1. 16 Feb, 2022 2 commits
    • Dmitry Torokhov's avatar
      module: fix building with sysfs disabled · a8e8f851
      Dmitry Torokhov authored
      Sysfs support might be disabled so we need to guard the code that
      instantiates "compression" attribute with an #ifdef.
      
      Fixes: b1ae6dc4 ("module: add in-kernel support for decompressing")
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Signed-off-by: default avatarDmitry Torokhov <dmitry.torokhov@gmail.com>
      Signed-off-by: default avatarLuis Chamberlain <mcgrof@kernel.org>
      a8e8f851
    • Linus Torvalds's avatar
      tty: n_tty: do not look ahead for EOL character past the end of the buffer · 35930307
      Linus Torvalds authored
      Daniel Gibson reports that the n_tty code gets line termination wrong in
      very specific cases:
      
       "If you feed a line with exactly 64 chars + terminating newline, and
        directly afterwards (without reading) another line into a pseudo
        terminal, the the first read() on the other side will return the 64
        char line *without* terminating newline, and the next read() will
        return the missing terminating newline AND the complete next line (if
        it fits in the buffer)"
      
      and bisected the behavior to commit 3b830a9c ("tty: convert
      tty_ldisc_ops 'read()' function to take a kernel pointer").
      
      Now, digging deeper, it turns out that the behavior isn't exactly new:
      what changed in commit 3b830a9c was that the tty line discipline
      .read() function is now passed an intermediate kernel buffer rather than
      the final user space buffer.
      
      And that intermediate kernel buffer is 64 bytes in size - thus that
      special case with exactly 64 bytes plus terminating newline.
      
      The same problem did exist before, but historically the boundary was not
      the 64-byte chunk, but the user-supplied buffer size, which is obviously
      generally bigger (and potentially bigger than N_TTY_BUF_SIZE, which
      would hide the issue entirely).
      
      The reason is that the n_tty canon_copy_from_read_buf() code would look
      ahead for the EOL character one byte further than it would actually
      copy.  It would then decide that it had found the terminator, and unmark
      it as an EOL character - which in turn explains why the next read
      wouldn't then be terminated by it.
      
      Now, the reason it did all this in the first place is related to some
      historical and pretty obscure EOF behavior, see commit ac8f3bf8
      ("n_tty: Fix poll() after buffer-limited eof push read") and commit
      40d5e090 ("n_tty: Fix EOF push handling").
      
      And the reason for the EOL confusion is that we treat EOF as a special
      EOL condition, with the EOL character being NUL (aka "__DISABLED_CHAR"
      in the kernel sources).
      
      So that EOF look-ahead also affects the normal EOL handling.
      
      This patch just removes the look-ahead that causes problems, because EOL
      is much more critical than the historical "EOF in the middle of a line
      that coincides with the end of the buffer" handling ever was.
      
      Now, it is possible that we should indeed re-introduce the "look at next
      character to see if it's a EOF" behavior, but if so, that should be done
      not at the kernel buffer chunk boundary in canon_copy_from_read_buf(),
      but at a higher level, when we run out of the user buffer.
      
      In particular, the place to do that would be at the top of
      'n_tty_read()', where we check if it's a continuation of a previously
      started read, and there is no more buffer space left, we could decide to
      just eat the __DISABLED_CHAR at that point.
      
      But that would be a separate patch, because I suspect nobody actually
      cares, and I'd like to get a report about it before bothering.
      
      Fixes: 3b830a9c ("tty: convert tty_ldisc_ops 'read()' function to take a kernel pointer")
      Fixes: ac8f3bf8 ("n_tty: Fix  poll() after buffer-limited eof push read")
      Fixes: 40d5e090 ("n_tty: Fix EOF push handling")
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=215611Reported-and-tested-by: default avatarDaniel Gibson <metalcaedes@gmail.com>
      Cc: Peter Hurley <peter@hurleysoftware.com>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Jiri Slaby <jirislaby@kernel.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      35930307
  2. 15 Feb, 2022 5 commits
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · c5d9ae26
      Linus Torvalds authored
      Pull kvm fixes from Paolo Bonzini:
       "ARM:
      
         - Read HW interrupt pending state from the HW
      
        x86:
      
         - Don't truncate the performance event mask on AMD
      
         - Fix Xen runstate updates to be atomic when preempting vCPU
      
         - Fix for AMD AVIC interrupt injection race
      
         - Several other AMD fixes"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
        KVM: x86/pmu: Use AMD64_RAW_EVENT_MASK for PERF_TYPE_RAW
        KVM: x86/pmu: Don't truncate the PerfEvtSeln MSR when creating a perf event
        KVM: SVM: fix race between interrupt delivery and AVIC inhibition
        KVM: SVM: set IRR in svm_deliver_interrupt
        KVM: SVM: extract avic_ring_doorbell
        selftests: kvm: Remove absent target file
        KVM: arm64: vgic: Read HW interrupt pending state from the HW
        KVM: x86/xen: Fix runstate updates to be atomic when preempting vCPU
        KVM: x86: SVM: move avic definitions from AMD's spec to svm.h
        KVM: x86: lapic: don't touch irr_pending in kvm_apic_update_apicv when inhibiting it
        KVM: x86: nSVM: deal with L1 hypervisor that intercepts interrupts but lets L2 control them
        KVM: x86: nSVM: expose clean bit support to the guest
        KVM: x86: nSVM/nVMX: set nested_run_pending on VM entry which is a result of RSM
        KVM: x86: nSVM: mark vmcb01 as dirty when restoring SMM saved state
        KVM: x86: nSVM: fix potential NULL derefernce on nested migration
        KVM: x86: SVM: don't passthrough SMAP/SMEP/PKE bits in !NPT && !gCR0.PG case
        Revert "svm: Add warning message for AVIC IPI invalid target"
      c5d9ae26
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid · a254a9da
      Linus Torvalds authored
      Pull HID fixes from Jiri Kosina:
      
       - memory leak fix for hid-elo driver (Dongliang Mu)
      
       - fix for hangs on newer AMD platforms with amd_sfh-driven hardware
         (Basavaraj Natikar )
      
       - locking fix in i2c-hid (Daniel Thompson)
      
       - a few device-ID specific quirks
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid:
        HID: amd_sfh: Add interrupt handler to process interrupts
        HID: amd_sfh: Add functionality to clear interrupts
        HID: amd_sfh: Disable the interrupt for all command
        HID: amd_sfh: Correct the structure field name
        HID: amd_sfh: Handle amd_sfh work buffer in PM ops
        HID:Add support for UGTABLET WP5540
        HID: amd_sfh: Add illuminance mask to limit ALS max value
        HID: amd_sfh: Increase sensor command timeout
        HID: i2c-hid: goodix: Fix a lockdep splat
        HID: elo: fix memory leak in elo_probe
        HID: apple: Set the tilde quirk flag on the Wellspring 5 and later
      a254a9da
    • Linus Torvalds's avatar
      Merge tag 'for-5.17-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · 705d84a3
      Linus Torvalds authored
      Pull btrfs fixes from David Sterba:
      
       - yield CPU more often when defragmenting a large file
      
       - skip defragmenting extents already under writeback
      
       - improve error message when send fails to write file data
      
       - get rid of warning when mounted with 'flushoncommit'
      
      * tag 'for-5.17-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        btrfs: send: in case of IO error log it
        btrfs: get rid of warning on transaction commit when using flushoncommit
        btrfs: defrag: don't try to defrag extents which are under writeback
        btrfs: don't hold CPU for too long when defragging a file
      705d84a3
    • Linus Torvalds's avatar
      Merge tag 'for-5.17/parisc-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux · 2572da44
      Linus Torvalds authored
      Pull parisc architecture fixes from Helge Deller:
      
       - Fix miscompilations when function calls are made from inside a
         put_user() call
      
       - Drop __init from map_pages() declaration to avoid random boot crashes
      
       - Added #error messages if a 64-bit compiler was used to build a 32-bit
         kernel (and vice versa)
      
       - Fix out-of-bound data TLB miss faults in sba_iommu and ccio-dma
         drivers
      
       - Add ioread64_lo_hi() and iowrite64_lo_hi() functions to avoid kernel
         test robot errors
      
       - Fix link failure when 8250_gsc driver is built without CONFIG_IOSAPIC
      
      * tag 'for-5.17/parisc-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
        serial: parisc: GSC: fix build when IOSAPIC is not set
        parisc: Fix some apparent put_user() failures
        parisc: Show error if wrong 32/64-bit compiler is being used
        parisc: Add ioread64_lo_hi() and iowrite64_lo_hi()
        parisc: Fix sglist access in ccio-dma.c
        parisc: Fix data TLB miss in sba_unmap_sg
        parisc: Drop __init from map_pages declaration
      2572da44
    • Linus Torvalds's avatar
      Merge tag 'hyperv-fixes-signed-20220215' of... · c24449b3
      Linus Torvalds authored
      Merge tag 'hyperv-fixes-signed-20220215' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux
      
      Pull hyperv fixes from Wei Liu:
      
       - Rework use of DMA_BIT_MASK in vmbus to work around a clang bug
         (Michael Kelley)
      
       - Fix NUMA topology (Long Li)
      
       - Fix a memory leak in vmbus (Miaoqian Lin)
      
       - One minor clean-up patch (Cai Huoqing)
      
      * tag 'hyperv-fixes-signed-20220215' of git://git.kernel.org/pub/scm/linux/kernel/git/hyperv/linux:
        Drivers: hv: utils: Make use of the helper macro LIST_HEAD()
        Drivers: hv: vmbus: Rework use of DMA_BIT_MASK(64)
        Drivers: hv: vmbus: Fix memory leak in vmbus_add_channel_kobj
        PCI: hv: Fix NUMA node assignment when kernel boots with custom NUMA topology
      c24449b3
  3. 14 Feb, 2022 10 commits
  4. 13 Feb, 2022 10 commits
  5. 12 Feb, 2022 13 commits
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · b81b1829
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Two minor fixes in the lpfc driver. One changing the classification of
        trace messages and the other fixing a build issue when NVME_FC is
        disabled"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: lpfc: Reduce log messages seen after firmware download
        scsi: lpfc: Remove NVMe support if kernel has NVME_FC disabled
      b81b1829
    • Linus Torvalds's avatar
      Merge tag 'char-misc-5.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc · 080eba78
      Linus Torvalds authored
      Pull char/misc driver fixes from Greg KH:
       "Here are a small number of char/misc driver fixes for 5.17-rc4 for
        reported issues. They contain:
      
         - phy driver fixes
      
         - iio driver fix
      
         - eeprom driver fix
      
         - speakup regression fix
      
         - fastrpc fix
      
        All of these have been in linux-next with no reported issues"
      
      * tag 'char-misc-5.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
        iio: buffer: Fix file related error handling in IIO_BUFFER_GET_FD_IOCTL
        speakup-dectlk: Restore pitch setting
        bus: mhi: pci_generic: Add mru_default for Cinterion MV31-W
        bus: mhi: pci_generic: Add mru_default for Foxconn SDX55
        eeprom: ee1004: limit i2c reads to I2C_SMBUS_BLOCK_MAX
        misc: fastrpc: avoid double fput() on failed usercopy
        phy: dphy: Correct clk_pre parameter
        phy: phy-mtk-tphy: Fix duplicated argument in phy-mtk-tphy
        phy: stm32: fix a refcount leak in stm32_usbphyc_pll_enable()
        phy: xilinx: zynqmp: Fix bus width setting for SGMII
        phy: cadence: Sierra: fix error handling bugs in probe()
        phy: ti: Fix missing sentinel for clk_div_table
        phy: broadcom: Kconfig: Fix PHY_BRCM_USB config option
        phy: usb: Leave some clocks running during suspend
      080eba78
    • Linus Torvalds's avatar
      Merge tag 'staging-5.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging · dcd72f54
      Linus Torvalds authored
      Pullstaging driver fixes from Greg KH:
       "Here are two staging driver fixes for 5.17-rc4.  These are:
      
         - fbtft error path fix
      
         - vc04_services rcu dereference fix
      
        Both of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'staging-5.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
        staging: fbtft: Fix error path in fbtft_driver_module_init()
        staging: vc04_services: Fix RCU dereference check
      dcd72f54
    • Linus Torvalds's avatar
      Merge tag 'tty-5.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty · 522e7d03
      Linus Torvalds authored
      Pull tty/serial fixes from Greg KH:
       "Here are four small tty/serial fixes for 5.17-rc4.  They are:
      
         - 8250_pericom change revert to fix a reported regression
      
         - two speculation fixes for vt_ioctl
      
         - n_tty regression fix for polling
      
        All of these have been in linux-next for a while with no reported
        issues"
      
      * tag 'tty-5.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
        vt_ioctl: add array_index_nospec to VT_ACTIVATE
        vt_ioctl: fix array_index_nospec in vt_setactivate
        serial: 8250_pericom: Revert "Re-enable higher baud rates"
        n_tty: wake up poll(POLLRDNORM) on receiving data
      522e7d03
    • Linus Torvalds's avatar
      Merge tag 'usb-5.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb · 85187378
      Linus Torvalds authored
      Pull USB fixes from Greg KH:
       "Here are some small USB driver fixes for 5.17-rc4 that resolve some
        reported issues and add new device ids:
      
         - usb-serial new device ids
      
         - ulpi cleanup fixes
      
         - f_fs use-after-free fix
      
         - dwc3 driver fixes
      
         - ax88179_178a usb network driver fix
      
         - usb gadget fixes
      
        There is a revert at the end of this series to resolve a build problem
        that 0-day found yesterday. Most of these have been in linux-next,
        except for the last few, and all have now passed 0-day tests"
      
      * tag 'usb-5.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
        Revert "usb: dwc2: drd: fix soft connect when gadget is unconfigured"
        usb: dwc2: drd: fix soft connect when gadget is unconfigured
        usb: gadget: rndis: check size of RNDIS_MSG_SET command
        USB: gadget: validate interface OS descriptor requests
        usb: core: Unregister device on component_add() failure
        net: usb: ax88179_178a: Fix out-of-bounds accesses in RX fixup
        usb: dwc3: gadget: Prevent core from processing stale TRBs
        USB: serial: cp210x: add CPI Bulk Coin Recycler id
        USB: serial: cp210x: add NCR Retail IO box id
        USB: serial: ftdi_sio: add support for Brainboxes US-159/235/320
        usb: gadget: f_uac2: Define specific wTerminalType
        usb: gadget: udc: renesas_usb3: Fix host to USB_ROLE_NONE transition
        usb: raw-gadget: fix handling of dual-direction-capable endpoints
        usb: usb251xb: add boost-up property support
        usb: ulpi: Call of_node_put correctly
        usb: ulpi: Move of_node_put to ulpi_dev_release
        USB: serial: option: add ZTE MF286D modem
        USB: serial: ch341: add support for GW Instek USB2.0-Serial devices
        usb: f_fs: Fix use-after-free for epfile
        usb: dwc3: xilinx: fix uninitialized return value
      85187378
    • Linus Torvalds's avatar
      Merge tag 's390-5.17-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux · a4fd49cd
      Linus Torvalds authored
      Pull s390 updates from Vasily Gorbik:
       "Maintainers and reviewers changes:
      
          - Add Alexander Gordeev as maintainer for s390.
      
          - Christian Borntraeger will focus on s390 KVM maintainership and
            stays as s390 reviewer.
      
        Fixes:
      
         - Fix clang build of modules loader KUnit test.
      
         - Fix kernel panic in CIO code on FCES path-event when no driver is
           attached to a device or the driver does not provide the path_event
           function"
      
      * tag 's390-5.17-4' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
        s390/cio: verify the driver availability for path_event call
        s390/module: fix building test_modules_helpers.o with clang
        MAINTAINERS: downgrade myself to Reviewer for s390
        MAINTAINERS: add Alexander Gordeev as maintainer for s390
      a4fd49cd
    • Linus Torvalds's avatar
      Merge tag 'for-linus-5.17a-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip · 4a387c98
      Linus Torvalds authored
      Pull xen fixes from Juergen Gross:
      
       - Two small cleanups
      
       - Another fix for addressing the EFI framebuffer above 4GB when running
         as Xen dom0
      
       - A patch to let Xen guests use reserved bits in MSI- and IO-APIC-
         registers for extended APIC-IDs the same way KVM guests are doing it
         already
      
      * tag 'for-linus-5.17a-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
        xen/pci: Make use of the helper macro LIST_HEAD()
        xen/x2apic: Fix inconsistent indenting
        xen/x86: detect support for extended destination ID
        xen/x86: obtain full video frame buffer address for Dom0 also under EFI
      4a387c98
    • Linus Torvalds's avatar
      Merge tag 'seccomp-v5.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux · eef8cffc
      Linus Torvalds authored
      Pull seccomp fixes from Kees Cook:
       "This fixes a corner case of fatal SIGSYS being ignored since v5.15.
        Along with the signal fix is a change to seccomp so that seeing
        another syscall after a fatal filter result will cause seccomp to kill
        the process harder.
      
        Summary:
      
         - Force HANDLER_EXIT even for SIGNAL_UNKILLABLE
      
         - Make seccomp self-destruct after fatal filter results
      
         - Update seccomp samples for easier behavioral demonstration"
      
      * tag 'seccomp-v5.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:
        samples/seccomp: Adjust sample to also provide kill option
        seccomp: Invalidate seccomp mode to catch death failures
        signal: HANDLER_EXIT should clear SIGNAL_UNKILLABLE
      eef8cffc
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · 9917ff5f
      Linus Torvalds authored
      Merge misc fixes from Andrew Morton:
       "5 patches.
      
        Subsystems affected by this patch series: binfmt, procfs, and mm
        (vmscan, memcg, and kfence)"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        kfence: make test case compatible with run time set sample interval
        mm: memcg: synchronize objcg lists with a dedicated spinlock
        mm: vmscan: remove deadlock due to throttling failing to make progress
        fs/proc: task_mmu.c: don't read mapcount for migration entry
        fs/binfmt_elf: fix PT_LOAD p_align values for loaders
      9917ff5f
    • Jing Leng's avatar
      kconfig: fix failing to generate auto.conf · 1b9e740a
      Jing Leng authored
      When the KCONFIG_AUTOCONFIG is specified (e.g. export \
      KCONFIG_AUTOCONFIG=output/config/auto.conf), the directory of
      include/config/ will not be created, so kconfig can't create deps
      files in it and auto.conf can't be generated.
      Signed-off-by: default avatarJing Leng <jleng@ambarella.com>
      Signed-off-by: default avatarMasahiro Yamada <masahiroy@kernel.org>
      1b9e740a
    • Greg Kroah-Hartman's avatar
      Revert "usb: dwc2: drd: fix soft connect when gadget is unconfigured" · 736e8d89
      Greg Kroah-Hartman authored
      This reverts commit 269cbcf7.
      
      It causes build errors as reported by the kernel test robot.
      
      Link: https://lore.kernel.org/r/202202112236.AwoOTtHO-lkp@intel.comReported-by: default avatarkernel test robot <lkp@intel.com>
      Fixes: 269cbcf7 ("usb: dwc2: drd: fix soft connect when gadget is unconfigured")
      Cc: stable@kernel.org
      Cc: Amelie Delaunay <amelie.delaunay@foss.st.com>
      Cc: Minas Harutyunyan <Minas.Harutyunyan@synopsys.com>
      Cc: Fabrice Gasnier <fabrice.gasnier@foss.st.com>
      Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
      736e8d89
    • Peng Liu's avatar
      kfence: make test case compatible with run time set sample interval · 8913c610
      Peng Liu authored
      The parameter kfence_sample_interval can be set via boot parameter and
      late shell command, which is convenient for automated tests and KFENCE
      parameter optimization.  However, KFENCE test case just uses
      compile-time CONFIG_KFENCE_SAMPLE_INTERVAL, which will make KFENCE test
      case not run as users desired.  Export kfence_sample_interval, so that
      KFENCE test case can use run-time-set sample interval.
      
      Link: https://lkml.kernel.org/r/20220207034432.185532-1-liupeng256@huawei.comSigned-off-by: default avatarPeng Liu <liupeng256@huawei.com>
      Reviewed-by: default avatarMarco Elver <elver@google.com>
      Cc: Alexander Potapenko <glider@google.com>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: Jonathan Corbet <corbet@lwn.net>
      Cc: Sumit Semwal <sumit.semwal@linaro.org>
      Cc: Christian Knig <christian.koenig@amd.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      8913c610
    • Roman Gushchin's avatar
      mm: memcg: synchronize objcg lists with a dedicated spinlock · 0764db9b
      Roman Gushchin authored
      Alexander reported a circular lock dependency revealed by the mmap1 ltp
      test:
      
        LOCKDEP_CIRCULAR (suite: ltp, case: mtest06 (mmap1))
                WARNING: possible circular locking dependency detected
                5.17.0-20220113.rc0.git0.f2211f194038.300.fc35.s390x+debug #1 Not tainted
                ------------------------------------------------------
                mmap1/202299 is trying to acquire lock:
                00000001892c0188 (css_set_lock){..-.}-{2:2}, at: obj_cgroup_release+0x4a/0xe0
                but task is already holding lock:
                00000000ca3b3818 (&sighand->siglock){-.-.}-{2:2}, at: force_sig_info_to_task+0x38/0x180
                which lock already depends on the new lock.
                the existing dependency chain (in reverse order) is:
                -> #1 (&sighand->siglock){-.-.}-{2:2}:
                       __lock_acquire+0x604/0xbd8
                       lock_acquire.part.0+0xe2/0x238
                       lock_acquire+0xb0/0x200
                       _raw_spin_lock_irqsave+0x6a/0xd8
                       __lock_task_sighand+0x90/0x190
                       cgroup_freeze_task+0x2e/0x90
                       cgroup_migrate_execute+0x11c/0x608
                       cgroup_update_dfl_csses+0x246/0x270
                       cgroup_subtree_control_write+0x238/0x518
                       kernfs_fop_write_iter+0x13e/0x1e0
                       new_sync_write+0x100/0x190
                       vfs_write+0x22c/0x2d8
                       ksys_write+0x6c/0xf8
                       __do_syscall+0x1da/0x208
                       system_call+0x82/0xb0
                -> #0 (css_set_lock){..-.}-{2:2}:
                       check_prev_add+0xe0/0xed8
                       validate_chain+0x736/0xb20
                       __lock_acquire+0x604/0xbd8
                       lock_acquire.part.0+0xe2/0x238
                       lock_acquire+0xb0/0x200
                       _raw_spin_lock_irqsave+0x6a/0xd8
                       obj_cgroup_release+0x4a/0xe0
                       percpu_ref_put_many.constprop.0+0x150/0x168
                       drain_obj_stock+0x94/0xe8
                       refill_obj_stock+0x94/0x278
                       obj_cgroup_charge+0x164/0x1d8
                       kmem_cache_alloc+0xac/0x528
                       __sigqueue_alloc+0x150/0x308
                       __send_signal+0x260/0x550
                       send_signal+0x7e/0x348
                       force_sig_info_to_task+0x104/0x180
                       force_sig_fault+0x48/0x58
                       __do_pgm_check+0x120/0x1f0
                       pgm_check_handler+0x11e/0x180
                other info that might help us debug this:
                 Possible unsafe locking scenario:
                       CPU0                    CPU1
                       ----                    ----
                  lock(&sighand->siglock);
                                               lock(css_set_lock);
                                               lock(&sighand->siglock);
                  lock(css_set_lock);
                 *** DEADLOCK ***
                2 locks held by mmap1/202299:
                 #0: 00000000ca3b3818 (&sighand->siglock){-.-.}-{2:2}, at: force_sig_info_to_task+0x38/0x180
                 #1: 00000001892ad560 (rcu_read_lock){....}-{1:2}, at: percpu_ref_put_many.constprop.0+0x0/0x168
                stack backtrace:
                CPU: 15 PID: 202299 Comm: mmap1 Not tainted 5.17.0-20220113.rc0.git0.f2211f194038.300.fc35.s390x+debug #1
                Hardware name: IBM 3906 M04 704 (LPAR)
                Call Trace:
                  dump_stack_lvl+0x76/0x98
                  check_noncircular+0x136/0x158
                  check_prev_add+0xe0/0xed8
                  validate_chain+0x736/0xb20
                  __lock_acquire+0x604/0xbd8
                  lock_acquire.part.0+0xe2/0x238
                  lock_acquire+0xb0/0x200
                  _raw_spin_lock_irqsave+0x6a/0xd8
                  obj_cgroup_release+0x4a/0xe0
                  percpu_ref_put_many.constprop.0+0x150/0x168
                  drain_obj_stock+0x94/0xe8
                  refill_obj_stock+0x94/0x278
                  obj_cgroup_charge+0x164/0x1d8
                  kmem_cache_alloc+0xac/0x528
                  __sigqueue_alloc+0x150/0x308
                  __send_signal+0x260/0x550
                  send_signal+0x7e/0x348
                  force_sig_info_to_task+0x104/0x180
                  force_sig_fault+0x48/0x58
                  __do_pgm_check+0x120/0x1f0
                  pgm_check_handler+0x11e/0x180
                INFO: lockdep is turned off.
      
      In this example a slab allocation from __send_signal() caused a
      refilling and draining of a percpu objcg stock, resulted in a releasing
      of another non-related objcg.  Objcg release path requires taking the
      css_set_lock, which is used to synchronize objcg lists.
      
      This can create a circular dependency with the sighandler lock, which is
      taken with the locked css_set_lock by the freezer code (to freeze a
      task).
      
      In general it seems that using css_set_lock to synchronize objcg lists
      makes any slab allocations and deallocation with the locked css_set_lock
      and any intervened locks risky.
      
      To fix the problem and make the code more robust let's stop using
      css_set_lock to synchronize objcg lists and use a new dedicated spinlock
      instead.
      
      Link: https://lkml.kernel.org/r/Yfm1IHmoGdyUR81T@carbon.dhcp.thefacebook.com
      Fixes: bf4f0599 ("mm: memcg/slab: obj_cgroup API")
      Signed-off-by: default avatarRoman Gushchin <guro@fb.com>
      Reported-by: default avatarAlexander Egorenkov <egorenar@linux.ibm.com>
      Tested-by: default avatarAlexander Egorenkov <egorenar@linux.ibm.com>
      Reviewed-by: default avatarWaiman Long <longman@redhat.com>
      Acked-by: default avatarTejun Heo <tj@kernel.org>
      Reviewed-by: default avatarShakeel Butt <shakeelb@google.com>
      Reviewed-by: default avatarJeremy Linton <jeremy.linton@arm.com>
      Tested-by: default avatarJeremy Linton <jeremy.linton@arm.com>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      0764db9b