1. 04 Feb, 2022 32 commits
    • Linus Torvalds's avatar
      Merge tag 'iommu-fixes-v5.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu · 07cd9ac4
      Linus Torvalds authored
      Pull iommu fixes from Joerg Roedel:
      
       - Warning fixes and a fix for a potential use-after-free in IOMMU core
         code
      
       - Another potential memory leak fix for the Intel VT-d driver
      
       - Fix for an IO polling loop timeout issue in the AMD IOMMU driver
      
      * tag 'iommu-fixes-v5.17-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
        iommu/amd: Fix loop timeout issue in iommu_ga_log_enable()
        iommu/vt-d: Fix potential memory leak in intel_setup_irq_remapping()
        iommu: Fix some W=1 warnings
        iommu: Fix potential use-after-free during probe
      07cd9ac4
    • Linus Torvalds's avatar
      Merge tag 'random-5.17-rc3-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random · ba6ef8af
      Linus Torvalds authored
      Pull random number generator fixes from Jason Donenfeld:
       "For this week, we have:
      
         - A fix to make more frequent use of hwgenerator randomness, from
           Dominik.
      
         - More cleanups to the boot initialization sequence, from Dominik.
      
         - A fix for an old shortcoming with the ZAP ioctl, from me.
      
         - A workaround for a still unfixed Clang CFI/FullLTO compiler bug,
           from me. On one hand, it's a bummer to commit workarounds for
           experimental compiler features that have bugs. But on the other, I
           think this actually improves the code somewhat, independent of the
           bug. So a win-win"
      
      * tag 'random-5.17-rc3-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/crng/random:
        random: only call crng_finalize_init() for primary_crng
        random: access primary_pool directly rather than through pointer
        random: wake up /dev/random writers after zap
        random: continually use hwgenerator randomness
        lib/crypto: blake2s: avoid indirect calls to compression function for Clang CFI
      ba6ef8af
    • Linus Torvalds's avatar
      Merge tag 'acpi-5.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · ddb16b08
      Linus Torvalds authored
      Pull ACPI fix from Rafael Wysocki:
       "Fix compilation in the case when ACPI is selected and CRC32, depended
        on by ACPI after recent changes, is not (Randy Dunlap)"
      
      * tag 'acpi-5.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI: require CRC32 to build
      ddb16b08
    • Linus Torvalds's avatar
      Merge tag 'sound-5.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound · 0a566d43
      Linus Torvalds authored
      Pull sound fixes from Takashi Iwai:
       "A collection of small fixes.
      
        The major changes are ASoC core fixes, addressing the DPCM locking
        issue after the recent code changes and the potentially invalid
        register accesses via control API. Also, HD-audio got a core fix for
        Oops at dynamic unbinding.
      
        The rest are device-specific small fixes, including the usual stuff
        like HD-audio and USB-audio quirks"
      
      * tag 'sound-5.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (31 commits)
        ALSA: hda: Skip codec shutdown in case the codec is not registered
        ALSA: usb-audio: Correct quirk for VF0770
        ALSA: Replace acpi_bus_get_device()
        Input: wm97xx: Simplify resource management
        ALSA: hda/realtek: Add quirk for ASUS GU603
        ALSA: hda/realtek: Fix silent output on Gigabyte X570 Aorus Xtreme after reboot from Windows
        ALSA: hda/realtek: Fix silent output on Gigabyte X570S Aorus Master (newer chipset)
        ALSA: hda/realtek: Add missing fixup-model entry for Gigabyte X570 ALC1220 quirks
        ALSA: hda: realtek: Fix race at concurrent COEF updates
        ASoC: ops: Check for negative values before reading them
        ASoC: rt5682: Fix deadlock on resume
        ASoC: hdmi-codec: Fix OOB memory accesses
        ASoC: soc-pcm: Move debugfs removal out of spinlock
        ASoC: soc-pcm: Fix DPCM lockdep warning due to nested stream locks
        ASoC: fsl: Add missing error handling in pcm030_fabric_probe
        ALSA: hda: Fix signedness of sscanf() arguments
        ALSA: usb-audio: initialize variables that could ignore errors
        ALSA: hda: Fix UAF of leds class devs at unbinding
        ASoC: qdsp6: q6apm-dai: only stop graphs that are started
        ASoC: codecs: wcd938x: fix return value of mixer put function
        ...
      0a566d43
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2022-02-04' of git://anongit.freedesktop.org/drm/drm · 31462d9e
      Linus Torvalds authored
      Pull drm fixes from Dave Airlie:
       "Regular fixes for the week. Daniel has agreed to bring back the fbcon
        hw acceleration under a CONFIG option for the non-drm fbdev users, we
        don't advise turning this on unless you are in the niche that is old
        fbdev drivers, Since it's essentially a revert and shouldn't be high
        impact seemed like a good time to do it now.
      
        Otherwise, i915 and amdgpu fixes are most of it, along with some minor
        fixes elsewhere.
      
        fbdev:
         - readd fbcon acceleration
      
        i915:
         - fix DP monitor via type-c dock
         - fix for engine busyness and read timeout with GuC
         - use ALLOW_FAIL for error capture buffer allocs
         - don't use interruptible lock on error paths
         - smatch fix to reject zero sized overlays.
      
        amdgpu:
         - mGPU fan boost fix for beige goby
         - S0ix fixes
         - Cyan skillfish hang fix
         - DCN fixes for DCN 3.1
         - DCN fixes for DCN 3.01
         - Apple retina panel fix
         - ttm logic inversion fix
      
        dma-buf:
         - heaps: fix potential spectre v1 gadget
      
        kmb:
         - fix potential oob access
      
        mxsfb:
         - fix NULL ptr deref
      
        nouveau:
         - fix potential oob access during BIOS decode"
      
      * tag 'drm-fixes-2022-02-04' of git://anongit.freedesktop.org/drm/drm: (24 commits)
        drm: mxsfb: Fix NULL pointer dereference
        drm/amdgpu: fix logic inversion in check
        drm/amd: avoid suspend on dGPUs w/ s2idle support when runtime PM enabled
        drm/amd/display: Force link_rate as LINK_RATE_RBR2 for 2018 15" Apple Retina panels
        drm/amd/display: revert "Reset fifo after enable otg"
        drm/amd/display: watermark latencies is not enough on DCN31
        drm/amd/display: Update watermark values for DCN301
        drm/amdgpu: fix a potential GPU hang on cyan skillfish
        drm/amd: Only run s3 or s0ix if system is configured properly
        drm/amd: add support to check whether the system is set to s3
        fbcon: Add option to enable legacy hardware acceleration
        Revert "fbcon: Disable accelerated scrolling"
        Revert "fbdev: Garbage collect fbdev scrolling acceleration, part 1 (from TODO list)"
        drm/i915/pmu: Fix KMD and GuC race on accessing busyness
        dma-buf: heaps: Fix potential spectre v1 gadget
        drm/amd: Warn users about potential s0ix problems
        drm/amd/pm: correct the MGpuFanBoost support for Beige Goby
        drm/nouveau: fix off by one in BIOS boundary checking
        drm/i915/adlp: Fix TypeC PHY-ready status readout
        drm/i915/pmu: Use PM timestamp instead of RING TIMESTAMP for reference
        ...
      31462d9e
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · f9aaa5b0
      Linus Torvalds authored
      Merge misc fixes from Andrew Morton:
       "10 patches.
      
        Subsystems affected by this patch series: ipc, MAINTAINERS, and mm
        (vmscan, debug, pagemap, kmemleak, and selftests)"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        kselftest/vm: revert "tools/testing/selftests/vm/userfaultfd.c: use swap() to make code cleaner"
        MAINTAINERS: update rppt's email
        mm/kmemleak: avoid scanning potential huge holes
        ipc/sem: do not sleep with a spin lock held
        mm/pgtable: define pte_index so that preprocessor could recognize it
        mm/page_table_check: check entries at pmd levels
        mm/khugepaged: unify collapse pmd clear, flush and free
        mm/page_table_check: use unsigned long for page counters and cleanup
        mm/debug_vm_pgtable: remove pte entry from the page table
        Revert "mm/page_isolation: unset migratetype directly for non Buddy page"
      f9aaa5b0
    • Dominik Brodowski's avatar
      random: only call crng_finalize_init() for primary_crng · 9d5505f1
      Dominik Brodowski authored
      crng_finalize_init() returns instantly if it is called for another pool
      than primary_crng. The test whether crng_finalize_init() is still required
      can be moved to the relevant caller in crng_reseed(), and
      crng_need_final_init can be reset to false if crng_finalize_init() is
      called with workqueues ready. Then, no previous callsite will call
      crng_finalize_init() unless it is needed, and we can get rid of the
      superfluous function parameter.
      Signed-off-by: default avatarDominik Brodowski <linux@dominikbrodowski.net>
      Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
      9d5505f1
    • Dominik Brodowski's avatar
      random: access primary_pool directly rather than through pointer · ebf76063
      Dominik Brodowski authored
      Both crng_initialize_primary() and crng_init_try_arch_early() are
      only called for the primary_pool. Accessing it directly instead of
      through a function parameter simplifies the code.
      Signed-off-by: default avatarDominik Brodowski <linux@dominikbrodowski.net>
      Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
      ebf76063
    • Jason A. Donenfeld's avatar
      random: wake up /dev/random writers after zap · 042e293e
      Jason A. Donenfeld authored
      When account() is called, and the amount of entropy dips below
      random_write_wakeup_bits, we wake up the random writers, so that they
      can write some more in. However, the RNDZAPENTCNT/RNDCLEARPOOL ioctl
      sets the entropy count to zero -- a potential reduction just like
      account() -- but does not unblock writers. This commit adds the missing
      logic to that ioctl to unblock waiting writers.
      Reviewed-by: default avatarDominik Brodowski <linux@dominikbrodowski.net>
      Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
      042e293e
    • Dominik Brodowski's avatar
      random: continually use hwgenerator randomness · c321e907
      Dominik Brodowski authored
      The rngd kernel thread may sleep indefinitely if the entropy count is
      kept above random_write_wakeup_bits by other entropy sources. To make
      best use of multiple sources of randomness, mix entropy from hardware
      RNGs into the pool at least once within CRNG_RESEED_INTERVAL.
      
      Cc: Herbert Xu <herbert@gondor.apana.org.au>
      Cc: Jason A. Donenfeld <Jason@zx2c4.com>
      Signed-off-by: default avatarDominik Brodowski <linux@dominikbrodowski.net>
      Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
      c321e907
    • Jason A. Donenfeld's avatar
      lib/crypto: blake2s: avoid indirect calls to compression function for Clang CFI · d2a02e3c
      Jason A. Donenfeld authored
      blake2s_compress_generic is weakly aliased by blake2s_compress. The
      current harness for function selection uses a function pointer, which is
      ordinarily inlined and resolved at compile time. But when Clang's CFI is
      enabled, CFI still triggers when making an indirect call via a weak
      symbol. This seems like a bug in Clang's CFI, as though it's bucketing
      weak symbols and strong symbols differently. It also only seems to
      trigger when "full LTO" mode is used, rather than "thin LTO".
      
      [    0.000000][    T0] Kernel panic - not syncing: CFI failure (target: blake2s_compress_generic+0x0/0x1444)
      [    0.000000][    T0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-mainline-06981-g076c855b846e #1
      [    0.000000][    T0] Hardware name: MT6873 (DT)
      [    0.000000][    T0] Call trace:
      [    0.000000][    T0]  dump_backtrace+0xfc/0x1dc
      [    0.000000][    T0]  dump_stack_lvl+0xa8/0x11c
      [    0.000000][    T0]  panic+0x194/0x464
      [    0.000000][    T0]  __cfi_check_fail+0x54/0x58
      [    0.000000][    T0]  __cfi_slowpath_diag+0x354/0x4b0
      [    0.000000][    T0]  blake2s_update+0x14c/0x178
      [    0.000000][    T0]  _extract_entropy+0xf4/0x29c
      [    0.000000][    T0]  crng_initialize_primary+0x24/0x94
      [    0.000000][    T0]  rand_initialize+0x2c/0x6c
      [    0.000000][    T0]  start_kernel+0x2f8/0x65c
      [    0.000000][    T0]  __primary_switched+0xc4/0x7be4
      [    0.000000][    T0] Rebooting in 5 seconds..
      
      Nonetheless, the function pointer method isn't so terrific anyway, so
      this patch replaces it with a simple boolean, which also gets inlined
      away. This successfully works around the Clang bug.
      
      In general, I'm not too keen on all of the indirection involved here; it
      clearly does more harm than good. Hopefully the whole thing can get
      cleaned up down the road when lib/crypto is overhauled more
      comprehensively. But for now, we go with a simple bandaid.
      
      Fixes: 6048fdcc ("lib/crypto: blake2s: include as built-in")
      Link: https://github.com/ClangBuiltLinux/linux/issues/1567Reported-by: default avatarMiles Chen <miles.chen@mediatek.com>
      Tested-by: default avatarMiles Chen <miles.chen@mediatek.com>
      Tested-by: default avatarNathan Chancellor <nathan@kernel.org>
      Tested-by: default avatarJohn Stultz <john.stultz@linaro.org>
      Acked-by: default avatarNick Desaulniers <ndesaulniers@google.com>
      Reviewed-by: default avatarEric Biggers <ebiggers@google.com>
      Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
      d2a02e3c
    • Linus Torvalds's avatar
      Merge tag 'ceph-for-5.17-rc3' of git://github.com/ceph/ceph-client · cff7f223
      Linus Torvalds authored
      Pull ceph fixes from Ilya Dryomov:
       "A patch to make it possible to disable zero copy path in the messenger
        to avoid checksum or authentication tag mismatches and ensuing session
        resets in case the destination buffer isn't guaranteed to be stable"
      
      * tag 'ceph-for-5.17-rc3' of git://github.com/ceph/ceph-client:
        libceph: optionally use bounce buffer on recv path in crc mode
        libceph: make recv path in secure mode work the same as send path
      cff7f223
    • Linus Torvalds's avatar
      Merge tag '9p-for-5.17-rc3' of git://github.com/martinetd/linux · 1eb7de17
      Linus Torvalds authored
      Pull 9p fix from Dominique Martinet:
       "Fix 'cannot walk open fid' rule
      
        The 9p 'walk' operation requires fid arguments to not originate from
        an open or create call and we've missed that for a while as the
        servers regularly running tests with don't enforce the check and no
        active reviewer knew about the rule.
      
        Both reporters confirmed reverting this patch fixes things for them
        and looking at it further wasn't actually required... Will take more
        time for follow up and enforcing the rule more thoroughly later"
      
      * tag '9p-for-5.17-rc3' of git://github.com/martinetd/linux:
        Revert "fs/9p: search open fids first"
      1eb7de17
    • Linus Torvalds's avatar
      Merge tag '5.17-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6 · 633a8e89
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
       "SMB3 client fixes including:
      
         - multiple fscache related fixes, reenabling ability to read/write to
           cached files for cifs.ko (that was temporarily disabled for cifs.ko
           a few weeks ago due to the recent fscache changes)
      
         - also includes a new fscache helper function ("query_occupancy")
           used by above
      
         - fix for multiuser mounts and NTLMSSP auth (workstation name) for
           stable
      
         - fix locking ordering problem in multichannel code
      
         - trivial malformed comment fix"
      
      * tag '5.17-rc3-smb3-client-fixes' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: fix workstation_name for multiuser mounts
        Invalidate fscache cookie only when inode attributes are changed.
        cifs: Fix the readahead conversion to manage the batch when reading from cache
        cifs: Implement cache I/O by accessing the cache directly
        netfs, cachefiles: Add a method to query presence of data in the cache
        cifs: Transition from ->readpages() to ->readahead()
        cifs: unlock chan_lock before calling cifs_put_tcp_session
        Fix a warning about a malformed kernel doc comment in cifs
      633a8e89
    • Shuah Khan's avatar
      kselftest/vm: revert "tools/testing/selftests/vm/userfaultfd.c: use swap() to make code cleaner" · 07d2505b
      Shuah Khan authored
      With this change, userfaultfd fails to build with undefined reference
      swap() error:
      
        userfaultfd.c: In function `userfaultfd_stress':
        userfaultfd.c:1530:17: warning: implicit declaration of function `swap'; did you mean `swab'? [-Wimplicit-function-declaration]
         1530 |                 swap(area_src, area_dst);
              |                 ^~~~
              |                 swab
        /usr/bin/ld: /tmp/ccDGOAdV.o: in function `userfaultfd_stress':
        userfaultfd.c:(.text+0x549e): undefined reference to `swap'
        /usr/bin/ld: userfaultfd.c:(.text+0x54bc): undefined reference to `swap'
        collect2: error: ld returned 1 exit status
      
      Revert the commit to fix the problem.
      
      Link: https://lkml.kernel.org/r/20220202003340.87195-1-skhan@linuxfoundation.org
      Fixes: 2c769ed7 ("tools/testing/selftests/vm/userfaultfd.c: use swap() to make code cleaner")
      Signed-off-by: default avatarShuah Khan <skhan@linuxfoundation.org>
      Cc: Shuah Khan <shuah@kernel.org>
      Cc: Minghao Chi <chi.minghao@zte.com.cn>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      07d2505b
    • Mike Rapoport's avatar
    • Lang Yu's avatar
      mm/kmemleak: avoid scanning potential huge holes · c10a0f87
      Lang Yu authored
      When using devm_request_free_mem_region() and devm_memremap_pages() to
      add ZONE_DEVICE memory, if requested free mem region's end pfn were
      huge(e.g., 0x400000000), the node_end_pfn() will be also huge (see
      move_pfn_range_to_zone()).  Thus it creates a huge hole between
      node_start_pfn() and node_end_pfn().
      
      We found on some AMD APUs, amdkfd requested such a free mem region and
      created a huge hole.  In such a case, following code snippet was just
      doing busy test_bit() looping on the huge hole.
      
        for (pfn = start_pfn; pfn < end_pfn; pfn++) {
      	struct page *page = pfn_to_online_page(pfn);
      		if (!page)
      			continue;
      	...
        }
      
      So we got a soft lockup:
      
        watchdog: BUG: soft lockup - CPU#6 stuck for 26s! [bash:1221]
        CPU: 6 PID: 1221 Comm: bash Not tainted 5.15.0-custom #1
        RIP: 0010:pfn_to_online_page+0x5/0xd0
        Call Trace:
          ? kmemleak_scan+0x16a/0x440
          kmemleak_write+0x306/0x3a0
          ? common_file_perm+0x72/0x170
          full_proxy_write+0x5c/0x90
          vfs_write+0xb9/0x260
          ksys_write+0x67/0xe0
          __x64_sys_write+0x1a/0x20
          do_syscall_64+0x3b/0xc0
          entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      I did some tests with the patch.
      
      (1) amdgpu module unloaded
      
      before the patch:
      
        real    0m0.976s
        user    0m0.000s
        sys     0m0.968s
      
      after the patch:
      
        real    0m0.981s
        user    0m0.000s
        sys     0m0.973s
      
      (2) amdgpu module loaded
      
      before the patch:
      
        real    0m35.365s
        user    0m0.000s
        sys     0m35.354s
      
      after the patch:
      
        real    0m1.049s
        user    0m0.000s
        sys     0m1.042s
      
      Link: https://lkml.kernel.org/r/20211108140029.721144-1-lang.yu@amd.comSigned-off-by: default avatarLang Yu <lang.yu@amd.com>
      Acked-by: default avatarDavid Hildenbrand <david@redhat.com>
      Acked-by: default avatarCatalin Marinas <catalin.marinas@arm.com>
      Cc: Oscar Salvador <osalvador@suse.de>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c10a0f87
    • Minghao Chi's avatar
      ipc/sem: do not sleep with a spin lock held · 520ba724
      Minghao Chi authored
      We can't call kvfree() with a spin lock held, so defer it.
      
      Link: https://lkml.kernel.org/r/20211223031207.556189-1-chi.minghao@zte.com.cn
      Fixes: fc37a3b8 ("[PATCH] ipc sem: use kvmalloc for sem_undo allocation")
      Reported-by: default avatarZeal Robot <zealci@zte.com.cn>
      Signed-off-by: default avatarMinghao Chi <chi.minghao@zte.com.cn>
      Reviewed-by: default avatarShakeel Butt <shakeelb@google.com>
      Reviewed-by: default avatarManfred Spraul <manfred@colorfullife.com>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Yang Guang <cgel.zte@gmail.com>
      Cc: Davidlohr Bueso <dbueso@suse.de>
      Cc: Randy Dunlap <rdunlap@infradead.org>
      Cc: Bhaskar Chowdhury <unixbhaskar@gmail.com>
      Cc: Vasily Averin <vvs@virtuozzo.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      520ba724
    • Mike Rapoport's avatar
      mm/pgtable: define pte_index so that preprocessor could recognize it · 314c459a
      Mike Rapoport authored
      Since commit 974b9b2c ("mm: consolidate pte_index() and
      pte_offset_*() definitions") pte_index is a static inline and there is
      no define for it that can be recognized by the preprocessor.  As a
      result, vm_insert_pages() uses slower loop over vm_insert_page() instead
      of insert_pages() that amortizes the cost of spinlock operations when
      inserting multiple pages.
      
      Link: https://lkml.kernel.org/r/20220111145457.20748-1-rppt@kernel.org
      Fixes: 974b9b2c ("mm: consolidate pte_index() and pte_offset_*() definitions")
      Signed-off-by: default avatarMike Rapoport <rppt@linux.ibm.com>
      Reported-by: default avatarChristian Dietrich <stettberger@dokucode.de>
      Reviewed-by: default avatarKhalid Aziz <khalid.aziz@oracle.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      314c459a
    • Pasha Tatashin's avatar
      mm/page_table_check: check entries at pmd levels · 80110bbf
      Pasha Tatashin authored
      syzbot detected a case where the page table counters were not properly
      updated.
      
        syzkaller login:  ------------[ cut here ]------------
        kernel BUG at mm/page_table_check.c:162!
        invalid opcode: 0000 [#1] PREEMPT SMP KASAN
        CPU: 0 PID: 3099 Comm: pasha Not tainted 5.16.0+ #48
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIO4
        RIP: 0010:__page_table_check_zero+0x159/0x1a0
        Call Trace:
         free_pcp_prepare+0x3be/0xaa0
         free_unref_page+0x1c/0x650
         free_compound_page+0xec/0x130
         free_transhuge_page+0x1be/0x260
         __put_compound_page+0x90/0xd0
         release_pages+0x54c/0x1060
         __pagevec_release+0x7c/0x110
         shmem_undo_range+0x85e/0x1250
        ...
      
      The repro involved having a huge page that is split due to uprobe event
      temporarily replacing one of the pages in the huge page.  Later the huge
      page was combined again, but the counters were off, as the PTE level was
      not properly updated.
      
      Make sure that when PMD is cleared and prior to freeing the level the
      PTEs are updated.
      
      Link: https://lkml.kernel.org/r/20220131203249.2832273-5-pasha.tatashin@soleen.com
      Fixes: df4e817b ("mm: page table check")
      Signed-off-by: default avatarPasha Tatashin <pasha.tatashin@soleen.com>
      Acked-by: default avatarDavid Rientjes <rientjes@google.com>
      Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
      Cc: Anshuman Khandual <anshuman.khandual@arm.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: Greg Thelen <gthelen@google.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Hugh Dickins <hughd@google.com>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: Jiri Slaby <jirislaby@kernel.org>
      Cc: Mike Rapoport <rppt@kernel.org>
      Cc: Muchun Song <songmuchun@bytedance.com>
      Cc: Paul Turner <pjt@google.com>
      Cc: Wei Xu <weixugc@google.com>
      Cc: Will Deacon <will@kernel.org>
      Cc: Zi Yan <ziy@nvidia.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      80110bbf
    • Pasha Tatashin's avatar
      mm/khugepaged: unify collapse pmd clear, flush and free · e59a47b8
      Pasha Tatashin authored
      Unify the code that flushes, clears pmd entry, and frees the PTE table
      level into a new function collapse_and_free_pmd().
      
      This cleanup is useful as in the next patch we will add another call to
      this function to iterate through PTE prior to freeing the level for page
      table check.
      
      Link: https://lkml.kernel.org/r/20220131203249.2832273-4-pasha.tatashin@soleen.comSigned-off-by: default avatarPasha Tatashin <pasha.tatashin@soleen.com>
      Acked-by: default avatarDavid Rientjes <rientjes@google.com>
      Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
      Cc: Anshuman Khandual <anshuman.khandual@arm.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: Greg Thelen <gthelen@google.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Hugh Dickins <hughd@google.com>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: Jiri Slaby <jirislaby@kernel.org>
      Cc: Mike Rapoport <rppt@kernel.org>
      Cc: Muchun Song <songmuchun@bytedance.com>
      Cc: Paul Turner <pjt@google.com>
      Cc: Wei Xu <weixugc@google.com>
      Cc: Will Deacon <will@kernel.org>
      Cc: Zi Yan <ziy@nvidia.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e59a47b8
    • Pasha Tatashin's avatar
      mm/page_table_check: use unsigned long for page counters and cleanup · 64d8b9e1
      Pasha Tatashin authored
      For consistency, use "unsigned long" for all page counters.
      
      Also, reduce code duplication by calling __page_table_check_*_clear()
      from __page_table_check_*_set() functions.
      
      Link: https://lkml.kernel.org/r/20220131203249.2832273-3-pasha.tatashin@soleen.comSigned-off-by: default avatarPasha Tatashin <pasha.tatashin@soleen.com>
      Reviewed-by: default avatarWei Xu <weixugc@google.com>
      Acked-by: default avatarDavid Rientjes <rientjes@google.com>
      Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
      Cc: Anshuman Khandual <anshuman.khandual@arm.com>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: Greg Thelen <gthelen@google.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Hugh Dickins <hughd@google.com>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: Jiri Slaby <jirislaby@kernel.org>
      Cc: Mike Rapoport <rppt@kernel.org>
      Cc: Muchun Song <songmuchun@bytedance.com>
      Cc: Paul Turner <pjt@google.com>
      Cc: Will Deacon <will@kernel.org>
      Cc: Zi Yan <ziy@nvidia.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      64d8b9e1
    • Pasha Tatashin's avatar
      mm/debug_vm_pgtable: remove pte entry from the page table · fb5222aa
      Pasha Tatashin authored
      Patch series "page table check fixes and cleanups", v5.
      
      This patch (of 4):
      
      The pte entry that is used in pte_advanced_tests() is never removed from
      the page table at the end of the test.
      
      The issue is detected by page_table_check, to repro compile kernel with
      the following configs:
      
      CONFIG_DEBUG_VM_PGTABLE=y
      CONFIG_PAGE_TABLE_CHECK=y
      CONFIG_PAGE_TABLE_CHECK_ENFORCED=y
      
      During the boot the following BUG is printed:
      
        debug_vm_pgtable: [debug_vm_pgtable         ]: Validating architecture page table helpers
        ------------[ cut here ]------------
        kernel BUG at mm/page_table_check.c:162!
        invalid opcode: 0000 [#1] PREEMPT SMP PTI
        CPU: 0 PID: 1 Comm: swapper/0 Not tainted 5.16.0-11413-g2c271fe7 #3
        Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b3f840-prebuilt.qemu.org 04/01/2014
        ...
      
      The entry should be properly removed from the page table before the page
      is released to the free list.
      
      Link: https://lkml.kernel.org/r/20220131203249.2832273-1-pasha.tatashin@soleen.com
      Link: https://lkml.kernel.org/r/20220131203249.2832273-2-pasha.tatashin@soleen.com
      Fixes: a5c3b9ff ("mm/debug_vm_pgtable: add tests validating advanced arch page table helpers")
      Signed-off-by: default avatarPasha Tatashin <pasha.tatashin@soleen.com>
      Reviewed-by: default avatarZi Yan <ziy@nvidia.com>
      Tested-by: default avatarZi Yan <ziy@nvidia.com>
      Acked-by: default avatarDavid Rientjes <rientjes@google.com>
      Reviewed-by: default avatarAnshuman Khandual <anshuman.khandual@arm.com>
      Cc: Paul Turner <pjt@google.com>
      Cc: Wei Xu <weixugc@google.com>
      Cc: Greg Thelen <gthelen@google.com>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: Will Deacon <will@kernel.org>
      Cc: Mike Rapoport <rppt@kernel.org>
      Cc: Dave Hansen <dave.hansen@linux.intel.com>
      Cc: H. Peter Anvin <hpa@zytor.com>
      Cc: Aneesh Kumar K.V <aneesh.kumar@linux.ibm.com>
      Cc: Jiri Slaby <jirislaby@kernel.org>
      Cc: Muchun Song <songmuchun@bytedance.com>
      Cc: Hugh Dickins <hughd@google.com>
      Cc: <stable@vger.kernel.org>	[5.9+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      fb5222aa
    • Chen Wandun's avatar
      Revert "mm/page_isolation: unset migratetype directly for non Buddy page" · a85468b7
      Chen Wandun authored
      This reverts commit 721fb891.
      
      Commit 721fb891 ("mm/page_isolation: unset migratetype directly for
      non Buddy page") will result memory that should in buddy disappear by
      mistake.  move_freepages_block moves all pages in pageblock instead of
      pages indicated by input parameter, so if input pages is not in buddy
      but other pages in pageblock is in buddy, it will result in page out of
      control.
      
      Link: https://lkml.kernel.org/r/20220126024436.13921-1-chenwandun@huawei.com
      Fixes: 721fb891 ("mm/page_isolation: unset migratetype directly for non Buddy page")
      Signed-off-by: default avatarChen Wandun <chenwandun@huawei.com>
      Reported-by: default avatar"kernelci.org bot" <bot@kernelci.org>
      Acked-by: default avatarDavid Hildenbrand <david@redhat.com>
      Tested-by: default avatarDong Aisheng <aisheng.dong@nxp.com>
      Tested-by: default avatarFrancesco Dolcini <francesco.dolcini@toradex.com>
      Acked-by: default avatarVlastimil Babka <vbabka@suse.cz>
      Tested-by: default avatarGuenter Roeck <linux@roeck-us.net>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      a85468b7
    • Joerg Roedel's avatar
      iommu/amd: Fix loop timeout issue in iommu_ga_log_enable() · 9b45a773
      Joerg Roedel authored
      The polling loop for the register change in iommu_ga_log_enable() needs
      to have a udelay() in it.  Otherwise the CPU might be faster than the
      IOMMU hardware and wrongly trigger the WARN_ON() further down the code
      stream. Use a 10us for udelay(), has there is some hardware where
      activation of the GA log can take more than a 100ms.
      
      A future optimization should move the activation check of the GA log
      to the point where it gets used for the first time. But that is a
      bigger change and not suitable for a fix.
      
      Fixes: 8bda0cfb ("iommu/amd: Detect and initialize guest vAPIC log")
      Signed-off-by: default avatarJoerg Roedel <jroedel@suse.de>
      Link: https://lore.kernel.org/r/20220204115537.3894-1-joro@8bytes.org
      9b45a773
    • Dave Airlie's avatar
      Merge tag 'drm-intel-fixes-2022-02-03' of... · 9ca3d3cd
      Dave Airlie authored
      Merge tag 'drm-intel-fixes-2022-02-03' of git://anongit.freedesktop.org/drm/drm-intel into drm-fixes
      
      Fix GitLab issue #4698: DP monitor through Type-C dock(Dell DA310) doesn't work.
      Fixes for inconsistent engine busyness value and read timeout with GuC.
      Fix to use ALLOW_FAIL for error capture buffer allocation. Don't use
      interruptible lock on error path. Smatch fix to reject zero sized overlays.
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Joonas Lahtinen <joonas.lahtinen@linux.intel.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/YfuiG8SKMKP5V/Dm@jlahtine-mobl.ger.corp.intel.com
      9ca3d3cd
    • Dave Airlie's avatar
      Merge tag 'drm-misc-fixes-2022-02-03' of git://anongit.freedesktop.org/drm/drm-misc into drm-fixes · 8ea2c518
      Dave Airlie authored
       * dma-buf/heaps: Fix potential spectre v1 gadget
       * drm/kmb: Fix potential out-of-bounds access
       * drm/mxsfb: Fix NULL-pointer dereference
       * drm/nouveau: Fix potential out-of-bounds access in BIOS decoding
       * fbdev: Re-add support for fbcon hardware acceleration
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      
      From: Thomas Zimmermann <tzimmermann@suse.de>
      Link: https://patchwork.freedesktop.org/patch/msgid/Yfu8mTZQUNt1RwZd@linux-uq9g
      8ea2c518
    • Dave Airlie's avatar
      Merge tag 'amd-drm-fixes-5.17-2022-02-02' of... · 7eb3848c
      Dave Airlie authored
      Merge tag 'amd-drm-fixes-5.17-2022-02-02' of https://gitlab.freedesktop.org/agd5f/linux into drm-fixes
      
      amd-drm-fixes-5.17-2022-02-02:
      
      amdgpu:
      - mGPU fan boost fix for beige goby
      - S0ix fixes
      - Cyan skillfish hang fix
      - DCN fixes for DCN 3.1
      - DCN fixes for DCN 3.01
      - Apple retina panel fix
      - ttm logic inversion fix
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexander.deucher@amd.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20220203035224.5801-1-alexander.deucher@amd.com
      7eb3848c
    • Kees Cook's avatar
      gcc-plugins/stackleak: Use noinstr in favor of notrace · dcb85f85
      Kees Cook authored
      While the stackleak plugin was already using notrace, objtool is now a
      bit more picky.  Update the notrace uses to noinstr.  Silences the
      following objtool warnings when building with:
      
      CONFIG_DEBUG_ENTRY=y
      CONFIG_STACK_VALIDATION=y
      CONFIG_VMLINUX_VALIDATION=y
      CONFIG_GCC_PLUGIN_STACKLEAK=y
      
        vmlinux.o: warning: objtool: do_syscall_64()+0x9: call to stackleak_track_stack() leaves .noinstr.text section
        vmlinux.o: warning: objtool: do_int80_syscall_32()+0x9: call to stackleak_track_stack() leaves .noinstr.text section
        vmlinux.o: warning: objtool: exc_general_protection()+0x22: call to stackleak_track_stack() leaves .noinstr.text section
        vmlinux.o: warning: objtool: fixup_bad_iret()+0x20: call to stackleak_track_stack() leaves .noinstr.text section
        vmlinux.o: warning: objtool: do_machine_check()+0x27: call to stackleak_track_stack() leaves .noinstr.text section
        vmlinux.o: warning: objtool: .text+0x5346e: call to stackleak_erase() leaves .noinstr.text section
        vmlinux.o: warning: objtool: .entry.text+0x143: call to stackleak_erase() leaves .noinstr.text section
        vmlinux.o: warning: objtool: .entry.text+0x10eb: call to stackleak_erase() leaves .noinstr.text section
        vmlinux.o: warning: objtool: .entry.text+0x17f9: call to stackleak_erase() leaves .noinstr.text section
      
      Note that the plugin's addition of calls to stackleak_track_stack() from
      noinstr functions is expected to be safe, as it isn't runtime
      instrumentation and is self-contained.
      
      Cc: Alexander Popov <alex.popov@linux.com>
      Suggested-by: default avatarPeter Zijlstra <peterz@infradead.org>
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      dcb85f85
    • Linus Torvalds's avatar
      Merge tag 'net-5.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net · eb2eb516
      Linus Torvalds authored
      Pull networking fixes from Jakub Kicinski:
       "Including fixes from bpf, netfilter, and ieee802154.
      
        Current release - regressions:
      
         - Partially revert "net/smc: Add netlink net namespace support", fix
           uABI breakage
      
         - netfilter:
            - nft_ct: fix use after free when attaching zone template
            - nft_byteorder: track register operations
      
        Previous releases - regressions:
      
         - ipheth: fix EOVERFLOW in ipheth_rcvbulk_callback
      
         - phy: qca8081: fix speeds lower than 2.5Gb/s
      
         - sched: fix use-after-free in tc_new_tfilter()
      
        Previous releases - always broken:
      
         - tcp: fix mem under-charging with zerocopy sendmsg()
      
         - tcp: add missing tcp_skb_can_collapse() test in
           tcp_shift_skb_data()
      
         - neigh: do not trigger immediate probes on NUD_FAILED from
           neigh_managed_work, avoid a deadlock
      
         - bpf: use VM_MAP instead of VM_ALLOC for ringbuf, avoid KASAN
           false-positives
      
         - netfilter: nft_reject_bridge: fix for missing reply from prerouting
      
         - smc: forward wakeup to smc socket waitqueue after fallback
      
         - ieee802154:
            - return meaningful error codes from the netlink helpers
            - mcr20a: fix lifs/sifs periods
            - at86rf230, ca8210: stop leaking skbs on error paths
      
         - macsec: add missing un-offload call for NETDEV_UNREGISTER of parent
      
         - ax25: add refcount in ax25_dev to avoid UAF bugs
      
         - eth: mlx5e:
            - fix SFP module EEPROM query
            - fix broken SKB allocation in HW-GRO
            - IPsec offload: fix tunnel mode crypto for non-TCP/UDP flows
      
         - eth: amd-xgbe:
            - fix skb data length underflow
            - ensure reset of the tx_timer_active flag, avoid Tx timeouts
      
         - eth: stmmac: fix runtime pm use in stmmac_dvr_remove()
      
         - eth: e1000e: handshake with CSME starts from Alder Lake platforms"
      
      * tag 'net-5.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (69 commits)
        ax25: fix reference count leaks of ax25_dev
        net: stmmac: ensure PTP time register reads are consistent
        net: ipa: request IPA register values be retained
        dt-bindings: net: qcom,ipa: add optional qcom,qmp property
        tools/resolve_btfids: Do not print any commands when building silently
        bpf: Use VM_MAP instead of VM_ALLOC for ringbuf
        net, neigh: Do not trigger immediate probes on NUD_FAILED from neigh_managed_work
        tcp: add missing tcp_skb_can_collapse() test in tcp_shift_skb_data()
        net: sparx5: do not refer to skb after passing it on
        Partially revert "net/smc: Add netlink net namespace support"
        net/mlx5e: Avoid field-overflowing memcpy()
        net/mlx5e: Use struct_group() for memcpy() region
        net/mlx5e: Avoid implicit modify hdr for decap drop rule
        net/mlx5e: IPsec: Fix tunnel mode crypto offload for non TCP/UDP traffic
        net/mlx5e: IPsec: Fix crypto offload for non TCP/UDP encapsulated traffic
        net/mlx5e: Don't treat small ceil values as unlimited in HTB offload
        net/mlx5: E-Switch, Fix uninitialized variable modact
        net/mlx5e: Fix handling of wrong devices during bond netevent
        net/mlx5e: Fix broken SKB allocation in HW-GRO
        net/mlx5e: Fix wrong calculation of header index in HW_GRO
        ...
      eb2eb516
    • Linus Torvalds's avatar
      Merge tag 'selinux-pr-20220203' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux · 551007a8
      Linus Torvalds authored
      Pull selinux fix from Paul Moore:
       "One small SELinux patch to ensure that a policy structure field is
        properly reset after freeing so that we don't inadvertently do a
        double-free on certain error conditions"
      
      * tag 'selinux-pr-20220203' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
        selinux: fix double free of cond_list on error paths
      551007a8
    • Linus Torvalds's avatar
      Merge tag 'linux-kselftest-fixes-5.17-rc3' of... · 25b20ae8
      Linus Torvalds authored
      Merge tag 'linux-kselftest-fixes-5.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
      
      Pull Kselftest fixes from Shuah Khan:
       "Important fixes to several tests and documentation clarification on
        running mainline kselftest on stable releases. A few notable fixes:
      
         - fix kselftest run hang due to child processes that haven't been
           terminated. Fix signals all child processes
      
         - fix false pass/fail results from vdso_test_abi, openat2, mincore
      
         - build failures when using -j (multiple jobs) option
      
         - exec test build failure due to incorrect build rule for a run-time
           created "pipe"
      
         - zram test fixes related to interaction with zram-generator to make
           sure zram test to coordinate deleted with zram-generator
      
         - zram test compression ratio calculation fix and skipping
           max_comp_streams.
      
         - increasing rtc test timeout
      
         - cpufreq test to write test results to stdout which will necessary
           on automated test systems"
      
      * tag 'linux-kselftest-fixes-5.17-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
        kselftest: Fix vdso_test_abi return status
        selftests: skip mincore.check_file_mmap when fs lacks needed support
        selftests: openat2: Skip testcases that fail with EOPNOTSUPP
        selftests: openat2: Add missing dependency in Makefile
        selftests: openat2: Print also errno in failure messages
        selftests: futex: Use variable MAKE instead of make
        selftests/exec: Remove pipe from TEST_GEN_FILES
        selftests/zram: Adapt the situation that /dev/zram0 is being used
        selftests/zram01.sh: Fix compression ratio calculation
        selftests/zram: Skip max_comp_streams interface on newer kernel
        docs/kselftest: clarify running mainline tests on stables
        kselftest: signal all child processes
        selftests: cpufreq: Write test output to stdout as well
        selftests: rtc: Increase test timeout so that all tests run
      25b20ae8
  2. 03 Feb, 2022 8 commits