1. 26 11月, 2016 3 次提交
  2. 25 11月, 2016 9 次提交
    • V
      mfd: wm8994-core: Don't use managed regulator bulk get API · 1a41741f
      Viresh Kumar 提交于
      The kernel WARNs and then crashes today if wm8994_device_init() fails
      after calling devm_regulator_bulk_get().
      
      That happens because there are multiple devices involved here and the
      order in which managed resources are freed isn't correct.
      
      The regulators are added as children of wm8994->dev.  Whereas,
      devm_regulator_bulk_get() receives wm8994->dev as the device, though it
      gets the same regulators which were added as children of wm8994->dev
      earlier.
      
      During failures, the children are removed first and the core eventually
      calls regulator_unregister() for them. As regulator_put() was never done
      for them (opposite of devm_regulator_bulk_get()), the kernel WARNs at
      
      	WARN_ON(rdev->open_count);
      
      And eventually it crashes from debugfs_remove_recursive().
      
      --------x------------------x----------------
      
       wm8994 3-001a: Device is not a WM8994, ID is 0
       ------------[ cut here ]------------
       WARNING: CPU: 0 PID: 1 at /mnt/ssd/all/work/repos/devel/linux/drivers/regulator/core.c:4072 regulator_unregister+0xc8/0xd0
       Modules linked in:
       CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.8.0-rc6-00154-g54fe84cbd50b #41
       Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
       [<c010e24c>] (unwind_backtrace) from [<c010af38>] (show_stack+0x10/0x14)
       [<c010af38>] (show_stack) from [<c032a1c4>] (dump_stack+0x88/0x9c)
       [<c032a1c4>] (dump_stack) from [<c011a98c>] (__warn+0xe8/0x100)
       [<c011a98c>] (__warn) from [<c011aa54>] (warn_slowpath_null+0x20/0x28)
       [<c011aa54>] (warn_slowpath_null) from [<c0384a0c>] (regulator_unregister+0xc8/0xd0)
       [<c0384a0c>] (regulator_unregister) from [<c0406434>] (release_nodes+0x16c/0x1dc)
       [<c0406434>] (release_nodes) from [<c04039c4>] (__device_release_driver+0x8c/0x110)
       [<c04039c4>] (__device_release_driver) from [<c0403a64>] (device_release_driver+0x1c/0x28)
       [<c0403a64>] (device_release_driver) from [<c0402b24>] (bus_remove_device+0xd8/0x104)
       [<c0402b24>] (bus_remove_device) from [<c03ffcd8>] (device_del+0x10c/0x218)
       [<c03ffcd8>] (device_del) from [<c0404e4c>] (platform_device_del+0x1c/0x88)
       [<c0404e4c>] (platform_device_del) from [<c0404ec4>] (platform_device_unregister+0xc/0x20)
       [<c0404ec4>] (platform_device_unregister) from [<c0428bc0>] (mfd_remove_devices_fn+0x5c/0x64)
       [<c0428bc0>] (mfd_remove_devices_fn) from [<c03ff9d8>] (device_for_each_child_reverse+0x4c/0x78)
       [<c03ff9d8>] (device_for_each_child_reverse) from [<c04288c4>] (mfd_remove_devices+0x20/0x30)
       [<c04288c4>] (mfd_remove_devices) from [<c042758c>] (wm8994_device_init+0x2ac/0x7f0)
       [<c042758c>] (wm8994_device_init) from [<c04f14a8>] (i2c_device_probe+0x178/0x1fc)
       [<c04f14a8>] (i2c_device_probe) from [<c04036fc>] (driver_probe_device+0x214/0x2c0)
       [<c04036fc>] (driver_probe_device) from [<c0403854>] (__driver_attach+0xac/0xb0)
       [<c0403854>] (__driver_attach) from [<c0401a74>] (bus_for_each_dev+0x68/0x9c)
       [<c0401a74>] (bus_for_each_dev) from [<c0402cf0>] (bus_add_driver+0x1a0/0x218)
       [<c0402cf0>] (bus_add_driver) from [<c040406c>] (driver_register+0x78/0xf8)
       [<c040406c>] (driver_register) from [<c04f20a0>] (i2c_register_driver+0x34/0x84)
       [<c04f20a0>] (i2c_register_driver) from [<c01017d0>] (do_one_initcall+0x40/0x170)
       [<c01017d0>] (do_one_initcall) from [<c0a00dbc>] (kernel_init_freeable+0x15c/0x1fc)
       [<c0a00dbc>] (kernel_init_freeable) from [<c06e07b0>] (kernel_init+0x8/0x114)
       [<c06e07b0>] (kernel_init) from [<c0107978>] (ret_from_fork+0x14/0x3c)
       ---[ end trace 0919d3d0bc998260 ]---
      
       [snip..]
      
       Unable to handle kernel NULL pointer dereference at virtual address 00000078
       pgd = c0004000
       [00000078] *pgd=00000000
       Internal error: Oops: 5 [#1] PREEMPT SMP ARM
       Modules linked in:
       CPU: 0 PID: 1 Comm: swapper/0 Tainted: G        W       4.8.0-rc6-00154-g54fe84cbd50b #41
       Hardware name: SAMSUNG EXYNOS (Flattened Device Tree)
       task: ee874000 task.stack: ee878000
       PC is at down_write+0x14/0x54
       LR is at debugfs_remove_recursive+0x30/0x150
      
       [snip..]
      
       [<c06e489c>] (down_write) from [<c02e9954>] (debugfs_remove_recursive+0x30/0x150)
       [<c02e9954>] (debugfs_remove_recursive) from [<c0382b78>] (_regulator_put+0x24/0xac)
       [<c0382b78>] (_regulator_put) from [<c0382c1c>] (regulator_put+0x1c/0x2c)
       [<c0382c1c>] (regulator_put) from [<c0406434>] (release_nodes+0x16c/0x1dc)
       [<c0406434>] (release_nodes) from [<c04035d4>] (driver_probe_device+0xec/0x2c0)
       [<c04035d4>] (driver_probe_device) from [<c0403854>] (__driver_attach+0xac/0xb0)
       [<c0403854>] (__driver_attach) from [<c0401a74>] (bus_for_each_dev+0x68/0x9c)
       [<c0401a74>] (bus_for_each_dev) from [<c0402cf0>] (bus_add_driver+0x1a0/0x218)
       [<c0402cf0>] (bus_add_driver) from [<c040406c>] (driver_register+0x78/0xf8)
       [<c040406c>] (driver_register) from [<c04f20a0>] (i2c_register_driver+0x34/0x84)
       [<c04f20a0>] (i2c_register_driver) from [<c01017d0>] (do_one_initcall+0x40/0x170)
       [<c01017d0>] (do_one_initcall) from [<c0a00dbc>] (kernel_init_freeable+0x15c/0x1fc)
       [<c0a00dbc>] (kernel_init_freeable) from [<c06e07b0>] (kernel_init+0x8/0x114)
       [<c06e07b0>] (kernel_init) from [<c0107978>] (ret_from_fork+0x14/0x3c)
       Code: e1a04000 f590f000 e3a03001 e34f3fff (e1902f9f)
       ---[ end trace 0919d3d0bc998262 ]---
      
      --------x------------------x----------------
      
      Fix the kernel warnings and crashes by using regulator_bulk_get()
      instead of devm_regulator_bulk_get() and explicitly freeing the supplies
      in exit paths.
      
      Tested on Exynos 5250, dual core ARM A15 machine.
      Signed-off-by: NViresh Kumar <viresh.kumar@linaro.org>
      Acked-by: NCharles Keepax <ckeepax@opensource.wolfsonmicro.com>
      Signed-off-by: NLee Jones <lee.jones@linaro.org>
      1a41741f
    • V
      mfd: wm8994-core: Disable regulators before removing them · 3cfc43df
      Viresh Kumar 提交于
      The order in which resources were freed in wm8994_device_exit() isn't
      correct. The regulators are removed before they are disabled.
      
      Fix it by reordering code a bit, which makes it exact opposite of
      wm8994_device_init() as well.
      Signed-off-by: NViresh Kumar <viresh.kumar@linaro.org>
      Acked-by: NCharles Keepax <ckeepax@opensource.wolfsonmicro.com>
      Signed-off-by: NLee Jones <lee.jones@linaro.org>
      3cfc43df
    • P
      mfd: syscon: Support native-endian regmaps · d29ccdb3
      Paul Burton 提交于
      The regmap devicetree binding documentation states that a native-endian
      property should be supported as well as big-endian & little-endian,
      however syscon in its duplication of the parsing of these properties
      omits support for native-endian. Fix this by setting
      REGMAP_ENDIAN_NATIVE when a native-endian property is found.
      Signed-off-by: NPaul Burton <paul.burton@imgtec.com>
      Cc: Lee Jones <lee.jones@linaro.org>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Guenter Roeck <linux@roeck-us.net>
      Cc: Ralf Baechle <ralf@linux-mips.org>
      Cc: linux-mips@linux-mips.org
      Signed-off-by: NLee Jones <lee.jones@linaro.org>
      d29ccdb3
    • D
      Merge branch 'mediatek-drm-fixes-2016-11-24' of... · 9704668e
      Dave Airlie 提交于
      Merge branch 'mediatek-drm-fixes-2016-11-24' of https://github.com/ckhu-mediatek/linux.git-tags into drm-fixes
      
      This branch include patches of fixing a typo, accurate dsi frame rate,
      and fixing null pointer dereference.
      
      * 'mediatek-drm-fixes-2016-11-24' of https://github.com/ckhu-mediatek/linux.git-tags:
        drm/mediatek: fix null pointer dereference
        drm/mediatek: fixed the calc method of data rate per lane
        drm/mediatek: fix a typo of DISP_OD_CFG to OD_RELAYMODE
      9704668e
    • A
      gpu/drm/exynos/exynos_hdmi - Unmap region obtained by of_iomap · d7420002
      Arvind Yadav 提交于
      Free memory mapping, if hdmi_probe is not successful.
      Signed-off-by: NArvind Yadav <arvind.yadav.cs@gmail.com>
      Signed-off-by: NInki Dae <inki.dae@samsung.com>
      Signed-off-by: NDave Airlie <airlied@redhat.com>
      d7420002
    • L
      Merge tag 'mmc-v4.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc · 16ae16c6
      Linus Torvalds 提交于
      Pull MMC fixes from Ulf Hansson:
       "MMC host:
      
         - sdhci-of-esdhc: Fix card detection
         - dw_mmc: Fix DMA error path"
      
      * tag 'mmc-v4.9-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
        mmc: dw_mmc: fix the error handling for dma operation
        mmc: sdhci-of-esdhc: fixup PRESENT_STATE read
      16ae16c6
    • L
      Merge tag 'usb-4.9-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · bae73e80
      Linus Torvalds 提交于
      Pull USB fixes from Greg KH:
       "Here are a few small USB fixes and new device ids for 4.9-rc7.
      
        The majority of these fixes are in the musb driver, fixing a number of
        regressions that have been reported but took a while to resolve. The
        other fixes are all small ones, to resolve other reported minor
        issues.
      
        All have been in linux-next for a while with no reported issues"
      
      * tag 'usb-4.9-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        usb: gadget: f_fs: fix wrong parenthesis in ffs_func_req_match()
        phy: twl4030-usb: Fix for musb session bit based PM
        usb: musb: Drop pointless PM runtime code for dsps glue
        usb: musb: Add missing pm_runtime_disable and drop 2430 PM timeout
        usb: musb: Fix PM for hub disconnect
        usb: musb: Fix sleeping function called from invalid context for hdrc glue
        usb: musb: Fix broken use of static variable for multiple instances
        USB: serial: cp210x: add ID for the Zone DPMX
        usb: chipidea: move the lock initialization to core file
        Fix USB CB/CBI storage devices with CONFIG_VMAP_STACK=y
        USB: serial: ftdi_sio: add support for TI CC3200 LaunchPad
      bae73e80
    • L
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid · e2b6535d
      Linus Torvalds 提交于
      Pull HID fixes from Jiri Kosina:
      
       - DMA-on-stack fixes for a couple drivers, from Benjamin Tissoires
      
       - small memory sanitization fix for sensor-hub driver, from Song
         Hongyan
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
        HID: hid-sensor-hub: clear memory to avoid random data
        HID: rmi: make transfer buffers DMA capable
        HID: magicmouse: make transfer buffers DMA capable
        HID: lg: make transfer buffers DMA capable
        HID: cp2112: make transfer buffers DMA capable
      e2b6535d
    • N
      init: use pr_cont() when displaying rotator during ramdisk loading. · 18594e9b
      Nicolas Schichan 提交于
      Otherwise each individual rotator char would be printed in a new line:
      
      (...)
      [    0.642350] -
      [    0.644374] |
      [    0.646367] -
      (...)
      Signed-off-by: NNicolas Schichan <nicolas.schichan@gmail.com>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      18594e9b
  3. 24 11月, 2016 17 次提交
  4. 23 11月, 2016 7 次提交
    • L
      Merge branch 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 · 23aabe73
      Linus Torvalds 提交于
      Pull crypto fixes from Herbert Xu:
       "The last push broke algif_hash for all shash implementations, so this
        is a follow-up to fix that.
      
        This also fixes a problem in the crypto scatterwalk that triggers a
        BUG_ON with certain debugging options due to the new vmalloced-stack
        code"
      
      * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
        crypto: scatterwalk - Remove unnecessary aliasing check in map_and_copy
        crypto: algif_hash - Fix result clobbering in recvmsg
      23aabe73
    • L
      Merge branch 'for-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux · 23400ac9
      Linus Torvalds 提交于
      Pull thermal management fix from Zhang Rui:
       "We only have one urgent fix this time.
      
        Commit 3105f234 ("thermal/powerclamp: correct cpu support check"),
        which is shipped in 4.9-rc3, fixed a problem introduced by commit
        b721ca0d ("thermal/powerclamp: remove cpu whitelist").
      
        But unfortunately, it broke intel_powerclamp driver module auto-
        loading at the same time. Thus we need this change to add back module
        auto-loading for 4.9"
      
      * 'for-rc' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux:
        thermal/powerclamp: add back module device table
      23400ac9
    • L
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · b66c08ba
      Linus Torvalds 提交于
      Pull SCSI fixes from James Bottomley:
       "Two small fixes.
      
        One prevents timeouts on mpt3sas when trying to use the secure erase
        protocol which causes the erase protocol to be aborted. The second is
        a regression in a prior fix which causes all commands to abort during
        PCI extended error recovery, which is incorrect because PCI EEH is
        independent from what's happening on the FC transport"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: qla2xxx: do not abort all commands in the adapter during EEH recovery
        scsi: mpt3sas: Fix secure erase premature termination
      b66c08ba
    • L
      Merge tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux · 57527ed1
      Linus Torvalds 提交于
      Pull clk fixes from Stephen Boyd:
       "A handful of driver fixes.
      
        The sunxi fixes are for an incorrect clk tree configuration and a bad
        frequency calculation. The other two are fixes for passing the wrong
        pointer in drivers recently converted to clk_hw style registration"
      
      * tag 'clk-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux:
        clk: efm32gg: Pass correct type to hw provider registration
        clk: berlin: Pass correct type to hw provider registration
        clk: sunxi: Fix M factor computation for APB1
        clk: sunxi-ng: sun6i-a31: Force AHB1 clock to use PLL6 as parent
      57527ed1
    • A
      NFSv4.x: hide array-bounds warning · d55b352b
      Arnd Bergmann 提交于
      A correct bugfix introduced a harmless warning that shows up with gcc-7:
      
      fs/nfs/callback.c: In function 'nfs_callback_up':
      fs/nfs/callback.c:214:14: error: array subscript is outside array bounds [-Werror=array-bounds]
      
      What happens here is that the 'minorversion == 0' check tells the
      compiler that we assume minorversion can be something other than 0,
      but when CONFIG_NFS_V4_1 is disabled that would be invalid and
      result in an out-of-bounds access.
      
      The added check for IS_ENABLED(CONFIG_NFS_V4_1) tells gcc that this
      really can't happen, which makes the code slightly smaller and also
      avoids the warning.
      
      The bugfix that introduced the warning is marked for stable backports,
      we want this one backported to the same releases.
      
      Fixes: 98b0f80c ("NFSv4.x: Fix a refcount leak in nfs_callback_up_net")
      Cc: stable@vger.kernel.org # v3.7+
      Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Signed-off-by: NAnna Schumaker <Anna.Schumaker@Netapp.com>
      d55b352b
    • L
      Merge branch 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 000b8949
      Linus Torvalds 提交于
      Pull scheduler fixes from Ingo Molnar:
       "Two fixes for autogroup scheduling, for races when turning the feature
        on/off via /proc/sys/kernel/sched_autogroup_enabled"
      
      * 'sched-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched/autogroup: Do not use autogroup->tg in zombie threads
        sched/autogroup: Fix autogroup_move_group() to never skip sched_move_task()
      000b8949
    • L
      Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 7cfc4317
      Linus Torvalds 提交于
      Pull x86 fixes from Ingo Molnar:
       "Misc fixes:
         - two fixes to make (very) old Intel CPUs boot reliably
         - fix the intel-mid driver and rename it
         - two KASAN false positive fixes
         - an FPU fix
         - two sysfb fixes
         - two build fixes related to new toolchain versions"
      
      * 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/platform/intel-mid: Rename platform_wdt to platform_mrfld_wdt
        x86/build: Build compressed x86 kernels as PIE when !CONFIG_RELOCATABLE as well
        x86/platform/intel-mid: Register watchdog device after SCU
        x86/fpu: Fix invalid FPU ptrace state after execve()
        x86/boot: Fail the boot if !M486 and CPUID is missing
        x86/traps: Ignore high word of regs->cs in early_fixup_exception()
        x86/dumpstack: Prevent KASAN false positive warnings
        x86/unwind: Prevent KASAN false positive warnings in guess unwinder
        x86/boot: Avoid warning for zero-filling .bss
        x86/sysfb: Fix lfb_size calculation
        x86/sysfb: Add support for 64bit EFI lfb_base
      7cfc4317
  5. 22 11月, 2016 4 次提交
    • R
      drm/arm: hdlcd: fix plane base address update · 7a79279e
      Russell King 提交于
      While testing HDMI with Xorg on the Juno board, I find that when Xorg
      starts up or shuts down, the display is shifted significantly to the
      right and wrapped in the active region.  (No sync bars are visible.)
      The timings are correct, it behaves as if the start address has been
      shifted many pixels _into_ the framebuffer.
      
      This occurs whenever the display mode size is changed - using xrandr
      in Xorg shows that changing the resolution triggers the problem
      almost every time, but changing the refresh rate does not.
      
      Using devmem2 to disable and re-enable the HDLCD resolves the issue,
      and repeated disable/enable cycles do not make the issue re-appear.
      Further debugging shows that we try to update the controller
      configuration while enabled.
      
      Alwys ensure that the HDLCD is disabled prior to updating the
      controller timings, and use drm_crtc_vblank_off()/drm_crtc_vblank_on()
      so that DRM knows whether it can expect vblank interrupts.
      Signed-off-by: NRussell King <rmk+kernel@armlinux.org.uk>
      Signed-off-by: NLiviu Dudau <Liviu.Dudau@arm.com>
      7a79279e
    • P
      perf/x86/intel/uncore: Allow only a single PMU/box within an events group · 033ac60c
      Peter Zijlstra 提交于
      Group validation expects all events to be of the same PMU; however
      is_uncore_pmu() is too wide, it matches _all_ uncore events, even
      across PMUs.
      
      This triggers failure when we group different events from different
      uncore PMUs, like:
      
        perf stat -vv -e '{uncore_cbox_0/config=0x0334/,uncore_qpi_0/event=1/}' -a sleep 1
      
      Fix is_uncore_pmu() by only matching events to the box at hand.
      
      Note that generic code; ran after this step; will disallow this
      mixture of PMU events.
      Reported-by: NJiri Olsa <jolsa@redhat.com>
      Tested-by: NJiri Olsa <jolsa@redhat.com>
      Signed-off-by: NPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Kan Liang <kan.liang@intel.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Stephane Eranian <eranian@google.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Vince Weaver <vince@deater.net>
      Cc: Vince Weaver <vincent.weaver@maine.edu>
      Link: http://lkml.kernel.org/r/20161118125354.GQ3117@twins.programming.kicks-ass.netSigned-off-by: NIngo Molnar <mingo@kernel.org>
      033ac60c
    • P
      perf/x86/intel: Cure bogus unwind from PEBS entries · b8000586
      Peter Zijlstra 提交于
      Vince Weaver reported that perf_fuzzer + KASAN detects that PEBS event
      unwinds sometimes do 'weird' things. In particular, we seemed to be
      ending up unwinding from random places on the NMI stack.
      
      While it was somewhat expected that the event record BP,SP would not
      match the interrupt BP,SP in that the interrupt is strictly later than
      the record event, it was overlooked that it could be on an already
      overwritten stack.
      
      Therefore, don't copy the recorded BP,SP over the interrupted BP,SP
      when we need stack unwinds.
      
      Note that its still possible the unwind doesn't full match the actual
      event, as its entirely possible to have done an (I)RET between record
      and interrupt, but on average it should still point in the general
      direction of where the event came from. Also, it's the best we can do,
      considering.
      
      The particular scenario that triggered the bogus NMI stack unwind was
      a PEBS event with very short period, upon enabling the event at the
      tail of the PMI handler (FREEZE_ON_PMI is not used), it instantly
      triggers a record (while still on the NMI stack) which in turn
      triggers the next PMI. This then causes back-to-back NMIs and we'll
      try and unwind the stack-frame from the last NMI, which obviously is
      now overwritten by our own.
      Analyzed-by: NJosh Poimboeuf <jpoimboe@redhat.com>
      Reported-by: NVince Weaver <vincent.weaver@maine.edu>
      Signed-off-by: NPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Stephane Eranian <eranian@gmail.com>
      Cc: Stephane Eranian <eranian@google.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: davej@codemonkey.org.uk <davej@codemonkey.org.uk>
      Cc: dvyukov@google.com <dvyukov@google.com>
      Cc: stable@vger.kernel.org
      Fixes: ca037701 ("perf, x86: Add PEBS infrastructure")
      Link: http://lkml.kernel.org/r/20161117171731.GV3157@twins.programming.kicks-ass.netSigned-off-by: NIngo Molnar <mingo@kernel.org>
      b8000586
    • J
      perf/x86: Restore TASK_SIZE check on frame pointer · ae31fe51
      Johannes Weiner 提交于
      The following commit:
      
        75925e1a ("perf/x86: Optimize stack walk user accesses")
      
      ... switched from copy_from_user_nmi() to __copy_from_user_nmi() with a manual
      access_ok() check.
      
      Unfortunately, copy_from_user_nmi() does an explicit check against TASK_SIZE,
      whereas the access_ok() uses whatever the current address limit of the task is.
      
      We are getting NMIs when __probe_kernel_read() has switched to KERNEL_DS, and
      then see vmalloc faults when we access what looks like pointers into vmalloc
      space:
      
        [] WARNING: CPU: 3 PID: 3685731 at arch/x86/mm/fault.c:435 vmalloc_fault+0x289/0x290
        [] CPU: 3 PID: 3685731 Comm: sh Tainted: G        W       4.6.0-5_fbk1_223_gdbf0f40 #1
        [] Call Trace:
        []  <NMI>  [<ffffffff814717d1>] dump_stack+0x4d/0x6c
        []  [<ffffffff81076e43>] __warn+0xd3/0xf0
        []  [<ffffffff81076f2d>] warn_slowpath_null+0x1d/0x20
        []  [<ffffffff8104a899>] vmalloc_fault+0x289/0x290
        []  [<ffffffff8104b5a0>] __do_page_fault+0x330/0x490
        []  [<ffffffff8104b70c>] do_page_fault+0xc/0x10
        []  [<ffffffff81794e82>] page_fault+0x22/0x30
        []  [<ffffffff81006280>] ? perf_callchain_user+0x100/0x2a0
        []  [<ffffffff8115124f>] get_perf_callchain+0x17f/0x190
        []  [<ffffffff811512c7>] perf_callchain+0x67/0x80
        []  [<ffffffff8114e750>] perf_prepare_sample+0x2a0/0x370
        []  [<ffffffff8114e840>] perf_event_output+0x20/0x60
        []  [<ffffffff8114aee7>] ? perf_event_update_userpage+0xc7/0x130
        []  [<ffffffff8114ea01>] __perf_event_overflow+0x181/0x1d0
        []  [<ffffffff8114f484>] perf_event_overflow+0x14/0x20
        []  [<ffffffff8100a6e3>] intel_pmu_handle_irq+0x1d3/0x490
        []  [<ffffffff8147daf7>] ? copy_user_enhanced_fast_string+0x7/0x10
        []  [<ffffffff81197191>] ? vunmap_page_range+0x1a1/0x2f0
        []  [<ffffffff811972f1>] ? unmap_kernel_range_noflush+0x11/0x20
        []  [<ffffffff814f2056>] ? ghes_copy_tofrom_phys+0x116/0x1f0
        []  [<ffffffff81040d1d>] ? x2apic_send_IPI_self+0x1d/0x20
        []  [<ffffffff8100411d>] perf_event_nmi_handler+0x2d/0x50
        []  [<ffffffff8101ea31>] nmi_handle+0x61/0x110
        []  [<ffffffff8101ef94>] default_do_nmi+0x44/0x110
        []  [<ffffffff8101f13b>] do_nmi+0xdb/0x150
        []  [<ffffffff81795187>] end_repeat_nmi+0x1a/0x1e
        []  [<ffffffff8147daf7>] ? copy_user_enhanced_fast_string+0x7/0x10
        []  [<ffffffff8147daf7>] ? copy_user_enhanced_fast_string+0x7/0x10
        []  [<ffffffff8147daf7>] ? copy_user_enhanced_fast_string+0x7/0x10
        []  <<EOE>>  <IRQ>  [<ffffffff8115d05e>] ? __probe_kernel_read+0x3e/0xa0
      
      Fix this by moving the valid_user_frame() check to before the uaccess
      that loads the return address and the pointer to the next frame.
      Signed-off-by: NJohannes Weiner <hannes@cmpxchg.org>
      Signed-off-by: NPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Stephane Eranian <eranian@google.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Vince Weaver <vincent.weaver@maine.edu>
      Cc: linux-kernel@vger.kernel.org
      Fixes: 75925e1a ("perf/x86: Optimize stack walk user accesses")
      Signed-off-by: NIngo Molnar <mingo@kernel.org>
      ae31fe51