1. 22 Mar, 2020 9 commits
    • Vlastimil Babka's avatar
      mm, slub: prevent kmalloc_node crashes and memory leaks · 0715e6c5
      Vlastimil Babka authored
      Sachin reports [1] a crash in SLUB __slab_alloc():
      
        BUG: Kernel NULL pointer dereference on read at 0x000073b0
        Faulting instruction address: 0xc0000000003d55f4
        Oops: Kernel access of bad area, sig: 11 [#1]
        LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries
        Modules linked in:
        CPU: 19 PID: 1 Comm: systemd Not tainted 5.6.0-rc2-next-20200218-autotest #1
        NIP:  c0000000003d55f4 LR: c0000000003d5b94 CTR: 0000000000000000
        REGS: c0000008b37836d0 TRAP: 0300   Not tainted  (5.6.0-rc2-next-20200218-autotest)
        MSR:  8000000000009033 <SF,EE,ME,IR,DR,RI,LE>  CR: 24004844  XER: 00000000
        CFAR: c00000000000dec4 DAR: 00000000000073b0 DSISR: 40000000 IRQMASK: 1
        GPR00: c0000000003d5b94 c0000008b3783960 c00000000155d400 c0000008b301f500
        GPR04: 0000000000000dc0 0000000000000002 c0000000003443d8 c0000008bb398620
        GPR08: 00000008ba2f0000 0000000000000001 0000000000000000 0000000000000000
        GPR12: 0000000024004844 c00000001ec52a00 0000000000000000 0000000000000000
        GPR16: c0000008a1b20048 c000000001595898 c000000001750c18 0000000000000002
        GPR20: c000000001750c28 c000000001624470 0000000fffffffe0 5deadbeef0000122
        GPR24: 0000000000000001 0000000000000dc0 0000000000000002 c0000000003443d8
        GPR28: c0000008b301f500 c0000008bb398620 0000000000000000 c00c000002287180
        NIP ___slab_alloc+0x1f4/0x760
        LR __slab_alloc+0x34/0x60
        Call Trace:
          ___slab_alloc+0x334/0x760 (unreliable)
          __slab_alloc+0x34/0x60
          __kmalloc_node+0x110/0x490
          kvmalloc_node+0x58/0x110
          mem_cgroup_css_online+0x108/0x270
          online_css+0x48/0xd0
          cgroup_apply_control_enable+0x2ec/0x4d0
          cgroup_mkdir+0x228/0x5f0
          kernfs_iop_mkdir+0x90/0xf0
          vfs_mkdir+0x110/0x230
          do_mkdirat+0xb0/0x1a0
          system_call+0x5c/0x68
      
      This is a PowerPC platform with following NUMA topology:
      
        available: 2 nodes (0-1)
        node 0 cpus:
        node 0 size: 0 MB
        node 0 free: 0 MB
        node 1 cpus: 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31
        node 1 size: 35247 MB
        node 1 free: 30907 MB
        node distances:
        node   0   1
          0:  10  40
          1:  40  10
      
        possible numa nodes: 0-31
      
      This only happens with a mmotm patch "mm/memcontrol.c: allocate
      shrinker_map on appropriate NUMA node" [2] which effectively calls
      kmalloc_node for each possible node.  SLUB however only allocates
      kmem_cache_node on online N_NORMAL_MEMORY nodes, and relies on
      node_to_mem_node to return such valid node for other nodes since commit
      a561ce00 ("slub: fall back to node_to_mem_node() node if allocating
      on memoryless node").  This is however not true in this configuration
      where the _node_numa_mem_ array is not initialized for nodes 0 and 2-31,
      thus it contains zeroes and get_partial() ends up accessing
      non-allocated kmem_cache_node.
      
      A related issue was reported by Bharata (originally by Ramachandran) [3]
      where a similar PowerPC configuration, but with mainline kernel without
      patch [2] ends up allocating large amounts of pages by kmalloc-1k
      kmalloc-512.  This seems to have the same underlying issue with
      node_to_mem_node() not behaving as expected, and might probably also
      lead to an infinite loop with CONFIG_SLUB_CPU_PARTIAL [4].
      
      This patch should fix both issues by not relying on node_to_mem_node()
      anymore and instead simply falling back to NUMA_NO_NODE, when
      kmalloc_node(node) is attempted for a node that's not online, or has no
      usable memory.  The "usable memory" condition is also changed from
      node_present_pages() to N_NORMAL_MEMORY node state, as that is exactly
      the condition that SLUB uses to allocate kmem_cache_node structures.
      The check in get_partial() is removed completely, as the checks in
      ___slab_alloc() are now sufficient to prevent get_partial() being
      reached with an invalid node.
      
      [1] https://lore.kernel.org/linux-next/3381CD91-AB3D-4773-BA04-E7A072A63968@linux.vnet.ibm.com/
      [2] https://lore.kernel.org/linux-mm/fff0e636-4c36-ed10-281c-8cdb0687c839@virtuozzo.com/
      [3] https://lore.kernel.org/linux-mm/20200317092624.GB22538@in.ibm.com/
      [4] https://lore.kernel.org/linux-mm/088b5996-faae-8a56-ef9c-5b567125ae54@suse.cz/
      
      Fixes: a561ce00 ("slub: fall back to node_to_mem_node() node if allocating on memoryless node")
      Reported-by: default avatarSachin Sant <sachinp@linux.vnet.ibm.com>
      Reported-by: default avatarPUVICHAKRAVARTHY RAMACHANDRAN <puvichakravarthy@in.ibm.com>
      Signed-off-by: default avatarVlastimil Babka <vbabka@suse.cz>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Tested-by: default avatarSachin Sant <sachinp@linux.vnet.ibm.com>
      Tested-by: default avatarBharata B Rao <bharata@linux.ibm.com>
      Reviewed-by: default avatarSrikar Dronamraju <srikar@linux.vnet.ibm.com>
      Cc: Mel Gorman <mgorman@techsingularity.net>
      Cc: Michael Ellerman <mpe@ellerman.id.au>
      Cc: Michal Hocko <mhocko@kernel.org>
      Cc: Christopher Lameter <cl@linux.com>
      Cc: linuxppc-dev@lists.ozlabs.org
      Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
      Cc: Pekka Enberg <penberg@kernel.org>
      Cc: David Rientjes <rientjes@google.com>
      Cc: Kirill Tkhai <ktkhai@virtuozzo.com>
      Cc: Vlastimil Babka <vbabka@suse.cz>
      Cc: Nathan Lynch <nathanl@linux.ibm.com>
      Cc: <stable@vger.kernel.org>
      Link: http://lkml.kernel.org/r/20200320115533.9604-1-vbabka@suse.czDebugged-by: default avatarSrikar Dronamraju <srikar@linux.vnet.ibm.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      0715e6c5
    • Qian Cai's avatar
      mm/mmu_notifier: silence PROVE_RCU_LIST warnings · 63886bad
      Qian Cai authored
      It is safe to traverse mm->notifier_subscriptions->list either under
      SRCU read lock or mm->notifier_subscriptions->lock using
      hlist_for_each_entry_rcu().  Silence the PROVE_RCU_LIST false positives,
      for example,
      
        WARNING: suspicious RCU usage
        -----------------------------
        mm/mmu_notifier.c:484 RCU-list traversed in non-reader section!!
      
        other info that might help us debug this:
      
        rcu_scheduler_active = 2, debug_locks = 1
        3 locks held by libvirtd/802:
         #0: ffff9321e3f58148 (&mm->mmap_sem#2){++++}, at: do_mprotect_pkey+0xe1/0x3e0
         #1: ffffffff91ae6160 (mmu_notifier_invalidate_range_start){+.+.}, at: change_p4d_range+0x5fa/0x800
         #2: ffffffff91ae6e08 (srcu){....}, at: __mmu_notifier_invalidate_range_start+0x178/0x460
      
        stack backtrace:
        CPU: 7 PID: 802 Comm: libvirtd Tainted: G          I       5.6.0-rc6-next-20200317+ #2
        Hardware name: HP ProLiant BL460c Gen8, BIOS I31 11/02/2014
        Call Trace:
          dump_stack+0xa4/0xfe
          lockdep_rcu_suspicious+0xeb/0xf5
          __mmu_notifier_invalidate_range_start+0x3ff/0x460
          change_p4d_range+0x746/0x800
          change_protection+0x1df/0x300
          mprotect_fixup+0x245/0x3e0
          do_mprotect_pkey+0x23b/0x3e0
          __x64_sys_mprotect+0x51/0x70
          do_syscall_64+0x91/0xae8
          entry_SYSCALL_64_after_hwframe+0x49/0xb3
      Signed-off-by: default avatarQian Cai <cai@lca.pw>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarPaul E. McKenney <paulmck@kernel.org>
      Reviewed-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      Link: http://lkml.kernel.org/r/20200317175640.2047-1-cai@lca.pwSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      63886bad
    • Roman Penyaev's avatar
      epoll: fix possible lost wakeup on epoll_ctl() path · 1b53734b
      Roman Penyaev authored
      This fixes possible lost wakeup introduced by commit a218cc49.
      Originally modifications to ep->wq were serialized by ep->wq.lock, but
      in commit a218cc49 ("epoll: use rwlock in order to reduce
      ep_poll_callback() contention") a new rw lock was introduced in order to
      relax fd event path, i.e. callers of ep_poll_callback() function.
      
      After the change ep_modify and ep_insert (both are called on epoll_ctl()
      path) were switched to ep->lock, but ep_poll (epoll_wait) was using
      ep->wq.lock on wqueue list modification.
      
      The bug doesn't lead to any wqueue list corruptions, because wake up
      path and list modifications were serialized by ep->wq.lock internally,
      but actual waitqueue_active() check prior wake_up() call can be
      reordered with modifications of ep ready list, thus wake up can be lost.
      
      And yes, can be healed by explicit smp_mb():
      
        list_add_tail(&epi->rdlink, &ep->rdllist);
        smp_mb();
        if (waitqueue_active(&ep->wq))
      	wake_up(&ep->wp);
      
      But let's make it simple, thus current patch replaces ep->wq.lock with
      the ep->lock for wqueue modifications, thus wake up path always observes
      activeness of the wqueue correcty.
      
      Fixes: a218cc49 ("epoll: use rwlock in order to reduce ep_poll_callback() contention")
      Reported-by: default avatarMax Neunhoeffer <max@arangodb.com>
      Signed-off-by: default avatarRoman Penyaev <rpenyaev@suse.de>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Tested-by: default avatarMax Neunhoeffer <max@arangodb.com>
      Cc: Jakub Kicinski <kuba@kernel.org>
      Cc: Christopher Kohlhoff <chris.kohlhoff@clearpool.io>
      Cc: Davidlohr Bueso <dbueso@suse.de>
      Cc: Jason Baron <jbaron@akamai.com>
      Cc: Jes Sorensen <jes.sorensen@gmail.com>
      Cc: <stable@vger.kernel.org>	[5.1+]
      Link: http://lkml.kernel.org/r/20200214170211.561524-1-rpenyaev@suse.de
      References: https://bugzilla.kernel.org/show_bug.cgi?id=205933Bisected-by: default avatarMax Neunhoeffer <max@arangodb.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      1b53734b
    • Michal Hocko's avatar
      mm: do not allow MADV_PAGEOUT for CoW pages · 12e967fd
      Michal Hocko authored
      Jann has brought up a very interesting point [1].  While shared pages
      are excluded from MADV_PAGEOUT normally, CoW pages can be easily
      reclaimed that way.  This can lead to all sorts of hard to debug
      problems.  E.g.  performance problems outlined by Daniel [2].
      
      There are runtime environments where there is a substantial memory
      shared among security domains via CoW memory and a easy to reclaim way
      of that memory, which MADV_{COLD,PAGEOUT} offers, can lead to either
      performance degradation in for the parent process which might be more
      privileged or even open side channel attacks.
      
      The feasibility of the latter is not really clear to me TBH but there is
      no real reason for exposure at this stage.  It seems there is no real
      use case to depend on reclaiming CoW memory via madvise at this stage so
      it is much easier to simply disallow it and this is what this patch
      does.  Put it simply MADV_{PAGEOUT,COLD} can operate only on the
      exclusively owned memory which is a straightforward semantic.
      
      [1] http://lkml.kernel.org/r/CAG48ez0G3JkMq61gUmyQAaCq=_TwHbi1XKzWRooxZkv08PQKuw@mail.gmail.com
      [2] http://lkml.kernel.org/r/CAKOZueua_v8jHCpmEtTB6f3i9e2YnmX4mqdYVWhV4E=Z-n+zRQ@mail.gmail.com
      
      Fixes: 9c276cc6 ("mm: introduce MADV_COLD")
      Reported-by: default avatarJann Horn <jannh@google.com>
      Signed-off-by: default avatarMichal Hocko <mhocko@suse.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Acked-by: default avatarVlastimil Babka <vbabka@suse.cz>
      Cc: Minchan Kim <minchan@kernel.org>
      Cc: Daniel Colascione <dancol@google.com>
      Cc: Dave Hansen <dave.hansen@intel.com>
      Cc: "Joel Fernandes (Google)" <joel@joelfernandes.org>
      Cc: <stable@vger.kernel.org>
      Link: http://lkml.kernel.org/r/20200312082248.GS23944@dhcp22.suse.czSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      12e967fd
    • Chris Down's avatar
      mm, memcg: throttle allocators based on ancestral memory.high · e26733e0
      Chris Down authored
      Prior to this commit, we only directly check the affected cgroup's
      memory.high against its usage.  However, it's possible that we are being
      reclaimed as a result of hitting an ancestor memory.high and should be
      penalised based on that, instead.
      
      This patch changes memory.high overage throttling to use the largest
      overage in its ancestors when considering how many penalty jiffies to
      charge.  This makes sure that we penalise poorly behaving cgroups in the
      same way regardless of at what level of the hierarchy memory.high was
      breached.
      
      Fixes: 0e4b01df ("mm, memcg: throttle allocators when failing reclaim over memory.high")
      Reported-by: default avatarJohannes Weiner <hannes@cmpxchg.org>
      Signed-off-by: default avatarChris Down <chris@chrisdown.name>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Acked-by: default avatarJohannes Weiner <hannes@cmpxchg.org>
      Cc: Tejun Heo <tj@kernel.org>
      Cc: Michal Hocko <mhocko@kernel.org>
      Cc: Nathan Chancellor <natechancellor@gmail.com>
      Cc: Roman Gushchin <guro@fb.com>
      Cc: <stable@vger.kernel.org>	[5.4.x+]
      Link: http://lkml.kernel.org/r/8cd132f84bd7e16cdb8fde3378cdbf05ba00d387.1584036142.git.chris@chrisdown.nameSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e26733e0
    • Chris Down's avatar
      mm, memcg: fix corruption on 64-bit divisor in memory.high throttling · d397a45f
      Chris Down authored
      Commit 0e4b01df had a bunch of fixups to use the right division
      method.  However, it seems that after all that it still wasn't right --
      div_u64 takes a 32-bit divisor.
      
      The headroom is still large (2^32 pages), so on mundane systems you
      won't hit this, but this should definitely be fixed.
      
      Fixes: 0e4b01df ("mm, memcg: throttle allocators when failing reclaim over memory.high")
      Reported-by: default avatarJohannes Weiner <hannes@cmpxchg.org>
      Signed-off-by: default avatarChris Down <chris@chrisdown.name>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Acked-by: default avatarJohannes Weiner <hannes@cmpxchg.org>
      Cc: Tejun Heo <tj@kernel.org>
      Cc: Roman Gushchin <guro@fb.com>
      Cc: Michal Hocko <mhocko@kernel.org>
      Cc: Nathan Chancellor <natechancellor@gmail.com>
      Cc: <stable@vger.kernel.org>	[5.4.x+]
      Link: http://lkml.kernel.org/r/80780887060514967d414b3cd91f9a316a16ab98.1584036142.git.chris@chrisdown.nameSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d397a45f
    • Qian Cai's avatar
      page-flags: fix a crash at SetPageError(THP_SWAP) · d72520ad
      Qian Cai authored
      Commit bd4c82c2 ("mm, THP, swap: delay splitting THP after swapped
      out") supported writing THP to a swap device but forgot to upgrade an
      older commit df8c94d1 ("page-flags: define behavior of FS/IO-related
      flags on compound pages") which could trigger a crash during THP
      swapping out with DEBUG_VM_PGFLAGS=y,
      
        kernel BUG at include/linux/page-flags.h:317!
      
        page dumped because: VM_BUG_ON_PAGE(1 && PageCompound(page))
        page:fffff3b2ec3a8000 refcount:512 mapcount:0 mapping:000000009eb0338c index:0x7f6e58200 head:fffff3b2ec3a8000 order:9 compound_mapcount:0 compound_pincount:0
        anon flags: 0x45fffe0000d8454(uptodate|lru|workingset|owner_priv_1|writeback|head|reclaim|swapbacked)
      
        end_swap_bio_write()
          SetPageError(page)
            VM_BUG_ON_PAGE(1 && PageCompound(page))
      
        <IRQ>
        bio_endio+0x297/0x560
        dec_pending+0x218/0x430 [dm_mod]
        clone_endio+0xe4/0x2c0 [dm_mod]
        bio_endio+0x297/0x560
        blk_update_request+0x201/0x920
        scsi_end_request+0x6b/0x4b0
        scsi_io_completion+0x509/0x7e0
        scsi_finish_command+0x1ed/0x2a0
        scsi_softirq_done+0x1c9/0x1d0
        __blk_mqnterrupt+0xf/0x20
        </IRQ>
      
      Fix by checking PF_NO_TAIL in those places instead.
      
      Fixes: bd4c82c2 ("mm, THP, swap: delay splitting THP after swapped out")
      Signed-off-by: default avatarQian Cai <cai@lca.pw>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
      Acked-by: default avatar"Huang, Ying" <ying.huang@intel.com>
      Acked-by: default avatarRafael Aquini <aquini@redhat.com>
      Cc: <stable@vger.kernel.org>
      Link: http://lkml.kernel.org/r/20200310235846.1319-1-cai@lca.pwSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d72520ad
    • Baoquan He's avatar
      mm/hotplug: fix hot remove failure in SPARSEMEM|!VMEMMAP case · d41e2f3b
      Baoquan He authored
      In section_deactivate(), pfn_to_page() doesn't work any more after
      ms->section_mem_map is resetting to NULL in SPARSEMEM|!VMEMMAP case.  It
      causes a hot remove failure:
      
        kernel BUG at mm/page_alloc.c:4806!
        invalid opcode: 0000 [#1] SMP PTI
        CPU: 3 PID: 8 Comm: kworker/u16:0 Tainted: G        W         5.5.0-next-20200205+ #340
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.0.0 02/06/2015
        Workqueue: kacpi_hotplug acpi_hotplug_work_fn
        RIP: 0010:free_pages+0x85/0xa0
        Call Trace:
         __remove_pages+0x99/0xc0
         arch_remove_memory+0x23/0x4d
         try_remove_memory+0xc8/0x130
         __remove_memory+0xa/0x11
         acpi_memory_device_remove+0x72/0x100
         acpi_bus_trim+0x55/0x90
         acpi_device_hotplug+0x2eb/0x3d0
         acpi_hotplug_work_fn+0x1a/0x30
         process_one_work+0x1a7/0x370
         worker_thread+0x30/0x380
         kthread+0x112/0x130
         ret_from_fork+0x35/0x40
      
      Let's move the ->section_mem_map resetting after
      depopulate_section_memmap() to fix it.
      
      [akpm@linux-foundation.org: remove unneeded initialization, per David]
      Fixes: ba72b4c8 ("mm/sparsemem: support sub-section hotplug")
      Signed-off-by: default avatarBaoquan He <bhe@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Reviewed-by: default avatarPankaj Gupta <pankaj.gupta.linux@gmail.com>
      Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
      Acked-by: default avatarMichal Hocko <mhocko@suse.com>
      Cc: Wei Yang <richardw.yang@linux.intel.com>
      Cc: Oscar Salvador <osalvador@suse.de>
      Cc: Mike Rapoport <rppt@linux.ibm.com>
      Cc: <stable@vger.kernel.org>
      Link: http://lkml.kernel.org/r/20200307084229.28251-2-bhe@redhat.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d41e2f3b
    • Chunguang Xu's avatar
      memcg: fix NULL pointer dereference in __mem_cgroup_usage_unregister_event · 7d36665a
      Chunguang Xu authored
      An eventfd monitors multiple memory thresholds of the cgroup, closes them,
      the kernel deletes all events related to this eventfd.  Before all events
      are deleted, another eventfd monitors the memory threshold of this cgroup,
      leading to a crash:
      
        BUG: kernel NULL pointer dereference, address: 0000000000000004
        #PF: supervisor write access in kernel mode
        #PF: error_code(0x0002) - not-present page
        PGD 800000033058e067 P4D 800000033058e067 PUD 3355ce067 PMD 0
        Oops: 0002 [#1] SMP PTI
        CPU: 2 PID: 14012 Comm: kworker/2:6 Kdump: loaded Not tainted 5.6.0-rc4 #3
        Hardware name: LENOVO 20AWS01K00/20AWS01K00, BIOS GLET70WW (2.24 ) 05/21/2014
        Workqueue: events memcg_event_remove
        RIP: 0010:__mem_cgroup_usage_unregister_event+0xb3/0x190
        RSP: 0018:ffffb47e01c4fe18 EFLAGS: 00010202
        RAX: 0000000000000001 RBX: ffff8bb223a8a000 RCX: 0000000000000001
        RDX: 0000000000000001 RSI: ffff8bb22fb83540 RDI: 0000000000000001
        RBP: ffffb47e01c4fe48 R08: 0000000000000000 R09: 0000000000000010
        R10: 000000000000000c R11: 071c71c71c71c71c R12: ffff8bb226aba880
        R13: ffff8bb223a8a480 R14: 0000000000000000 R15: 0000000000000000
        FS:  0000000000000000(0000) GS:ffff8bb242680000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 0000000000000004 CR3: 000000032c29c003 CR4: 00000000001606e0
        Call Trace:
          memcg_event_remove+0x32/0x90
          process_one_work+0x172/0x380
          worker_thread+0x49/0x3f0
          kthread+0xf8/0x130
          ret_from_fork+0x35/0x40
        CR2: 0000000000000004
      
      We can reproduce this problem in the following ways:
      
      1. We create a new cgroup subdirectory and a new eventfd, and then we
         monitor multiple memory thresholds of the cgroup through this eventfd.
      
      2.  closing this eventfd, and __mem_cgroup_usage_unregister_event ()
         will be called multiple times to delete all events related to this
         eventfd.
      
      The first time __mem_cgroup_usage_unregister_event() is called, the
      kernel will clear all items related to this eventfd in thresholds->
      primary.
      
      Since there is currently only one eventfd, thresholds-> primary becomes
      empty, so the kernel will set thresholds-> primary and hresholds-> spare
      to NULL.  If at this time, the user creates a new eventfd and monitor
      the memory threshold of this cgroup, kernel will re-initialize
      thresholds-> primary.
      
      Then when __mem_cgroup_usage_unregister_event () is called for the
      second time, because thresholds-> primary is not empty, the system will
      access thresholds-> spare, but thresholds-> spare is NULL, which will
      trigger a crash.
      
      In general, the longer it takes to delete all events related to this
      eventfd, the easier it is to trigger this problem.
      
      The solution is to check whether the thresholds associated with the
      eventfd has been cleared when deleting the event.  If so, we do nothing.
      
      [akpm@linux-foundation.org: fix comment, per Kirill]
      Fixes: 907860ed ("cgroups: make cftype.unregister_event() void-returning")
      Signed-off-by: default avatarChunguang Xu <brookxu@tencent.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Acked-by: default avatarMichal Hocko <mhocko@suse.com>
      Acked-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
      Cc: <stable@vger.kernel.org>
      Link: http://lkml.kernel.org/r/077a6f67-aefa-4591-efec-f2f3af2b0b02@gmail.comSigned-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      7d36665a
  2. 21 Mar, 2020 1 commit
  3. 20 Mar, 2020 10 commits
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · 5ad0ec0b
      Linus Torvalds authored
      Pull arm64 fixes from Will Deacon:
      
       - Fix panic() when it occurs during secondary CPU startup
      
       - Fix "kpti=off" when KASLR is enabled
      
       - Fix howler in compat syscall table for vDSO clock_getres() fallback
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: compat: Fix syscall number of compat_clock_getres
        arm64: kpti: Fix "kpti=off" when KASLR is enabled
        arm64: smp: fix crash_smp_send_stop() behaviour
        arm64: smp: fix smp_send_stop() behaviour
      5ad0ec0b
    • Linus Torvalds's avatar
      Merge tag 'char-misc-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · f014d2b8
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are some small different driver fixes for 5.6-rc7:
      
         - binderfs fix, yet again
      
         - slimbus new device id added
      
         - hwtracing bugfixes for reported issues and a new device id
      
        All of these have been in linux-next with no reported issues"
      
      * tag 'char-misc-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        intel_th: pci: Add Elkhart Lake CPU support
        intel_th: Fix user-visible error codes
        intel_th: msu: Fix the unexpected state warning
        stm class: sys-t: Fix the use of time_after()
        slimbus: ngd: add v2.1.0 compatible
        binderfs: use refcount for binder control devices too
      f014d2b8
    • Linus Torvalds's avatar
      Merge tag 'staging-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 3bd14829
      Linus Torvalds authored
      Pull staging/IIO fixes from Greg KH:
       "Here are a number of small staging and IIO driver fixes for 5.6-rc7
      
        Nothing major here, just resolutions for some reported problems:
         - iio bugfixes for a number of different drivers
         - greybus loopback_test fixes
         - wfx driver fixes
      
        All of these have been in linux-next with no reported issues"
      
      * tag 'staging-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: rtl8188eu: Add device id for MERCUSYS MW150US v2
        staging: greybus: loopback_test: fix potential path truncations
        staging: greybus: loopback_test: fix potential path truncation
        staging: greybus: loopback_test: fix poll-mask build breakage
        staging: wfx: fix RCU usage between hif_join() and ieee80211_bss_get_ie()
        staging: wfx: fix RCU usage in wfx_join_finalize()
        staging: wfx: make warning about pending frame less scary
        staging: wfx: fix lines ending with a comma instead of a semicolon
        staging: wfx: fix warning about freeing in-use mutex during device unregister
        staging/speakup: fix get_word non-space look-ahead
        iio: ping: set pa_laser_ping_cfg in of_ping_match
        iio: chemical: sps30: fix missing triggered buffer dependency
        iio: st_sensors: remap SMO8840 to LIS2DH12
        iio: light: vcnl4000: update sampling periods for vcnl4040
        iio: light: vcnl4000: update sampling periods for vcnl4200
        iio: accel: adxl372: Set iio_chan BE
        iio: magnetometer: ak8974: Fix negative raw values in sysfs
        iio: trigger: stm32-timer: disable master mode when stopping
        iio: adc: stm32-dfsdm: fix sleep in atomic context
        iio: adc: at91-sama5d2_adc: fix differential channels in triggered mode
      3bd14829
    • Linus Torvalds's avatar
      Merge tag 'usb-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · b07c2e76
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are some small USB fixes for 5.6-rc7. And there's a thunderbolt
        driver fix thrown in for good measure as well.
      
        These fixes are:
         - new device ids for usb-serial drivers
         - thunderbolt error code fix
         - xhci driver fixes
         - typec fixes
         - cdc-acm driver fixes
         - chipidea driver fix
         - more USB quirks added for devices that need them.
      
        All of these have been in linux-next with no reported issues"
      
      * tag 'usb-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        USB: cdc-acm: fix rounding error in TIOCSSERIAL
        USB: cdc-acm: fix close_delay and closing_wait units in TIOCSSERIAL
        usb: quirks: add NO_LPM quirk for RTL8153 based ethernet adapters
        usb: chipidea: udc: fix sleeping function called from invalid context
        USB: serial: pl2303: add device-id for HP LD381
        USB: serial: option: add ME910G1 ECM composition 0x110b
        usb: host: xhci-plat: add a shutdown
        usb: typec: ucsi: displayport: Fix a potential race during registration
        usb: typec: ucsi: displayport: Fix NULL pointer dereference
        USB: Disable LPM on WD19's Realtek Hub
        usb: xhci: apply XHCI_SUSPEND_DELAY to AMD XHCI controller 1022:145c
        xhci: Do not open code __print_symbolic() in xhci trace events
        thunderbolt: Fix error code in tb_port_is_width_supported()
      b07c2e76
    • Linus Torvalds's avatar
      Merge tag 'tty-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · fa91418b
      Linus Torvalds authored
      Pull tty fixes from Greg KH:
       "Here are three small tty_io bugfixes for reported issues that Eric has
        resolved for 5.6-rc7
      
        All of these have been in linux-next with no reported issues"
      
      * tag 'tty-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        tty: fix compat TIOCGSERIAL checking wrong function ptr
        tty: fix compat TIOCGSERIAL leaking uninitialized memory
        tty: drop outdated comments about release_tty() locking
      fa91418b
    • Linus Torvalds's avatar
      Merge tag 'sound-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 12bf19c9
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "A few fixes covering the issues reported by syzkaller, a couple of
        fixes for the MIDI decoding bug, and a few usual HD-audio quirks.
      
        Some of them are about ALSA core stuff, but they are small fixes just
        for corner cases, and nothing thrilling"
      
      * tag 'sound-5.6-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
        ALSA: hda/realtek - Enable the headset of Acer N50-600 with ALC662
        ALSA: hda/realtek - Enable headset mic of Acer X2660G with ALC662
        ALSA: seq: oss: Fix running status after receiving sysex
        ALSA: seq: virmidi: Fix running status after receiving sysex
        ALSA: pcm: oss: Remove WARNING from snd_pcm_plug_alloc() checks
        ALSA: hda/realtek: Fix pop noise on ALC225
        ALSA: line6: Fix endless MIDI read loop
        ALSA: pcm: oss: Avoid plugin buffer overflow
      12bf19c9
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2020-03-20' of git://anongit.freedesktop.org/drm/drm · 69d3e5a5
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Hope you are well hiding out above the garage. A few amdgpu changes
        but nothing too major. I've had a wisdom tooth out this week so
        haven't been to on top of things, but all seems good.
      
        core:
         - fix lease warning
      
        i915:
         - Track active elements during dequeue
         - Fix failure to handle all MCR ranges
         - Revert unnecessary workaround
      
        amdgpu:
         - Pageflip fix
         - VCN clockgating fixes
         - GPR debugfs fix for umr
         - GPU reset fix
         - eDP fix for MBP
         - DCN2.x fix
      
        dw-hdmi:
         - fix AVI frame colorimetry
      
        komeda:
         - fix compiler warning
      
        bochs:
         - downgrade a binding failure to a warning"
      
      * tag 'drm-fixes-2020-03-20' of git://anongit.freedesktop.org/drm/drm:
        drm/amd/display: Fix pageflip event race condition for DCN.
        drm/amdgpu: fix typo for vcn2.5/jpeg2.5 idle check
        drm/amdgpu: fix typo for vcn2/jpeg2 idle check
        drm/amdgpu: fix typo for vcn1 idle check
        drm/lease: fix WARNING in idr_destroy
        drm/i915: Handle all MCR ranges
        Revert "drm/i915/tgl: Add extra hdc flush workaround"
        drm/i915/execlists: Track active elements during dequeue
        drm/bochs: downgrade pci_request_region failure from error to warning
        drm/amd/display: Add link_rate quirk for Apple 15" MBP 2017
        drm/amdgpu: add fbdev suspend/resume on gpu reset
        drm/amd/amdgpu: Fix GPR read from debugfs (v2)
        drm/amd/display: fix typos for dcn20_funcs and dcn21_funcs struct
        drm/komeda: mark PM functions as __maybe_unused
        drm/bridge: dw-hdmi: fix AVI frame colorimetry
      69d3e5a5
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2020-03-19' of... · 5366b96b
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2020-03-19' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
      
      drm/i915 fixes for v5.6-rc7:
      - Track active elements during dequeue
      - Fix failure to handle all MCR ranges
      - Revert unnecessary workaround
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Jani Nikula <jani.nikula@intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/877dzgepvu.fsf@intel.com
      5366b96b
    • Dave Airlie's avatar
      Merge tag 'amd-drm-fixes-5.6-2020-03-19' of... · 362b86a3
      Dave Airlie authored
      Merge tag 'amd-drm-fixes-5.6-2020-03-19' of git://people.freedesktop.org/~agd5f/linux into drm-fixes
      
      amd-drm-fixes-5.6-2020-03-19:
      
      amdgpu:
      - Pageflip fix
      - VCN clockgating fixes
      - GPR debugfs fix for umr
      - GPU reset fix
      - eDP fix for MBP
      - DCN2.x fix
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexdeucher@gmail.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20200319204054.1036478-1-alexander.deucher@amd.com
      362b86a3
    • Greg Kurz's avatar
      KVM: PPC: Fix kernel crash with PR KVM · 1d0c32ec
      Greg Kurz authored
      With PR KVM, shutting down a VM causes the host kernel to crash:
      
      [  314.219284] BUG: Unable to handle kernel data access on read at 0xc00800000176c638
      [  314.219299] Faulting instruction address: 0xc008000000d4ddb0
      cpu 0x0: Vector: 300 (Data Access) at [c00000036da077a0]
          pc: c008000000d4ddb0: kvmppc_mmu_pte_flush_all+0x68/0xd0 [kvm_pr]
          lr: c008000000d4dd94: kvmppc_mmu_pte_flush_all+0x4c/0xd0 [kvm_pr]
          sp: c00000036da07a30
         msr: 900000010280b033
         dar: c00800000176c638
       dsisr: 40000000
        current = 0xc00000036d4c0000
        paca    = 0xc000000001a00000   irqmask: 0x03   irq_happened: 0x01
          pid   = 1992, comm = qemu-system-ppc
      Linux version 5.6.0-master-gku+ (greg@palmb) (gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04)) #17 SMP Wed Mar 18 13:49:29 CET 2020
      enter ? for help
      [c00000036da07ab0] c008000000d4fbe0 kvmppc_mmu_destroy_pr+0x28/0x60 [kvm_pr]
      [c00000036da07ae0] c0080000009eab8c kvmppc_mmu_destroy+0x34/0x50 [kvm]
      [c00000036da07b00] c0080000009e50c0 kvm_arch_vcpu_destroy+0x108/0x140 [kvm]
      [c00000036da07b30] c0080000009d1b50 kvm_vcpu_destroy+0x28/0x80 [kvm]
      [c00000036da07b60] c0080000009e4434 kvm_arch_destroy_vm+0xbc/0x190 [kvm]
      [c00000036da07ba0] c0080000009d9c2c kvm_put_kvm+0x1d4/0x3f0 [kvm]
      [c00000036da07c00] c0080000009da760 kvm_vm_release+0x38/0x60 [kvm]
      [c00000036da07c30] c000000000420be0 __fput+0xe0/0x310
      [c00000036da07c90] c0000000001747a0 task_work_run+0x150/0x1c0
      [c00000036da07cf0] c00000000014896c do_exit+0x44c/0xd00
      [c00000036da07dc0] c0000000001492f4 do_group_exit+0x64/0xd0
      [c00000036da07e00] c000000000149384 sys_exit_group+0x24/0x30
      [c00000036da07e20] c00000000000b9d0 system_call+0x5c/0x68
      
      This is caused by a use-after-free in kvmppc_mmu_pte_flush_all()
      which dereferences vcpu->arch.book3s which was previously freed by
      kvmppc_core_vcpu_free_pr(). This happens because kvmppc_mmu_destroy()
      is called after kvmppc_core_vcpu_free() since commit ff030fdf
      ("KVM: PPC: Move kvm_vcpu_init() invocation to common code").
      
      The kvmppc_mmu_destroy() helper calls one of the following depending
      on the KVM backend:
      
      - kvmppc_mmu_destroy_hv() which does nothing (Book3s HV)
      
      - kvmppc_mmu_destroy_pr() which undoes the effects of
        kvmppc_mmu_init() (Book3s PR 32-bit)
      
      - kvmppc_mmu_destroy_pr() which undoes the effects of
        kvmppc_mmu_init() (Book3s PR 64-bit)
      
      - kvmppc_mmu_destroy_e500() which does nothing (BookE e500/e500mc)
      
      It turns out that this is only relevant to PR KVM actually. And both
      32 and 64 backends need vcpu->arch.book3s to be valid when calling
      kvmppc_mmu_destroy_pr(). So instead of calling kvmppc_mmu_destroy()
      from kvm_arch_vcpu_destroy(), call kvmppc_mmu_destroy_pr() at the
      beginning of kvmppc_core_vcpu_free_pr(). This is consistent with
      kvmppc_mmu_init() being the last call in kvmppc_core_vcpu_create_pr().
      
      For the same reason, if kvmppc_core_vcpu_create_pr() returns an
      error then this means that kvmppc_mmu_init() was either not called
      or failed, in which case kvmppc_mmu_destroy() should not be called.
      Drop the line in the error path of kvm_arch_vcpu_create().
      
      Fixes: ff030fdf ("KVM: PPC: Move kvm_vcpu_init() invocation to common code")
      Signed-off-by: default avatarGreg Kurz <groug@kaod.org>
      Reviewed-by: default avatarSean Christopherson <sean.j.christopherson@intel.com>
      Signed-off-by: default avatarMichael Ellerman <mpe@ellerman.id.au>
      Link: https://lore.kernel.org/r/158455341029.178873.15248663726399374882.stgit@bahia.lan
      1d0c32ec
  4. 19 Mar, 2020 9 commits
    • Mario Kleiner's avatar
      drm/amd/display: Fix pageflip event race condition for DCN. · eb916a5a
      Mario Kleiner authored
      Commit '16f17eda ("drm/amd/display: Send vblank and user
      events at vsartup for DCN")' introduces a new way of pageflip
      completion handling for DCN, and some trouble.
      
      The current implementation introduces a race condition, which
      can cause pageflip completion events to be sent out one vblank
      too early, thereby confusing userspace and causing flicker:
      
      prepare_flip_isr():
      
      1. Pageflip programming takes the ddev->event_lock.
      2. Sets acrtc->pflip_status == AMDGPU_FLIP_SUBMITTED
      3. Releases ddev->event_lock.
      
      --> Deadline for surface address regs double-buffering passes on
          target pipe.
      
      4. dc_commit_updates_for_stream() MMIO programs the new pageflip
         into hw, but too late for current vblank.
      
      => pflip_status == AMDGPU_FLIP_SUBMITTED, but flip won't complete
         in current vblank due to missing the double-buffering deadline
         by a tiny bit.
      
      5. VSTARTUP trigger point in vblank is reached, VSTARTUP irq fires,
         dm_dcn_crtc_high_irq() gets called.
      
      6. Detects pflip_status == AMDGPU_FLIP_SUBMITTED and assumes the
         pageflip has been completed/will complete in this vblank and
         sends out pageflip completion event to userspace and resets
         pflip_status = AMDGPU_FLIP_NONE.
      
      => Flip completion event sent out one vblank too early.
      
      This behaviour has been observed during my testing with measurement
      hardware a couple of time.
      
      The commit message says that the extra flip event code was added to
      dm_dcn_crtc_high_irq() to prevent missing to send out pageflip events
      in case the pflip irq doesn't fire, because the "DCH HUBP" component
      is clock gated and doesn't fire pflip irqs in that state. Also that
      this clock gating may happen if no planes are active. This suggests
      that the problem addressed by that commit can't happen if planes
      are active.
      
      The proposed solution is therefore to only execute the extra pflip
      completion code iff the count of active planes is zero and otherwise
      leave pflip completion handling to the pflip irq handler, for a
      more race-free experience.
      
      Note that i don't know if this fixes the problem the original commit
      tried to address, as i don't know what the test scenario was. It
      does fix the observed too early pageflip events though and points
      out the problem introduced.
      
      Fixes: 16f17eda ("drm/amd/display: Send vblank and user events at vsartup for DCN")
      Reviewed-by: default avatarNicholas Kazlauskas <nicholas.kazlauskas@amd.com>
      Signed-off-by: default avatarMario Kleiner <mario.kleiner.de@gmail.com>
      Signed-off-by: default avatarAlex Deucher <alexander.deucher@amd.com>
      eb916a5a
    • Linus Torvalds's avatar
      Merge tag 'mmc-v5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · 6c90b86a
      Linus Torvalds authored
      Pull MMC fixes from Ulf Hansson:
      
       - rtsx_pci: Fix support for some various speed modes
      
       - sdhci-of-at91: Fix support for GPIO card detect on SAMA5D2
      
       - sdhci-cadence: Fix support for DDR52 speed mode for eMMC on UniPhier
      
       - sdhci-acpi: Fix broken WP support on Acer Aspire Switch 10
      
       - sdhci-acpi: Workaround FW bug for suspend on Lenovo Miix 320
      
      * tag 'mmc-v5.6-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        mmc: rtsx_pci: Fix support for speed-modes that relies on tuning
        mmc: sdhci-of-at91: fix cd-gpios for SAMA5D2
        mmc: sdhci-cadence: set SDHCI_QUIRK2_PRESET_VALUE_BROKEN for UniPhier
        mmc: sdhci-acpi: Disable write protect detection on Acer Aspire Switch 10 (SW5-012)
        mmc: sdhci-acpi: Switch signal voltage back to 3.3V on suspend on external microSD on Lenovo Miix 320
      6c90b86a
    • Vincenzo Frascino's avatar
      arm64: compat: Fix syscall number of compat_clock_getres · 3568b889
      Vincenzo Frascino authored
      The syscall number of compat_clock_getres was erroneously set to 247
      (__NR_io_cancel!) instead of 264. This causes the vDSO fallback of
      clock_getres() to land on the wrong syscall for compat tasks.
      
      Fix the numbering.
      
      Cc: <stable@vger.kernel.org>
      Fixes: 53c489e1 ("arm64: compat: Add missing syscall numbers")
      Acked-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      Reviewed-by: default avatarNick Desaulniers <ndesaulniers@google.com>
      Signed-off-by: default avatarVincenzo Frascino <vincenzo.frascino@arm.com>
      Signed-off-by: default avatarWill Deacon <will@kernel.org>
      3568b889
    • Linus Torvalds's avatar
      Merge tag '5.6-rc6-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 · cd607737
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
       "Three small smb3 fixes, two for stable"
      
      * tag '5.6-rc6-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6:
        CIFS: fiemap: do not return EINVAL if get nothing
        CIFS: Increment num_remote_opens stats counter even in case of smb2_query_dir_first
        cifs: potential unintitliazed error code in cifs_getattr()
      cd607737
    • Linus Torvalds's avatar
      Merge tag 'kbuild-fixes-v5.6-3' of... · 207f75c4
      Linus Torvalds authored
      Merge tag 'kbuild-fixes-v5.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
      
      Pull Kbuild fixes from Masahiro Yamada:
      
       - fix __uint128_t capability test in Kconfig when GCC that defaults to
         32-bit is used to build the 64-bit kernel
      
       - suppress new noisy Clang warnings -Wpointer-to-enum-cast
      
       - move the namespace field in Module.symvers for the backward
         compatibility reason for the depmod tool
      
       - use available compression for initramdisk when INTRAMFS_SOURCE is
         defined, which was the original behavior
      
       - fix modpost to handle correct large section numbers when it refers to
         modversion CRCs and module namespaces
      
       - fix comments and documents
      
      * tag 'kbuild-fixes-v5.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
        scripts/kallsyms: fix wrong kallsyms_relative_base
        modpost: Get proper section index by get_secindex() instead of st_shndx
        initramfs: restore default compression behavior
        modpost: move the namespace field in Module.symvers last
        kbuild: Disable -Wpointer-to-enum-cast
        kbuild: doc: fix references to other documents
        int128: fix __uint128_t compiler test in Kconfig
        kconfig: introduce m32-flag and m64-flag
        kbuild: Fix inconsistent comment
      207f75c4
    • Corentin Labbe's avatar
      rtc: max8907: add missing select REGMAP_IRQ · 5d892919
      Corentin Labbe authored
      I have hit the following build error:
      
        armv7a-hardfloat-linux-gnueabi-ld: drivers/rtc/rtc-max8907.o: in function `max8907_rtc_probe':
        rtc-max8907.c:(.text+0x400): undefined reference to `regmap_irq_get_virq'
      
      max8907 should select REGMAP_IRQ
      
      Fixes: 94c01ab6 ("rtc: add MAX8907 RTC driver")
      Cc: stable <stable@vger.kernel.org>
      Signed-off-by: default avatarCorentin Labbe <clabbe@baylibre.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      5d892919
    • Mikhail Petrov's avatar
      scripts/kallsyms: fix wrong kallsyms_relative_base · 7883a143
      Mikhail Petrov authored
      There is the code in the read_symbol function in 'scripts/kallsyms.c':
      
      	if (is_ignored_symbol(name, type))
      		return NULL;
      
      	/* Ignore most absolute/undefined (?) symbols. */
      	if (strcmp(name, "_text") == 0)
      		_text = addr;
      
      But the is_ignored_symbol function returns true for name="_text" and
      type='A'. So the next condition is not executed and the _text variable
      is always zero.
      
      It makes the wrong kallsyms_relative_base symbol as a result of the code
      (CONFIG_KALLSYMS_BASE_RELATIVE is defined):
      
      	if (base_relative) {
      		output_label("kallsyms_relative_base");
      		output_address(relative_base);
      		printf("\n");
      	}
      
      Because the output_address function uses the _text variable.
      
      So the kallsyms_lookup function and all related functions in the kernel
      do not work properly. For example, the stack trace in oops:
      
       Call Trace:
       [aa095e58] [809feab8] kobj_ns_ops_tbl+0x7ff09ac8/0x7ff1c1c4 (unreliable)
       [aa095e98] [80002b64] kobj_ns_ops_tbl+0x7f50db74/0x80000010
       [aa095ef8] [809c3d24] kobj_ns_ops_tbl+0x7feced34/0x7ff1c1c4
       [aa095f28] [80002ed0] kobj_ns_ops_tbl+0x7f50dee0/0x80000010
       [aa095f38] [8000f238] kobj_ns_ops_tbl+0x7f51a248/0x80000010
      
      The right stack trace:
      
       Call Trace:
       [aa095e58] [809feab8] module_vdu_video_init+0x2fc/0x3bc (unreliable)
       [aa095e98] [80002b64] do_one_initcall+0x40/0x1f0
       [aa095ef8] [809c3d24] kernel_init_freeable+0x164/0x1d8
       [aa095f28] [80002ed0] kernel_init+0x14/0x124
       [aa095f38] [8000f238] ret_from_kernel_thread+0x14/0x1c
      
      [masahiroy@kernel.org:
      
      This issue happens on binutils <= 2.22
      The following commit fixed it:
      https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=d2667025dd30611514810c28bee9709e4623012a
      
      The symbol type of _text is 'T' on binutils >= 2.23
      The minimal supported binutils version for the kernel build is 2.21
      ]
      Signed-off-by: default avatarMikhail Petrov <Mikhail.Petrov@mir.dev>
      Signed-off-by: default avatarMasahiro Yamada <masahiroy@kernel.org>
      7883a143
    • Will Deacon's avatar
      arm64: kpti: Fix "kpti=off" when KASLR is enabled · c8355785
      Will Deacon authored
      Enabling KASLR forces the use of non-global page-table entries for kernel
      mappings, as this is a decision that we have to make very early on before
      mapping the kernel proper. When used in conjunction with the "kpti=off"
      command-line option, it is possible to use non-global kernel mappings but
      with the kpti trampoline disabled.
      
      Since commit 09e3c22a ("arm64: Use a variable to store non-global
      mappings decision"), arm64_kernel_unmapped_at_el0() reflects only the use of
      non-global mappings and does not take into account whether the kpti
      trampoline is enabled. This breaks context switching of the TPIDRRO_EL0
      register for 64-bit tasks, where the clearing of the register is deferred to
      the ret-to-user code, but it also breaks the ARM SPE PMU driver which
      helpfully recommends passing "kpti=off" on the command line!
      
      Report whether or not KPTI is actually enabled in
      arm64_kernel_unmapped_at_el0() and check the 'arm64_use_ng_mappings' global
      variable directly when determining the protection flags for kernel mappings.
      
      Cc: Mark Brown <broonie@kernel.org>
      Reported-by: default avatarHongbo Yao <yaohongbo@huawei.com>
      Tested-by: default avatarHongbo Yao <yaohongbo@huawei.com>
      Fixes: 09e3c22a ("arm64: Use a variable to store non-global mappings decision")
      Signed-off-by: default avatarWill Deacon <will@kernel.org>
      c8355785
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2020-03-18-1' of... · 0f08b315
      Dave Airlie authored
      Merge tag 'drm-misc-fixes-2020-03-18-1' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes
      
      - drm/lease: fix WARNING in idr_destroy
      - Fix AVI frame colorimetry in the dw-hdmi bridge.
      - Fix compiler warning in komeda by annotating functions as __maybe_unused.
      - Downgrade bochs pci_request_region failure from error to warning to
        workaround firmware fb.
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Maarten Lankhorst <maarten.lankhorst@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/7654ac39-deb8-c9ca-9fd5-ef77b2636380@linux.intel.com
      0f08b315
  5. 18 Mar, 2020 11 commits