1. 26 Jul, 2021 11 commits
  2. 25 Jul, 2021 9 commits
  3. 24 Jul, 2021 20 commits
    • Linus Torvalds's avatar
      Merge tag 'riscv-for-linus-5.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux · 6498f615
      Linus Torvalds authored
      Pull RISC-V fixes from Palmer Dabbelt:
      
       - properly set the memory size, which fixes 32-bit systems
      
       - allow initrd to load anywhere in memory, rather that restricting it
         to the first 256MiB
      
       - fix the 'mem=' parameter on 64-bit systems to properly account for
         the maximum supported memory now that the kernel is outside the
         linear map
      
       - avoid installing mappings into the last 4KiB of memory, which
         conflicts with error values
      
       - avoid the stack from being freed while it is being walked
      
       - a handful of fixes to the new copy to/from user routines
      
      * tag 'riscv-for-linus-5.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
        riscv: __asm_copy_to-from_user: Fix: Typos in comments
        riscv: __asm_copy_to-from_user: Remove unnecessary size check
        riscv: __asm_copy_to-from_user: Fix: fail on RV32
        riscv: __asm_copy_to-from_user: Fix: overrun copy
        riscv: stacktrace: pin the task's stack in get_wchan
        riscv: Make sure the kernel mapping does not overlap with IS_ERR_VALUE
        riscv: Make sure the linear mapping does not use the kernel mapping
        riscv: Fix memory_limit for 64-bit kernel
        RISC-V: load initrd wherever it fits into memory
        riscv: Fix 32-bit RISC-V boot failure
      6498f615
    • Linus Torvalds's avatar
      ACPI: fix NULL pointer dereference · fc68f42a
      Linus Torvalds authored
      Commit 71f64283 ("ACPI: utils: Fix reference counting in
      for_each_acpi_dev_match()") started doing "acpi_dev_put()" on a pointer
      that was possibly NULL.  That fails miserably, because that helper
      inline function is not set up to handle that case.
      
      Just make acpi_dev_put() silently accept a NULL pointer, rather than
      calling down to put_device() with an invalid offset off that NULL
      pointer.
      
      Link: https://lore.kernel.org/lkml/a607c149-6bf6-0fd0-0e31-100378504da2@kernel.dk/Reported-and-tested-by: default avatarJens Axboe <axboe@kernel.dk>
      Tested-by: default avatarDaniel Scally <djrscally@gmail.com>
      Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      fc68f42a
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 7ffca2bb
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Four fixes, all in drivers, all of which can lead to user visible
        problems in certain situations"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: target: Fix NULL dereference on XCOPY completion
        scsi: mpt3sas: Transition IOC to Ready state during shutdown
        scsi: target: Fix protect handling in WRITE SAME(32)
        scsi: iscsi: Fix iface sysfs attr detection
      7ffca2bb
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.14-2021-07-24' of git://git.kernel.dk/linux-block · 0ee818c3
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
      
       - Fix a memory leak due to a race condition in io_init_wq_offload
         (Yang)
      
       - Poll error handling fixes (Pavel)
      
       - Fix early fdput() regression (me)
      
       - Don't reissue iopoll requests off release path (me)
      
       - Add a safety check for io-wq queue off wrong path (me)
      
      * tag 'io_uring-5.14-2021-07-24' of git://git.kernel.dk/linux-block:
        io_uring: explicitly catch any illegal async queue attempt
        io_uring: never attempt iopoll reissue from release path
        io_uring: fix early fdput() of file
        io_uring: fix memleak in io_init_wq_offload()
        io_uring: remove double poll entry on arm failure
        io_uring: explicitly count entries for poll reqs
      0ee818c3
    • Linus Torvalds's avatar
      Merge tag 'block-5.14-2021-07-24' of git://git.kernel.dk/linux-block · 4d4a60ce
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
      
       - NVMe pull request (Christoph):
          - tracing fix (Keith Busch)
          - fix multipath head refcounting (Hannes Reinecke)
          - Write Zeroes vs PI fix (me)
          - drop a bogus WARN_ON (Zhihao Cheng)
      
       - Increase max blk-cgroup policy size, now that mq-deadline
         uses it too (Oleksandr)
      
      * tag 'block-5.14-2021-07-24' of git://git.kernel.dk/linux-block:
        nvme: set the PRACT bit when using Write Zeroes with T10 PI
        nvme: fix nvme_setup_command metadata trace event
        nvme: fix refcounting imbalance when all paths are down
        nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is not RESETTING
        block: increase BLKCG_MAX_POLS
      4d4a60ce
    • Linus Torvalds's avatar
      Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · 0823baef
      Linus Torvalds authored
      Pull i2c fixes from Wolfram Sang:
       "Two bugfixes for the I2C subsystem"
      
      * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        i2c: mpc: Poll for MCF
        misc: eeprom: at24: Always append device id even if label property is set.
      0823baef
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · bca1d4de
      Linus Torvalds authored
      Merge misc mm fixes from Andrew Morton:
       "15 patches.
      
        VM subsystems affected by this patch series: userfaultfd, kfence,
        highmem, pagealloc, memblock, pagecache, secretmem, pagemap, and
        hugetlbfs"
      
      * akpm:
        hugetlbfs: fix mount mode command line processing
        mm: fix the deadlock in finish_fault()
        mm: mmap_lock: fix disabling preemption directly
        mm/secretmem: wire up ->set_page_dirty
        writeback, cgroup: do not reparent dax inodes
        writeback, cgroup: remove wb from offline list before releasing refcnt
        memblock: make for_each_mem_range() traverse MEMBLOCK_HOTPLUG regions
        mm: page_alloc: fix page_poison=1 / INIT_ON_ALLOC_DEFAULT_ON interaction
        mm: use kmap_local_page in memzero_page
        mm: call flush_dcache_page() in memcpy_to_page() and memzero_page()
        kfence: skip all GFP_ZONEMASK allocations
        kfence: move the size check to the beginning of __kfence_alloc()
        kfence: defer kfence_test_init to ensure that kunit debugfs is created
        selftest: use mmap instead of posix_memalign to allocate memory
        userfaultfd: do not untag user pointers
      bca1d4de
    • Akira Tsukamoto's avatar
      riscv: __asm_copy_to-from_user: Fix: Typos in comments · ea196c54
      Akira Tsukamoto authored
      Fixing typos and grammar mistakes and using more intuitive label
      name.
      Signed-off-by: default avatarAkira Tsukamoto <akira.tsukamoto@gmail.com>
      Fixes: ca6eaaa2 ("riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall")
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      ea196c54
    • Akira Tsukamoto's avatar
      riscv: __asm_copy_to-from_user: Remove unnecessary size check · d4b3e010
      Akira Tsukamoto authored
      Clean up:
      
      The size of 0 will be evaluated in the next step. Not
      required here.
      Signed-off-by: default avatarAkira Tsukamoto <akira.tsukamoto@gmail.com>
      Fixes: ca6eaaa2 ("riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall")
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      d4b3e010
    • Akira Tsukamoto's avatar
      riscv: __asm_copy_to-from_user: Fix: fail on RV32 · 22b5f16f
      Akira Tsukamoto authored
      Had a bug when converting bytes to bits when the cpu was rv32.
      
      The a3 contains the number of bytes and multiple of 8
      would be the bits. The LGREG is holding 2 for RV32 and 3 for
      RV32, so to achieve multiple of 8 it must always be constant 3.
      The 2 was mistakenly used for rv32.
      Signed-off-by: default avatarAkira Tsukamoto <akira.tsukamoto@gmail.com>
      Fixes: ca6eaaa2 ("riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall")
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      22b5f16f
    • Akira Tsukamoto's avatar
      riscv: __asm_copy_to-from_user: Fix: overrun copy · 6010d300
      Akira Tsukamoto authored
      There were two causes for the overrun memory access.
      
      The threshold size was too small.
      The aligning dst require one SZREG and unrolling word copy requires
      8*SZREG, total have to be at least 9*SZREG.
      
      Inside the unrolling copy, the subtracting -(8*SZREG-1) would make
      iteration happening one extra loop. Proper value is -(8*SZREG).
      Signed-off-by: default avatarAkira Tsukamoto <akira.tsukamoto@gmail.com>
      Fixes: ca6eaaa2 ("riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall")
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      6010d300
    • Mike Kravetz's avatar
      hugetlbfs: fix mount mode command line processing · e0f7e2b2
      Mike Kravetz authored
      In commit 32021982 ("hugetlbfs: Convert to fs_context") processing
      of the mount mode string was changed from match_octal() to fsparam_u32.
      
      This changed existing behavior as match_octal does not require octal
      values to have a '0' prefix, but fsparam_u32 does.
      
      Use fsparam_u32oct which provides the same behavior as match_octal.
      
      Link: https://lkml.kernel.org/r/20210721183326.102716-1-mike.kravetz@oracle.com
      Fixes: 32021982 ("hugetlbfs: Convert to fs_context")
      Signed-off-by: default avatarMike Kravetz <mike.kravetz@oracle.com>
      Reported-by: default avatarDennis Camera <bugs+kernel.org@dtnr.ch>
      Reviewed-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
      Cc: David Howells <dhowells@redhat.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e0f7e2b2
    • Qi Zheng's avatar
      mm: fix the deadlock in finish_fault() · e4dc3489
      Qi Zheng authored
      Commit 63f3655f ("mm, memcg: fix reclaim deadlock with writeback")
      fix the following ABBA deadlock by pre-allocating the pte page table
      without holding the page lock.
      
      	                                lock_page(A)
                                              SetPageWriteback(A)
                                              unlock_page(A)
        lock_page(B)
                                              lock_page(B)
        pte_alloc_one
          shrink_page_list
            wait_on_page_writeback(A)
                                              SetPageWriteback(B)
                                              unlock_page(B)
      
                                              # flush A, B to clear the writeback
      
      Commit f9ce0be7 ("mm: Cleanup faultaround and finish_fault()
      codepaths") reworked the relevant code but ignored this race.  This will
      cause the deadlock above to appear again, so fix it.
      
      Link: https://lkml.kernel.org/r/20210721074849.57004-1-zhengqi.arch@bytedance.com
      Fixes: f9ce0be7 ("mm: Cleanup faultaround and finish_fault() codepaths")
      Signed-off-by: default avatarQi Zheng <zhengqi.arch@bytedance.com>
      Acked-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Cc: Michal Hocko <mhocko@kernel.org>
      Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
      Cc: Muchun Song <songmuchun@bytedance.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e4dc3489
    • Muchun Song's avatar
      mm: mmap_lock: fix disabling preemption directly · e904c2cc
      Muchun Song authored
      Commit 832b5072 ("mm: mmap_lock: use local locks instead of
      disabling preemption") fixed a bug by using local locks.
      
      But commit d01079f3 ("mm/mmap_lock: remove dead code for
      !CONFIG_TRACING configurations") changed those lines back to the
      original version.
      
      I guess it was introduced by fixing conflicts.
      
      Link: https://lkml.kernel.org/r/20210720074228.76342-1-songmuchun@bytedance.com
      Fixes: d01079f3 ("mm/mmap_lock: remove dead code for !CONFIG_TRACING configurations")
      Signed-off-by: default avatarMuchun Song <songmuchun@bytedance.com>
      Acked-by: default avatarMel Gorman <mgorman@techsingularity.net>
      Reviewed-by: default avatarYang Shi <shy828301@gmail.com>
      Reviewed-by: default avatarPankaj Gupta <pankaj.gupta@ionos.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e904c2cc
    • Mike Rapoport's avatar
      mm/secretmem: wire up ->set_page_dirty · af642374
      Mike Rapoport authored
      Make secretmem up to date with the changes done in commit 0af57378
      ("mm: require ->set_page_dirty to be explicitly wired up") so that
      unconditional call to this method won't cause crashes.
      
      Link: https://lkml.kernel.org/r/20210716063933.31633-1-rppt@kernel.org
      Fixes: 0af57378 ("mm: require ->set_page_dirty to be explicitly wired up")
      Signed-off-by: default avatarMike Rapoport <rppt@linux.ibm.com>
      Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      af642374
    • Roman Gushchin's avatar
      writeback, cgroup: do not reparent dax inodes · 593311e8
      Roman Gushchin authored
      The inode switching code is not suited for dax inodes.  An attempt to
      switch a dax inode to a parent writeback structure (as a part of a
      writeback cleanup procedure) results in a panic like this:
      
        run fstests generic/270 at 2021-07-15 05:54:02
        XFS (pmem0p2): EXPERIMENTAL big timestamp feature in use.  Use at your own risk!
        XFS (pmem0p2): DAX enabled. Warning: EXPERIMENTAL, use at your own risk
        XFS (pmem0p2): EXPERIMENTAL inode btree counters feature in use. Use at your own risk!
        XFS (pmem0p2): Mounting V5 Filesystem
        XFS (pmem0p2): Ending clean mount
        XFS (pmem0p2): Quotacheck needed: Please wait.
        XFS (pmem0p2): Quotacheck: Done.
        XFS (pmem0p2): xlog_verify_grant_tail: space > BBTOB(tail_blocks)
        XFS (pmem0p2): xlog_verify_grant_tail: space > BBTOB(tail_blocks)
        XFS (pmem0p2): xlog_verify_grant_tail: space > BBTOB(tail_blocks)
        BUG: unable to handle page fault for address: 0000000005b0f669
        #PF: supervisor read access in kernel mode
        #PF: error_code(0x0000) - not-present page
        PGD 0 P4D 0
        Oops: 0000 [#1] SMP PTI
        CPU: 13 PID: 10479 Comm: kworker/13:16 Not tainted 5.14.0-rc1-master-8096acd7+ #8
        Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 09/13/2016
        Workqueue: inode_switch_wbs inode_switch_wbs_work_fn
        RIP: 0010:inode_do_switch_wbs+0xaf/0x470
        Code: 00 30 0f 85 c1 03 00 00 0f 1f 44 00 00 31 d2 48 c7 c6 ff ff ff ff 48 8d 7c 24 08 e8 eb 49 1a 00 48 85 c0 74 4a bb ff ff ff ff <48> 8b 50 08 48 8d 4a ff 83 e2 01 48 0f 45 c1 48 8b 00 a8 08 0f 85
        RSP: 0018:ffff9c66691abdc8 EFLAGS: 00010002
        RAX: 0000000005b0f661 RBX: 00000000ffffffff RCX: ffff89e6a21382b0
        RDX: 0000000000000001 RSI: ffff89e350230248 RDI: ffffffffffffffff
        RBP: ffff89e681d19400 R08: 0000000000000000 R09: 0000000000000228
        R10: ffffffffffffffff R11: ffffffffffffffc0 R12: ffff89e6a2138130
        R13: ffff89e316af7400 R14: ffff89e316af6e78 R15: ffff89e6a21382b0
        FS:  0000000000000000(0000) GS:ffff89ee5fb40000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 0000000005b0f669 CR3: 0000000cb2410004 CR4: 00000000001706e0
        Call Trace:
         inode_switch_wbs_work_fn+0xb6/0x2a0
         process_one_work+0x1e6/0x380
         worker_thread+0x53/0x3d0
         kthread+0x10f/0x130
         ret_from_fork+0x22/0x30
        Modules linked in: xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_counter nf_tables nfnetlink bridge stp llc rfkill sunrpc intel_rapl_msr intel_rapl_common sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel ipmi_ssif kvm mgag200 i2c_algo_bit iTCO_wdt irqbypass drm_kms_helper iTCO_vendor_support acpi_ipmi rapl syscopyarea sysfillrect intel_cstate ipmi_si sysimgblt ioatdma dax_pmem_compat fb_sys_fops ipmi_devintf device_dax i2c_i801 pcspkr intel_uncore hpilo nd_pmem cec dax_pmem_core dca i2c_smbus acpi_tad lpc_ich ipmi_msghandler acpi_power_meter drm fuse xfs libcrc32c sd_mod t10_pi crct10dif_pclmul crc32_pclmul crc32c_intel tg3 ghash_clmulni_intel serio_raw hpsa hpwdt scsi_transport_sas wmi dm_mirror dm_region_hash dm_log dm_mod
        CR2: 0000000005b0f669
        ---[ end trace ed2105faff8384f3 ]---
        RIP: 0010:inode_do_switch_wbs+0xaf/0x470
        Code: 00 30 0f 85 c1 03 00 00 0f 1f 44 00 00 31 d2 48 c7 c6 ff ff ff ff 48 8d 7c 24 08 e8 eb 49 1a 00 48 85 c0 74 4a bb ff ff ff ff <48> 8b 50 08 48 8d 4a ff 83 e2 01 48 0f 45 c1 48 8b 00 a8 08 0f 85
        RSP: 0018:ffff9c66691abdc8 EFLAGS: 00010002
        RAX: 0000000005b0f661 RBX: 00000000ffffffff RCX: ffff89e6a21382b0
        RDX: 0000000000000001 RSI: ffff89e350230248 RDI: ffffffffffffffff
        RBP: ffff89e681d19400 R08: 0000000000000000 R09: 0000000000000228
        R10: ffffffffffffffff R11: ffffffffffffffc0 R12: ffff89e6a2138130
        R13: ffff89e316af7400 R14: ffff89e316af6e78 R15: ffff89e6a21382b0
        FS:  0000000000000000(0000) GS:ffff89ee5fb40000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 0000000005b0f669 CR3: 0000000cb2410004 CR4: 00000000001706e0
        Kernel panic - not syncing: Fatal exception
        Kernel Offset: 0x15200000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
        ---[ end Kernel panic - not syncing: Fatal exception ]---
      
      The crash happens on an attempt to iterate over attached pagecache pages
      and check the dirty flag: a dax inode's xarray contains pfn's instead of
      generic struct page pointers.
      
      This happens for DAX and not for other kinds of non-page entries in the
      inodes because it's a tagged iteration, and shadow/swap entries are
      never tagged; only DAX entries get tagged.
      
      Fix the problem by bailing out (with the false return value) of
      inode_prepare_sbs_switch() if a dax inode is passed.
      
      [willy@infradead.org: changelog addition]
      
      Link: https://lkml.kernel.org/r/20210719171350.3876830-1-guro@fb.com
      Fixes: c22d70a1 ("writeback, cgroup: release dying cgwbs by switching attached inodes")
      Signed-off-by: default avatarRoman Gushchin <guro@fb.com>
      Reported-by: default avatarMurphy Zhou <jencce.kernel@gmail.com>
      Reported-by: default avatarDarrick J. Wong <djwong@kernel.org>
      Tested-by: default avatarDarrick J. Wong <djwong@kernel.org>
      Tested-by: default avatarMurphy Zhou <jencce.kernel@gmail.com>
      Acked-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
      Cc: Jan Kara <jack@suse.cz>
      Cc: Dave Chinner <dchinner@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      593311e8
    • Roman Gushchin's avatar
      writeback, cgroup: remove wb from offline list before releasing refcnt · b43a9e76
      Roman Gushchin authored
      Boyang reported that the commit c22d70a1 ("writeback, cgroup:
      release dying cgwbs by switching attached inodes") causes the kernel to
      crash while running xfstests generic/256 on ext4 on aarch64 and ppc64le.
      
        run fstests generic/256 at 2021-07-12 05:41:40
        EXT4-fs (vda3): mounted filesystem with ordered data mode. Opts: . Quota mode: none.
        Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
        Mem abort info:
           ESR = 0x96000005
           EC = 0x25: DABT (current EL), IL = 32 bits
           SET = 0, FnV = 0
           EA = 0, S1PTW = 0
           FSC = 0x05: level 1 translation fault
        Data abort info:
           ISV = 0, ISS = 0x00000005
           CM = 0, WnR = 0
        user pgtable: 64k pages, 48-bit VAs, pgdp=00000000b0502000
        [0000000000000000] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
        Internal error: Oops: 96000005 [#1] SMP
        Modules linked in: dm_flakey dm_snapshot dm_bufio dm_zero dm_mod loop tls rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs rfkill sunrpc ext4 vfat fat mbcache jbd2 drm fuse xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce virtio_blk virtio_net net_failover virtio_console failover virtio_mmio aes_neon_bs [last unloaded: scsi_debug]
        CPU: 0 PID: 408468 Comm: kworker/u8:5 Tainted: G X --------- ---  5.14.0-0.rc1.15.bx.el9.aarch64 #1
        Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
        Workqueue: events_unbound cleanup_offline_cgwbs_workfn
        pstate: 004000c5 (nzcv daIF +PAN -UAO -TCO BTYPE=--)
        pc : cleanup_offline_cgwbs_workfn+0x320/0x394
        lr : cleanup_offline_cgwbs_workfn+0xe0/0x394
        sp : ffff80001554fd10
        x29: ffff80001554fd10 x28: 0000000000000000 x27: 0000000000000001
        x26: 0000000000000000 x25: 00000000000000e0 x24: ffffd2a2fbe671a8
        x23: ffff80001554fd88 x22: ffffd2a2fbe67198 x21: ffffd2a2fc25a730
        x20: ffff210412bc3000 x19: ffff210412bc3280 x18: 0000000000000000
        x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
        x14: 0000000000000000 x13: 0000000000000030 x12: 0000000000000040
        x11: ffff210481572238 x10: ffff21048157223a x9 : ffffd2a2fa276c60
        x8 : ffff210484106b60 x7 : 0000000000000000 x6 : 000000000007d18a
        x5 : ffff210416a86400 x4 : ffff210412bc0280 x3 : 0000000000000000
        x2 : ffff80001554fd88 x1 : ffff210412bc0280 x0 : 0000000000000003
        Call trace:
           cleanup_offline_cgwbs_workfn+0x320/0x394
           process_one_work+0x1f4/0x4b0
           worker_thread+0x184/0x540
           kthread+0x114/0x120
           ret_from_fork+0x10/0x18
        Code: d63f0020 97f99963 17ffffa6 f8588263 (f9400061)
        ---[ end trace e250fe289272792a ]---
        Kernel panic - not syncing: Oops: Fatal exception
        SMP: stopping secondary CPUs
        SMP: failed to stop secondary CPUs 0-2
        Kernel Offset: 0x52a2e9fa0000 from 0xffff800010000000
        PHYS_OFFSET: 0xfff0defca0000000
        CPU features: 0x00200251,23200840
        Memory Limit: none
        ---[ end Kernel panic - not syncing: Oops: Fatal exception ]---
      
      The problem happens when cgwb_release_workfn() races with
      cleanup_offline_cgwbs_workfn(): wb_tryget() in
      cleanup_offline_cgwbs_workfn() can be called after percpu_ref_exit() is
      cgwb_release_workfn(), which is basically a use-after-free error.
      
      Fix the problem by making removing the writeback structure from the
      offline list before releasing the percpu reference counter.  It will
      guarantee that cleanup_offline_cgwbs_workfn() will not see and not
      access writeback structures which are about to be released.
      
      Link: https://lkml.kernel.org/r/20210716201039.3762203-1-guro@fb.com
      Fixes: c22d70a1 ("writeback, cgroup: release dying cgwbs by switching attached inodes")
      Signed-off-by: default avatarRoman Gushchin <guro@fb.com>
      Reported-by: default avatarBoyang Xue <bxue@redhat.com>
      Suggested-by: default avatarJan Kara <jack@suse.cz>
      Tested-by: default avatarDarrick J. Wong <djwong@kernel.org>
      Cc: Will Deacon <will@kernel.org>
      Cc: Dave Chinner <dchinner@redhat.com>
      Cc: Murphy Zhou <jencce.kernel@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b43a9e76
    • Mike Rapoport's avatar
      memblock: make for_each_mem_range() traverse MEMBLOCK_HOTPLUG regions · 79e482e9
      Mike Rapoport authored
      Commit b10d6bca ("arch, drivers: replace for_each_membock() with
      for_each_mem_range()") didn't take into account that when there is
      movable_node parameter in the kernel command line, for_each_mem_range()
      would skip ranges marked with MEMBLOCK_HOTPLUG.
      
      The page table setup code in POWER uses for_each_mem_range() to create
      the linear mapping of the physical memory and since the regions marked
      as MEMORY_HOTPLUG are skipped, they never make it to the linear map.
      
      A later access to the memory in those ranges will fail:
      
        BUG: Unable to handle kernel data access on write at 0xc000000400000000
        Faulting instruction address: 0xc00000000008a3c0
        Oops: Kernel access of bad area, sig: 11 [#1]
        LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
        Modules linked in:
        CPU: 0 PID: 53 Comm: kworker/u2:0 Not tainted 5.13.0 #7
        NIP:  c00000000008a3c0 LR: c0000000003c1ed8 CTR: 0000000000000040
        REGS: c000000008a57770 TRAP: 0300   Not tainted  (5.13.0)
        MSR:  8000000002009033 <SF,VEC,EE,ME,IR,DR,RI,LE>  CR: 84222202  XER: 20040000
        CFAR: c0000000003c1ed4 DAR: c000000400000000 DSISR: 42000000 IRQMASK: 0
        GPR00: c0000000003c1ed8 c000000008a57a10 c0000000019da700 c000000400000000
        GPR04: 0000000000000280 0000000000000180 0000000000000400 0000000000000200
        GPR08: 0000000000000100 0000000000000080 0000000000000040 0000000000000300
        GPR12: 0000000000000380 c000000001bc0000 c0000000001660c8 c000000006337e00
        GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
        GPR20: 0000000040000000 0000000020000000 c000000001a81990 c000000008c30000
        GPR24: c000000008c20000 c000000001a81998 000fffffffff0000 c000000001a819a0
        GPR28: c000000001a81908 c00c000001000000 c000000008c40000 c000000008a64680
        NIP clear_user_page+0x50/0x80
        LR __handle_mm_fault+0xc88/0x1910
        Call Trace:
          __handle_mm_fault+0xc44/0x1910 (unreliable)
          handle_mm_fault+0x130/0x2a0
          __get_user_pages+0x248/0x610
          __get_user_pages_remote+0x12c/0x3e0
          get_arg_page+0x54/0xf0
          copy_string_kernel+0x11c/0x210
          kernel_execve+0x16c/0x220
          call_usermodehelper_exec_async+0x1b0/0x2f0
          ret_from_kernel_thread+0x5c/0x70
        Instruction dump:
        79280fa4 79271764 79261f24 794ae8e2 7ca94214 7d683a14 7c893a14 7d893050
        7d4903a6 60000000 60000000 60000000 <7c001fec> 7c091fec 7c081fec 7c051fec
        ---[ end trace 490b8c67e6075e09 ]---
      
      Making for_each_mem_range() include MEMBLOCK_HOTPLUG regions in the
      traversal fixes this issue.
      
      Link: https://bugzilla.redhat.com/show_bug.cgi?id=1976100
      Link: https://lkml.kernel.org/r/20210712071132.20902-1-rppt@kernel.org
      Fixes: b10d6bca ("arch, drivers: replace for_each_membock() with for_each_mem_range()")
      Signed-off-by: default avatarMike Rapoport <rppt@linux.ibm.com>
      Tested-by: default avatarGreg Kurz <groug@kaod.org>
      Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
      Cc: <stable@vger.kernel.org>	[5.10+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      79e482e9
    • Sergei Trofimovich's avatar
      mm: page_alloc: fix page_poison=1 / INIT_ON_ALLOC_DEFAULT_ON interaction · 69e5d322
      Sergei Trofimovich authored
      To reproduce the failure we need the following system:
      
       - kernel command: page_poison=1 init_on_free=0 init_on_alloc=0
      
       - kernel config:
          * CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
          * CONFIG_INIT_ON_FREE_DEFAULT_ON=y
          * CONFIG_PAGE_POISONING=y
      
      Resulting in:
      
          0000000085629bdd: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
          0000000022861832: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
          00000000c597f5b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
          CPU: 11 PID: 15195 Comm: bash Kdump: loaded Tainted: G     U     O      5.13.1-gentoo-x86_64 #1
          Hardware name: System manufacturer System Product Name/PRIME Z370-A, BIOS 2801 01/13/2021
          Call Trace:
           dump_stack+0x64/0x7c
           __kernel_unpoison_pages.cold+0x48/0x84
           post_alloc_hook+0x60/0xa0
           get_page_from_freelist+0xdb8/0x1000
           __alloc_pages+0x163/0x2b0
           __get_free_pages+0xc/0x30
           pgd_alloc+0x2e/0x1a0
           mm_init+0x185/0x270
           dup_mm+0x6b/0x4f0
           copy_process+0x190d/0x1b10
           kernel_clone+0xba/0x3b0
           __do_sys_clone+0x8f/0xb0
           do_syscall_64+0x68/0x80
           entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      Before commit 51cba1eb ("init_on_alloc: Optimize static branches")
      init_on_alloc never enabled static branch by default.  It could only be
      enabed explicitly by init_mem_debugging_and_hardening().
      
      But after commit 51cba1eb, a static branch could already be enabled
      by default.  There was no code to ever disable it.  That caused
      page_poison=1 / init_on_free=1 conflict.
      
      This change extends init_mem_debugging_and_hardening() to also disable
      static branch disabling.
      
      Link: https://lkml.kernel.org/r/20210714031935.4094114-1-keescook@chromium.org
      Link: https://lore.kernel.org/r/20210712215816.1512739-1-slyfox@gentoo.org
      Fixes: 51cba1eb ("init_on_alloc: Optimize static branches")
      Signed-off-by: default avatarSergei Trofimovich <slyfox@gentoo.org>
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      Co-developed-by: default avatarKees Cook <keescook@chromium.org>
      Reported-by: default avatarMikhail Morfikov <mmorfikov@gmail.com>
      Reported-by: <bowsingbetee@pm.me>
      Tested-by: <bowsingbetee@protonmail.com>
      Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
      Cc: Alexander Potapenko <glider@google.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Vlastimil Babka <vbabka@suse.cz>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      69e5d322
    • Christoph Hellwig's avatar
      mm: use kmap_local_page in memzero_page · d9a42b53
      Christoph Hellwig authored
      The commit message introducing the global memzero_page explicitly
      mentions switching to kmap_local_page in the commit log but doesn't
      actually do that.
      
      Link: https://lkml.kernel.org/r/20210713055231.137602-3-hch@lst.de
      Fixes: 28961998 ("iov_iter: lift memzero_page() to highmem.h")
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarChaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
      Reviewed-by: default avatarIra Weiny <ira.weiny@intel.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d9a42b53