1. 20 Aug, 2019 3 commits
    • Jason Gunthorpe's avatar
      drm/amdkfd: fix a use after free race with mmu_notifer unregister · 0029cab3
      Jason Gunthorpe authored
      When using mmu_notifer_unregister_no_release() the caller must ensure
      there is a SRCU synchronize before the mn memory is freed, otherwise use
      after free races are possible, for instance:
      
           CPU0                                      CPU1
                                            invalidate_range_start
                                               hlist_for_each_entry_rcu(..)
       mmu_notifier_unregister_no_release(&p->mn)
       kfree(mn)
                                            if (mn->ops->invalidate_range_end)
      
      The error unwind in amdkfd misses the SRCU synchronization.
      
      amdkfd keeps the kfd_process around until the mm is released, so split the
      flow to fully initialize the kfd_process and register it for find_process,
      and with the notifier. Past this point the kfd_process does not need to be
      cleaned up as it is fully ready.
      
      The final failable step does a vm_mmap() and does not seem to impact the
      kfd_process global state. Since it also cannot be undone (and already has
      problems with undo if it internally fails), it has to be last.
      
      This way we don't have to try to unwind the mmu_notifier_register() and
      avoid the problem with the SRCU.
      
      Along the way this also fixes various other error unwind bugs in the flow.
      
      Fixes: 45102048 ("amdkfd: Add process queue manager module")
      Link: https://lore.kernel.org/r/20190806231548.25242-10-jgg@ziepe.caReviewed-by: default avatarFelix Kuehling <Felix.Kuehling@amd.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      0029cab3
    • Jason Gunthorpe's avatar
      drm/radeon: use mmu_notifier_get/put for struct radeon_mn · 534e5f84
      Jason Gunthorpe authored
      radeon is using a device global hash table to track what mmu_notifiers
      have been registered on struct mm. This is better served with the new
      get/put scheme instead.
      
      radeon has a bug where it was not blocking notifier release() until all
      the BO's had been invalidated. This could result in a use after free of
      pages the BOs. This is tied into a second bug where radeon left the
      notifiers running endlessly even once the interval tree became
      empty. This could result in a use after free with module unload.
      
      Both are fixed by changing the lifetime model, the BOs exist in the
      interval tree with their natural lifetimes independent of the mm_struct
      lifetime using the get/put scheme. The release runs synchronously and just
      does invalidate_start across the entire interval tree to create the
      required DMA fence.
      
      Additions to the interval tree after release are already impossible as
      only current->mm is used during the add.
      
      Link: https://lore.kernel.org/r/20190806231548.25242-9-jgg@ziepe.caAcked-by: default avatarChristian König <christian.koenig@amd.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      534e5f84
    • Jason Gunthorpe's avatar
      hmm: use mmu_notifier_get/put for 'struct hmm' · c7d8b782
      Jason Gunthorpe authored
      This is a significant simplification, it eliminates all the remaining
      'hmm' stuff in mm_struct, eliminates krefing along the critical notifier
      paths, and takes away all the ugly locking and abuse of page_table_lock.
      
      mmu_notifier_get() provides the single struct hmm per struct mm which
      eliminates mm->hmm.
      
      It also directly guarantees that no mmu_notifier op callback is callable
      while concurrent free is possible, this eliminates all the krefs inside
      the mmu_notifier callbacks.
      
      The remaining krefs in the range code were overly cautious, drivers are
      already not permitted to free the mirror while a range exists.
      
      Link: https://lore.kernel.org/r/20190806231548.25242-6-jgg@ziepe.caReviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarRalph Campbell <rcampbell@nvidia.com>
      Tested-by: default avatarRalph Campbell <rcampbell@nvidia.com>
      Signed-off-by: default avatarJason Gunthorpe <jgg@mellanox.com>
      c7d8b782
  2. 16 Aug, 2019 4 commits
  3. 07 Aug, 2019 13 commits
  4. 26 Jul, 2019 6 commits
  5. 25 Jul, 2019 7 commits
  6. 21 Jul, 2019 7 commits
    • Linus Torvalds's avatar
      Linus 5.3-rc1 · 5f9e832c
      Linus Torvalds authored
      5f9e832c
    • Linus Torvalds's avatar
      Merge tag 'devicetree-fixes-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux · c7bf0a0f
      Linus Torvalds authored
      Pull Devicetree fixes from Rob Herring:
       "Fix several warnings/errors in validation of binding schemas"
      
      * tag 'devicetree-fixes-for-5.3' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
        dt-bindings: pinctrl: stm32: Fix missing 'clocks' property in examples
        dt-bindings: iio: ad7124: Fix dtc warnings in example
        dt-bindings: iio: avia-hx711: Fix avdd-supply typo in example
        dt-bindings: pinctrl: aspeed: Fix AST2500 example errors
        dt-bindings: pinctrl: aspeed: Fix 'compatible' schema errors
        dt-bindings: riscv: Limit cpus schema to only check RiscV 'cpu' nodes
        dt-bindings: Ensure child nodes are of type 'object'
      c7bf0a0f
    • Linus Torvalds's avatar
      Merge branch 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · d6788eb7
      Linus Torvalds authored
      Pull vfs documentation typo fix from Al Viro.
      
      * 'work.misc' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        typo fix: it's d_make_root, not d_make_inode...
      d6788eb7
    • Linus Torvalds's avatar
      Merge tag '5.3-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 · 91962d0f
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
       "Two fixes for stable, one that had dependency on earlier patch in this
        merge window and can now go in, and a perf improvement in SMB3 open"
      
      * tag '5.3-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: update internal module number
        cifs: flush before set-info if we have writeable handles
        smb3: optimize open to not send query file internal info
        cifs: copy_file_range needs to strip setuid bits and update timestamps
        CIFS: fix deadlock in cached root handling
      91962d0f
    • Qian Cai's avatar
      iommu/amd: fix a crash in iova_magazine_free_pfns · 8cf66504
      Qian Cai authored
      The commit b3aa14f0 ("iommu: remove the mapping_error dma_map_ops
      method") incorrectly changed the checking from dma_ops_alloc_iova() in
      map_sg() causes a crash under memory pressure as dma_ops_alloc_iova()
      never return DMA_MAPPING_ERROR on failure but 0, so the error handling
      is all wrong.
      
         kernel BUG at drivers/iommu/iova.c:801!
          Workqueue: kblockd blk_mq_run_work_fn
          RIP: 0010:iova_magazine_free_pfns+0x7d/0xc0
          Call Trace:
           free_cpu_cached_iovas+0xbd/0x150
           alloc_iova_fast+0x8c/0xba
           dma_ops_alloc_iova.isra.6+0x65/0xa0
           map_sg+0x8c/0x2a0
           scsi_dma_map+0xc6/0x160
           pqi_aio_submit_io+0x1f6/0x440 [smartpqi]
           pqi_scsi_queue_command+0x90c/0xdd0 [smartpqi]
           scsi_queue_rq+0x79c/0x1200
           blk_mq_dispatch_rq_list+0x4dc/0xb70
           blk_mq_sched_dispatch_requests+0x249/0x310
           __blk_mq_run_hw_queue+0x128/0x200
           blk_mq_run_work_fn+0x27/0x30
           process_one_work+0x522/0xa10
           worker_thread+0x63/0x5b0
           kthread+0x1d2/0x1f0
           ret_from_fork+0x22/0x40
      
      Fixes: b3aa14f0 ("iommu: remove the mapping_error dma_map_ops method")
      Signed-off-by: default avatarQian Cai <cai@lca.pw>
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      8cf66504
    • Mike Rapoport's avatar
      hexagon: switch to generic version of pte allocation · 618381f0
      Mike Rapoport authored
      The hexagon implementation pte_alloc_one(), pte_alloc_one_kernel(),
      pte_free_kernel() and pte_free() is identical to the generic except of
      lack of __GFP_ACCOUNT for the user PTEs allocation.
      
      Switch hexagon to use generic version of these functions.
      Signed-off-by: default avatarMike Rapoport <rppt@linux.ibm.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      618381f0
    • Linus Torvalds's avatar
      Merge tag 'ntb-5.3' of git://github.com/jonmason/ntb · bec5545e
      Linus Torvalds authored
      Pull NTB updates from Jon Mason:
       "New feature to add support for NTB virtual MSI interrupts, the ability
        to test and use this feature in the NTB transport layer.
      
        Also, bug fixes for the AMD and Switchtec drivers, as well as some
        general patches"
      
      * tag 'ntb-5.3' of git://github.com/jonmason/ntb: (22 commits)
        NTB: Describe the ntb_msi_test client in the documentation.
        NTB: Add MSI interrupt support to ntb_transport
        NTB: Add ntb_msi_test support to ntb_test
        NTB: Introduce NTB MSI Test Client
        NTB: Introduce MSI library
        NTB: Rename ntb.c to support multiple source files in the module
        NTB: Introduce functions to calculate multi-port resource index
        NTB: Introduce helper functions to calculate logical port number
        PCI/switchtec: Add module parameter to request more interrupts
        PCI/MSI: Support allocating virtual MSI interrupts
        ntb_hw_switchtec: Fix setup MW with failure bug
        ntb_hw_switchtec: Skip unnecessary re-setup of shared memory window for crosslink case
        ntb_hw_switchtec: Remove redundant steps of switchtec_ntb_reinit_peer() function
        NTB: correct ntb_dev_ops and ntb_dev comment typos
        NTB: amd: Silence shift wrapping warning in amd_ntb_db_vector_mask()
        ntb_hw_switchtec: potential shift wrapping bug in switchtec_ntb_init_sndev()
        NTB: ntb_transport: Ensure qp->tx_mw_dma_addr is initaliazed
        NTB: ntb_hw_amd: set peer limit register
        NTB: ntb_perf: Clear stale values in doorbell and command SPAD register
        NTB: ntb_perf: Disable NTB link after clearing peer XLAT registers
        ...
      bec5545e