1. 05 Jun, 2018 7 commits
    • Josh Poimboeuf's avatar
      objtool: Fix "noreturn" detection for recursive sibling calls · 6bcf3b06
      Josh Poimboeuf authored
      commit 0afd0d9e upstream.
      
      Objtool has some crude logic for detecting static "noreturn" functions
      (aka "dead ends").  This is necessary for being able to correctly follow
      GCC code flow when such functions are called.
      
      It's remotely possible for two functions to call each other via sibling
      calls.  If they don't have RET instructions, objtool's noreturn
      detection logic goes into a recursive loop:
      
        drivers/char/ipmi/ipmi_ssif.o: warning: objtool: return_hosed_msg()+0x0: infinite recursion (objtool bug!)
        drivers/char/ipmi/ipmi_ssif.o: warning: objtool: deliver_recv_msg()+0x0: infinite recursion (objtool bug!)
      
      Instead of reporting an error in this case, consider the functions to be
      non-dead-ends.
      Reported-and-tested-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Signed-off-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
      Acked-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: David Laight <David.Laight@ACULAB.COM>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: damian <damian.tometzki@icloud.com>
      Link: http://lkml.kernel.org/r/7cc156408c5781a1f62085d352ced1fe39fe2f91.1525923412.git.jpoimboe@redhat.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      6bcf3b06
    • Josh Poimboeuf's avatar
      objtool: Detect RIP-relative switch table references, part 2 · 806a730c
      Josh Poimboeuf authored
      commit 7dec80cc upstream.
      
      With the following commit:
      
        fd35c88b ("objtool: Support GCC 8 switch tables")
      
      I added a "can't find switch jump table" warning, to stop covering up
      silent failures if add_switch_table() can't find anything.
      
      That warning found yet another bug in the objtool switch table detection
      logic.  For cases 1 and 2 (as described in the comments of
      find_switch_table()), the find_symbol_containing() check doesn't adjust
      the offset for RIP-relative switch jumps.
      
      Incidentally, this bug was already fixed for case 3 with:
      
        6f5ec299 ("objtool: Detect RIP-relative switch table references")
      
      However, that commit missed the fix for cases 1 and 2.
      
      The different cases are now starting to look more and more alike.  So
      fix the bug by consolidating them into a single case, by checking the
      original dynamic jump instruction in the case 3 loop.
      
      This also simplifies the code and makes it more robust against future
      switch table detection issues -- of which I'm sure there will be many...
      
      Switch table detection has been the most fragile area of objtool, by
      far.  I long for the day when we'll have a GCC plugin for annotating
      switch tables.  Linus asked me to delay such a plugin due to the
      flakiness of the plugin infrastructure in older versions of GCC, so this
      rickety code is what we're stuck with for now.  At least the code is now
      a little simpler than it was.
      Reported-by: default avatarkbuild test robot <lkp@intel.com>
      Signed-off-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/f400541613d45689086329432f3095119ffbc328.1526674218.git.jpoimboe@redhat.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      806a730c
    • Josh Poimboeuf's avatar
      objtool: Detect RIP-relative switch table references · afb5e5c8
      Josh Poimboeuf authored
      commit 6f5ec299 upstream.
      
      Typically a switch table can be found by detecting a .rodata access
      followed an indirect jump:
      
          1969:	4a 8b 0c e5 00 00 00 	mov    0x0(,%r12,8),%rcx
          1970:	00
      			196d: R_X86_64_32S	.rodata+0x438
          1971:	e9 00 00 00 00       	jmpq   1976 <dispc_runtime_suspend+0xb6a>
      			1972: R_X86_64_PC32	__x86_indirect_thunk_rcx-0x4
      
      Randy Dunlap reported a case (seen with GCC 4.8) where the .rodata
      access uses RIP-relative addressing:
      
          19bd:	48 8b 3d 00 00 00 00 	mov    0x0(%rip),%rdi        # 19c4 <dispc_runtime_suspend+0xbb8>
      			19c0: R_X86_64_PC32	.rodata+0x45c
          19c4:	e9 00 00 00 00       	jmpq   19c9 <dispc_runtime_suspend+0xbbd>
      			19c5: R_X86_64_PC32	__x86_indirect_thunk_rdi-0x4
      
      In this case the relocation addend needs to be adjusted accordingly in
      order to find the location of the switch table.
      
      The fix is for case 3 (as described in the comments), but also make the
      existing case 1 & 2 checks more precise by only adjusting the addend for
      R_X86_64_PC32 relocations.
      
      This fixes the following warnings:
      
        drivers/video/fbdev/omap2/omapfb/dss/dispc.o: warning: objtool: dispc_runtime_suspend()+0xbb8: sibling call from callable instruction with modified stack frame
        drivers/video/fbdev/omap2/omapfb/dss/dispc.o: warning: objtool: dispc_runtime_resume()+0xcc5: sibling call from callable instruction with modified stack frame
      Reported-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Signed-off-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/b6098294fd67afb69af8c47c9883d7a68bf0f8ea.1526305958.git.jpoimboe@redhat.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      afb5e5c8
    • Josh Poimboeuf's avatar
      objtool: Support GCC 8 switch tables · 2c26d578
      Josh Poimboeuf authored
      commit fd35c88b upstream.
      
      With GCC 8, some issues were found with the objtool switch table
      detection.
      
      1) In the .rodata section, immediately after the switch table, there can
         be another object which contains a pointer to the function which had
         the switch statement.  In this case objtool wrongly considers the
         function pointer to be part of the switch table.  Fix it by:
      
         a) making sure there are no pointers to the beginning of the
            function; and
      
         b) making sure there are no gaps in the switch table.
      
         Only the former was needed, the latter adds additional protection for
         future optimizations.
      
      2) In find_switch_table(), case 1 and case 2 are missing the check to
         ensure that the .rodata switch table data is anonymous, i.e. that it
         isn't already associated with an ELF symbol.  Fix it by adding the
         same find_symbol_containing() check which is used for case 3.
      
      This fixes the following warnings with GCC 8:
      
        drivers/block/virtio_blk.o: warning: objtool: virtio_queue_rq()+0x0: stack state mismatch: cfa1=7+8 cfa2=7+72
        net/ipv6/icmp.o: warning: objtool: icmpv6_rcv()+0x0: stack state mismatch: cfa1=7+8 cfa2=7+64
        drivers/usb/core/quirks.o: warning: objtool: quirks_param_set()+0x0: stack state mismatch: cfa1=7+8 cfa2=7+48
        drivers/mtd/nand/raw/nand_hynix.o: warning: objtool: hynix_nand_decode_id()+0x0: stack state mismatch: cfa1=7+8 cfa2=7+24
        drivers/mtd/nand/raw/nand_samsung.o: warning: objtool: samsung_nand_decode_id()+0x0: stack state mismatch: cfa1=7+8 cfa2=7+32
        drivers/gpu/drm/nouveau/nvkm/subdev/top/gk104.o: warning: objtool: gk104_top_oneinit()+0x0: stack state mismatch: cfa1=7+8 cfa2=7+64
      Reported-by: default avatarArnd Bergmann <arnd@arndb.de>
      Reported-by: default avatarkbuild test robot <lkp@intel.com>
      Signed-off-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
      Acked-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: David Laight <David.Laight@ACULAB.COM>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Randy Dunlap <rdunlap@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: damian <damian.tometzki@icloud.com>
      Link: http://lkml.kernel.org/r/20180510224849.xwi34d6tzheb5wgw@trebleSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      2c26d578
    • Josh Poimboeuf's avatar
      objtool: Support GCC 8's cold subfunctions · 1bea53df
      Josh Poimboeuf authored
      commit 13810435 upstream.
      
      GCC 8 moves a lot of unlikely code out of line to "cold" subfunctions in
      .text.unlikely.  Properly detect the new subfunctions and treat them as
      extensions of the original functions.
      
      This fixes a bunch of warnings like:
      
        kernel/cgroup/cgroup.o: warning: objtool: parse_cgroup_root_flags()+0x33: sibling call from callable instruction with modified stack frame
        kernel/cgroup/cgroup.o: warning: objtool: cgroup_addrm_files()+0x290: sibling call from callable instruction with modified stack frame
        kernel/cgroup/cgroup.o: warning: objtool: cgroup_apply_control_enable()+0x25b: sibling call from callable instruction with modified stack frame
        kernel/cgroup/cgroup.o: warning: objtool: rebind_subsystems()+0x325: sibling call from callable instruction with modified stack frame
      Reported-and-tested-by: default avatardamian <damian.tometzki@icloud.com>
      Reported-by: default avatarArnd Bergmann <arnd@arndb.de>
      Signed-off-by: default avatarJosh Poimboeuf <jpoimboe@redhat.com>
      Acked-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: David Laight <David.Laight@ACULAB.COM>
      Cc: Greg KH <gregkh@linuxfoundation.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Randy Dunlap <rdunlap@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Link: http://lkml.kernel.org/r/0965e7fcfc5f31a276f0c7f298ff770c19b68706.1525923412.git.jpoimboe@redhat.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      1bea53df
    • Hugh Dickins's avatar
      mm: fix the NULL mapping case in __isolate_lru_page() · b968dd76
      Hugh Dickins authored
      commit 145e1a71 upstream.
      
      George Boole would have noticed a slight error in 4.16 commit
      69d763fc ("mm: pin address_space before dereferencing it while
      isolating an LRU page").  Fix it, to match both the comment above it,
      and the original behaviour.
      
      Although anonymous pages are not marked PageDirty at first, we have an
      old habit of calling SetPageDirty when a page is removed from swap
      cache: so there's a category of ex-swap pages that are easily
      migratable, but were inadvertently excluded from compaction's async
      migration in 4.16.
      
      Link: http://lkml.kernel.org/r/alpine.LSU.2.11.1805302014001.12558@eggly.anvils
      Fixes: 69d763fc ("mm: pin address_space before dereferencing it while isolating an LRU page")
      Signed-off-by: default avatarHugh Dickins <hughd@google.com>
      Acked-by: default avatarMinchan Kim <minchan@kernel.org>
      Acked-by: default avatarMel Gorman <mgorman@techsingularity.net>
      Reported-by: default avatarIvan Kalvachev <ikalvachev@gmail.com>
      Cc: "Huang, Ying" <ying.huang@intel.com>
      Cc: Jan Kara <jack@suse.cz>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      b968dd76
    • Al Viro's avatar
      fix io_destroy()/aio_complete() race · 6a19487d
      Al Viro authored
      commit 4faa9996 upstream.
      
      If io_destroy() gets to cancelling everything that can be cancelled and
      gets to kiocb_cancel() calling the function driver has left in ->ki_cancel,
      it becomes vulnerable to a race with IO completion.  At that point req
      is already taken off the list and aio_complete() does *NOT* spin until
      we (in free_ioctx_users()) releases ->ctx_lock.  As the result, it proceeds
      to kiocb_free(), freing req just it gets passed to ->ki_cancel().
      
      Fix is simple - remove from the list after the call of kiocb_cancel().  All
      instances of ->ki_cancel() already have to cope with the being called with
      iocb still on list - that's what happens in io_cancel(2).
      
      Cc: stable@kernel.org
      Fixes: 0460fef2 "aio: use cancellation list lazily"
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      6a19487d
  2. 30 May, 2018 33 commits