1. 28 Jul, 2021 5 commits
  2. 27 Jul, 2021 2 commits
    • Randy Dunlap's avatar
      efi: sysfb_efi: fix build when EFI is not set · 15d27b15
      Randy Dunlap authored
      When # CONFIG_EFI is not set, there are 2 definitions of
      sysfb_apply_efi_quirks(). The stub from sysfb.h should be used
      and the __init function from sysfb_efi.c should not be used.
      
      ../drivers/firmware/efi/sysfb_efi.c:337:13: error: redefinition of ‘sysfb_apply_efi_quirks’
       __init void sysfb_apply_efi_quirks(struct platform_device *pd)
                   ^~~~~~~~~~~~~~~~~~~~~~
      In file included from ../drivers/firmware/efi/sysfb_efi.c:26:0:
      ../include/linux/sysfb.h:65:20: note: previous definition of ‘sysfb_apply_efi_quirks’ was here
       static inline void sysfb_apply_efi_quirks(struct platform_device *pd)
                          ^~~~~~~~~~~~~~~~~~~~~~
      Reviewed-by: default avatarJavier Martinez Canillas <javierm@redhat.com>
      Fixes: 8633ef82 ("drivers/firmware: consolidate EFI framebuffer setup for all arches")
      Acked-by: default avatarArd Biesheuvel <ardb@kernel.org>
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Cc: Ard Biesheuvel <ardb@kernel.org>
      Cc: linux-efi@vger.kernel.org
      Cc: dri-devel@lists.freedesktop.org
      Cc: Javier Martinez Canillas <javierm@redhat.com>
      Cc: Thomas Zimmermann <tzimmermann@suse.de>
      Cc: Mark Brown <broonie@kernel.org>
      Cc: linux-next@vger.kernel.org
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: https://patchwork.freedesktop.org/patch/msgid/20210727050447.7339-1-rdunlap@infradead.org
      15d27b15
    • Javier Martinez Canillas's avatar
      drivers/firmware: fix SYSFB depends to prevent build failures · 71260b9a
      Javier Martinez Canillas authored
      The Generic System Framebuffers support is built when the COMPILE_TEST
      option is enabled. But this wrongly assumes that all the architectures
      declare a struct screen_info.
      
      This is true for most architectures, but at least the following do not:
      arc, m68k, microblaze, openrisc, parisc and s390.
      
      By attempting to make this compile testeable on all architectures, it
      leads to linking errors as reported by the kernel test robot for parisc:
      
        All errors (new ones prefixed by >>):
      
           hppa-linux-ld: drivers/firmware/sysfb.o: in function `sysfb_init':
           (.init.text+0x24): undefined reference to `screen_info'
        >> hppa-linux-ld: (.init.text+0x28): undefined reference to `screen_info'
      
      To prevent these errors only allow sysfb to be built on systems that are
      going to need it, which are x86 BIOS and EFI.
      
      The EFI Kconfig symbol is used instead of (ARM || ARM64 || RISC) because
      some of these architectures only declare a struct screen_info if EFI is
      enabled. And also, because the SYSFB code is only used for EFI on these
      architectures. For !EFI the "simple-framebuffer" device is registered by
      OF when parsing the Device Tree Blob (if a DT node for this was defined).
      
      Fixes: d391c582 ("drivers/firmware: move x86 Generic System Framebuffers support")
      Reported-by: default avatarkernel test robot <lkp@intel.com>
      Signed-off-by: default avatarJavier Martinez Canillas <javierm@redhat.com>
      Signed-off-by: default avatarDaniel Vetter <daniel.vetter@ffwll.ch>
      Link: https://patchwork.freedesktop.org/patch/msgid/20210727093015.1225107-1-javierm@redhat.com
      71260b9a
  3. 25 Jul, 2021 10 commits
  4. 24 Jul, 2021 23 commits
    • Linus Torvalds's avatar
      Merge tag 'riscv-for-linus-5.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux · 6498f615
      Linus Torvalds authored
      Pull RISC-V fixes from Palmer Dabbelt:
      
       - properly set the memory size, which fixes 32-bit systems
      
       - allow initrd to load anywhere in memory, rather that restricting it
         to the first 256MiB
      
       - fix the 'mem=' parameter on 64-bit systems to properly account for
         the maximum supported memory now that the kernel is outside the
         linear map
      
       - avoid installing mappings into the last 4KiB of memory, which
         conflicts with error values
      
       - avoid the stack from being freed while it is being walked
      
       - a handful of fixes to the new copy to/from user routines
      
      * tag 'riscv-for-linus-5.14-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux:
        riscv: __asm_copy_to-from_user: Fix: Typos in comments
        riscv: __asm_copy_to-from_user: Remove unnecessary size check
        riscv: __asm_copy_to-from_user: Fix: fail on RV32
        riscv: __asm_copy_to-from_user: Fix: overrun copy
        riscv: stacktrace: pin the task's stack in get_wchan
        riscv: Make sure the kernel mapping does not overlap with IS_ERR_VALUE
        riscv: Make sure the linear mapping does not use the kernel mapping
        riscv: Fix memory_limit for 64-bit kernel
        RISC-V: load initrd wherever it fits into memory
        riscv: Fix 32-bit RISC-V boot failure
      6498f615
    • Linus Torvalds's avatar
      ACPI: fix NULL pointer dereference · fc68f42a
      Linus Torvalds authored
      Commit 71f64283 ("ACPI: utils: Fix reference counting in
      for_each_acpi_dev_match()") started doing "acpi_dev_put()" on a pointer
      that was possibly NULL.  That fails miserably, because that helper
      inline function is not set up to handle that case.
      
      Just make acpi_dev_put() silently accept a NULL pointer, rather than
      calling down to put_device() with an invalid offset off that NULL
      pointer.
      
      Link: https://lore.kernel.org/lkml/a607c149-6bf6-0fd0-0e31-100378504da2@kernel.dk/Reported-and-tested-by: default avatarJens Axboe <axboe@kernel.dk>
      Tested-by: default avatarDaniel Scally <djrscally@gmail.com>
      Cc: Andy Shevchenko <andy.shevchenko@gmail.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      fc68f42a
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 7ffca2bb
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Four fixes, all in drivers, all of which can lead to user visible
        problems in certain situations"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: target: Fix NULL dereference on XCOPY completion
        scsi: mpt3sas: Transition IOC to Ready state during shutdown
        scsi: target: Fix protect handling in WRITE SAME(32)
        scsi: iscsi: Fix iface sysfs attr detection
      7ffca2bb
    • Linus Torvalds's avatar
      Merge tag 'io_uring-5.14-2021-07-24' of git://git.kernel.dk/linux-block · 0ee818c3
      Linus Torvalds authored
      Pull io_uring fixes from Jens Axboe:
      
       - Fix a memory leak due to a race condition in io_init_wq_offload
         (Yang)
      
       - Poll error handling fixes (Pavel)
      
       - Fix early fdput() regression (me)
      
       - Don't reissue iopoll requests off release path (me)
      
       - Add a safety check for io-wq queue off wrong path (me)
      
      * tag 'io_uring-5.14-2021-07-24' of git://git.kernel.dk/linux-block:
        io_uring: explicitly catch any illegal async queue attempt
        io_uring: never attempt iopoll reissue from release path
        io_uring: fix early fdput() of file
        io_uring: fix memleak in io_init_wq_offload()
        io_uring: remove double poll entry on arm failure
        io_uring: explicitly count entries for poll reqs
      0ee818c3
    • Linus Torvalds's avatar
      Merge tag 'block-5.14-2021-07-24' of git://git.kernel.dk/linux-block · 4d4a60ce
      Linus Torvalds authored
      Pull block fixes from Jens Axboe:
      
       - NVMe pull request (Christoph):
          - tracing fix (Keith Busch)
          - fix multipath head refcounting (Hannes Reinecke)
          - Write Zeroes vs PI fix (me)
          - drop a bogus WARN_ON (Zhihao Cheng)
      
       - Increase max blk-cgroup policy size, now that mq-deadline
         uses it too (Oleksandr)
      
      * tag 'block-5.14-2021-07-24' of git://git.kernel.dk/linux-block:
        nvme: set the PRACT bit when using Write Zeroes with T10 PI
        nvme: fix nvme_setup_command metadata trace event
        nvme: fix refcounting imbalance when all paths are down
        nvme-pci: don't WARN_ON in nvme_reset_work if ctrl.state is not RESETTING
        block: increase BLKCG_MAX_POLS
      4d4a60ce
    • Linus Torvalds's avatar
      Merge branch 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux · 0823baef
      Linus Torvalds authored
      Pull i2c fixes from Wolfram Sang:
       "Two bugfixes for the I2C subsystem"
      
      * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        i2c: mpc: Poll for MCF
        misc: eeprom: at24: Always append device id even if label property is set.
      0823baef
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · bca1d4de
      Linus Torvalds authored
      Merge misc mm fixes from Andrew Morton:
       "15 patches.
      
        VM subsystems affected by this patch series: userfaultfd, kfence,
        highmem, pagealloc, memblock, pagecache, secretmem, pagemap, and
        hugetlbfs"
      
      * akpm:
        hugetlbfs: fix mount mode command line processing
        mm: fix the deadlock in finish_fault()
        mm: mmap_lock: fix disabling preemption directly
        mm/secretmem: wire up ->set_page_dirty
        writeback, cgroup: do not reparent dax inodes
        writeback, cgroup: remove wb from offline list before releasing refcnt
        memblock: make for_each_mem_range() traverse MEMBLOCK_HOTPLUG regions
        mm: page_alloc: fix page_poison=1 / INIT_ON_ALLOC_DEFAULT_ON interaction
        mm: use kmap_local_page in memzero_page
        mm: call flush_dcache_page() in memcpy_to_page() and memzero_page()
        kfence: skip all GFP_ZONEMASK allocations
        kfence: move the size check to the beginning of __kfence_alloc()
        kfence: defer kfence_test_init to ensure that kunit debugfs is created
        selftest: use mmap instead of posix_memalign to allocate memory
        userfaultfd: do not untag user pointers
      bca1d4de
    • Akira Tsukamoto's avatar
      riscv: __asm_copy_to-from_user: Fix: Typos in comments · ea196c54
      Akira Tsukamoto authored
      Fixing typos and grammar mistakes and using more intuitive label
      name.
      Signed-off-by: default avatarAkira Tsukamoto <akira.tsukamoto@gmail.com>
      Fixes: ca6eaaa2 ("riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall")
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      ea196c54
    • Akira Tsukamoto's avatar
      riscv: __asm_copy_to-from_user: Remove unnecessary size check · d4b3e010
      Akira Tsukamoto authored
      Clean up:
      
      The size of 0 will be evaluated in the next step. Not
      required here.
      Signed-off-by: default avatarAkira Tsukamoto <akira.tsukamoto@gmail.com>
      Fixes: ca6eaaa2 ("riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall")
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      d4b3e010
    • Akira Tsukamoto's avatar
      riscv: __asm_copy_to-from_user: Fix: fail on RV32 · 22b5f16f
      Akira Tsukamoto authored
      Had a bug when converting bytes to bits when the cpu was rv32.
      
      The a3 contains the number of bytes and multiple of 8
      would be the bits. The LGREG is holding 2 for RV32 and 3 for
      RV32, so to achieve multiple of 8 it must always be constant 3.
      The 2 was mistakenly used for rv32.
      Signed-off-by: default avatarAkira Tsukamoto <akira.tsukamoto@gmail.com>
      Fixes: ca6eaaa2 ("riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall")
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      22b5f16f
    • Akira Tsukamoto's avatar
      riscv: __asm_copy_to-from_user: Fix: overrun copy · 6010d300
      Akira Tsukamoto authored
      There were two causes for the overrun memory access.
      
      The threshold size was too small.
      The aligning dst require one SZREG and unrolling word copy requires
      8*SZREG, total have to be at least 9*SZREG.
      
      Inside the unrolling copy, the subtracting -(8*SZREG-1) would make
      iteration happening one extra loop. Proper value is -(8*SZREG).
      Signed-off-by: default avatarAkira Tsukamoto <akira.tsukamoto@gmail.com>
      Fixes: ca6eaaa2 ("riscv: __asm_copy_to-from_user: Optimize unaligned memory access and pipeline stall")
      Signed-off-by: default avatarPalmer Dabbelt <palmerdabbelt@google.com>
      6010d300
    • Mike Kravetz's avatar
      hugetlbfs: fix mount mode command line processing · e0f7e2b2
      Mike Kravetz authored
      In commit 32021982 ("hugetlbfs: Convert to fs_context") processing
      of the mount mode string was changed from match_octal() to fsparam_u32.
      
      This changed existing behavior as match_octal does not require octal
      values to have a '0' prefix, but fsparam_u32 does.
      
      Use fsparam_u32oct which provides the same behavior as match_octal.
      
      Link: https://lkml.kernel.org/r/20210721183326.102716-1-mike.kravetz@oracle.com
      Fixes: 32021982 ("hugetlbfs: Convert to fs_context")
      Signed-off-by: default avatarMike Kravetz <mike.kravetz@oracle.com>
      Reported-by: default avatarDennis Camera <bugs+kernel.org@dtnr.ch>
      Reviewed-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
      Cc: David Howells <dhowells@redhat.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e0f7e2b2
    • Qi Zheng's avatar
      mm: fix the deadlock in finish_fault() · e4dc3489
      Qi Zheng authored
      Commit 63f3655f ("mm, memcg: fix reclaim deadlock with writeback")
      fix the following ABBA deadlock by pre-allocating the pte page table
      without holding the page lock.
      
      	                                lock_page(A)
                                              SetPageWriteback(A)
                                              unlock_page(A)
        lock_page(B)
                                              lock_page(B)
        pte_alloc_one
          shrink_page_list
            wait_on_page_writeback(A)
                                              SetPageWriteback(B)
                                              unlock_page(B)
      
                                              # flush A, B to clear the writeback
      
      Commit f9ce0be7 ("mm: Cleanup faultaround and finish_fault()
      codepaths") reworked the relevant code but ignored this race.  This will
      cause the deadlock above to appear again, so fix it.
      
      Link: https://lkml.kernel.org/r/20210721074849.57004-1-zhengqi.arch@bytedance.com
      Fixes: f9ce0be7 ("mm: Cleanup faultaround and finish_fault() codepaths")
      Signed-off-by: default avatarQi Zheng <zhengqi.arch@bytedance.com>
      Acked-by: default avatarKirill A. Shutemov <kirill.shutemov@linux.intel.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Johannes Weiner <hannes@cmpxchg.org>
      Cc: Michal Hocko <mhocko@kernel.org>
      Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
      Cc: Muchun Song <songmuchun@bytedance.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e4dc3489
    • Muchun Song's avatar
      mm: mmap_lock: fix disabling preemption directly · e904c2cc
      Muchun Song authored
      Commit 832b5072 ("mm: mmap_lock: use local locks instead of
      disabling preemption") fixed a bug by using local locks.
      
      But commit d01079f3 ("mm/mmap_lock: remove dead code for
      !CONFIG_TRACING configurations") changed those lines back to the
      original version.
      
      I guess it was introduced by fixing conflicts.
      
      Link: https://lkml.kernel.org/r/20210720074228.76342-1-songmuchun@bytedance.com
      Fixes: d01079f3 ("mm/mmap_lock: remove dead code for !CONFIG_TRACING configurations")
      Signed-off-by: default avatarMuchun Song <songmuchun@bytedance.com>
      Acked-by: default avatarMel Gorman <mgorman@techsingularity.net>
      Reviewed-by: default avatarYang Shi <shy828301@gmail.com>
      Reviewed-by: default avatarPankaj Gupta <pankaj.gupta@ionos.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e904c2cc
    • Mike Rapoport's avatar
      mm/secretmem: wire up ->set_page_dirty · af642374
      Mike Rapoport authored
      Make secretmem up to date with the changes done in commit 0af57378
      ("mm: require ->set_page_dirty to be explicitly wired up") so that
      unconditional call to this method won't cause crashes.
      
      Link: https://lkml.kernel.org/r/20210716063933.31633-1-rppt@kernel.org
      Fixes: 0af57378 ("mm: require ->set_page_dirty to be explicitly wired up")
      Signed-off-by: default avatarMike Rapoport <rppt@linux.ibm.com>
      Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      af642374
    • Roman Gushchin's avatar
      writeback, cgroup: do not reparent dax inodes · 593311e8
      Roman Gushchin authored
      The inode switching code is not suited for dax inodes.  An attempt to
      switch a dax inode to a parent writeback structure (as a part of a
      writeback cleanup procedure) results in a panic like this:
      
        run fstests generic/270 at 2021-07-15 05:54:02
        XFS (pmem0p2): EXPERIMENTAL big timestamp feature in use.  Use at your own risk!
        XFS (pmem0p2): DAX enabled. Warning: EXPERIMENTAL, use at your own risk
        XFS (pmem0p2): EXPERIMENTAL inode btree counters feature in use. Use at your own risk!
        XFS (pmem0p2): Mounting V5 Filesystem
        XFS (pmem0p2): Ending clean mount
        XFS (pmem0p2): Quotacheck needed: Please wait.
        XFS (pmem0p2): Quotacheck: Done.
        XFS (pmem0p2): xlog_verify_grant_tail: space > BBTOB(tail_blocks)
        XFS (pmem0p2): xlog_verify_grant_tail: space > BBTOB(tail_blocks)
        XFS (pmem0p2): xlog_verify_grant_tail: space > BBTOB(tail_blocks)
        BUG: unable to handle page fault for address: 0000000005b0f669
        #PF: supervisor read access in kernel mode
        #PF: error_code(0x0000) - not-present page
        PGD 0 P4D 0
        Oops: 0000 [#1] SMP PTI
        CPU: 13 PID: 10479 Comm: kworker/13:16 Not tainted 5.14.0-rc1-master-8096acd7+ #8
        Hardware name: HP ProLiant DL360 Gen9/ProLiant DL360 Gen9, BIOS P89 09/13/2016
        Workqueue: inode_switch_wbs inode_switch_wbs_work_fn
        RIP: 0010:inode_do_switch_wbs+0xaf/0x470
        Code: 00 30 0f 85 c1 03 00 00 0f 1f 44 00 00 31 d2 48 c7 c6 ff ff ff ff 48 8d 7c 24 08 e8 eb 49 1a 00 48 85 c0 74 4a bb ff ff ff ff <48> 8b 50 08 48 8d 4a ff 83 e2 01 48 0f 45 c1 48 8b 00 a8 08 0f 85
        RSP: 0018:ffff9c66691abdc8 EFLAGS: 00010002
        RAX: 0000000005b0f661 RBX: 00000000ffffffff RCX: ffff89e6a21382b0
        RDX: 0000000000000001 RSI: ffff89e350230248 RDI: ffffffffffffffff
        RBP: ffff89e681d19400 R08: 0000000000000000 R09: 0000000000000228
        R10: ffffffffffffffff R11: ffffffffffffffc0 R12: ffff89e6a2138130
        R13: ffff89e316af7400 R14: ffff89e316af6e78 R15: ffff89e6a21382b0
        FS:  0000000000000000(0000) GS:ffff89ee5fb40000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 0000000005b0f669 CR3: 0000000cb2410004 CR4: 00000000001706e0
        Call Trace:
         inode_switch_wbs_work_fn+0xb6/0x2a0
         process_one_work+0x1e6/0x380
         worker_thread+0x53/0x3d0
         kthread+0x10f/0x130
         ret_from_fork+0x22/0x30
        Modules linked in: xt_CHECKSUM xt_MASQUERADE xt_conntrack ipt_REJECT nf_reject_ipv4 nft_compat nft_chain_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 nft_counter nf_tables nfnetlink bridge stp llc rfkill sunrpc intel_rapl_msr intel_rapl_common sb_edac x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel ipmi_ssif kvm mgag200 i2c_algo_bit iTCO_wdt irqbypass drm_kms_helper iTCO_vendor_support acpi_ipmi rapl syscopyarea sysfillrect intel_cstate ipmi_si sysimgblt ioatdma dax_pmem_compat fb_sys_fops ipmi_devintf device_dax i2c_i801 pcspkr intel_uncore hpilo nd_pmem cec dax_pmem_core dca i2c_smbus acpi_tad lpc_ich ipmi_msghandler acpi_power_meter drm fuse xfs libcrc32c sd_mod t10_pi crct10dif_pclmul crc32_pclmul crc32c_intel tg3 ghash_clmulni_intel serio_raw hpsa hpwdt scsi_transport_sas wmi dm_mirror dm_region_hash dm_log dm_mod
        CR2: 0000000005b0f669
        ---[ end trace ed2105faff8384f3 ]---
        RIP: 0010:inode_do_switch_wbs+0xaf/0x470
        Code: 00 30 0f 85 c1 03 00 00 0f 1f 44 00 00 31 d2 48 c7 c6 ff ff ff ff 48 8d 7c 24 08 e8 eb 49 1a 00 48 85 c0 74 4a bb ff ff ff ff <48> 8b 50 08 48 8d 4a ff 83 e2 01 48 0f 45 c1 48 8b 00 a8 08 0f 85
        RSP: 0018:ffff9c66691abdc8 EFLAGS: 00010002
        RAX: 0000000005b0f661 RBX: 00000000ffffffff RCX: ffff89e6a21382b0
        RDX: 0000000000000001 RSI: ffff89e350230248 RDI: ffffffffffffffff
        RBP: ffff89e681d19400 R08: 0000000000000000 R09: 0000000000000228
        R10: ffffffffffffffff R11: ffffffffffffffc0 R12: ffff89e6a2138130
        R13: ffff89e316af7400 R14: ffff89e316af6e78 R15: ffff89e6a21382b0
        FS:  0000000000000000(0000) GS:ffff89ee5fb40000(0000) knlGS:0000000000000000
        CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
        CR2: 0000000005b0f669 CR3: 0000000cb2410004 CR4: 00000000001706e0
        Kernel panic - not syncing: Fatal exception
        Kernel Offset: 0x15200000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
        ---[ end Kernel panic - not syncing: Fatal exception ]---
      
      The crash happens on an attempt to iterate over attached pagecache pages
      and check the dirty flag: a dax inode's xarray contains pfn's instead of
      generic struct page pointers.
      
      This happens for DAX and not for other kinds of non-page entries in the
      inodes because it's a tagged iteration, and shadow/swap entries are
      never tagged; only DAX entries get tagged.
      
      Fix the problem by bailing out (with the false return value) of
      inode_prepare_sbs_switch() if a dax inode is passed.
      
      [willy@infradead.org: changelog addition]
      
      Link: https://lkml.kernel.org/r/20210719171350.3876830-1-guro@fb.com
      Fixes: c22d70a1 ("writeback, cgroup: release dying cgwbs by switching attached inodes")
      Signed-off-by: default avatarRoman Gushchin <guro@fb.com>
      Reported-by: default avatarMurphy Zhou <jencce.kernel@gmail.com>
      Reported-by: default avatarDarrick J. Wong <djwong@kernel.org>
      Tested-by: default avatarDarrick J. Wong <djwong@kernel.org>
      Tested-by: default avatarMurphy Zhou <jencce.kernel@gmail.com>
      Acked-by: default avatarMatthew Wilcox (Oracle) <willy@infradead.org>
      Cc: Jan Kara <jack@suse.cz>
      Cc: Dave Chinner <dchinner@redhat.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      593311e8
    • Roman Gushchin's avatar
      writeback, cgroup: remove wb from offline list before releasing refcnt · b43a9e76
      Roman Gushchin authored
      Boyang reported that the commit c22d70a1 ("writeback, cgroup:
      release dying cgwbs by switching attached inodes") causes the kernel to
      crash while running xfstests generic/256 on ext4 on aarch64 and ppc64le.
      
        run fstests generic/256 at 2021-07-12 05:41:40
        EXT4-fs (vda3): mounted filesystem with ordered data mode. Opts: . Quota mode: none.
        Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
        Mem abort info:
           ESR = 0x96000005
           EC = 0x25: DABT (current EL), IL = 32 bits
           SET = 0, FnV = 0
           EA = 0, S1PTW = 0
           FSC = 0x05: level 1 translation fault
        Data abort info:
           ISV = 0, ISS = 0x00000005
           CM = 0, WnR = 0
        user pgtable: 64k pages, 48-bit VAs, pgdp=00000000b0502000
        [0000000000000000] pgd=0000000000000000, p4d=0000000000000000, pud=0000000000000000
        Internal error: Oops: 96000005 [#1] SMP
        Modules linked in: dm_flakey dm_snapshot dm_bufio dm_zero dm_mod loop tls rpcsec_gss_krb5 auth_rpcgss nfsv4 dns_resolver nfs lockd grace fscache netfs rfkill sunrpc ext4 vfat fat mbcache jbd2 drm fuse xfs libcrc32c crct10dif_ce ghash_ce sha2_ce sha256_arm64 sha1_ce virtio_blk virtio_net net_failover virtio_console failover virtio_mmio aes_neon_bs [last unloaded: scsi_debug]
        CPU: 0 PID: 408468 Comm: kworker/u8:5 Tainted: G X --------- ---  5.14.0-0.rc1.15.bx.el9.aarch64 #1
        Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015
        Workqueue: events_unbound cleanup_offline_cgwbs_workfn
        pstate: 004000c5 (nzcv daIF +PAN -UAO -TCO BTYPE=--)
        pc : cleanup_offline_cgwbs_workfn+0x320/0x394
        lr : cleanup_offline_cgwbs_workfn+0xe0/0x394
        sp : ffff80001554fd10
        x29: ffff80001554fd10 x28: 0000000000000000 x27: 0000000000000001
        x26: 0000000000000000 x25: 00000000000000e0 x24: ffffd2a2fbe671a8
        x23: ffff80001554fd88 x22: ffffd2a2fbe67198 x21: ffffd2a2fc25a730
        x20: ffff210412bc3000 x19: ffff210412bc3280 x18: 0000000000000000
        x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000000
        x14: 0000000000000000 x13: 0000000000000030 x12: 0000000000000040
        x11: ffff210481572238 x10: ffff21048157223a x9 : ffffd2a2fa276c60
        x8 : ffff210484106b60 x7 : 0000000000000000 x6 : 000000000007d18a
        x5 : ffff210416a86400 x4 : ffff210412bc0280 x3 : 0000000000000000
        x2 : ffff80001554fd88 x1 : ffff210412bc0280 x0 : 0000000000000003
        Call trace:
           cleanup_offline_cgwbs_workfn+0x320/0x394
           process_one_work+0x1f4/0x4b0
           worker_thread+0x184/0x540
           kthread+0x114/0x120
           ret_from_fork+0x10/0x18
        Code: d63f0020 97f99963 17ffffa6 f8588263 (f9400061)
        ---[ end trace e250fe289272792a ]---
        Kernel panic - not syncing: Oops: Fatal exception
        SMP: stopping secondary CPUs
        SMP: failed to stop secondary CPUs 0-2
        Kernel Offset: 0x52a2e9fa0000 from 0xffff800010000000
        PHYS_OFFSET: 0xfff0defca0000000
        CPU features: 0x00200251,23200840
        Memory Limit: none
        ---[ end Kernel panic - not syncing: Oops: Fatal exception ]---
      
      The problem happens when cgwb_release_workfn() races with
      cleanup_offline_cgwbs_workfn(): wb_tryget() in
      cleanup_offline_cgwbs_workfn() can be called after percpu_ref_exit() is
      cgwb_release_workfn(), which is basically a use-after-free error.
      
      Fix the problem by making removing the writeback structure from the
      offline list before releasing the percpu reference counter.  It will
      guarantee that cleanup_offline_cgwbs_workfn() will not see and not
      access writeback structures which are about to be released.
      
      Link: https://lkml.kernel.org/r/20210716201039.3762203-1-guro@fb.com
      Fixes: c22d70a1 ("writeback, cgroup: release dying cgwbs by switching attached inodes")
      Signed-off-by: default avatarRoman Gushchin <guro@fb.com>
      Reported-by: default avatarBoyang Xue <bxue@redhat.com>
      Suggested-by: default avatarJan Kara <jack@suse.cz>
      Tested-by: default avatarDarrick J. Wong <djwong@kernel.org>
      Cc: Will Deacon <will@kernel.org>
      Cc: Dave Chinner <dchinner@redhat.com>
      Cc: Murphy Zhou <jencce.kernel@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b43a9e76
    • Mike Rapoport's avatar
      memblock: make for_each_mem_range() traverse MEMBLOCK_HOTPLUG regions · 79e482e9
      Mike Rapoport authored
      Commit b10d6bca ("arch, drivers: replace for_each_membock() with
      for_each_mem_range()") didn't take into account that when there is
      movable_node parameter in the kernel command line, for_each_mem_range()
      would skip ranges marked with MEMBLOCK_HOTPLUG.
      
      The page table setup code in POWER uses for_each_mem_range() to create
      the linear mapping of the physical memory and since the regions marked
      as MEMORY_HOTPLUG are skipped, they never make it to the linear map.
      
      A later access to the memory in those ranges will fail:
      
        BUG: Unable to handle kernel data access on write at 0xc000000400000000
        Faulting instruction address: 0xc00000000008a3c0
        Oops: Kernel access of bad area, sig: 11 [#1]
        LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
        Modules linked in:
        CPU: 0 PID: 53 Comm: kworker/u2:0 Not tainted 5.13.0 #7
        NIP:  c00000000008a3c0 LR: c0000000003c1ed8 CTR: 0000000000000040
        REGS: c000000008a57770 TRAP: 0300   Not tainted  (5.13.0)
        MSR:  8000000002009033 <SF,VEC,EE,ME,IR,DR,RI,LE>  CR: 84222202  XER: 20040000
        CFAR: c0000000003c1ed4 DAR: c000000400000000 DSISR: 42000000 IRQMASK: 0
        GPR00: c0000000003c1ed8 c000000008a57a10 c0000000019da700 c000000400000000
        GPR04: 0000000000000280 0000000000000180 0000000000000400 0000000000000200
        GPR08: 0000000000000100 0000000000000080 0000000000000040 0000000000000300
        GPR12: 0000000000000380 c000000001bc0000 c0000000001660c8 c000000006337e00
        GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000
        GPR20: 0000000040000000 0000000020000000 c000000001a81990 c000000008c30000
        GPR24: c000000008c20000 c000000001a81998 000fffffffff0000 c000000001a819a0
        GPR28: c000000001a81908 c00c000001000000 c000000008c40000 c000000008a64680
        NIP clear_user_page+0x50/0x80
        LR __handle_mm_fault+0xc88/0x1910
        Call Trace:
          __handle_mm_fault+0xc44/0x1910 (unreliable)
          handle_mm_fault+0x130/0x2a0
          __get_user_pages+0x248/0x610
          __get_user_pages_remote+0x12c/0x3e0
          get_arg_page+0x54/0xf0
          copy_string_kernel+0x11c/0x210
          kernel_execve+0x16c/0x220
          call_usermodehelper_exec_async+0x1b0/0x2f0
          ret_from_kernel_thread+0x5c/0x70
        Instruction dump:
        79280fa4 79271764 79261f24 794ae8e2 7ca94214 7d683a14 7c893a14 7d893050
        7d4903a6 60000000 60000000 60000000 <7c001fec> 7c091fec 7c081fec 7c051fec
        ---[ end trace 490b8c67e6075e09 ]---
      
      Making for_each_mem_range() include MEMBLOCK_HOTPLUG regions in the
      traversal fixes this issue.
      
      Link: https://bugzilla.redhat.com/show_bug.cgi?id=1976100
      Link: https://lkml.kernel.org/r/20210712071132.20902-1-rppt@kernel.org
      Fixes: b10d6bca ("arch, drivers: replace for_each_membock() with for_each_mem_range()")
      Signed-off-by: default avatarMike Rapoport <rppt@linux.ibm.com>
      Tested-by: default avatarGreg Kurz <groug@kaod.org>
      Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
      Cc: <stable@vger.kernel.org>	[5.10+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      79e482e9
    • Sergei Trofimovich's avatar
      mm: page_alloc: fix page_poison=1 / INIT_ON_ALLOC_DEFAULT_ON interaction · 69e5d322
      Sergei Trofimovich authored
      To reproduce the failure we need the following system:
      
       - kernel command: page_poison=1 init_on_free=0 init_on_alloc=0
      
       - kernel config:
          * CONFIG_INIT_ON_ALLOC_DEFAULT_ON=y
          * CONFIG_INIT_ON_FREE_DEFAULT_ON=y
          * CONFIG_PAGE_POISONING=y
      
      Resulting in:
      
          0000000085629bdd: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
          0000000022861832: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
          00000000c597f5b0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
          CPU: 11 PID: 15195 Comm: bash Kdump: loaded Tainted: G     U     O      5.13.1-gentoo-x86_64 #1
          Hardware name: System manufacturer System Product Name/PRIME Z370-A, BIOS 2801 01/13/2021
          Call Trace:
           dump_stack+0x64/0x7c
           __kernel_unpoison_pages.cold+0x48/0x84
           post_alloc_hook+0x60/0xa0
           get_page_from_freelist+0xdb8/0x1000
           __alloc_pages+0x163/0x2b0
           __get_free_pages+0xc/0x30
           pgd_alloc+0x2e/0x1a0
           mm_init+0x185/0x270
           dup_mm+0x6b/0x4f0
           copy_process+0x190d/0x1b10
           kernel_clone+0xba/0x3b0
           __do_sys_clone+0x8f/0xb0
           do_syscall_64+0x68/0x80
           entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      Before commit 51cba1eb ("init_on_alloc: Optimize static branches")
      init_on_alloc never enabled static branch by default.  It could only be
      enabed explicitly by init_mem_debugging_and_hardening().
      
      But after commit 51cba1eb, a static branch could already be enabled
      by default.  There was no code to ever disable it.  That caused
      page_poison=1 / init_on_free=1 conflict.
      
      This change extends init_mem_debugging_and_hardening() to also disable
      static branch disabling.
      
      Link: https://lkml.kernel.org/r/20210714031935.4094114-1-keescook@chromium.org
      Link: https://lore.kernel.org/r/20210712215816.1512739-1-slyfox@gentoo.org
      Fixes: 51cba1eb ("init_on_alloc: Optimize static branches")
      Signed-off-by: default avatarSergei Trofimovich <slyfox@gentoo.org>
      Signed-off-by: default avatarKees Cook <keescook@chromium.org>
      Co-developed-by: default avatarKees Cook <keescook@chromium.org>
      Reported-by: default avatarMikhail Morfikov <mmorfikov@gmail.com>
      Reported-by: <bowsingbetee@pm.me>
      Tested-by: <bowsingbetee@protonmail.com>
      Reviewed-by: default avatarDavid Hildenbrand <david@redhat.com>
      Cc: Alexander Potapenko <glider@google.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Vlastimil Babka <vbabka@suse.cz>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      69e5d322
    • Christoph Hellwig's avatar
      mm: use kmap_local_page in memzero_page · d9a42b53
      Christoph Hellwig authored
      The commit message introducing the global memzero_page explicitly
      mentions switching to kmap_local_page in the commit log but doesn't
      actually do that.
      
      Link: https://lkml.kernel.org/r/20210713055231.137602-3-hch@lst.de
      Fixes: 28961998 ("iov_iter: lift memzero_page() to highmem.h")
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarChaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
      Reviewed-by: default avatarIra Weiny <ira.weiny@intel.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d9a42b53
    • Christoph Hellwig's avatar
      mm: call flush_dcache_page() in memcpy_to_page() and memzero_page() · 8dad53a1
      Christoph Hellwig authored
      memcpy_to_page and memzero_page can write to arbitrary pages, which
      could be in the page cache or in high memory, so call
      flush_kernel_dcache_pages to flush the dcache.
      
      This is a problem when using these helpers on dcache challeneged
      architectures.  Right now there are just a few users, chances are no one
      used the PC floppy driver, the aha1542 driver for an ISA SCSI HBA, and a
      few advanced and optional btrfs and ext4 features on those platforms yet
      since the conversion.
      
      Link: https://lkml.kernel.org/r/20210713055231.137602-2-hch@lst.de
      Fixes: bb90d4bc ("mm/highmem: Lift memcpy_[to|from]_page to core")
      Fixes: 28961998 ("iov_iter: lift memzero_page() to highmem.h")
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarIra Weiny <ira.weiny@intel.com>
      Cc: Chaitanya Kulkarni <chaitanya.kulkarni@wdc.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      8dad53a1
    • Alexander Potapenko's avatar
      kfence: skip all GFP_ZONEMASK allocations · 236e9f15
      Alexander Potapenko authored
      Allocation requests outside ZONE_NORMAL (MOVABLE, HIGHMEM or DMA) cannot
      be fulfilled by KFENCE, because KFENCE memory pool is located in a zone
      different from the requested one.
      
      Because callers of kmem_cache_alloc() may actually rely on the
      allocation to reside in the requested zone (e.g.  memory allocations
      done with __GFP_DMA must be DMAable), skip all allocations done with
      GFP_ZONEMASK and/or respective SLAB flags (SLAB_CACHE_DMA and
      SLAB_CACHE_DMA32).
      
      Link: https://lkml.kernel.org/r/20210714092222.1890268-2-glider@google.com
      Fixes: 0ce20dd8 ("mm: add Kernel Electric-Fence infrastructure")
      Signed-off-by: default avatarAlexander Potapenko <glider@google.com>
      Reviewed-by: default avatarMarco Elver <elver@google.com>
      Acked-by: default avatarSouptick Joarder <jrdr.linux@gmail.com>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Souptick Joarder <jrdr.linux@gmail.com>
      Cc: <stable@vger.kernel.org>	[5.12+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      236e9f15
    • Alexander Potapenko's avatar
      kfence: move the size check to the beginning of __kfence_alloc() · 235a85cb
      Alexander Potapenko authored
      Check the allocation size before toggling kfence_allocation_gate.
      
      This way allocations that can't be served by KFENCE will not result in
      waiting for another CONFIG_KFENCE_SAMPLE_INTERVAL without allocating
      anything.
      
      Link: https://lkml.kernel.org/r/20210714092222.1890268-1-glider@google.comSigned-off-by: default avatarAlexander Potapenko <glider@google.com>
      Suggested-by: default avatarMarco Elver <elver@google.com>
      Reviewed-by: default avatarMarco Elver <elver@google.com>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: Marco Elver <elver@google.com>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: <stable@vger.kernel.org>	[5.12+]
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      235a85cb