1. 25 Aug, 2017 4 commits
    • Will Deacon's avatar
      perf/aux: Ensure aux_wakeup represents most recent wakeup index · d9a50b02
      Will Deacon authored
      The aux_watermark member of struct ring_buffer represents the period (in
      terms of bytes) at which wakeup events should be generated when data is
      written to the aux buffer in non-snapshot mode. On hardware that cannot
      generate an interrupt when the aux_head reaches an arbitrary wakeup index
      (such as ARM SPE), the aux_head sampled from handle->head in
      perf_aux_output_{skip,end} may in fact be past the wakeup index. This
      can lead to wakeup slowly falling behind the head. For example, consider
      the case where hardware can only generate an interrupt on a page-boundary
      and the aux buffer is initialised as follows:
      
        // Buffer size is 2 * PAGE_SIZE
        rb->aux_head = rb->aux_wakeup = 0
        rb->aux_watermark = PAGE_SIZE / 2
      
      following the first perf_aux_output_begin call, the handle is
      initialised with:
      
        handle->head = 0
        handle->size = 2 * PAGE_SIZE
        handle->wakeup = PAGE_SIZE / 2
      
      and the hardware will be programmed to generate an interrupt at
      PAGE_SIZE.
      
      When the interrupt is raised, the hardware head will be at PAGE_SIZE,
      so calling perf_aux_output_end(handle, PAGE_SIZE) puts the ring buffer
      into the following state:
      
        rb->aux_head = PAGE_SIZE
        rb->aux_wakeup = PAGE_SIZE / 2
        rb->aux_watermark = PAGE_SIZE / 2
      
      and then the next call to perf_aux_output_begin will result in:
      
        handle->head = handle->wakeup = PAGE_SIZE
      
      for which the semantics are unclear and, for a smaller aux_watermark
      (e.g. PAGE_SIZE / 4), then the wakeup would in fact be behind head at
      this point.
      
      This patch fixes the problem by rounding down the aux_head (as sampled
      from the handle) to the nearest aux_watermark boundary when updating
      rb->aux_wakeup, therefore taking into account any overruns by the
      hardware.
      Reported-by: default avatarMark Rutland <mark.rutland@arm.com>
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Acked-by: default avatarAlexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: linux-arm-kernel@lists.infradead.org
      Link: http://lkml.kernel.org/r/1502900297-21839-2-git-send-email-will.deacon@arm.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      d9a50b02
    • Will Deacon's avatar
      perf/aux: Make aux_{head,wakeup} ring_buffer members long · 2ab346cf
      Will Deacon authored
      The aux_head and aux_wakeup members of struct ring_buffer are defined
      using the local_t type, despite the fact that they are only accessed via
      the perf_aux_output_*() functions, which cannot race with each other for a
      given ring buffer.
      
      This patch changes the type of the members to long, so we can avoid
      using the local_*() API where it isn't needed.
      Signed-off-by: default avatarWill Deacon <will.deacon@arm.com>
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Mark Rutland <mark.rutland@arm.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: linux-arm-kernel@lists.infradead.org
      Link: http://lkml.kernel.org/r/1502900297-21839-1-git-send-email-will.deacon@arm.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      2ab346cf
    • Ingo Molnar's avatar
      290d9bf2
    • Mark Rutland's avatar
      perf/core: Fix group {cpu,task} validation · 64aee2a9
      Mark Rutland authored
      Regardless of which events form a group, it does not make sense for the
      events to target different tasks and/or CPUs, as this leaves the group
      inconsistent and impossible to schedule. The core perf code assumes that
      these are consistent across (successfully intialised) groups.
      
      Core perf code only verifies this when moving SW events into a HW
      context. Thus, we can violate this requirement for pure SW groups and
      pure HW groups, unless the relevant PMU driver happens to perform this
      verification itself. These mismatched groups subsequently wreak havoc
      elsewhere.
      
      For example, we handle watchpoints as SW events, and reserve watchpoint
      HW on a per-CPU basis at pmu::event_init() time to ensure that any event
      that is initialised is guaranteed to have a slot at pmu::add() time.
      However, the core code only checks the group leader's cpu filter (via
      event_filter_match()), and can thus install follower events onto CPUs
      violating thier (mismatched) CPU filters, potentially installing them
      into a CPU without sufficient reserved slots.
      
      This can be triggered with the below test case, resulting in warnings
      from arch backends.
      
        #define _GNU_SOURCE
        #include <linux/hw_breakpoint.h>
        #include <linux/perf_event.h>
        #include <sched.h>
        #include <stdio.h>
        #include <sys/prctl.h>
        #include <sys/syscall.h>
        #include <unistd.h>
      
        static int perf_event_open(struct perf_event_attr *attr, pid_t pid, int cpu,
      			   int group_fd, unsigned long flags)
        {
      	return syscall(__NR_perf_event_open, attr, pid, cpu, group_fd, flags);
        }
      
        char watched_char;
      
        struct perf_event_attr wp_attr = {
      	.type = PERF_TYPE_BREAKPOINT,
      	.bp_type = HW_BREAKPOINT_RW,
      	.bp_addr = (unsigned long)&watched_char,
      	.bp_len = 1,
      	.size = sizeof(wp_attr),
        };
      
        int main(int argc, char *argv[])
        {
      	int leader, ret;
      	cpu_set_t cpus;
      
      	/*
      	 * Force use of CPU0 to ensure our CPU0-bound events get scheduled.
      	 */
      	CPU_ZERO(&cpus);
      	CPU_SET(0, &cpus);
      	ret = sched_setaffinity(0, sizeof(cpus), &cpus);
      	if (ret) {
      		printf("Unable to set cpu affinity\n");
      		return 1;
      	}
      
      	/* open leader event, bound to this task, CPU0 only */
      	leader = perf_event_open(&wp_attr, 0, 0, -1, 0);
      	if (leader < 0) {
      		printf("Couldn't open leader: %d\n", leader);
      		return 1;
      	}
      
      	/*
      	 * Open a follower event that is bound to the same task, but a
      	 * different CPU. This means that the group should never be possible to
      	 * schedule.
      	 */
      	ret = perf_event_open(&wp_attr, 0, 1, leader, 0);
      	if (ret < 0) {
      		printf("Couldn't open mismatched follower: %d\n", ret);
      		return 1;
      	} else {
      		printf("Opened leader/follower with mismastched CPUs\n");
      	}
      
      	/*
      	 * Open as many independent events as we can, all bound to the same
      	 * task, CPU0 only.
      	 */
      	do {
      		ret = perf_event_open(&wp_attr, 0, 0, -1, 0);
      	} while (ret >= 0);
      
      	/*
      	 * Force enable/disble all events to trigger the erronoeous
      	 * installation of the follower event.
      	 */
      	printf("Opened all events. Toggling..\n");
      	for (;;) {
      		prctl(PR_TASK_PERF_EVENTS_DISABLE, 0, 0, 0, 0);
      		prctl(PR_TASK_PERF_EVENTS_ENABLE, 0, 0, 0, 0);
      	}
      
      	return 0;
        }
      
      Fix this by validating this requirement regardless of whether we're
      moving events.
      Signed-off-by: default avatarMark Rutland <mark.rutland@arm.com>
      Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Zhou Chengming <zhouchengming1@huawei.com>
      Cc: stable@vger.kernel.org
      Link: http://lkml.kernel.org/r/1498142498-15758-1-git-send-email-mark.rutland@arm.comSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
      64aee2a9
  2. 24 Aug, 2017 19 commits
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma · 90a6cd50
      Linus Torvalds authored
      Pull more rdma fixes from Doug Ledford:
       "Well, I thought we were going to be done for this -rc cycle. I should
        have known better than to say so though.
      
        We have four additional items that trickled in.
      
        One was a simple mistake on my part. I took a patch into my for-next
        thinking that the issue was less severe than it was. I was then
        notified that it needed to be in my -rc area instead.
      
        The other three were just found late in testing.
      
        Summary:
      
         - One core fix accidentally applied first to for-next and then cherry
           picked back because it needed to be in the -rc cycles instead
      
         - Another core fix
      
         - Two mlx5 fixes"
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:
        IB/mlx5: Always return success for RoCE modify port
        IB/mlx5: Fix Raw Packet QP event handler assignment
        IB/core: Avoid accessing non-allocated memory when inferring port type
        RDMA/uverbs: Initialize cq_context appropriately
      90a6cd50
    • Linus Torvalds's avatar
      Merge tag 'acpi-4.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm · 4898b99c
      Linus Torvalds authored
      Pull ACPI fixes from Rafael Wysocki:
       "These fix two recent regressions (in ACPICA and in the ACPI EC driver)
        and one bug in code introduced during the 4.12 cycle (ACPI device
        properties library routine).
      
        Specifics:
      
         - Fix a regression in the ACPI EC driver causing a kernel to crash
           during initialization on some systems due to a code ordering issue
           exposed by a recent change (Lv Zheng).
      
         - Fix a recent regression in ACPICA due to a change of the behavior
           of a library function in a way that is not backwards compatible
           with some existing callers of it (Rafael Wysocki).
      
         - Fix a coding mistake in a library function related to the handling
           of ACPI device properties introduced during the 4.12 cycle (Sakari
           Ailus)"
      
      * tag 'acpi-4.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
        ACPI: device property: Fix node lookup in acpi_graph_get_child_prop_value()
        ACPICA: Fix acpi_evaluate_object_typed()
        ACPI: EC: Fix regression related to wrong ECDT initialization order
      4898b99c
    • Linus Torvalds's avatar
      Merge tag 'kbuild-fixes-v4.13' of... · f7bbf075
      Linus Torvalds authored
      Merge tag 'kbuild-fixes-v4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild
      
      Pull Kbuild fixes from Masahiro Yamada:
      
       - fix linker script regression caused by dead code elimination support
      
       - fix typos and outdated comments
      
       - specify kselftest-clean as a PHONY target
      
       - fix "make dtbs_install" when $(srctree) includes shell special
         characters like '~'
      
       - Move -fshort-wchar to the global option list because defining it
         partially emits warnings
      
      * tag 'kbuild-fixes-v4.13' of git://git.kernel.org/pub/scm/linux/kernel/git/masahiroy/linux-kbuild:
        kbuild: update comments of Makefile.asm-generic
        kbuild: Do not use hyphen in exported variable name
        Makefile: add kselftest-clean to PHONY target list
        Kbuild: use -fshort-wchar globally
        fixdep: trivial: typo fix and correction
        kbuild: trivial cleanups on the comments
        kbuild: linker script do not match C names unless LD_DEAD_CODE_DATA_ELIMINATION is configured
      f7bbf075
    • Linus Torvalds's avatar
      Merge branch 'for-4.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux · b71a5e3f
      Linus Torvalds authored
      Pull btrfs fix from David Sterba:
       "We have one more fixup that stems from the blk_status_t conversion
        that did not quite cover everything.
      
        The normal cases were not affected because the code is 0, but any
        error and retries could mix up new and old values"
      
      * 'for-4.13-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:
        Btrfs: fix blk_status_t/errno confusion
      b71a5e3f
    • Linus Torvalds's avatar
      Merge tag 'trace-v4.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 415be6c2
      Linus Torvalds authored
      Pull tracing fixes from Steven Rostedt:
       "Various bug fixes:
      
         - Two small memory leaks in error paths.
      
         - A missed return error code on an error path.
      
         - A fix to check the tracing ring buffer CPU when it doesn't exist
           (caused by setting maxcpus on the command line that is less than
           the actual number of CPUs, and then onlining them manually).
      
         - A fix to have the reset of boot tracers called by lateinit_sync()
           instead of just lateinit(). As some of the tracers register via
           lateinit(), and if the clear happens before the tracer is
           registered, it will never start even though it was told to via the
           kernel command line"
      
      * tag 'trace-v4.13-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Fix freeing of filter in create_filter() when set_str is false
        tracing: Fix kmemleak in tracing_map_array_free()
        ftrace: Check for null ret_stack on profile function graph entry function
        ring-buffer: Have ring_buffer_alloc_read_page() return error on offline CPU
        tracing: Missing error code in tracer_alloc_buffers()
        tracing: Call clear_boot_tracer() at lateinit_sync
      415be6c2
    • Linus Torvalds's avatar
      Merge tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc · 1cffe595
      Linus Torvalds authored
      Pull ARM SoC fixes from Arnd Bergmann:
       "A small number of bugfixes, again nothing serious.
      
         - Alexander Dahl found multiple bugs in the Atmel memory interface
           driver
      
         - A randconfig build fix for at91 was incomplete, the second attempt
           fixes the remaining corner case
      
         - One fix for the TI Keystone queue handler
      
         - The Odroid XU4 HDMI port (added in 4.13) needs a small DT fix"
      
      * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
        ARM: dts: exynos: add needs-hpd for Odroid-XU3/4
        ARM: at91: don't select CONFIG_ARM_CPU_SUSPEND for old platforms
        soc: ti: knav: Add a NULL pointer check for kdev in knav_pool_create
        memory: atmel-ebi: Fix smc cycle xlate converter
        memory: atmel-ebi: Allow t_DF timings of zero ns
        memory: atmel-ebi: Fix smc timing return value evaluation
      1cffe595
    • Eric W. Biederman's avatar
      pty: Repair TIOCGPTPEER · 311fc65c
      Eric W. Biederman authored
      The implementation of TIOCGPTPEER has two issues.
      
      When /dev/ptmx (as opposed to /dev/pts/ptmx) is opened the wrong
      vfsmount is passed to dentry_open.  Which results in the kernel displaying
      the wrong pathname for the peer.
      
      The second is simply by caching the vfsmount and dentry of the peer it leaves
      them open, in a way they were not previously Which because of the inreased
      reference counts can cause unnecessary behaviour differences resulting in
      regressions.
      
      To fix these move the ioctl into tty_io.c at a generic level allowing
      the ioctl to have access to the struct file on which the ioctl is
      being called.  This allows the path of the slave to be derived when
      opening the slave through TIOCGPTPEER instead of requiring the path to
      the slave be cached.  Thus removing the need for caching the path.
      
      A new function devpts_ptmx_path is factored out of devpts_acquire and
      used to implement a function devpts_mntget.   The new function devpts_mntget
      takes a filp to perform the lookup on and fsi so that it can confirm
      that the superblock that is found by devpts_ptmx_path is the proper superblock.
      
      v2: Lots of fixes to make the code actually work
      v3: Suggestions by Linus
          - Removed the unnecessary initialization of filp in ptm_open_peer
          - Simplified devpts_ptmx_path as gotos are no longer required
      
      [ This is the fix for the issue that was reverted in commit
        143c97cc, but this time without breaking 'pbuilder' due to
        increased reference counts   - Linus ]
      
      Fixes: 54ebbfb1 ("tty: add TIOCGPTPEER ioctl")
      Reported-by: default avatarChristian Brauner <christian.brauner@canonical.com>
      Reported-and-tested-by: default avatarStefan Lippers-Hollmann <s.l-h@gmx.de>
      Signed-off-by: default avatar"Eric W. Biederman" <ebiederm@xmission.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      311fc65c
    • Rafael J. Wysocki's avatar
      Merge branches 'acpica-fix', 'acpi-ec-fix' and 'acpi-properties-fix' · d5d6c1dd
      Rafael J. Wysocki authored
      * acpica-fix:
        ACPICA: Fix acpi_evaluate_object_typed()
      
      * acpi-ec-fix:
        ACPI: EC: Fix regression related to wrong ECDT initialization order
      
      * acpi-properties-fix:
        ACPI: device property: Fix node lookup in acpi_graph_get_child_prop_value()
      d5d6c1dd
    • Majd Dibbiny's avatar
      IB/mlx5: Always return success for RoCE modify port · ec255879
      Majd Dibbiny authored
      CM layer calls ib_modify_port() regardless of the link layer.
      
      For the Ethernet ports, qkey violation and Port capabilities
      are meaningless. Therefore, always return success for ib_modify_port
      calls on the Ethernet ports.
      
      Cc: Selvin Xavier <selvin.xavier@broadcom.com>
      Signed-off-by: default avatarMajd Dibbiny <majd@mellanox.com>
      Reviewed-by: default avatarMoni Shoua <monis@mellanox.com>
      Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      ec255879
    • Majd Dibbiny's avatar
      IB/mlx5: Fix Raw Packet QP event handler assignment · 1d31e9c0
      Majd Dibbiny authored
      In case we have SQ and RQ for Raw Packet QP, the SQ's event handler
      wasn't assigned.
      
      Fixing this by assigning event handler for each WQ after creation.
      
      [ 1877.145243] Call Trace:
      [ 1877.148644] <IRQ>
      [ 1877.150580] [<ffffffffa07987c5>] ? mlx5_rsc_event+0x105/0x210 [mlx5_core]
      [ 1877.159581] [<ffffffffa0795bd7>] ? mlx5_cq_event+0x57/0xd0 [mlx5_core]
      [ 1877.167137] [<ffffffffa079208e>] mlx5_eq_int+0x53e/0x6c0 [mlx5_core]
      [ 1877.174526] [<ffffffff8101a679>] ? sched_clock+0x9/0x10
      [ 1877.180753] [<ffffffff810f717e>] handle_irq_event_percpu+0x3e/0x1e0
      [ 1877.188014] [<ffffffff810f735d>] handle_irq_event+0x3d/0x60
      [ 1877.194567] [<ffffffff810f9fe7>] handle_edge_irq+0x77/0x130
      [ 1877.201129] [<ffffffff81014c3f>] handle_irq+0xbf/0x150
      [ 1877.207244] [<ffffffff815ed78a>] ? atomic_notifier_call_chain+0x1a/0x20
      [ 1877.214829] [<ffffffff815f434f>] do_IRQ+0x4f/0xf0
      [ 1877.220498] [<ffffffff815e94ad>] common_interrupt+0x6d/0x6d
      [ 1877.227025] <EOI>
      [ 1877.228967] [<ffffffff814834e2>] ? cpuidle_enter_state+0x52/0xc0
      [ 1877.236990] [<ffffffff81483615>] cpuidle_idle_call+0xc5/0x200
      [ 1877.243676] [<ffffffff8101bc7e>] arch_cpu_idle+0xe/0x30
      [ 1877.249831] [<ffffffff810b4725>] cpu_startup_entry+0xf5/0x290
      [ 1877.256513] [<ffffffff815cfee1>] start_secondary+0x265/0x27b
      [ 1877.263111] Code: Bad RIP value.
      [ 1877.267296] RIP [< (null)>] (null)
      [ 1877.273264] RSP <ffff88046fd63df8>
      [ 1877.277531] CR2: 0000000000000000
      
      Fixes: 19098df2 ("IB/mlx5: Refactor mlx5_ib_qp to accommodate other QP types")
      Signed-off-by: default avatarMajd Dibbiny <majd@mellanox.com>
      Reviewed-by: default avatarYishai Hadas <yishaih@mellanox.com>
      Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      1d31e9c0
    • Noa Osherovich's avatar
      IB/core: Avoid accessing non-allocated memory when inferring port type · 498ca3c8
      Noa Osherovich authored
      Commit 44c58487 ("IB/core: Define 'ib' and 'roce' rdma_ah_attr types")
      introduced the concept of type in ah_attr:
       * During ib_register_device, each port is checked for its type which
         is stored in ib_device's port_immutable array.
       * During uverbs' modify_qp, the type is inferred using the port number
         in ib_uverbs_qp_dest struct (address vector) by accessing the
         relevant port_immutable array and the type is passed on to
         providers.
      
      IB spec (version 1.3) enforces a valid port value only in Reset to
      Init. During Init to RTR, the address vector must be valid but port
      number is not mentioned as a field in the address vector, so its
      value is not validated, which leads to accesses to a non-allocated
      memory when inferring the port type.
      
      Save the real port number in ib_qp during modify to Init (when the
      comp_mask indicates that the port number is valid) and use this value
      to infer the port type.
      
      Avoid copying the address vector fields if the matching bit is not set
      in the attr_mask. Address vector can't be modified before the port, so
      no valid flow is affected.
      
      Fixes: 44c58487 ('IB/core: Define 'ib' and 'roce' rdma_ah_attr types')
      Signed-off-by: default avatarNoa Osherovich <noaos@mellanox.com>
      Reviewed-by: default avatarYishai Hadas <yishaih@mellanox.com>
      Signed-off-by: default avatarLeon Romanovsky <leon@kernel.org>
      Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
      498ca3c8
    • Omar Sandoval's avatar
      Btrfs: fix blk_status_t/errno confusion · 58efbc9f
      Omar Sandoval authored
      This fixes several instances of blk_status_t and bare errno ints being
      mixed up, some of which are real bugs.
      
      In the normal case, 0 matches BLK_STS_OK, so we don't observe any
      effects of the missing conversion, but in case of errors or passes
      through the repair/retry paths, the errors get mixed up.
      
      The changes were identified using 'sparse', we don't have reports of the
      buggy behaviour.
      
      Fixes: 4e4cbee9 ("block: switch bios to blk_status_t")
      Signed-off-by: default avatarOmar Sandoval <osandov@fb.com>
      Reviewed-by: default avatarLiu Bo <bo.li.liu@oracle.com>
      Reviewed-by: default avatarDavid Sterba <dsterba@suse.com>
      Signed-off-by: default avatarDavid Sterba <dsterba@suse.com>
      58efbc9f
    • Cao jin's avatar
    • Steven Rostedt (VMware)'s avatar
      tracing: Fix freeing of filter in create_filter() when set_str is false · 8b0db1a5
      Steven Rostedt (VMware) authored
      Performing the following task with kmemleak enabled:
      
       # cd /sys/kernel/tracing/events/irq/irq_handler_entry/
       # echo 'enable_event:kmem:kmalloc:3 if irq >' > trigger
       # echo 'enable_event:kmem:kmalloc:3 if irq > 31' > trigger
       # echo scan > /sys/kernel/debug/kmemleak
       # cat /sys/kernel/debug/kmemleak
      unreferenced object 0xffff8800b9290308 (size 32):
        comm "bash", pid 1114, jiffies 4294848451 (age 141.139s)
        hex dump (first 32 bytes):
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
          00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
        backtrace:
          [<ffffffff81cef5aa>] kmemleak_alloc+0x4a/0xa0
          [<ffffffff81357938>] kmem_cache_alloc_trace+0x158/0x290
          [<ffffffff81261c09>] create_filter_start.constprop.28+0x99/0x940
          [<ffffffff812639c9>] create_filter+0xa9/0x160
          [<ffffffff81263bdc>] create_event_filter+0xc/0x10
          [<ffffffff812655e5>] set_trigger_filter+0xe5/0x210
          [<ffffffff812660c4>] event_enable_trigger_func+0x324/0x490
          [<ffffffff812652e2>] event_trigger_write+0x1a2/0x260
          [<ffffffff8138cf87>] __vfs_write+0xd7/0x380
          [<ffffffff8138f421>] vfs_write+0x101/0x260
          [<ffffffff8139187b>] SyS_write+0xab/0x130
          [<ffffffff81cfd501>] entry_SYSCALL_64_fastpath+0x1f/0xbe
          [<ffffffffffffffff>] 0xffffffffffffffff
      
      The function create_filter() is passed a 'filterp' pointer that gets
      allocated, and if "set_str" is true, it is up to the caller to free it, even
      on error. The problem is that the pointer is not freed by create_filter()
      when set_str is false. This is a bug, and it is not up to the caller to free
      the filter on error if it doesn't care about the string.
      
      Link: http://lkml.kernel.org/r/1502705898-27571-2-git-send-email-chuhu@redhat.com
      
      Cc: stable@vger.kernel.org
      Fixes: 38b78eb8 ("tracing: Factorize filter creation")
      Reported-by: default avatarChunyu Hu <chuhu@redhat.com>
      Tested-by: default avatarChunyu Hu <chuhu@redhat.com>
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      8b0db1a5
    • Chunyu Hu's avatar
      tracing: Fix kmemleak in tracing_map_array_free() · 475bb3c6
      Chunyu Hu authored
      kmemleak reported the below leak when I was doing clear of the hist
      trigger. With this patch, the kmeamleak is gone.
      
      unreferenced object 0xffff94322b63d760 (size 32):
        comm "bash", pid 1522, jiffies 4403687962 (age 2442.311s)
        hex dump (first 32 bytes):
          00 01 00 00 04 00 00 00 08 00 00 00 ff 00 00 00  ................
          10 00 00 00 00 00 00 00 80 a8 7a f2 31 94 ff ff  ..........z.1...
        backtrace:
          [<ffffffff9e96c27a>] kmemleak_alloc+0x4a/0xa0
          [<ffffffff9e424cba>] kmem_cache_alloc_trace+0xca/0x1d0
          [<ffffffff9e377736>] tracing_map_array_alloc+0x26/0x140
          [<ffffffff9e261be0>] kretprobe_trampoline+0x0/0x50
          [<ffffffff9e38b935>] create_hist_data+0x535/0x750
          [<ffffffff9e38bd47>] event_hist_trigger_func+0x1f7/0x420
          [<ffffffff9e38893d>] event_trigger_write+0xfd/0x1a0
          [<ffffffff9e44dfc7>] __vfs_write+0x37/0x170
          [<ffffffff9e44f552>] vfs_write+0xb2/0x1b0
          [<ffffffff9e450b85>] SyS_write+0x55/0xc0
          [<ffffffff9e203857>] do_syscall_64+0x67/0x150
          [<ffffffff9e977ce7>] return_from_SYSCALL_64+0x0/0x6a
          [<ffffffffffffffff>] 0xffffffffffffffff
      unreferenced object 0xffff9431f27aa880 (size 128):
        comm "bash", pid 1522, jiffies 4403687962 (age 2442.311s)
        hex dump (first 32 bytes):
          00 00 8c 2a 32 94 ff ff 00 f0 8b 2a 32 94 ff ff  ...*2......*2...
          00 e0 8b 2a 32 94 ff ff 00 d0 8b 2a 32 94 ff ff  ...*2......*2...
        backtrace:
          [<ffffffff9e96c27a>] kmemleak_alloc+0x4a/0xa0
          [<ffffffff9e425348>] __kmalloc+0xe8/0x220
          [<ffffffff9e3777c1>] tracing_map_array_alloc+0xb1/0x140
          [<ffffffff9e261be0>] kretprobe_trampoline+0x0/0x50
          [<ffffffff9e38b935>] create_hist_data+0x535/0x750
          [<ffffffff9e38bd47>] event_hist_trigger_func+0x1f7/0x420
          [<ffffffff9e38893d>] event_trigger_write+0xfd/0x1a0
          [<ffffffff9e44dfc7>] __vfs_write+0x37/0x170
          [<ffffffff9e44f552>] vfs_write+0xb2/0x1b0
          [<ffffffff9e450b85>] SyS_write+0x55/0xc0
          [<ffffffff9e203857>] do_syscall_64+0x67/0x150
          [<ffffffff9e977ce7>] return_from_SYSCALL_64+0x0/0x6a
          [<ffffffffffffffff>] 0xffffffffffffffff
      
      Link: http://lkml.kernel.org/r/1502705898-27571-1-git-send-email-chuhu@redhat.com
      
      Cc: stable@vger.kernel.org
      Fixes: 08d43a5f ("tracing: Add lock-free tracing_map")
      Signed-off-by: default avatarChunyu Hu <chuhu@redhat.com>
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      475bb3c6
    • Steven Rostedt (VMware)'s avatar
      ftrace: Check for null ret_stack on profile function graph entry function · a8f0f9e4
      Steven Rostedt (VMware) authored
      There's a small race when function graph shutsdown and the calling of the
      registered function graph entry callback. The callback must not reference
      the task's ret_stack without first checking that it is not NULL. Note, when
      a ret_stack is allocated for a task, it stays allocated until the task exits.
      The problem here, is that function_graph is shutdown, and a new task was
      created, which doesn't have its ret_stack allocated. But since some of the
      functions are still being traced, the callbacks can still be called.
      
      The normal function_graph code handles this, but starting with commit
      8861dd30 ("ftrace: Access ret_stack->subtime only in the function
      profiler") the profiler code references the ret_stack on function entry, but
      doesn't check if it is NULL first.
      
      Link: https://bugzilla.kernel.org/show_bug.cgi?id=196611
      
      Cc: stable@vger.kernel.org
      Fixes: 8861dd30 ("ftrace: Access ret_stack->subtime only in the function profiler")
      Reported-by: lilydjwg@gmail.com
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      a8f0f9e4
    • Ingo Molnar's avatar
      Merge tag 'perf-core-for-mingo-4.14-20170823' of... · c7f4f994
      Ingo Molnar authored
      Merge tag 'perf-core-for-mingo-4.14-20170823' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/core
      
      Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo:
      
      - Expression parser enhancements for metrics (Andi Kleen)
      
      - Fix buffer overflow while freeing events in 'perf stat' (Andi Kleen)
      
      - Fix static linking with elfutils's libdf and with libunwind
        in Debian/Ubuntu (Konstantin Khlebnikov)
      
      - Tighten detection of BPF events, avoiding matching some other PMU
        events such as 'cpu/uops_executed.core,cmask=1/' as a .c source
        file that ended up being considered a BPF event (Andi Kleen)
      
      - Add Skylake server uncore JSON vendor events (Andi Kleen)
      
      - Add support for printing new mem_info encodings, including
        'perf test' checks (Andi Kleen)
      
      - Really install manpages via 'make install-man' (Konstantin Khlebnikov)
      
      - Fix documentation for perf_event_paranoid and perf_event_mlock_kb
        sysctls (Konstantin Khlebnikov)
      Signed-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      c7f4f994
    • Ingo Molnar's avatar
      93da8b22
    • Linus Torvalds's avatar
      Revert "pty: fix the cached path of the pty slave file descriptor in the master" · 143c97cc
      Linus Torvalds authored
      This reverts commit c8c03f18.
      
      It turns out that while fixing the ptmx file descriptor to have the
      correct 'struct path' to the associated slave pty is a really good
      thing, it breaks some user space tools for a very annoying reason.
      
      The problem is that /dev/ptmx and its associated slave pty (/dev/pts/X)
      are on different mounts.  That was what caused us to have the wrong path
      in the first place (we would mix up the vfsmount of the 'ptmx' node,
      with the dentry of the pty slave node), but it also means that now while
      we use the right vfsmount, having the pty master open also keeps the pts
      mount busy.
      
      And it turn sout that that makes 'pbuilder' very unhappy, as noted by
      Stefan Lippers-Hollmann:
      
       "This patch introduces a regression for me when using pbuilder
        0.228.7[2] (a helper to build Debian packages in a chroot and to
        create and update its chroots) when trying to umount /dev/ptmx (inside
        the chroot) on Debian/ unstable (full log and pbuilder configuration
        file[3] attached).
      
        [...]
        Setting up build-essential (12.3) ...
        Processing triggers for libc-bin (2.24-15) ...
        I: unmounting dev/ptmx filesystem
        W: Could not unmount dev/ptmx: umount: /var/cache/pbuilder/build/1340/dev/ptmx: target is busy
                (In some cases useful info about processes that
                 use the device is found by lsof(8) or fuser(1).)"
      
      apparently pbuilder tries to unmount the /dev/pts filesystem while still
      holding at least one master node open, which is arguably not very nice,
      but we don't break user space even when fixing other bugs.
      
      So this commit has to be reverted.
      
      I'll try to figure out a way to avoid caching the path to the slave pty
      in the master pty.  The only thing that actually wants that slave pty
      path is the "TIOCGPTPEER" ioctl, and I think we could just recreate the
      path at that time.
      Reported-by: default avatarStefan Lippers-Hollmann <s.l-h@gmx.de>
      Cc: Eric W Biederman <ebiederm@xmission.com>
      Cc: Christian Brauner <christian.brauner@canonical.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      143c97cc
  3. 23 Aug, 2017 6 commits
    • Hans Verkuil's avatar
      ARM: dts: exynos: add needs-hpd for Odroid-XU3/4 · 93a4c835
      Hans Verkuil authored
      CEC support was added for Exynos5 in 4.13, but for the Odroids we need to set
      'needs-hpd' as well since CEC is disabled when there is no HDMI hotplug signal,
      just as for the exynos4 Odroid-U3.
      
      This is due to the level-shifter that is disabled when there is no HPD, thus
      blocking the CEC signal as well. Same close-but-no-cigar board design as the
      Odroid-U3.
      
      Tested with my Odroid XU4.
      Signed-off-by: default avatarHans Verkuil <hans.verkuil@cisco.com>
      Signed-off-by: default avatarKrzysztof Kozlowski <krzk@kernel.org>
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      93a4c835
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · 2acf097f
      Linus Torvalds authored
      Pull arm64 fixes from Will Deacon:
       "Late arm64 fixes.
      
        They fix very early boot failures with KASLR where the early mapping
        of the kernel is incorrect, so the failure mode looks like a hang with
        no output. There's also a signal-handling fix when a uaccess routine
        faults with a fatal signal pending, which could be used to create
        unkillable user tasks using userfaultfd and finally a state leak fix
        for the floating pointer registers across a call to exec().
      
        We're still seeing some random issues crop up (inode memory corruption
        and spinlock recursion) but we've not managed to reproduce things
        reliably enough to debug or bisect them yet.
      
        Summary:
      
         - Fix very early boot failures with KASLR enabled
      
         - Fix fatal signal handling on userspace access from kernel
      
         - Fix leakage of floating point register state across exec()"
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: kaslr: Adjust the offset to avoid Image across alignment boundary
        arm64: kaslr: ignore modulo offset when validating virtual displacement
        arm64: mm: abort uaccess retries upon fatal signal
        arm64: fpsimd: Prevent registers leaking across exec
      2acf097f
    • Linus Torvalds's avatar
      Merge tag 'gpio-v4.13-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio · a67ca1e9
      Linus Torvalds authored
      Pull GPIO fixes from Linus Walleij:
       "Here are the (hopefully) last GPIO fixes for v4.13:
      
         - an important core fix to reject invalid GPIOs *before* trying to
           obtain a GPIO descriptor for it.
      
         - a driver fix for the mvebu driver IRQ handling"
      
      * tag 'gpio-v4.13-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
        gpio: mvebu: Fix cause computation in irq handler
        gpio: reject invalid gpio before getting gpio_desc
      a67ca1e9
    • Linus Torvalds's avatar
      Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi · 55652400
      Linus Torvalds authored
      Pull SCSI fixes from James Bottomley:
       "Six minor and error leg fixes, plus one major change: the reversion of
        scsi-mq as the default.
      
        We're doing the latter temporarily (with a backport to stable) to give
        us time to fix all the issues that turned up with this default before
        trying again"
      
      * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
        scsi: cxgb4i: call neigh_event_send() to update MAC address
        Revert "scsi: default to scsi-mq"
        scsi: sd_zbc: Write unlock zone from sd_uninit_cmnd()
        scsi: aacraid: Fix out of bounds in aac_get_name_resp
        scsi: csiostor: fail probe if fw does not support FCoE
        scsi: megaraid_sas: fix error handle in megasas_probe_one
      55652400
    • Arnd Bergmann's avatar
      ARM: at91: don't select CONFIG_ARM_CPU_SUSPEND for old platforms · dbeb0c8e
      Arnd Bergmann authored
      My previous patch fixed a link error for all at91 platforms when
      CONFIG_ARM_CPU_SUSPEND was not set, however this caused another
      problem on a configuration that enabled CONFIG_ARCH_AT91 but none
      of the individual SoCs, and that also enabled CPU_ARM720 as
      the only CPU:
      
      warning: (ARCH_AT91 && SOC_IMX23 && SOC_IMX28 && ARCH_PXA && MACH_MVEBU_V7 && SOC_IMX6 && ARCH_OMAP3 && ARCH_OMAP4 && SOC_OMAP5 && SOC_AM33XX && SOC_DRA7XX && ARCH_EXYNOS3 && ARCH_EXYNOS4 && EXYNOS5420_MCPM && EXYNOS_CPU_SUSPEND && ARCH_VEXPRESS_TC2_PM && ARM_BIG_LITTLE_CPUIDLE && ARM_HIGHBANK_CPUIDLE && QCOM_PM) selects ARM_CPU_SUSPEND which has unmet direct dependencies (ARCH_SUSPEND_POSSIBLE)
      arch/arm/kernel/sleep.o: In function `cpu_resume':
      (.text+0xf0): undefined reference to `cpu_arm720_suspend_size'
      arch/arm/kernel/suspend.o: In function `__cpu_suspend_save':
      suspend.c:(.text+0x134): undefined reference to `cpu_arm720_do_suspend'
      
      This improves the hack some more by only selecting ARM_CPU_SUSPEND
      for the part that requires it, and changing pm.c to drop the
      contents of unused init functions so we no longer refer to
      cpu_resume on at91 platforms that don't need it.
      
      Fixes: cc7a938f ("ARM: at91: select CONFIG_ARM_CPU_SUSPEND")
      Acked-by: default avatarAlexandre Belloni <alexandre.belloni@free-electrons.com>
      Signed-off-by: default avatarArnd Bergmann <arnd@arndb.de>
      dbeb0c8e
    • Linus Torvalds's avatar
      Merge tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4 · 98b9f8a4
      Linus Torvalds authored
      Pull ext4 fixes from Ted Ts'o:
       "Fix a clang build regression and an potential xattr corruption bug"
      
      * tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
        ext4: add missing xattr hash update
        ext4: fix clang build regression
      98b9f8a4
  4. 22 Aug, 2017 11 commits