1. 26 Jul, 2021 15 commits
  2. 25 Jul, 2021 9 commits
  3. 24 Jul, 2021 16 commits
    • Linus Torvalds's avatar
      Merge tag 'riscv-for-linus-5.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux · 6498f615
      Linus Torvalds authored
      Pull RISC-V fixes from Palmer Dabbelt:
      
       - properly set the memory size, which fixes 32-bit systems
      
       - allow initrd to load anywhere in memory, rather that restricting it
         to the first 256MiB
      
       - fix the 'mem=' parameter on 64-bit systems to properly account for
         the maximum supported memory now that the kernel is outside the
         linear map
      
       - avoid installing mappings into the last 4KiB of memory, which
         conflicts with error values
      
       - avoid the stack from being freed while it is being walked
      
       - a handful of fixes to the new copy to/from user routines
      
      * tag 'riscv-for-linus-5.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
        riscv: __asm_copy_to-from_user: Fix: Typos in comments
        riscv: __asm_copy_to-from_user: Remove unnecessary size check
        riscv: __asm_copy_to-from_user: Fix: fail on RV32
        riscv: __asm_copy_to-from_user: Fix: overrun copy
        riscv: stacktrace: pin the task's stack in get_wchan
        riscv: Make sure the kernel mapping does not overlap with IS_ERR_VALUE
        riscv: Make sure the linear mapping does not use the kernel mapping
        riscv: Fix memory_limit for 64-bit kernel
        RISC-V: load initrd wherever it fits into memory
        riscv: Fix 32-bit RISC-V boot failure
      6498f615
    • Linus Torvalds's avatar
      ACPI: fix NULL pointer dereference · fc68f42a
      Linus Torvalds authored
      Commit 71f64283 ("ACPI: utils: Fix reference counting in
      for_each_acpi_dev_match()") started doing "acpi_dev_put()" on a pointer
      that was possibly NULL.  That fails miserably, because that helper
      inline function is not set up to handle that case.
      
      Just make acpi_dev_put() silently accept a NULL pointer, rather than
      calling down to put_device() with an invalid offset off that NULL
      pointer.
      
      Link: https://lore.kernel.org/lkml/a607c149-6bf6-0fd0-0e31-100378504da2@kernel.dk/Reported-and-tested-by: default avatarJens Axboe <axboe@kernel.dk>
      Tested-by: default avatarDaniel Scally <djrscally@gmail.com>
      Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      fc68f42a
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 7ffca2bb
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Four fixes, all in drivers, all of which can lead to user visible
        problems in certain situations"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: target: Fix NULL dereference on XCOPY completion
        scsi: mpt3sas: Transition IOC to Ready state during shutdown
        scsi: target: Fix protect handling in WRITE SAME(32)
        scsi: iscsi: Fix iface sysfs attr detection
      7ffca2bb
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.14-2021-07-24' of git://git.kernel.dk/linux-block · 0ee818c3
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
      
       - Fix a memory leak due to a race condition in io_init_wq_offload
         (Yang)
      
       - Poll error handling fixes (Pavel)
      
       - Fix early fdput() regression (me)
      
       - Don't reissue iopoll requests off release path (me)
      
       - Add a safety check for io-wq queue off wrong path (me)
      
      * tag 'io_uring-5.14-2021-07-24' of git://git.kernel.dk/linux-block:
        io_uring: explicitly catch any illegal async queue attempt
        io_uring: never attempt iopoll reissue from release path
        io_uring: fix early fdput() of file
        io_uring: fix memleak in io_init_wq_offload()
        io_uring: remove double poll entry on arm failure
        io_uring: explicitly count entries for poll reqs
      0ee818c3
    • Linus Torvalds's avatar
      Merge tag 'block-5.14-2021-07-24' of git://git.kernel.dk/linux-block · 4d4a60ce
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
      
       - NVMe pull request (Christoph):
          - tracing fix (Keith Busch)
          - fix multipath head refcounting (Hannes Reinecke)
          - Write Zeroes vs PI fix (me)
          - drop a bogus WARN_ON (Zhihao Cheng)
      
       - Increase max blk-cgroup policy size, now that mq-deadline
         uses it too (Oleksandr)
      
      * tag 'block-5.14-2021-07-24' of git://git.kernel.dk/linux-block:
        nvme: set the PRACT bit when using Write Zeroes with T10 PI
        nvme: fix nvme_setup_command metadata trace event
        nvme: fix refcounting imbalance when all paths are down
        nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is not RESETTING
        block: increase BLKCG_MAX_POLS
      4d4a60ce
    • Linus Torvalds's avatar
      Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · 0823baef
      Linus Torvalds authored
      Pull i2c fixes from Wolfram Sang:
       "Two bugfixes for the I2C subsystem"
      
      * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        i2c: mpc: Poll for MCF
        misc: eeprom: at24: Always append device id even if label property is set.
      0823baef
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · bca1d4de
      Linus Torvalds authored
      Merge misc mm fixes from Andrew Morton:
       "15 patches.
      
        VM subsystems affected by this patch series: userfaultfd, kfence,
        highmem, pagealloc, memblock, pagecache, secretmem, pagemap, and
        hugetlbfs"
      
      * akpm:
        hugetlbfs: fix mount mode command line processing
        mm: fix the deadlock in finish_fault()
        mm: mmap_lock: fix disabling preemption directly
        mm/secretmem: wire up ->set_page_dirty
        writeback, cgroup: do not reparent dax inodes
        writeback, cgroup: remove wb from offline list before releasing refcnt
        memblock: make for_each_mem_range() traverse MEMBLOCK_HOTPLUG regions
        mm: page_alloc: fix page_poison=1 / INIT_ON_ALLOC_DEFAULT_ON interaction
        mm: use kmap_local_page in memzero_page
        mm: call flush_dcache_page() in memcpy_to_page() and memzero_page()
        kfence: skip all GFP_ZONEMASK allocations
        kfence: move the size check to the beginning of __kfence_alloc()
        kfence: defer kfence_test_init to ensure that kunit debugfs is created
        selftest: use mmap instead of posix_memalign to allocate memory
        userfaultfd: do not untag user pointers
      bca1d4de
    • Akira Tsukamoto's avatar
      riscv: __asm_copy_to-from_user: Fix: Typos in comments · ea196c54
      Akira Tsukamoto authored
      Fixing typos and grammar mistakes and using more intuitive label
      name.
      Signed-off-by: default avatarAkira Tsukamoto <akira.tsukamoto@gmail.com>
      Fixes: ca6eaaa2 ("riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall")
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      ea196c54
    • Akira Tsukamoto's avatar
      riscv: __asm_copy_to-from_user: Remove unnecessary size check · d4b3e010
      Akira Tsukamoto authored
      Clean up:
      
      The size of 0 will be evaluated in the next step. Not
      required here.
      Signed-off-by: default avatarAkira Tsukamoto <akira.tsukamoto@gmail.com>
      Fixes: ca6eaaa2 ("riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall")
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      d4b3e010
    • Akira Tsukamoto's avatar
      riscv: __asm_copy_to-from_user: Fix: fail on RV32 · 22b5f16f
      Akira Tsukamoto authored
      Had a bug when converting bytes to bits when the cpu was rv32.
      
      The a3 contains the number of bytes and multiple of 8
      would be the bits. The LGREG is holding 2 for RV32 and 3 for
      RV32, so to achieve multiple of 8 it must always be constant 3.
      The 2 was mistakenly used for rv32.
      Signed-off-by: default avatarAkira Tsukamoto <akira.tsukamoto@gmail.com>
      Fixes: ca6eaaa2 ("riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall")
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      22b5f16f
    • Akira Tsukamoto's avatar
      riscv: __asm_copy_to-from_user: Fix: overrun copy · 6010d300
      Akira Tsukamoto authored
      There were two causes for the overrun memory access.
      
      The threshold size was too small.
      The aligning dst require one SZREG and unrolling word copy requires
      8*SZREG, total have to be at least 9*SZREG.
      
      Inside the unrolling copy, the subtracting -(8*SZREG-1) would make
      iteration happening one extra loop. Proper value is -(8*SZREG).
      Signed-off-by: default avatarAkira Tsukamoto <akira.tsukamoto@gmail.com>
      Fixes: ca6eaaa2 ("riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall")
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      6010d300
    • Mike Kravetz's avatar
      hugetlbfs: fix mount mode command line processing · e0f7e2b2
      Mike Kravetz authored
      In commit 32021982 ("hugetlbfs: Convert to fs_context") processing
      of the mount mode string was changed from match_octal() to fsparam_u32.
      
      This changed existing behavior as match_octal does not require octal
      values to have a '0' prefix, but fsparam_u32 does.
      
      Use fsparam_u32oct which provides the same behavior as match_octal.
      
      Link: https://lkml.kernel.org/r/20210721183326.102716-1-mike.kravetz@oracle.com
      Fixes: 32021982 ("hugetlbfs: Convert to fs_context")
      Signed-off-by: default avatarMike Kravetz <mike.kravetz@oracle.com>
      Reported-by: default avatarDennis Camera <bugs+kernel.org@dtnr.ch>
      Reviewed-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
      Cc: David Howells <dhowells@redhat.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e0f7e2b2
    • Qi Zheng's avatar
      mm: fix the deadlock in finish_fault() · e4dc3489
      Qi Zheng authored
      Commit 63f3655f ("mm, memcg: fix reclaim deadlock with writeback")
      fix the following ABBA deadlock by pre-allocating the pte page table
      without holding the page lock.
      
      	                                lock_page(A)
                                              SetPageWriteback(A)
                                              unlock_page(A)
        lock_page(B)
                                              lock_page(B)
        pte_alloc_one
          shrink_page_list
            wait_on_page_writeback(A)
                                              SetPageWriteback(B)
                                              unlock_page(B)
      
                                              # flush A, B to clear the writeback
      
      Commit f9ce0be7 ("mm: Cleanup faultaround and finish_fault()
      codepaths") reworked the relevant code but ignored this race.  This will
      cause the deadlock above to appear again, so fix it.
      
      Link: https://lkml.kernel.org/r/20210721074849.57004-1-zhengqi.arch@bytedance.com
      Fixes: f9ce0be7 ("mm: Cleanup faultaround and finish_fault() codepaths")
      Signed-off-by: default avatarQi Zheng <zhengqi.arch@bytedance.com>
      Acked-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Cc: Michal Hocko <mhocko@kernel.org>
      Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
      Cc: Muchun Song <songmuchun@bytedance.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e4dc3489
    • Muchun Song's avatar
      mm: mmap_lock: fix disabling preemption directly · e904c2cc
      Muchun Song authored
      Commit 832b5072 ("mm: mmap_lock: use local locks instead of
      disabling preemption") fixed a bug by using local locks.
      
      But commit d01079f3 ("mm/mmap_lock: remove dead code for
      !CONFIG_TRACING configurations") changed those lines back to the
      original version.
      
      I guess it was introduced by fixing conflicts.
      
      Link: https://lkml.kernel.org/r/20210720074228.76342-1-songmuchun@bytedance.com
      Fixes: d01079f3 ("mm/mmap_lock: remove dead code for !CONFIG_TRACING configurations")
      Signed-off-by: default avatarMuchun Song <songmuchun@bytedance.com>
      Acked-by: default avatarMel Gorman <mgorman@techsingularity.net>
      Reviewed-by: default avatarYang Shi <shy828301@gmail.com>
      Reviewed-by: default avatarPankaj Gupta <pankaj.gupta@ionos.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e904c2cc
    • Mike Rapoport's avatar
      mm/secretmem: wire up ->set_page_dirty · af642374
      Mike Rapoport authored
      Make secretmem up to date with the changes done in commit 0af57378
      ("mm: require ->set_page_dirty to be explicitly wired up") so that
      unconditional call to this method won't cause crashes.
      
      Link: https://lkml.kernel.org/r/20210716063933.31633-1-rppt@kernel.org
      Fixes: 0af57378 ("mm: require ->set_page_dirty to be explicitly wired up")
      Signed-off-by: default avatarMike Rapoport <rppt@linux.ibm.com>
      Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      af642374
    • Roman Gushchin's avatar
      writeback, cgroup: do not reparent dax inodes · 593311e8
      Roman Gushchin authored
      The inode switching code is not suited for dax inodes.  An attempt to
      switch a dax inode to a parent writeback structure (as a part of a
      writeback cleanup procedure) results in a panic like this:
      
        run fstests generic/270 at 2021-07-15 05:54:02
        XFS (pmem0p2): EXPERIMENTAL big timestamp feature in use.  Use at your own risk!
        XFS (pmem0p2): DAX enabled. Warning: EXPERIMENTAL, use at your own risk
        XFS (pmem0p2): EXPERIMENTAL inode btree counters feature in use. Use at your own risk!
        XFS (pmem0p2): Mounting V5 Filesystem
        XFS (pmem0p2): Ending clean mount
        XFS (pmem0p2): Quotacheck needed: Please wait.
        XFS (pmem0p2): Quotacheck: Done.
        XFS (pmem0p2): xlog_verify_grant_tail: space > BBTOB(tail_blocks)
        XFS (pmem0p2): xlog_verify_grant_tail: space > BBTOB(tail_blocks)
        XFS (pmem0p2): xlog_verify_grant_tail: space > BBTOB(tail_blocks)
        BUG: unable to handle page fault for address: 0000000005b0f669
        #PF: supervisor read access in kernel mode
        #PF: error_code(0x0000) - not-present page
        PGD 0 P4D 0
        Oops: 0000 [#1] SMP PTI
        CPU: 13 PID: 10479 Comm: kworker/13:16 Not tainted 5.14.0-rc1-master-8096acd7+ #8
        Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 09/13/2016
        Workqueue: inode_switch_wbs inode_switch_wbs_work_fn
        RIP: 0010:inode_do_switch_wbs+0xaf/0x470
        Code: 00 30 0f 85 c1 03 00 00 0f 1f 44 00 00 31 d2 48 c7 c6 ff ff ff ff 48 8d 7c 24 08 e8 eb 49 1a 00 48 85 c0 74 4a bb ff ff ff ff <48> 8b 50 08 48 8d 4a ff 83 e2 01 48 0f 45 c1 48 8b 00 a8 08 0f 85
        RSP: 0018:ffff9c66691abdc8 EFLAGS: 00010002
        RAX: 0000000005b0f661 RBX: 00000000ffffffff RCX: ffff89e6a21382b0
        RDX: 0000000000000001 RSI: ffff89e350230248 RDI: ffffffffffffffff
        RBP: ffff89e681d19400 R08: 0000000000000000 R09: 0000000000000228
        R10: ffffffffffffffff R11: ffffffffffffffc0 R12: ffff89e6a2138130
        R13: ffff89e316af7400 R14: ffff89e316af6e78 R15: ffff89e6a21382b0
        FS:  0000000000000000(0000) GS:ffff89ee5fb40000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 0000000005b0f669 CR3: 0000000cb2410004 CR4: 00000000001706e0
        Call Trace:
         inode_switch_wbs_work_fn+0xb6/0x2a0
         process_one_work+0x1e6/0x380
         worker_thread+0x53/0x3d0
         kthread+0x10f/0x130
         ret_from_fork+0x22/0x30
        Modules linked in: xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_counter nf_tables nfnetlink bridge stp llc rfkill sunrpc intel_rapl_msr intel_rapl_common sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel ipmi_ssif kvm mgag200 i2c_algo_bit iTCO_wdt irqbypass drm_kms_helper iTCO_vendor_support acpi_ipmi rapl syscopyarea sysfillrect intel_cstate ipmi_si sysimgblt ioatdma dax_pmem_compat fb_sys_fops ipmi_devintf device_dax i2c_i801 pcspkr intel_uncore hpilo nd_pmem cec dax_pmem_core dca i2c_smbus acpi_tad lpc_ich ipmi_msghandler acpi_power_meter drm fuse xfs libcrc32c sd_mod t10_pi crct10dif_pclmul crc32_pclmul crc32c_intel tg3 ghash_clmulni_intel serio_raw hpsa hpwdt scsi_transport_sas wmi dm_mirror dm_region_hash dm_log dm_mod
        CR2: 0000000005b0f669
        ---[ end trace ed2105faff8384f3 ]---
        RIP: 0010:inode_do_switch_wbs+0xaf/0x470
        Code: 00 30 0f 85 c1 03 00 00 0f 1f 44 00 00 31 d2 48 c7 c6 ff ff ff ff 48 8d 7c 24 08 e8 eb 49 1a 00 48 85 c0 74 4a bb ff ff ff ff <48> 8b 50 08 48 8d 4a ff 83 e2 01 48 0f 45 c1 48 8b 00 a8 08 0f 85
        RSP: 0018:ffff9c66691abdc8 EFLAGS: 00010002
        RAX: 0000000005b0f661 RBX: 00000000ffffffff RCX: ffff89e6a21382b0
        RDX: 0000000000000001 RSI: ffff89e350230248 RDI: ffffffffffffffff
        RBP: ffff89e681d19400 R08: 0000000000000000 R09: 0000000000000228
        R10: ffffffffffffffff R11: ffffffffffffffc0 R12: ffff89e6a2138130
        R13: ffff89e316af7400 R14: ffff89e316af6e78 R15: ffff89e6a21382b0
        FS:  0000000000000000(0000) GS:ffff89ee5fb40000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 0000000005b0f669 CR3: 0000000cb2410004 CR4: 00000000001706e0
        Kernel panic - not syncing: Fatal exception
        Kernel Offset: 0x15200000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
        ---[ end Kernel panic - not syncing: Fatal exception ]---
      
      The crash happens on an attempt to iterate over attached pagecache pages
      and check the dirty flag: a dax inode's xarray contains pfn's instead of
      generic struct page pointers.
      
      This happens for DAX and not for other kinds of non-page entries in the
      inodes because it's a tagged iteration, and shadow/swap entries are
      never tagged; only DAX entries get tagged.
      
      Fix the problem by bailing out (with the false return value) of
      inode_prepare_sbs_switch() if a dax inode is passed.
      
      [willy@infradead.org: changelog addition]
      
      Link: https://lkml.kernel.org/r/20210719171350.3876830-1-guro@fb.com
      Fixes: c22d70a1 ("writeback, cgroup: release dying cgwbs by switching attached inodes")
      Signed-off-by: default avatarRoman Gushchin <guro@fb.com>
      Reported-by: default avatarMurphy Zhou <jencce.kernel@gmail.com>
      Reported-by: default avatarDarrick J. Wong <djwong@kernel.org>
      Tested-by: default avatarDarrick J. Wong <djwong@kernel.org>
      Tested-by: default avatarMurphy Zhou <jencce.kernel@gmail.com>
      Acked-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
      Cc: Jan Kara <jack@suse.cz>
      Cc: Dave Chinner <dchinner@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      593311e8