commit 34b1a1ce1458f50ef27c54e28eb9b1947012907a upstream
fixup_pi_state_owner() tries to ensure that the state of the rtmutex,
pi_state and the user space value related to the PI futex are consistent
before returning to user space. In case that the user space value update
faults and the fault cannot be resolved by faulting the page in via
fault_in_user_writeable() the function returns with -EFAULT and leaves
the rtmutex and pi_state owner state inconsistent.
A subsequent futex_unlock_pi() operates on the inconsistent pi_state and
releases the rtmutex despite not owning it which can corrupt the RB tree of
the rtmutex and cause a subsequent kernel stack use after free.
It was suggested to loop forever in fixup_pi_state_owner() if the fault
cannot be resolved, but that results in runaway tasks which is especially
undesired when the problem happens due to a programming error and not due
to malice.
As the user space value cannot be fixed up, the proper solution is to make
the rtmutex and the pi_state consistent so both have the same owner. This
leaves the user space value out of sync. Any subsequent operation on the
futex will fail because the 10th rule of PI futexes (pi_state owner and
user space value are consistent) has been violated.
As a consequence this removes the inept attempts of 'fixing' the situation
in case that the current task owns the rtmutex when returning with an
unresolvable fault by unlocking the rtmutex which left pi_state::owner and
rtmutex::owner out of sync in a different and only slightly less dangerous
way.
Fixes: 1b7558e457 ("futexes: fix fault handling in futex_lock_pi")
Reported-by: gzobqq@gmail.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 34b1a1ce1458f50ef27c54e28eb9b1947012907a)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Iabd44dad5d4b8385b8a20e44d18308708cc3b701
commit f2dac39d93987f7de1e20b3988c8685523247ae2 upstream
Too many gotos already and an upcoming fix would make it even more
unreadable.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit f2dac39d93987f7de1e20b3988c8685523247ae2)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5a97587c0f696d4f4b849f7f106990a5587fa402
commit 6ccc84f917d33312eb2846bd7b567639f585ad6d upstream
No point in open coding it. This way it gains the extra sanity checks.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 6ccc84f917d33312eb2846bd7b567639f585ad6d)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic34513518cd4996b3eb4cb82b669d727be522597
commit 2156ac1934166d6deb6cd0f6ffc4c1076ec63697 upstream
Nothing uses the argument. Remove it as preparation to use
pi_state_update_owner().
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 2156ac1934166d6deb6cd0f6ffc4c1076ec63697)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I126088d93c5f05db654e508dfd4195e5c1696164
commit c5cade200ab9a2a3be9e7f32a752c8d86b502ec7 upstream
Updating pi_state::owner is done at several places with the same
code. Provide a function for it and use that at the obvious places.
This is also a preparation for a bug fix to avoid yet another copy of the
same code or alternatively introducing a completely unpenetratable mess of
gotos.
Originally-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit c5cade200ab9a2a3be9e7f32a752c8d86b502ec7)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I17a67806a035338a55b27eea673d707fc4d8c529
commit 04b79c55201f02ffd675e1231d731365e335c307 upstream
If that unexpected case of inconsistent arguments ever happens then the
futex state is left completely inconsistent and the printk is not really
helpful. Replace it with a warning and make the state consistent.
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 04b79c55201f02ffd675e1231d731365e335c307)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I32bd64130d9414f65155ecd80646d01eb4374a60
commit 12bb3f7f1b03d5913b3f9d4236a488aa7774dfe9 upstream
In case that futex_lock_pi() was aborted by a signal or a timeout and the
task returned without acquiring the rtmutex, but is the designated owner of
the futex due to a concurrent futex_unlock_pi() fixup_owner() is invoked to
establish consistent state. In that case it invokes fixup_pi_state_owner()
which in turn tries to acquire the rtmutex again. If that succeeds then it
does not propagate this success to fixup_owner() and futex_lock_pi()
returns -EINTR or -ETIMEOUT despite having the futex locked.
Return success from fixup_pi_state_owner() in all cases where the current
task owns the rtmutex and therefore the futex and propagate it correctly
through fixup_owner(). Fixup the other callsite which does not expect a
positive return value.
Fixes: c1e2f0eaf0 ("futex: Avoid violating the 10th rule of futex")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 12bb3f7f1b03d5913b3f9d4236a488aa7774dfe9)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I6dfb7407620fdf8293edbfbe54463f0c8ff63a57
commit 1e106aa3509b86738769775969822ffc1ec21bf4 upstream.
The exit_pi_state_list() function calls put_pi_state() with IRQs disabled
and is not expecting that IRQs will be enabled inside the function.
Use the _irqsave() variant so that IRQs are restored to the original state
instead of being enabled unconditionally.
Fixes: 153fbd1226 ("futex: Fix more put_pi_state() vs. exit_pi_state_list() races")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20201106085205.GA1159983@mwanda
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 2192d905df)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I10bc011b54ffc6d66c0a499ecebfa5b2d96d58ce
commit 9f5d1c336a10c0d24e83e40b4c1b9539f7dba627 upstream.
Gratian managed to trigger the BUG_ON(!newowner) in fixup_pi_state_owner().
This is one possible chain of events leading to this:
Task Prio Operation
T1 120 lock(F)
T2 120 lock(F) -> blocks (top waiter)
T3 50 (RT) lock(F) -> boosts T1 and blocks (new top waiter)
XX timeout/ -> wakes T2
signal
T1 50 unlock(F) -> wakes T3 (rtmutex->owner == NULL, waiter bit is set)
T2 120 cleanup -> try_to_take_mutex() fails because T3 is the top waiter
and the lower priority T2 cannot steal the lock.
-> fixup_pi_state_owner() sees newowner == NULL -> BUG_ON()
The comment states that this is invalid and rt_mutex_real_owner() must
return a non NULL owner when the trylock failed, but in case of a queued
and woken up waiter rt_mutex_real_owner() == NULL is a valid transient
state. The higher priority waiter has simply not yet managed to take over
the rtmutex.
The BUG_ON() is therefore wrong and this is just another retry condition in
fixup_pi_state_owner().
Drop the locks, so that T3 can make progress, and then try the fixup again.
Gratian provided a great analysis, traces and a reproducer. The analysis is
to the point, but it confused the hell out of that tglx dude who had to
page in all the futex horrors again. Condensed version is above.
[ tglx: Wrote comment and changelog ]
Fixes: c1e2f0eaf0 ("futex: Avoid violating the 10th rule of futex")
Reported-by: Gratian Crisan <gratian.crisan@ni.com>
Signed-off-by: Mike Galbraith <efault@gmx.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/87a6w6x7bb.fsf@ni.com
Link: https://lore.kernel.org/r/87sg9pkvf7.fsf@nanos.tec.linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 2716e78a64)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I9ab0878641624448cacb1951506b5accb4c92a00
[ Upstream commit 921c7ebd1337d1a46783d7e15a850e12aed2eaa0 ]
If should_futex_fail() returns true in futex_wake_pi(), then the 'ret'
variable is set to -EFAULT and then immediately overwritten. So the failure
injection is non-functional.
Fix it by actually leaving the function and returning -EFAULT.
The Fixes tag is kinda blury because the initial commit which introduced
failure injection was already sloppy, but the below mentioned commit broke
it completely.
[ tglx: Massaged changelog ]
Fixes: 6b4f4bc9cb ("locking/futex: Allow low-level atomic operations to return -EAGAIN")
Signed-off-by: Mateusz Nosek <mateusznosek0@gmail.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20200927000858.24219-1-mateusznosek0@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
(cherry picked from commit 2db7590371)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I22198b7a65630cb5649f3e889810783b147bfada
We add a vendor hook for util to freq calculation in schedutil,
so we need to do corresponding change for energy calculation.
android_vh_em_pd_energy
adjust energy calculation
Bug: 178021064
Signed-off-by: Yun Hsiang <yun.hsiang@mediatek.com>
Change-Id: Iae772cf07881602eea3f27aeb75fba753e7c2635
Currently, the frequency is calculated by max freq * 1.25 * util / max cap.
Add a vendor hook to adjust the frequency when the calculation
overestimate.
android_vh_map_util_freq
adjust util to freq calculation
Bug: 177845438
Signed-off-by: Yun Hsiang <yun.hsiang@mediatek.com>
Change-Id: I9aa9079f00af7d3380b19f2fe21b75cddd107d15
This symbol is needed for certain vendor modules which cannot rely on
only the sysfs interface for uclamp alone.
Bug: 170697030
Signed-off-by: J. Avila <elavila@google.com>
Change-Id: Ic904ade83a45d259cfc95501e6b81e6c5a0e90a0
(cherry picked from commit 0edac9cb95fb2fa292a4b25ac77b125cde28b674)
A number of kthread-related functions indirectly take task_struct->pi_lock
while holding worker->lock in the call chain like this:
spin_lock(&worker->lock)
kthread_insert_work
wake_up_process
try_to_wake_up
raw_spin_lock_irqsave(&p->pi_lock, flags)
This lock dependency exists whenever kthread_insert_work is called either
directly or indirectly via __kthread_queue_delayed_work in the following
functions:
kthread_queue_work
kthread_delayed_work_timer_fn
kthread_queue_delayed_work
kthread_flush_work
kthread_mod_delayed_work
This creates possibilities for circular dependencies like the one reported
at [1]. Break this lock dependency by moving task wakeup after worker->lock
has been released.
[1]: https://lore.kernel.org/lkml/CAJuCfpG4NkhpQvZjgXZ_3gm6Hf1QgN_eUOQ8iX9Cv1k9whLwSQ@mail.gmail.com
Reported-by: Ke Wang <ke.wang@unisoc.com>
Reported-by: Shakeel Butt <shakeelb@google.com>
Suggested-by: Peter Zijlstra <peterz@infradead.org>
Tested-by: Shakeel Butt <shakeelb@google.com>
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Link: https://lkml.org/lkml/2020/5/4/1148
Cherry picked instead of commit 461daba06bdcb9c7a3f92b9bbd110e1f7d093ffc
as an alternative solution for the lockdep error that does not break KMI.
Bug: 174875976
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: I2478847f66c85dca953846cd77955928d690c97c
Suspend to IDLE invokes tick_unfreeze() on resume. tick_unfreeze() on the
first resuming CPU resumes timekeeping, which also has the side effect of
resetting the softlockup watchdog on this CPU.
But on the secondary CPUs the watchdog is not reset in the resume /
unfreeze() path, which can result in false softlockup warnings on those
CPUs depending on the time spent in suspend.
Prevent this by clearing the softlock watchdog in the unfreeze path also
on the secondary resuming CPUs.
[ tglx: Massaged changelog ]
Signed-off-by: Chunyan Zhang <chunyan.zhang@unisoc.com>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20200110083902.27276-1-chunyan.zhang@unisoc.com
Bug: 173341055
(cherry picked from commit 5167c506d62dd9ffab73eba23c79b0a8845c9fe1)
Signed-off-by: Chunyan Zhang <zhang.lyra@gmail.com>
Change-Id: Iab440b4137726811fce76f3636a4cf8bafc2c202
In find_energy_efficient_cpu() 'cpu_cap' could be less that 'util'.
It might be because of RT, DL (so higher sched class than CFS), irq or
thermal pressure signal, which reduce the capacity value.
In such situation the result of 'cpu_cap - util' might be negative but
stored in the unsigned long. Then it might be compared with other unsigned
long when uclamp_rq_util_with() reduced the 'util' such that is passes the
fits_capacity() check.
Prevent this situation and make the arithmetic more safe.
Fixes: 1d42509e475cd ("sched/fair: Make EAS wakeup placement consider uclamp restrictions")
Signed-off-by: Lukasz Luba <lukasz.luba@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Valentin Schneider <valentin.schneider@arm.com>
Link: https://lkml.kernel.org/r/20200810083004.26420-1-lukasz.luba@arm.com
(cherry picked from commit da0777d35f47892f359c3f73ea155870bb595700)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ib3e22c155eb031854cfb4428494c1c4da57692b1
Fix this link error:
ERROR: modpost: "rcu_idle_enter" [drivers/acpi/processor.ko] undefined!
ERROR: modpost: "rcu_idle_exit" [drivers/acpi/processor.ko] undefined!
when CONFIG_ACPI_PROCESSOR is built as module. PeterZ says that in light
of ARM needing those soon too, they should simply be exported.
Link: https://lore.kernel.org/linux-pm/20200921103741.GC5901@zn.tnic/
Bug: 172034763
Change-Id: I26d516d11edbce673f52df6474f6695c5a1e2b07
(cherry picked from commit 3ad1c8ef083bef96ec922688966484be1039e6b5)
Fixes: 1fecfdbb7acc ("ACPI: processor: Take over RCU-idle for C3-BM idle")
Reported-by: Sven Joachim <svenjoac@gmx.de>
Suggested-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Paul E. McKenney <paulmckrcu@kernel.org>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Cheng Jui Wang <cheng-jui.wang@mediatek.com>
Signed-off-by: Chun-Hung Wu <chun-hung.wu@mediatek.com>
Indirect calls can happen when RCU is not watching, so we need to wake
it up again for the CFI shadow and __module_address. As these calls can
happen anywhere, use rcu_nmi_enter() similarly to kernel_text_address(),
and switch to rcu_read_lock_sched() for shadow access.
Bug: 169017431
Change-Id: Iebb857df898e644b4952a62d86fa5ff9852b5711
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
This reverts commit db96212bde as it is
not needed if we are able to update the Android KABI.
Fixes: db96212bde ("ANDROID: GKI: fix ABI breakage in module.h")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ic6f4f449e554240457e1f94c49b53fa158f0d00e
For modifying load balance policy, we add the hook on
find_busiest_group().
It allows us to modify load balance paths.
Bug: 168248326
Signed-off-by: YT Chang <yt.chang@mediatek.com>
Change-Id: I77ec043576139806551b978eb1bdf9f637442dfb
(cherry picked from commit a2ca8408de6183364b4c17f341f06e875bc7a1c1)
(cherry picked from commit 489646b879ede582b6b00803edd3f777aede4d85)
The estimated utilization for a task:
util_est = max(util_avg, est.enqueue, est.ewma)
is defined based on:
- util_avg: the PELT defined utilization
- est.enqueued: the util_avg at the end of the last activation
- est.ewma: a exponential moving average on the est.enqueued samples
According to this definition, when a task suddenly changes its bandwidth
requirements from small to big, the EWMA will need to collect multiple
samples before converging up to track the new big utilization.
This slow convergence towards bigger utilization values is not
aligned to the default scheduler behavior, which is to optimize for
performance. Moreover, the est.ewma component fails to compensate for
temporarely utilization drops which spans just few est.enqueued samples.
To let util_est do a better job in the scenario depicted above, change
its definition by making util_est directly follow upward motion and
only decay the est.ewma on downward.
Bug: 120440300
Signed-off-by: Patrick Bellasi <patrick.bellasi@matbug.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: Vincent Guittot <vincent.guittot@linaro.org>
Cc: Dietmar Eggemann <dietmar.eggemann@arm.com>
Cc: Douglas Raillard <douglas.raillard@arm.com>
Cc: Juri Lelli <juri.lelli@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Quentin Perret <qperret@google.com>
Cc: Rafael J . Wysocki <rafael.j.wysocki@intel.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Link: https://lkml.kernel.org/r/20191023205630.14469-1-patrick.bellasi@matbug.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
(cherry picked from commit b8c96361402aa3e74ad48ceef18aed99153d8da8)
Signed-off-by: Qais Yousef <qais.yousef@arm.com>
Change-Id: Iaa75dec917748375d9043c3ebf21bf272299c8dd
Use rcu_read_lock_sched() & rcu_read_unlock_sched() to mark the
beginning & end of a RCU-sched critical section instead.
Bug: 171362096
Signed-off-by: Neal Liu <neal.liu@mediatek.com>
Change-Id: Idb40e2c2356621398e06944f7cb9b8bc5ef1d92a
commit 262e6ae7081d ("modules: inherit TAINT_PROPRIETARY_MODULE")
changes the size of 'struct module' a bit by adding a single boolean
value to the middle. Move things around a bit and take up a space to
preserve the abi so that nothing changes with the abi before that commit
was merged.
This might be able to be dropped at the next Android KABI "Break", if
one happens.
Bug: 171277690
Fixes: 262e6ae7081d ("modules: inherit TAINT_PROPRIETARY_MODULE")
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ie31a6fcea384ad665248c87f7abfde4d214da70a
If a TAINT_PROPRIETARY_MODULE exports symbol, inherit the taint flag
for all modules importing these symbols, and don't allow loading
symbols from TAINT_PROPRIETARY_MODULE modules if the module previously
imported gplonly symbols. Add a anti-circumvention devices so people
don't accidentally get themselves into trouble this way.
Comment from Greg:
"Ah, the proven-to-be-illegal "GPL Condom" defense :)"
Bug: 171277690
[jeyu: pr_info -> pr_err and pr_warn as per discussion]
Link: http://lore.kernel.org/r/20200730162957.GA22469@lst.de
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jessica Yu <jeyu@kernel.org>
(cherry picked from commit 262e6ae7081df304fc625cf368d5c2cbba2bb991)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Id7c1af6bb8523bc39bda1efc661929d9ea0ccb20
Report the GPLONLY status through a new argument.
Bug: 157965270
Bug: 171277690
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jessica Yu <jeyu@kernel.org>
(cherry picked from commit ef1dac6021cc8ec5de02ce31722bf26ac4ed5523)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I93285e06e380509b11356256da4d3d5a8738e252
Use the same spelling variant as the rest of the file.
Bug: 157965270
Bug: 171277690
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jessica Yu <jeyu@kernel.org>
(cherry picked from commit cd8732cdcc37d7077c4fa2c966b748c0662b607e)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I0ad6d1dcbe39053566bb922b9a71359f753df85c
each_symbol_section is only used inside of module.c.
Bug: 157965270
Bug: 171277690
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jessica Yu <jeyu@kernel.org>
(cherry picked from commit a54e04914c211b5678602a46b3ede5d82ec1327d)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I5debe30f150847281874d9b2c47952f9036d37d2
Declare war on uninterruptible sleep. Add a tracepoint which
walks the kernel stack and dumps the first non-scheduler function
called before the scheduler is invoked.
Bug: 120445457
Change-Id: I19e965d5206329360a92cbfe2afcc8c30f65c229
Signed-off-by: Riley Andrews <riandrews@google.com>
[astrachan: deleted an unnecessary whitespace change]
Signed-off-by: Alistair Strachan <astrachan@google.com>
Bug: 170916884
Signed-off-by: Todd Kjos <tkjos@google.com>
- Add the hook to provide additional information like
a task scheduling log.
Bug: 169374262
Signed-off-by: Sangmoon Kim <sangmoon.kim@samsung.com>
Change-Id: I203dbc6faa77687ea48769f76658d28b29ef46fd
With non-canonical CFI, LLVM generates jump table entries for external
symbols in modules and as a result, a function pointer passed from a
module to the core kernel will have a different address.
Disable the warning for now.
Bug: 145210207
Signed-off-by: Daniel Mentz <danielmentz@google.com>
Change-Id: I576a07206a465902773481e51a84529f0ac2e84b
- Add EXPORT_SYMBOL_GPL for find_task_by_vpid() so that drivers
can be loadable as a module.
- This API is required by loadable driver module from samsung to
read process related information based on pid and thread id.
To get information on when a certain process or thread was started,
duration of run, Average load contributed by it.
Signed-off-by: Abhilasha Rao <abhilasha.hv@samsung.corp-partner.google.com>
Bug: 158067689
Change-Id: I0db9cc50c93eedff0f3e9dea0ac09a5d17d118f0
(cherry picked from commit bee18dd57e89f4e7aa79f6054b9238b99e45c191)
- Add EXPORT_SYMBOL_GPL for runqueues().
- This API is required by loadable driver module,to get number of
jobs in the run queue (state R) or waiting for disk I/O (state D)
averaged over 1 min.
Signed-off-by: Abhilasha Rao <abhilasha.hv@samsung.corp-partner.google.com>
Bug: 158067689
Change-Id: I3e80a46bef2e7c92714b68cc5b6b617ac50bc478
(cherry picked from commit 6b0a9dc6df8d8be21c8d178a01e0711b0fe6ce73)
- Add EXPORT_SYMBOL_GPL for nsec_to_clock_t() so that drivers
be loadable as a module.
- This API is required by loadable driver module from samsung to
fetch process uptime based on CPU clock ticks to get the exact time
during which app is scheduled in user mode.
Signed-off-by: Abhilasha Rao <abhilasha.hv@samsung.corp-partner.google.com>
Bug: 158067689
Change-Id: I45be5fd7873dc7c21aa583313499f48f8b10bb1b
(cherry picked from commit 0575bec804810d9b8abf533c4ef4a957968553fc)
- Add EXPORT_SYMBOL_GPL for __lock_task_sighand()
- This API is required by loadable driver module from samsung to
Lock task structure, when reading task/process related information.
Signed-off-by: Abhilasha Rao <abhilasha.hv@samsung.corp-partner.google.com>
Bug: 158067689
Change-Id: Ia54e17b1f2630bcc648e7840cf36e743f08ba9c9
(cherry picked from commit a719abf03114cfc0b9f68937d9cd900d74d65cae)
- Add EXPORT_SYMBOL_GPL for thread_group_cputime_adjusted()
to allow drivers to be loadable as a module.
- This API is required by loadable driver module from samsung
to fetch process uptime based on CPU clock ticks to get the
exact duration of time app is scheduled in user mode.
Signed-off-by: Abhilasha Rao <abhilasha.hv@samsung.corp-partner.google.com>
Bug: 158067689
Change-Id: I1843de08edf5bb2eee806845f4b5e0a305da5fe7
(cherry picked from commit bf679b941237ae76d0bba8d98e670819e029847a)
- Add EXPORT_SYMBOL_GPL for get_avenrun() so that drivers
be loadable as a module.
- This API is required by loadable driver module
to get Number of jobs in the run queue (state R) or waiting
for disk I/O(state D) averaged over 1 min.
Signed-off-by: Abhilasha Rao <abhilasha.hv@samsung.corp-partner.google.com>
Signed-off-by: Todd Kjos <tkjos@google.com>
Bug: 158067689
Change-Id: I56c12c908be068f78e16004df876be3bee0e7229
(cherry picked from commit 64ea6f327359a90eca8ec9fe2a8f0caba0188e45)
Similar to commit f683c8dc7f ("ANDROID: kallsyms: strip hashes from
static functions with ThinLTO and CFI"), since LLVM adds a hash to
static function names when CONFIG_THINLTO and CFI are enabled, callers
of kallsyms_lookup_name() which aren't aware of the additional suffix
will fail to find the symbol. One example is kprobes (both compiled
and the dynamic events) which rely on this to resolve the function
name to attach a kprobe/kretprobe to.
Address this by also calling the cleanup_symbol_name() helper from
kallsyms_lookup_name() when failing to match a symbol by name.
This will strip off the hash suffix, if any, and attempt the
strcmp() again.
Bug: 167595670
Change-Id: I4c79c818c29b4b82a94a5a7e86ae9783a41e853d
Signed-off-by: Jack Pham <jackp@codeaurora.org>
Currently __set_oom_adj loops through all processes in the system to
keep oom_score_adj and oom_score_adj_min in sync between processes
sharing their mm. This is done for any task with more that one mm_users,
which includes processes with multiple threads (sharing mm and signals).
However for such processes the loop is unnecessary because their signal
structure is shared as well.
Android updates oom_score_adj whenever a tasks changes its role
(background/foreground/...) or binds to/unbinds from a service, making
it more/less important. Such operation can happen frequently.
We noticed that updates to oom_score_adj became more expensive and after
further investigation found out that the patch mentioned in "Fixes"
introduced a regression. Using Pixel 4 with a typical Android workload,
write time to oom_score_adj increased from ~3.57us to ~362us. Moreover
this regression linearly depends on the number of multi-threaded
processes running on the system.
Mark the mm with a new MMF_MULTIPROCESS flag bit when task is created with
(CLONE_VM && !CLONE_THREAD && !CLONE_VFORK). Change __set_oom_adj to use
MMF_MULTIPROCESS instead of mm_users to decide whether oom_score_adj
update should be synchronized between multiple processes. To prevent
races between clone() and __set_oom_adj(), when oom_score_adj of the
process being cloned might be modified from userspace, we use
oom_adj_mutex. Its scope is changed to global. The combination of
(CLONE_VM && !CLONE_THREAD) is rarely used except for the case of vfork().
To prevent performance regressions of vfork(), we skip taking oom_adj_mutex
and setting MMF_MULTIPROCESS when CLONE_VFORK is specified. Clearing the
MMF_MULTIPROCESS flag (when the last process sharing the mm exits) is left
out of this patch to keep it simple and because it is believed that this
threading model is rare. Should there ever be a need for optimizing that
case as well, it can be done by hooking into the exit path, likely
following the mm_update_next_owner pattern.
With the combination of (CLONE_VM && !CLONE_THREAD && !CLONE_VFORK) being
quite rare, the regression is gone after the change is applied.
Fixes: 44a70adec9 ("mm, oom_adj: make sure processes sharing mm have same view of oom_score_adj")
Reported-by: Tim Murray <timmurray@google.com>
Debugged-by: Minchan Kim <minchan@kernel.org>
Suggested-by: Michal Hocko <mhocko@kernel.org>
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Bug: 168521639
Link: https://lore.kernel.org/linux-fsdevel/20200902012558.2335613-1-surenb@google.com/
[isaacm: upstream bound, no cherry-pick info because patch is in mm tree]
Change-Id: I20352a77815fbc358c36e686bb1503fdeea658ed
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
When sudden reset by watchdog occurs, kernel log is very helpful.
But the log has saved structure type in log_buf.
So we want to collect the log on runtime to string format at other
reserved memory.
Bug: 167766040
Change-Id: Ic9686acc7c284e2ab81395fb9cc076fafe142bf9
Signed-off-by: Changki Kim <changki.kim@samsung.com>
commit 11990a5bd7e558e9203c1070fc52fb6f0488e75b upstream.
The only-root-readable /sys/module/$module/sections/$section files
did not truncate their output to the available buffer size. While most
paths into the kernfs read handlers end up using PAGE_SIZE buffers,
it's possible to get there through other paths (e.g. splice, sendfile).
Actually limit the output to the "count" passed into the read function,
and report it back correctly. *sigh*
Reported-by: kernel test robot <lkp@intel.com>
Link: https://lore.kernel.org/lkml/20200805002015.GE23458@shao2-debian
Fixes: ed66f991bb19 ("module: Refactor section attr into bin attribute")
Cc: stable@vger.kernel.org
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Acked-by: Jessica Yu <jeyu@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Bug: 163100336
Cc: Saravana Kannan <saravanak@google.com
(cherry picked from commit 11990a5bd7e558e9203c1070fc52fb6f0488e75b)
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I61cd70ce32bf06a6ec1be971a60101729606cd32
This reverts commit d837f090a6 as the
ramdump tooling is now fixed.
Bug: 163100336
Cc: Saravana Kannan <saravanak@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I4d0917beb848563270343515c49e0d6ad055c917
This reverts commit ae8f7f7807 as the
ramdump tooling is now fixed.
Bug: 163100336
Cc: Saravana Kannan <saravanak@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I51d7b6ddb1e26602e53bf4fbfbfde72ca294246d
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAl9GIDoACgkQONu9yGCS
aT7WKw//W69xawVqio91JxxYoYEC6fpFANMoaGAJwfIOz88Kr3D5n6g4Ldbmzlwa
NlaJT1oTm7L9iWYdyBWUEKSau74o9yhiy1V7IGNuj2sS+N7mH3BJ6rAjiQxiCH7K
UuFtpg7MgSlX2L3x93IsauV+PxU0E0Em3hrLw7XS8tYCCURwlyoyhpNb/fcIbu4Z
m4iBC9p2b5WcsS0c7J4m9aT94TpXajBfMMQdrHiYqFxdeyXRK/0Auk/C4HFLH+7b
Xt+ZLF/fQguiXH1ZDDLAudVxfqRf6zz2zNNRzN8npsneIJGLqQ1Ty3FUW6z7EYq5
jHz3w+amXt/ijeoxqS+QJU3Vgz7LZUvclB3RTOGXouPUlQFAUzD5tA1kobiQUFVC
D7vl1NjLbAkjMkr4jWs8A1//CwLey2CvPumI507iamLpXh/TsrA3qkpRrB+FUGQn
2YdflclIr5UMIYio3e9Gwf3eQTYjujQU19cyKa0SzhvmaFS0CRUrpRH5h5dJHLBV
rTxvhkXEkAMFfTyDI7zsRmIBAd4RgsIqyikU8GGprWrRQemA/aXH0jillZUMtFxE
jWdlSpF7aUGTGKTki/CWdx7t58BOH+uzcjIBdLpQKJOm+GTwJ3n2Cfqzei8KVGML
pDcSlqV4C2DO9OxhB/PeRI2V6H0AzAPBiZCow2vsl+LXlM9qHMQ=
=gnUK
-----END PGP SIGNATURE-----
Merge 5.4.61 into android11-5.4
Changes in 5.4.61
Documentation/llvm: add documentation on building w/ Clang/LLVM
Documentation/llvm: fix the name of llvm-size
net: wan: wanxl: use allow to pass CROSS_COMPILE_M68k for rebuilding firmware
net: wan: wanxl: use $(M68KCC) instead of $(M68KAS) for rebuilding firmware
x86/boot: kbuild: allow readelf executable to be specified
kbuild: remove PYTHON2 variable
kbuild: remove AS variable
kbuild: replace AS=clang with LLVM_IAS=1
kbuild: support LLVM=1 to switch the default tools to Clang/LLVM
drm/vgem: Replace opencoded version of drm_gem_dumb_map_offset()
gfs2: Improve mmap write vs. punch_hole consistency
gfs2: Never call gfs2_block_zero_range with an open transaction
perf probe: Fix memory leakage when the probe point is not found
khugepaged: khugepaged_test_exit() check mmget_still_valid()
khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter()
bcache: avoid nr_stripes overflow in bcache_device_init()
btrfs: export helpers for subvolume name/id resolution
btrfs: don't show full path of bind mounts in subvol=
btrfs: return EROFS for BTRFS_FS_STATE_ERROR cases
btrfs: add wrapper for transaction abort predicate
ALSA: hda/realtek: Add quirk for Samsung Galaxy Flex Book
ALSA: hda/realtek: Add quirk for Samsung Galaxy Book Ion
can: j1939: transport: j1939_session_tx_dat(): fix use-after-free read in j1939_tp_txtimer()
can: j1939: socket: j1939_sk_bind(): make sure ml_priv is allocated
spi: Prevent adding devices below an unregistering controller
romfs: fix uninitialized memory leak in romfs_dev_read()
kernel/relay.c: fix memleak on destroy relay channel
uprobes: __replace_page() avoid BUG in munlock_vma_page()
mm: include CMA pages in lowmem_reserve at boot
mm, page_alloc: fix core hung in free_pcppages_bulk()
RDMA/hfi1: Correct an interlock issue for TID RDMA WRITE request
ext4: fix checking of directory entry validity for inline directories
jbd2: add the missing unlock_buffer() in the error path of jbd2_write_superblock()
scsi: zfcp: Fix use-after-free in request timeout handlers
drm/amdgpu/display: use GFP_ATOMIC in dcn20_validate_bandwidth_internal
drm/amd/display: Fix EDID parsing after resume from suspend
drm/amd/display: fix pow() crashing when given base 0
kthread: Do not preempt current task if it is going to call schedule()
opp: Enable resources again if they were disabled earlier
scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices
scsi: target: tcmu: Fix crash in tcmu_flush_dcache_range on ARM
media: budget-core: Improve exception handling in budget_register()
rtc: goldfish: Enable interrupt in set_alarm() when necessary
media: vpss: clean up resources in init
Input: psmouse - add a newline when printing 'proto' by sysfs
MIPS: Fix unable to reserve memory for Crash kernel
m68knommu: fix overwriting of bits in ColdFire V3 cache control
svcrdma: Fix another Receive buffer leak
xfs: fix inode quota reservation checks
drm/ttm: fix offset in VMAs with a pg_offs in ttm_bo_vm_access
jffs2: fix UAF problem
ceph: fix use-after-free for fsc->mdsc
swiotlb-xen: use vmalloc_to_page on vmalloc virt addresses
cpufreq: intel_pstate: Fix cpuinfo_max_freq when MSR_TURBO_RATIO_LIMIT is 0
scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases
virtio_ring: Avoid loop when vq is broken in virtqueue_poll
media: camss: fix memory leaks on error handling paths in probe
tools/testing/selftests/cgroup/cgroup_util.c: cg_read_strcmp: fix null pointer dereference
xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init
alpha: fix annotation of io{read,write}{16,32}be()
fs/signalfd.c: fix inconsistent return codes for signalfd4
ext4: fix potential negative array index in do_split()
ext4: don't allow overlapping system zones
netfilter: nf_tables: nft_exthdr: the presence return value should be little-endian
spi: stm32: fixes suspend/resume management
ASoC: q6afe-dai: mark all widgets registers as SND_SOC_NOPM
ASoC: q6routing: add dummy register read/write function
bpf: sock_ops sk access may stomp registers when dst_reg = src_reg
can: j1939: fix kernel-infoleak in j1939_sk_sock2sockaddr_can()
can: j1939: transport: j1939_simple_recv(): ignore local J1939 messages send not by J1939 stack
can: j1939: transport: add j1939_session_skb_find_by_offset() function
i40e: Set RX_ONLY mode for unicast promiscuous on VLAN
i40e: Fix crash during removing i40e driver
net: fec: correct the error path for regulator disable in probe
bonding: show saner speed for broadcast mode
can: j1939: fix support for multipacket broadcast message
can: j1939: cancel rxtimer on multipacket broadcast session complete
can: j1939: abort multipacket broadcast session when timeout occurs
can: j1939: add rxtimer for multipacket broadcast session
bonding: fix a potential double-unregister
s390/runtime_instrumentation: fix storage key handling
s390/ptrace: fix storage key handling
ASoC: msm8916-wcd-analog: fix register Interrupt offset
ASoC: intel: Fix memleak in sst_media_open
vfio/type1: Add proper error unwind for vfio_iommu_replay()
kvm: x86: Toggling CR4.SMAP does not load PDPTEs in PAE mode
kvm: x86: Toggling CR4.PKE does not load PDPTEs in PAE mode
Revert "scsi: qla2xxx: Disable T10-DIF feature with FC-NVMe during probe"
kconfig: qconf: do not limit the pop-up menu to the first row
kconfig: qconf: fix signal connection to invalid slots
efi: avoid error message when booting under Xen
Fix build error when CONFIG_ACPI is not set/enabled:
RDMA/bnxt_re: Do not add user qps to flushlist
afs: Fix NULL deref in afs_dynroot_depopulate()
ARM64: vdso32: Install vdso32 from vdso_install
bonding: fix active-backup failover for current ARP slave
net: ena: Prevent reset after device destruction
net: gemini: Fix missing free_netdev() in error path of gemini_ethernet_port_probe()
hv_netvsc: Fix the queue_mapping in netvsc_vf_xmit()
net: dsa: b53: check for timeout
powerpc/pseries: Do not initiate shutdown when system is running on UPS
efi: add missed destroy_workqueue when efisubsys_init fails
epoll: Keep a reference on files added to the check list
do_epoll_ctl(): clean the failure exits up a bit
mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible
xen: don't reschedule in preemption off sections
KVM: Pass MMU notifier range flags to kvm_unmap_hva_range()
KVM: arm64: Only reschedule if MMU_NOTIFIER_RANGE_BLOCKABLE is not set
Linux 5.4.61
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I316392535e50265bbcce6a56d3e10586d1ed29cc
commit 26c7295be0c5e6da3fa45970e9748be983175b1b upstream.
when we create a kthread with ktrhead_create_on_cpu(),the child thread
entry is ktread.c:ktrhead() which will be preempted by the parent after
call complete(done) while schedule() is not called yet,then the parent
will call wait_task_inactive(child) but the child is still on the runqueue,
so the parent will schedule_hrtimeout() for 1 jiffy,it will waste a lot of
time,especially on startup.
parent child
ktrhead_create_on_cpu()
wait_fo_completion(&done) -----> ktread.c:ktrhead()
|----- complete(done);--wakeup and preempted by parent
kthread_bind() <------------| |-> schedule();--dequeue here
wait_task_inactive(child) |
schedule_hrtimeout(1 jiffy) -|
So we hope the child just wakeup parent but not preempted by parent, and the
child is going to call schedule() soon,then the parent will not call
schedule_hrtimeout(1 jiffy) as the child is already dequeue.
The same issue for ktrhead_park()&&kthread_parkme().
This patch can save 120ms on rk312x startup with CONFIG_HZ=300.
Signed-off-by: Liang Chen <cl@rock-chips.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Link: https://lkml.kernel.org/r/20200306070133.18335-2-cl@rock-chips.com
Signed-off-by: Chanho Park <chanho61.park@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit c17c3dc9d08b9aad9a55a1e53f205187972f448e upstream.
syzbot crashed on the VM_BUG_ON_PAGE(PageTail) in munlock_vma_page(), when
called from uprobes __replace_page(). Which of many ways to fix it?
Settled on not calling when PageCompound (since Head and Tail are equals
in this context, PageCompound the usual check in uprobes.c, and the prior
use of FOLL_SPLIT_PMD will have cleared PageMlocked already).
Fixes: 5a52c9df62 ("uprobe: use FOLL_SPLIT_PMD instead of FOLL_SPLIT")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Acked-by: Song Liu <songliubraving@fb.com>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: <stable@vger.kernel.org> [5.4+]
Link: http://lkml.kernel.org/r/alpine.LSU.2.11.2008161338360.20413@eggly.anvils
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
