removal
+++ a/mm/memory_hotplug.c
@@ -471,11 +471,20 @@ void __ref remove_pfn_range_from_zone(st
 				      unsigned long start_pfn,
 				      unsigned long nr_pages)
 {
+	const unsigned long end_pfn = start_pfn + nr_pages;
 	struct pglist_data *pgdat = zone->zone_pgdat;
-	unsigned long flags;
+	unsigned long pfn, cur_nr_pages, flags;
 
 	/* Poison struct pages because they are now uninitialized again. */
-	page_init_poison(pfn_to_page(start_pfn), sizeof(struct page) * nr_pages);
+	for (pfn = start_pfn; pfn < end_pfn; pfn += cur_nr_pages) {
+		cond_resched();
+
+		/* Select all remaining pages up to the next section boundary */
+		cur_nr_pages =
+			min(end_pfn - pfn, SECTION_ALIGN_UP(pfn + 1) - pfn);
+		page_init_poison(pfn_to_page(pfn),
+				 sizeof(struct page) * cur_nr_pages);
+	}
 
 #ifdef CONFIG_ZONE_DEVICE
 	/*
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [patch 32/32] MAINTAINERS: update info for sparse
  2020-06-26  3:28 incoming Andrew Morton
                   ` (30 preceding siblings ...)
  2020-06-26  3:30 ` [patch 31/32] mm/memory_hotplug.c: fix false softlockup during pfn range removal Andrew Morton
@ 2020-06-26  3:30 ` Andrew Morton
  2020-06-27  3:32 ` + linux-next-git-rejects.patch added to -mm tree Andrew Morton
                   ` (32 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-26  3:30 UTC (permalink / raw)
  To: akpm, luc.vanoostenryck, mm-commits, torvalds

From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
Subject: MAINTAINERS: update info for sparse

Update the info for sparse. More specifically:
* change W entry to point to sparse.docs.kernel.org
* add Q & B entry (patchwork & bugzilla)

Link: http://lkml.kernel.org/r/20200621144204.53938-1-luc.vanoostenryck@gmail.com
Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 MAINTAINERS |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/MAINTAINERS~maintainers-update-info-for-sparse
+++ a/MAINTAINERS
@@ -16058,8 +16058,10 @@ SPARSE CHECKER
 M:	"Luc Van Oostenryck" <luc.vanoostenryck@gmail.com>
 L:	linux-sparse@vger.kernel.org
 S:	Maintained
-W:	https://sparse.wiki.kernel.org/
+W:	https://sparse.docs.kernel.org/
 T:	git git://git.kernel.org/pub/scm/devel/sparse/sparse.git
+Q:	https://patchwork.kernel.org/project/linux-sparse/list/
+B:	https://bugzilla.kernel.org/enter_bug.cgi?component=Sparse&product=Tools
 F:	include/linux/compiler.h
 
 SPEAR CLOCK FRAMEWORK SUPPORT
_

^ permalink raw reply	[flat|nested] 66+ messages in thread

* + linux-next-git-rejects.patch added to -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (31 preceding siblings ...)
  2020-06-26  3:30 ` [patch 32/32] MAINTAINERS: update info for sparse Andrew Morton
@ 2020-06-27  3:32 ` Andrew Morton
  2020-06-27  3:32 ` [merged] dma-remap-align-the-size-in-dma_common__remap.patch removed from " Andrew Morton
                   ` (31 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:32 UTC (permalink / raw)
  To: akpm, mm-commits


The patch titled
     Subject: linux-next-git-rejects
has been added to the -mm tree.  Its filename is
     linux-next-git-rejects.patch

This patch should soon appear at
    http://ozlabs.org/~akpm/mmots/broken-out/linux-next-git-rejects.patch
and later at
    http://ozlabs.org/~akpm/mmotm/broken-out/linux-next-git-rejects.patch

Before you just go and hit "reply", please:
   a) Consider who else should be cc'ed
   b) Prefer to cc a suitable mailing list as well
   c) Ideally: find the original patch on the mailing list and do a
      reply-to-all to that, adding suitable additional cc's

*** Remember to use Documentation/process/submit-checklist.rst when testing your code ***

The -mm tree is included into linux-next and is updated
there every 3-4 working days

------------------------------------------------------
From: Andrew Morton <akpm@linux-foundation.org>
Subject: linux-next-git-rejects

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 drivers/cpuidle/cpuidle.c              |    4 ----
 drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c |    5 -----
 net/xfrm/xfrm_device.c                 |    7 -------
 3 files changed, 16 deletions(-)

--- a/drivers/cpuidle/cpuidle.c~linux-next-git-rejects
+++ a/drivers/cpuidle/cpuidle.c
@@ -187,11 +187,7 @@ int cpuidle_enter_s2idle(struct cpuidle_
 	 * be frozen safely.
 	 */
 	index = find_deepest_state(drv, dev, U64_MAX, 0, true);
-<<<<<<< HEAD
-	if (index > 0) {
-=======
 	if (index > 0 && !current_clr_polling_and_test())
->>>>>>> linux-next/akpm-base
 		enter_s2idle_proper(drv, dev, index);
 		local_irq_enable();
 	}
--- a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c~linux-next-git-rejects
+++ a/drivers/gpu/drm/amd/amdgpu/sdma_v5_0.c
@@ -1300,13 +1300,8 @@ static int sdma_v5_0_sw_fini(void *handl
 	int i;
 
 	for (i = 0; i < adev->sdma.num_instances; i++) {
-<<<<<<< HEAD
-		if (adev->sdma.instance[i].fw != NULL)
-			release_firmware(adev->sdma.instance[i].fw);
-=======
 		release_firmware(adev->sdma.instance[i].fw);
 		adev->sdma.instance[i].fw = NULL;
->>>>>>> linux-next/akpm-base
 
 		amdgpu_ring_fini(&adev->sdma.instance[i].ring);
 	}
--- a/net/xfrm/xfrm_device.c~linux-next-git-rejects
+++ a/net/xfrm/xfrm_device.c
@@ -135,13 +135,6 @@ struct sk_buff *validate_xmit_xfrm(struc
 	}
 
 	xo->flags |= XFRM_XMIT;
-<<<<<<< HEAD
-
-	if (skb_is_gso(skb)) {
-		struct net_device *dev = skb->dev;
-=======
->>>>>>> linux-next/akpm-base

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] dma-remap-align-the-size-in-dma_common__remap.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (32 preceding siblings ...)
  2020-06-27  3:32 ` + linux-next-git-rejects.patch added to -mm tree Andrew Morton
@ 2020-06-27  3:32 ` Andrew Morton
  2020-06-27  3:32 ` [merged] openrisc-fix-boot-oops-when-debug_vm-is-enabled.patch " Andrew Morton
                   ` (30 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:32 UTC (permalink / raw)
  To: bbhushan2, eric.auger, hch, jean-philippe, m.szyprowski,
	mm-commits, peterz, robin.murphy


The patch titled
     Subject: kernel/dma/remap.c: align the size in dma_common_*_remap()
has been removed from the -mm tree.  Its filename was
     dma-remap-align-the-size-in-dma_common__remap.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Eric Auger <eric.auger@redhat.com>
Subject: kernel/dma/remap.c: align the size in dma_common_*_remap()

Running a guest with a virtio-iommu protecting virtio devices is broken
since commit 515e5b6d90d4 ("dma-mapping: use vmap insted of reimplementing
it").  Before the conversion, the size was page aligned in
__get_vm_area_node().  Doing so fixes the regression.

Link: http://lkml.kernel.org/r/20200622202320.1331-1-eric.auger@redhat.com
Fixes: 515e5b6d90d4 ("dma-mapping: use vmap insted of reimplementing it")
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Cc: Christoph Hellwig <hch@lst.de>
Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Marek Szyprowski <m.szyprowski@samsung.com>
Cc: Robin Murphy <robin.murphy@arm.com>
Cc: Jean-Philippe Brucker <jean-philippe@linaro.org>
Cc: Bharat Bhushan <bbhushan2@marvell.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 kernel/dma/remap.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/kernel/dma/remap.c~dma-remap-align-the-size-in-dma_common__remap
+++ a/kernel/dma/remap.c
@@ -24,7 +24,7 @@ void *dma_common_pages_remap(struct page
 {
 	void *vaddr;
 
-	vaddr = vmap(pages, size >> PAGE_SHIFT, VM_DMA_COHERENT, prot);
+	vaddr = vmap(pages, PAGE_ALIGN(size) >> PAGE_SHIFT, VM_DMA_COHERENT, prot);
 	if (vaddr)
 		find_vm_area(vaddr)->pages = pages;
 	return vaddr;
@@ -37,7 +37,7 @@ void *dma_common_pages_remap(struct page
 void *dma_common_contiguous_remap(struct page *page, size_t size,
 			pgprot_t prot, const void *caller)
 {
-	int count = size >> PAGE_SHIFT;
+	int count = PAGE_ALIGN(size) >> PAGE_SHIFT;
 	struct page **pages;
 	void *vaddr;
 	int i;
_

Patches currently in -mm which might be from eric.auger@redhat.com are

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] openrisc-fix-boot-oops-when-debug_vm-is-enabled.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (33 preceding siblings ...)
  2020-06-27  3:32 ` [merged] dma-remap-align-the-size-in-dma_common__remap.patch removed from " Andrew Morton
@ 2020-06-27  3:32 ` Andrew Morton
  2020-06-27  3:33 ` [merged] mm-do_swap_page-fix-up-the-error-code-instantiation.patch " Andrew Morton
                   ` (29 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:32 UTC (permalink / raw)
  To: daniel.m.jordan, jgg, jonas, mm-commits, robin.murphy, shorne,
	stefan.kristiansson, steven.price, thellstrom, vbabka, walken


The patch titled
     Subject: openrisc: fix boot oops when DEBUG_VM is enabled
has been removed from the -mm tree.  Its filename was
     openrisc-fix-boot-oops-when-debug_vm-is-enabled.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Stafford Horne <shorne@gmail.com>
Subject: openrisc: fix boot oops when DEBUG_VM is enabled

Since v5.8-rc1 OpenRISC Linux fails to boot when DEBUG_VM is enabled. 
This has been bisected to commit 42fc541404f2 ("mmap locking API: add
mmap_assert_locked() and mmap_assert_write_locked()").

The added locking checks exposed the issue that OpenRISC was not taking
this mmap lock when during page walks for DMA operations.  This patch
locks and unlocks the mmap lock for page walking.

Link: http://lkml.kernel.org/r/20200617090247.1680188-1-shorne@gmail.com
Fixes: 42fc541404f2 ("mmap locking API: add mmap_assert_locked() and mmap_assert_write_locked()"
Signed-off-by: Stafford Horne <shorne@gmail.com>
Reviewed-by: Michel Lespinasse <walken@google.com>
Cc: Jonas Bonn <jonas@southpole.se>
Cc: Stefan Kristiansson <stefan.kristiansson@saunalahti.fi>
Cc: Jason Gunthorpe <jgg@ziepe.ca>
Cc: Steven Price <steven.price@arm.com>
Cc: Thomas Hellstrom <thellstrom@vmware.com>
Cc: Robin Murphy <robin.murphy@arm.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Daniel Jordan <daniel.m.jordan@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 arch/openrisc/kernel/dma.c |    5 +++++
 1 file changed, 5 insertions(+)

--- a/arch/openrisc/kernel/dma.c~openrisc-fix-boot-oops-when-debug_vm-is-enabled
+++ a/arch/openrisc/kernel/dma.c
@@ -74,8 +74,11 @@ void *arch_dma_set_uncached(void *cpu_ad
 	 * We need to iterate through the pages, clearing the dcache for
 	 * them and setting the cache-inhibit bit.
 	 */
+	mmap_read_lock(&init_mm);
 	error = walk_page_range(&init_mm, va, va + size, &set_nocache_walk_ops,
 			NULL);
+	mmap_read_unlock(&init_mm);
+
 	if (error)
 		return ERR_PTR(error);
 	return cpu_addr;
@@ -85,9 +88,11 @@ void arch_dma_clear_uncached(void *cpu_a
 {
 	unsigned long va = (unsigned long)cpu_addr;
 
+	mmap_read_lock(&init_mm);
 	/* walk_page_range shouldn't be able to fail here */
 	WARN_ON(walk_page_range(&init_mm, va, va + size,
 			&clear_nocache_walk_ops, NULL));
+	mmap_read_unlock(&init_mm);
 }
 
 void arch_sync_dma_for_device(phys_addr_t addr, size_t size,
_

Patches currently in -mm which might be from shorne@gmail.com are

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] mm-do_swap_page-fix-up-the-error-code-instantiation.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (34 preceding siblings ...)
  2020-06-27  3:32 ` [merged] openrisc-fix-boot-oops-when-debug_vm-is-enabled.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] mm-compaction-make-capture-control-handling-safe-wrt-interrupts.patch " Andrew Morton
                   ` (28 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: alex.shi, guro, hannes, hughd, js1304, kirill, mhocko,
	mm-commits, shakeelb


The patch titled
     Subject: mm: do_swap_page(): fix up the error code
has been removed from the -mm tree.  Its filename was
     mm-do_swap_page-fix-up-the-error-code-instantiation.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Michal Hocko <mhocko@suse.com>
Subject: mm: do_swap_page(): fix up the error code

do_swap_page() returns error codes from the VM_FAULT* space.  try_charge()
might return -ENOMEM, though, and then do_swap_page() simply returns 0
which means a success.

We almost never return ENOMEM for GFP_KERNEL single page charge.  Except
for async OOM handling (oom_disabled v1).  So this needs translation to
VM_FAULT_OOM otherwise the the page fault path will not notify the
userspace and wait for an action.

Link: http://lkml.kernel.org/r/20200617090238.GL9499@dhcp22.suse.cz
Fixes: 4c6355b25e8b ("mm: memcontrol: charge swapin pages on instantiation")
Signed-off-by: Michal Hocko <mhocko@suse.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Alex Shi <alex.shi@linux.alibaba.com>
Cc: Joonsoo Kim <js1304@gmail.com>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
Cc: Roman Gushchin <guro@fb.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/memory.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/mm/memory.c~mm-do_swap_page-fix-up-the-error-code-instantiation
+++ a/mm/memory.c
@@ -3140,8 +3140,10 @@ vm_fault_t do_swap_page(struct vm_fault
 				err = mem_cgroup_charge(page, vma->vm_mm,
 							GFP_KERNEL);
 				ClearPageSwapCache(page);
-				if (err)
+				if (err) {
+					ret = VM_FAULT_OOM;
 					goto out_page;
+				}
 
 				lru_cache_add(page);
 				swap_readpage(page, true);
_

Patches currently in -mm which might be from mhocko@suse.com are

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] mm-compaction-make-capture-control-handling-safe-wrt-interrupts.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (35 preceding siblings ...)
  2020-06-27  3:33 ` [merged] mm-do_swap_page-fix-up-the-error-code-instantiation.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] kexec-do-not-verify-the-signature-without-the-lockdown-or-mandatory-signature.patch " Andrew Morton
                   ` (27 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: alex.shi, hughd, liwang, mgorman, mm-commits, stable, vbabka


The patch titled
     Subject: mm, compaction: make capture control handling safe wrt interrupts
has been removed from the -mm tree.  Its filename was
     mm-compaction-make-capture-control-handling-safe-wrt-interrupts.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Vlastimil Babka <vbabka@suse.cz>
Subject: mm, compaction: make capture control handling safe wrt interrupts

Hugh reports:

: While stressing compaction, one run oopsed on NULL capc->cc in
: __free_one_page()'s task_capc(zone): compact_zone_order() had been
: interrupted, and a page was being freed in the return from interrupt.
: 
: Though you would not expect it from the source, both gccs I was using (a
: 4.8.1 and a 7.5.0) had chosen to compile compact_zone_order() with the
: ".cc = &cc" implemented by mov %rbx,-0xb0(%rbp) immediately before callq
: compact_zone - long after the "current->capture_control = &capc".  An
: interrupt in between those finds capc->cc NULL (zeroed by an earlier rep
: stos).
: 
: This could presumably be fixed by a barrier() before setting
: current->capture_control in compact_zone_order(); but would also need more
: care on return from compact_zone(), in order not to risk leaking a page
: captured by interrupt just before capture_control is reset.
: 
: Maybe that is the preferable fix, but I felt safer for task_capc() to
: exclude the rather surprising possibility of capture at interrupt time.

I have checked that gcc10 also behaves the same.

The advantage of fix in compact_zone_order() is that we don't add another
test in the page freeing hot path, and that it might prevent future
problems if we stop exposing pointers to uninitialized structures in
current task.

So this patch implements the suggestion for compact_zone_order() with
barrier() (and WRITE_ONCE() to prevent store tearing) for setting
current->capture_control, and prevents page leaking with
WRITE_ONCE/READ_ONCE in the proper order.

Link: http://lkml.kernel.org/r/20200616082649.27173-1-vbabka@suse.cz
Fixes: 5e1f0f098b46 ("mm, compaction: capture a page under direct compaction")
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Reported-by: Hugh Dickins <hughd@google.com>
Suggested-by: Hugh Dickins <hughd@google.com>
Acked-by: Hugh Dickins <hughd@google.com>
Cc: Alex Shi <alex.shi@linux.alibaba.com>
Cc: Li Wang <liwang@redhat.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: <stable@vger.kernel.org>	[5.1+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/compaction.c |   17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

--- a/mm/compaction.c~mm-compaction-make-capture-control-handling-safe-wrt-interrupts
+++ a/mm/compaction.c
@@ -2316,15 +2316,26 @@ static enum compact_result compact_zone_
 		.page = NULL,
 	};
 
-	current->capture_control = &capc;
+	/*
+	 * Make sure the structs are really initialized before we expose the
+	 * capture control, in case we are interrupted and the interrupt handler
+	 * frees a page.
+	 */
+	barrier();
+	WRITE_ONCE(current->capture_control, &capc);
 
 	ret = compact_zone(&cc, &capc);
 
 	VM_BUG_ON(!list_empty(&cc.freepages));
 	VM_BUG_ON(!list_empty(&cc.migratepages));
 
-	*capture = capc.page;
-	current->capture_control = NULL;
+	/*
+	 * Make sure we hide capture control first before we read the captured
+	 * page pointer, otherwise an interrupt could free and capture a page
+	 * and we would leak it.
+	 */
+	WRITE_ONCE(current->capture_control, NULL);
+	*capture = READ_ONCE(capc.page);
 
 	return ret;
 }
_

Patches currently in -mm which might be from vbabka@suse.cz are

mm-slub-extend-slub_debug-syntax-for-multiple-blocks.patch
mm-slub-make-some-slub_debug-related-attributes-read-only.patch
mm-slub-remove-runtime-allocation-order-changes.patch
mm-slub-make-remaining-slub_debug-related-attributes-read-only.patch
mm-slub-make-reclaim_account-attribute-read-only.patch
mm-slub-introduce-static-key-for-slub_debug.patch
mm-slub-introduce-kmem_cache_debug_flags.patch
mm-slub-introduce-kmem_cache_debug_flags-fix.patch
mm-slub-extend-checks-guarded-by-slub_debug-static-key.patch
mm-slab-slub-move-and-improve-cache_from_obj.patch
mm-slab-slub-improve-error-reporting-and-overhead-of-cache_from_obj.patch
mm-slab-slub-improve-error-reporting-and-overhead-of-cache_from_obj-fix.patch
mm-page_alloc-use-unlikely-in-task_capc.patch

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] kexec-do-not-verify-the-signature-without-the-lockdown-or-mandatory-signature.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (36 preceding siblings ...)
  2020-06-27  3:33 ` [merged] mm-compaction-make-capture-control-handling-safe-wrt-interrupts.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] ocfs2-avoid-inode-removed-while-nfsd-access-it.patch " Andrew Morton
                   ` (26 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: bhe, dyoung, ebiederm, jbohac, jmorris, lijiang, mjg59, mm-commits


The patch titled
     Subject: kexec: do not verify the signature without the lockdown or mandatory signature
has been removed from the -mm tree.  Its filename was
     kexec-do-not-verify-the-signature-without-the-lockdown-or-mandatory-signature.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Lianbo Jiang <lijiang@redhat.com>
Subject: kexec: do not verify the signature without the lockdown or mandatory signature

Signature verification is an important security feature, to protect system
from being attacked with a kernel of unknown origin.  Kexec rebooting is a
way to replace the running kernel, hence need be secured carefully.

In the current code of handling signature verification of kexec kernel,
the logic is very twisted.  It mixes signature verification, IMA signature
appraising and kexec lockdown.

If there is no KEXEC_SIG_FORCE, kexec kernel image doesn't have one of
signature, the supported crypto, and key, we don't think this is wrong,
Unless kexec lockdown is executed.  IMA is considered as another kind of
signature appraising method.

If kexec kernel image has signature/crypto/key, it has to go through the
signature verification and pass.  Otherwise it's seen as verification
failure, and won't be loaded.

Seems kexec kernel image with an unqualified signature is even worse than
those w/o signature at all, this sounds very unreasonable.  E.g.  If
people get a unsigned kernel to load, or a kernel signed with expired key,
which one is more dangerous?

So, here, let's simplify the logic to improve code readability.  If the
KEXEC_SIG_FORCE enabled or kexec lockdown enabled, signature verification
is mandated.  Otherwise, we lift the bar for any kernel image.

Link: http://lkml.kernel.org/r/20200602045952.27487-1-lijiang@redhat.com
Signed-off-by: Lianbo Jiang <lijiang@redhat.com>
Reviewed-by: Jiri Bohac <jbohac@suse.cz>
Acked-by: Dave Young <dyoung@redhat.com>
Acked-by: Baoquan He <bhe@redhat.com>
Cc: James Morris <jmorris@namei.org>
Cc: Matthew Garrett <mjg59@google.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 kernel/kexec_file.c |   36 +++++++-----------------------------
 1 file changed, 7 insertions(+), 29 deletions(-)

--- a/kernel/kexec_file.c~kexec-do-not-verify-the-signature-without-the-lockdown-or-mandatory-signature
+++ a/kernel/kexec_file.c
@@ -181,34 +181,19 @@ void kimage_file_post_load_cleanup(struc
 static int
 kimage_validate_signature(struct kimage *image)
 {
-	const char *reason;
 	int ret;
 
 	ret = arch_kexec_kernel_verify_sig(image, image->kernel_buf,
 					   image->kernel_buf_len);
-	switch (ret) {
-	case 0:
-		break;
-
-		/* Certain verification errors are non-fatal if we're not
-		 * checking errors, provided we aren't mandating that there
-		 * must be a valid signature.
-		 */
-	case -ENODATA:
-		reason = "kexec of unsigned image";
-		goto decide;
-	case -ENOPKG:
-		reason = "kexec of image with unsupported crypto";
-		goto decide;
-	case -ENOKEY:
-		reason = "kexec of image with unavailable key";
-	decide:
+	if (ret) {
+
 		if (IS_ENABLED(CONFIG_KEXEC_SIG_FORCE)) {
-			pr_notice("%s rejected\n", reason);
+			pr_notice("Enforced kernel signature verification failed (%d).\n", ret);
 			return ret;
 		}
 
-		/* If IMA is guaranteed to appraise a signature on the kexec
+		/*
+		 * If IMA is guaranteed to appraise a signature on the kexec
 		 * image, permit it even if the kernel is otherwise locked
 		 * down.
 		 */
@@ -216,17 +201,10 @@ kimage_validate_signature(struct kimage
 		    security_locked_down(LOCKDOWN_KEXEC))
 			return -EPERM;
 
-		return 0;

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] ocfs2-avoid-inode-removed-while-nfsd-access-it.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (37 preceding siblings ...)
  2020-06-27  3:33 ` [merged] kexec-do-not-verify-the-signature-without-the-lockdown-or-mandatory-signature.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] ocfs2-load-global_inode_alloc.patch " Andrew Morton
                   ` (25 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: gechangwei, ghe, jlbec, joseph.qi, junxiao.bi, mark, mm-commits,
	piaojun, stable


The patch titled
     Subject: ocfs2: avoid inode removal while nfsd is accessing it
has been removed from the -mm tree.  Its filename was
     ocfs2-avoid-inode-removed-while-nfsd-access-it.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Junxiao Bi <junxiao.bi@oracle.com>
Subject: ocfs2: avoid inode removal while nfsd is accessing it

Patch series "ocfs2: fix nfsd over ocfs2 issues", v2.

This is a series of patches to fix issues on nfsd over ocfs2.  patch 1 is
to avoid inode removed while nfsd access it patch 2 & 3 is to fix a panic
issue.


This patch (of 4):

When nfsd is getting file dentry using handle or parent dentry of some
dentry, one cluster lock is used to avoid inode removed from other node,
but it still could be removed from local node, so use a rw lock to avoid
this.

Link: http://lkml.kernel.org/r/20200616183829.87211-1-junxiao.bi@oracle.com
Link: http://lkml.kernel.org/r/20200616183829.87211-2-junxiao.bi@oracle.com
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 fs/ocfs2/dlmglue.c |   17 ++++++++++++++++-
 fs/ocfs2/ocfs2.h   |    1 +
 2 files changed, 17 insertions(+), 1 deletion(-)

--- a/fs/ocfs2/dlmglue.c~ocfs2-avoid-inode-removed-while-nfsd-access-it
+++ a/fs/ocfs2/dlmglue.c
@@ -689,6 +689,12 @@ static void ocfs2_nfs_sync_lock_res_init
 				   &ocfs2_nfs_sync_lops, osb);
 }
 
+static void ocfs2_nfs_sync_lock_init(struct ocfs2_super *osb)
+{
+	ocfs2_nfs_sync_lock_res_init(&osb->osb_nfs_sync_lockres, osb);
+	init_rwsem(&osb->nfs_sync_rwlock);
+}
+
 void ocfs2_trim_fs_lock_res_init(struct ocfs2_super *osb)
 {
 	struct ocfs2_lock_res *lockres = &osb->osb_trim_fs_lockres;
@@ -2855,6 +2861,11 @@ int ocfs2_nfs_sync_lock(struct ocfs2_sup
 	if (ocfs2_is_hard_readonly(osb))
 		return -EROFS;
 
+	if (ex)
+		down_write(&osb->nfs_sync_rwlock);
+	else
+		down_read(&osb->nfs_sync_rwlock);
+
 	if (ocfs2_mount_local(osb))
 		return 0;
 
@@ -2873,6 +2884,10 @@ void ocfs2_nfs_sync_unlock(struct ocfs2_
 	if (!ocfs2_mount_local(osb))
 		ocfs2_cluster_unlock(osb, lockres,
 				     ex ? LKM_EXMODE : LKM_PRMODE);
+	if (ex)
+		up_write(&osb->nfs_sync_rwlock);
+	else
+		up_read(&osb->nfs_sync_rwlock);
 }
 
 int ocfs2_trim_fs_lock(struct ocfs2_super *osb,
@@ -3340,7 +3355,7 @@ int ocfs2_dlm_init(struct ocfs2_super *o
 local:
 	ocfs2_super_lock_res_init(&osb->osb_super_lockres, osb);
 	ocfs2_rename_lock_res_init(&osb->osb_rename_lockres, osb);
-	ocfs2_nfs_sync_lock_res_init(&osb->osb_nfs_sync_lockres, osb);
+	ocfs2_nfs_sync_lock_init(osb);
 	ocfs2_orphan_scan_lock_res_init(&osb->osb_orphan_scan.os_lockres, osb);
 
 	osb->cconn = conn;
--- a/fs/ocfs2/ocfs2.h~ocfs2-avoid-inode-removed-while-nfsd-access-it
+++ a/fs/ocfs2/ocfs2.h
@@ -395,6 +395,7 @@ struct ocfs2_super
 	struct ocfs2_lock_res osb_super_lockres;
 	struct ocfs2_lock_res osb_rename_lockres;
 	struct ocfs2_lock_res osb_nfs_sync_lockres;
+	struct rw_semaphore nfs_sync_rwlock;
 	struct ocfs2_lock_res osb_trim_fs_lockres;
 	struct mutex obs_trim_fs_mutex;
 	struct ocfs2_dlm_debug *osb_dlm_debug;
_

Patches currently in -mm which might be from junxiao.bi@oracle.com are

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] ocfs2-load-global_inode_alloc.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (38 preceding siblings ...)
  2020-06-27  3:33 ` [merged] ocfs2-avoid-inode-removed-while-nfsd-access-it.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] ocfs2-fix-panic-on-nfs-server-over-ocfs2.patch " Andrew Morton
                   ` (24 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: gechangwei, ghe, jlbec, joseph.qi, junxiao.bi, mark, mm-commits,
	piaojun, stable


The patch titled
     Subject: ocfs2: load global_inode_alloc
has been removed from the -mm tree.  Its filename was
     ocfs2-load-global_inode_alloc.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Junxiao Bi <junxiao.bi@oracle.com>
Subject: ocfs2: load global_inode_alloc

Set global_inode_alloc as OCFS2_FIRST_ONLINE_SYSTEM_INODE, that will make
it load during mount.  It can be used to test whether some global/system
inodes are valid.  One use case is that nfsd will test whether root inode
is valid.

Link: http://lkml.kernel.org/r/20200616183829.87211-3-junxiao.bi@oracle.com
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 fs/ocfs2/ocfs2_fs.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/ocfs2/ocfs2_fs.h~ocfs2-load-global_inode_alloc
+++ a/fs/ocfs2/ocfs2_fs.h
@@ -326,8 +326,8 @@ struct ocfs2_system_inode_info {
 enum {
 	BAD_BLOCK_SYSTEM_INODE = 0,
 	GLOBAL_INODE_ALLOC_SYSTEM_INODE,
+#define OCFS2_FIRST_ONLINE_SYSTEM_INODE GLOBAL_INODE_ALLOC_SYSTEM_INODE
 	SLOT_MAP_SYSTEM_INODE,
-#define OCFS2_FIRST_ONLINE_SYSTEM_INODE SLOT_MAP_SYSTEM_INODE
 	HEARTBEAT_SYSTEM_INODE,
 	GLOBAL_BITMAP_SYSTEM_INODE,
 	USER_QUOTA_SYSTEM_INODE,
_

Patches currently in -mm which might be from junxiao.bi@oracle.com are

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] ocfs2-fix-panic-on-nfs-server-over-ocfs2.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (39 preceding siblings ...)
  2020-06-27  3:33 ` [merged] ocfs2-load-global_inode_alloc.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] ocfs2-fix-value-of-ocfs2_invalid_slot.patch " Andrew Morton
                   ` (23 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: gechangwei, ghe, jlbec, joseph.qi, junxiao.bi, mark, mm-commits,
	piaojun, stable


The patch titled
     Subject: ocfs2: fix panic on nfs server over ocfs2
has been removed from the -mm tree.  Its filename was
     ocfs2-fix-panic-on-nfs-server-over-ocfs2.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Junxiao Bi <junxiao.bi@oracle.com>
Subject: ocfs2: fix panic on nfs server over ocfs2

The following kernel panic was captured when running nfs server over
ocfs2, at that time ocfs2_test_inode_bit() was checking whether one inode
locating at "blkno" 5 was valid, that is ocfs2 root inode, its
"suballoc_slot" was OCFS2_INVALID_SLOT(65535) and it was allocted from
//global_inode_alloc, but here it wrongly assumed that it was got from per
slot inode alloctor which would cause array overflow and trigger kernel
panic.

[430033.469151] BUG: unable to handle kernel paging request at
0000000000001088
[430033.469367] IP: [<ffffffff816f6898>] _raw_spin_lock+0x18/0xf0
[430033.469567] PGD 1e06ba067 PUD 1e9e7d067 PMD 0
[430033.469769] Oops: 0002 [#1] SMP
[430033.469975] Modules linked in: tun nfsd lockd grace nfs_acl auth_rpcgss
ocfs2 xen_netback xen_blkback xen_gntalloc xen_gntdev xen_evtchn xenfs
xen_privcmd ocfs2_dlmfs ocfs2_stack_o2cb ocfs2_dlm ocfs2_nodemanager
ocfs2_stackglue configfs bnx2fc fcoe libfcoe libfc sunrpc bridge 8021q mrp
garp stp llc bonding dm_round_robin scsi_dh_emc dm_multipath iTCO_wdt
iTCO_vendor_support pcspkr sb_edac edac_core i2c_i801 i2c_core lpc_ich
mfd_core sg ext4 jbd2 mbcache2 sd_mod ahci libahci lpfc scsi_transport_fc
be2net vxlan udp_tunnel ip6_udp_tunnel mpt3sas scsi_transport_sas raid_class
crc32c_intel be2iscsi bnx2i cnic uio cxgb4i cxgb4 cxgb3i libcxgbi ipv6 cxgb3
mdio libiscsi_tcp qla4xxx iscsi_boot_sysfs libiscsi scsi_transport_iscsi
dm_mirror dm_region_hash dm_log dm_mod
[430033.472350] CPU: 6 PID: 24873 Comm: nfsd Not tainted
4.1.12-124.36.1.el6uek.x86_64 #2
[430033.472719] Hardware name: Huawei CH121 V3/IT11SGCA1, BIOS 3.87
02/02/2018
[430033.472910] task: ffff88005ae98000 ti: ffff88005ae94000 task.ti:
ffff88005ae94000
[430033.473277] RIP: e030:[<ffffffff816f6898>]  [<ffffffff816f6898>]
_raw_spin_lock+0x18/0xf0
[430033.473655] RSP: e02b:ffff88005ae97908  EFLAGS: 00010206
[430033.473850] RAX: ffff88005ae98000 RBX: 0000000000001088 RCX:
0000000000000000
[430033.474205] RDX: 0000000000020000 RSI: 0000000000000009 RDI:
0000000000001088
[430033.474574] RBP: ffff88005ae97928 R08: 0000000000000000 R09:
ffff880212878e00
[430033.474938] R10: 0000000000007ff0 R11: 0000000000000000 R12:
0000000000001088
[430033.475324] R13: ffff8800063c0aa8 R14: ffff8800650c27d0 R15:
000000000000ffff
[430033.475721] FS:  0000000000000000(0000) GS:ffff880218180000(0000)
knlGS:ffff880218180000
[430033.476199] CS:  e033 DS: 0000 ES: 0000 CR0: 0000000080050033
[430033.476390] CR2: 0000000000001088 CR3: 00000002033d0000 CR4:
0000000000042660
[430033.476760] Stack:
[430033.476942]  0000000000001000 0000000000001088 ffff8800063c0aa8
ffff8800650c27d0
[430033.477329]  ffff88005ae97948 ffffffff8122a3de 0000000000000009
ffff8800063c0000
[430033.477718]  ffff88005ae979e8 ffffffffc0714e43 ffff88005ae97968
ffff88019de8f958
[430033.478104] Call Trace:
[430033.478286]  [<ffffffff8122a3de>] igrab+0x1e/0x60
[430033.478494]  [<ffffffffc0714e43>] ocfs2_get_system_file_inode+0x63/0x3a0
[ocfs2]
[430033.478870]  [<ffffffffc06a87df>] ? ocfs2_read_blocks_sync+0x13f/0x3c0
[ocfs2]
[430033.479267]  [<ffffffffc06ff2d8>] ocfs2_test_inode_bit+0x328/0xa00
[ocfs2]
[430033.479498]  [<ffffffffc06bef5a>] ocfs2_get_parent+0xba/0x3e0 [ocfs2]
[430033.479730]  [<ffffffff8129b305>] reconnect_path+0xb5/0x300
[430033.479933]  [<ffffffff8129b646>] exportfs_decode_fh+0xf6/0x2b0
[430033.480124]  [<ffffffffc0814af0>] ? nfsd_proc_getattr+0xa0/0xa0 [nfsd]
[430033.480294]  [<ffffffffc081a682>] ? exp_find+0xe2/0x190 [nfsd]
[430033.480461]  [<ffffffff810e5a7e>] ? irq_get_irq_data+0xe/0x10
[430033.480627]  [<ffffffff810ea1a7>] ? __call_rcu_nocb_enqueue+0xd7/0xe0
[430033.480794]  [<ffffffff810eb9e8>] ? __call_rcu+0xe8/0x360
[430033.480959]  [<ffffffffc0815860>] fh_verify+0x350/0x660 [nfsd]
[430033.481134]  [<ffffffffc0535076>] ? cache_check+0x56/0x3a0 [sunrpc]
[430033.481317]  [<ffffffffc0823a4d>] nfsd4_putfh+0x4d/0x60 [nfsd]
[430033.481505]  [<ffffffffc0826003>] nfsd4_proc_compound+0x3d3/0x6f0 [nfsd]
[430033.481730]  [<ffffffffc0811f60>] nfsd_dispatch+0xe0/0x290 [nfsd]
[430033.481950]  [<ffffffffc052b752>] ? svc_tcp_adjust_wspace+0x12/0x30
[sunrpc]
[430033.482152]  [<ffffffffc052a512>] svc_process_common+0x412/0x6a0 [sunrpc]
[430033.482351]  [<ffffffffc052a8c3>] svc_process+0x123/0x210 [sunrpc]
[430033.482550]  [<ffffffffc081190f>] nfsd+0xff/0x170 [nfsd]
[430033.482744]  [<ffffffffc0811810>] ? nfsd_destroy+0x80/0x80 [nfsd]
[430033.482943]  [<ffffffff810a7aeb>] kthread+0xcb/0xf0
[430033.483151]  [<ffffffff816f10ea>] ? __schedule+0x24a/0x810
[430033.483354]  [<ffffffff816f10ea>] ? __schedule+0x24a/0x810
[430033.483553]  [<ffffffff810a7a20>] ? kthread_create_on_node+0x180/0x180
[430033.483777]  [<ffffffff816f72a1>] ret_from_fork+0x61/0x90
[430033.483976]  [<ffffffff810a7a20>] ? kthread_create_on_node+0x180/0x180
[430033.484191] Code: 83 c2 02 0f b7 f2 e8 18 dc 91 ff 66 90 eb bf 0f 1f 40
00 55 48 89 e5 41 56 41 55 41 54 53 0f 1f 44 00 00 48 89 fb ba 00 00 02 00
<f0> 0f c1 17 89 d0 45 31 e4 45 31 ed c1 e8 10 66 39 d0 41 89 c6
[430033.485174] RIP  [<ffffffff816f6898>] _raw_spin_lock+0x18/0xf0
[430033.485370]  RSP <ffff88005ae97908>
[430033.485566] CR2: 0000000000001088
[430033.486223] ---[ end trace 7264463cd1aac8f9 ]---
[430033.666368] Kernel panic - not syncing: Fatal exception

Link: http://lkml.kernel.org/r/20200616183829.87211-4-junxiao.bi@oracle.com
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Jun Piao <piaojun@huawei.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 fs/ocfs2/suballoc.c |    9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

--- a/fs/ocfs2/suballoc.c~ocfs2-fix-panic-on-nfs-server-over-ocfs2
+++ a/fs/ocfs2/suballoc.c
@@ -2825,9 +2825,12 @@ int ocfs2_test_inode_bit(struct ocfs2_su
 		goto bail;
 	}
 
-	inode_alloc_inode =
-		ocfs2_get_system_file_inode(osb, INODE_ALLOC_SYSTEM_INODE,
-					    suballoc_slot);
+	if (suballoc_slot == (u16)OCFS2_INVALID_SLOT)
+		inode_alloc_inode = ocfs2_get_system_file_inode(osb,
+			GLOBAL_INODE_ALLOC_SYSTEM_INODE, suballoc_slot);
+	else
+		inode_alloc_inode = ocfs2_get_system_file_inode(osb,
+			INODE_ALLOC_SYSTEM_INODE, suballoc_slot);
 	if (!inode_alloc_inode) {
 		/* the error code could be inaccurate, but we are not able to
 		 * get the correct one. */
_

Patches currently in -mm which might be from junxiao.bi@oracle.com are

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] ocfs2-fix-value-of-ocfs2_invalid_slot.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (40 preceding siblings ...)
  2020-06-27  3:33 ` [merged] ocfs2-fix-panic-on-nfs-server-over-ocfs2.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] lib-fix-test_hmmc-reference-after-free.patch " Andrew Morton
                   ` (22 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: gechangwei, ghe, jlbec, joseph.qi, junxiao.bi, mark, mm-commits,
	piaojun, stable


The patch titled
     Subject: ocfs2: fix value of OCFS2_INVALID_SLOT
has been removed from the -mm tree.  Its filename was
     ocfs2-fix-value-of-ocfs2_invalid_slot.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Junxiao Bi <junxiao.bi@oracle.com>
Subject: ocfs2: fix value of OCFS2_INVALID_SLOT

In the ocfs2 disk layout, slot number is 16 bits, but in ocfs2
implementation, slot number is 32 bits.  Usually this will not cause any
issue, because slot number is converted from u16 to u32, but
OCFS2_INVALID_SLOT was defined as -1, when an invalid slot number from
disk was obtained, its value was (u16)-1, and it was converted to u32. 
Then the following checking in get_local_system_inode will be always
skipped:

 static struct inode **get_local_system_inode(struct ocfs2_super *osb,
                                               int type,
                                               u32 slot)
 {
 	BUG_ON(slot == OCFS2_INVALID_SLOT);
	...
 }

Link: http://lkml.kernel.org/r/20200616183829.87211-5-junxiao.bi@oracle.com
Signed-off-by: Junxiao Bi <junxiao.bi@oracle.com>
Reviewed-by: Joseph Qi <joseph.qi@linux.alibaba.com>
Cc: Mark Fasheh <mark@fasheh.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Changwei Ge <gechangwei@live.cn>
Cc: Gang He <ghe@suse.com>
Cc: Jun Piao <piaojun@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 fs/ocfs2/ocfs2_fs.h |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/fs/ocfs2/ocfs2_fs.h~ocfs2-fix-value-of-ocfs2_invalid_slot
+++ a/fs/ocfs2/ocfs2_fs.h
@@ -290,7 +290,7 @@
 #define OCFS2_MAX_SLOTS			255
 
 /* Slot map indicator for an empty slot */
-#define OCFS2_INVALID_SLOT		-1
+#define OCFS2_INVALID_SLOT		((u16)-1)
 
 #define OCFS2_VOL_UUID_LEN		16
 #define OCFS2_MAX_VOL_LABEL_LEN		64
_

Patches currently in -mm which might be from junxiao.bi@oracle.com are

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] lib-fix-test_hmmc-reference-after-free.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (41 preceding siblings ...)
  2020-06-27  3:33 ` [merged] ocfs2-fix-value-of-ocfs2_invalid_slot.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] mm-slab-fix-sign-conversion-problem-in-memcg_uncharge_slab.patch " Andrew Morton
                   ` (21 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: jglisse, mm-commits, rcampbell, rdunlap


The patch titled
     Subject: lib: fix test_hmm.c reference after free
has been removed from the -mm tree.  Its filename was
     lib-fix-test_hmmc-reference-after-free.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Randy Dunlap <rdunlap@infradead.org>
Subject: lib: fix test_hmm.c reference after free

Coccinelle scripts report the following errors:

lib/test_hmm.c:523:20-26: ERROR: reference preceded by free on line 521
lib/test_hmm.c:524:21-27: ERROR: reference preceded by free on line 521
lib/test_hmm.c:523:28-35: ERROR: devmem is NULL but dereferenced.
lib/test_hmm.c:524:29-36: ERROR: devmem is NULL but dereferenced.

Fix these by using the local variable 'res' instead of devmem.

Link: http://lkml.kernel.org/r/c845c158-9c65-9665-0d0b-00342846dd07@infradead.org
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Ralph Campbell <rcampbell@nvidia.com>
Cc: Jérôme Glisse <jglisse@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 lib/test_hmm.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/lib/test_hmm.c~lib-fix-test_hmmc-reference-after-free
+++ a/lib/test_hmm.c
@@ -520,8 +520,7 @@ static bool dmirror_allocate_chunk(struc
 err_free:
 	kfree(devmem);
 err_release:
-	release_mem_region(devmem->pagemap.res.start,
-			   resource_size(&devmem->pagemap.res));
+	release_mem_region(res->start, resource_size(res));
 err:
 	mutex_unlock(&mdevice->devmem_lock);
 	return false;
_

Patches currently in -mm which might be from rdunlap@infradead.org are

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] mm-slab-fix-sign-conversion-problem-in-memcg_uncharge_slab.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (42 preceding siblings ...)
  2020-06-27  3:33 ` [merged] lib-fix-test_hmmc-reference-after-free.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] mm-slab-use-memzero_explicit-in-kzfree.patch " Andrew Morton
                   ` (20 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: cl, guro, hannes, iamjoonsoo.kim, longman, mhocko, mm-commits,
	penberg, rientjes, shakeelb, stable, vdavydov.dev


The patch titled
     Subject: mm, slab: fix sign conversion problem in memcg_uncharge_slab()
has been removed from the -mm tree.  Its filename was
     mm-slab-fix-sign-conversion-problem-in-memcg_uncharge_slab.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Waiman Long <longman@redhat.com>
Subject: mm, slab: fix sign conversion problem in memcg_uncharge_slab()

It was found that running the LTP test on a PowerPC system could produce
erroneous values in /proc/meminfo, like:

  MemTotal:       531915072 kB
  MemFree:        507962176 kB
  MemAvailable:   1100020596352 kB

Using bisection, the problem is tracked down to commit 9c315e4d7d8c ("mm:
memcg/slab: cache page number in memcg_(un)charge_slab()").

In memcg_uncharge_slab() with a "int order" argument:

  unsigned int nr_pages = 1 << order;
    :
  mod_lruvec_state(lruvec, cache_vmstat_idx(s), -nr_pages);

The mod_lruvec_state() function will eventually call the
__mod_zone_page_state() which accepts a long argument.  Depending on the
compiler and how inlining is done, "-nr_pages" may be treated as a
negative number or a very large positive number.  Apparently, it was
treated as a large positive number in that PowerPC system leading to
incorrect stat counts.  This problem hasn't been seen in x86-64 yet,
perhaps the gcc compiler there has some slight difference in behavior.

It is fixed by making nr_pages a signed value.  For consistency, a similar
change is applied to memcg_charge_slab() as well.

Link: http://lkml.kernel.org/r/20200620184719.10994-1-longman@redhat.com
Fixes: 9c315e4d7d8c ("mm: memcg/slab: cache page number in memcg_(un)charge_slab()").
Signed-off-by: Waiman Long <longman@redhat.com>
Acked-by: Roman Gushchin <guro@fb.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Shakeel Butt <shakeelb@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/slab.h |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/mm/slab.h~mm-slab-fix-sign-conversion-problem-in-memcg_uncharge_slab
+++ a/mm/slab.h
@@ -348,7 +348,7 @@ static __always_inline int memcg_charge_
 					     gfp_t gfp, int order,
 					     struct kmem_cache *s)
 {
-	unsigned int nr_pages = 1 << order;
+	int nr_pages = 1 << order;
 	struct mem_cgroup *memcg;
 	struct lruvec *lruvec;
 	int ret;
@@ -388,7 +388,7 @@ out:
 static __always_inline void memcg_uncharge_slab(struct page *page, int order,
 						struct kmem_cache *s)
 {
-	unsigned int nr_pages = 1 << order;
+	int nr_pages = 1 << order;
 	struct mem_cgroup *memcg;
 	struct lruvec *lruvec;
 
_

Patches currently in -mm which might be from longman@redhat.com are

mm-treewide-rename-kzfree-to-kfree_sensitive.patch
sched-mm-optimize-current_gfp_context.patch

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] mm-slab-use-memzero_explicit-in-kzfree.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (43 preceding siblings ...)
  2020-06-27  3:33 ` [merged] mm-slab-fix-sign-conversion-problem-in-memcg_uncharge_slab.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] slub-cure-list_slab_objects-from-double-fix.patch " Andrew Morton
                   ` (19 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: dan.carpenter, dhowells, hannes, jarkko.sakkinen, Jason, jmorris,
	joe, longman, mhocko, mm-commits, rientjes, serge, stable, willy


The patch titled
     Subject: mm/slab: use memzero_explicit() in kzfree()
has been removed from the -mm tree.  Its filename was
     mm-slab-use-memzero_explicit-in-kzfree.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Waiman Long <longman@redhat.com>
Subject: mm/slab: use memzero_explicit() in kzfree()

The kzfree() function is normally used to clear some sensitive
information, like encryption keys, in the buffer before freeing it back to
the pool.  Memset() is currently used for buffer clearing.  However
unlikely, there is still a non-zero probability that the compiler may
choose to optimize away the memory clearing especially if LTO is being
used in the future.  To make sure that this optimization will never
happen, memzero_explicit(), which is introduced in v3.18, is now used in
kzfree() to future-proof it.

Link: http://lkml.kernel.org/r/20200616154311.12314-2-longman@redhat.com
Fixes: 3ef0e5ba4673 ("slab: introduce kzfree()")
Signed-off-by: Waiman Long <longman@redhat.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>
Cc: James Morris <jmorris@namei.org>
Cc: "Serge E. Hallyn" <serge@hallyn.com>
Cc: Joe Perches <joe@perches.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Dan Carpenter <dan.carpenter@oracle.com>
Cc: "Jason A . Donenfeld" <Jason@zx2c4.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/slab_common.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/mm/slab_common.c~mm-slab-use-memzero_explicit-in-kzfree
+++ a/mm/slab_common.c
@@ -1726,7 +1726,7 @@ void kzfree(const void *p)
 	if (unlikely(ZERO_OR_NULL_PTR(mem)))
 		return;
 	ks = ksize(mem);
-	memset(mem, 0, ks);
+	memzero_explicit(mem, ks);
 	kfree(mem);
 }
 EXPORT_SYMBOL(kzfree);
_

Patches currently in -mm which might be from longman@redhat.com are

mm-treewide-rename-kzfree-to-kfree_sensitive.patch
sched-mm-optimize-current_gfp_context.patch

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] slub-cure-list_slab_objects-from-double-fix.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (44 preceding siblings ...)
  2020-06-27  3:33 ` [merged] mm-slab-use-memzero_explicit-in-kzfree.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] mm-fix-swap-cache-node-allocation-mask.patch " Andrew Morton
                   ` (18 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: bigeasy, iamjoonsoo.kim, mm-commits, penberg, rientjes, tglx, yuzhao


The patch titled
     Subject: slub: cure list_slab_objects() from double fix
has been removed from the -mm tree.  Its filename was
     slub-cure-list_slab_objects-from-double-fix.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Subject: slub: cure list_slab_objects() from double fix

According to Christopher Lameter two fixes have been merged for the same
problem.  As far as I can tell, the code does not acquire the list_lock
and invoke kmalloc().  list_slab_objects() misses an unlock (the
counterpart to get_map()) and the memory allocated in free_partial() isn't
used.

Revert the mentioned commit.

Link: http://lkml.kernel.org/r/20200618201234.795692-1-bigeasy@linutronix.de
Fixes: aa456c7aebb14 ("slub: remove kmalloc under list_lock from list_slab_objects() V2")
Link: https://lkml.kernel.org/r/alpine.DEB.2.22.394.2006181501480.12014@www.lameter.com
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Yu Zhao <yuzhao@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/slub.c |   19 ++++---------------
 1 file changed, 4 insertions(+), 15 deletions(-)

--- a/mm/slub.c~slub-cure-list_slab_objects-from-double-fix
+++ a/mm/slub.c
@@ -3766,15 +3766,13 @@ error:
 }
 
 static void list_slab_objects(struct kmem_cache *s, struct page *page,
-			      const char *text, unsigned long *map)
+			      const char *text)
 {
 #ifdef CONFIG_SLUB_DEBUG
 	void *addr = page_address(page);
+	unsigned long *map;
 	void *p;
 
-	if (!map)
-		return;
-
 	slab_err(s, page, text, s->name);
 	slab_lock(page);
 
@@ -3786,6 +3784,7 @@ static void list_slab_objects(struct kme
 			print_tracking(s, p);
 		}
 	}
+	put_map(map);
 	slab_unlock(page);
 #endif
 }
@@ -3799,11 +3798,6 @@ static void free_partial(struct kmem_cac
 {
 	LIST_HEAD(discard);
 	struct page *page, *h;
-	unsigned long *map = NULL;
-
-#ifdef CONFIG_SLUB_DEBUG
-	map = bitmap_alloc(oo_objects(s->max), GFP_KERNEL);
-#endif
 
 	BUG_ON(irqs_disabled());
 	spin_lock_irq(&n->list_lock);
@@ -3813,16 +3807,11 @@ static void free_partial(struct kmem_cac
 			list_add(&page->slab_list, &discard);
 		} else {
 			list_slab_objects(s, page,
-			  "Objects remaining in %s on __kmem_cache_shutdown()",
-			  map);
+			  "Objects remaining in %s on __kmem_cache_shutdown()");
 		}
 	}
 	spin_unlock_irq(&n->list_lock);
 
-#ifdef CONFIG_SLUB_DEBUG
-	bitmap_free(map);
-#endif

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] mm-fix-swap-cache-node-allocation-mask.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (45 preceding siblings ...)
  2020-06-27  3:33 ` [merged] slub-cure-list_slab_objects-from-double-fix.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] mm-memoryc-properly-pte_offset_map_lock-unlock-in-vm_insert_pages.patch " Andrew Morton
                   ` (17 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: hughd, lists, mm-commits, stable, vbabka, willy


The patch titled
     Subject: mm: fix swap cache node allocation mask
has been removed from the -mm tree.  Its filename was
     mm-fix-swap-cache-node-allocation-mask.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Hugh Dickins <hughd@google.com>
Subject: mm: fix swap cache node allocation mask

https://bugzilla.kernel.org/show_bug.cgi?id=208085 reports that a slightly
overcommitted load, testing swap and zram along with i915, splats and
keeps on splatting, when it had better fail less noisily:

gnome-shell: page allocation failure: order:0,
mode:0x400d0(__GFP_IO|__GFP_FS|__GFP_COMP|__GFP_RECLAIMABLE),
nodemask=(null),cpuset=/,mems_allowed=0
CPU: 2 PID: 1155 Comm: gnome-shell Not tainted 5.7.0-1.fc33.x86_64 #1
Call Trace:
dump_stack+0x64/0x88
warn_alloc.cold+0x75/0xd9
__alloc_pages_slowpath.constprop.0+0xcfa/0xd30
__alloc_pages_nodemask+0x2df/0x320
alloc_slab_page+0x195/0x310
allocate_slab+0x3c5/0x440
___slab_alloc+0x40c/0x5f0
__slab_alloc+0x1c/0x30
kmem_cache_alloc+0x20e/0x220
xas_nomem+0x28/0x70
add_to_swap_cache+0x321/0x400
__read_swap_cache_async+0x105/0x240
swap_cluster_readahead+0x22c/0x2e0
shmem_swapin+0x8e/0xc0
shmem_swapin_page+0x196/0x740
shmem_getpage_gfp+0x3a2/0xa60
shmem_read_mapping_page_gfp+0x32/0x60
shmem_get_pages+0x155/0x5e0 [i915]
__i915_gem_object_get_pages+0x68/0xa0 [i915]
i915_vma_pin+0x3fe/0x6c0 [i915]
eb_add_vma+0x10b/0x2c0 [i915]
i915_gem_do_execbuffer+0x704/0x3430 [i915]
i915_gem_execbuffer2_ioctl+0x1ea/0x3e0 [i915]
drm_ioctl_kernel+0x86/0xd0 [drm]
drm_ioctl+0x206/0x390 [drm]
ksys_ioctl+0x82/0xc0
__x64_sys_ioctl+0x16/0x20
do_syscall_64+0x5b/0xf0
entry_SYSCALL_64_after_hwframe+0x44/0xa9

Reported on 5.7, but it goes back really to 3.1: when
shmem_read_mapping_page_gfp() was implemented for use by i915, and
allowed for __GFP_NORETRY and __GFP_NOWARN flags in most places, but
missed swapin's "& GFP_KERNEL" mask for page tree node allocation in
__read_swap_cache_async() - that was to mask off HIGHUSER_MOVABLE bits
from what page cache uses, but GFP_RECLAIM_MASK is now what's needed.

Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2006151330070.11064@eggly.anvils
Fixes: 68da9f055755 ("tmpfs: pass gfp to shmem_getpage_gfp")
Signed-off-by: Hugh Dickins <hughd@google.com>
Reviewed-by: Vlastimil Babka <vbabka@suse.cz>
Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Reported-by: Chris Murphy <lists@colorremedies.com>
Analyzed-by: Vlastimil Babka <vbabka@suse.cz>
Analyzed-by: Matthew Wilcox <willy@infradead.org>
Tested-by: Chris Murphy <lists@colorremedies.com>
Cc: <stable@vger.kernel.org>	[3.1+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/swap_state.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/mm/swap_state.c~mm-fix-swap-cache-node-allocation-mask
+++ a/mm/swap_state.c
@@ -21,7 +21,7 @@
 #include <linux/vmalloc.h>
 #include <linux/swap_slots.h>
 #include <linux/huge_mm.h>

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] mm-memoryc-properly-pte_offset_map_lock-unlock-in-vm_insert_pages.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (46 preceding siblings ...)
  2020-06-27  3:33 ` [merged] mm-fix-swap-cache-node-allocation-mask.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] mm-debug_vm_pgtable-fix-build-failure-with-powerpc-8xx.patch " Andrew Morton
                   ` (16 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: arjunroy, edumazet, hughd, mm-commits, rientjes, soheil


The patch titled
     Subject: mm/memory.c: properly pte_offset_map_lock/unlock in vm_insert_pages()
has been removed from the -mm tree.  Its filename was
     mm-memoryc-properly-pte_offset_map_lock-unlock-in-vm_insert_pages.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Arjun Roy <arjunroy@google.com>
Subject: mm/memory.c: properly pte_offset_map_lock/unlock in vm_insert_pages()

Calls to pte_offset_map() in vm_insert_pages() are erroneously not matched
with a call to pte_unmap().  This would cause problems on architectures
where that is not a no-op.

This patch does away with the non-traditional locking in the existing
code, and instead uses pte_offset_map_lock/unlock() as usual, incrementing
PTE as necessary.  The PTE pointer is kept within bounds since we clamp it
with PTRS_PER_PTE.

Link: http://lkml.kernel.org/r/20200618220446.20284-1-arjunroy.kdev@gmail.com
Fixes: 8cd3984d81d5 ("mm/memory.c: add vm_insert_pages()")
Signed-off-by: Arjun Roy <arjunroy@google.com>
Acked-by: David Rientjes <rientjes@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Soheil Hassas Yeganeh <soheil@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/memory.c |   21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

--- a/mm/memory.c~mm-memoryc-properly-pte_offset_map_lock-unlock-in-vm_insert_pages
+++ a/mm/memory.c
@@ -1498,7 +1498,7 @@ out:
 }
 
 #ifdef pte_index
-static int insert_page_in_batch_locked(struct mm_struct *mm, pmd_t *pmd,
+static int insert_page_in_batch_locked(struct mm_struct *mm, pte_t *pte,
 			unsigned long addr, struct page *page, pgprot_t prot)
 {
 	int err;
@@ -1506,8 +1506,9 @@ static int insert_page_in_batch_locked(s
 	if (!page_count(page))
 		return -EINVAL;
 	err = validate_page_before_insert(page);
-	return err ? err : insert_page_into_pte_locked(
-		mm, pte_offset_map(pmd, addr), addr, page, prot);
+	if (err)
+		return err;
+	return insert_page_into_pte_locked(mm, pte, addr, page, prot);
 }
 
 /* insert_pages() amortizes the cost of spinlock operations
@@ -1517,7 +1518,8 @@ static int insert_pages(struct vm_area_s
 			struct page **pages, unsigned long *num, pgprot_t prot)
 {
 	pmd_t *pmd = NULL;
-	spinlock_t *pte_lock = NULL;
+	pte_t *start_pte, *pte;
+	spinlock_t *pte_lock;
 	struct mm_struct *const mm = vma->vm_mm;
 	unsigned long curr_page_idx = 0;
 	unsigned long remaining_pages_total = *num;
@@ -1536,18 +1538,17 @@ more:
 	ret = -ENOMEM;
 	if (pte_alloc(mm, pmd))
 		goto out;
-	pte_lock = pte_lockptr(mm, pmd);
 
 	while (pages_to_write_in_pmd) {
 		int pte_idx = 0;
 		const int batch_size = min_t(int, pages_to_write_in_pmd, 8);
 
-		spin_lock(pte_lock);
-		for (; pte_idx < batch_size; ++pte_idx) {
-			int err = insert_page_in_batch_locked(mm, pmd,
+		start_pte = pte_offset_map_lock(mm, pmd, addr, &pte_lock);
+		for (pte = start_pte; pte_idx < batch_size; ++pte, ++pte_idx) {
+			int err = insert_page_in_batch_locked(mm, pte,
 				addr, pages[curr_page_idx], prot);
 			if (unlikely(err)) {
-				spin_unlock(pte_lock);
+				pte_unmap_unlock(start_pte, pte_lock);
 				ret = err;
 				remaining_pages_total -= pte_idx;
 				goto out;
@@ -1555,7 +1556,7 @@ more:
 			addr += PAGE_SIZE;
 			++curr_page_idx;
 		}
-		spin_unlock(pte_lock);
+		pte_unmap_unlock(start_pte, pte_lock);
 		pages_to_write_in_pmd -= batch_size;
 		remaining_pages_total -= batch_size;
 	}
_

Patches currently in -mm which might be from arjunroy@google.com are

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] mm-debug_vm_pgtable-fix-build-failure-with-powerpc-8xx.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (47 preceding siblings ...)
  2020-06-27  3:33 ` [merged] mm-memoryc-properly-pte_offset_map_lock-unlock-in-vm_insert_pages.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] make-asm-generic-cacheflushh-more-standalone.patch " Andrew Morton
                   ` (15 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: anshuman.khandual, benh, christophe.leroy, mm-commits, mpe,
	paulus, peterz, will


The patch titled
     Subject: mm/debug_vm_pgtable: fix build failure with powerpc 8xx
has been removed from the -mm tree.  Its filename was
     mm-debug_vm_pgtable-fix-build-failure-with-powerpc-8xx.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Christophe Leroy <christophe.leroy@csgroup.eu>
Subject: mm/debug_vm_pgtable: fix build failure with powerpc 8xx

Since commit 9e343b467c70 ("READ_ONCE: Enforce atomicity for
{READ,WRITE}_ONCE() memory accesses"), READ_ONCE() cannot be used anymore
to read complex page table entries.  This leads to:

  CC      mm/debug_vm_pgtable.o
In file included from ./include/asm-generic/bug.h:5,
                 from ./arch/powerpc/include/asm/bug.h:109,
                 from ./include/linux/bug.h:5,
                 from ./include/linux/mmdebug.h:5,
                 from ./include/linux/gfp.h:5,
                 from mm/debug_vm_pgtable.c:13:
In function 'pte_clear_tests',
    inlined from 'debug_vm_pgtable' at mm/debug_vm_pgtable.c:363:2:
./include/linux/compiler.h:392:38: error: call to '__compiletime_assert_210' declared with attribute error: Unsupported access size for {READ,WRITE}_ONCE().
  392 |  _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
      |                                      ^
./include/linux/compiler.h:373:4: note: in definition of macro '__compiletime_assert'
  373 |    prefix ## suffix();    \
      |    ^~~~~~
./include/linux/compiler.h:392:2: note: in expansion of macro '_compiletime_assert'
  392 |  _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
      |  ^~~~~~~~~~~~~~~~~~~
./include/linux/compiler.h:405:2: note: in expansion of macro 'compiletime_assert'
  405 |  compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
      |  ^~~~~~~~~~~~~~~~~~
./include/linux/compiler.h:291:2: note: in expansion of macro 'compiletime_assert_rwonce_type'
  291 |  compiletime_assert_rwonce_type(x);    \
      |  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
mm/debug_vm_pgtable.c:249:14: note: in expansion of macro 'READ_ONCE'
  249 |  pte_t pte = READ_ONCE(*ptep);
      |              ^~~~~~~~~
make[2]: *** [mm/debug_vm_pgtable.o] Error 1

Fix it by using the recently added ptep_get() helper.

Link: http://lkml.kernel.org/r/6ca8c972e6c920dc4ae0d4affbed9703afa4d010.1592490570.git.christophe.leroy@csgroup.eu
Fixes: 9e343b467c70 ("READ_ONCE: Enforce atomicity for {READ,WRITE}_ONCE() memory accesses")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Acked-by: Will Deacon <will@kernel.org>
Reviewed-by: Anshuman Khandual <anshuman.khandual@arm.com>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: "Peter Zijlstra (Intel)" <peterz@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/debug_vm_pgtable.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

--- a/mm/debug_vm_pgtable.c~mm-debug_vm_pgtable-fix-build-failure-with-powerpc-8xx
+++ a/mm/debug_vm_pgtable.c
@@ -246,13 +246,13 @@ static void __init pgd_populate_tests(st
 static void __init pte_clear_tests(struct mm_struct *mm, pte_t *ptep,
 				   unsigned long vaddr)
 {
-	pte_t pte = READ_ONCE(*ptep);
+	pte_t pte = ptep_get(ptep);
 
 	pte = __pte(pte_val(pte) | RANDOM_ORVALUE);
 	set_pte_at(mm, vaddr, ptep, pte);
 	barrier();
 	pte_clear(mm, vaddr, ptep);
-	pte = READ_ONCE(*ptep);
+	pte = ptep_get(ptep);
 	WARN_ON(!pte_none(pte));
 }
 
_

Patches currently in -mm which might be from christophe.leroy@csgroup.eu are

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] make-asm-generic-cacheflushh-more-standalone.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (48 preceding siblings ...)
  2020-06-27  3:33 ` [merged] mm-debug_vm_pgtable-fix-build-failure-with-powerpc-8xx.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] media-omap3isp-remove-cacheflushh.patch " Andrew Morton
                   ` (14 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: arnd, borntraeger, gor, hch, heiko.carstens, mm-commits, sfr


The patch titled
     Subject: make asm-generic/cacheflush.h more standalone
has been removed from the -mm tree.  Its filename was
     make-asm-generic-cacheflushh-more-standalone.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Stephen Rothwell <sfr@canb.auug.org.au>
Subject: make asm-generic/cacheflush.h more standalone

Some s390 builds get these warnings:

include/asm-generic/cacheflush.h:16:42: warning: 'struct mm_struct' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:22:46: warning: 'struct mm_struct' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:28:45: warning: 'struct vm_area_struct' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:36:44: warning: 'struct vm_area_struct' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:44:45: warning: 'struct page' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:52:50: warning: 'struct address_space' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:58:52: warning: 'struct address_space' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:75:17: warning: 'struct page' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:74:45: warning: 'struct vm_area_struct' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:82:16: warning: 'struct page' declared inside parameter list will not be visible outside of this definition or declaration
include/asm-generic/cacheflush.h:81:50: warning: 'struct vm_area_struct' declared inside parameter list will not be visible outside of this definition or declaration

Forward declare the named structs to get rid of these.

Link: http://lkml.kernel.org/r/20200623135714.4dae4b8a@canb.auug.org.au
Fixes: e0cf615d725c ("asm-generic: don't include <linux/mm.h> in cacheflush.h")
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Cc: Heiko Carstens <heiko.carstens@de.ibm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 include/asm-generic/cacheflush.h |    5 +++++
 1 file changed, 5 insertions(+)

--- a/include/asm-generic/cacheflush.h~make-asm-generic-cacheflushh-more-standalone
+++ a/include/asm-generic/cacheflush.h
@@ -2,6 +2,11 @@
 #ifndef _ASM_GENERIC_CACHEFLUSH_H
 #define _ASM_GENERIC_CACHEFLUSH_H
 
+struct mm_struct;
+struct vm_area_struct;
+struct page;
+struct address_space;
+
 /*
  * The cache doesn't need to be flushed when TLB entries change when
  * the cache is mapped to physical memory, not virtual memory
_

Patches currently in -mm which might be from sfr@canb.auug.org.au are

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] media-omap3isp-remove-cacheflushh.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (49 preceding siblings ...)
  2020-06-27  3:33 ` [merged] make-asm-generic-cacheflushh-more-standalone.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] mm-fix-a-warning-while-make-xmldocs.patch " Andrew Morton
                   ` (13 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: geert, hch, laurent.pinchart, mchehab+huawei, mm-commits, natechancellor


The patch titled
     Subject: media: omap3isp: remove cacheflush.h
has been removed from the -mm tree.  Its filename was
     media-omap3isp-remove-cacheflushh.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Nathan Chancellor <natechancellor@gmail.com>
Subject: media: omap3isp: remove cacheflush.h

After mm.h was removed from the asm-generic version of cacheflush.h, s390
allyesconfig shows several warnings of the following nature:

In file included from ./arch/s390/include/generated/asm/cacheflush.h:1,
                 from drivers/media/platform/omap3isp/isp.c:42:
./include/asm-generic/cacheflush.h:16:42: warning: 'struct mm_struct'
declared inside parameter list will not be visible outside of this
definition or declaration

As Geert and Laurent point out, this driver does not need this header in
the two files that include it.  Remove it so there are no warnings.

Link: http://lkml.kernel.org/r/20200622234740.72825-2-natechancellor@gmail.com
Fixes: e0cf615d725c ("asm-generic: don't include <linux/mm.h> in cacheflush.h")
Signed-off-by: Nathan Chancellor <natechancellor@gmail.com>
Suggested-by: Geert Uytterhoeven <geert@linux-m68k.org>
Suggested-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 drivers/media/platform/omap3isp/isp.c      |    2 --
 drivers/media/platform/omap3isp/ispvideo.c |    1 -
 2 files changed, 3 deletions(-)

--- a/drivers/media/platform/omap3isp/isp.c~media-omap3isp-remove-cacheflushh
+++ a/drivers/media/platform/omap3isp/isp.c
@@ -39,8 +39,6 @@
  *	Troy Laramy <t-laramy@ti.com>
  */
 
-#include <asm/cacheflush.h>

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] mm-fix-a-warning-while-make-xmldocs.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (50 preceding siblings ...)
  2020-06-27  3:33 ` [merged] media-omap3isp-remove-cacheflushh.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] mm-memcontrol-handle-div0-crash-race-condition-in-memorylow.patch " Andrew Morton
                   ` (12 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: akpm, mm-commits, standby24x7


The patch titled
     Subject: mm/vmalloc.c: fix a warning while make xmldocs
has been removed from the -mm tree.  Its filename was
     mm-fix-a-warning-while-make-xmldocs.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Masanari Iida <standby24x7@gmail.com>
Subject: mm/vmalloc.c: fix a warning while make xmldocs

This patch fixes following warning while "make xmldocs"

./mm/vmalloc.c:1877: warning: Excess function parameter
'prot' description in 'vm_map_ram'

This warning started since a patch was merged in 5.8-rc1.
Link: http://lkml.kernel.org/r/20200622152850.140871-1-standby24x7@gmail.com
Fixes: d4efd79a81ab ("mm: remove the prot argument from vm_map_ram")

Signed-off-by: Masanari Iida <standby24x7@gmail.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/vmalloc.c |    1 -
 1 file changed, 1 deletion(-)

--- a/mm/vmalloc.c~mm-fix-a-warning-while-make-xmldocs
+++ a/mm/vmalloc.c
@@ -1862,7 +1862,6 @@ EXPORT_SYMBOL(vm_unmap_ram);
  * @pages: an array of pointers to the pages to be mapped
  * @count: number of pages
  * @node: prefer to allocate data structures on this node
- * @prot: memory protection to use. PAGE_KERNEL for regular RAM
  *
  * If you use this function for less than VMAP_MAX_ALLOC pages, it could be
  * faster than vmap so it's good.  But if you mix long-life and short-life
_

Patches currently in -mm which might be from standby24x7@gmail.com are

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] mm-memcontrol-handle-div0-crash-race-condition-in-memorylow.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (51 preceding siblings ...)
  2020-06-27  3:33 ` [merged] mm-fix-a-warning-while-make-xmldocs.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] mm-memcontrol-fix-do-not-put-the-css-reference.patch " Andrew Morton
                   ` (11 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: chris, guro, hannes, mhocko, mm-commits, stable, tj


The patch titled
     Subject: mm: memcontrol: handle div0 crash race condition in memory.low
has been removed from the -mm tree.  Its filename was
     mm-memcontrol-handle-div0-crash-race-condition-in-memorylow.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Johannes Weiner <hannes@cmpxchg.org>
Subject: mm: memcontrol: handle div0 crash race condition in memory.low

Tejun reports seeing rare div0 crashes in memory.low stress testing:

[37228.504582] RIP: 0010:mem_cgroup_calculate_protection+0xed/0x150
[37228.505059] Code: 0f 46 d1 4c 39 d8 72 57 f6 05 16 d6 42 01 40 74 1f 4c 39 d8 76 1a 4c 39 d1 76 15 4c 29 d1 4c 29 d8 4d 29 d9 31 d2 48 0f af c1 <49> f7 f1 49 01 c2 4c 89 96 38 01 00 00 5d c3 48 0f af c7 31 d2 49
[37228.506254] RSP: 0018:ffffa14e01d6fcd0 EFLAGS: 00010246
[37228.506769] RAX: 000000000243e384 RBX: 0000000000000000 RCX: 0000000000008f4b
[37228.507319] RDX: 0000000000000000 RSI: ffff8b89bee84000 RDI: 0000000000000000
[37228.507869] RBP: ffffa14e01d6fcd0 R08: ffff8b89ca7d40f8 R09: 0000000000000000
[37228.508376] R10: 0000000000000000 R11: 00000000006422f7 R12: 0000000000000000
[37228.508881] R13: ffff8b89d9617000 R14: ffff8b89bee84000 R15: ffffa14e01d6fdb8
[37228.509397] FS:  0000000000000000(0000) GS:ffff8b8a1f1c0000(0000) knlGS:0000000000000000
[37228.509917] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[37228.510442] CR2: 00007f93b1fc175b CR3: 000000016100a000 CR4: 0000000000340ea0
[37228.511076] Call Trace:
[37228.511561]  shrink_node+0x1e5/0x6c0
[37228.512044]  balance_pgdat+0x32d/0x5f0
[37228.512521]  kswapd+0x1d7/0x3d0
[37228.513346]  ? wait_woken+0x80/0x80
[37228.514170]  kthread+0x11c/0x160
[37228.514983]  ? balance_pgdat+0x5f0/0x5f0
[37228.515797]  ? kthread_park+0x90/0x90
[37228.516593]  ret_from_fork+0x1f/0x30

This happens when parent_usage == siblings_protected.  We check that usage
is bigger than protected, which should imply parent_usage being bigger
than siblings_protected.  However, we don't read (or even update) these
values atomically, and they can be out of sync as the memory state changes
under us.  A bit of fluctuation around the target protection isn't a big
deal, but we need to handle the div0 case.

Check the parent state explicitly to make sure we have a reasonable
positive value for the divisor.

Link: http://lkml.kernel.org/r/20200615140658.601684-1-hannes@cmpxchg.org
Fixes: 8a931f801340 ("mm: memcontrol: recursive memory.low protection")
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Reported-by: Tejun Heo <tj@kernel.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Chris Down <chris@chrisdown.name>
Cc: Roman Gushchin <guro@fb.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/memcontrol.c |    9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

--- a/mm/memcontrol.c~mm-memcontrol-handle-div0-crash-race-condition-in-memorylow
+++ a/mm/memcontrol.c
@@ -6360,11 +6360,16 @@ static unsigned long effective_protectio
 	 * We're using unprotected memory for the weight so that if
 	 * some cgroups DO claim explicit protection, we don't protect
 	 * the same bytes twice.
+	 *
+	 * Check both usage and parent_usage against the respective
+	 * protected values. One should imply the other, but they
+	 * aren't read atomically - make sure the division is sane.
 	 */
 	if (!(cgrp_dfl_root.flags & CGRP_ROOT_MEMORY_RECURSIVE_PROT))
 		return ep;

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] mm-memcontrol-fix-do-not-put-the-css-reference.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (52 preceding siblings ...)
  2020-06-27  3:33 ` [merged] mm-memcontrol-handle-div0-crash-race-condition-in-memorylow.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] mm-memcg-prevent-missed-memorylow-load-tears.patch " Andrew Morton
                   ` (10 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: cai, guro, hannes, mhocko, mm-commits, songmuchun, stable, vdavydov.dev


The patch titled
     Subject: mm/memcontrol.c: add missed css_put()
has been removed from the -mm tree.  Its filename was
     mm-memcontrol-fix-do-not-put-the-css-reference.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Muchun Song <songmuchun@bytedance.com>
Subject: mm/memcontrol.c: add missed css_put()

We should put the css reference when memory allocation failed.

Link: http://lkml.kernel.org/r/20200614122653.98829-1-songmuchun@bytedance.com
Fixes: f0a3a24b532d ("mm: memcg/slab: rework non-root kmem_cache lifecycle management")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Acked-by: Roman Gushchin <guro@fb.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Qian Cai <cai@lca.pw>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/memcontrol.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/mm/memcontrol.c~mm-memcontrol-fix-do-not-put-the-css-reference
+++ a/mm/memcontrol.c
@@ -2772,8 +2772,10 @@ static void memcg_schedule_kmem_cache_cr
 		return;
 
 	cw = kmalloc(sizeof(*cw), GFP_NOWAIT | __GFP_NOWARN);
-	if (!cw)
+	if (!cw) {
+		css_put(&memcg->css);
 		return;
+	}
 
 	cw->memcg = memcg;
 	cw->cachep = cachep;
_

Patches currently in -mm which might be from songmuchun@bytedance.com are

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] mm-memcg-prevent-missed-memorylow-load-tears.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (53 preceding siblings ...)
  2020-06-27  3:33 ` [merged] mm-memcontrol-fix-do-not-put-the-css-reference.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] docs-mm-gup-minor-documentation-update.patch " Andrew Morton
                   ` (9 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: chris, mhocko, mkoutny, mm-commits


The patch titled
     Subject: mm/memcontrol.c: prevent missed memory.low load tears
has been removed from the -mm tree.  Its filename was
     mm-memcg-prevent-missed-memorylow-load-tears.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Chris Down <chris@chrisdown.name>
Subject: mm/memcontrol.c: prevent missed memory.low load tears

Looks like one of these got missed when massaging in f86b810c2610 ("mm,
memcg: prevent memory.low load/store tearing") with other linux-mm
changes.

Link: http://lkml.kernel.org/r/20200612174437.GA391453@chrisdown.name
Signed-off-by: Chris Down <chris@chrisdown.name>
Reported-by: Michal Koutny <mkoutny@suse.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/memcontrol.c |    5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

--- a/mm/memcontrol.c~mm-memcg-prevent-missed-memorylow-load-tears
+++ a/mm/memcontrol.c
@@ -6423,7 +6423,7 @@ enum mem_cgroup_protection mem_cgroup_pr
 
 	if (parent == root) {
 		memcg->memory.emin = READ_ONCE(memcg->memory.min);
-		memcg->memory.elow = memcg->memory.low;
+		memcg->memory.elow = READ_ONCE(memcg->memory.low);
 		goto out;
 	}
 
@@ -6435,7 +6435,8 @@ enum mem_cgroup_protection mem_cgroup_pr
 			atomic_long_read(&parent->memory.children_min_usage)));
 
 	WRITE_ONCE(memcg->memory.elow, effective_protection(usage, parent_usage,
-			memcg->memory.low, READ_ONCE(parent->memory.elow),
+			READ_ONCE(memcg->memory.low),
+			READ_ONCE(parent->memory.elow),
 			atomic_long_read(&parent->memory.children_low_usage)));
 
 out:
_

Patches currently in -mm which might be from chris@chrisdown.name are

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] docs-mm-gup-minor-documentation-update.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (54 preceding siblings ...)
  2020-06-27  3:33 ` [merged] mm-memcg-prevent-missed-memorylow-load-tears.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] doc-thp-cow-fault-no-longer-allocate-thp.patch " Andrew Morton
                   ` (8 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: corbet, jack, jhubbard, jrdr.linux, kirill.shutemov, mm-commits


The patch titled
     Subject: docs: mm/gup: minor documentation update
has been removed from the -mm tree.  Its filename was
     docs-mm-gup-minor-documentation-update.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Souptick Joarder <jrdr.linux@gmail.com>
Subject: docs: mm/gup: minor documentation update

Now there are 5 cases. Updated the same.

Link: http://lkml.kernel.org/r/1592422023-7401-1-git-send-email-jrdr.linux@gmail.com
Signed-off-by: Souptick Joarder <jrdr.linux@gmail.com>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Cc: Jan Kara <jack@suse.cz>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 Documentation/core-api/pin_user_pages.rst |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/Documentation/core-api/pin_user_pages.rst~docs-mm-gup-minor-documentation-update
+++ a/Documentation/core-api/pin_user_pages.rst
@@ -33,7 +33,7 @@ all combinations of get*(), pin*(), FOLL
 pin_user_pages*() APIs are clearly distinct from the get_user_pages*() APIs, so
 that's a natural dividing line, and a good point to make separate wrapper calls.
 In other words, use pin_user_pages*() for DMA-pinned pages, and
-get_user_pages*() for other cases. There are four cases described later on in
+get_user_pages*() for other cases. There are five cases described later on in
 this document, to further clarify that concept.
 
 FOLL_PIN and FOLL_GET are mutually exclusive for a given gup call. However,
_

Patches currently in -mm which might be from jrdr.linux@gmail.com are

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] doc-thp-cow-fault-no-longer-allocate-thp.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (55 preceding siblings ...)
  2020-06-27  3:33 ` [merged] docs-mm-gup-minor-documentation-update.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:33 ` [merged] mm-workingset-age-nonresident-information-alongside-anonymous-pages.patch " Andrew Morton
                   ` (7 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: corbet, kirill.shutemov, mm-commits, yang.shi, ziy


The patch titled
     Subject: doc: THP CoW fault no longer allocate THP
has been removed from the -mm tree.  Its filename was
     doc-thp-cow-fault-no-longer-allocate-thp.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Yang Shi <yang.shi@linux.alibaba.com>
Subject: doc: THP CoW fault no longer allocate THP

Since commit 3917c80280c93a7123f ("thp: change CoW semantics for
anon-THP"), THP CoW page fault is rewritten.  Now it just splits pmd then
fallback to base page fault, it doesn't try to allocate THP anymore.  So
it is no longer counted in THP_FAULT_ALLOC.

Remove the obsolete statement in documentation about THP CoW allocation to
avoid confusion.

Link: http://lkml.kernel.org/r/1592424895-5421-1-git-send-email-yang.shi@linux.alibaba.com
Signed-off-by: Yang Shi <yang.shi@linux.alibaba.com>
Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Zi Yan <ziy@nvidia.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 Documentation/admin-guide/cgroup-v2.rst    |    4 ++--
 Documentation/admin-guide/mm/transhuge.rst |    3 +--
 2 files changed, 3 insertions(+), 4 deletions(-)

--- a/Documentation/admin-guide/cgroup-v2.rst~doc-thp-cow-fault-no-longer-allocate-thp
+++ a/Documentation/admin-guide/cgroup-v2.rst
@@ -1356,8 +1356,8 @@ PAGE_SIZE multiple when read back.
 
 	  thp_fault_alloc
 		Number of transparent hugepages which were allocated to satisfy
-		a page fault, including COW faults. This counter is not present
-		when CONFIG_TRANSPARENT_HUGEPAGE is not set.
+		a page fault. This counter is not present when CONFIG_TRANSPARENT_HUGEPAGE
+                is not set.
 
 	  thp_collapse_alloc
 		Number of transparent hugepages which were allocated to allow
--- a/Documentation/admin-guide/mm/transhuge.rst~doc-thp-cow-fault-no-longer-allocate-thp
+++ a/Documentation/admin-guide/mm/transhuge.rst
@@ -305,8 +305,7 @@ monitor how successfully the system is p
 
 thp_fault_alloc
 	is incremented every time a huge page is successfully
-	allocated to handle a page fault. This applies to both the
-	first time a page is faulted and for COW faults.
+	allocated to handle a page fault.
 
 thp_collapse_alloc
 	is incremented by khugepaged when it has found
_

Patches currently in -mm which might be from yang.shi@linux.alibaba.com are

mm-filemap-clear-idle-flag-for-writes.patch
mm-filemap-add-missing-fgp_-flags-in-kerneldoc-comment-for-pagecache_get_page.patch
mm-thp-remove-debug_cow-switch.patch

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] mm-workingset-age-nonresident-information-alongside-anonymous-pages.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (56 preceding siblings ...)
  2020-06-27  3:33 ` [merged] doc-thp-cow-fault-no-longer-allocate-thp.patch " Andrew Morton
@ 2020-06-27  3:33 ` Andrew Morton
  2020-06-27  3:34 ` [merged] mm-swap-fix-for-mm-workingset-age-nonresident-information-alongside-anonymous-pages.patch " Andrew Morton
                   ` (6 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:33 UTC (permalink / raw)
  To: hannes, iamjoonsoo.kim, js1304, mhocko, minchan.kim, mm-commits, riel


The patch titled
     Subject: mm: workingset: age nonresident information alongside anonymous pages
has been removed from the -mm tree.  Its filename was
     mm-workingset-age-nonresident-information-alongside-anonymous-pages.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Johannes Weiner <hannes@cmpxchg.org>
Subject: mm: workingset: age nonresident information alongside anonymous pages

Patch series "fix for "mm: balance LRU lists based on relative thrashing" patchset"

This patchset fixes some problems of the patchset, "mm: balance LRU lists
based on relative thrashing", which is now merged on the mainline.

Patch "mm: workingset: let cache workingset challenge anon fix" is the
result of discussion with Johannes.  See following link.

http://lkml.kernel.org/r/20200520232525.798933-6-hannes@cmpxchg.org

And, the other two are minor things which are found when I try to rebase
my patchset.


This patch (of 3):
After ("mm: workingset: let cache workingset challenge anon fix"), we
compare refault distances to active_file + anon.  But age of the
non-resident information is only driven by the file LRU.  As a result, we
may overestimate the recency of any incoming refaults and activate them
too eagerly, causing unnecessary LRU churn in certain situations.

Make anon aging drive nonresident age as well to address that.

Link: http://lkml.kernel.org/r/1592288204-27734-1-git-send-email-iamjoonsoo.kim@lge.com
Link: http://lkml.kernel.org/r/1592288204-27734-2-git-send-email-iamjoonsoo.kim@lge.com
Fixes: 34e58cac6d8f2a ("mm: workingset: let cache workingset challenge anon")
Reported-by: Joonsoo Kim <js1304@gmail.com>
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Minchan Kim <minchan.kim@gmail.com>
Cc: Michal Hocko <mhocko@suse.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 include/linux/mmzone.h |    4 +--
 include/linux/swap.h   |    1 
 mm/vmscan.c            |    3 ++
 mm/workingset.c        |   46 ++++++++++++++++++++++-----------------
 4 files changed, 33 insertions(+), 21 deletions(-)

--- a/include/linux/mmzone.h~mm-workingset-age-nonresident-information-alongside-anonymous-pages
+++ a/include/linux/mmzone.h
@@ -257,8 +257,8 @@ struct lruvec {
 	 */
 	unsigned long			anon_cost;
 	unsigned long			file_cost;
-	/* Evictions & activations on the inactive file list */
-	atomic_long_t			inactive_age;
+	/* Non-resident age, driven by LRU movement */
+	atomic_long_t			nonresident_age;
 	/* Refaults at the time of last reclaim cycle */
 	unsigned long			refaults;
 	/* Various lruvec state flags (enum lruvec_flags) */
--- a/include/linux/swap.h~mm-workingset-age-nonresident-information-alongside-anonymous-pages
+++ a/include/linux/swap.h
@@ -313,6 +313,7 @@ struct vma_swap_readahead {
 };
 
 /* linux/mm/workingset.c */
+void workingset_age_nonresident(struct lruvec *lruvec, unsigned long nr_pages);
 void *workingset_eviction(struct page *page, struct mem_cgroup *target_memcg);
 void workingset_refault(struct page *page, void *shadow);
 void workingset_activation(struct page *page);
--- a/mm/vmscan.c~mm-workingset-age-nonresident-information-alongside-anonymous-pages
+++ a/mm/vmscan.c
@@ -904,6 +904,7 @@ static int __remove_mapping(struct addre
 		__delete_from_swap_cache(page, swap);
 		xa_unlock_irqrestore(&mapping->i_pages, flags);
 		put_swap_page(page, swap);
+		workingset_eviction(page, target_memcg);
 	} else {
 		void (*freepage)(struct page *);
 		void *shadow = NULL;
@@ -1884,6 +1885,8 @@ static unsigned noinline_for_stack move_
 				list_add(&page->lru, &pages_to_free);
 		} else {
 			nr_moved += nr_pages;
+			if (PageActive(page))
+				workingset_age_nonresident(lruvec, nr_pages);
 		}
 	}
 
--- a/mm/workingset.c~mm-workingset-age-nonresident-information-alongside-anonymous-pages
+++ a/mm/workingset.c
@@ -156,8 +156,8 @@
  *
  *		Implementation
  *
- * For each node's file LRU lists, a counter for inactive evictions
- * and activations is maintained (node->inactive_age).
+ * For each node's LRU lists, a counter for inactive evictions and
+ * activations is maintained (node->nonresident_age).
  *
  * On eviction, a snapshot of this counter (along with some bits to
  * identify the node) is stored in the now empty page cache
@@ -213,7 +213,17 @@ static void unpack_shadow(void *shadow,
 	*workingsetp = workingset;
 }
 
-static void advance_inactive_age(struct mem_cgroup *memcg, pg_data_t *pgdat)
+/**
+ * workingset_age_nonresident - age non-resident entries as LRU ages
+ * @memcg: the lruvec that was aged
+ * @nr_pages: the number of pages to count
+ *
+ * As in-memory pages are aged, non-resident pages need to be aged as
+ * well, in order for the refault distances later on to be comparable
+ * to the in-memory dimensions. This function allows reclaim and LRU
+ * operations to drive the non-resident aging along in parallel.
+ */
+void workingset_age_nonresident(struct lruvec *lruvec, unsigned long nr_pages)
 {
 	/*
 	 * Reclaiming a cgroup means reclaiming all its children in a
@@ -227,11 +237,8 @@ static void advance_inactive_age(struct
 	 * the root cgroup's, age as well.
 	 */
 	do {
-		struct lruvec *lruvec;
-
-		lruvec = mem_cgroup_lruvec(memcg, pgdat);
-		atomic_long_inc(&lruvec->inactive_age);
-	} while (memcg && (memcg = parent_mem_cgroup(memcg)));
+		atomic_long_add(nr_pages, &lruvec->nonresident_age);
+	} while ((lruvec = parent_lruvec(lruvec)));
 }
 
 /**
@@ -254,12 +261,11 @@ void *workingset_eviction(struct page *p
 	VM_BUG_ON_PAGE(page_count(page), page);
 	VM_BUG_ON_PAGE(!PageLocked(page), page);
 
-	advance_inactive_age(page_memcg(page), pgdat);
-
 	lruvec = mem_cgroup_lruvec(target_memcg, pgdat);
+	workingset_age_nonresident(lruvec, hpage_nr_pages(page));
 	/* XXX: target_memcg can be NULL, go through lruvec */
 	memcgid = mem_cgroup_id(lruvec_memcg(lruvec));
-	eviction = atomic_long_read(&lruvec->inactive_age);
+	eviction = atomic_long_read(&lruvec->nonresident_age);
 	return pack_shadow(memcgid, pgdat, eviction, PageWorkingset(page));
 }
 
@@ -309,20 +315,20 @@ void workingset_refault(struct page *pag
 	if (!mem_cgroup_disabled() && !eviction_memcg)
 		goto out;
 	eviction_lruvec = mem_cgroup_lruvec(eviction_memcg, pgdat);
-	refault = atomic_long_read(&eviction_lruvec->inactive_age);
+	refault = atomic_long_read(&eviction_lruvec->nonresident_age);
 
 	/*
 	 * Calculate the refault distance
 	 *
 	 * The unsigned subtraction here gives an accurate distance
-	 * across inactive_age overflows in most cases. There is a
+	 * across nonresident_age overflows in most cases. There is a
 	 * special case: usually, shadow entries have a short lifetime
 	 * and are either refaulted or reclaimed along with the inode
 	 * before they get too old.  But it is not impossible for the
-	 * inactive_age to lap a shadow entry in the field, which can
-	 * then result in a false small refault distance, leading to a
-	 * false activation should this old entry actually refault
-	 * again.  However, earlier kernels used to deactivate
+	 * nonresident_age to lap a shadow entry in the field, which
+	 * can then result in a false small refault distance, leading
+	 * to a false activation should this old entry actually
+	 * refault again.  However, earlier kernels used to deactivate
 	 * unconditionally with *every* reclaim invocation for the
 	 * longest time, so the occasional inappropriate activation
 	 * leading to pressure on the active list is not a problem.
@@ -359,7 +365,7 @@ void workingset_refault(struct page *pag
 		goto out;
 
 	SetPageActive(page);
-	advance_inactive_age(memcg, pgdat);
+	workingset_age_nonresident(lruvec, hpage_nr_pages(page));
 	inc_lruvec_state(lruvec, WORKINGSET_ACTIVATE);
 
 	/* Page was active prior to eviction */
@@ -382,6 +388,7 @@ out:
 void workingset_activation(struct page *page)
 {
 	struct mem_cgroup *memcg;
+	struct lruvec *lruvec;
 
 	rcu_read_lock();
 	/*
@@ -394,7 +401,8 @@ void workingset_activation(struct page *
 	memcg = page_memcg_rcu(page);
 	if (!mem_cgroup_disabled() && !memcg)
 		goto out;
-	advance_inactive_age(memcg, page_pgdat(page));
+	lruvec = mem_cgroup_page_lruvec(page, page_pgdat(page));
+	workingset_age_nonresident(lruvec, hpage_nr_pages(page));
 out:
 	rcu_read_unlock();
 }
_

Patches currently in -mm which might be from hannes@cmpxchg.org are

mm-memcontrol-decouple-reference-counting-from-page-accounting.patch

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] mm-swap-fix-for-mm-workingset-age-nonresident-information-alongside-anonymous-pages.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (57 preceding siblings ...)
  2020-06-27  3:33 ` [merged] mm-workingset-age-nonresident-information-alongside-anonymous-pages.patch " Andrew Morton
@ 2020-06-27  3:34 ` Andrew Morton
  2020-06-27  3:34 ` [merged] mm-memory-fix-io-cost-for-anonymous-page.patch " Andrew Morton
                   ` (5 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:34 UTC (permalink / raw)
  To: hannes, iamjoonsoo.kim, js1304, mhocko, minchan.kim, mm-commits, riel


The patch titled
     Subject: mm/swap: fix for "mm: workingset: age nonresident information alongside anonymous pages"
has been removed from the -mm tree.  Its filename was
     mm-swap-fix-for-mm-workingset-age-nonresident-information-alongside-anonymous-pages.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Subject: mm/swap: fix for "mm: workingset: age nonresident information alongside anonymous pages"

Non-file-lru page could also be activated in mark_page_accessed()
and we need to count this activation for nonresident_age.

Note that it's better for this patch to be squashed into the patch
"mm: workingset: age nonresident information alongside anonymous pages".

Link: http://lkml.kernel.org/r/1592288204-27734-3-git-send-email-iamjoonsoo.kim@lge.com
Signed-off-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Joonsoo Kim <js1304@gmail.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Minchan Kim <minchan.kim@gmail.com>
Cc: Rik van Riel <riel@surriel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/swap.c |    3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

--- a/mm/swap.c~mm-swap-fix-for-mm-workingset-age-nonresident-information-alongside-anonymous-pages
+++ a/mm/swap.c
@@ -443,8 +443,7 @@ void mark_page_accessed(struct page *pag
 		else
 			__lru_cache_activate_page(page);
 		ClearPageReferenced(page);
-		if (page_is_file_lru(page))
-			workingset_activation(page);
+		workingset_activation(page);
 	}
 	if (page_is_idle(page))
 		clear_page_idle(page);
_

Patches currently in -mm which might be from iamjoonsoo.kim@lge.com are

mm-page_isolation-prefer-the-node-of-the-source-page.patch
mm-migrate-move-migration-helper-from-h-to-c.patch
mm-hugetlb-unify-migration-callbacks.patch
mm-hugetlb-make-hugetlb-migration-callback-cma-aware.patch
mm-migrate-make-a-standard-migration-target-allocation-function.patch
mm-gup-use-a-standard-migration-target-allocation-callback.patch
mm-mempolicy-use-a-standard-migration-target-allocation-callback.patch
mm-page_alloc-remove-a-wrapper-for-alloc_migration_target.patch

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] mm-memory-fix-io-cost-for-anonymous-page.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (58 preceding siblings ...)
  2020-06-27  3:34 ` [merged] mm-swap-fix-for-mm-workingset-age-nonresident-information-alongside-anonymous-pages.patch " Andrew Morton
@ 2020-06-27  3:34 ` Andrew Morton
  2020-06-27  3:34 ` [merged] x86-hyperv-allocate-the-hypercall-page-with-only-read-and-execute-bits.patch " Andrew Morton
                   ` (4 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:34 UTC (permalink / raw)
  To: hannes, iamjoonsoo.kim, js1304, mhocko, minchan.kim, mm-commits, riel


The patch titled
     Subject: mm/memory: fix IO cost for anonymous page
has been removed from the -mm tree.  Its filename was
     mm-memory-fix-io-cost-for-anonymous-page.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Subject: mm/memory: fix IO cost for anonymous page

With synchronous IO swap device, swap-in is directly handled in fault
code.  Since IO cost notation isn't added there, with synchronous IO swap
device, LRU balancing could be wrongly biased.  Fix it to count it in
fault code.

Link: http://lkml.kernel.org/r/1592288204-27734-4-git-send-email-iamjoonsoo.kim@lge.com
Fixes: 314b57fb0460001 ("mm: balance LRU lists based on relative thrashing cache sizing")
Signed-off-by: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Joonsoo Kim <js1304@gmail.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Minchan Kim <minchan.kim@gmail.com>
Cc: Rik van Riel <riel@surriel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/memory.c |    8 ++++++++
 1 file changed, 8 insertions(+)

--- a/mm/memory.c~mm-memory-fix-io-cost-for-anonymous-page
+++ a/mm/memory.c
@@ -3146,6 +3146,14 @@ vm_fault_t do_swap_page(struct vm_fault
 					goto out_page;
 				}
 
+				/*
+				 * XXX: Move to lru_cache_add() when it
+				 * supports new vs putback
+				 */
+				spin_lock_irq(&page_pgdat(page)->lru_lock);
+				lru_note_cost_page(page);
+				spin_unlock_irq(&page_pgdat(page)->lru_lock);
+
 				lru_cache_add(page);
 				swap_readpage(page, true);
 			}
_

Patches currently in -mm which might be from iamjoonsoo.kim@lge.com are

mm-page_isolation-prefer-the-node-of-the-source-page.patch
mm-migrate-move-migration-helper-from-h-to-c.patch
mm-hugetlb-unify-migration-callbacks.patch
mm-hugetlb-make-hugetlb-migration-callback-cma-aware.patch
mm-migrate-make-a-standard-migration-target-allocation-function.patch
mm-gup-use-a-standard-migration-target-allocation-callback.patch
mm-mempolicy-use-a-standard-migration-target-allocation-callback.patch
mm-page_alloc-remove-a-wrapper-for-alloc_migration_target.patch

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] x86-hyperv-allocate-the-hypercall-page-with-only-read-and-execute-bits.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (59 preceding siblings ...)
  2020-06-27  3:34 ` [merged] mm-memory-fix-io-cost-for-anonymous-page.patch " Andrew Morton
@ 2020-06-27  3:34 ` Andrew Morton
  2020-06-27  3:34 ` [merged] arm64-use-page_kernel_rox-directly-in-alloc_insn_page.patch " Andrew Morton
                   ` (3 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:34 UTC (permalink / raw)
  To: catalin.marinas, david, decui, hch, jeyu, mm-commits, peterz,
	vkuznets, wei.liu, will


The patch titled
     Subject: x86/hyperv: allocate the hypercall page with only read and execute bits
has been removed from the -mm tree.  Its filename was
     x86-hyperv-allocate-the-hypercall-page-with-only-read-and-execute-bits.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Christoph Hellwig <hch@lst.de>
Subject: x86/hyperv: allocate the hypercall page with only read and execute bits

Patch series "fix a hyperv W^X violation and remove vmalloc_exec"

Dexuan reported a W^X violation due to the fact that the hyper hypercall
page due switching it to be allocated using vmalloc_exec.  The problem is
that PAGE_KERNEL_EXEC as used by vmalloc_exec actually sets writable
permissions in the pte.  This series fixes the issue by switching to the
low-level __vmalloc_node_range interface that allows specifing more
detailed permissions instead.  It then also open codes the other two
callers and removes the somewhat confusing vmalloc_exec interface.

Peter noted that the hyper hypercall page allocation also has another long
standing issue in that it shouldn't use the full vmalloc but just the
module space.  This issue is so far theoretical as the allocation is done
early in the boot process.  I plan to fix it with another bigger series
for 5.9.


This patch (of 3):

Avoid a W^X violation cause by the fact that PAGE_KERNEL_EXEC includes the
writable bit.

For this resurrect the removed PAGE_KERNEL_RX definitіon, but as
PAGE_KERNEL_ROX to match arm64 and powerpc.

Link: http://lkml.kernel.org/r/20200618064307.32739-2-hch@lst.de
Fixes: 78bb17f76edc ("x86/hyperv: use vmalloc_exec for the hypercall page")
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reported-by: Dexuan Cui <decui@microsoft.com>
Tested-by: Vitaly Kuznetsov <vkuznets@redhat.com>
Acked-by: Wei Liu <wei.liu@kernel.org>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Jessica Yu <jeyu@kernel.org>
Cc: David Hildenbrand <david@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 arch/x86/hyperv/hv_init.c            |    4 +++-
 arch/x86/include/asm/pgtable_types.h |    2 ++
 2 files changed, 5 insertions(+), 1 deletion(-)

--- a/arch/x86/hyperv/hv_init.c~x86-hyperv-allocate-the-hypercall-page-with-only-read-and-execute-bits
+++ a/arch/x86/hyperv/hv_init.c
@@ -375,7 +375,9 @@ void __init hyperv_init(void)
 	guest_id = generate_guest_id(0, LINUX_VERSION_CODE, 0);
 	wrmsrl(HV_X64_MSR_GUEST_OS_ID, guest_id);
 
-	hv_hypercall_pg = vmalloc_exec(PAGE_SIZE);
+	hv_hypercall_pg = __vmalloc_node_range(PAGE_SIZE, 1, VMALLOC_START,
+			VMALLOC_END, GFP_KERNEL, PAGE_KERNEL_ROX,
+			VM_FLUSH_RESET_PERMS, NUMA_NO_NODE, __func__);
 	if (hv_hypercall_pg == NULL) {
 		wrmsrl(HV_X64_MSR_GUEST_OS_ID, 0);
 		goto remove_cpuhp_state;
--- a/arch/x86/include/asm/pgtable_types.h~x86-hyperv-allocate-the-hypercall-page-with-only-read-and-execute-bits
+++ a/arch/x86/include/asm/pgtable_types.h
@@ -194,6 +194,7 @@ enum page_cache_mode {
 #define _PAGE_TABLE_NOENC	 (__PP|__RW|_USR|___A|   0|___D|   0|   0)
 #define _PAGE_TABLE		 (__PP|__RW|_USR|___A|   0|___D|   0|   0| _ENC)
 #define __PAGE_KERNEL_RO	 (__PP|   0|   0|___A|__NX|___D|   0|___G)
+#define __PAGE_KERNEL_ROX	 (__PP|   0|   0|___A|   0|___D|   0|___G)
 #define __PAGE_KERNEL_NOCACHE	 (__PP|__RW|   0|___A|__NX|___D|   0|___G| __NC)
 #define __PAGE_KERNEL_VVAR	 (__PP|   0|_USR|___A|__NX|___D|   0|___G)
 #define __PAGE_KERNEL_LARGE	 (__PP|__RW|   0|___A|__NX|___D|_PSE|___G)
@@ -219,6 +220,7 @@ enum page_cache_mode {
 #define PAGE_KERNEL_RO		__pgprot_mask(__PAGE_KERNEL_RO         | _ENC)
 #define PAGE_KERNEL_EXEC	__pgprot_mask(__PAGE_KERNEL_EXEC       | _ENC)
 #define PAGE_KERNEL_EXEC_NOENC	__pgprot_mask(__PAGE_KERNEL_EXEC       |    0)
+#define PAGE_KERNEL_ROX		__pgprot_mask(__PAGE_KERNEL_ROX        | _ENC)
 #define PAGE_KERNEL_NOCACHE	__pgprot_mask(__PAGE_KERNEL_NOCACHE    | _ENC)
 #define PAGE_KERNEL_LARGE	__pgprot_mask(__PAGE_KERNEL_LARGE      | _ENC)
 #define PAGE_KERNEL_LARGE_EXEC	__pgprot_mask(__PAGE_KERNEL_LARGE_EXEC | _ENC)
_

Patches currently in -mm which might be from hch@lst.de are

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] arm64-use-page_kernel_rox-directly-in-alloc_insn_page.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (60 preceding siblings ...)
  2020-06-27  3:34 ` [merged] x86-hyperv-allocate-the-hypercall-page-with-only-read-and-execute-bits.patch " Andrew Morton
@ 2020-06-27  3:34 ` Andrew Morton
  2020-06-27  3:34 ` [merged] mm-remove-vmalloc_exec.patch " Andrew Morton
                   ` (2 subsequent siblings)
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:34 UTC (permalink / raw)
  To: catalin.marinas, david, decui, hch, jeyu, mm-commits, peterz,
	vkuznets, wei.liu, will


The patch titled
     Subject: arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page
has been removed from the -mm tree.  Its filename was
     arm64-use-page_kernel_rox-directly-in-alloc_insn_page.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Christoph Hellwig <hch@lst.de>
Subject: arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page

Use PAGE_KERNEL_ROX directly instead of allocating RWX and setting the
page read-only just after the allocation.

Link: http://lkml.kernel.org/r/20200618064307.32739-3-hch@lst.de
Signed-off-by: Christoph Hellwig <hch@lst.de>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dexuan Cui <decui@microsoft.com>
Cc: Jessica Yu <jeyu@kernel.org>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Cc: Wei Liu <wei.liu@kernel.org>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 arch/arm64/kernel/probes/kprobes.c |   12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

--- a/arch/arm64/kernel/probes/kprobes.c~arm64-use-page_kernel_rox-directly-in-alloc_insn_page
+++ a/arch/arm64/kernel/probes/kprobes.c
@@ -120,15 +120,9 @@ int __kprobes arch_prepare_kprobe(struct
 
 void *alloc_insn_page(void)
 {
-	void *page;
-
-	page = vmalloc_exec(PAGE_SIZE);
-	if (page) {
-		set_memory_ro((unsigned long)page, 1);
-		set_vm_flush_reset_perms(page);
-	}

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] mm-remove-vmalloc_exec.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (61 preceding siblings ...)
  2020-06-27  3:34 ` [merged] arm64-use-page_kernel_rox-directly-in-alloc_insn_page.patch " Andrew Morton
@ 2020-06-27  3:34 ` Andrew Morton
  2020-06-27  3:34 ` [merged] mm-fix-false-softlockup-during-pfn-range-removal.patch " Andrew Morton
  2020-06-27  3:34 ` [merged] maintainers-update-info-for-sparse.patch " Andrew Morton
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:34 UTC (permalink / raw)
  To: catalin.marinas, david, decui, hch, jeyu, mm-commits, peterz,
	vkuznets, wei.liu, will


The patch titled
     Subject: mm: remove vmalloc_exec
has been removed from the -mm tree.  Its filename was
     mm-remove-vmalloc_exec.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Christoph Hellwig <hch@lst.de>
Subject: mm: remove vmalloc_exec

Merge vmalloc_exec into its only caller.  Note that for !CONFIG_MMU
__vmalloc_node_range maps to __vmalloc, which directly clears the
__GFP_HIGHMEM added by the vmalloc_exec stub anyway.

Link: http://lkml.kernel.org/r/20200618064307.32739-4-hch@lst.de
Signed-off-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: David Hildenbrand <david@redhat.com>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dexuan Cui <decui@microsoft.com>
Cc: Jessica Yu <jeyu@kernel.org>
Cc: Vitaly Kuznetsov <vkuznets@redhat.com>
Cc: Wei Liu <wei.liu@kernel.org>
Cc: Will Deacon <will@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 include/linux/vmalloc.h |    1 -
 kernel/module.c         |    4 +++-
 mm/nommu.c              |   17 -----------------
 mm/vmalloc.c            |   20 --------------------
 4 files changed, 3 insertions(+), 39 deletions(-)

--- a/include/linux/vmalloc.h~mm-remove-vmalloc_exec
+++ a/include/linux/vmalloc.h
@@ -106,7 +106,6 @@ extern void *vzalloc(unsigned long size)
 extern void *vmalloc_user(unsigned long size);
 extern void *vmalloc_node(unsigned long size, int node);
 extern void *vzalloc_node(unsigned long size, int node);
-extern void *vmalloc_exec(unsigned long size);
 extern void *vmalloc_32(unsigned long size);
 extern void *vmalloc_32_user(unsigned long size);
 extern void *__vmalloc(unsigned long size, gfp_t gfp_mask);
--- a/kernel/module.c~mm-remove-vmalloc_exec
+++ a/kernel/module.c
@@ -2783,7 +2783,9 @@ static void dynamic_debug_remove(struct
 
 void * __weak module_alloc(unsigned long size)
 {
-	return vmalloc_exec(size);
+	return __vmalloc_node_range(size, 1, VMALLOC_START, VMALLOC_END,
+			GFP_KERNEL, PAGE_KERNEL_EXEC, VM_FLUSH_RESET_PERMS,
+			NUMA_NO_NODE, __func__);
 }
 
 bool __weak module_init_section(const char *name)
--- a/mm/nommu.c~mm-remove-vmalloc_exec
+++ a/mm/nommu.c
@@ -291,23 +291,6 @@ void *vzalloc_node(unsigned long size, i
 EXPORT_SYMBOL(vzalloc_node);
 
 /**
- *	vmalloc_exec  -  allocate virtually contiguous, executable memory
- *	@size:		allocation size
- *
- *	Kernel-internal function to allocate enough pages to cover @size
- *	the page level allocator and map them into contiguous and
- *	executable kernel virtual space.
- *
- *	For tight control over page level allocator and protection flags
- *	use __vmalloc() instead.
- */
-
-void *vmalloc_exec(unsigned long size)
-{
-	return __vmalloc(size, GFP_KERNEL | __GFP_HIGHMEM);
-}
-
-/**
  * vmalloc_32  -  allocate virtually contiguous memory (32bit addressable)
  *	@size:		allocation size
  *
--- a/mm/vmalloc.c~mm-remove-vmalloc_exec
+++ a/mm/vmalloc.c
@@ -2695,26 +2695,6 @@ void *vzalloc_node(unsigned long size, i
 }
 EXPORT_SYMBOL(vzalloc_node);
 
-/**
- * vmalloc_exec - allocate virtually contiguous, executable memory
- * @size:	  allocation size
- *
- * Kernel-internal function to allocate enough pages to cover @size
- * the page level allocator and map them into contiguous and
- * executable kernel virtual space.
- *
- * For tight control over page level allocator and protection flags
- * use __vmalloc() instead.
- *
- * Return: pointer to the allocated memory or %NULL on error
- */
-void *vmalloc_exec(unsigned long size)
-{
-	return __vmalloc_node_range(size, 1, VMALLOC_START, VMALLOC_END,
-			GFP_KERNEL, PAGE_KERNEL_EXEC, VM_FLUSH_RESET_PERMS,
-			NUMA_NO_NODE, __builtin_return_address(0));
-}

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] mm-fix-false-softlockup-during-pfn-range-removal.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (62 preceding siblings ...)
  2020-06-27  3:34 ` [merged] mm-remove-vmalloc_exec.patch " Andrew Morton
@ 2020-06-27  3:34 ` Andrew Morton
  2020-06-27  3:34 ` [merged] maintainers-update-info-for-sparse.patch " Andrew Morton
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:34 UTC (permalink / raw)
  To: ben.widawsky, dan.j.williams, david, mm-commits, stable,
	steve.scargall, vishal.l.verma


The patch titled
     Subject: mm/memory_hotplug.c: fix false softlockup during pfn range removal
has been removed from the -mm tree.  Its filename was
     mm-fix-false-softlockup-during-pfn-range-removal.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Ben Widawsky <ben.widawsky@intel.com>
Subject: mm/memory_hotplug.c: fix false softlockup during pfn range removal

When working with very large nodes, poisoning the struct pages (for which
there will be very many) can take a very long time.  If the system is
using voluntary preemptions, the software watchdog will not be able to
detect forward progress.  This patch addresses this issue by offering to
give up time like __remove_pages() does.  This behavior was introduced in
v5.6 with: commit d33695b16a9f ("mm/memory_hotplug: poison memmap in
remove_pfn_range_from_zone()")

Alternately, init_page_poison could do this cond_resched(), but it seems
to me that the caller of init_page_poison() is what actually knows whether
or not it should relax its own priority.

Based on Dan's notes, I think this is perfectly safe: commit f931ab479dd2
("mm: fix devm_memremap_pages crash, use mem_hotplug_{begin, done}")

Aside from fixing the lockup, it is also a friendlier thing to do on lower
core systems that might wipe out large chunks of hotplug memory (probably
not a very common case).

Fixes this kind of splat:
[  352.142079] watchdog: BUG: soft lockup - CPU#46 stuck for 22s! [daxctl:9922]
[  352.150067] Modules linked in: nft_fib_inet nft_fib_ipv4 nft_fib_ipv6 nft_fib nft_reject_inet nf_reject_ipv4 nf_reject_ipv6 nft_reject nft_ct nft_chain_nat nf_tables ebtable_nat ebtable_broute ip6table_nat ip6table_mangle ip6table_raw ip6table_security iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_mangle iptable_raw iptable_security rfkill ip_set nfnetlink ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ib_isert iscsi_target_mod ib_srpt target_core_mod ib_srp scsi_transport_srp ib_ipoib ib_umad vfat fat kmem intel_rapl_msr intel_rapl_common rpcrdma sunrpc rdma_ucm ib_iser isst_if_common rdma_cm skx_edac iw_cm ib_cm x86_pkg_temp_thermal libiscsi intel_powerclamp scsi_transport_iscsi coretemp kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel i40iw intel_cstate iTCO_wdt ib_uverbs iTCO_vendor_support device_dax ib_core joydev intel_uncore i2c_i801 lpc_ich ipmi_ssif ioatdma dca wmi ipmi_si ipmi_devintf ipmi_msghandler dax_pmem
[  352.150123]  dax_pmem_core acpi_pad acpi_power_meter drm ip_tables xfs libcrc32c nd_pmem nd_btt i40e e1000e crc32c_intel nfit
[  352.260774] irq event stamp: 138450
[  352.264692] hardirqs last  enabled at (138449): [<ffffffffa1001f26>] trace_hardirqs_on_thunk+0x1a/0x1c
[  352.275134] hardirqs last disabled at (138450): [<ffffffffa1001f42>] trace_hardirqs_off_thunk+0x1a/0x1c
[  352.285662] softirqs last  enabled at (138448): [<ffffffffa1e00347>] __do_softirq+0x347/0x456
[  352.295233] softirqs last disabled at (138443): [<ffffffffa10c416d>] irq_exit+0x7d/0xb0
[  352.304210] CPU: 46 PID: 9922 Comm: daxctl Not tainted 5.7.0-BEN-14238-g373c6049b336 #30
[  352.313283] Hardware name: Intel Corporation PURLEY/PURLEY, BIOS PLYXCRB1.86B.0578.D07.1902280810 02/28/2019
[  352.324308] RIP: 0010:memset_erms+0x9/0x10
[  352.328905] Code: c1 e9 03 40 0f b6 f6 48 b8 01 01 01 01 01 01 01 01 48 0f af c6 f3 48 ab 89 d1 f3 aa 4c 89 c8 c3 90 49 89 f9 40 88 f0 48 89 d1 <f3> aa 4c 89 c8 c3 90 49 89 fa 40 0f b6 ce 48 b8 01 01 01 01 01 01
[  352.349953] RSP: 0018:ffffc90021b5fd50 EFLAGS: 00010202 ORIG_RAX: ffffffffffffff13
[  352.358450] RAX: 00000000000000ff RBX: ffff88983ffd5000 RCX: 0000000065df0e40
[  352.366457] RDX: 00000003a0000000 RSI: 00000000ffffffff RDI: ffffea039b20f1c0
[  352.374465] RBP: ffff88983ffd6c00 R08: 0000000000000000 R09: ffffea0061000000
[  352.382473] R10: 0000000000000001 R11: 0000000000000000 R12: ffffea006f808000
[  352.390480] R13: 0000000001840000 R14: 000000000e800000 R15: ffff8997d7b764e0
[  352.398487] FS:  00007f724ef81780(0000) GS:ffff8997df100000(0000) knlGS:0000000000000000
[  352.407562] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  352.414011] CR2: 00007ffcd4070768 CR3: 000001178c722002 CR4: 00000000003606e0
[  352.422056] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  352.430092] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  352.438115] Call Trace:
[  352.440865]  remove_pfn_range_from_zone+0x3a/0x380
[  352.446244]  ? cpumask_next+0x17/0x20
[  352.450361]  memunmap_pages+0x17f/0x280
[  352.454670]  release_nodes+0x22a/0x260
[  352.458888]  __device_release_driver+0x172/0x220
[  352.464070]  device_driver_detach+0x3e/0xa0
[  352.468753]  unbind_store+0x113/0x130
[  352.472868]  kernfs_fop_write+0xdc/0x1c0
[  352.477273]  vfs_write+0xde/0x1d0
[  352.482218]  ksys_write+0x58/0xd0
[  352.487207]  do_syscall_64+0x5a/0x120
[  352.492529]  entry_SYSCALL_64_after_hwframe+0x49/0xb3
[  352.499446] RIP: 0033:0x7f724f40b5e7
[  352.504673] Code: Bad RIP value.
[  352.509484] RSP: 002b:00007ffcd40738f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
[  352.519213] RAX: ffffffffffffffda RBX: 00007f724ef816a8 RCX: 00007f724f40b5e7
[  352.528410] RDX: 0000000000000007 RSI: 00005617d7cd1277 RDI: 0000000000000003
[  352.537573] RBP: 0000000000000003 R08: 00000000ffffffff R09: 00007ffcd40737d0
[  352.546764] R10: 0000000000000000 R11: 0000000000000246 R12: 00005617d7cd1277
[  352.555929] R13: 0000000000000000 R14: 0000000000000007 R15: 00005617d7cd1230
[  370.353742] Built 2 zonelists, mobility grouping on.  Total pages: 49050381
[  370.373317] Policy zone: Normal
[  374.948164] Built 3 zonelists, mobility grouping on.  Total pages: 49312525
[  375.017496] Policy zone: Normal

David said: "It really only is an issue for devmem.  Ordinary
hotplugged system memory is not affected (onlined/offlined in memory
block granularity)."

Link: http://lkml.kernel.org/r/20200619231213.1160351-1-ben.widawsky@intel.com
Fixes: commit d33695b16a9f ("mm/memory_hotplug: poison memmap in remove_pfn_range_from_zone()")
Signed-off-by: Ben Widawsky <ben.widawsky@intel.com>
Reported-by: "Scargall, Steve" <steve.scargall@intel.com>
Reported-by: Ben Widawsky <ben.widawsky@intel.com>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Dan Williams <dan.j.williams@intel.com>
Cc: Vishal Verma <vishal.l.verma@intel.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 mm/memory_hotplug.c |   13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

--- a/mm/memory_hotplug.c~mm-fix-false-softlockup-during-pfn-range-removal
+++ a/mm/memory_hotplug.c
@@ -471,11 +471,20 @@ void __ref remove_pfn_range_from_zone(st
 				      unsigned long start_pfn,
 				      unsigned long nr_pages)
 {
+	const unsigned long end_pfn = start_pfn + nr_pages;
 	struct pglist_data *pgdat = zone->zone_pgdat;
-	unsigned long flags;
+	unsigned long pfn, cur_nr_pages, flags;
 
 	/* Poison struct pages because they are now uninitialized again. */
-	page_init_poison(pfn_to_page(start_pfn), sizeof(struct page) * nr_pages);
+	for (pfn = start_pfn; pfn < end_pfn; pfn += cur_nr_pages) {
+		cond_resched();
+
+		/* Select all remaining pages up to the next section boundary */
+		cur_nr_pages =
+			min(end_pfn - pfn, SECTION_ALIGN_UP(pfn + 1) - pfn);
+		page_init_poison(pfn_to_page(pfn),
+				 sizeof(struct page) * cur_nr_pages);
+	}
 
 #ifdef CONFIG_ZONE_DEVICE
 	/*
_

Patches currently in -mm which might be from ben.widawsky@intel.com are

^ permalink raw reply	[flat|nested] 66+ messages in thread

* [merged] maintainers-update-info-for-sparse.patch removed from -mm tree
  2020-06-26  3:28 incoming Andrew Morton
                   ` (63 preceding siblings ...)
  2020-06-27  3:34 ` [merged] mm-fix-false-softlockup-during-pfn-range-removal.patch " Andrew Morton
@ 2020-06-27  3:34 ` Andrew Morton
  64 siblings, 0 replies; 66+ messages in thread
From: Andrew Morton @ 2020-06-27  3:34 UTC (permalink / raw)
  To: luc.vanoostenryck, mm-commits


The patch titled
     Subject: MAINTAINERS: update info for sparse
has been removed from the -mm tree.  Its filename was
     maintainers-update-info-for-sparse.patch

This patch was dropped because it was merged into mainline or a subsystem tree

------------------------------------------------------
From: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
Subject: MAINTAINERS: update info for sparse

Update the info for sparse. More specifically:
* change W entry to point to sparse.docs.kernel.org
* add Q & B entry (patchwork & bugzilla)

Link: http://lkml.kernel.org/r/20200621144204.53938-1-luc.vanoostenryck@gmail.com
Signed-off-by: Luc Van Oostenryck <luc.vanoostenryck@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---

 MAINTAINERS |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

--- a/MAINTAINERS~maintainers-update-info-for-sparse
+++ a/MAINTAINERS
@@ -16058,8 +16058,10 @@ SPARSE CHECKER
 M:	"Luc Van Oostenryck" <luc.vanoostenryck@gmail.com>
 L:	linux-sparse@vger.kernel.org
 S:	Maintained
-W:	https://sparse.wiki.kernel.org/
+W:	https://sparse.docs.kernel.org/
 T:	git git://git.kernel.org/pub/scm/devel/sparse/sparse.git
+Q:	https://patchwork.kernel.org/project/linux-sparse/list/
+B:	https://bugzilla.kernel.org/enter_bug.cgi?component=Sparse&product=Tools
 F:	include/linux/compiler.h
 
 SPEAR CLOCK FRAMEWORK SUPPORT
_

Patches currently in -mm which might be from luc.vanoostenryck@gmail.com are

fix-annotation-of-ioreadwrite1632be.patch
sparse-group-the-defines-by-functionality.patch
lib-generic-radix-treec-remove-unneeded-__rcu.patch

^ permalink raw reply	[flat|nested] 66+ messages in thread

end of thread, other threads:[~2020-06-27  3:34 UTC | newest]

Thread overview: 66+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-06-26  3:28 incoming Andrew Morton
2020-06-26  3:29 ` [patch 01/32] openrisc: fix boot oops when DEBUG_VM is enabled Andrew Morton
2020-06-26  3:29 ` [patch 02/32] mm: do_swap_page(): fix up the error code Andrew Morton
2020-06-26  3:29 ` [patch 03/32] mm, compaction: make capture control handling safe wrt interrupts Andrew Morton
2020-06-26  3:29 ` [patch 04/32] kexec: do not verify the signature without the lockdown or mandatory signature Andrew Morton
2020-06-26  3:29 ` [patch 05/32] ocfs2: avoid inode removal while nfsd is accessing it Andrew Morton
2020-06-26  3:29 ` [patch 06/32] ocfs2: load global_inode_alloc Andrew Morton
2020-06-26  3:29 ` [patch 07/32] ocfs2: fix panic on nfs server over ocfs2 Andrew Morton
2020-06-26  3:29 ` [patch 08/32] ocfs2: fix value of OCFS2_INVALID_SLOT Andrew Morton
2020-06-26  3:29 ` [patch 09/32] lib: fix test_hmm.c reference after free Andrew Morton
2020-06-26  3:29 ` [patch 10/32] linux/bits.h: fix unsigned less than zero warnings Andrew Morton
2020-06-26  3:29 ` [patch 11/32] mm, slab: fix sign conversion problem in memcg_uncharge_slab() Andrew Morton
2020-06-26  3:29 ` [patch 12/32] mm/slab: use memzero_explicit() in kzfree() Andrew Morton
2020-06-26  3:29 ` [patch 13/32] slub: cure list_slab_objects() from double fix Andrew Morton
2020-06-26  3:29 ` [patch 14/32] mm: fix swap cache node allocation mask Andrew Morton
2020-06-26  3:30 ` [patch 15/32] mm/memory.c: properly pte_offset_map_lock/unlock in vm_insert_pages() Andrew Morton
2020-06-26  3:30 ` [patch 16/32] mm/debug_vm_pgtable: fix build failure with powerpc 8xx Andrew Morton
2020-06-26  3:30 ` [patch 17/32] make asm-generic/cacheflush.h more standalone Andrew Morton
2020-06-26  3:30 ` [patch 18/32] media: omap3isp: remove cacheflush.h Andrew Morton
2020-06-26  3:30 ` [patch 19/32] mm/vmalloc.c: fix a warning while make xmldocs Andrew Morton
2020-06-26  3:30 ` [patch 20/32] mm: memcontrol: handle div0 crash race condition in memory.low Andrew Morton
2020-06-26  3:30 ` [patch 21/32] mm/memcontrol.c: add missed css_put() Andrew Morton
2020-06-26  3:30 ` [patch 22/32] mm/memcontrol.c: prevent missed memory.low load tears Andrew Morton
2020-06-26  3:30 ` [patch 23/32] docs: mm/gup: minor documentation update Andrew Morton
2020-06-26  3:30 ` [patch 24/32] doc: THP CoW fault no longer allocate THP Andrew Morton
2020-06-26  3:30 ` [patch 25/32] mm: workingset: age nonresident information alongside anonymous pages Andrew Morton
2020-06-26  3:30 ` [patch 26/32] mm/swap: fix for "mm: workingset: age nonresident information alongside anonymous pages" Andrew Morton
2020-06-26  3:30 ` [patch 27/32] mm/memory: fix IO cost for anonymous page Andrew Morton
2020-06-26  3:30 ` [patch 28/32] x86/hyperv: allocate the hypercall page with only read and execute bits Andrew Morton
2020-06-26  3:30 ` [patch 29/32] arm64: use PAGE_KERNEL_ROX directly in alloc_insn_page Andrew Morton
2020-06-26  3:30 ` [patch 30/32] mm: remove vmalloc_exec Andrew Morton
2020-06-26  3:30 ` [patch 31/32] mm/memory_hotplug.c: fix false softlockup during pfn range removal Andrew Morton
2020-06-26  3:30 ` [patch 32/32] MAINTAINERS: update info for sparse Andrew Morton
2020-06-27  3:32 ` + linux-next-git-rejects.patch added to -mm tree Andrew Morton
2020-06-27  3:32 ` [merged] dma-remap-align-the-size-in-dma_common__remap.patch removed from " Andrew Morton
2020-06-27  3:32 ` [merged] openrisc-fix-boot-oops-when-debug_vm-is-enabled.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-do_swap_page-fix-up-the-error-code-instantiation.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-compaction-make-capture-control-handling-safe-wrt-interrupts.patch " Andrew Morton
2020-06-27  3:33 ` [merged] kexec-do-not-verify-the-signature-without-the-lockdown-or-mandatory-signature.patch " Andrew Morton
2020-06-27  3:33 ` [merged] ocfs2-avoid-inode-removed-while-nfsd-access-it.patch " Andrew Morton
2020-06-27  3:33 ` [merged] ocfs2-load-global_inode_alloc.patch " Andrew Morton
2020-06-27  3:33 ` [merged] ocfs2-fix-panic-on-nfs-server-over-ocfs2.patch " Andrew Morton
2020-06-27  3:33 ` [merged] ocfs2-fix-value-of-ocfs2_invalid_slot.patch " Andrew Morton
2020-06-27  3:33 ` [merged] lib-fix-test_hmmc-reference-after-free.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-slab-fix-sign-conversion-problem-in-memcg_uncharge_slab.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-slab-use-memzero_explicit-in-kzfree.patch " Andrew Morton
2020-06-27  3:33 ` [merged] slub-cure-list_slab_objects-from-double-fix.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-fix-swap-cache-node-allocation-mask.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-memoryc-properly-pte_offset_map_lock-unlock-in-vm_insert_pages.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-debug_vm_pgtable-fix-build-failure-with-powerpc-8xx.patch " Andrew Morton
2020-06-27  3:33 ` [merged] make-asm-generic-cacheflushh-more-standalone.patch " Andrew Morton
2020-06-27  3:33 ` [merged] media-omap3isp-remove-cacheflushh.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-fix-a-warning-while-make-xmldocs.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-memcontrol-handle-div0-crash-race-condition-in-memorylow.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-memcontrol-fix-do-not-put-the-css-reference.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-memcg-prevent-missed-memorylow-load-tears.patch " Andrew Morton
2020-06-27  3:33 ` [merged] docs-mm-gup-minor-documentation-update.patch " Andrew Morton
2020-06-27  3:33 ` [merged] doc-thp-cow-fault-no-longer-allocate-thp.patch " Andrew Morton
2020-06-27  3:33 ` [merged] mm-workingset-age-nonresident-information-alongside-anonymous-pages.patch " Andrew Morton
2020-06-27  3:34 ` [merged] mm-swap-fix-for-mm-workingset-age-nonresident-information-alongside-anonymous-pages.patch " Andrew Morton
2020-06-27  3:34 ` [merged] mm-memory-fix-io-cost-for-anonymous-page.patch " Andrew Morton
2020-06-27  3:34 ` [merged] x86-hyperv-allocate-the-hypercall-page-with-only-read-and-execute-bits.patch " Andrew Morton
2020-06-27  3:34 ` [merged] arm64-use-page_kernel_rox-directly-in-alloc_insn_page.patch " Andrew Morton
2020-06-27  3:34 ` [merged] mm-remove-vmalloc_exec.patch " Andrew Morton
2020-06-27  3:34 ` [merged] mm-fix-false-softlockup-during-pfn-range-removal.patch " Andrew Morton
2020-06-27  3:34 ` [merged] maintainers-update-info-for-sparse.patch " Andrew Morton

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).