1. 13 2月, 2019 1 次提交
  2. 09 2月, 2019 2 次提交
  3. 06 2月, 2019 3 次提交
  4. 05 2月, 2019 5 次提交
  5. 02 2月, 2019 1 次提交
    • Q
      efi/arm64: Fix debugfs crash by adding a terminator for ptdump marker · 74c953ca
      Qian Cai 提交于
      When reading 'efi_page_tables' debugfs triggers an out-of-bounds access here:
      
        arch/arm64/mm/dump.c: 282
        if (addr >= st->marker[1].start_address) {
      
      called from:
      
        arch/arm64/mm/dump.c: 331
        note_page(st, addr, 2, pud_val(pud));
      
      because st->marker++ is is called after "UEFI runtime end" which is the
      last element in addr_marker[]. Therefore, add a terminator like the one
      for kernel_page_tables, so it can be skipped to print out non-existent
      markers.
      
      Here's the KASAN bug report:
      
        # cat /sys/kernel/debug/efi_page_tables
        ---[ UEFI runtime start ]---
        0x0000000020000000-0x0000000020010000          64K PTE       RW NX SHD AF ...
        0x0000000020200000-0x0000000021340000       17664K PTE       RW NX SHD AF ...
        ...
        0x0000000021920000-0x0000000021950000         192K PTE       RW x  SHD AF ...
        0x0000000021950000-0x00000000219a0000         320K PTE       RW NX SHD AF ...
        ---[ UEFI runtime end ]---
        ---[ (null) ]---
        ---[ (null) ]---
      
         BUG: KASAN: global-out-of-bounds in note_page+0x1f0/0xac0
         Read of size 8 at addr ffff2000123f2ac0 by task read_all/42464
         Call trace:
          dump_backtrace+0x0/0x298
          show_stack+0x24/0x30
          dump_stack+0xb0/0xdc
          print_address_description+0x64/0x2b0
          kasan_report+0x150/0x1a4
          __asan_report_load8_noabort+0x30/0x3c
          note_page+0x1f0/0xac0
          walk_pgd+0xb4/0x244
          ptdump_walk_pgd+0xec/0x140
          ptdump_show+0x40/0x50
          seq_read+0x3f8/0xad0
          full_proxy_read+0x9c/0xc0
          __vfs_read+0xfc/0x4c8
          vfs_read+0xec/0x208
          ksys_read+0xd0/0x15c
          __arm64_sys_read+0x84/0x94
          el0_svc_handler+0x258/0x304
          el0_svc+0x8/0xc
      
        The buggy address belongs to the variable:
         __compound_literal.0+0x20/0x800
      
        Memory state around the buggy address:
         ffff2000123f2980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
         ffff2000123f2a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fa
        >ffff2000123f2a80: fa fa fa fa 00 00 00 00 fa fa fa fa 00 00 00 00
                                                  ^
         ffff2000123f2b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
         ffff2000123f2b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
      
      [ ardb: fix up whitespace ]
      [ mingo: fix up some moar ]
      Signed-off-by: NQian Cai <cai@lca.pw>
      Signed-off-by: NArd Biesheuvel <ard.biesheuvel@linaro.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: linux-efi@vger.kernel.org
      Fixes: 9d80448a ("efi/arm64: Add debugfs node to dump UEFI runtime page tables")
      Link: http://lkml.kernel.org/r/20190202095017.13799-2-ard.biesheuvel@linaro.orgSigned-off-by: NIngo Molnar <mingo@kernel.org>
      74c953ca
  6. 01 2月, 2019 6 次提交
  7. 31 1月, 2019 4 次提交
    • J
      ide: ensure atapi sense request aren't preempted · 9a6d5488
      Jens Axboe 提交于
      There's an issue with how sense requests are handled in IDE. If ide-cd
      encounters an error, it queues a sense request. With how IDE request
      handling is done, this is the next request we need to handle. But it's
      impossible to guarantee this, as another request could come in between
      the sense being queued, and ->queue_rq() being run and handling it. If
      that request ALSO fails, then we attempt to doubly queue the single
      sense request we have.
      
      Since we only support one active request at the time, defer request
      processing when a sense request is queued.
      
      Fixes: 60033520 "ide: convert to blk-mq"
      Reported-by: NHe Zhe <zhe.he@windriver.com>
      Tested-by: NHe Zhe <zhe.he@windriver.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      9a6d5488
    • D
      cpuidle: poll_state: Fix default time limit · 1617971c
      Doug Smythies 提交于
      The default time is declared in units of microsecnds,
      but is used as nanoseconds, resulting in significant
      accounting errors for idle state 0 time when all idle
      states deeper than 0 are disabled.
      
      Under these unusual conditions, we don't really care
      about the poll time limit anyhow.
      
      Fixes: 800fb34a ("cpuidle: poll_state: Disregard disable idle states")
      Signed-off-by: NDoug Smythies <dsmythies@telus.net>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      1617971c
    • V
      PM-runtime: Fix deadlock with ktime_get() · 15efb47d
      Vincent Guittot 提交于
      A deadlock has been seen when swicthing clocksources which use
      PM-runtime.  The call path is:
      
      change_clocksource
          ...
          write_seqcount_begin
          ...
          timekeeping_update
              ...
              sh_cmt_clocksource_enable
                  ...
                  rpm_resume
                      pm_runtime_mark_last_busy
                          ktime_get
                              do
                                  read_seqcount_begin
                              while read_seqcount_retry
          ....
          write_seqcount_end
      
      Although we should be safe because we haven't yet changed the
      clocksource at that time, we can't do that because of seqcount
      protection.
      
      Use ktime_get_mono_fast_ns() instead which is lock safe for such
      cases.
      
      With ktime_get_mono_fast_ns, the timestamp is not guaranteed to be
      monotonic across an update and as a result can goes backward.
      According to update_fast_timekeeper() description: "In the worst
      case, this can result is a slightly wrong timestamp (a few
      nanoseconds)". For PM-runtime autosuspend, this means only that
      the suspend decision may be slightly suboptimal.
      
      Fixes: 8234f673 ("PM-runtime: Switch autosuspend over to using hrtimers")
      Reported-by: NBiju Das <biju.das@bp.renesas.com>
      Signed-off-by: NVincent Guittot <vincent.guittot@linaro.org>
      Reviewed-by: NUlf Hansson <ulf.hansson@linaro.org>
      Signed-off-by: NRafael J. Wysocki <rafael.j.wysocki@intel.com>
      15efb47d
    • C
      drm/amdgpu: Transfer fences to dmabuf importer · 6e11ea9d
      Chris Wilson 提交于
      amdgpu only uses shared-fences internally, but dmabuf importers rely on
      implicit write hazard tracking via the reservation_object.fence_excl.
      For example, the importer use the write hazard for timing a page flip to
      only occur after the exporter has finished flushing its write into the
      surface. As such, on exporting a dmabuf, we must either flush all
      outstanding fences (for we do not know which are writes and should have
      been exclusive) or alternatively create a new exclusive fence that is
      the composite of all the existing shared fences, and so will only be
      signaled when all earlier fences are signaled (ensuring that we can not
      be signaled before the completion of any earlier write).
      
      v2: reservation_object is already locked by amdgpu_bo_reserve()
      v3: Replace looping with get_fences_rcu and special case the promotion
      of a single shared fence directly to an exclusive fence, bypassing the
      fence array.
      v4: Drop the fence array ref after assigning to reservation_object
      
      Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=107341
      Testcase: igt/amd_prime/amd-to-i915
      References: 8e94a46c ("drm/amdgpu: Attach exclusive fence to prime exported bo's. (v5)")
      Signed-off-by: NChris Wilson <chris@chris-wilson.co.uk>
      Cc: Alex Deucher <alexander.deucher@amd.com>
      Cc: "Christian König" <christian.koenig@amd.com>
      Reviewed-by: N"Christian König" <christian.koenig@amd.com>
      Signed-off-by: NAlex Deucher <alexander.deucher@amd.com>
      6e11ea9d
  8. 30 1月, 2019 5 次提交
    • Y
      IB/uverbs: Fix OOPs in uverbs_user_mmap_disassociate · 7b21b69a
      Yishai Hadas 提交于
      The vma->vm_mm can become impossible to get before rdma_umap_close() is
      called, in this case we must not try to get an mm that is already
      undergoing process exit. In this case there is no need to wait for
      anything as the VMA will be destroyed by another thread soon and is
      already effectively 'unreachable' by userspace.
      
       BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
       PGD 800000012bc50067 P4D 800000012bc50067 PUD 129db5067 PMD 0
       Oops: 0000 [#1] SMP PTI
       CPU: 1 PID: 2050 Comm: bash Tainted: G        W  OE 4.20.0-rc6+ #3
       Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
       RIP: 0010:__rb_erase_color+0xb9/0x280
       Code: 84 17 01 00 00 48 3b 68 10 0f 84 15 01 00 00 48 89
                     58 08 48 89 de 48 89 ef 4c 89 e3 e8 90 84 22 00 e9 60 ff ff ff 48 8b 5d
                     10 <f6> 03 01 0f 84 9c 00 00 00 48 8b 43 10 48 85 c0 74 09 f6 00 01 0f
       RSP: 0018:ffffbecfc090bab8 EFLAGS: 00010246
       RAX: ffff97616346cf30 RBX: 0000000000000000 RCX: 0000000000000101
       RDX: 0000000000000000 RSI: ffff97623b6ca828 RDI: ffff97621ef10828
       RBP: ffff97621ef10828 R08: ffff97621ef10828 R09: 0000000000000000
       R10: 0000000000000000 R11: 0000000000000000 R12: ffff97623b6ca838
       R13: ffffffffbb3fef50 R14: ffff97623b6ca828 R15: 0000000000000000
       FS:  00007f7a5c31d740(0000) GS:ffff97623bb00000(0000) knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       CR2: 0000000000000000 CR3: 000000011255a000 CR4: 00000000000006e0
       Call Trace:
        unlink_file_vma+0x3b/0x50
        free_pgtables+0xa1/0x110
        exit_mmap+0xca/0x1a0
        ? mlx5_ib_dealloc_pd+0x28/0x30 [mlx5_ib]
        mmput+0x54/0x140
        uverbs_user_mmap_disassociate+0xcc/0x160 [ib_uverbs]
        uverbs_destroy_ufile_hw+0xf7/0x120 [ib_uverbs]
        ib_uverbs_remove_one+0xea/0x240 [ib_uverbs]
        ib_unregister_device+0xfb/0x200 [ib_core]
        mlx5_ib_remove+0x51/0xe0 [mlx5_ib]
        mlx5_remove_device+0xc1/0xd0 [mlx5_core]
        mlx5_unregister_device+0x3d/0xb0 [mlx5_core]
        remove_one+0x2a/0x90 [mlx5_core]
        pci_device_remove+0x3b/0xc0
        device_release_driver_internal+0x16d/0x240
        unbind_store+0xb2/0x100
        kernfs_fop_write+0x102/0x180
        __vfs_write+0x36/0x1a0
        ? __alloc_fd+0xa9/0x170
        ? set_close_on_exec+0x49/0x70
        vfs_write+0xad/0x1a0
        ksys_write+0x52/0xc0
        do_syscall_64+0x5b/0x180
        entry_SYSCALL_64_after_hwframe+0x44/0xa9
      
      Cc: <stable@vger.kernel.org> # 4.19
      Fixes: 5f9794dc ("RDMA/ucontext: Add a core API for mmaping driver IO memory")
      Signed-off-by: NYishai Hadas <yishaih@mellanox.com>
      Signed-off-by: NLeon Romanovsky <leonro@mellanox.com>
      Signed-off-by: NJason Gunthorpe <jgg@mellanox.com>
      7b21b69a
    • Y
      net: b44: replace dev_kfree_skb_xxx by dev_consume_skb_xxx for drop profiles · 0f0ed828
      Yang Wei 提交于
      The skb should be freed by dev_consume_skb_any() in b44_start_xmit()
      when bounce_skb is used. The skb is be replaced by bounce_skb, so the
      original skb should be consumed(not drop).
      
      dev_consume_skb_irq() should be called in b44_tx() when skb xmit
      done. It makes drop profiles(dropwatch, perf) more friendly.
      Signed-off-by: NYang Wei <yang.wei9@zte.com.cn>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      0f0ed828
    • Y
      net: caif: call dev_consume_skb_any when skb xmit done · e339f863
      Yang Wei 提交于
      The skb shouled be consumed when xmit done, it makes drop profiles
      (dropwatch, perf) more friendly.
      dev_kfree_skb_irq()/kfree_skb() shouled be replaced by
      dev_consume_skb_any(), it makes code cleaner.
      Signed-off-by: NYang Wei <yang.wei9@zte.com.cn>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e339f863
    • Y
      net: 8139cp: replace dev_kfree_skb_irq by dev_consume_skb_irq for drop profiles · 896cebc0
      Yang Wei 提交于
      dev_consume_skb_irq() should be called in cp_tx() when skb xmit
      done. It makes drop profiles(dropwatch, perf) more friendly.
      Signed-off-by: NYang Wei <yang.wei9@zte.com.cn>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      896cebc0
    • H
      net: macb: Apply RXUBR workaround only to versions with errata · e501070e
      Harini Katakam 提交于
      The interrupt handler contains a workaround for RX hang applicable
      to Zynq and AT91RM9200 only. Subsequent versions do not need this
      workaround. This workaround unnecessarily resets RX whenever RX used
      bit read is observed, which can be often under heavy traffic. There
      is no other action performed on RX UBR interrupt. Hence introduce a
      CAPS mask; enable this interrupt and workaround only on affected
      versions.
      Signed-off-by: NHarini Katakam <harini.katakam@xilinx.com>
      Signed-off-by: NDavid S. Miller <davem@davemloft.net>
      e501070e
  9. 29 1月, 2019 13 次提交