1. 16 Jun, 2021 8 commits
    • Pingfan Liu's avatar
      crash_core, vmcoreinfo: append 'SECTION_SIZE_BITS' to vmcoreinfo · 4f5aecdf
      Pingfan Liu authored
      As mentioned in kernel commit 1d50e5d0 ("crash_core, vmcoreinfo:
      Append 'MAX_PHYSMEM_BITS' to vmcoreinfo"), SECTION_SIZE_BITS in the
      formula:
      
          #define SECTIONS_SHIFT    (MAX_PHYSMEM_BITS - SECTION_SIZE_BITS)
      
      Besides SECTIONS_SHIFT, SECTION_SIZE_BITS is also used to calculate
      PAGES_PER_SECTION in makedumpfile just like kernel.
      
      Unfortunately, this arch-dependent macro SECTION_SIZE_BITS changes, e.g.
      recently in kernel commit f0b13ee2 ("arm64/sparsemem: reduce
      SECTION_SIZE_BITS").  But user space wants a stable interface to get
      this info.  Such info is impossible to be deduced from a crashdump
      vmcore.  Hence append SECTION_SIZE_BITS to vmcoreinfo.
      
      Link: https://lkml.kernel.org/r/20210608103359.84907-1-kernelfans@gmail.com
      Link: http://lists.infradead.org/pipermail/kexec/2021-June/022676.htmlSigned-off-by: default avatarPingfan Liu <kernelfans@gmail.com>
      Acked-by: default avatarBaoquan He <bhe@redhat.com>
      Cc: Bhupesh Sharma <bhupesh.sharma@linaro.org>
      Cc: Kazuhito Hagio <k-hagio@ab.jp.nec.com>
      Cc: Dave Young <dyoung@redhat.com>
      Cc: Boris Petkov <bp@alien8.de>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: James Morse <james.morse@arm.com>
      Cc: Mark Rutland <mark.rutland@arm.com>
      Cc: Will Deacon <will@kernel.org>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Cc: Michael Ellerman <mpe@ellerman.id.au>
      Cc: Paul Mackerras <paulus@samba.org>
      Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
      Cc: Dave Anderson <anderson@redhat.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      4f5aecdf
    • yangerkun's avatar
      mm/memory-failure: make sure wait for page writeback in memory_failure · e8675d29
      yangerkun authored
      Our syzkaller trigger the "BUG_ON(!list_empty(&inode->i_wb_list))" in
      clear_inode:
      
        kernel BUG at fs/inode.c:519!
        Internal error: Oops - BUG: 0 [#1] SMP
        Modules linked in:
        Process syz-executor.0 (pid: 249, stack limit = 0x00000000a12409d7)
        CPU: 1 PID: 249 Comm: syz-executor.0 Not tainted 4.19.95
        Hardware name: linux,dummy-virt (DT)
        pstate: 80000005 (Nzcv daif -PAN -UAO)
        pc : clear_inode+0x280/0x2a8
        lr : clear_inode+0x280/0x2a8
        Call trace:
          clear_inode+0x280/0x2a8
          ext4_clear_inode+0x38/0xe8
          ext4_free_inode+0x130/0xc68
          ext4_evict_inode+0xb20/0xcb8
          evict+0x1a8/0x3c0
          iput+0x344/0x460
          do_unlinkat+0x260/0x410
          __arm64_sys_unlinkat+0x6c/0xc0
          el0_svc_common+0xdc/0x3b0
          el0_svc_handler+0xf8/0x160
          el0_svc+0x10/0x218
        Kernel panic - not syncing: Fatal exception
      
      A crash dump of this problem show that someone called __munlock_pagevec
      to clear page LRU without lock_page: do_mmap -> mmap_region -> do_munmap
      -> munlock_vma_pages_range -> __munlock_pagevec.
      
      As a result memory_failure will call identify_page_state without
      wait_on_page_writeback.  And after truncate_error_page clear the mapping
      of this page.  end_page_writeback won't call sb_clear_inode_writeback to
      clear inode->i_wb_list.  That will trigger BUG_ON in clear_inode!
      
      Fix it by checking PageWriteback too to help determine should we skip
      wait_on_page_writeback.
      
      Link: https://lkml.kernel.org/r/20210604084705.3729204-1-yangerkun@huawei.com
      Fixes: 0bc1f8b0 ("hwpoison: fix the handling path of the victimized page frame that belong to non-LRU")
      Signed-off-by: default avataryangerkun <yangerkun@huawei.com>
      Acked-by: default avatarNaoya Horiguchi <naoya.horiguchi@nec.com>
      Cc: Jan Kara <jack@suse.cz>
      Cc: Theodore Ts'o <tytso@mit.edu>
      Cc: Oscar Salvador <osalvador@suse.de>
      Cc: Yu Kuai <yukuai3@huawei.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e8675d29
    • Mike Kravetz's avatar
      mm/hugetlb: expand restore_reserve_on_error functionality · 846be085
      Mike Kravetz authored
      The routine restore_reserve_on_error is called to restore reservation
      information when an error occurs after page allocation.  The routine
      alloc_huge_page modifies the mapping reserve map and potentially the
      reserve count during allocation.  If code calling alloc_huge_page
      encounters an error after allocation and needs to free the page, the
      reservation information needs to be adjusted.
      
      Currently, restore_reserve_on_error only takes action on pages for which
      the reserve count was adjusted(HPageRestoreReserve flag).  There is
      nothing wrong with these adjustments.  However, alloc_huge_page ALWAYS
      modifies the reserve map during allocation even if the reserve count is
      not adjusted.  This can cause issues as observed during development of
      this patch [1].
      
      One specific series of operations causing an issue is:
      
       - Create a shared hugetlb mapping
         Reservations for all pages created by default
      
       - Fault in a page in the mapping
         Reservation exists so reservation count is decremented
      
       - Punch a hole in the file/mapping at index previously faulted
         Reservation and any associated pages will be removed
      
       - Allocate a page to fill the hole
         No reservation entry, so reserve count unmodified
         Reservation entry added to map by alloc_huge_page
      
       - Error after allocation and before instantiating the page
         Reservation entry remains in map
      
       - Allocate a page to fill the hole
         Reservation entry exists, so decrement reservation count
      
      This will cause a reservation count underflow as the reservation count
      was decremented twice for the same index.
      
      A user would observe a very large number for HugePages_Rsvd in
      /proc/meminfo.  This would also likely cause subsequent allocations of
      hugetlb pages to fail as it would 'appear' that all pages are reserved.
      
      This sequence of operations is unlikely to happen, however they were
      easily reproduced and observed using hacked up code as described in [1].
      
      Address the issue by having the routine restore_reserve_on_error take
      action on pages where HPageRestoreReserve is not set.  In this case, we
      need to remove any reserve map entry created by alloc_huge_page.  A new
      helper routine vma_del_reservation assists with this operation.
      
      There are three callers of alloc_huge_page which do not currently call
      restore_reserve_on error before freeing a page on error paths.  Add
      those missing calls.
      
      [1] https://lore.kernel.org/linux-mm/20210528005029.88088-1-almasrymina@google.com/
      
      Link: https://lkml.kernel.org/r/20210607204510.22617-1-mike.kravetz@oracle.com
      Fixes: 96b96a96 ("mm/hugetlb: fix huge page reservation leak in private mapping error paths"
      Signed-off-by: default avatarMike Kravetz <mike.kravetz@oracle.com>
      Reviewed-by: default avatarMina Almasry <almasrymina@google.com>
      Cc: Axel Rasmussen <axelrasmussen@google.com>
      Cc: Peter Xu <peterx@redhat.com>
      Cc: Muchun Song <songmuchun@bytedance.com>
      Cc: Michal Hocko <mhocko@suse.com>
      Cc: Naoya Horiguchi <naoya.horiguchi@nec.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      846be085
    • Kees Cook's avatar
      mm/slub: actually fix freelist pointer vs redzoning · e41a49fa
      Kees Cook authored
      It turns out that SLUB redzoning ("slub_debug=Z") checks from
      s->object_size rather than from s->inuse (which is normally bumped to
      make room for the freelist pointer), so a cache created with an object
      size less than 24 would have the freelist pointer written beyond
      s->object_size, causing the redzone to be corrupted by the freelist
      pointer.  This was very visible with "slub_debug=ZF":
      
        BUG test (Tainted: G    B            ): Right Redzone overwritten
        -----------------------------------------------------------------------------
      
        INFO: 0xffff957ead1c05de-0xffff957ead1c05df @offset=1502. First byte 0x1a instead of 0xbb
        INFO: Slab 0xffffef3950b47000 objects=170 used=170 fp=0x0000000000000000 flags=0x8000000000000200
        INFO: Object 0xffff957ead1c05d8 @offset=1496 fp=0xffff957ead1c0620
      
        Redzone  (____ptrval____): bb bb bb bb bb bb bb bb               ........
        Object   (____ptrval____): 00 00 00 00 00 f6 f4 a5               ........
        Redzone  (____ptrval____): 40 1d e8 1a aa                        @....
        Padding  (____ptrval____): 00 00 00 00 00 00 00 00               ........
      
      Adjust the offset to stay within s->object_size.
      
      (Note that no caches of in this size range are known to exist in the
      kernel currently.)
      
      Link: https://lkml.kernel.org/r/20210608183955.280836-4-keescook@chromium.org
      Link: https://lore.kernel.org/linux-mm/20200807160627.GA1420741@elver.google.com/
      Link: https://lore.kernel.org/lkml/0f7dd7b2-7496-5e2d-9488-2ec9f8e90441@suse.cz/Fixes: 89b83f28 (slub: avoid redzone when choosing freepointer location)
      Link: https://lore.kernel.org/lkml/CANpmjNOwZ5VpKQn+SYWovTkFB4VsT-RPwyENBmaK0dLcpqStkA@mail.gmail.comSigned-off-by: default avatarKees Cook <keescook@chromium.org>
      Reported-by: default avatarMarco Elver <elver@google.com>
      Reported-by: default avatar"Lin, Zhenpeng" <zplin@psu.edu>
      Tested-by: default avatarMarco Elver <elver@google.com>
      Acked-by: default avatarVlastimil Babka <vbabka@suse.cz>
      Cc: Christoph Lameter <cl@linux.com>
      Cc: David Rientjes <rientjes@google.com>
      Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
      Cc: Pekka Enberg <penberg@kernel.org>
      Cc: Roman Gushchin <guro@fb.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e41a49fa
    • Kees Cook's avatar
      mm/slub: fix redzoning for small allocations · 74c1d3e0
      Kees Cook authored
      The redzone area for SLUB exists between s->object_size and s->inuse
      (which is at least the word-aligned object_size).  If a cache were
      created with an object_size smaller than sizeof(void *), the in-object
      stored freelist pointer would overwrite the redzone (e.g.  with boot
      param "slub_debug=ZF"):
      
        BUG test (Tainted: G    B            ): Right Redzone overwritten
        -----------------------------------------------------------------------------
      
        INFO: 0xffff957ead1c05de-0xffff957ead1c05df @offset=1502. First byte 0x1a instead of 0xbb
        INFO: Slab 0xffffef3950b47000 objects=170 used=170 fp=0x0000000000000000 flags=0x8000000000000200
        INFO: Object 0xffff957ead1c05d8 @offset=1496 fp=0xffff957ead1c0620
      
        Redzone  (____ptrval____): bb bb bb bb bb bb bb bb    ........
        Object   (____ptrval____): f6 f4 a5 40 1d e8          ...@..
        Redzone  (____ptrval____): 1a aa                      ..
        Padding  (____ptrval____): 00 00 00 00 00 00 00 00    ........
      
      Store the freelist pointer out of line when object_size is smaller than
      sizeof(void *) and redzoning is enabled.
      
      Additionally remove the "smaller than sizeof(void *)" check under
      CONFIG_DEBUG_VM in kmem_cache_sanity_check() as it is now redundant:
      SLAB and SLOB both handle small sizes.
      
      (Note that no caches within this size range are known to exist in the
      kernel currently.)
      
      Link: https://lkml.kernel.org/r/20210608183955.280836-3-keescook@chromium.org
      Fixes: 81819f0f ("SLUB core")
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      Acked-by: default avatarVlastimil Babka <vbabka@suse.cz>
      Cc: Christoph Lameter <cl@linux.com>
      Cc: David Rientjes <rientjes@google.com>
      Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
      Cc: "Lin, Zhenpeng" <zplin@psu.edu>
      Cc: Marco Elver <elver@google.com>
      Cc: Pekka Enberg <penberg@kernel.org>
      Cc: Roman Gushchin <guro@fb.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      74c1d3e0
    • Kees Cook's avatar
      mm/slub: clarify verification reporting · 8669dbab
      Kees Cook authored
      Patch series "Actually fix freelist pointer vs redzoning", v4.
      
      This fixes redzoning vs the freelist pointer (both for middle-position
      and very small caches).  Both are "theoretical" fixes, in that I see no
      evidence of such small-sized caches actually be used in the kernel, but
      that's no reason to let the bugs continue to exist, especially since
      people doing local development keep tripping over it.  :)
      
      This patch (of 3):
      
      Instead of repeating "Redzone" and "Poison", clarify which sides of
      those zones got tripped.  Additionally fix column alignment in the
      trailer.
      
      Before:
      
        BUG test (Tainted: G    B            ): Redzone overwritten
        ...
        Redzone (____ptrval____): bb bb bb bb bb bb bb bb      ........
        Object (____ptrval____): f6 f4 a5 40 1d e8            ...@..
        Redzone (____ptrval____): 1a aa                        ..
        Padding (____ptrval____): 00 00 00 00 00 00 00 00      ........
      
      After:
      
        BUG test (Tainted: G    B            ): Right Redzone overwritten
        ...
        Redzone  (____ptrval____): bb bb bb bb bb bb bb bb      ........
        Object   (____ptrval____): f6 f4 a5 40 1d e8            ...@..
        Redzone  (____ptrval____): 1a aa                        ..
        Padding  (____ptrval____): 00 00 00 00 00 00 00 00      ........
      
      The earlier commits that slowly resulted in the "Before" reporting were:
      
        d86bd1be ("mm/slub: support left redzone")
        ffc79d28 ("slub: use print_hex_dump")
        24922684 ("SLUB: change error reporting format to follow lockdep loosely")
      
      Link: https://lkml.kernel.org/r/20210608183955.280836-1-keescook@chromium.org
      Link: https://lkml.kernel.org/r/20210608183955.280836-2-keescook@chromium.org
      Link: https://lore.kernel.org/lkml/cfdb11d7-fb8e-e578-c939-f7f5fb69a6bd@suse.cz/Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      Acked-by: default avatarVlastimil Babka <vbabka@suse.cz>
      Cc: Marco Elver <elver@google.com>
      Cc: "Lin, Zhenpeng" <zplin@psu.edu>
      Cc: Christoph Lameter <cl@linux.com>
      Cc: Pekka Enberg <penberg@kernel.org>
      Cc: David Rientjes <rientjes@google.com>
      Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
      Cc: Roman Gushchin <guro@fb.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      8669dbab
    • Peter Xu's avatar
      mm/swap: fix pte_same_as_swp() not removing uffd-wp bit when compare · 099dd687
      Peter Xu authored
      I found it by pure code review, that pte_same_as_swp() of unuse_vma()
      didn't take uffd-wp bit into account when comparing ptes.
      pte_same_as_swp() returning false negative could cause failure to
      swapoff swap ptes that was wr-protected by userfaultfd.
      
      Link: https://lkml.kernel.org/r/20210603180546.9083-1-peterx@redhat.com
      Fixes: f45ec5ff ("userfaultfd: wp: support swap and page migration")
      Signed-off-by: default avatarPeter Xu <peterx@redhat.com>
      Acked-by: default avatarHugh Dickins <hughd@google.com>
      Cc: Andrea Arcangeli <aarcange@redhat.com>
      Cc: <stable@vger.kernel.org>	[5.7+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      099dd687
    • Naoya Horiguchi's avatar
      mm,hwpoison: fix race with hugetlb page allocation · 25182f05
      Naoya Horiguchi authored
      When hugetlb page fault (under overcommitting situation) and
      memory_failure() race, VM_BUG_ON_PAGE() is triggered by the following
      race:
      
          CPU0:                           CPU1:
      
                                          gather_surplus_pages()
                                            page = alloc_surplus_huge_page()
          memory_failure_hugetlb()
            get_hwpoison_page(page)
              __get_hwpoison_page(page)
                get_page_unless_zero(page)
                                            zero = put_page_testzero(page)
                                            VM_BUG_ON_PAGE(!zero, page)
                                            enqueue_huge_page(h, page)
            put_page(page)
      
      __get_hwpoison_page() only checks the page refcount before taking an
      additional one for memory error handling, which is not enough because
      there's a time window where compound pages have non-zero refcount during
      hugetlb page initialization.
      
      So make __get_hwpoison_page() check page status a bit more for hugetlb
      pages with get_hwpoison_huge_page().  Checking hugetlb-specific flags
      under hugetlb_lock makes sure that the hugetlb page is not transitive.
      It's notable that another new function, HWPoisonHandlable(), is helpful
      to prevent a race against other transitive page states (like a generic
      compound page just before PageHuge becomes true).
      
      Link: https://lkml.kernel.org/r/20210603233632.2964832-2-nao.horiguchi@gmail.com
      Fixes: ead07f6a ("mm/memory-failure: introduce get_hwpoison_page() for consistent refcount handling")
      Signed-off-by: default avatarNaoya Horiguchi <naoya.horiguchi@nec.com>
      Reported-by: default avatarMuchun Song <songmuchun@bytedance.com>
      Acked-by: default avatarMike Kravetz <mike.kravetz@oracle.com>
      Cc: Oscar Salvador <osalvador@suse.de>
      Cc: Michal Hocko <mhocko@suse.com>
      Cc: Tony Luck <tony.luck@intel.com>
      Cc: <stable@vger.kernel.org>	[5.12+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      25182f05
  2. 15 Jun, 2021 2 commits
  3. 13 Jun, 2021 4 commits
    • Linus Torvalds's avatar
      Linux 5.13-rc6 · 009c9aa5
      Linus Torvalds authored
      009c9aa5
    • Linus Torvalds's avatar
      Merge tag 'perf-tools-fixes-for-v5.13-2021-06-13' of... · e4e45343
      Linus Torvalds authored
      Merge tag 'perf-tools-fixes-for-v5.13-2021-06-13' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux
      
      Pull perf tools fixes from Arnaldo Carvalho de Melo:
      
       - Correct buffer copying when peeking events
      
       - Sync cpufeatures/disabled-features.h header with the kernel sources
      
      * tag 'perf-tools-fixes-for-v5.13-2021-06-13' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux:
        tools headers cpufeatures: Sync with the kernel sources
        perf session: Correct buffer copying when peeking events
      e4e45343
    • Linus Torvalds's avatar
      Merge tag 'nfs-for-5.13-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs · 960f0716
      Linus Torvalds authored
      Pull NFS client bugfixes from Trond Myklebust:
       "Highlights include:
      
        Stable fixes:
      
         - Fix use-after-free in nfs4_init_client()
      
        Bugfixes:
      
         - Fix deadlock between nfs4_evict_inode() and nfs4_opendata_get_inode()
      
         - Fix second deadlock in nfs4_evict_inode()
      
         - nfs4_proc_set_acl should not change the value of NFS_CAP_UIDGID_NOMAP
      
         - Fix setting of the NFS_CAP_SECURITY_LABEL capability"
      
      * tag 'nfs-for-5.13-3' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
        NFSv4: Fix second deadlock in nfs4_evict_inode()
        NFSv4: Fix deadlock between nfs4_evict_inode() and nfs4_opendata_get_inode()
        NFS: FMODE_READ and friends are C macros, not enum types
        NFS: Fix a potential NULL dereference in nfs_get_client()
        NFS: Fix use-after-free in nfs4_init_client()
        NFS: Ensure the NFS_CAP_SECURITY_LABEL capability is set when appropriate
        NFSv4: nfs4_proc_set_acl needs to restore NFS_CAP_UIDGID_NOMAP on error.
      960f0716
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 331a6edb
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Four reasonably small fixes to the core for scsi host allocation
        failure paths.
      
        The root problem is that we're not freeing the memory allocated by
        dev_set_name(), which involves a rejig of may of the free on error
        paths to do put_device() instead of kfree which, in turn, has several
        other knock on ramifications and inspection turned up a few other
        lurking bugs"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: core: Only put parent device if host state differs from SHOST_CREATED
        scsi: core: Put .shost_dev in failure path if host state changes to RUNNING
        scsi: core: Fix failure handling of scsi_add_host_with_dma()
        scsi: core: Fix error handling of scsi_host_alloc()
      331a6edb
  4. 12 Jun, 2021 15 commits
    • Linus Torvalds's avatar
      Merge tag 'riscv-for-linus-5.13-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux · 8ecfa36c
      Linus Torvalds authored
      Pull RISC-V fixes from Palmer Dabbelt:
      
       - A pair of XIP fixes: one to fix alternatives, and one to turn off the
         rest of the features that require code modification
      
       - A fix to a type that was causing some alternatives to break
      
       - A build fix for BUILTIN_DTB
      
      * tag 'riscv-for-linus-5.13-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
        riscv: Fix BUILTIN_DTB for sifive and microchip soc
        riscv: alternative: fix typo in macro name
        riscv: code patching only works on !XIP_KERNEL
        riscv: xip: support runtime trap patching
      8ecfa36c
    • Feng Tang's avatar
      mm: relocate 'write_protect_seq' in struct mm_struct · 2e302543
      Feng Tang authored
      0day robot reported a 9.2% regression for will-it-scale mmap1 test
      case[1], caused by commit 57efa1fe ("mm/gup: prevent gup_fast from
      racing with COW during fork").
      
      Further debug shows the regression is due to that commit changes the
      offset of hot fields 'mmap_lock' inside structure 'mm_struct', thus some
      cache alignment changes.
      
      From the perf data, the contention for 'mmap_lock' is very severe and
      takes around 95% cpu cycles, and it is a rw_semaphore
      
              struct rw_semaphore {
                      atomic_long_t count;	/* 8 bytes */
                      atomic_long_t owner;	/* 8 bytes */
                      struct optimistic_spin_queue osq; /* spinner MCS lock */
                      ...
      
      Before commit 57efa1fe adds the 'write_protect_seq', it happens to
      have a very optimal cache alignment layout, as Linus explained:
      
       "and before the addition of the 'write_protect_seq' field, the
        mmap_sem was at offset 120 in 'struct mm_struct'.
      
        Which meant that count and owner were in two different cachelines,
        and then when you have contention and spend time in
        rwsem_down_write_slowpath(), this is probably *exactly* the kind
        of layout you want.
      
        Because first the rwsem_write_trylock() will do a cmpxchg on the
        first cacheline (for the optimistic fast-path), and then in the
        case of contention, rwsem_down_write_slowpath() will just access
        the second cacheline.
      
        Which is probably just optimal for a load that spends a lot of
        time contended - new waiters touch that first cacheline, and then
        they queue themselves up on the second cacheline."
      
      After the commit, the rw_semaphore is at offset 128, which means the
      'count' and 'owner' fields are now in the same cacheline, and causes
      more cache bouncing.
      
      Currently there are 3 "#ifdef CONFIG_XXX" before 'mmap_lock' which will
      affect its offset:
      
        CONFIG_MMU
        CONFIG_MEMBARRIER
        CONFIG_HAVE_ARCH_COMPAT_MMAP_BASES
      
      The layout above is on 64 bits system with 0day's default kernel config
      (similar to RHEL-8.3's config), in which all these 3 options are 'y'.
      And the layout can vary with different kernel configs.
      
      Relayouting a structure is usually a double-edged sword, as sometimes it
      can helps one case, but hurt other cases.  For this case, one solution
      is, as the newly added 'write_protect_seq' is a 4 bytes long seqcount_t
      (when CONFIG_DEBUG_LOCK_ALLOC=n), placing it into an existing 4 bytes
      hole in 'mm_struct' will not change other fields' alignment, while
      restoring the regression.
      
      Link: https://lore.kernel.org/lkml/20210525031636.GB7744@xsang-OptiPlex-9020/ [1]
      Reported-by: default avatarkernel test robot <oliver.sang@intel.com>
      Signed-off-by: default avatarFeng Tang <feng.tang@intel.com>
      Reviewed-by: default avatarJohn Hubbard <jhubbard@nvidia.com>
      Reviewed-by: default avatarJason Gunthorpe <jgg@nvidia.com>
      Cc: Peter Xu <peterx@redhat.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      2e302543
    • Linus Torvalds's avatar
      Merge tag 'usb-5.13-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 43cb5d49
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are a number of tiny USB fixes for 5.13-rc6.
      
        There are more than I would normally like, but there's been a bunch of
        people banging on the gadget and dwc3 and typec code recently for I
        think an Android release, which has resulted in a number of small
        fixes. It's nice to see companies send fixes upstream for this type of
        work, a notable change from years ago.
      
        Anyway, fixes in here are:
      
         - usb-serial device id updates
      
         - usb-serial cp210x driver fixes for broken firmware versions
      
         - typec fixes for crazy charging devices and other reported problems
      
         - dwc3 fixes for reported problems found
      
         - gadget fixes for reported problems
      
         - tiny xhci fixes
      
         - other small fixes for reported issues.
      
         - revert of a problem fix found by linux-next testing
      
        All of these have passed 0-day and linux-next testing with no reported
        problems (the revert for the found linux-next build problem included)"
      
      * tag 'usb-5.13-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (44 commits)
        Revert "usb: gadget: fsl: Re-enable driver for ARM SoCs"
        usb: typec: mux: Fix copy-paste mistake in typec_mux_match
        usb: typec: ucsi: Clear PPM capability data in ucsi_init() error path
        usb: gadget: fsl: Re-enable driver for ARM SoCs
        usb: typec: wcove: Use LE to CPU conversion when accessing msg->header
        USB: serial: cp210x: fix CP2102N-A01 modem control
        USB: serial: cp210x: fix alternate function for CP2102N QFN20
        usb: misc: brcmstb-usb-pinmap: check return value after calling platform_get_resource()
        usb: dwc3: ep0: fix NULL pointer exception
        usb: gadget: eem: fix wrong eem header operation
        usb: typec: intel_pmc_mux: Put ACPI device using acpi_dev_put()
        usb: typec: intel_pmc_mux: Add missed error check for devm_ioremap_resource()
        usb: typec: intel_pmc_mux: Put fwnode in error case during ->probe()
        usb: typec: tcpm: Do not finish VDM AMS for retrying Responses
        usb: fix various gadget panics on 10gbps cabling
        usb: fix various gadgets null ptr deref on 10gbps cabling.
        usb: pci-quirks: disable D3cold on xhci suspend for s2idle on AMD Renoir
        usb: f_ncm: only first packet of aggregate needs to start timer
        USB: f_ncm: ncm_bitrate (speed) is unsigned
        MAINTAINERS: usb: add entry for isp1760
        ...
      43cb5d49
    • Linus Torvalds's avatar
      Merge tag 'tty-5.13-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · c46fe4aa
      Linus Torvalds authored
      Pull serial driver fix from Greg KH:
       "A single 8250_exar serial driver fix for a reported problem with a
        change that happened in 5.13-rc1.
      
        It has been in linux-next with no reported problems"
      
      * tag 'tty-5.13-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        serial: 8250_exar: Avoid NULL pointer dereference at ->exit()
      c46fe4aa
    • Linus Torvalds's avatar
      Merge tag 'staging-5.13-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · 0d506588
      Linus Torvalds authored
      Pull staging driver fixes from Greg KH:
       "Two tiny staging driver fixes:
      
         - ralink-gdma driver authorship information fixed up
      
         - rtl8723bs driver fix for reported regression
      
        Both have been in linux-next for a while with no reported problems"
      
      * tag 'staging-5.13-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: ralink-gdma: Remove incorrect author information
        staging: rtl8723bs: Fix uninitialized variables
      0d506588
    • Linus Torvalds's avatar
      Merge tag 'driver-core-5.13-rc6' of... · 87a7f736
      Linus Torvalds authored
      Merge tag 'driver-core-5.13-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core
      
      Pull driver core fix from Greg KH:
       "A single debugfs fix for 5.13-rc6, fixing a bug in
        debugfs_read_file_str() that showed up in 5.13-rc1.
      
        It has been in linux-next for a full week with no
        reported problems"
      
      * tag 'driver-core-5.13-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
        debugfs: Fix debugfs_read_file_str()
      87a7f736
    • Linus Torvalds's avatar
      Merge tag 'char-misc-5.13-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · 1dfa2e77
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are some small misc driver fixes for 5.13-rc6 that fix some
        reported problems:
      
         - Tiny phy driver fixes for reported issues
      
         - rtsx regression for when the device suspended
      
         - mhi driver fix for a use-after-free
      
        All of these have been in linux-next for a few days with no reported
        issues"
      
      * tag 'char-misc-5.13-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        misc: rtsx: separate aspm mode into MODE_REG and MODE_CFG
        bus: mhi: pci-generic: Fix hibernation
        bus: mhi: pci_generic: Fix possible use-after-free in mhi_pci_remove()
        bus: mhi: pci_generic: T99W175: update channel name from AT to DUN
        phy: Sparx5 Eth SerDes: check return value after calling platform_get_resource()
        phy: ralink: phy-mt7621-pci: drop 'of_match_ptr' to fix -Wunused-const-variable
        phy: ti: Fix an error code in wiz_probe()
        phy: phy-mtk-tphy: Fix some resource leaks in mtk_phy_init()
        phy: cadence: Sierra: Fix error return code in cdns_sierra_phy_probe()
        phy: usb: Fix misuse of IS_ENABLED
      1dfa2e77
    • Linus Torvalds's avatar
      Merge tag 'pinctrl-v5.13-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl · 141415d7
      Linus Torvalds authored
      Pull pin control fixes from Linus Walleij:
      
       - Fix some documentation warnings for Allwinner
      
       - Fix duplicated GPIO groups on Qualcomm SDX55
      
       - Fix a double enablement bug in the Ralink driver
      
       - Fix the Qualcomm SC8180x Kconfig so the driver can be selected.
      
      * tag 'pinctrl-v5.13-2' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
        pinctrl: qcom: Make it possible to select SC8180x TLMM
        pinctrl: ralink: rt2880: avoid to error in calls is pin is already enabled
        pinctrl: qcom: Fix duplication in gpio_groups
        pinctrl: aspeed: Fix minor documentation error
      141415d7
    • Linus Torvalds's avatar
      Merge tag 'block-5.13-2021-06-12' of git://git.kernel.dk/linux-block · efc1fd60
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
       "A few fixes that should go into 5.13:
      
         - Fix a regression deadlock introduced in this release between open
           and remove of a bdev (Christoph)
      
         - Fix an async_xor md regression in this release (Xiao)
      
         - Fix bcache oversized read issue (Coly)"
      
      * tag 'block-5.13-2021-06-12' of git://git.kernel.dk/linux-block:
        block: loop: fix deadlock between open and remove
        async_xor: check src_offs is not NULL before updating it
        bcache: avoid oversized read request in cache missing code path
        bcache: remove bcache device self-defined readahead
      efc1fd60
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.13-2021-06-12' of git://git.kernel.dk/linux-block · b2568eeb
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
       "Just an API change for the registration changes that went into this
        release. Better to get it sorted out now than before it's too late"
      
      * tag 'io_uring-5.13-2021-06-12' of git://git.kernel.dk/linux-block:
        io_uring: add feature flag for rsrc tags
        io_uring: change registration/upd/rsrc tagging ABI
      b2568eeb
    • Linus Torvalds's avatar
      Merge tag 'sched-urgent-2021-06-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 99f92594
      Linus Torvalds authored
      Pull scheduler fixes from Ingo Molnar:
       "Misc fixes:
      
         - Fix performance regression caused by lack of intended batching of
           RCU callbacks by over-eager NOHZ-full code.
      
         - Fix cgroups related corruption of load_avg and load_sum metrics.
      
         - Three fixes to fix blocked load, util_sum/runnable_sum and util_est
           tracking bugs"
      
      * tag 'sched-urgent-2021-06-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        sched/fair: Fix util_est UTIL_AVG_UNCHANGED handling
        sched/pelt: Ensure that *_sum is always synced with *_avg
        tick/nohz: Only check for RCU deferred wakeup on user/guest entry when needed
        sched/fair: Make sure to update tg contrib for blocked load
        sched/fair: Keep load_avg and load_sum synced
      99f92594
    • Linus Torvalds's avatar
      Merge tag 'perf-urgent-2021-06-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 191aaf6c
      Linus Torvalds authored
      Pull perf fixes from Ingo Molnar:
       "Misc fixes:
      
         - Fix the NMI watchdog on ancient Intel CPUs
      
         - Remove a misguided, NMI-unsafe KASAN callback from the NMI-safe
           irq_work path used by perf.
      
         - Fix uncore events on Ice Lake servers.
      
         - Someone booted maxcpus=1 on an SNB-EP, and the uncore driver
           emitted warnings and was probably buggy. Fix it.
      
         - KCSAN found a genuine data race in the core perf code. Somewhat
           ironically the bug was introduced through a recent race fix. :-/
           In our defense, the new race window was much more narrow. Fix it"
      
      * tag 'perf-urgent-2021-06-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        x86/nmi_watchdog: Fix old-style NMI watchdog regression on old Intel CPUs
        irq_work: Make irq_work_queue() NMI-safe again
        perf/x86/intel/uncore: Fix M2M event umask for Ice Lake server
        perf/x86/intel/uncore: Fix a kernel WARNING triggered by maxcpus=1
        perf: Fix data race between pin_count increment/decrement
      191aaf6c
    • Linus Torvalds's avatar
      Merge tag 'objtool-urgent-2021-06-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip · 768895fb
      Linus Torvalds authored
      Pull objtool fixes from Ingo Molnar:
       "Two objtool fixes:
      
         - fix a bug that corrupts the code by mistakenly rewriting
           conditional jumps
      
         - fix another bug generating an incorrect ELF symbol table
           during retpoline rewriting"
      
      * tag 'objtool-urgent-2021-06-12' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
        objtool: Only rewrite unconditional retpoline thunk calls
        objtool: Fix .symtab_shndx handling for elf_create_undef_symbol()
      768895fb
    • Alexandre Ghiti's avatar
      riscv: Fix BUILTIN_DTB for sifive and microchip soc · 0ddd7eaf
      Alexandre Ghiti authored
      Fix BUILTIN_DTB config which resulted in a dtb that was actually not
      built into the Linux image: in the same manner as Canaan soc does,
      create an object file from the dtb file that will get linked into the
      Linux image.
      Signed-off-by: default avatarAlexandre Ghiti <alex@ghiti.fr>
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      0ddd7eaf
    • Linus Torvalds's avatar
      Merge tag 'trace-v5.13-rc5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · ad347abe
      Linus Torvalds authored
      Pull tracing fixes from Steven Rostedt:
      
       - Fix the length check in the temp buffer filter
      
       - Fix build failure in bootconfig tools for "fallthrough" macro
      
       - Fix error return of bootconfig apply_xbc() routine
      
      * tag 'trace-v5.13-rc5-2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Correct the length check which causes memory corruption
        ftrace: Do not blindly read the ip address in ftrace_bug()
        tools/bootconfig: Fix a build error accroding to undefined fallthrough
        tools/bootconfig: Fix error return code in apply_xbc()
      ad347abe
  5. 11 Jun, 2021 11 commits