1. 18 1月, 2017 1 次提交
  2. 12 1月, 2017 2 次提交
  3. 10 1月, 2017 1 次提交
  4. 09 1月, 2017 4 次提交
  5. 08 1月, 2017 1 次提交
    • J
      mm: workingset: fix use-after-free in shadow node shrinker · ea07b862
      Johannes Weiner 提交于
      Several people report seeing warnings about inconsistent radix tree
      nodes followed by crashes in the workingset code, which all looked like
      use-after-free access from the shadow node shrinker.
      
      Dave Jones managed to reproduce the issue with a debug patch applied,
      which confirmed that the radix tree shrinking indeed frees shadow nodes
      while they are still linked to the shadow LRU:
      
        WARNING: CPU: 2 PID: 53 at lib/radix-tree.c:643 delete_node+0x1e4/0x200
        CPU: 2 PID: 53 Comm: kswapd0 Not tainted 4.10.0-rc2-think+ #3
        Call Trace:
           delete_node+0x1e4/0x200
           __radix_tree_delete_node+0xd/0x10
           shadow_lru_isolate+0xe6/0x220
           __list_lru_walk_one.isra.4+0x9b/0x190
           list_lru_walk_one+0x23/0x30
           scan_shadow_nodes+0x2e/0x40
           shrink_slab.part.44+0x23d/0x5d0
           shrink_node+0x22c/0x330
           kswapd+0x392/0x8f0
      
      This is the WARN_ON_ONCE(!list_empty(&node->private_list)) placed in the
      inlined radix_tree_shrink().
      
      The problem is with 14b46879 ("mm: workingset: move shadow entry
      tracking to radix tree exceptional tracking"), which passes an update
      callback into the radix tree to link and unlink shadow leaf nodes when
      tree entries change, but forgot to pass the callback when reclaiming a
      shadow node.
      
      While the reclaimed shadow node itself is unlinked by the shrinker, its
      deletion from the tree can cause the left-most leaf node in the tree to
      be shrunk.  If that happens to be a shadow node as well, we don't unlink
      it from the LRU as we should.
      
      Consider this tree, where the s are shadow entries:
      
             root->rnode
                  |
             [0       n]
              |       |
           [s    ] [sssss]
      
      Now the shadow node shrinker reclaims the rightmost leaf node through
      the shadow node LRU:
      
             root->rnode
                  |
             [0        ]
              |
          [s     ]
      
      Because the parent of the deleted node is the first level below the
      root and has only one child in the left-most slot, the intermediate
      level is shrunk and the node containing the single shadow is put in
      its place:
      
             root->rnode
                  |
             [s        ]
      
      The shrinker again sees a single left-most slot in a first level node
      and thus decides to store the shadow in root->rnode directly and free
      the node - which is a leaf node on the shadow node LRU.
      
        root->rnode
             |
             s
      
      Without the update callback, the freed node remains on the shadow LRU,
      where it causes later shrinker runs to crash.
      
      Pass the node updater callback into __radix_tree_delete_node() in case
      the deletion causes the left-most branch in the tree to collapse too.
      
      Also add warnings when linked nodes are freed right away, rather than
      wait for the use-after-free when the list is scanned much later.
      
      Fixes: 14b46879 ("mm: workingset: move shadow entry tracking to radix tree exceptional tracking")
      Reported-by: NDave Chinner <david@fromorbit.com>
      Reported-by: NHugh Dickins <hughd@google.com>
      Reported-by: NAndrea Arcangeli <aarcange@redhat.com>
      Reported-and-tested-by: NDave Jones <davej@codemonkey.org.uk>
      Signed-off-by: NJohannes Weiner <hannes@cmpxchg.org>
      Cc: Christoph Hellwig <hch@lst.de>
      Cc: Chris Leech <cleech@redhat.com>
      Cc: Lee Duncan <lduncan@suse.com>
      Cc: Jan Kara <jack@suse.cz>
      Cc: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: Matthew Wilcox <mawilcox@linuxonhyperv.com>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      ea07b862
  6. 07 1月, 2017 2 次提交
  7. 06 1月, 2017 1 次提交
  8. 05 1月, 2017 5 次提交
  9. 04 1月, 2017 3 次提交
  10. 02 1月, 2017 2 次提交
  11. 31 12月, 2016 2 次提交
    • L
      iio: accel: st_accel: fix LIS3LV02 reading and scaling · 65e4345c
      Linus Walleij 提交于
      The LIS3LV02 has a special bit that need to be set to get the
      read values left aligned. Before this patch we get gibberish
      like this:
      
      iio_generic_buffer -a -c10 -n lis3lv02dl_accel
      (...)
      0.000000 -0.010042 -0.642688 19155832931907
      0.000000 -0.010042 -0.642688 19155858751073
      
      Which is because we read a raw value for 1g as 64 which is
      the nominal 1024 for 1g shifted 4 bits to the left by being
      right-aligned rather than left aligned.
      
      Since all other sensors are left aligned, add some code to
      set the special DAS (data alignment setting) bit to 1 so that
      the right value is now read like this:
      
      iio_generic_buffer -a -c10 -n lis3lv02dl_accel
      (...)
      0.000000 -0.147095 -10.120135 24761614364956
      -0.029419 -0.176514 -10.120135 24761631624540
      
      The scaling was weird as well: we have a gain of 1000 for 1g
      and 3000 for 6g. I don't even remember how I came up with the
      old values but they are wrong.
      
      Fixes: 3acddf74 ("iio: st-sensors: add support for lis3lv02d accelerometer")
      Cc: Lorenzo Bianconi <lorenzo.bianconi@st.com>
      Cc: Giuseppe Barba <giuseppe.barba@st.com>
      Cc: Denis Ciocca <denis.ciocca@st.com>
      Signed-off-by: NLinus Walleij <linus.walleij@linaro.org>
      Signed-off-by: NJonathan Cameron <jic23@kernel.org>
      65e4345c
    • D
      drm/cma-helper: simplify setup for drivers with ->dirty callbacks · b112481b
      Daniel Vetter 提交于
      If we store the fb funcs pointer, we can remove a bit of boilerplate.
      Also remove the _fbdev_ in the example code, since the fb_funcs->dirty
      callback has nothing to do with fbdev. It's a KMS feature, only
      used by the fbdev deferred_io support to implement flushing/upload.
      
      Cc: Noralf Trønnes <noralf@tronnes.org>
      Cc: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
      Reviewed-by: NLaurent Pinchart <laurent.pinchart@ideasonboard.com>
      [danvet: Move the misplaced kerneldoc change from a later patch to
      this one here.]
      Signed-off-by: NDaniel Vetter <daniel.vetter@intel.com>
      Link: http://patchwork.freedesktop.org/patch/msgid/1483044517-5770-11-git-send-email-daniel.vetter@ffwll.ch
      b112481b
  12. 30 12月, 2016 13 次提交
  13. 29 12月, 2016 1 次提交
  14. 28 12月, 2016 2 次提交