mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-24 13:44:26 -04:00
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Greg Kroah-Hartman
|
87acfa0267 |
This is the 5.4.19 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl5Cn6wACgkQONu9yGCS
aT789BAAkpzYCCHEL2aqDpnZQdu1kVua2nywEJCY0WqSM1lWLeU1Lk9EvS6uu99B
nHnIgoAGXR1zQy9rlhpKKt62LvCCM94QWlQRDYYeJxbFPn1ogT2/0vmwN7rqNz4M
Jdszd6gfNKtB3zpZZLJ0KXG8q6YRp5kXOHEzOXNjcVsfKRuNTWWIBV0dMmkCzduQ
Y5e62+d1FnnRFj28R7wjJfXiZSRnIGcMHohcQGXsWZsh2rktYOYsL6G37I9lCBwx
RO7/+qVOT+BImqB5fIxB98JOzOlo6uEVqPgXjMHAAZUzzA4KpOkDBn55m5hA9axf
EG67Ft4vZJc6Q3FTtHdSZZ/x6TBAJ2DUzatpKhCTDB3vlWJ6a+CsTFq3dXj4+bFr
hFuyi0u91VeudmWR8IH5Er8QaNaOq8m72XAwK22fZptZz0ZHl+Bf1QZyEY0L0P2Q
DpT/kmZVgSSDusvMtJOwI8Vr4Ibb8o46kFTQN+PCSs0pbPchEJmInHz0mIypK89N
4YIjcDZZu3WUS13pEsgNAi2FEpwZdn32LYxZg8xTYBtovzuvT1pJUEppiVSMXgKS
8vF6oCAd7pX9Fal5fYklA7gyQENnHBFI+LE+bHwMR/qwreH/3wBTLnhRPsGOxyZI
oj57YDdxZCAwEfXGoWA3Le+60lj6bGuRfmCc4VkodaOxMLb1WrE=
=rUtE
-----END PGP SIGNATURE-----
Merge 5.4.19 into android-5.4
Changes in 5.4.19
sparc32: fix struct ipc64_perm type definition
bnxt_en: Move devlink_register before registering netdev
cls_rsvp: fix rsvp_policy
gtp: use __GFP_NOWARN to avoid memalloc warning
l2tp: Allow duplicate session creation with UDP
net: hsr: fix possible NULL deref in hsr_handle_frame()
net_sched: fix an OOB access in cls_tcindex
net: stmmac: Delete txtimer in suspend()
bnxt_en: Fix TC queue mapping.
rxrpc: Fix use-after-free in rxrpc_put_local()
rxrpc: Fix insufficient receive notification generation
rxrpc: Fix missing active use pinning of rxrpc_local object
rxrpc: Fix NULL pointer deref due to call->conn being cleared on disconnect
tcp: clear tp->total_retrans in tcp_disconnect()
tcp: clear tp->delivered in tcp_disconnect()
tcp: clear tp->data_segs{in|out} in tcp_disconnect()
tcp: clear tp->segs_{in|out} in tcp_disconnect()
ionic: fix rxq comp packet type mask
MAINTAINERS: correct entries for ISDN/mISDN section
netdevsim: fix stack-out-of-bounds in nsim_dev_debugfs_init()
bnxt_en: Fix logic that disables Bus Master during firmware reset.
media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors
mfd: dln2: More sanity checking for endpoints
netfilter: ipset: fix suspicious RCU usage in find_set_and_id
ipc/msg.c: consolidate all xxxctl_down() functions
tracing/kprobes: Have uname use __get_str() in print_fmt
tracing: Fix sched switch start/stop refcount racy updates
rcu: Use *_ONCE() to protect lockless ->expmask accesses
rcu: Avoid data-race in rcu_gp_fqs_check_wake()
srcu: Apply *_ONCE() to ->srcu_last_gp_end
rcu: Use READ_ONCE() for ->expmask in rcu_read_unlock_special()
nvmet: Fix error print message at nvmet_install_queue function
nvmet: Fix controller use after free
Bluetooth: btusb: fix memory leak on fw
Bluetooth: btusb: Disable runtime suspend on Realtek devices
brcmfmac: Fix memory leak in brcmf_usbdev_qinit
usb: dwc3: gadget: Check END_TRANSFER completion
usb: dwc3: gadget: Delay starting transfer
usb: typec: tcpci: mask event interrupts when remove driver
objtool: Silence build output
usb: gadget: f_fs: set req->num_sgs as 0 for non-sg transfer
usb: gadget: legacy: set max_speed to super-speed
usb: gadget: f_ncm: Use atomic_t to track in-flight request
usb: gadget: f_ecm: Use atomic_t to track in-flight request
ALSA: usb-audio: Fix endianess in descriptor validation
ALSA: usb-audio: Annotate endianess in Scarlett gen2 quirk
ALSA: dummy: Fix PCM format loop in proc output
memcg: fix a crash in wb_workfn when a device disappears
mm/sparse.c: reset section's mem_map when fully deactivated
mmc: sdhci-pci: Make function amd_sdhci_reset static
utimes: Clamp the timestamps in notify_change()
mm/memory_hotplug: fix remove_memory() lockdep splat
mm: thp: don't need care deferred split queue in memcg charge move path
mm: move_pages: report the number of non-attempted pages
media/v4l2-core: set pages dirty upon releasing DMA buffers
media: v4l2-core: compat: ignore native command codes
media: v4l2-rect.h: fix v4l2_rect_map_inside() top/left adjustments
lib/test_kasan.c: fix memory leak in kmalloc_oob_krealloc_more()
irqdomain: Fix a memory leak in irq_domain_push_irq()
x86/cpu: Update cached HLE state on write to TSX_CTRL_CPUID_CLEAR
platform/x86: intel_scu_ipc: Fix interrupt support
ALSA: hda: Apply aligned MMIO access only conditionally
ALSA: hda: Add Clevo W65_67SB the power_save blacklist
ALSA: hda: Add JasperLake PCI ID and codec vid
arm64: acpi: fix DAIF manipulation with pNMI
KVM: arm64: Correct PSTATE on exception entry
KVM: arm/arm64: Correct CPSR on exception entry
KVM: arm/arm64: Correct AArch32 SPSR on exception entry
KVM: arm64: Only sign-extend MMIO up to register width
MIPS: syscalls: fix indentation of the 'SYSNR' message
MIPS: fix indentation of the 'RELOCS' message
MIPS: boot: fix typo in 'vmlinux.lzma.its' target
s390/mm: fix dynamic pagetable upgrade for hugetlbfs
powerpc/mmu_gather: enable RCU_TABLE_FREE even for !SMP case
powerpc/ptdump: Fix W+X verification
powerpc/xmon: don't access ASDR in VMs
powerpc/pseries: Advance pfn if section is not present in lmb_is_removable()
powerpc/32s: Fix bad_kuap_fault()
powerpc/32s: Fix CPU wake-up from sleep mode
tracing: Fix now invalid var_ref_vals assumption in trace action
PCI: tegra: Fix return value check of pm_runtime_get_sync()
PCI: keystone: Fix outbound region mapping
PCI: keystone: Fix link training retries initiation
PCI: keystone: Fix error handling when "num-viewport" DT property is not populated
mmc: spi: Toggle SPI polarity, do not hardcode it
ACPI: video: Do not export a non working backlight interface on MSI MS-7721 boards
ACPI / battery: Deal with design or full capacity being reported as -1
ACPI / battery: Use design-cap for capacity calculations if full-cap is not available
ACPI / battery: Deal better with neither design nor full capacity not being reported
alarmtimer: Unregister wakeup source when module get fails
fscrypt: don't print name of busy file when removing key
ubifs: don't trigger assertion on invalid no-key filename
ubifs: Fix wrong memory allocation
ubifs: Fix FS_IOC_SETFLAGS unexpectedly clearing encrypt flag
ubifs: Fix deadlock in concurrent bulk-read and writepage
mmc: sdhci-of-at91: fix memleak on clk_get failure
ASoC: SOF: core: free trace on errors
hv_balloon: Balloon up according to request page number
mfd: axp20x: Mark AXP20X_VBUS_IPSOUT_MGMT as volatile
nvmem: core: fix memory abort in cleanup path
crypto: api - Check spawn->alg under lock in crypto_drop_spawn
crypto: ccree - fix backlog memory leak
crypto: ccree - fix AEAD decrypt auth fail
crypto: ccree - fix pm wrongful error reporting
crypto: ccree - fix FDE descriptor sequence
crypto: ccree - fix PM race condition
padata: Remove broken queue flushing
fs: allow deduplication of eof block into the end of the destination file
scripts/find-unused-docs: Fix massive false positives
erofs: fix out-of-bound read for shifted uncompressed block
scsi: megaraid_sas: Do not initiate OCR if controller is not in ready state
scsi: qla2xxx: Fix mtcp dump collection failure
cpupower: Revert library ABI changes from commit
|
||
Peter Zijlstra
|
806cabd311 |
mm/mmu_gather: invalidate TLB correctly on batch allocation failure and flush
commit 0ed1325967ab5f7a4549a2641c6ebe115f76e228 upstream. Architectures for which we have hardware walkers of Linux page table should flush TLB on mmu gather batch allocation failures and batch flush. Some architectures like POWER supports multiple translation modes (hash and radix) and in the case of POWER only radix translation mode needs the above TLBI. This is because for hash translation mode kernel wants to avoid this extra flush since there are no hardware walkers of linux page table. With radix translation, the hardware also walks linux page table and with that, kernel needs to make sure to TLB invalidate page walk cache before page table pages are freed. More details in commit |
||
David Hildenbrand
|
ed53278ee8 |
mm/page_alloc.c: fix uninitialized memmaps on a partially populated last section
commit e822969cab48b786b64246aad1a3ba2a774f5d23 upstream. Patch series "mm: fix max_pfn not falling on section boundary", v2. Playing with different memory sizes for a x86-64 guest, I discovered that some memmaps (highest section if max_mem does not fall on the section boundary) are marked as being valid and online, but contain garbage. We have to properly initialize these memmaps. Looking at /proc/kpageflags and friends, I found some more issues, partially related to this. This patch (of 3): If max_pfn is not aligned to a section boundary, we can easily run into BUGs. This can e.g., be triggered on x86-64 under QEMU by specifying a memory size that is not a multiple of 128MB (e.g., 4097MB, but also 4160MB). I was told that on real HW, we can easily have this scenario (esp., one of the main reasons sub-section hotadd of devmem was added). The issue is, that we have a valid memmap (pfn_valid()) for the whole section, and the whole section will be marked "online". pfn_to_online_page() will succeed, but the memmap contains garbage. E.g., doing a "./page-types -r -a 0x144001" when QEMU was started with "-m 4160M" - (see tools/vm/page-types.c): [ 200.476376] BUG: unable to handle page fault for address: fffffffffffffffe [ 200.477500] #PF: supervisor read access in kernel mode [ 200.478334] #PF: error_code(0x0000) - not-present page [ 200.479076] PGD 59614067 P4D 59614067 PUD 59616067 PMD 0 [ 200.479557] Oops: 0000 [#4] SMP NOPTI [ 200.479875] CPU: 0 PID: 603 Comm: page-types Tainted: G D W 5.5.0-rc1-next-20191209 #93 [ 200.480646] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu4 [ 200.481648] RIP: 0010:stable_page_flags+0x4d/0x410 [ 200.482061] Code: f3 ff 41 89 c0 48 b8 00 00 00 00 01 00 00 00 45 84 c0 0f 85 cd 02 00 00 48 8b 53 08 48 8b 2b 48f [ 200.483644] RSP: 0018:ffffb139401cbe60 EFLAGS: 00010202 [ 200.484091] RAX: fffffffffffffffe RBX: fffffbeec5100040 RCX: 0000000000000000 [ 200.484697] RDX: 0000000000000001 RSI: ffffffff9535c7cd RDI: 0000000000000246 [ 200.485313] RBP: ffffffffffffffff R08: 0000000000000000 R09: 0000000000000000 [ 200.485917] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000144001 [ 200.486523] R13: 00007ffd6ba55f48 R14: 00007ffd6ba55f40 R15: ffffb139401cbf08 [ 200.487130] FS: 00007f68df717580(0000) GS:ffff9ec77fa00000(0000) knlGS:0000000000000000 [ 200.487804] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 200.488295] CR2: fffffffffffffffe CR3: 0000000135d48000 CR4: 00000000000006f0 [ 200.488897] Call Trace: [ 200.489115] kpageflags_read+0xe9/0x140 [ 200.489447] proc_reg_read+0x3c/0x60 [ 200.489755] vfs_read+0xc2/0x170 [ 200.490037] ksys_pread64+0x65/0xa0 [ 200.490352] do_syscall_64+0x5c/0xa0 [ 200.490665] entry_SYSCALL_64_after_hwframe+0x49/0xbe But it can be triggered much easier via "cat /proc/kpageflags > /dev/null" after cold/hot plugging a DIMM to such a system: [root@localhost ~]# cat /proc/kpageflags > /dev/null [ 111.517275] BUG: unable to handle page fault for address: fffffffffffffffe [ 111.517907] #PF: supervisor read access in kernel mode [ 111.518333] #PF: error_code(0x0000) - not-present page [ 111.518771] PGD a240e067 P4D a240e067 PUD a2410067 PMD 0 This patch fixes that by at least zero-ing out that memmap (so e.g., page_to_pfn() will not crash). Commit |
||
Yang Shi
|
d364e9b37c |
mm: move_pages: report the number of non-attempted pages
commit 5984fabb6e82d9ab4e6305cb99694c85d46de8ae upstream. Since commit |
||
Wei Yang
|
95419e7ef2 |
mm: thp: don't need care deferred split queue in memcg charge move path
commit fac0516b5534897bf4c4a88daa06a8cfa5611b23 upstream.
If compound is true, this means it is a PMD mapped THP. Which implies
the page is not linked to any defer list. So the first code chunk will
not be executed.
Also with this reason, it would not be proper to add this page to a
defer list. So the second code chunk is not correct.
Based on this, we should remove the defer list related code.
[yang.shi@linux.alibaba.com: better patch title]
Link: http://lkml.kernel.org/r/20200117233836.3434-1-richardw.yang@linux.intel.com
Fixes:
|
||
Dan Williams
|
aab4189dfd |
mm/memory_hotplug: fix remove_memory() lockdep splat
commit f1037ec0cc8ac1a450974ad9754e991f72884f48 upstream.
The daxctl unit test for the dax_kmem driver currently triggers the
(false positive) lockdep splat below. It results from the fact that
remove_memory_block_devices() is invoked under the mem_hotplug_lock()
causing lockdep entanglements with cpu_hotplug_lock() and sysfs (kernfs
active state tracking). It is a false positive because the sysfs
attribute path triggering the memory remove is not the same attribute
path associated with memory-block device.
sysfs_break_active_protection() is not applicable since there is no real
deadlock conflict, instead move memory-block device removal outside the
lock. The mem_hotplug_lock() is not needed to synchronize the
memory-block device removal vs the page online state, that is already
handled by lock_device_hotplug(). Specifically, lock_device_hotplug()
is sufficient to allow try_remove_memory() to check the offline state of
the memblocks and be assured that any in progress online attempts are
flushed / blocked by kernfs_drain() / attribute removal.
The add_memory() path safely creates memblock devices under the
mem_hotplug_lock(). There is no kernfs active state synchronization in
the memblock device_register() path, so nothing to fix there.
This change is only possible thanks to the recent change that refactored
memory block device removal out of arch_remove_memory() (commit
|
||
Pingfan Liu
|
af823232b0 |
mm/sparse.c: reset section's mem_map when fully deactivated
commit 1f503443e7df8dc8366608b4d810ce2d6669827c upstream.
After commit
|
||
Theodore Ts'o
|
c2c814fc9a |
memcg: fix a crash in wb_workfn when a device disappears
commit 68f23b89067fdf187763e75a56087550624fdbee upstream. Without memcg, there is a one-to-one mapping between the bdi and bdi_writeback structures. In this world, things are fairly straightforward; the first thing bdi_unregister() does is to shutdown the bdi_writeback structure (or wb), and part of that writeback ensures that no other work queued against the wb, and that the wb is fully drained. With memcg, however, there is a one-to-many relationship between the bdi and bdi_writeback structures; that is, there are multiple wb objects which can all point to a single bdi. There is a refcount which prevents the bdi object from being released (and hence, unregistered). So in theory, the bdi_unregister() *should* only get called once its refcount goes to zero (bdi_put will drop the refcount, and when it is zero, release_bdi gets called, which calls bdi_unregister). Unfortunately, del_gendisk() in block/gen_hd.c never got the memo about the Brave New memcg World, and calls bdi_unregister directly. It does this without informing the file system, or the memcg code, or anything else. This causes the root wb associated with the bdi to be unregistered, but none of the memcg-specific wb's are shutdown. So when one of these wb's are woken up to do delayed work, they try to dereference their wb->bdi->dev to fetch the device name, but unfortunately bdi->dev is now NULL, thanks to the bdi_unregister() called by del_gendisk(). As a result, *boom*. Fortunately, it looks like the rest of the writeback path is perfectly happy with bdi->dev and bdi->owner being NULL, so the simplest fix is to create a bdi_dev_name() function which can handle bdi->dev being NULL. This also allows us to bulletproof the writeback tracepoints to prevent them from dereferencing a NULL pointer and crashing the kernel if one is tracing with memcg's enabled, and an iSCSI device dies or a USB storage stick is pulled. The most common way of triggering this will be hotremoval of a device while writeback with memcg enabled is going on. It was triggering several times a day in a heavily loaded production environment. Google Bug Id: 145475544 Link: https://lore.kernel.org/r/20191227194829.150110-1-tytso@mit.edu Link: http://lkml.kernel.org/r/20191228005211.163952-1-tytso@mit.edu Signed-off-by: Theodore Ts'o <tytso@mit.edu> Cc: Chris Mason <clm@fb.com> Cc: Tejun Heo <tj@kernel.org> Cc: Jens Axboe <axboe@kernel.dk> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Greg Kroah-Hartman
|
1bb7ab6685 |
This is the 5.4.18 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl47Mi4ACgkQONu9yGCS aT4zURAAiRhPVfht+amxkX2ebcimGIDO7oMICICF4vAOn9zAHHzEuxjtQms0LWRN l91qduujbVHg9/81BzCe0qp5GwYsgJRAIB5sJwuCrtM5u8zSSQXIY58sU1ZUXLha UC7Pnez+f420RO/U4Xh3BnEM6GOj97VrLw3gePdmI+e4imwP+czloYR/sVLhHES3 vHr7OFhYx8GF303RomFo4kuG9dz11ZUuPdrcHWxDRBHIf3bNCITGpjOV9ICZPL9+ UqmrFZKyqXcT29pgwtUMIxobnkgQm9KekS8iYGS7pblu5BXTuvU6TvfKwpOMOdF3 FIDV9km6LRFyydCLowuiA5gVuNQwfcXCIfPZfhX0ua0vC8e7q/DKItf7QBaChYyp tD4mjXGkOvIrZad94kSw3qVWr1bv9I4D5w+BmDoi5/zchjAcphUeij+QXEhmkD9k PB+zu3NbeY0J69QaVgCbPPHAmimIwsCKlA9FAJNMeuDwBIk7LXF7J0Y0ehlxwdTy h9/miG0UXYkeo5BhhdvvlZ9jdCVHI/fux+McObsasBL2xArmAA059GRgDag2qEo9 X+rtszl8x1JIcPZ3lfm5aSsZ/8nQhtpfsl+mZKSM/x+Kl+SoryvgYtDJHg9Rf5Cp WPx5mD82fS9g1RaQmIWa7iZj4iNvLDf4I+ppe2JbEGUq5IYzZGY= =cfYj -----END PGP SIGNATURE----- Merge 5.4.18 into android-5.4 Changes in 5.4.18 vfs: fix do_last() regression cifs: fix soft mounts hanging in the reconnect code x86/resctrl: Fix a deadlock due to inaccurate reference x86/resctrl: Fix use-after-free when deleting resource groups x86/resctrl: Fix use-after-free due to inaccurate refcount of rdtgroup e1000e: Drop unnecessary __E1000_DOWN bit twiddling e1000e: Revert "e1000e: Make watchdog use delayed work" gfs2: Another gfs2_find_jhead fix perf c2c: Fix return type for histogram sorting comparision functions PM / devfreq: Add new name attribute for sysfs tools lib: Fix builds when glibc contains strlcpy() arm64: kbuild: remove compressed images on 'make ARCH=arm64 (dist)clean' mm/mempolicy.c: fix out of bounds write in mpol_parse_str() reiserfs: Fix memory leak of journal device string media: digitv: don't continue if remote control state can't be read media: af9005: uninitialized variable printked media: vp7045: do not read uninitialized values if usb transfer fails media: gspca: zero usb_buf media: dvb-usb/dvb-usb-urb.c: initialize actlen to 0 tomoyo: Use atomic_t for statistics counter ttyprintk: fix a potential deadlock in interrupt context issue Bluetooth: Fix race condition in hci_release_sock() cgroup: Prevent double killing of css when enabling threaded cgroup clk: sunxi-ng: v3s: Fix incorrect number of hw_clks. arm64: dts: meson-sm1-sei610: add gpio bluetooth interrupt ARM: dts: sun8i: a83t: Correct USB3503 GPIOs polarity ARM: dts: am57xx-beagle-x15/am57xx-idk: Remove "gpios" for endpoint dt nodes ARM: dts: beagle-x15-common: Model 5V0 regulator soc: ti: wkup_m3_ipc: Fix race condition with rproc_boot tools lib traceevent: Fix memory leakage in filter_event rseq: Unregister rseq for clone CLONE_VM clk: sunxi-ng: sun8i-r: Fix divider on APB0 clock clk: sunxi-ng: h6-r: Fix AR100/R_APB2 parent order mac80211: mesh: restrict airtime metric to peered established plinks clk: mmp2: Fix the order of timer mux parents ASoC: rt5640: Fix NULL dereference on module unload s390/zcrypt: move ap device reset from bus to driver code i40e: Fix virtchnl_queue_select bitmap validation ixgbevf: Remove limit of 10 entries for unicast filter list ixgbe: Fix calculation of queue with VFs and flow director on interface flap igb: Fix SGMII SFP module discovery for 100FX/LX. iavf: remove current MAC address filter on VF reset platform/x86: GPD pocket fan: Allow somewhat lower/higher temperature limits platform/x86: intel_pmc_core: update Comet Lake platform driver ASoC: SOF: Intel: fix HDA codec driver probe with multiple controllers ASoC: hdac_hda: Fix error in driver removal after failed probe ASoC: sti: fix possible sleep-in-atomic qmi_wwan: Add support for Quectel RM500Q parisc: Use proper printk format for resource_size_t lkdtm/bugs: fix build error in lkdtm_UNSET_SMEP wireless: fix enabling channel 12 for custom regulatory domain cfg80211: Fix radar event during another phy CAC mac80211: Fix TKIP replay protection immediately after key setup wireless: wext: avoid gcc -O3 warning perf/x86/intel/uncore: Add PCI ID of IMC for Xeon E3 V5 Family perf/x86/intel/uncore: Remove PCIe3 unit for SNR riscv: delete temporary files XArray: Fix xas_pause at ULONG_MAX iwlwifi: pcie: allocate smaller dev_cmd for TX headers iwlwifi: Don't ignore the cap field upon mcc update iwlwifi: dbg: force stop the debug monitor HW Input: evdev - convert kzalloc()/vzalloc() to kvzalloc() ARM: dts: am335x-boneblack-common: fix memory size vti[6]: fix packet tx through bpf_redirect() xfrm interface: fix packet tx through bpf_redirect() xfrm: interface: do not confirm neighbor when do pmtu update Input: max77650-onkey - add of_match table scsi: fnic: do not queue commands during fwreset ARM: 8955/1: virt: Relax arch timer version check during early boot led: max77650: add of_match table tee: optee: Fix compilation issue with nommu r8152: get default setting of WOL before initializing r8152: disable U2P3 for RTL8153B r8152: Disable PLA MCU clock speed down r8152: disable test IO for RTL8153B r8152: avoid the MCU to clear the lanwake r8152: disable DelayPhyPwrChg ARM: dts: am43x-epos-evm: set data pin directions for spi0 and spi1 qlcnic: Fix CPU soft lockup while collecting firmware dump powerpc/fsl/dts: add fsl,erratum-a011043 net/fsl: treat fsl,erratum-a011043 net: fsl/fman: rename IF_MODE_XGMII to IF_MODE_10G seq_tab_next() should increase position index l2t_seq_next should increase position index netfilter: conntrack: sctp: use distinct states for new SCTP connections netfilter: nf_tables_offload: fix check the chain offload flag net: Fix skb->csum update in inet_proto_csum_replace16(). btrfs: do not zero f_bavail if we have available space cpuidle: teo: Avoid using "early hits" incorrectly flow_dissector: Fix to use new variables for port ranges in bpf hook dm thin: fix use-after-free in metadata_pre_commit_callback perf report: Fix no libunwind compiled warning break s390 issue mm/migrate.c: also overwrite error when it is bigger than zero ASoC: topology: fix soc_tplg_fe_link_create() - link->dobj initialization order Revert "rsi: fix potential null dereference in rsi_probe()" tracing/uprobe: Fix to make trace_uprobe_filter alignment safe Linux 5.4.18 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I2dcf0611b3c562c6e934f952844a90be6ace99ed |
||
|
Wei Yang
|
52cf138f5c |
mm/migrate.c: also overwrite error when it is bigger than zero
[ Upstream commit dfe9aa23cab7880a794db9eb2d176c00ed064eb6 ]
If we get here after successfully adding page to list, err would be 1 to
indicate the page is queued in the list.
Current code has two problems:
* on success, 0 is not returned
* on error, if add_page_for_migratioin() return 1, and the following err1
from do_move_pages_to_node() is set, the err1 is not returned since err
is 1
And these behaviors break the user interface.
Link: http://lkml.kernel.org/r/20200119065753.21694-1-richardw.yang@linux.intel.com
Fixes: e0153fc2c760 ("mm: move_pages: return valid node id in status if the page is already on the target node").
Signed-off-by: Wei Yang <richardw.yang@linux.intel.com>
Acked-by: Yang Shi <yang.shi@linux.alibaba.com>
Cc: John Hubbard <jhubbard@nvidia.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Christoph Lameter <cl@linux.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||
Dan Carpenter
|
9bcdb8ba5a |
mm/mempolicy.c: fix out of bounds write in mpol_parse_str()
commit c7a91bc7c2e17e0a9c8b9745a2cb118891218fd1 upstream.
What we are trying to do is change the '=' character to a NUL terminator
and then at the end of the function we restore it back to an '='. The
problem is there are two error paths where we jump to the end of the
function before we have replaced the '=' with NUL.
We end up putting the '=' in the wrong place (possibly one element
before the start of the buffer).
Link: http://lkml.kernel.org/r/20200115055426.vdjwvry44nfug7yy@kili.mountain
Reported-by: syzbot+e64a13c5369a194d67df@syzkaller.appspotmail.com
Fixes:
|
||
Minchan Kim
|
d3411757f3 |
UPSTREAM: mm/page_io.c: annotate refault stalls from swap_readpage
If a block device supports rw_page operation, it doesn't submit bios so the annotation in submit_bio() for refault stall doesn't work. It happens with zram in android, especially swap read path which could consume CPU cycle for decompress. It is also a problem for zswap which uses frontswap. Annotate swap_readpage() to account the synchronous IO overhead to prevent underreport memory pressure. [akpm@linux-foundation.org: add comment, per Johannes] Link: http://lkml.kernel.org/r/20191010152134.38545-1-minchan@kernel.org Signed-off-by: Minchan Kim <minchan@google.com> Acked-by: Johannes Weiner <hannes@cmpxchg.org> Reviewed-by: Shakeel Butt <shakeelb@google.com> Cc: Seth Jennings <sjenning@redhat.com> Cc: Dan Streetman <ddstreet@ieee.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> (cherry picked from commit 937790699be9c8100e5358625e7dfa8b32bd33f2) Bug: 142418748 Signed-off-by: Suren Baghdasaryan <surenb@google.com> Change-Id: I97ca7fb492faaa6cabb27b49b84de3e4a9a56ae5 |
||
|
Greg Kroah-Hartman
|
ea962facf5 |
This is the 5.4.14 stable release
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl4pSdUACgkQONu9yGCS
aT7wnRAAqw7JuC+cQMI29GiTfX/+V6BHFUGp0b7EoFWg1VVqiFqEHOf4QETS2Qy1
3ZAMIBCICMgJD03WUK95tju4byNhpAVc5HDy3ir4E0ZGE6VprgbkzmVWsJhdVd0E
y0whXgRj2mM0eXwCLcLz2qcruE/AxmL84rlnwZ5BwgxbOPq/xRzQQV8R3XUu2bos
1felFUzOLhfJKtZ5ig9ToJGCorc7jOU+cXrvUSvntOFGFqsEdmIfcQMoqE2cXExC
WQIk/JDNGnyHlX7I55P0/OBuSv4SV5JzGZjGkkS/Orqg5/KtaOMh0dAcvp25L3jY
b2bNDDnKvDEd2eb3GQNb4X7pqy8SFD5WLQH2otJjpZl6nHqOG2xCZCnrVtvf7toC
kJ0ocNIeGU6OsFzAwXATh3hk6ZFlJYkQarHjvgpETkx+WBcw9yw7DFW9Pa9khkMV
OWKqfGrqVyV1bTXTfZPHOHm+eBVmqTLPeoK4XeholrnBrPa50pBjexv+uN+UsQnT
QQxTkDpdfFv4KIkH/qgwDh/gIJ/xtjsI9JTK+70aFbSq1HrXNeoZTYof8iLOggY8
wh/aWQGf0PVC3ffgqxd7TF6CxiVn4vaP3/FfcBQVMuTnYK03BScdAEOqBCRLvLK6
509VzsCc1N7qa3vwRTTWxr0u1aCDDgDx5iqmTXW46sYxzjfwnY4=
=qNcT
-----END PGP SIGNATURE-----
Merge 5.4.14 into android-5.4
Changes in 5.4.14
ARM: dts: meson8: fix the size of the PMU registers
clk: qcom: gcc-sdm845: Add missing flag to votable GDSCs
soc: amlogic: meson-ee-pwrc: propagate PD provider registration errors
soc: amlogic: meson-ee-pwrc: propagate errors from pm_genpd_init()
dt-bindings: reset: meson8b: fix duplicate reset IDs
ARM: dts: imx6q-dhcom: fix rtc compatible
arm64: dts: ls1028a: fix endian setting for dcfg
arm64: dts: imx8mm: Change SDMA1 ahb clock for imx8mm
bus: ti-sysc: Fix iterating over clocks
clk: Don't try to enable critical clocks if prepare failed
Revert "gpio: thunderx: Switch to GPIOLIB_IRQCHIP"
arm64: dts: imx8mq-librem5-devkit: use correct interrupt for the magnetometer
ASoC: msm8916-wcd-digital: Reset RX interpolation path after use
ASoC: stm32: sai: fix possible circular locking
ASoC: stm32: dfsdm: fix 16 bits record
ASoC: msm8916-wcd-analog: Fix selected events for MIC BIAS External1
ASoC: msm8916-wcd-analog: Fix MIC BIAS Internal1
ARM: OMAP2+: Fix ti_sysc_find_one_clockdomain to check for to_clk_hw_omap
ARM: dts: imx7ulp: fix reg of cpu node
ARM: dts: imx6q-dhcom: Fix SGTL5000 VDDIO regulator connection
ASoC: Intel: bytcht_es8316: Fix Irbis NB41 netbook quirk
ALSA: dice: fix fallback from protocol extension into limited functionality
ALSA: seq: Fix racy access for queue timer in proc read
ALSA: firewire-tascam: fix corruption due to spin lock without restoration in SoftIRQ context
ALSA: usb-audio: fix sync-ep altsetting sanity check
arm64: dts: allwinner: a64: olinuxino: Fix SDIO supply regulator
arm64: dts: allwinner: a64: olinuxino: Fix eMMC supply regulator
arm64: dts: agilex/stratix10: fix pmu interrupt numbers
Fix built-in early-load Intel microcode alignment
clk: sunxi-ng: r40: Allow setting parent rate for external clock outputs
block: fix an integer overflow in logical block size
fuse: fix fuse_send_readpages() in the syncronous read case
io_uring: only allow submit from owning task
cpuidle: teo: Fix intervals[] array indexing bug
ARM: dts: am571x-idk: Fix gpios property to have the correct gpio number
ARM: davinci: select CONFIG_RESET_CONTROLLER
perf: Correctly handle failed perf_get_aux_event()
iio: adc: ad7124: Fix DT channel configuration
iio: imu: st_lsm6dsx: Fix selection of ST_LSM6DS3_ID
iio: light: vcnl4000: Fix scale for vcnl4040
iio: chemical: pms7003: fix unmet triggered buffer dependency
iio: buffer: align the size of scan bytes to size of the largest element
USB: serial: simple: Add Motorola Solutions TETRA MTP3xxx and MTP85xx
USB: serial: option: Add support for Quectel RM500Q
USB: serial: opticon: fix control-message timeouts
USB: serial: option: add support for Quectel RM500Q in QDL mode
USB: serial: suppress driver bind attributes
USB: serial: ch341: handle unbound port at reset_resume
USB: serial: io_edgeport: handle unbound ports on URB completion
USB: serial: io_edgeport: add missing active-port sanity check
USB: serial: keyspan: handle unbound ports
USB: serial: quatech2: handle unbound ports
staging: comedi: ni_routes: fix null dereference in ni_find_route_source()
staging: comedi: ni_routes: allow partial routing information
scsi: fnic: fix invalid stack access
scsi: mptfusion: Fix double fetch bug in ioctl
ptrace: reintroduce usage of subjective credentials in ptrace_has_cap()
mtd: rawnand: gpmi: Fix suspend/resume problem
mtd: rawnand: gpmi: Restore nfc timing setup after suspend/resume
usb: core: hub: Improved device recognition on remote wakeup
cpu/SMT: Fix x86 link error without CONFIG_SYSFS
x86/resctrl: Fix an imbalance in domain_remove_cpu()
x86/CPU/AMD: Ensure clearing of SME/SEV features is maintained
locking/rwsem: Fix kernel crash when spinning on RWSEM_OWNER_UNKNOWN
perf/x86/intel/uncore: Fix missing marker for snr_uncore_imc_freerunning_events
x86/efistub: Disable paging at mixed mode entry
s390/zcrypt: Fix CCA cipher key gen with clear key value function
scsi: storvsc: Correctly set number of hardware queues for IDE disk
mtd: spi-nor: Fix selection of 4-byte addressing opcodes on Spansion
drm/i915: Add missing include file <linux/math64.h>
x86/resctrl: Fix potential memory leak
efi/earlycon: Fix write-combine mapping on x86
s390/setup: Fix secure ipl message
clk: samsung: exynos5420: Keep top G3D clocks enabled
perf hists: Fix variable name's inconsistency in hists__for_each() macro
locking/lockdep: Fix buffer overrun problem in stack_trace[]
perf report: Fix incorrectly added dimensions as switch perf data file
mm/shmem.c: thp, shmem: fix conflict of above-47bit hint address and PMD alignment
mm/huge_memory.c: thp: fix conflict of above-47bit hint address and PMD alignment
mm: memcg/slab: fix percpu slab vmstats flushing
mm: memcg/slab: call flush_memcg_workqueue() only if memcg workqueue is valid
mm, debug_pagealloc: don't rely on static keys too early
btrfs: rework arguments of btrfs_unlink_subvol
btrfs: fix invalid removal of root ref
btrfs: do not delete mismatched root refs
btrfs: relocation: fix reloc_root lifespan and access
btrfs: fix memory leak in qgroup accounting
btrfs: check rw_devices, not num_devices for balance
Btrfs: always copy scrub arguments back to user space
mm/memory_hotplug: don't free usage map when removing a re-added early section
mm/page-writeback.c: avoid potential division by zero in wb_min_max_ratio()
mm: khugepaged: add trace status description for SCAN_PAGE_HAS_PRIVATE
ARM: dts: imx6qdl-sabresd: Remove incorrect power supply assignment
ARM: dts: imx6sx-sdb: Remove incorrect power supply assignment
ARM: dts: imx6sl-evk: Remove incorrect power supply assignment
ARM: dts: imx6sll-evk: Remove incorrect power supply assignment
ARM: dts: imx6q-icore-mipi: Use 1.5 version of i.Core MX6DL
ARM: dts: imx7: Fix Toradex Colibri iMX7S 256MB NAND flash support
net: stmmac: 16KB buffer must be 16 byte aligned
net: stmmac: Enable 16KB buffer size
reset: Fix {of,devm}_reset_control_array_get kerneldoc return types
tipc: fix potential hanging after b/rcast changing
tipc: fix retrans failure due to wrong destination
net: fix kernel-doc warning in <linux/netdevice.h>
block: Fix the type of 'sts' in bsg_queue_rq()
drm/amd/display: Reorder detect_edp_sink_caps before link settings read.
bpf: Fix incorrect verifier simulation of ARSH under ALU32
bpf: Sockmap/tls, during free we may call tcp_bpf_unhash() in loop
bpf: Sockmap, ensure sock lock held during tear down
bpf: Sockmap/tls, push write_space updates through ulp updates
bpf: Sockmap, skmsg helper overestimates push, pull, and pop bounds
bpf: Sockmap/tls, msg_push_data may leave end mark in place
bpf: Sockmap/tls, tls_sw can create a plaintext buf > encrypt buf
bpf: Sockmap/tls, skmsg can have wrapped skmsg that needs extra chaining
bpf: Sockmap/tls, fix pop data with SK_DROP return code
i2c: tegra: Fix suspending in active runtime PM state
i2c: tegra: Properly disable runtime PM on driver's probe error
cfg80211: fix deadlocks in autodisconnect work
cfg80211: fix memory leak in nl80211_probe_mesh_link
cfg80211: fix memory leak in cfg80211_cqm_rssi_update
cfg80211: fix page refcount issue in A-MSDU decap
bpf/sockmap: Read psock ingress_msg before sk_receive_queue
i2c: iop3xx: Fix memory leak in probe error path
netfilter: fix a use-after-free in mtype_destroy()
netfilter: arp_tables: init netns pointer in xt_tgdtor_param struct
netfilter: nat: fix ICMP header corruption on ICMP errors
netfilter: nft_tunnel: fix null-attribute check
netfilter: nft_tunnel: ERSPAN_VERSION must not be null
netfilter: nf_tables: remove WARN and add NLA_STRING upper limits
netfilter: nf_tables: store transaction list locally while requesting module
netfilter: nf_tables: fix flowtable list del corruption
NFC: pn533: fix bulk-message timeout
net: bpf: Don't leak time wait and request sockets
bpftool: Fix printing incorrect pointer in btf_dump_ptr
batman-adv: Fix DAT candidate selection on little endian systems
macvlan: use skb_reset_mac_header() in macvlan_queue_xmit()
hv_netvsc: Fix memory leak when removing rndis device
net: avoid updating qdisc_xmit_lock_key in netdev_update_lockdep_key()
net: dsa: tag_qca: fix doubled Tx statistics
net: hns3: pad the short frame before sending to the hardware
net: hns: fix soft lockup when there is not enough memory
net: phy: dp83867: Set FORCE_LINK_GOOD to default after reset
net/sched: act_ife: initalize ife->metalist earlier
net: usb: lan78xx: limit size of local TSO packets
net/wan/fsl_ucc_hdlc: fix out of bounds write on array utdm_info
ptp: free ptp device pin descriptors properly
r8152: add missing endpoint sanity check
tcp: fix marked lost packets not being retransmitted
bnxt_en: Fix NTUPLE firmware command failures.
bnxt_en: Fix ipv6 RFS filter matching logic.
bnxt_en: Do not treat DSN (Digital Serial Number) read failure as fatal.
net: ethernet: ave: Avoid lockdep warning
net: systemport: Fixed queue mapping in internal ring map
net: dsa: sja1105: Don't error out on disabled ports with no phy-mode
net: dsa: tag_gswip: fix typo in tagger name
net: sched: act_ctinfo: fix memory leak
net: dsa: bcm_sf2: Configure IMP port for 2Gb/sec
i40e: prevent memory leak in i40e_setup_macvlans
drm/amdgpu: allow direct upload save restore list for raven2
sh_eth: check sh_eth_cpu_data::dual_port when dumping registers
mlxsw: spectrum: Do not modify cloned SKBs during xmit
mlxsw: spectrum: Wipe xstats.backlog of down ports
mlxsw: spectrum_qdisc: Include MC TCs in Qdisc counters
net: stmmac: selftests: Make it work in Synopsys AXS101 boards
net: stmmac: selftests: Mark as fail when received VLAN ID != expected
selftests: mlxsw: qos_mc_aware: Fix mausezahn invocation
net: stmmac: selftests: Update status when disabling RSS
net: stmmac: tc: Do not setup flower filtering if RSS is enabled
devlink: Wait longer before warning about unset port type
xen/blkfront: Adjust indentation in xlvbd_alloc_gendisk
dt-bindings: Add missing 'properties' keyword enclosing 'snps,tso'
tcp: refine rule to allow EPOLLOUT generation under mem pressure
irqchip: Place CONFIG_SIFIVE_PLIC into the menu
arm64: dts: qcom: msm8998: Disable coresight by default
cw1200: Fix a signedness bug in cw1200_load_firmware()
arm64: dts: meson: axg: fix audio fifo reg size
arm64: dts: meson: g12: fix audio fifo reg size
arm64: dts: meson-gxl-s905x-khadas-vim: fix gpio-keys-polled node
arm64: dts: renesas: r8a77970: Fix PWM3
arm64: dts: marvell: Add AP806-dual missing CPU clocks
cfg80211: check for set_wiphy_params
tick/sched: Annotate lockless access to last_jiffies_update
arm64: dts: marvell: Fix CP110 NAND controller node multi-line comment alignment
arm64: dts: renesas: r8a774a1: Remove audio port node
arm64: dts: imx8mm-evk: Assigned clocks for audio plls
arm64: dts: qcom: sdm845-cheza: delete zap-shader
ARM: dts: imx6ul-kontron-n6310-s: Disable the snvs-poweroff driver
arm64: dts: allwinner: a64: Re-add PMU node
ARM: dts: dra7: fix cpsw mdio fck clock
arm64: dts: juno: Fix UART frequency
ARM: dts: Fix sgx sysconfig register for omap4
Revert "arm64: dts: juno: add dma-ranges property"
mtd: devices: fix mchp23k256 read and write
mtd: cfi_cmdset_0002: only check errors when ready in cfi_check_err_status()
mtd: cfi_cmdset_0002: fix delayed error detection on HyperFlash
um: Don't trace irqflags during shutdown
um: virtio_uml: Disallow modular build
reiserfs: fix handling of -EOPNOTSUPP in reiserfs_for_each_xattr
scsi: esas2r: unlock on error in esas2r_nvram_read_direct()
scsi: hisi_sas: Don't create debugfs dump folder twice
scsi: hisi_sas: Set the BIST init value before enabling BIST
scsi: qla4xxx: fix double free bug
scsi: bnx2i: fix potential use after free
scsi: target: core: Fix a pr_debug() argument
scsi: lpfc: fix: Coverity: lpfc_get_scsi_buf_s3(): Null pointer dereferences
scsi: hisi_sas: Return directly if init hardware failed
scsi: scsi_transport_sas: Fix memory leak when removing devices
scsi: qla2xxx: Fix qla2x00_request_irqs() for MSI
scsi: qla2xxx: fix rports not being mark as lost in sync fabric scan
scsi: core: scsi_trace: Use get_unaligned_be*()
scsi: lpfc: Fix list corruption detected in lpfc_put_sgl_per_hdwq
scsi: lpfc: Fix hdwq sgl locks and irq handling
scsi: lpfc: Fix a kernel warning triggered by lpfc_get_sgl_per_hdwq()
rtw88: fix potential read outside array boundary
perf probe: Fix wrong address verification
perf script: Allow --time with --reltime
clk: sprd: Use IS_ERR() to validate the return value of syscon_regmap_lookup_by_phandle()
clk: imx7ulp: Correct system clock source option #7
clk: imx7ulp: Correct DDR clock mux options
regulator: ab8500: Remove SYSCLKREQ from enum ab8505_regulator_id
hwmon: (pmbus/ibm-cffps) Switch LEDs to blocking brightness call
hwmon: (pmbus/ibm-cffps) Fix LED blink behavior
perf script: Fix --reltime with --time
scsi: lpfc: use hdwq assigned cpu for allocation
Linux 5.4.14
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I400bdf3be682df698c2477fbf869d5ad8ce300b5
|
||
Wen Yang
|
36875206a3 |
mm/page-writeback.c: avoid potential division by zero in wb_min_max_ratio()
commit 6d9e8c651dd979aa666bee15f086745f3ea9c4b3 upstream. Patch series "use div64_ul() instead of div_u64() if the divisor is unsigned long". We were first inspired by commit |
||
|
David Hildenbrand
|
5147a518f5 |
mm/memory_hotplug: don't free usage map when removing a re-added early section
commit 8068df3b60373c390198f660574ea14c8098de57 upstream.
When we remove an early section, we don't free the usage map, as the
usage maps of other sections are placed into the same page. Once the
section is removed, it is no longer an early section (especially, the
memmap is freed). When we re-add that section, the usage map is reused,
however, it is no longer an early section. When removing that section
again, we try to kfree() a usage map that was allocated during early
boot - bad.
Let's check against PageReserved() to see if we are dealing with an
usage map that was allocated during boot. We could also check against
!(PageSlab(usage_page) || PageCompound(usage_page)), but PageReserved() is
cleaner.
Can be triggered using memtrace under ppc64/powernv:
$ mount -t debugfs none /sys/kernel/debug/
$ echo 0x20000000 > /sys/kernel/debug/powerpc/memtrace/enable
$ echo 0x20000000 > /sys/kernel/debug/powerpc/memtrace/enable
------------[ cut here ]------------
kernel BUG at mm/slub.c:3969!
Oops: Exception in kernel mode, sig: 5 [#1]
LE PAGE_SIZE=3D64K MMU=3DHash SMP NR_CPUS=3D2048 NUMA PowerNV
Modules linked in:
CPU: 0 PID: 154 Comm: sh Not tainted 5.5.0-rc2-next-20191216-00005-g0be1dba7b7c0 #61
NIP kfree+0x338/0x3b0
LR section_deactivate+0x138/0x200
Call Trace:
section_deactivate+0x138/0x200
__remove_pages+0x114/0x150
arch_remove_memory+0x3c/0x160
try_remove_memory+0x114/0x1a0
__remove_memory+0x20/0x40
memtrace_enable_set+0x254/0x850
simple_attr_write+0x138/0x160
full_proxy_write+0x8c/0x110
__vfs_write+0x38/0x70
vfs_write+0x11c/0x2a0
ksys_write+0x84/0x140
system_call+0x5c/0x68
---[ end trace 4b053cbd84e0db62 ]---
The first invocation will offline+remove memory blocks. The second
invocation will first add+online them again, in order to offline+remove
them again (usually we are lucky and the exact same memory blocks will
get "reallocated").
Tested on powernv with boot memory: The usage map will not get freed.
Tested on x86-64 with DIMMs: The usage map will get freed.
Using Dynamic Memory under a Power DLAPR can trigger it easily.
Triggering removal (I assume after previously removed+re-added) of
memory from the HMC GUI can crash the kernel with the same call trace
and is fixed by this patch.
Link: http://lkml.kernel.org/r/20191217104637.5509-1-david@redhat.com
Fixes:
|
||
Vlastimil Babka
|
d30dce3510 |
mm, debug_pagealloc: don't rely on static keys too early
commit 8e57f8acbbd121ecfb0c9dc13b8b030f86c6bd3b upstream. Commit |
||
Adrian Huang
|
904c1db4b3 |
mm: memcg/slab: call flush_memcg_workqueue() only if memcg workqueue is valid
commit 2fe20210fc5f5e62644678b8f927c49f2c6f42a7 upstream.
When booting with amd_iommu=off, the following WARNING message
appears:
AMD-Vi: AMD IOMMU disabled on kernel command-line
------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at kernel/workqueue.c:2772 flush_workqueue+0x42e/0x450
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.5.0-rc3-amd-iommu #6
Hardware name: Lenovo ThinkSystem SR655-2S/7D2WRCZ000, BIOS D8E101L-1.00 12/05/2019
RIP: 0010:flush_workqueue+0x42e/0x450
Code: ff 0f 0b e9 7a fd ff ff 4d 89 ef e9 33 fe ff ff 0f 0b e9 7f fd ff ff 0f 0b e9 bc fd ff ff 0f 0b e9 a8 fd ff ff e8 52 2c fe ff <0f> 0b 31 d2 48 c7 c6 e0 88 c5 95 48 c7 c7 d8 ad f0 95 e8 19 f5 04
Call Trace:
kmem_cache_destroy+0x69/0x260
iommu_go_to_state+0x40c/0x5ab
amd_iommu_prepare+0x16/0x2a
irq_remapping_prepare+0x36/0x5f
enable_IR_x2apic+0x21/0x172
default_setup_apic_routing+0x12/0x6f
apic_intr_mode_init+0x1a1/0x1f1
x86_late_time_init+0x17/0x1c
start_kernel+0x480/0x53f
secondary_startup_64+0xb6/0xc0
---[ end trace 30894107c3749449 ]---
x2apic: IRQ remapping doesn't support X2APIC mode
x2apic disabled
The warning is caused by the calling of 'kmem_cache_destroy()'
in free_iommu_resources(). Here is the call path:
free_iommu_resources
kmem_cache_destroy
flush_memcg_workqueue
flush_workqueue
The root cause is that the IOMMU subsystem runs before the workqueue
subsystem, which the variable 'wq_online' is still 'false'. This leads
to the statement 'if (WARN_ON(!wq_online))' in flush_workqueue() is
'true'.
Since the variable 'memcg_kmem_cache_wq' is not allocated during the
time, it is unnecessary to call flush_memcg_workqueue(). This prevents
the WARNING message triggered by flush_workqueue().
Link: http://lkml.kernel.org/r/20200103085503.1665-1-ahuang12@lenovo.com
Fixes:
|
||
Roman Gushchin
|
090892ba70 |
mm: memcg/slab: fix percpu slab vmstats flushing
commit 4a87e2a25dc27131c3cce5e94421622193305638 upstream.
Currently slab percpu vmstats are flushed twice: during the memcg
offlining and just before freeing the memcg structure. Each time percpu
counters are summed, added to the atomic counterparts and propagated up
by the cgroup tree.
The second flushing is required due to how recursive vmstats are
implemented: counters are batched in percpu variables on a local level,
and once a percpu value is crossing some predefined threshold, it spills
over to atomic values on the local and each ascendant levels. It means
that without flushing some numbers cached in percpu variables will be
dropped on floor each time a cgroup is destroyed. And with uptime the
error on upper levels might become noticeable.
The first flushing aims to make counters on ancestor levels more
precise. Dying cgroups may resume in the dying state for a long time.
After kmem_cache reparenting which is performed during the offlining
slab counters of the dying cgroup don't have any chances to be updated,
because any slab operations will be performed on the parent level. It
means that the inaccuracy caused by percpu batching will not decrease up
to the final destruction of the cgroup. By the original idea flushing
slab counters during the offlining should minimize the visible
inaccuracy of slab counters on the parent level.
The problem is that percpu counters are not zeroed after the first
flushing. So every cached percpu value is summed twice. It creates a
small error (up to 32 pages per cpu, but usually less) which accumulates
on parent cgroup level. After creating and destroying of thousands of
child cgroups, slab counter on parent level can be way off the real
value.
For now, let's just stop flushing slab counters on memcg offlining. It
can't be done correctly without scheduling a work on each cpu: reading
and zeroing it during css offlining can race with an asynchronous
update, which doesn't expect values to be changed underneath.
With this change, slab counters on parent level will become eventually
consistent. Once all dying children are gone, values are correct. And
if not, the error is capped by 32 * NR_CPUS pages per dying cgroup.
It's not perfect, as slab are reparented, so any updates after the
reparenting will happen on the parent level. It means that if a slab
page was allocated, a counter on child level was bumped, then the page
was reparented and freed, the annihilation of positive and negative
counter values will not happen until the child cgroup is released. It
makes slab counters different from others, and it might want us to
implement flushing in a correct form again. But it's also a question of
performance: scheduling a work on each cpu isn't free, and it's an open
question if the benefit of having more accurate counters is worth it.
We might also consider flushing all counters on offlining, not only slab
counters.
So let's fix the main problem now: make the slab counters eventually
consistent, so at least the error won't grow with uptime (or more
precisely the number of created and destroyed cgroups). And think about
the accuracy of counters separately.
Link: http://lkml.kernel.org/r/20191220042728.1045881-1-guro@fb.com
Fixes:
|
||
Kirill A. Shutemov
|
194e7fcd19 |
mm/huge_memory.c: thp: fix conflict of above-47bit hint address and PMD alignment
commit 97d3d0f9a1cf132c63c0b8b8bd497b8a56283dd9 upstream.
Patch series "Fix two above-47bit hint address vs. THP bugs".
The two get_unmapped_area() implementations have to be fixed to provide
THP-friendly mappings if above-47bit hint address is specified.
This patch (of 2):
Filesystems use thp_get_unmapped_area() to provide THP-friendly
mappings. For DAX in particular.
Normally, the kernel doesn't create userspace mappings above 47-bit,
even if the machine allows this (such as with 5-level paging on x86-64).
Not all user space is ready to handle wide addresses. It's known that
at least some JIT compilers use higher bits in pointers to encode their
information.
Userspace can ask for allocation from full address space by specifying
hint address (with or without MAP_FIXED) above 47-bits. If the
application doesn't need a particular address, but wants to allocate
from whole address space it can specify -1 as a hint address.
Unfortunately, this trick breaks thp_get_unmapped_area(): the function
would not try to allocate PMD-aligned area if *any* hint address
specified.
Modify the routine to handle it correctly:
- Try to allocate the space at the specified hint address with length
padding required for PMD alignment.
- If failed, retry without length padding (but with the same hint
address);
- If the returned address matches the hint address return it.
- Otherwise, align the address as required for THP and return.
The user specified hint address is passed down to get_unmapped_area() so
above-47bit hint address will be taken into account without breaking
alignment requirements.
Link: http://lkml.kernel.org/r/20191220142548.7118-2-kirill.shutemov@linux.intel.com
Fixes:
|
||
|
Kirill A. Shutemov
|
5e56519a98 |
mm/shmem.c: thp, shmem: fix conflict of above-47bit hint address and PMD alignment
commit 991589974d9c9ecb24ee3799ec8c415c730598a2 upstream.
Shmem/tmpfs tries to provide THP-friendly mappings if huge pages are
enabled. But it doesn't work well with above-47bit hint address.
Normally, the kernel doesn't create userspace mappings above 47-bit,
even if the machine allows this (such as with 5-level paging on x86-64).
Not all user space is ready to handle wide addresses. It's known that
at least some JIT compilers use higher bits in pointers to encode their
information.
Userspace can ask for allocation from full address space by specifying
hint address (with or without MAP_FIXED) above 47-bits. If the
application doesn't need a particular address, but wants to allocate
from whole address space it can specify -1 as a hint address.
Unfortunately, this trick breaks THP alignment in shmem/tmp:
shmem_get_unmapped_area() would not try to allocate PMD-aligned area if
*any* hint address specified.
This can be fixed by requesting the aligned area if the we failed to
allocated at user-specified hint address. The request with inflated
length will also take the user-specified hint address. This way we will
not lose an allocation request from the full address space.
[kirill@shutemov.name: fold in a fixup]
Link: http://lkml.kernel.org/r/20191223231309.t6bh5hkbmokihpfu@box
Link: http://lkml.kernel.org/r/20191220142548.7118-3-kirill.shutemov@linux.intel.com
Fixes:
|
||
|
Greg Kroah-Hartman
|
b0b02162a4 |
This is the 5.4.13 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl4iAaQACgkQONu9yGCS aT5vIg/+Lj4wdF3UuUWonHdWBhnfG2FKCWFTYJKPpFXFRMltAa27XKns/CvR8CBW 9ztOH928CR8K9BS7HbfGtsgOEOVzILb4+akco5UhrTH93dc2T6RwSDiMpaULgeIF x/n834yNlsHs1NSmjjuimBe1j4NcZwPnnNVGKmFojkv04QPsFjP6HCp7PR2/PMXP CVO5JBXqMYtMRprY0xkpAGCStqVZPF6uwfTPrKRgaOCTpkKsqBEFJbwqOoqGQWou fQPOmEFjw+e9rIKzJgou6k4YGrWITcpNnUMdxavCszcQFTeUnY1vpLTiVxyZC1E3 R+7ulfe+/zoQvWIer9H85ySLuOjSmmXb5CM9Fc0WLSsvKmTKfUNe/g5Cce+rngPY x/+tIBvXgFSoGR4oO5dEHhXn9Hzqr0OHbZy1dLKY1RU4NzxLsAtR2DH4ps25I4ux Ty2P0kYwm5Sz43MspnFAPTaU5kC3qHVNMjanbb5I7xGF2m0HZmh0zRHBC50DqP4Y nmLUklpX4EGVAYGb94YZMa3ugksSvie2SLgk838UQG+lGqaQoxAyAeRmDdyR1zE7 GHlkNxWj8cbkBsPDSYt6Wvrt+7+e8Bbk5Y/fM5+j02h6ehs9wqOaQ985CfvrrYix RyGc7pWt1FPL7Kqv/CtbDieglS/P0BMPPGYX2rfidk6i+0knWaE= =53PP -----END PGP SIGNATURE----- Merge 5.4.13 into android-5.4 Changes in 5.4.13 HID: hidraw, uhid: Always report EPOLLOUT rtc: mt6397: fix alarm register overwrite phy: mapphone-mdm6600: Fix uninitialized status value regression RDMA/bnxt_re: Avoid freeing MR resources if dereg fails RDMA/bnxt_re: Fix Send Work Entry state check while polling completions IB/hfi1: Don't cancel unused work item mtd: rawnand: stm32_fmc2: avoid to lock the CPU bus i2c: bcm2835: Store pointer to bus clock ASoC: SOF: imx8: fix memory allocation failure check on priv->pd_dev ASoC: soc-core: Set dpcm_playback / dpcm_capture ASoC: stm32: spdifrx: fix inconsistent lock state ASoC: stm32: spdifrx: fix race condition in irq handler ASoC: stm32: spdifrx: fix input pin state management pinctrl: lochnagar: select GPIOLIB netfilter: nft_flow_offload: fix underflow in flowtable reference counter ASoC: SOF: imx8: Fix dsp_box offset mtd: onenand: omap2: Pass correct flags for prep_dma_memcpy gpio: zynq: Fix for bug in zynq_gpio_restore_context API pinctrl: meson: Fix wrong shift value when get drive-strength selftests: loopback.sh: skip this test if the driver does not support iommu/vt-d: Unlink device if failed to add to group iommu: Remove device link to group on failure bpf: cgroup: prevent out-of-order release of cgroup bpf fs: move guard_bio_eod() after bio_set_op_attrs scsi: mpt3sas: Fix double free in attach error handling gpio: Fix error message on out-of-range GPIO in lookup table PM / devfreq: tegra: Add COMMON_CLK dependency PCI: amlogic: Fix probed clock names drm/tegra: Fix ordering of cleanup code hsr: add hsr root debugfs directory hsr: rename debugfs file when interface name is changed hsr: reset network header when supervision frame is created s390/qeth: fix qdio teardown after early init error s390/qeth: fix false reporting of VNIC CHAR config failure s390/qeth: Fix vnicc_is_in_use if rx_bcast not set s390/qeth: vnicc Fix init to default s390/qeth: fix initialization on old HW cifs: Adjust indentation in smb2_open_file scsi: smartpqi: Update attribute name to `driver_version` MAINTAINERS: Append missed file to the database ath9k: use iowrite32 over __raw_writel can: j1939: fix address claim code example dt-bindings: reset: Fix brcmstb-reset example reset: brcmstb: Remove resource checks afs: Fix missing cell comparison in afs_test_super() perf vendor events s390: Remove name from L1D_RO_EXCL_WRITES description syscalls/x86: Wire up COMPAT_SYSCALL_DEFINE0 syscalls/x86: Use COMPAT_SYSCALL_DEFINE0 for IA32 (rt_)sigreturn syscalls/x86: Use the correct function type for sys_ni_syscall syscalls/x86: Fix function types in COND_SYSCALL hsr: fix slab-out-of-bounds Read in hsr_debugfs_rename() btrfs: simplify inode locking for RWF_NOWAIT netfilter: nf_tables_offload: release flow_rule on error from commit path netfilter: nft_meta: use 64-bit time arithmetic ASoC: dt-bindings: mt8183: add missing update ASoC: simple_card_utils.h: Add missing include ASoC: fsl_esai: Add spin lock to protect reset, stop and start ASoC: SOF: Intel: Broadwell: clarify mutual exclusion with legacy driver ASoC: core: Fix compile warning with CONFIG_DEBUG_FS=n ASoC: rsnd: fix DALIGN register for SSIU RDMA/hns: Prevent undefined behavior in hns_roce_set_user_sq_size() RDMA/hns: remove a redundant le16_to_cpu RDMA/hns: Modify return value of restrack functions RDMA/counter: Prevent QP counter manual binding in auto mode RDMA/siw: Fix port number endianness in a debug message RDMA/hns: Fix build error again RDMA/hns: Release qp resources when failed to destroy qp xprtrdma: Add unique trace points for posting Local Invalidate WRs xprtrdma: Connection becomes unstable after a reconnect xprtrdma: Fix MR list handling xprtrdma: Close window between waking RPC senders and posting Receives RDMA/hns: Fix to support 64K page for srq RDMA/hns: Bugfix for qpc/cqc timer configuration rdma: Remove nes ABI header RDMA/mlx5: Return proper error value RDMA/srpt: Report the SCSI residual to the initiator uaccess: Add non-pagefault user-space write function bpf: Make use of probe_user_write in probe write helper bpf: skmsg, fix potential psock NULL pointer dereference bpf: Support pre-2.25-binutils objcopy for vmlinux BTF libbpf: Fix Makefile' libbpf symbol mismatch diagnostic afs: Fix use-after-loss-of-ref afs: Fix afs_lookup() to not clobber the version on a new dentry keys: Fix request_key() cache scsi: enclosure: Fix stale device oops with hot replug scsi: sd: Clear sdkp->protection_type if disk is reformatted without PI platform/mellanox: fix potential deadlock in the tmfifo driver platform/x86: asus-wmi: Fix keyboard brightness cannot be set to 0 platform/x86: GPD pocket fan: Use default values when wrong modparams are given asm-generic/nds32: don't redefine cacheflush primitives Documentation/ABI: Fix documentation inconsistency for mlxreg-io sysfs interfaces Documentation/ABI: Add missed attribute for mlxreg-io sysfs interfaces xprtrdma: Fix create_qp crash on device unload xprtrdma: Fix completion wait during device removal xprtrdma: Fix oops in Receive handler after device removal dm: add dm-clone to the documentation index scsi: ufs: Give an unique ID to each ufs-bsg crypto: cavium/nitrox - fix firmware assignment to AE cores crypto: hisilicon - select NEED_SG_DMA_LENGTH in qm Kconfig crypto: arm64/aes-neonbs - add return value of skcipher_walk_done() in __xts_crypt() crypto: virtio - implement missing support for output IVs crypto: algif_skcipher - Use chunksize instead of blocksize crypto: geode-aes - convert to skcipher API and make thread-safe NFSv2: Fix a typo in encode_sattr() nfsd: Fix cld_net->cn_tfm initialization nfsd: v4 support requires CRYPTO_SHA256 NFSv4.x: Handle bad/dead sessions correctly in nfs41_sequence_process() NFSv4.x: Drop the slot if nfs4_delegreturn_prepare waits for layoutreturn iio: imu: st_lsm6dsx: fix gyro gain definitions for LSM9DS1 iio: imu: adis16480: assign bias value only if operation succeeded mei: fix modalias documentation clk: meson: axg-audio: fix regmap last register clk: samsung: exynos5420: Preserve CPU clocks configuration during suspend/resume clk: Fix memory leak in clk_unregister() dmaengine: dw: platform: Mark 'hclk' clock optional clk: imx: pll14xx: Fix quick switch of S/K parameter rsi: fix potential null dereference in rsi_probe() affs: fix a memory leak in affs_remount pinctl: ti: iodelay: fix error checking on pinctrl_count_index_with_args call pinctrl: sh-pfc: Fix PINMUX_IPSR_PHYS() to set GPSR pinctrl: sh-pfc: Do not use platform_get_irq() to count interrupts pinctrl: lewisburg: Update pin list according to v1.1v6 PCI: pciehp: Do not disable interrupt twice on suspend Revert "drm/virtio: switch virtio_gpu_wait_ioctl() to gem helper." drm/amdgpu: cleanup creating BOs at fixed location (v2) drm/amdgpu/discovery: reserve discovery data at the top of VRAM scsi: sd: enable compat ioctls for sed-opal arm64: dts: apq8096-db820c: Increase load on l21 for SDCARD gfs2: add compat_ioctl support af_unix: add compat_ioctl support compat_ioctl: handle SIOCOUTQNSD PCI: aardvark: Use LTSSM state to build link training flag PCI: aardvark: Fix PCI_EXP_RTCTL register configuration PCI: dwc: Fix find_next_bit() usage PCI: Fix missing bridge dma_ranges resource list cleanup PCI/PM: Clear PCIe PME Status even for legacy power management tools: PCI: Fix fd leakage PCI/PTM: Remove spurious "d" from granularity message powerpc/powernv: Disable native PCIe port management MIPS: PCI: remember nasid changed by set interrupt affinity MIPS: Loongson: Fix return value of loongson_hwmon_init MIPS: SGI-IP27: Fix crash, when CPUs are disabled via nr_cpus parameter tty: serial: imx: use the sg count from dma_map_sg tty: serial: pch_uart: correct usage of dma_unmap_sg ARM: 8943/1: Fix topology setup in case of CPU hotplug for CONFIG_SCHED_MC media: ov6650: Fix incorrect use of JPEG colorspace media: ov6650: Fix some format attributes not under control media: ov6650: Fix .get_fmt() V4L2_SUBDEV_FORMAT_TRY support media: ov6650: Fix default format not applied on device probe media: rcar-vin: Fix incorrect return statement in rvin_try_format() media: hantro: h264: Fix the frame_num wraparound case media: v4l: cadence: Fix how unsued lanes are handled in 'csi2rx_start()' media: exynos4-is: Fix recursive locking in isp_video_release() media: coda: fix deadlock between decoder picture run and start command media: cedrus: Use correct H264 8x8 scaling list media: hantro: Do not reorder H264 scaling list media: aspeed-video: Fix memory leaks in aspeed_video_probe media: hantro: Set H264 FIELDPIC_FLAG_E flag correctly iommu/mediatek: Correct the flush_iotlb_all callback iommu/mediatek: Add a new tlb_lock for tlb_flush memory: mtk-smi: Add PM suspend and resume ops Revert "ubifs: Fix memory leak bug in alloc_ubifs_info() error path" ubifs: Fixed missed le64_to_cpu() in journal ubifs: do_kill_orphans: Fix a memory leak bug spi: sprd: Fix the incorrect SPI register mtd: spi-nor: fix silent truncation in spi_nor_read() mtd: spi-nor: fix silent truncation in spi_nor_read_raw() spi: pxa2xx: Set controller->max_transfer_size in dma mode spi: atmel: fix handling of cs_change set on non-last xfer spi: rspi: Use platform_get_irq_byname_optional() for optional irqs spi: lpspi: fix memory leak in fsl_lpspi_probe iwlwifi: mvm: consider ieee80211 station max amsdu value rtlwifi: Remove unnecessary NULL check in rtl_regd_init iwlwifi: mvm: fix support for single antenna diversity sch_cake: Add missing NLA policy entry TCA_CAKE_SPLIT_GSO f2fs: fix potential overflow NFSD fixing possible null pointer derefering in copy offload rtc: msm6242: Fix reading of 10-hour digit rtc: brcmstb-waketimer: add missed clk_disable_unprepare rtc: bd70528: Add MODULE ALIAS to autoload module gpio: mpc8xxx: Add platform device to gpiochip->parent scsi: libcxgbi: fix NULL pointer dereference in cxgbi_device_destroy() scsi: target/iblock: Fix protection error with blocks greater than 512B selftests: firmware: Fix it to do root uid check and skip rseq/selftests: Turn off timeout setting riscv: export flush_icache_all to modules mips: cacheinfo: report shared CPU map mips: Fix gettimeofday() in the vdso library tomoyo: Suppress RCU warning at list_for_each_entry_rcu(). MIPS: Prevent link failure with kcov instrumentation drm/arm/mali: make malidp_mw_connector_helper_funcs static rxrpc: Unlock new call in rxrpc_new_incoming_call() rather than the caller rxrpc: Don't take call->user_mutex in rxrpc_new_incoming_call() rxrpc: Fix missing security check on incoming calls dmaengine: k3dma: Avoid null pointer traversal s390/qeth: lock the card while changing its hsuid ioat: ioat_alloc_ring() failure handling. drm/amdgpu: enable gfxoff for raven1 refresh media: intel-ipu3: Align struct ipu3_uapi_awb_fr_config_s to 32 bytes kbuild/deb-pkg: annotate libelf-dev dependency as :native hexagon: parenthesize registers in asm predicates hexagon: work around compiler crash ocfs2: call journal flush to mark journal as empty after journal recovery when mount Linux 5.4.13 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I90734cd9d80f000e05a8109a529916ae641cdede |
||
Daniel Borkmann
|
e5194ee4bf |
uaccess: Add non-pagefault user-space write function
commit 1d1585ca0f48fe7ed95c3571f3e4a82b2b5045dc upstream.
Commit
|
||
|
Greg Kroah-Hartman
|
813bf83282 |
This is the 5.4.9 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl4W8EgACgkQONu9yGCS aT4szA//fqXI1OQ3xcCt5s9MYZYYa6IpX/VZ0H7lNC/7pkJzccKo+aSer7ppEn4o ND8sHNx/lhfZorhvLdqJK4PLThC+fXmXnLvFOzqvZeUVyesnv9zlhd/5JNu18Fvc RNjcIRIAHFwanZLAw8uft1DIZXcZ8wNkAAugn/WQV3FN/TG+FsrDzWYnmbBhRIQS XC/2jSlFpMTKoExNzEdbduG0XH5plWeE+AdY3a+DQsOBUO2XrAuk5HTEByM1jzPV W7U9vMqvw3OyrERcA0lmjs37Waw1e0qzfUaa8Bman5Uc0StOTq0UwschX21SB5yP MvbAKhqaKtSff7b4lNrDP9Kj1O/lH84WPSn/aao9D083m/ZYdkkd4AWMlS480lL5 oJ28tFbgwLayIqDbwCggHluTsNUdQSTwahVbnp4GMqxfjWrApdLPCqloSb+x9JCF 9pWJf3awI53mA864pH/uOM7pDOz5/c/oJ4QzVmOmR48dsddorY+gPcwk+YpElJcZ +xCBQDN5JkNC7lwqu2lvaoq/5cMC5lO/v6aeTfsYCRVnlNY12TY8z352zzMZfCKG GRkNvDqWZ5ZmQ+LblWRVbgdGxU42wIYXUS1jUdFd+5DRzz17+ZKUy7YbLNmZMcpY UyiM2Ij7X7HsNGrYDKFq0lZPw6k7v3FshvMwQ8C6dNk+l3o9oCA= =M+hs -----END PGP SIGNATURE----- Merge 5.4.9 into android-5.4 Changes in 5.4.9 drm/mcde: dsi: Fix invalid pointer dereference if panel cannot be found nvme_fc: add module to ops template to allow module references nvme-fc: fix double-free scenarios on hw queues drm/amdgpu: add check before enabling/disabling broadcast mode drm/amdgpu: add header line for power profile on Arcturus drm/amdgpu: add cache flush workaround to gfx8 emit_fence drm/amd/display: Map DSC resources 1-to-1 if numbers of OPPs and DSCs are equal drm/amd/display: Fixed kernel panic when booting with DP-to-HDMI dongle drm/amd/display: Change the delay time before enabling FEC drm/amd/display: Reset steer fifo before unblanking the stream drm/amd/display: update dispclk and dppclk vco frequency nvme/pci: Fix write and poll queue types nvme/pci: Fix read queue count iio: st_accel: Fix unused variable warning iio: adc: max9611: Fix too short conversion time delay PM / devfreq: Fix devfreq_notifier_call returning errno PM / devfreq: Set scaling_max_freq to max on OPP notifier error PM / devfreq: Don't fail devfreq_dev_release if not in list afs: Fix afs_find_server lookups for ipv4 peers afs: Fix SELinux setting security label on /afs RDMA/cma: add missed unregister_pernet_subsys in init failure rxe: correctly calculate iCRC for unaligned payloads scsi: lpfc: Fix memory leak on lpfc_bsg_write_ebuf_set func scsi: qla2xxx: Use explicit LOGO in target mode scsi: qla2xxx: Drop superfluous INIT_WORK of del_work scsi: qla2xxx: Don't call qlt_async_event twice scsi: qla2xxx: Fix PLOGI payload and ELS IOCB dump length scsi: qla2xxx: Configure local loop for N2N target scsi: qla2xxx: Send Notify ACK after N2N PLOGI scsi: qla2xxx: Don't defer relogin unconditonally scsi: qla2xxx: Ignore PORT UPDATE after N2N PLOGI scsi: iscsi: qla4xxx: fix double free in probe scsi: libsas: stop discovering if oob mode is disconnected scsi: iscsi: Avoid potential deadlock in iscsi_if_rx func staging/wlan-ng: add CRC32 dependency in Kconfig drm/nouveau: Move the declaration of struct nouveau_conn_atom up a bit drm/nouveau: Fix drm-core using atomic code-paths on pre-nv50 hardware drm/nouveau/kms/nv50-: fix panel scaling usb: gadget: fix wrong endpoint desc net: make socket read/write_iter() honor IOCB_NOWAIT afs: Fix mountpoint parsing afs: Fix creation calls in the dynamic root to fail with EOPNOTSUPP raid5: need to set STRIPE_HANDLE for batch head md: raid1: check rdev before reference in raid1_sync_request func s390/cpum_sf: Adjust sampling interval to avoid hitting sample limits s390/cpum_sf: Avoid SBD overflow condition in irq handler RDMA/counter: Prevent auto-binding a QP which are not tracked with res IB/mlx4: Follow mirror sequence of device add during device removal IB/mlx5: Fix steering rule of drop and count xen-blkback: prevent premature module unload xen/balloon: fix ballooned page accounting without hotplug enabled PM / hibernate: memory_bm_find_bit(): Tighten node optimisation ALSA: hda/realtek - Add Bass Speaker and fixed dac for bass speaker ALSA: hda/realtek - Enable the bass speaker of ASUS UX431FLC PCI: Add a helper to check Power Resource Requirements _PR3 existence ALSA: hda: Allow HDA to be runtime suspended when dGPU is not bound to a driver PCI: Fix missing inline for pci_pr3_present() ALSA: hda - fixup for the bass speaker on Lenovo Carbon X1 7th gen tcp: fix data-race in tcp_recvmsg() shmem: pin the file in shmem_fault() if mmap_sem is dropped taskstats: fix data-race ALSA: hda - Downgrade error message for single-cmd fallback netfilter: nft_tproxy: Fix port selector on Big Endian block: add bio_truncate to fix guard_bio_eod mm: drop mmap_sem before calling balance_dirty_pages() in write fault ALSA: ice1724: Fix sleep-in-atomic in Infrasonic Quartet support code ALSA: usb-audio: fix set_format altsetting sanity check ALSA: usb-audio: set the interface format after resume on Dell WD19 ALSA: hda - Apply sync-write workaround to old Intel platforms, too ALSA: hda/realtek - Add headset Mic no shutup for ALC283 drm/sun4i: hdmi: Remove duplicate cleanup calls drm/amdgpu/smu: add metrics table lock drm/amdgpu/smu: add metrics table lock for arcturus (v2) drm/amdgpu/smu: add metrics table lock for navi (v2) drm/amdgpu/smu: add metrics table lock for vega20 (v2) MIPS: BPF: Disable MIPS32 eBPF JIT MIPS: BPF: eBPF JIT: check for MIPS ISA compliance in Kconfig MIPS: Avoid VDSO ABI breakage due to global register variable media: pulse8-cec: fix lost cec_transmit_attempt_done() call media: cec: CEC 2.0-only bcast messages were ignored media: cec: avoid decrementing transmit_queue_sz if it is 0 media: cec: check 'transmit_in_progress', not 'transmitting' mm/memory_hotplug: shrink zones when offlining memory mm/zsmalloc.c: fix the migrated zspage statistics. memcg: account security cred as well to kmemcg mm: move_pages: return valid node id in status if the page is already on the target node mm/oom: fix pgtables units mismatch in Killed process message ocfs2: fix the crash due to call ocfs2_get_dlm_debug once less pstore/ram: Write new dumps to start of recycled zones pstore/ram: Fix error-path memory leak in persistent_ram_new() callers gcc-plugins: make it possible to disable CONFIG_GCC_PLUGINS again locks: print unsigned ino in /proc/locks selftests/seccomp: Zero out seccomp_notif seccomp: Check that seccomp_notif is zeroed out by the user samples/seccomp: Zero out members based on seccomp_notif_sizes selftests/seccomp: Catch garbage on SECCOMP_IOCTL_NOTIF_RECV dmaengine: Fix access to uninitialized dma_slave_caps dmaengine: dma-jz4780: Also break descriptor chains on JZ4725B Btrfs: fix infinite loop during nocow writeback due to race compat_ioctl: block: handle Persistent Reservations compat_ioctl: block: handle BLKREPORTZONE/BLKRESETZONE compat_ioctl: block: handle BLKGETZONESZ/BLKGETNRZONES bpf: Fix precision tracking for unbounded scalars ata: libahci_platform: Export again ahci_platform_<en/dis>able_phys() ata: ahci_brcm: Fix AHCI resources management ata: ahci_brcm: Add missing clock management during recovery ata: ahci_brcm: BCM7425 AHCI requires AHCI_HFLAG_DELAY_ENGINE libata: Fix retrieving of active qcs gpio: xtensa: fix driver build gpiolib: fix up emulated open drain outputs clocksource: riscv: add notrace to riscv_sched_clock riscv: ftrace: correct the condition logic in function graph tracer rseq/selftests: Fix: Namespace gettid() for compatibility with glibc 2.30 tracing: Fix lock inversion in trace_event_enable_tgid_record() tracing: Avoid memory leak in process_system_preds() tracing: Have the histogram compare functions convert to u64 first tracing: Fix endianness bug in histogram trigger samples/trace_printk: Wait for IRQ work to finish io_uring: use current task creds instead of allocating a new one mm/gup: fix memory leak in __gup_benchmark_ioctl apparmor: fix aa_xattrs_match() may sleep while holding a RCU lock dmaengine: virt-dma: Fix access after free in vchan_complete() gen_initramfs_list.sh: fix 'bad variable name' error ALSA: cs4236: fix error return comparison of an unsigned integer ALSA: pcm: Yet another missing check of non-cached buffer type ALSA: firewire-motu: Correct a typo in the clock proc string scsi: lpfc: Fix rpi release when deleting vport exit: panic before exit_mm() on global init exit arm64: Revert support for execute-only user mappings ftrace: Avoid potential division by zero in function profiler spi: spi-fsl-dspi: Fix 16-bit word order in 32-bit XSPI mode drm/msm: include linux/sched/task.h PM / devfreq: Check NULL governor in available_governors_show sunrpc: fix crash when cache_head become valid before update arm64: dts: qcom: msm8998-clamshell: Remove retention idle state nfsd4: fix up replay_matches_cache() powerpc: Chunk calls to flush_dcache_range in arch_*_memory HID: i2c-hid: Reset ALPS touchpads on resume net/sched: annotate lockless accesses to qdisc->empty kernel/module.c: wakeup processes in module_wq on module unload ACPI: sysfs: Change ACPI_MASKABLE_GPE_MAX to 0x100 perf callchain: Fix segfault in thread__resolve_callchain_sample() iommu/vt-d: Remove incorrect PSI capability check of: overlay: add_changeset_property() memory leak cifs: Fix potential softlockups while refreshing DFS cache firmware: arm_scmi: Avoid double free in error flow xfs: don't check for AG deadlock for realtime files in bunmapi platform/x86: pmc_atom: Add Siemens CONNECT X300 to critclk_systems DMI table netfilter: nf_queue: enqueue skbs with NULL dst net, sysctl: Fix compiler warning when only cBPF is present watchdog: tqmx86_wdt: Fix build error regulator: axp20x: Fix axp20x_set_ramp_delay regulator: bd70528: Remove .set_ramp_delay for bd70528_ldo_ops spi: uniphier: Fix FIFO threshold regulator: axp20x: Fix AXP22x ELDO2 regulator enable bitmask powerpc/mm: Mark get_slice_psize() & slice_addr_is_low() as notrace Bluetooth: btusb: fix PM leak in error case of setup Bluetooth: delete a stray unlock Bluetooth: Fix memory leak in hci_connect_le_scan arm64: dts: meson-gxl-s905x-khadas-vim: fix uart_A bluetooth node arm64: dts: meson-gxm-khadas-vim2: fix uart_A bluetooth node media: flexcop-usb: ensure -EIO is returned on error condition regulator: ab8500: Remove AB8505 USB regulator media: usb: fix memory leak in af9005_identify_state dt-bindings: clock: renesas: rcar-usb2-clock-sel: Fix typo in example arm64: dts: meson: odroid-c2: Disable usb_otg bus to avoid power failed warning phy: renesas: rcar-gen3-usb2: Use platform_get_irq_optional() for optional irq tty: serial: msm_serial: Fix lockup for sysrq and oops cifs: Fix lookup of root ses in DFS referral cache fs: cifs: Fix atime update check vs mtime fix compat handling of FICLONERANGE, FIDEDUPERANGE and FS_IOC_FIEMAP ath9k_htc: Modify byte order for an error message ath9k_htc: Discard undersized packets drm/i915/execlists: Fix annotation for decoupling virtual request xfs: periodically yield scrub threads to the scheduler net: add annotations on hh->hh_len lockless accesses ubifs: ubifs_tnc_start_commit: Fix OOB in layout_in_gaps btrfs: get rid of unique workqueue helper functions Btrfs: only associate the locked page with one async_chunk struct s390/smp: fix physical to logical CPU map for SMT mm/sparse.c: mark populate_section_memmap as __meminit xen/blkback: Avoid unmapping unmapped grant pages lib/ubsan: don't serialize UBSAN report efi: Don't attempt to map RCI2 config table if it doesn't exist perf/x86/intel/bts: Fix the use of page_private() net: annotate lockless accesses to sk->sk_pacing_shift hsr: avoid debugfs warning message when module is remove hsr: fix error handling routine in hsr_dev_finalize() hsr: fix a race condition in node list insertion and deletion mm/hugetlb: defer freeing of huge pages if in non-task context Linux 5.4.9 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I8eebcdac421faf74f70af8e8666abfdcdc45c86b |
||
Waiman Long
|
3a43ea2747 |
mm/hugetlb: defer freeing of huge pages if in non-task context
[ Upstream commit c77c0a8ac4c522638a8242fcb9de9496e3cdbb2d ] The following lockdep splat was observed when a certain hugetlbfs test was run: ================================ WARNING: inconsistent lock state 4.18.0-159.el8.x86_64+debug #1 Tainted: G W --------- - - -------------------------------- inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage. swapper/30/0 [HC0[0]:SC1[1]:HE1:SE0] takes: ffffffff9acdc038 (hugetlb_lock){+.?.}, at: free_huge_page+0x36f/0xaa0 {SOFTIRQ-ON-W} state was registered at: lock_acquire+0x14f/0x3b0 _raw_spin_lock+0x30/0x70 __nr_hugepages_store_common+0x11b/0xb30 hugetlb_sysctl_handler_common+0x209/0x2d0 proc_sys_call_handler+0x37f/0x450 vfs_write+0x157/0x460 ksys_write+0xb8/0x170 do_syscall_64+0xa5/0x4d0 entry_SYSCALL_64_after_hwframe+0x6a/0xdf irq event stamp: 691296 hardirqs last enabled at (691296): [<ffffffff99bb034b>] _raw_spin_unlock_irqrestore+0x4b/0x60 hardirqs last disabled at (691295): [<ffffffff99bb0ad2>] _raw_spin_lock_irqsave+0x22/0x81 softirqs last enabled at (691284): [<ffffffff97ff0c63>] irq_enter+0xc3/0xe0 softirqs last disabled at (691285): [<ffffffff97ff0ebe>] irq_exit+0x23e/0x2b0 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(hugetlb_lock); <Interrupt> lock(hugetlb_lock); *** DEADLOCK *** : Call Trace: <IRQ> __lock_acquire+0x146b/0x48c0 lock_acquire+0x14f/0x3b0 _raw_spin_lock+0x30/0x70 free_huge_page+0x36f/0xaa0 bio_check_pages_dirty+0x2fc/0x5c0 clone_endio+0x17f/0x670 [dm_mod] blk_update_request+0x276/0xe50 scsi_end_request+0x7b/0x6a0 scsi_io_completion+0x1c6/0x1570 blk_done_softirq+0x22e/0x350 __do_softirq+0x23d/0xad8 irq_exit+0x23e/0x2b0 do_IRQ+0x11a/0x200 common_interrupt+0xf/0xf </IRQ> Both the hugetbl_lock and the subpool lock can be acquired in free_huge_page(). One way to solve the problem is to make both locks irq-safe. However, Mike Kravetz had learned that the hugetlb_lock is held for a linear scan of ALL hugetlb pages during a cgroup reparentling operation. So it is just too long to have irq disabled unless we can break hugetbl_lock down into finer-grained locks with shorter lock hold times. Another alternative is to defer the freeing to a workqueue job. This patch implements the deferred freeing by adding a free_hpage_workfn() work function to do the actual freeing. The free_huge_page() call in a non-task context saves the page to be freed in the hpage_freelist linked list in a lockless manner using the llist APIs. The generic workqueue is used to process the work, but a dedicated workqueue can be used instead if it is desirable to have the huge page freed ASAP. Thanks to Kirill Tkhai <ktkhai@virtuozzo.com> for suggesting the use of llist APIs which simplfy the code. Link: http://lkml.kernel.org/r/20191217170331.30893-1-longman@redhat.com Signed-off-by: Waiman Long <longman@redhat.com> Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com> Acked-by: Davidlohr Bueso <dbueso@suse.de> Acked-by: Michal Hocko <mhocko@suse.com> Reviewed-by: Kirill Tkhai <ktkhai@virtuozzo.com> Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com> Cc: Matthew Wilcox <willy@infradead.org> Cc: Andi Kleen <ak@linux.intel.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
Ilya Leoshkevich
|
5e71be1a60 |
mm/sparse.c: mark populate_section_memmap as __meminit
[ Upstream commit 030eab4f9ffb469344c10a46bc02c5149db0a2a9 ] Building the kernel on s390 with -Og produces the following warning: WARNING: vmlinux.o(.text+0x28dabe): Section mismatch in reference from the function populate_section_memmap() to the function .meminit.text:__populate_section_memmap() The function populate_section_memmap() references the function __meminit __populate_section_memmap(). This is often because populate_section_memmap lacks a __meminit annotation or the annotation of __populate_section_memmap is wrong. While -Og is not supported, in theory this might still happen with another compiler or on another architecture. So fix this by using the correct section annotations. [iii@linux.ibm.com: v2] Link: http://lkml.kernel.org/r/20191030151639.41486-1-iii@linux.ibm.com Link: http://lkml.kernel.org/r/20191028165549.14478-1-iii@linux.ibm.com Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com> Acked-by: David Hildenbrand <david@redhat.com> Cc: Heiko Carstens <heiko.carstens@de.ibm.com> Cc: Vasily Gorbik <gor@linux.ibm.com> Cc: Oscar Salvador <OSalvador@suse.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
Catalin Marinas
|
623e5ae074 |
arm64: Revert support for execute-only user mappings
commit 24cecc37746393432d994c0dbc251fb9ac7c5d72 upstream. The ARMv8 64-bit architecture supports execute-only user permissions by clearing the PTE_USER and PTE_UXN bits, practically making it a mostly privileged mapping but from which user running at EL0 can still execute. The downside, however, is that the kernel at EL1 inadvertently reading such mapping would not trip over the PAN (privileged access never) protection. Revert the relevant bits from commit |
||
Navid Emamdoost
|
20170bfa3d |
mm/gup: fix memory leak in __gup_benchmark_ioctl
commit a7c46c0c0e3d62f2764cd08b90934cd2aaaf8545 upstream.
In the implementation of __gup_benchmark_ioctl() the allocated pages
should be released before returning in case of an invalid cmd. Release
pages via kvfree().
[akpm@linux-foundation.org: rework code flow, return -EINVAL rather than -1]
Link: http://lkml.kernel.org/r/20191211174653.4102-1-navid.emamdoost@gmail.com
Fixes:
|
||
Ilya Dryomov
|
7123ee7b3f |
mm/oom: fix pgtables units mismatch in Killed process message
commit 941f762bcb276259a78e7931674668874ccbda59 upstream.
pr_err() expects kB, but mm_pgtables_bytes() returns the number of bytes.
As everything else is printed in kB, I chose to fix the value rather than
the string.
Before:
[ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name
...
[ 1878] 1000 1878 217253 151144 1269760 0 0 python
...
Out of memory: Killed process 1878 (python) total-vm:869012kB, anon-rss:604572kB, file-rss:4kB, shmem-rss:0kB, UID:1000 pgtables:1269760kB oom_score_adj:0
After:
[ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name
...
[ 1436] 1000 1436 217253 151890 1294336 0 0 python
...
Out of memory: Killed process 1436 (python) total-vm:869012kB, anon-rss:607516kB, file-rss:44kB, shmem-rss:0kB, UID:1000 pgtables:1264kB oom_score_adj:0
Link: http://lkml.kernel.org/r/20191211202830.1600-1-idryomov@gmail.com
Fixes:
|
||
|
Yang Shi
|
366b5dce6d |
mm: move_pages: return valid node id in status if the page is already on the target node
commit e0153fc2c7606f101392b682e720a7a456d6c766 upstream.
Felix Abecassis reports move_pages() would return random status if the
pages are already on the target node by the below test program:
int main(void)
{
const long node_id = 1;
const long page_size = sysconf(_SC_PAGESIZE);
const int64_t num_pages = 8;
unsigned long nodemask = 1 << node_id;
long ret = set_mempolicy(MPOL_BIND, &nodemask, sizeof(nodemask));
if (ret < 0)
return (EXIT_FAILURE);
void **pages = malloc(sizeof(void*) * num_pages);
for (int i = 0; i < num_pages; ++i) {
pages[i] = mmap(NULL, page_size, PROT_WRITE | PROT_READ,
MAP_PRIVATE | MAP_POPULATE | MAP_ANONYMOUS,
-1, 0);
if (pages[i] == MAP_FAILED)
return (EXIT_FAILURE);
}
ret = set_mempolicy(MPOL_DEFAULT, NULL, 0);
if (ret < 0)
return (EXIT_FAILURE);
int *nodes = malloc(sizeof(int) * num_pages);
int *status = malloc(sizeof(int) * num_pages);
for (int i = 0; i < num_pages; ++i) {
nodes[i] = node_id;
status[i] = 0xd0; /* simulate garbage values */
}
ret = move_pages(0, num_pages, pages, nodes, status, MPOL_MF_MOVE);
printf("move_pages: %ld\n", ret);
for (int i = 0; i < num_pages; ++i)
printf("status[%d] = %d\n", i, status[i]);
}
Then running the program would return nonsense status values:
$ ./move_pages_bug
move_pages: 0
status[0] = 208
status[1] = 208
status[2] = 208
status[3] = 208
status[4] = 208
status[5] = 208
status[6] = 208
status[7] = 208
This is because the status is not set if the page is already on the
target node, but move_pages() should return valid status as long as it
succeeds. The valid status may be errno or node id.
We can't simply initialize status array to zero since the pages may be
not on node 0. Fix it by updating status with node id which the page is
already on.
Link: http://lkml.kernel.org/r/1575584353-125392-1-git-send-email-yang.shi@linux.alibaba.com
Fixes:
|
||
Chanho Min
|
cdc57bac99 |
mm/zsmalloc.c: fix the migrated zspage statistics.
commit ac8f05da5174c560de122c499ce5dfb5d0dfbee5 upstream.
When zspage is migrated to the other zone, the zone page state should be
updated as well, otherwise the NR_ZSPAGE for each zone shows wrong
counts including proc/zoneinfo in practice.
Link: http://lkml.kernel.org/r/1575434841-48009-1-git-send-email-chanho.min@lge.com
Fixes:
|
||
|
David Hildenbrand
|
e84c5b7617 |
mm/memory_hotplug: shrink zones when offlining memory
commit feee6b2989165631b17ac6d4ccdbf6759254e85a upstream.
We currently try to shrink a single zone when removing memory. We use
the zone of the first page of the memory we are removing. If that
memmap was never initialized (e.g., memory was never onlined), we will
read garbage and can trigger kernel BUGs (due to a stale pointer):
BUG: unable to handle page fault for address: 000000000000353d
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 0 P4D 0
Oops: 0002 [#1] SMP PTI
CPU: 1 PID: 7 Comm: kworker/u8:0 Not tainted 5.3.0-rc5-next-20190820+ #317
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.4
Workqueue: kacpi_hotplug acpi_hotplug_work_fn
RIP: 0010:clear_zone_contiguous+0x5/0x10
Code: 48 89 c6 48 89 c3 e8 2a fe ff ff 48 85 c0 75 cf 5b 5d c3 c6 85 fd 05 00 00 01 5b 5d c3 0f 1f 840
RSP: 0018:ffffad2400043c98 EFLAGS: 00010246
RAX: 0000000000000000 RBX: 0000000200000000 RCX: 0000000000000000
RDX: 0000000000200000 RSI: 0000000000140000 RDI: 0000000000002f40
RBP: 0000000140000000 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000140000
R13: 0000000000140000 R14: 0000000000002f40 R15: ffff9e3e7aff3680
FS: 0000000000000000(0000) GS:ffff9e3e7bb00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000000353d CR3: 0000000058610000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__remove_pages+0x4b/0x640
arch_remove_memory+0x63/0x8d
try_remove_memory+0xdb/0x130
__remove_memory+0xa/0x11
acpi_memory_device_remove+0x70/0x100
acpi_bus_trim+0x55/0x90
acpi_device_hotplug+0x227/0x3a0
acpi_hotplug_work_fn+0x1a/0x30
process_one_work+0x221/0x550
worker_thread+0x50/0x3b0
kthread+0x105/0x140
ret_from_fork+0x3a/0x50
Modules linked in:
CR2: 000000000000353d
Instead, shrink the zones when offlining memory or when onlining failed.
Introduce and use remove_pfn_range_from_zone(() for that. We now
properly shrink the zones, even if we have DIMMs whereby
- Some memory blocks fall into no zone (never onlined)
- Some memory blocks fall into multiple zones (offlined+re-onlined)
- Multiple memory blocks that fall into different zones
Drop the zone parameter (with a potential dubious value) from
__remove_pages() and __remove_section().
Link: http://lkml.kernel.org/r/20191006085646.5768-6-david@redhat.com
Fixes:
|
||
Johannes Weiner
|
173fa52f7f |
mm: drop mmap_sem before calling balance_dirty_pages() in write fault
[ Upstream commit 89b15332af7c0312a41e50846819ca6613b58b4c ]
One of our services is observing hanging ps/top/etc under heavy write
IO, and the task states show this is an mmap_sem priority inversion:
A write fault is holding the mmap_sem in read-mode and waiting for
(heavily cgroup-limited) IO in balance_dirty_pages():
balance_dirty_pages+0x724/0x905
balance_dirty_pages_ratelimited+0x254/0x390
fault_dirty_shared_page.isra.96+0x4a/0x90
do_wp_page+0x33e/0x400
__handle_mm_fault+0x6f0/0xfa0
handle_mm_fault+0xe4/0x200
__do_page_fault+0x22b/0x4a0
page_fault+0x45/0x50
Somebody tries to change the address space, contending for the mmap_sem in
write-mode:
call_rwsem_down_write_failed_killable+0x13/0x20
do_mprotect_pkey+0xa8/0x330
SyS_mprotect+0xf/0x20
do_syscall_64+0x5b/0x100
entry_SYSCALL_64_after_hwframe+0x3d/0xa2
The waiting writer locks out all subsequent readers to avoid lock
starvation, and several threads can be seen hanging like this:
call_rwsem_down_read_failed+0x14/0x30
proc_pid_cmdline_read+0xa0/0x480
__vfs_read+0x23/0x140
vfs_read+0x87/0x130
SyS_read+0x42/0x90
do_syscall_64+0x5b/0x100
entry_SYSCALL_64_after_hwframe+0x3d/0xa2
To fix this, do what we do for cache read faults already: drop the
mmap_sem before calling into anything IO bound, in this case the
balance_dirty_pages() function, and return VM_FAULT_RETRY.
Link: http://lkml.kernel.org/r/20190924194238.GA29030@cmpxchg.org
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Cc: Josef Bacik <josef@toxicpanda.com>
Cc: Hillf Danton <hdanton@sina.com>
Cc: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
|
||
Kirill A. Shutemov
|
d7af03159b |
shmem: pin the file in shmem_fault() if mmap_sem is dropped
[ Upstream commit 8897c1b1a1795cab23d5ac13e4e23bf0b5f4e0c6 ] syzbot found the following crash: BUG: KASAN: use-after-free in perf_trace_lock_acquire+0x401/0x530 include/trace/events/lock.h:13 Read of size 8 at addr ffff8880a5cf2c50 by task syz-executor.0/26173 CPU: 0 PID: 26173 Comm: syz-executor.0 Not tainted 5.3.0-rc6 #146 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: perf_trace_lock_acquire+0x401/0x530 include/trace/events/lock.h:13 trace_lock_acquire include/trace/events/lock.h:13 [inline] lock_acquire+0x2de/0x410 kernel/locking/lockdep.c:4411 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:151 spin_lock include/linux/spinlock.h:338 [inline] shmem_fault+0x5ec/0x7b0 mm/shmem.c:2034 __do_fault+0x111/0x540 mm/memory.c:3083 do_shared_fault mm/memory.c:3535 [inline] do_fault mm/memory.c:3613 [inline] handle_pte_fault mm/memory.c:3840 [inline] __handle_mm_fault+0x2adf/0x3f20 mm/memory.c:3964 handle_mm_fault+0x1b5/0x6b0 mm/memory.c:4001 do_user_addr_fault arch/x86/mm/fault.c:1441 [inline] __do_page_fault+0x536/0xdd0 arch/x86/mm/fault.c:1506 do_page_fault+0x38/0x590 arch/x86/mm/fault.c:1530 page_fault+0x39/0x40 arch/x86/entry/entry_64.S:1202 It happens if the VMA got unmapped under us while we dropped mmap_sem and inode got freed. Pinning the file if we drop mmap_sem fixes the issue. Link: http://lkml.kernel.org/r/20190927083908.rhifa4mmaxefc24r@box Signed-off-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com> Reported-by: syzbot+03ee87124ee05af991bd@syzkaller.appspotmail.com Acked-by: Johannes Weiner <hannes@cmpxchg.org> Reviewed-by: Matthew Wilcox (Oracle) <willy@infradead.org> Cc: Hillf Danton <hdanton@sina.com> Cc: Hugh Dickins <hughd@google.com> Cc: Josef Bacik <josef@toxicpanda.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Sasha Levin <sashal@kernel.org> |
||
|
Greg Kroah-Hartman
|
861433ef01 |
This is the 5.4.7 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl4LbVwACgkQONu9yGCS aT6zdhAAkTwLWNfzyk1cSPKzWdguZWoqAuddmIeCUaDmyPwI6TE5a2J8IfZ7upYU 4U2J4nO4I9WxVuTUgJpE0wnDidkvL6U7YfbMbqjVkxAfbFboxN8dJYDNTISehK2A WgpIpJadhj1M8Akxq0MLxuCMg11UJU2PP5Tc7K5aKgiVVneDodupjY8Ddksuw8SZ 5Mus33uOjpCvtxt3GZIRgAdduhL3s3h2Vp+dyAzV2eBvSGwd9Rz4/p0OGZytH780 oywFYzIU7CxtI7pxIQKBxegb4incjWnlRpP3Dk80CNXHzcuU6WGXARoHjgXmWYcu b9hX+/fM76qxbxojM1vI9QVuwy5uB++4NMVsX3e0xFxdvkTo2+Y/vbO3sBMmAy5i L0S0sftTuE6bg1XCWoeFbLUaXIWF7g0Xbc91VP7Wv5VolpIrwZsVHJNT4Nf8KHM4 DuRLmrANhU7ax2E26Bbt17/otCFvjyeQj5fggw/1rkEN8fJSY1YU/SWOxizDY6GZ S3ovivhqhLIaDPzW+qmphYRGnBDkTq7HxHal8eJoy/cgvFxBOYAbfXiHuPuNP4Kj zbIThujSlbI0gNGymoHH8EoVOJeNcK8L2PsilIZdlPDWi45v5tqYIgiYIA7mqqu+ 6O2plNGWbYK2+ARPkCJ08XTdDFSm+B6Cm0+KFvsdjuQ6xNkhMwc= =HvEl -----END PGP SIGNATURE----- Merge 5.4.7 into android-5.4 Changes in 5.4.7 af_packet: set defaule value for tmo fjes: fix missed check in fjes_acpi_add mod_devicetable: fix PHY module format net: dst: Force 4-byte alignment of dst_metrics net: gemini: Fix memory leak in gmac_setup_txqs net: hisilicon: Fix a BUG trigered by wrong bytes_compl net: nfc: nci: fix a possible sleep-in-atomic-context bug in nci_uart_tty_receive() net: phy: ensure that phy IDs are correctly typed net: qlogic: Fix error paths in ql_alloc_large_buffers() net-sysfs: Call dev_hold always in rx_queue_add_kobject net: usb: lan78xx: Fix suspend/resume PHY register access error nfp: flower: fix stats id allocation qede: Disable hardware gro when xdp prog is installed qede: Fix multicast mac configuration sctp: fix memleak on err handling of stream initialization sctp: fully initialize v4 addr in some functions selftests: forwarding: Delete IPv6 address at the end neighbour: remove neigh_cleanup() method bonding: fix bond_neigh_init() net: ena: fix default tx interrupt moderation interval net: ena: fix issues in setting interrupt moderation params in ethtool dpaa2-ptp: fix double free of the ptp_qoriq IRQ mlxsw: spectrum_router: Remove unlikely user-triggerable warning net: ethernet: ti: davinci_cpdma: fix warning "device driver frees DMA memory with different size" net: stmmac: platform: Fix MDIO init for platforms without PHY net: dsa: b53: Fix egress flooding settings NFC: nxp-nci: Fix probing without ACPI btrfs: don't double lock the subvol_sem for rename exchange btrfs: do not call synchronize_srcu() in inode_tree_del Btrfs: make tree checker detect checksum items with overlapping ranges btrfs: return error pointer from alloc_test_extent_buffer Btrfs: fix missing data checksums after replaying a log tree btrfs: send: remove WARN_ON for readonly mount btrfs: abort transaction after failed inode updates in create_subvol btrfs: skip log replay on orphaned roots btrfs: do not leak reloc root if we fail to read the fs root btrfs: handle ENOENT in btrfs_uuid_tree_iterate Btrfs: fix removal logic of the tree mod log that leads to use-after-free issues ALSA: pcm: Avoid possible info leaks from PCM stream buffers ALSA: hda/ca0132 - Keep power on during processing DSP response ALSA: hda/ca0132 - Avoid endless loop ALSA: hda/ca0132 - Fix work handling in delayed HP detection drm/vc4/vc4_hdmi: fill in connector info drm/virtio: switch virtio_gpu_wait_ioctl() to gem helper. drm: mst: Fix query_payload ack reply struct drm/mipi-dbi: fix a loop in debugfs code drm/panel: Add missing drm_panel_init() in panel drivers drm: exynos: exynos_hdmi: use cec_notifier_conn_(un)register drm: Use EOPNOTSUPP, not ENOTSUPP drm/amd/display: verify stream link before link test drm/bridge: analogix-anx78xx: silence -EPROBE_DEFER warnings drm/amd/display: OTC underflow fix iio: max31856: add missing of_node and parent references to iio_dev iio: light: bh1750: Resolve compiler warning and make code more readable drm/amdgpu/sriov: add ring_stop before ring_create in psp v11 code drm/amdgpu: grab the id mgr lock while accessing passid_mapping drm/ttm: return -EBUSY on pipelining with no_gpu_wait (v2) drm/amd/display: Rebuild mapped resources after pipe split ath10k: add cleanup in ath10k_sta_state() drm/amd/display: Handle virtual signal type in disable_link() ath10k: Check if station exists before forwarding tx airtime report spi: Add call to spi_slave_abort() function when spidev driver is released drm/meson: vclk: use the correct G12A frac max value staging: rtl8192u: fix multiple memory leaks on error path staging: rtl8188eu: fix possible null dereference rtlwifi: prevent memory leak in rtl_usb_probe libertas: fix a potential NULL pointer dereference Revert "pinctrl: sh-pfc: r8a77990: Fix MOD_SEL1 bit30 when using SSI_SCK2 and SSI_WS2" Revert "pinctrl: sh-pfc: r8a77990: Fix MOD_SEL1 bit31 when using SIM0_D" ath10k: fix backtrace on coredump IB/iser: bound protection_sg size by data_sg size drm/komeda: Workaround for broken FLIP_COMPLETE timestamps spi: gpio: prevent memory leak in spi_gpio_probe media: am437x-vpfe: Setting STD to current value is not an error media: cedrus: fill in bus_info for media device media: seco-cec: Add a missing 'release_region()' in an error handling path media: vim2m: Fix abort issue media: vim2m: Fix BUG_ON in vim2m_device_release() media: max2175: Fix build error without CONFIG_REGMAP_I2C media: ov6650: Fix control handler not freed on init error media: i2c: ov2659: fix s_stream return value media: ov6650: Fix crop rectangle alignment not passed back media: i2c: ov2659: Fix missing 720p register config media: ov6650: Fix stored frame format not in sync with hardware media: ov6650: Fix stored crop rectangle not in sync with hardware tools/power/cpupower: Fix initializer override in hsw_ext_cstates media: venus: core: Fix msm8996 frequency table ath10k: fix offchannel tx failure when no ath10k_mac_tx_frm_has_freq media: vimc: Fix gpf in rmmod path when stream is active drm/amd/display: Set number of pipes to 1 if the second pipe was disabled pinctrl: devicetree: Avoid taking direct reference to device name string drm/sun4i: dsi: Fix TCON DRQ set bits drm/amdkfd: fix a potential NULL pointer dereference (v2) x86/math-emu: Check __copy_from_user() result drm/amd/powerplay: A workaround to GPU RESET on APU selftests/bpf: Correct path to include msg + path drm/amd/display: set minimum abm backlight level media: venus: Fix occasionally failures to suspend rtw88: fix NSS of hw_cap drm/amd/display: fix struct init in update_bounding_box usb: renesas_usbhs: add suspend event support in gadget mode crypto: aegis128-neon - use Clang compatible cflags for ARM hwrng: omap3-rom - Call clk_disable_unprepare() on exit only if not idled regulator: max8907: Fix the usage of uninitialized variable in max8907_regulator_probe() tools/memory-model: Fix data race detection for unordered store and load media: flexcop-usb: fix NULL-ptr deref in flexcop_usb_transfer_init() media: cec-funcs.h: add status_req checks media: meson/ao-cec: move cec_notifier_cec_adap_register after hw setup drm/bridge: dw-hdmi: Refuse DDC/CI transfers on the internal I2C controller samples: pktgen: fix proc_cmd command result check logic block: Fix writeback throttling W=1 compiler warnings drm/amdkfd: Fix MQD size calculation MIPS: futex: Emit Loongson3 sync workarounds within asm mwifiex: pcie: Fix memory leak in mwifiex_pcie_init_evt_ring drm/drm_vblank: Change EINVAL by the correct errno selftests/bpf: Fix btf_dump padding test case libbpf: Fix struct end padding in btf_dump libbpf: Fix passing uninitialized bytes to setsockopt net/smc: increase device refcount for added link group team: call RCU read lock when walking the port_list media: cx88: Fix some error handling path in 'cx8800_initdev()' crypto: inside-secure - Fix a maybe-uninitialized warning crypto: aegis128/simd - build 32-bit ARM for v8 architecture explicitly misc: fastrpc: fix memory leak from miscdev->name ASoC: SOF: enable sync_write in hdac_bus media: ti-vpe: vpe: Fix Motion Vector vpdma stride media: ti-vpe: vpe: fix a v4l2-compliance warning about invalid pixel format media: ti-vpe: vpe: fix a v4l2-compliance failure about frame sequence number media: ti-vpe: vpe: Make sure YUYV is set as default format media: ti-vpe: vpe: fix a v4l2-compliance failure causing a kernel panic media: ti-vpe: vpe: ensure buffers are cleaned up properly in abort cases drm/amd/display: Properly round nominal frequency for SPD drm/amd/display: wait for set pipe mcp command completion media: ti-vpe: vpe: fix a v4l2-compliance failure about invalid sizeimage drm/amd/display: add new active dongle to existent w/a syscalls/x86: Use the correct function type in SYSCALL_DEFINE0 drm/amd/display: Fix dongle_caps containing stale information. extcon: sm5502: Reset registers during initialization drm/amd/display: Program DWB watermarks from correct state x86/mm: Use the correct function type for native_set_fixmap() ath10k: Correct error handling of dma_map_single() rtw88: coex: Set 4 slot mode for A2DP drm/bridge: dw-hdmi: Restore audio when setting a mode perf test: Report failure for mmap events perf report: Add warning when libunwind not compiled in perf test: Avoid infinite loop for task exit case perf vendor events arm64: Fix Hisi hip08 DDRC PMU eventname usb: usbfs: Suppress problematic bind and unbind uevents. drm/amd/powerplay: avoid disabling ECC if RAS is enabled for VEGA20 iio: adc: max1027: Reset the device at probe time Bluetooth: btusb: avoid unused function warning Bluetooth: missed cpu_to_le16 conversion in hci_init4_req Bluetooth: Workaround directed advertising bug in Broadcom controllers Bluetooth: hci_core: fix init for HCI_USER_CHANNEL bpf/stackmap: Fix deadlock with rq_lock in bpf_get_stack() x86/mce: Lower throttling MCE messages' priority to warning drm/amd/display: enable hostvm based on roimmu active for dcn2.1 drm/amd/display: fix header for RN clk mgr drm/amdgpu: fix amdgpu trace event print string format error staging: iio: ad9834: add a check for devm_clk_get power: supply: cpcap-battery: Check voltage before orderly_poweroff perf tests: Disable bp_signal testing for arm64 selftests/bpf: Make a copy of subtest name net: hns3: log and clear hardware error after reset complete RDMA/hns: Fix wrong parameters when initial mtt of srq->idx_que drm/gma500: fix memory disclosures due to uninitialized bytes ASoC: soc-pcm: fixup dpcm_prune_paths() loop continue rtl8xxxu: fix RTL8723BU connection failure issue after warm reboot RDMA/siw: Fix SQ/RQ drain logic ipmi: Don't allow device module unload when in use x86/ioapic: Prevent inconsistent state when moving an interrupt media: cedrus: Fix undefined shift with a SHIFT_AND_MASK_BITS macro media: aspeed: set hsync and vsync polarities to normal before starting mode detection drm/nouveau: Don't grab runtime PM refs for HPD IRQs media: ov6650: Fix stored frame interval not in sync with hardware media: ad5820: Define entity function media: ov5640: Make 2592x1944 mode only available at 15 fps media: st-mipid02: add a check for devm_gpiod_get_optional media: imx7-mipi-csis: Add a check for devm_regulator_get media: aspeed: clear garbage interrupts media: smiapp: Register sensor after enabling runtime PM on the device md: no longer compare spare disk superblock events in super_load staging: wilc1000: potential corruption in wilc_parse_join_bss_param() md/bitmap: avoid race window between md_bitmap_resize and bitmap_file_clear_bit drm: Don't free jobs in wait_event_interruptible() EDAC/amd64: Set grain per DIMM arm64: psci: Reduce the waiting time for cpu_psci_cpu_kill() drm/amd/display: setting the DIG_MODE to the correct value. i40e: initialize ITRN registers with correct values drm/amd/display: correctly populate dpp refclk in fpga i40e: Wrong 'Advertised FEC modes' after set FEC to AUTO net: phy: dp83867: enable robust auto-mdix drm/tegra: sor: Use correct SOR index on Tegra210 regulator: core: Release coupled_rdevs on regulator_init_coupling() error ubsan, x86: Annotate and allow __ubsan_handle_shift_out_of_bounds() in uaccess regions spi: sprd: adi: Add missing lock protection when rebooting ACPI: button: Add DMI quirk for Medion Akoya E2215T RDMA/qedr: Fix memory leak in user qp and mr RDMA/hns: Fix memory leak on 'context' on error return path RDMA/qedr: Fix srqs xarray initialization RDMA/core: Set DMA parameters correctly staging: wilc1000: check if device is initialzied before changing vif gpu: host1x: Allocate gather copy for host1x net: dsa: LAN9303: select REGMAP when LAN9303 enable phy: renesas: phy-rcar-gen2: Fix the array off by one warning phy: qcom-usb-hs: Fix extcon double register after power cycle s390/time: ensure get_clock_monotonic() returns monotonic values s390: add error handling to perf_callchain_kernel s390/mm: add mm_pxd_folded() checks to pxd_free() net: hns3: add struct netdev_queue debug info for TX timeout libata: Ensure ata_port probe has completed before detach loop: fix no-unmap write-zeroes request behavior net/mlx5e: Verify that rule has at least one fwd/drop action pinctrl: sh-pfc: sh7734: Fix duplicate TCLK1_B ALSA: bebob: expand sleep just after breaking connections for protocol version 1 iio: dln2-adc: fix iio_triggered_buffer_postenable() position libbpf: Fix error handling in bpf_map__reuse_fd() Bluetooth: Fix advertising duplicated flags ALSA: pcm: Fix missing check of the new non-cached buffer type spi: sifive: disable clk when probe fails and remove ASoC: SOF: imx: fix reverse CONFIG_SND_SOC_SOF_OF dependency pinctrl: qcom: sc7180: Add missing tile info in SDC_QDSD_PINGROUP/UFS_RESET pinctrl: amd: fix __iomem annotation in amd_gpio_irq_handler() ixgbe: protect TX timestamping from API misuse cpufreq: sun50i: Fix CPU speed bin detection media: rcar_drif: fix a memory disclosure media: v4l2-core: fix touch support in v4l_g_fmt nvme: introduce "Command Aborted By host" status code media: staging/imx: Use a shorter name for driver nvmem: imx-ocotp: reset error status on probe nvmem: core: fix nvmem_cell_write inline function ASoC: SOF: topology: set trigger order for FE DAI link media: vivid: media_device_cleanup was called too early spi: dw: Fix Designware SPI loopback bnx2x: Fix PF-VF communication over multi-cos queues. spi: img-spfi: fix potential double release ALSA: timer: Limit max amount of slave instances RDMA/core: Fix return code when modify_port isn't supported drm: msm: a6xx: fix debug bus register configuration rtlwifi: fix memory leak in rtl92c_set_fw_rsvdpagepkt() perf probe: Fix to find range-only function instance perf cs-etm: Fix definition of macro TO_CS_QUEUE_NR perf probe: Fix to list probe event with correct line number perf jevents: Fix resource leak in process_mapfile() and main() perf probe: Walk function lines in lexical blocks perf probe: Fix to probe an inline function which has no entry pc perf probe: Fix to show ranges of variables in functions without entry_pc perf probe: Fix to show inlined function callsite without entry_pc libsubcmd: Use -O0 with DEBUG=1 perf probe: Fix to probe a function which has no entry pc perf tools: Fix cross compile for ARM64 perf tools: Splice events onto evlist even on error drm/amdgpu: disallow direct upload save restore list from gfx driver drm/amd/powerplay: fix struct init in renoir_print_clk_levels drm/amdgpu: fix potential double drop fence reference ice: Check for null pointer dereference when setting rings xen/gntdev: Use select for DMA_SHARED_BUFFER perf parse: If pmu configuration fails free terms perf probe: Skip overlapped location on searching variables net: avoid potential false sharing in neighbor related code perf probe: Return a better scope DIE if there is no best scope perf probe: Fix to show calling lines of inlined functions perf probe: Skip end-of-sequence and non statement lines perf probe: Filter out instances except for inlined subroutine and subprogram libbpf: Fix negative FD close() in xsk_setup_xdp_prog() s390/bpf: Use kvcalloc for addrs array cgroup: freezer: don't change task and cgroups status unnecessarily selftests: proc: Make va_max 1MB drm/amdgpu: Avoid accidental thread reactivation. media: exynos4-is: fix wrong mdev and v4l2 dev order in error path ath10k: fix get invalid tx rate for Mesh metric fsi: core: Fix small accesses and unaligned offsets via sysfs selftests: net: Fix printf format warnings on arm media: pvrusb2: Fix oops on tear-down when radio support is not present soundwire: intel: fix PDI/stream mapping for Bulk crypto: atmel - Fix authenc support when it is set to m ice: delay less media: si470x-i2c: add missed operations in remove media: cedrus: Use helpers to access capture queue media: v4l2-ctrl: Lock main_hdl on operations of requests_queued. iio: cros_ec_baro: set info_mask_shared_by_all_available field EDAC/ghes: Fix grain calculation media: vicodec: media_device_cleanup was called too early media: vim2m: media_device_cleanup was called too early spi: pxa2xx: Add missed security checks ASoC: rt5677: Mark reg RT5677_PWR_ANLG2 as volatile iio: dac: ad5446: Add support for new AD5600 DAC bpf, testing: Workaround a verifier failure for test_progs ASoC: Intel: kbl_rt5663_rt5514_max98927: Add dmic format constraint net: dsa: sja1105: Disallow management xmit during switch reset r8169: respect EEE user setting when restarting network s390/disassembler: don't hide instruction addresses net: ethernet: ti: Add dependency for TI_DAVINCI_EMAC nvme: Discard workaround for non-conformant devices parport: load lowlevel driver if ports not found bcache: fix static checker warning in bcache_device_free() cpufreq: Register drivers only after CPU devices have been registered qtnfmac: fix debugfs support for multiple cards qtnfmac: fix invalid channel information output x86/crash: Add a forward declaration of struct kimage qtnfmac: fix using skb after free RDMA/efa: Clear the admin command buffer prior to its submission tracing: use kvcalloc for tgid_map array allocation MIPS: ralink: enable PCI support only if driver for mt7621 SoC is selected tracing/kprobe: Check whether the non-suffixed symbol is notrace bcache: fix deadlock in bcache_allocator iwlwifi: mvm: fix unaligned read of rx_pkt_status ASoC: wm8904: fix regcache handling regulator: core: Let boot-on regulators be powered off spi: tegra20-slink: add missed clk_unprepare tun: fix data-race in gro_normal_list() xhci-pci: Allow host runtime PM as default also for Intel Ice Lake xHCI crypto: virtio - deal with unsupported input sizes mmc: tmio: Add MMC_CAP_ERASE to allow erase/discard/trim requests btrfs: don't prematurely free work in end_workqueue_fn() btrfs: don't prematurely free work in run_ordered_work() sched/uclamp: Fix overzealous type replacement ASoC: wm2200: add missed operations in remove and probe failure spi: st-ssc4: add missed pm_runtime_disable ASoC: wm5100: add missed pm_runtime_disable perf/core: Fix the mlock accounting, again selftests, bpf: Fix test_tc_tunnel hanging selftests, bpf: Workaround an alu32 sub-register spilling issue bnxt_en: Return proper error code for non-existent NVM variable net: phy: avoid matching all-ones clause 45 PHY IDs firmware_loader: Fix labels with comma for builtin firmware ASoC: Intel: bytcr_rt5640: Update quirk for Acer Switch 10 SW5-012 2-in-1 x86/insn: Add some Intel instructions to the opcode map net-af_xdp: Use correct number of channels from ethtool brcmfmac: remove monitor interface when detaching perf session: Fix decompression of PERF_RECORD_COMPRESSED records perf probe: Fix to show function entry line as probe-able s390/crypto: Fix unsigned variable compared with zero s390/kasan: support memcpy_real with TRACE_IRQFLAGS bnxt_en: Improve RX buffer error handling. iwlwifi: check kasprintf() return value fbtft: Make sure string is NULL terminated ASoC: soc-pcm: check symmetry before hw_params net: ethernet: ti: ale: clean ale tbl on init and intf restart mt76: fix possible out-of-bound access in mt7615_fill_txs/mt7603_fill_txs s390/cpumf: Adjust registration of s390 PMU device drivers crypto: sun4i-ss - Fix 64-bit size_t warnings crypto: sun4i-ss - Fix 64-bit size_t warnings on sun4i-ss-hash.c mac80211: consider QoS Null frames for STA_NULLFUNC_ACKED crypto: vmx - Avoid weird build failures libtraceevent: Fix memory leakage in copy_filter_type mips: fix build when "48 bits virtual memory" is enabled drm/amdgpu: fix bad DMA from INTERRUPT_CNTL2 ice: Only disable VF state when freeing each VF resources ice: Fix setting coalesce to handle DCB configuration net: phy: initialise phydev speed and duplex sanely tools, bpf: Fix build for 'make -s tools/bpf O=<dir>' RDMA/bnxt_re: Fix missing le16_to_cpu RDMA/bnxt_re: Fix stat push into dma buffer on gen p5 devices bpf: Provide better register bounds after jmp32 instructions RDMA/bnxt_re: Fix chip number validation Broadcom's Gen P5 series ibmvnic: Fix completion structure initialization net: wireless: intel: iwlwifi: fix GRO_NORMAL packet stalling MIPS: futex: Restore \n after sync instructions btrfs: don't prematurely free work in reada_start_machine_worker() btrfs: don't prematurely free work in scrub_missing_raid56_worker() Revert "mmc: sdhci: Fix incorrect switch to HS mode" mmc: mediatek: fix CMD_TA to 2 for MT8173 HS200/HS400 mode tpm_tis: reserve chip for duration of tpm_tis_core_init tpm: fix invalid locking in NONBLOCKING mode iommu: fix KASAN use-after-free in iommu_insert_resv_region iommu: set group default domain before creating direct mappings iommu/vt-d: Fix dmar pte read access not set error iommu/vt-d: Set ISA bridge reserved region as relaxable iommu/vt-d: Allocate reserved region for ISA with correct permission can: xilinx_can: Fix missing Rx can packets on CANFD2.0 can: m_can: tcan4x5x: add required delay after reset can: j1939: j1939_sk_bind(): take priv after lock is held can: flexcan: fix possible deadlock and out-of-order reception after wakeup can: flexcan: poll MCR_LPM_ACK instead of GPR ACK for stop mode acknowledgment can: kvaser_usb: kvaser_usb_leaf: Fix some info-leaks to USB devices selftests: net: tls: remove recv_rcvbuf test spi: dw: Correct handling of native chipselect spi: cadence: Correct handling of native chipselect usb: xhci: Fix build warning seen with CONFIG_PM=n drm/amdgpu: fix uninitialized variable pasid_mapping_needed ath10k: Revert "ath10k: add cleanup in ath10k_sta_state()" RDMA/siw: Fix post_recv QP state locking md: avoid invalid memory access for array sb->dev_roles s390/ftrace: fix endless recursion in function_graph tracer ARM: dts: Fix vcsi regulator to be always-on for droid4 to prevent hangs can: flexcan: add low power enter/exit acknowledgment helper usbip: Fix receive error in vhci-hcd when using scatter-gather usbip: Fix error path of vhci_recv_ret_submit() spi: fsl: don't map irq during probe spi: fsl: use platform_get_irq() instead of of_irq_to_resource() efi/memreserve: Register reservations as 'reserved' in /proc/iomem cpufreq: Avoid leaving stale IRQ work items during CPU offline KEYS: asymmetric: return ENOMEM if akcipher_request_alloc() fails mm: vmscan: protect shrinker idr replace with CONFIG_MEMCG USB: EHCI: Do not return -EPIPE when hub is disconnected intel_th: pci: Add Comet Lake PCH-V support intel_th: pci: Add Elkhart Lake SOC support intel_th: Fix freeing IRQs intel_th: msu: Fix window switching without windows platform/x86: hp-wmi: Make buffer for HPWMI_FEATURE2_QUERY 128 bytes staging: comedi: gsc_hpdi: check dma_alloc_coherent() return value tty/serial: atmel: fix out of range clock divider handling serial: sprd: Add clearing break interrupt operation pinctrl: baytrail: Really serialize all register accesses clk: imx: clk-imx7ulp: Add missing sentinel of ulp_div_table clk: imx: clk-composite-8m: add lock to gate/mux clk: imx: pll14xx: fix clk_pll14xx_wait_lock ext4: fix ext4_empty_dir() for directories with holes ext4: check for directory entries too close to block end ext4: unlock on error in ext4_expand_extra_isize() ext4: validate the debug_want_extra_isize mount option at parse time iocost: over-budget forced IOs should schedule async delay KVM: PPC: Book3S HV: Fix regression on big endian hosts kvm: x86: Host feature SSBD doesn't imply guest feature SPEC_CTRL_SSBD kvm: x86: Host feature SSBD doesn't imply guest feature AMD_SSBD KVM: arm/arm64: Properly handle faulting of device mappings KVM: arm64: Ensure 'params' is initialised when looking up sys register x86/intel: Disable HPET on Intel Coffee Lake H platforms x86/MCE/AMD: Do not use rdmsr_safe_on_cpu() in smca_configure() x86/MCE/AMD: Allow Reserved types to be overwritten in smca_banks[] x86/mce: Fix possibly incorrect severity calculation on AMD powerpc/vcpu: Assume dedicated processors as non-preempt powerpc/irq: fix stack overflow verification ocxl: Fix concurrent AFU open and device removal mmc: sdhci-msm: Correct the offset and value for DDR_CONFIG register mmc: sdhci-of-esdhc: Revert "mmc: sdhci-of-esdhc: add erratum A-009204 support" mmc: sdhci: Update the tuning failed messages to pr_debug level mmc: sdhci-of-esdhc: fix P2020 errata handling mmc: sdhci: Workaround broken command queuing on Intel GLK mmc: sdhci: Add a quirk for broken command queuing nbd: fix shutdown and recv work deadlock v2 iwlwifi: pcie: move power gating workaround earlier in the flow Linux 5.4.7 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I3585238149235bf73bb453e25861d9a6b9193dfa |
||
|
Yang Shi
|
b58b8e9331 |
mm: vmscan: protect shrinker idr replace with CONFIG_MEMCG
commit 42a9a53bb394a1de2247ef78f0b802ae86798122 upstream. Since commit |
||
Yongqin Liu
|
d139b82ae2 |
ANDROID: mm/memory.c: export mm_trace_rss_stat
to workaround following error:
ERROR: "mm_trace_rss_stat" [drivers/gpu/arm_gpu/mali_kbase.ko] undefined!
reported when make modules
Test: test 5.5.0-rc1-mainline with hikey960 with GKI method
Change-Id: Icb56b0c760780c3f9081f82d921406d17f4f1c08
[adelva: workaround for Mali driver on hikey960]
Signed-off-by: Yongqin Liu <yongqin.liu@linaro.org>
Signed-off-by: Alistair Delva <adelva@google.com>
|
||
Joel Fernandes
|
cdc4b905be |
ANDROID: mm: Throttle rss_stat tracepoint
Previously we were throttling rss_stat tracepoint by checking for 512KB boundary cross over. We removed that because upstream suggested eBPF or other ways. However right now, we don't have support for those. Let us re introduce the patch to throttle and avoid large number of events which are causing data loss. Bug: 145972256 Change-Id: I4132133aa36163430069b3ca2f57443940fb90b3 Signed-off-by: Joel Fernandes <joelaf@google.com> (cherry picked from commit b3ddf584b0d6042bb355969ec0f3fa6a2a6117f6) |
||
|
Joel Fernandes
|
f6cc86c7bd |
UPSTREAM: rss_stat: Add support to detect RSS updates of external mm
When a process updates the RSS of a different process, the rss_stat tracepoint appears in the context of the process doing the update. This can confuse userspace that the RSS of process doing the update is updated, while in reality a different process's RSS was updated. This issue happens in reclaim paths such as with direct reclaim or background reclaim. This patch adds more information to the tracepoint about whether the mm being updated belongs to the current process's context (curr field). We also include a hash of the mm pointer so that the process who the mm belongs to can be uniquely identified (mm_id field). Also vsprintf.c is refactored a bit to allow reuse of hashing code. Change-Id: Ic87af93af608c83be0b08757aed99d2b9c2c01d8 Reported-by: Ioannis Ilkos <ilkos@google.com> Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org> Acked-by: Petr Mladek <pmladek@suse.com> # lib/vsprintf.c Signed-off-by: Joel Fernandes <joelaf@google.com> |
||
Joel Fernandes (Google)
|
77510796c6 |
UPSTREAM: mm: emit tracepoint when RSS changes
Useful to track how RSS is changing per TGID to detect spikes in RSS and
memory hogs. Several Android teams have been using this patch in various
kernel trees for half a year now. Many reported to me it is really
useful so I'm posting it upstream.
Initial patch developed by Tim Murray. Changes I made from original patch:
o Prevent any additional space consumed by mm_struct.
Regarding the fact that the RSS may change too often thus flooding the
traces - note that, there is some "hysterisis" with this already. That
is - We update the counter only if we receive 64 page faults due to
SPLIT_RSS_ACCOUNTING. However, during zapping or copying of pte range,
the RSS is updated immediately which can become noisy/flooding. In a
previous discussion, we agreed that BPF or ftrace can be used to rate
limit the signal if this becomes an issue.
Also note that I added wrappers to trace_rss_stat to prevent compiler
errors where linux/mm.h is included from tracing code, causing errors
such as:
CC kernel/trace/power-traces.o
In file included from ./include/trace/define_trace.h:102,
from ./include/trace/events/kmem.h:342,
from ./include/linux/mm.h:31,
from ./include/linux/ring_buffer.h:5,
from ./include/linux/trace_events.h:6,
from ./include/trace/events/power.h:12,
from kernel/trace/power-traces.c:15:
./include/trace/trace_events.h:113:22: error: field ‘ent’ has incomplete type
struct trace_entry ent; \
Change-Id: I26e72db29ec89a305c29a50159279339067f4983
Link: http://lore.kernel.org/r/20190903200905.198642-1-joel@joelfernandes.org
Acked-by: Michal Hocko <mhocko@suse.com>
Co-developed-by: Tim Murray <timmurray@google.com>
Signed-off-by: Tim Murray <timmurray@google.com>
Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Signed-off-by: Joel Fernandes <joelaf@google.com>
|
||
|
Greg Kroah-Hartman
|
7dc1159904 |
This is the 5.4.4 stable release
-----BEGIN PGP SIGNATURE----- iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl35Ju4ACgkQONu9yGCS aT7IMQ//Vs+kE7VCDeHfzNu4ivh3+X0bleYWo/OPxNQRFx7IL4Lb2jVjWrMnAGld u8H31nVaL28bhJAcQJg+O/OD3AXWQ8nzRKixfVfwd669Zv1ggaLM8MW9xuTBwmQs ciFrQ4GirfjvUP0VdkpsSLp+bbi61nkqGB4WHgX3gL+8LWxtpE8nFlh+8P+3TT9Z h4BuYQHhGF8JyhOFKhfWbWAFUoHLsR7Aa7TPOeQPXGfzWBaSfISA/UVo6N7QGpVw 4DP5rc4Wb+tzNAJHkkgzbSDzuM6L6BHrO3SQCisd0Viw9XYO9M0U9NVbExtu9x9l M/sqE61cX1AxUmjstdgca37vyHCntJ+wMT7WRnOBVJfodZDjB/6wzPz8rWIZrSX+ +uXSJF8Xpp5FuvB0td0CQoyUsnrMDnwWbjnMnlVXY6mPcgD5fgB9dTDJN3FEQ8t6 MixN3JBy1KseY9ihe9cINaR0CBKqyogOwbGrqqw3XJNWzpJ5xgxhLuSc2PyuDLwZ bDaj7K9Ukx4n0QzXWvW5pZTQi+yNVc7DUVOKFDXTf2xR2/KvEVNW25gL7oBxrTTu q5gw4bBkO0KsbgofTMWUyUfO3aYhDqc7H4yfRRbc/Q08hiJHORFC2jhLXG9oubNN QrZ4AxJvzRSYl5vwrVpHW9vnlPe5SuJvRbkMN8164togc9BMNbc= =qUmE -----END PGP SIGNATURE----- Merge 5.4.4 into android-5.4 Changes in 5.4.4 usb: gadget: configfs: Fix missing spin_lock_init() usb: gadget: pch_udc: fix use after free nvme: Namepace identification descriptor list is optional Revert "nvme: Add quirk for Kingston NVME SSD running FW E8FK11.T" scsi: lpfc: Fix bad ndlp ptr in xri aborted handling scsi: zfcp: trace channel log even for FCP command responses scsi: qla2xxx: Do command completion on abort timeout scsi: qla2xxx: Fix driver unload hang scsi: qla2xxx: Fix double scsi_done for abort path scsi: qla2xxx: Fix memory leak when sending I/O fails compat_ioctl: add compat_ptr_ioctl() ceph: fix compat_ioctl for ceph_dir_operations media: venus: remove invalid compat_ioctl32 handler USB: uas: honor flag to avoid CAPACITY16 USB: uas: heed CAPACITY_HEURISTICS USB: documentation: flags on usb-storage versus UAS usb: Allow USB device to be warm reset in suspended state usb: host: xhci-tegra: Correct phy enable sequence binder: fix incorrect calculation for num_valid staging: exfat: fix multiple definition error of `rename_file' staging: rtl8188eu: fix interface sanity check staging: rtl8712: fix interface sanity check staging: vchiq: call unregister_chrdev_region() when driver registration fails staging: gigaset: fix general protection fault on probe staging: gigaset: fix illegal free on probe errors staging: gigaset: add endpoint-type sanity check usb: xhci: only set D3hot for pci device xhci: Fix memory leak in xhci_add_in_port() xhci: fix USB3 device initiated resume race with roothub autosuspend xhci: Increase STS_HALT timeout in xhci_suspend() xhci: handle some XHCI_TRUST_TX_LENGTH quirks cases as default behaviour. xhci: make sure interrupts are restored to correct state interconnect: qcom: sdm845: Walk the list safely on node removal interconnect: qcom: qcs404: Walk the list safely on node removal usb: common: usb-conn-gpio: Don't log an error on probe deferral ARM: dts: pandora-common: define wl1251 as child node of mmc3 iio: adis16480: Add debugfs_reg_access entry iio: imu: st_lsm6dsx: fix ODR check in st_lsm6dsx_write_raw iio: adis16480: Fix scales factors iio: humidity: hdc100x: fix IIO_HUMIDITYRELATIVE channel reporting iio: imu: inv_mpu6050: fix temperature reporting using bad unit iio: adc: ad7606: fix reading unnecessary data from device iio: adc: ad7124: Enable internal reference USB: atm: ueagle-atm: add missing endpoint check USB: idmouse: fix interface sanity checks USB: serial: io_edgeport: fix epic endpoint lookup usb: roles: fix a potential use after free USB: adutux: fix interface sanity check usb: core: urb: fix URB structure initialization function usb: mon: Fix a deadlock in usbmon between mmap and read tpm: add check after commands attribs tab allocation tpm: Switch to platform_get_irq_optional() EDAC/altera: Use fast register IO for S10 IRQs brcmfmac: disable PCIe interrupts before bus reset mtd: spear_smi: Fix Write Burst mode mtd: rawnand: Change calculating of position page containing BBM virt_wifi: fix use-after-free in virt_wifi_newlink() virtio-balloon: fix managed page counts when migrating pages between zones usb: dwc3: pci: add ID for the Intel Comet Lake -H variant usb: dwc3: gadget: Fix logical condition usb: dwc3: gadget: Clear started flag for non-IOC usb: dwc3: ep0: Clear started flag on completion phy: renesas: rcar-gen3-usb2: Fix sysfs interface of "role" usb: typec: fix use after free in typec_register_port() iwlwifi: pcie: fix support for transmitting SKBs with fraglist btrfs: check page->mapping when loading free space cache btrfs: use btrfs_block_group_cache_done in update_block_group btrfs: use refcount_inc_not_zero in kill_all_nodes Btrfs: fix metadata space leak on fixup worker failure to set range as delalloc Btrfs: fix negative subv_writers counter and data space leak after buffered write btrfs: Avoid getting stuck during cyclic writebacks btrfs: Remove btrfs_bio::flags member Btrfs: send, skip backreference walking for extents with many references btrfs: record all roots for rename exchange on a subvol rtlwifi: rtl8192de: Fix missing code to retrieve RX buffer address rtlwifi: rtl8192de: Fix missing callback that tests for hw release of buffer rtlwifi: rtl8192de: Fix missing enable interrupt flag lib: raid6: fix awk build warnings ovl: fix lookup failure on multi lower squashfs ovl: fix corner case of non-unique st_dev;st_ino ovl: relax WARN_ON() on rename to self hwrng: omap - Fix RNG wait loop timeout dm writecache: handle REQ_FUA dm zoned: reduce overhead of backing device checks workqueue: Fix spurious sanity check failures in destroy_workqueue() workqueue: Fix pwq ref leak in rescuer_thread() ASoC: rt5645: Fixed buddy jack support. ASoC: rt5645: Fixed typo for buddy jack support. ASoC: Jack: Fix NULL pointer dereference in snd_soc_jack_report ASoC: fsl_audmix: Add spin lock to protect tdms md: improve handling of bio with REQ_PREFLUSH in md_flush_request() blk-mq: avoid sysfs buffer overflow with too many CPU cores cgroup: pids: use atomic64_t for pids->limit wil6210: check len before memcpy() calls ar5523: check NULL before memcpy() in ar5523_cmd() s390/mm: properly clear _PAGE_NOEXEC bit when it is not supported media: hantro: Fix s_fmt for dynamic resolution changes media: hantro: Fix motion vectors usage condition media: hantro: Fix picture order count table enable media: vimc: sen: remove unused kthread_sen field media: bdisp: fix memleak on release media: radio: wl1273: fix interrupt masking on release media: cec.h: CEC_OP_REC_FLAG_ values were swapped cpuidle: Do not unset the driver if it is there already cpuidle: teo: Ignore disabled idle states that are too deep cpuidle: teo: Rename local variable in teo_select() cpuidle: teo: Consider hits and misses metrics of disabled states cpuidle: teo: Fix "early hits" handling for disabled idle states cpuidle: use first valid target residency as poll time erofs: zero out when listxattr is called with no xattr perf tests: Fix out of bounds memory access drm/panfrost: Open/close the perfcnt BO powerpc/perf: Disable trace_imc pmu intel_th: Fix a double put_device() in error path intel_th: pci: Add Ice Lake CPU support intel_th: pci: Add Tiger Lake CPU support PM / devfreq: Lock devfreq in trans_stat_show cpufreq: powernv: fix stack bloat and hard limit on number of CPUs ALSA: fireface: fix return value in error path of isochronous resources reservation ALSA: oxfw: fix return value in error path of isochronous resources reservation ALSA: hda/realtek - Line-out jack doesn't work on a Dell AIO ACPI / utils: Move acpi_dev_get_first_match_dev() under CONFIG_ACPI ACPI: LPSS: Add LNXVIDEO -> BYT I2C7 to lpss_device_links ACPI: LPSS: Add LNXVIDEO -> BYT I2C1 to lpss_device_links ACPI: LPSS: Add dmi quirk for skipping _DEP check for some device-links ACPI / hotplug / PCI: Allocate resources directly under the non-hotplug bridge ACPI: OSL: only free map once in osl.c ACPI: bus: Fix NULL pointer check in acpi_bus_get_private_data() ACPI: EC: Rework flushing of pending work ACPI: PM: Avoid attaching ACPI PM domain to certain devices pinctrl: rza2: Fix gpio name typos pinctrl: armada-37xx: Fix irq mask access in armada_37xx_irq_set_type() pinctrl: samsung: Add of_node_put() before return in error path pinctrl: samsung: Fix device node refcount leaks in Exynos wakeup controller init pinctrl: samsung: Fix device node refcount leaks in S3C24xx wakeup controller init pinctrl: samsung: Fix device node refcount leaks in init code pinctrl: samsung: Fix device node refcount leaks in S3C64xx wakeup controller init mmc: host: omap_hsmmc: add code for special init of wl1251 to get rid of pandora_wl1251_init_card ARM: dts: omap3-tao3530: Fix incorrect MMC card detection GPIO polarity RDMA/core: Fix ib_dma_max_seg_size() ppdev: fix PPGETTIME/PPSETTIME ioctls stm class: Lose the protocol driver when dropping its reference coresight: Serialize enabling/disabling a link device. powerpc: Allow 64bit VDSO __kernel_sync_dicache to work across ranges >4GB powerpc/xive: Prevent page fault issues in the machine crash handler powerpc: Allow flush_icache_range to work across ranges >4GB powerpc/xive: Skip ioremap() of ESB pages for LSI interrupts video/hdmi: Fix AVI bar unpack quota: Check that quota is not dirty before release ext2: check err when partial != NULL seccomp: avoid overflow in implicit constant conversion quota: fix livelock in dquot_writeback_dquots ext4: Fix credit estimate for final inode freeing reiserfs: fix extended attributes on the root directory scsi: qla2xxx: Fix SRB leak on switch command timeout scsi: qla2xxx: Fix a dma_pool_free() call Revert "scsi: qla2xxx: Fix memory leak when sending I/O fails" iio: ad7949: kill pointless "readback"-handling code iio: ad7949: fix channels mixups omap: pdata-quirks: revert pandora specific gpiod additions omap: pdata-quirks: remove openpandora quirks for mmc3 and wl1251 powerpc: Avoid clang warnings around setjmp and longjmp powerpc: Fix vDSO clock_getres() mm, memfd: fix COW issue on MAP_PRIVATE and F_SEAL_FUTURE_WRITE mappings mfd: rk808: Fix RK818 ID template mm: memcg/slab: wait for !root kmem_cache refcnt killing on root kmem_cache destruction ext4: work around deleting a file with i_nlink == 0 safely firmware: qcom: scm: Ensure 'a0' status code is treated as signed s390/smp,vdso: fix ASCE handling s390/kaslr: store KASLR offset for early dumps mm/shmem.c: cast the type of unmap_start to u64 powerpc: Define arch_is_kernel_initmem_freed() for lockdep USB: dummy-hcd: increase max number of devices to 32 rtc: disable uie before setting time and enable after splice: only read in as much information as there is pipe buffer space ext4: fix a bug in ext4_wait_for_tail_page_commit ext4: fix leak of quota reservations blk-mq: make sure that line break can be printed workqueue: Fix missing kfree(rescuer) in destroy_workqueue() r8169: fix rtl_hw_jumbo_disable for RTL8168evl EDAC/ghes: Do not warn when incrementing refcount on 0 Linux 5.4.4 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I8949a5fb2fbd836ce34907e70906e3aeb8a58b7c |
||
Chen Jun
|
12de9bf4bf |
mm/shmem.c: cast the type of unmap_start to u64
commit aa71ecd8d86500da6081a72da6b0b524007e0627 upstream. In 64bit system. sb->s_maxbytes of shmem filesystem is MAX_LFS_FILESIZE, which equal LLONG_MAX. If offset > LLONG_MAX - PAGE_SIZE, offset + len < LLONG_MAX in shmem_fallocate, which will pass the checking in vfs_fallocate. /* Check for wrap through zero too */ if (((offset + len) > inode->i_sb->s_maxbytes) || ((offset + len) < 0)) return -EFBIG; loff_t unmap_start = round_up(offset, PAGE_SIZE) in shmem_fallocate causes a overflow. Syzkaller reports a overflow problem in mm/shmem: UBSAN: Undefined behaviour in mm/shmem.c:2014:10 signed integer overflow: '9223372036854775807 + 1' cannot be represented in type 'long long int' CPU: 0 PID:17076 Comm: syz-executor0 Not tainted 4.1.46+ #1 Hardware name: linux, dummy-virt (DT) Call trace: dump_backtrace+0x0/0x2c8 arch/arm64/kernel/traps.c:100 show_stack+0x20/0x30 arch/arm64/kernel/traps.c:238 __dump_stack lib/dump_stack.c:15 [inline] ubsan_epilogue+0x18/0x70 lib/ubsan.c:164 handle_overflow+0x158/0x1b0 lib/ubsan.c:195 shmem_fallocate+0x6d0/0x820 mm/shmem.c:2104 vfs_fallocate+0x238/0x428 fs/open.c:312 SYSC_fallocate fs/open.c:335 [inline] SyS_fallocate+0x54/0xc8 fs/open.c:239 The highest bit of unmap_start will be appended with sign bit 1 (overflow) when calculate shmem_falloc.start: shmem_falloc.start = unmap_start >> PAGE_SHIFT. Fix it by casting the type of unmap_start to u64, when right shifted. This bug is found in LTS Linux 4.1. It also seems to exist in mainline. Link: http://lkml.kernel.org/r/1573867464-5107-1-git-send-email-chenjun102@huawei.com Signed-off-by: Chen Jun <chenjun102@huawei.com> Reviewed-by: Andrew Morton <akpm@linux-foundation.org> Cc: Hugh Dickins <hughd@google.com> Cc: Qian Cai <cai@lca.pw> Cc: Kefeng Wang <wangkefeng.wang@huawei.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
||
|
Roman Gushchin
|
e4d09b31ad |
mm: memcg/slab: wait for !root kmem_cache refcnt killing on root kmem_cache destruction
commit a264df74df38855096393447f1b8f386069a94b9 upstream.
Christian reported a warning like the following obtained during running
some KVM-related tests on s390:
WARNING: CPU: 8 PID: 208 at lib/percpu-refcount.c:108 percpu_ref_exit+0x50/0x58
Modules linked in: kvm(-) xt_CHECKSUM xt_MASQUERADE bonding xt_tcpudp ip6t_rpfilter ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 xt_conntrack ip6table_na>
CPU: 8 PID: 208 Comm: kworker/8:1 Not tainted 5.2.0+ #66
Hardware name: IBM 2964 NC9 712 (LPAR)
Workqueue: events sysfs_slab_remove_workfn
Krnl PSW : 0704e00180000000 0000001529746850 (percpu_ref_exit+0x50/0x58)
R:0 T:1 IO:1 EX:1 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3
Krnl GPRS: 00000000ffff8808 0000001529746740 000003f4e30e8e18 0036008100000000
0000001f00000000 0035008100000000 0000001fb3573ab8 0000000000000000
0000001fbdb6de00 0000000000000000 0000001529f01328 0000001fb3573b00
0000001fbb27e000 0000001fbdb69300 000003e009263d00 000003e009263cd0
Krnl Code: 0000001529746842: f0a0000407fe srp 4(11,%r0),2046,0
0000001529746848: 47000700 bc 0,1792
#000000152974684c: a7f40001 brc 15,152974684e
>0000001529746850: a7f4fff2 brc 15,1529746834
0000001529746854: 0707 bcr 0,%r7
0000001529746856: 0707 bcr 0,%r7
0000001529746858: eb8ff0580024 stmg %r8,%r15,88(%r15)
000000152974685e: a738ffff lhi %r3,-1
Call Trace:
([<000003e009263d00>] 0x3e009263d00)
[<00000015293252ea>] slab_kmem_cache_release+0x3a/0x70
[<0000001529b04882>] kobject_put+0xaa/0xe8
[<000000152918cf28>] process_one_work+0x1e8/0x428
[<000000152918d1b0>] worker_thread+0x48/0x460
[<00000015291942c6>] kthread+0x126/0x160
[<0000001529b22344>] ret_from_fork+0x28/0x30
[<0000001529b2234c>] kernel_thread_starter+0x0/0x10
Last Breaking-Event-Address:
[<000000152974684c>] percpu_ref_exit+0x4c/0x58
---[ end trace b035e7da5788eb09 ]---
The problem occurs because kmem_cache_destroy() is called immediately
after deleting of a memcg, so it races with the memcg kmem_cache
deactivation.
flush_memcg_workqueue() at the beginning of kmem_cache_destroy() is
supposed to guarantee that all deactivation processes are finished, but
failed to do so. It waits for an rcu grace period, after which all
children kmem_caches should be deactivated. During the deactivation
percpu_ref_kill() is called for non root kmem_cache refcounters, but it
requires yet another rcu grace period to finish the transition to the
atomic (dead) state.
So in a rare case when not all children kmem_caches are destroyed at the
moment when the root kmem_cache is about to be gone, we need to wait
another rcu grace period before destroying the root kmem_cache.
This issue can be triggered only with dynamically created kmem_caches
which are used with memcg accounting. In this case per-memcg child
kmem_caches are created. They are deactivated from the cgroup removing
path. If the destruction of the root kmem_cache is racing with the
removal of the cgroup (both are quite complicated multi-stage
processes), the described issue can occur. The only known way to
trigger it in the real life, is to unload some kernel module which
creates a dedicated kmem_cache, used from different memory cgroups with
GFP_ACCOUNT flag. If the unloading happens immediately after calling
rmdir on the corresponding cgroup, there is some chance to trigger the
issue.
Link: http://lkml.kernel.org/r/20191129025011.3076017-1-guro@fb.com
Fixes:
|
||
Nicolas Geoffray
|
4d0f420c86 |
mm, memfd: fix COW issue on MAP_PRIVATE and F_SEAL_FUTURE_WRITE mappings
commit 05d351102dbe4e103d6bdac18b1122cd3cd04925 upstream.
F_SEAL_FUTURE_WRITE has unexpected behavior when used with MAP_PRIVATE:
A private mapping created after the memfd file that gets sealed with
F_SEAL_FUTURE_WRITE loses the copy-on-write at fork behavior, meaning
children and parent share the same memory, even though the mapping is
private.
The reason for this is due to the code below:
static int shmem_mmap(struct file *file, struct vm_area_struct *vma)
{
struct shmem_inode_info *info = SHMEM_I(file_inode(file));
if (info->seals & F_SEAL_FUTURE_WRITE) {
/*
* New PROT_WRITE and MAP_SHARED mmaps are not allowed when
* "future write" seal active.
*/
if ((vma->vm_flags & VM_SHARED) && (vma->vm_flags & VM_WRITE))
return -EPERM;
/*
* Since the F_SEAL_FUTURE_WRITE seals allow for a MAP_SHARED
* read-only mapping, take care to not allow mprotect to revert
* protections.
*/
vma->vm_flags &= ~(VM_MAYWRITE);
}
...
}
And for the mm to know if a mapping is copy-on-write:
static inline bool is_cow_mapping(vm_flags_t flags)
{
return (flags & (VM_SHARED | VM_MAYWRITE)) == VM_MAYWRITE;
}
The patch fixes the issue by making the mprotect revert protection
happen only for shared mappings. For private mappings, using mprotect
will have no effect on the seal behavior.
The F_SEAL_FUTURE_WRITE feature was introduced in v5.1 so v5.3.x stable
kernels would need a backport.
[akpm@linux-foundation.org: reflow comment, per Christoph]
Link: http://lkml.kernel.org/r/20191107195355.80608-1-joel@joelfernandes.org
Fixes:
|
||
Sami Tolvanen
|
7f498a4b7b |
FROMLIST: scs: add accounting
This change adds accounting for the memory allocated for shadow stacks. Bug: 145210207 Change-Id: Iee94c22abefcabb63a3bcd4db8ba952130f30a82 (am from https://lore.kernel.org/patchwork/patch/1149055/) Reviewed-by: Kees Cook <keescook@chromium.org> Signed-off-by: Sami Tolvanen <samitolvanen@google.com> |
||
|
Greg Kroah-Hartman
|
54e301676a |
Linux 5.4
-----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAl3bIQceHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiG8mUIAIjMARdI6Fc6Hrwo oVAFQU8BY/OB49NbKYCaXMi1AbMv0+f32jEmdcHj4AQa+Dq8owc1pOB2o+iTLrCq PWf6t1wjHtPVmkZ+lWGDFT74IBMCZ8M0dgN9rYBUbno09/B9cqN4ttjTrGjTgkGe yw4qTzeflZaMSIzvy+nZD8RM9bXsFJUncD/M759ElPj1p7Tdx29c05+e46pYOh7i A6QaSMZT2xKHDIDfU1rQhvyrzAX4cF1LtbSNu7GAG7Ajnn3jfxXqUzZdl5r5j04W ee+AXER4VXDlq+2fN7/jlGa4kxiZZDX/FqRnS6dsrb+2sNCKlnETI+6a9/dO0zsI wzBh36o= =0TWn -----END PGP SIGNATURE----- Merge 5.4 into android-mainline Linux 5.4 Here we go! Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: Iee409f3bbf65b93fa419e5b09818efb8e56569fd |
||
Andrey Ryabinin
|
9a63236f1a |
mm/ksm.c: don't WARN if page is still mapped in remove_stable_node()
It's possible to hit the WARN_ON_ONCE(page_mapped(page)) in
remove_stable_node() when it races with __mmput() and squeezes in
between ksm_exit() and exit_mmap().
WARNING: CPU: 0 PID: 3295 at mm/ksm.c:888 remove_stable_node+0x10c/0x150
Call Trace:
remove_all_stable_nodes+0x12b/0x330
run_store+0x4ef/0x7b0
kernfs_fop_write+0x200/0x420
vfs_write+0x154/0x450
ksys_write+0xf9/0x1d0
do_syscall_64+0x99/0x510
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Remove the warning as there is nothing scary going on.
Link: http://lkml.kernel.org/r/20191119131850.5675-1-aryabinin@virtuozzo.com
Fixes:
|
||
|
David Hildenbrand
|
7ce700bf11 |
mm/memory_hotplug: don't access uninitialized memmaps in shrink_zone_span()
Let's limit shrinking to !ZONE_DEVICE so we can fix the current code. We should never try to touch the memmap of offline sections where we could have uninitialized memmaps and could trigger BUGs when calling page_to_nid() on poisoned pages. There is no reliable way to distinguish an uninitialized memmap from an initialized memmap that belongs to ZONE_DEVICE, as we don't have anything like SECTION_IS_ONLINE we can use similar to pfn_to_online_section() for !ZONE_DEVICE memory. E.g., set_zone_contiguous() similarly relies on pfn_to_online_section() and will therefore never set a ZONE_DEVICE zone consecutive. Stopping to shrink the ZONE_DEVICE therefore results in no observable changes, besides /proc/zoneinfo indicating different boundaries - something we can totally live with. Before commit |
||
|
Greg Kroah-Hartman
|
ad5859c6ae |
Linux 5.4-rc8
-----BEGIN PGP SIGNATURE----- iQFSBAABCAA8FiEEq68RxlopcLEwq+PEeb4+QwBBGIYFAl3RzgkeHHRvcnZhbGRz QGxpbnV4LWZvdW5kYXRpb24ub3JnAAoJEHm+PkMAQRiGN18H/0JZbfIpy8/4Irol 0va7Aj2fBi1a5oxfqYsMKN0u3GKbN3OV9tQ+7w1eBNGvL72TGadgVTzTY+Im7A9U UjboAc7jDPCG+YhIwXFufMiIAq5jDIj6h0LDas7ALsMfsnI/RhTwgNtLTAkyI3dH YV/6ljFULwueJHCxzmrYbd1x39PScj3kCNL2pOe6On7rXMKOemY/nbbYYISxY30E GMgKApSS+li7VuSqgrKoq5Qaox26LyR2wrXB1ij4pqEJ9xgbnKRLdHuvXZnE+/5p 46EMirt+yeSkltW3d2/9MoCHaA76ESzWMMDijLx7tPgoTc3RB3/3ZLsm3rYVH+cR cRlNNSk= =0+Cg -----END PGP SIGNATURE----- Merge 5.4-rc8 into android-mainline Linux 5.4-rc8 Signed-off-by: Greg Kroah-Hartman <gregkh@google.com> Change-Id: I1f55e5d34dc78ddb064910ce1e1b7a7b5b39aaba |
||
Ralph Campbell
|
6855ac4acd |
mm/debug.c: PageAnon() is true for PageKsm() pages
PageAnon() and PageKsm() use the low two bits of the page->mapping
pointer to indicate the page type. PageAnon() only checks the LSB while
PageKsm() checks the least significant 2 bits are equal to 3.
Therefore, PageAnon() is true for KSM pages. __dump_page() incorrectly
will never print "ksm" because it checks PageAnon() first. Fix this by
checking PageKsm() first.
Link: http://lkml.kernel.org/r/20191113000651.20677-1-rcampbell@nvidia.com
Fixes:
|
||
|
Ralph Campbell
|
76a1850e45 |
mm/debug.c: __dump_page() prints an extra line
When dumping struct page information, __dump_page() prints the page type with a trailing blank followed by the page flags on a separate line: anon flags: 0x100000000090034(uptodate|lru|active|head|swapbacked) It looks like the intent was to use pr_cont() for printing "flags:" but pr_cont() usage is discouraged so fix this by extending the format to include the flags into a single line: anon flags: 0x100000000090034(uptodate|lru|active|head|swapbacked) If the page is file backed, the name might be long so use two lines: shmem_aops name:"dev/zero" flags: 0x10000000008000c(uptodate|dirty|swapbacked) Eliminate pr_conf() usage as well for appending compound_mapcount. Link: http://lkml.kernel.org/r/20191112012608.16926-1-rcampbell@nvidia.com Signed-off-by: Ralph Campbell <rcampbell@nvidia.com> Reviewed-by: Andrew Morton <akpm@linux-foundation.org> Cc: Jerome Glisse <jglisse@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |