Commit Graph

15972 Commits

Author SHA1 Message Date
Greg Kroah-Hartman
0eda5f918b Merge 5.10.37 into android13-5.10
Changes in 5.10.37
	Bluetooth: verify AMP hci_chan before amp_destroy
	bluetooth: eliminate the potential race condition when removing the HCI controller
	net/nfc: fix use-after-free llcp_sock_bind/connect
	io_uring: truncate lengths larger than MAX_RW_COUNT on provide buffers
	Revert "USB: cdc-acm: fix rounding error in TIOCSSERIAL"
	usb: roles: Call try_module_get() from usb_role_switch_find_by_fwnode()
	tty: moxa: fix TIOCSSERIAL jiffies conversions
	tty: amiserial: fix TIOCSSERIAL permission check
	USB: serial: usb_wwan: fix TIOCSSERIAL jiffies conversions
	staging: greybus: uart: fix TIOCSSERIAL jiffies conversions
	USB: serial: ti_usb_3410_5052: fix TIOCSSERIAL permission check
	staging: fwserial: fix TIOCSSERIAL jiffies conversions
	tty: moxa: fix TIOCSSERIAL permission check
	staging: fwserial: fix TIOCSSERIAL permission check
	drm: bridge: fix LONTIUM use of mipi_dsi_() functions
	usb: typec: tcpm: Address incorrect values of tcpm psy for fixed supply
	usb: typec: tcpm: Address incorrect values of tcpm psy for pps supply
	usb: typec: tcpm: update power supply once partner accepts
	usb: xhci-mtk: remove or operator for setting schedule parameters
	usb: xhci-mtk: improve bandwidth scheduling with TT
	ASoC: samsung: tm2_wm5110: check of of_parse return value
	ASoC: Intel: kbl_da7219_max98927: Fix kabylake_ssp_fixup function
	ASoC: tlv320aic32x4: Register clocks before registering component
	ASoC: tlv320aic32x4: Increase maximum register in regmap
	MIPS: pci-mt7620: fix PLL lock check
	MIPS: pci-rt2880: fix slot 0 configuration
	FDDI: defxx: Bail out gracefully with unassigned PCI resource for CSR
	PCI: Allow VPD access for QLogic ISP2722
	KVM: x86: Defer the MMU unload to the normal path on an global INVPCID
	PCI: xgene: Fix cfg resource mapping
	PCI: keystone: Let AM65 use the pci_ops defined in pcie-designware-host.c
	PM / devfreq: Unlock mutex and free devfreq struct in error path
	soc/tegra: regulators: Fix locking up when voltage-spread is out of range
	iio: inv_mpu6050: Fully validate gyro and accel scale writes
	iio:accel:adis16201: Fix wrong axis assignment that prevents loading
	iio:adc:ad7476: Fix remove handling
	sc16is7xx: Defer probe if device read fails
	phy: cadence: Sierra: Fix PHY power_on sequence
	misc: lis3lv02d: Fix false-positive WARN on various HP models
	phy: ti: j721e-wiz: Invoke wiz_init() before of_platform_device_create()
	misc: vmw_vmci: explicitly initialize vmci_notify_bm_set_msg struct
	misc: vmw_vmci: explicitly initialize vmci_datagram payload
	selinux: add proper NULL termination to the secclass_map permissions
	x86, sched: Treat Intel SNC topology as default, COD as exception
	async_xor: increase src_offs when dropping destination page
	md/bitmap: wait for external bitmap writes to complete during tear down
	md-cluster: fix use-after-free issue when removing rdev
	md: split mddev_find
	md: factor out a mddev_find_locked helper from mddev_find
	md: md_open returns -EBUSY when entering racing area
	md: Fix missing unused status line of /proc/mdstat
	mt76: mt7615: use ieee80211_free_txskb() in mt7615_tx_token_put()
	ipw2x00: potential buffer overflow in libipw_wx_set_encodeext()
	cfg80211: scan: drop entry from hidden_list on overflow
	rtw88: Fix array overrun in rtw_get_tx_power_params()
	mt76: fix potential DMA mapping leak
	FDDI: defxx: Make MMIO the configuration default except for EISA
	drm/i915/gvt: Fix virtual display setup for BXT/APL
	drm/i915/gvt: Fix vfio_edid issue for BXT/APL
	drm/qxl: use ttm bo priorities
	drm/panfrost: Clear MMU irqs before handling the fault
	drm/panfrost: Don't try to map pages that are already mapped
	drm/radeon: fix copy of uninitialized variable back to userspace
	drm/dp_mst: Revise broadcast msg lct & lcr
	drm/dp_mst: Set CLEAR_PAYLOAD_ID_TABLE as broadcast
	drm: bridge/panel: Cleanup connector on bridge detach
	drm/amd/display: Reject non-zero src_y and src_x for video planes
	drm/amdgpu: fix concurrent VM flushes on Vega/Navi v2
	ALSA: hda/realtek: Re-order ALC882 Acer quirk table entries
	ALSA: hda/realtek: Re-order ALC882 Sony quirk table entries
	ALSA: hda/realtek: Re-order ALC882 Clevo quirk table entries
	ALSA: hda/realtek: Re-order ALC269 HP quirk table entries
	ALSA: hda/realtek: Re-order ALC269 Acer quirk table entries
	ALSA: hda/realtek: Re-order ALC269 Dell quirk table entries
	ALSA: hda/realtek: Re-order ALC269 ASUS quirk table entries
	ALSA: hda/realtek: Re-order ALC269 Sony quirk table entries
	ALSA: hda/realtek: Re-order ALC269 Lenovo quirk table entries
	ALSA: hda/realtek: Re-order remaining ALC269 quirk table entries
	ALSA: hda/realtek: Re-order ALC662 quirk table entries
	ALSA: hda/realtek: Remove redundant entry for ALC861 Haier/Uniwill devices
	ALSA: hda/realtek: ALC285 Thinkpad jack pin quirk is unreachable
	ALSA: hda/realtek: Fix speaker amp on HP Envy AiO 32
	KVM: s390: VSIE: correctly handle MVPG when in VSIE
	KVM: s390: split kvm_s390_logical_to_effective
	KVM: s390: fix guarded storage control register handling
	s390: fix detection of vector enhancements facility 1 vs. vector packed decimal facility
	KVM: s390: VSIE: fix MVPG handling for prefixing and MSO
	KVM: s390: split kvm_s390_real_to_abs
	KVM: s390: extend kvm_s390_shadow_fault to return entry pointer
	KVM: x86/mmu: Alloc page for PDPTEs when shadowing 32-bit NPT with 64-bit
	KVM: x86: Remove emulator's broken checks on CR0/CR3/CR4 loads
	KVM: nSVM: Set the shadow root level to the TDP level for nested NPT
	KVM: SVM: Don't strip the C-bit from CR2 on #PF interception
	KVM: SVM: Do not allow SEV/SEV-ES initialization after vCPUs are created
	KVM: SVM: Inject #GP on guest MSR_TSC_AUX accesses if RDTSCP unsupported
	KVM: nVMX: Defer the MMU reload to the normal path on an EPTP switch
	KVM: nVMX: Truncate bits 63:32 of VMCS field on nested check in !64-bit
	KVM: nVMX: Truncate base/index GPR value on address calc in !64-bit
	KVM: arm/arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST read
	KVM: Destroy I/O bus devices on unregister failure _after_ sync'ing SRCU
	KVM: Stop looking for coalesced MMIO zones if the bus is destroyed
	KVM: arm64: Fully zero the vcpu state on reset
	KVM: arm64: Fix KVM_VGIC_V3_ADDR_TYPE_REDIST_REGION read
	Revert "drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit"
	Revert "i3c master: fix missing destroy_workqueue() on error in i3c_master_register"
	ovl: fix missing revert_creds() on error path
	Revert "drm/qxl: do not run release if qxl failed to init"
	usb: gadget: pch_udc: Revert d3cb25a121 completely
	Revert "tools/power turbostat: adjust for temperature offset"
	firmware: xilinx: Fix dereferencing freed memory
	firmware: xilinx: Add a blank line after function declaration
	firmware: xilinx: Remove zynqmp_pm_get_eemi_ops() in IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE)
	fpga: fpga-mgr: xilinx-spi: fix error messages on -EPROBE_DEFER
	crypto: sun8i-ss - fix result memory leak on error path
	memory: gpmc: fix out of bounds read and dereference on gpmc_cs[]
	ARM: dts: exynos: correct fuel gauge interrupt trigger level on GT-I9100
	ARM: dts: exynos: correct fuel gauge interrupt trigger level on Midas family
	ARM: dts: exynos: correct MUIC interrupt trigger level on Midas family
	ARM: dts: exynos: correct PMIC interrupt trigger level on Midas family
	ARM: dts: exynos: correct PMIC interrupt trigger level on Odroid X/U3 family
	ARM: dts: exynos: correct PMIC interrupt trigger level on SMDK5250
	ARM: dts: exynos: correct PMIC interrupt trigger level on Snow
	ARM: dts: s5pv210: correct fuel gauge interrupt trigger level on Fascinate family
	ARM: dts: renesas: Add mmc aliases into R-Car Gen2 board dts files
	arm64: dts: renesas: Add mmc aliases into board dts files
	x86/platform/uv: Set section block size for hubless architectures
	serial: stm32: fix code cleaning warnings and checks
	serial: stm32: add "_usart" prefix in functions name
	serial: stm32: fix probe and remove order for dma
	serial: stm32: Use of_device_get_match_data()
	serial: stm32: fix startup by enabling usart for reception
	serial: stm32: fix incorrect characters on console
	serial: stm32: fix TX and RX FIFO thresholds
	serial: stm32: fix a deadlock condition with wakeup event
	serial: stm32: fix wake-up flag handling
	serial: stm32: fix a deadlock in set_termios
	serial: stm32: fix tx dma completion, release channel
	serial: stm32: call stm32_transmit_chars locked
	serial: stm32: fix FIFO flush in startup and set_termios
	serial: stm32: add FIFO flush when port is closed
	serial: stm32: fix tx_empty condition
	usb: typec: tcpci: Check ROLE_CONTROL while interpreting CC_STATUS
	usb: typec: tps6598x: Fix return value check in tps6598x_probe()
	usb: typec: stusb160x: fix return value check in stusb160x_probe()
	regmap: set debugfs_name to NULL after it is freed
	spi: rockchip: avoid objtool warning
	mtd: rawnand: fsmc: Fix error code in fsmc_nand_probe()
	mtd: rawnand: brcmnand: fix OOB R/W with Hamming ECC
	mtd: Handle possible -EPROBE_DEFER from parse_mtd_partitions()
	mtd: rawnand: qcom: Return actual error code instead of -ENODEV
	mtd: don't lock when recursively deleting partitions
	mtd: maps: fix error return code of physmap_flash_remove()
	ARM: dts: stm32: fix usart 2 & 3 pinconf to wake up with flow control
	arm64: dts: qcom: sm8250: Fix level triggered PMU interrupt polarity
	arm64: dts: qcom: sm8250: Fix timer interrupt to specify EL2 physical timer
	arm64: dts: qcom: sdm845: fix number of pins in 'gpio-ranges'
	arm64: dts: qcom: sm8150: fix number of pins in 'gpio-ranges'
	arm64: dts: qcom: sm8250: fix number of pins in 'gpio-ranges'
	arm64: dts: qcom: db845c: fix correct powerdown pin for WSA881x
	crypto: sun8i-ss - Fix memory leak of object d when dma_iv fails to map
	spi: stm32: drop devres version of spi_register_master
	regulator: bd9576: Fix return from bd957x_probe()
	arm64: dts: renesas: r8a77980: Fix vin4-7 endpoint binding
	spi: stm32: Fix use-after-free on unbind
	x86/microcode: Check for offline CPUs before requesting new microcode
	devtmpfs: fix placement of complete() call
	usb: gadget: pch_udc: Replace cpu_to_le32() by lower_32_bits()
	usb: gadget: pch_udc: Check if driver is present before calling ->setup()
	usb: gadget: pch_udc: Check for DMA mapping error
	usb: gadget: pch_udc: Initialize device pointer before use
	usb: gadget: pch_udc: Provide a GPIO line used on Intel Minnowboard (v1)
	crypto: ccp - fix command queuing to TEE ring buffer
	crypto: qat - don't release uninitialized resources
	crypto: qat - ADF_STATUS_PF_RUNNING should be set after adf_dev_init
	fotg210-udc: Fix DMA on EP0 for length > max packet size
	fotg210-udc: Fix EP0 IN requests bigger than two packets
	fotg210-udc: Remove a dubious condition leading to fotg210_done
	fotg210-udc: Mask GRP2 interrupts we don't handle
	fotg210-udc: Don't DMA more than the buffer can take
	fotg210-udc: Complete OUT requests on short packets
	usb: gadget: s3c: Fix incorrect resources releasing
	usb: gadget: s3c: Fix the error handling path in 's3c2410_udc_probe()'
	dt-bindings: serial: stm32: Use 'type: object' instead of false for 'additionalProperties'
	mtd: require write permissions for locking and badblock ioctls
	arm64: dts: renesas: r8a779a0: Fix PMU interrupt
	bus: qcom: Put child node before return
	soundwire: bus: Fix device found flag correctly
	phy: ti: j721e-wiz: Delete "clk_div_sel" clk provider during cleanup
	phy: marvell: ARMADA375_USBCLUSTER_PHY should not default to y, unconditionally
	arm64: dts: mediatek: fix reset GPIO level on pumpkin
	NFSD: Fix sparse warning in nfs4proc.c
	NFSv4.2: fix copy stateid copying for the async copy
	crypto: poly1305 - fix poly1305_core_setkey() declaration
	crypto: qat - fix error path in adf_isr_resource_alloc()
	usb: gadget: aspeed: fix dma map failure
	USB: gadget: udc: fix wrong pointer passed to IS_ERR() and PTR_ERR()
	drivers: nvmem: Fix voltage settings for QTI qfprom-efuse
	driver core: platform: Declare early_platform_cleanup() prototype
	memory: pl353: fix mask of ECC page_size config register
	soundwire: stream: fix memory leak in stream config error path
	m68k: mvme147,mvme16x: Don't wipe PCC timer config bits
	firmware: qcom_scm: Make __qcom_scm_is_call_available() return bool
	firmware: qcom_scm: Reduce locking section for __get_convention()
	firmware: qcom_scm: Workaround lack of "is available" call on SC7180
	iio: adc: Kconfig: make AD9467 depend on ADI_AXI_ADC symbol
	mtd: rawnand: gpmi: Fix a double free in gpmi_nand_init
	irqchip/gic-v3: Fix OF_BAD_ADDR error handling
	staging: comedi: tests: ni_routes_test: Fix compilation error
	staging: rtl8192u: Fix potential infinite loop
	staging: fwserial: fix TIOCSSERIAL implementation
	staging: fwserial: fix TIOCGSERIAL implementation
	staging: greybus: uart: fix unprivileged TIOCCSERIAL
	soc: qcom: pdr: Fix error return code in pdr_register_listener
	PM / devfreq: Use more accurate returned new_freq as resume_freq
	clocksource/drivers/timer-ti-dm: Fix posted mode status check order
	clocksource/drivers/timer-ti-dm: Add missing set_state_oneshot_stopped
	clocksource/drivers/ingenic_ost: Fix return value check in ingenic_ost_probe()
	spi: Fix use-after-free with devm_spi_alloc_*
	spi: fsl: add missing iounmap() on error in of_fsl_spi_probe()
	soc: qcom: mdt_loader: Validate that p_filesz < p_memsz
	soc: qcom: mdt_loader: Detect truncated read of segments
	PM: runtime: Replace inline function pm_runtime_callbacks_present()
	cpuidle: Fix ARM_QCOM_SPM_CPUIDLE configuration
	ACPI: CPPC: Replace cppc_attr with kobj_attribute
	crypto: allwinner - add missing CRYPTO_ prefix
	crypto: sun8i-ss - Fix memory leak of pad
	crypto: sa2ul - Fix memory leak of rxd
	crypto: qat - Fix a double free in adf_create_ring
	cpufreq: armada-37xx: Fix setting TBG parent for load levels
	clk: mvebu: armada-37xx-periph: remove .set_parent method for CPU PM clock
	cpufreq: armada-37xx: Fix the AVS value for load L1
	clk: mvebu: armada-37xx-periph: Fix switching CPU freq from 250 Mhz to 1 GHz
	clk: mvebu: armada-37xx-periph: Fix workaround for switching from L1 to L0
	cpufreq: armada-37xx: Fix driver cleanup when registration failed
	cpufreq: armada-37xx: Fix determining base CPU frequency
	spi: spi-zynqmp-gqspi: use wait_for_completion_timeout to make zynqmp_qspi_exec_op not interruptible
	spi: spi-zynqmp-gqspi: add mutex locking for exec_op
	spi: spi-zynqmp-gqspi: transmit dummy circles by using the controller's internal functionality
	spi: spi-zynqmp-gqspi: fix incorrect operating mode in zynqmp_qspi_read_op
	spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware()
	usb: gadget: r8a66597: Add missing null check on return from platform_get_resource
	USB: cdc-acm: fix unprivileged TIOCCSERIAL
	USB: cdc-acm: fix TIOCGSERIAL implementation
	tty: actually undefine superseded ASYNC flags
	tty: fix return value for unsupported ioctls
	tty: Remove dead termiox code
	tty: fix return value for unsupported termiox ioctls
	serial: core: return early on unsupported ioctls
	firmware: qcom-scm: Fix QCOM_SCM configuration
	node: fix device cleanups in error handling code
	crypto: chelsio - Read rxchannel-id from firmware
	usbip: vudc: fix missing unlock on error in usbip_sockfd_store()
	m68k: Add missing mmap_read_lock() to sys_cacheflush()
	spi: spi-zynqmp-gqspi: Fix missing unlock on error in zynqmp_qspi_exec_op()
	memory: renesas-rpc-if: fix possible NULL pointer dereference of resource
	memory: samsung: exynos5422-dmc: handle clk_set_parent() failure
	security: keys: trusted: fix TPM2 authorizations
	platform/x86: pmc_atom: Match all Beckhoff Automation baytrail boards with critclk_systems DMI table
	ARM: dts: aspeed: Rainier: Fix humidity sensor bus address
	Drivers: hv: vmbus: Use after free in __vmbus_open()
	spi: spi-zynqmp-gqspi: fix clk_enable/disable imbalance issue
	spi: spi-zynqmp-gqspi: fix hang issue when suspend/resume
	spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_op
	spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single fails
	x86/platform/uv: Fix !KEXEC build failure
	hwmon: (pmbus/pxe1610) don't bail out when not all pages are active
	Drivers: hv: vmbus: Increase wait time for VMbus unload
	PM: hibernate: x86: Use crc32 instead of md5 for hibernation e820 integrity check
	usb: dwc2: Fix host mode hibernation exit with remote wakeup flow.
	usb: dwc2: Fix hibernation between host and device modes.
	ttyprintk: Add TTY hangup callback.
	serial: omap: don't disable rs485 if rts gpio is missing
	serial: omap: fix rs485 half-duplex filtering
	xen-blkback: fix compatibility bug with single page rings
	soc: aspeed: fix a ternary sign expansion bug
	drm/tilcdc: send vblank event when disabling crtc
	drm/stm: Fix bus_flags handling
	drm/amd/display: Fix off by one in hdmi_14_process_transaction()
	drm/mcde/panel: Inverse misunderstood flag
	sched/fair: Fix shift-out-of-bounds in load_balance()
	afs: Fix updating of i_mode due to 3rd party change
	rcu: Remove spurious instrumentation_end() in rcu_nmi_enter()
	media: vivid: fix assignment of dev->fbuf_out_flags
	media: saa7134: use sg_dma_len when building pgtable
	media: saa7146: use sg_dma_len when building pgtable
	media: omap4iss: return error code when omap4iss_get() failed
	media: rkisp1: rsz: crash fix when setting src format
	media: aspeed: fix clock handling logic
	drm/probe-helper: Check epoch counter in output_poll_execute()
	media: venus: core: Fix some resource leaks in the error path of 'venus_probe()'
	media: platform: sunxi: sun6i-csi: fix error return code of sun6i_video_start_streaming()
	media: m88ds3103: fix return value check in m88ds3103_probe()
	media: docs: Fix data organization of MEDIA_BUS_FMT_RGB101010_1X30
	media: [next] staging: media: atomisp: fix memory leak of object flash
	media: atomisp: Fixed error handling path
	media: m88rs6000t: avoid potential out-of-bounds reads on arrays
	media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()
	drm/amdkfd: fix build error with AMD_IOMMU_V2=m
	of: overlay: fix for_each_child.cocci warnings
	x86/kprobes: Fix to check non boostable prefixes correctly
	selftests: fix prepending $(OUTPUT) to $(TEST_PROGS)
	pata_arasan_cf: fix IRQ check
	pata_ipx4xx_cf: fix IRQ check
	sata_mv: add IRQ checks
	ata: libahci_platform: fix IRQ check
	seccomp: Fix CONFIG tests for Seccomp_filters
	nvme-tcp: block BH in sk state_change sk callback
	nvmet-tcp: fix incorrect locking in state_change sk callback
	clk: imx: Fix reparenting of UARTs not associated with stdout
	power: supply: bq25980: Move props from battery node
	nvme: retrigger ANA log update if group descriptor isn't found
	media: i2c: imx219: Move out locking/unlocking of vflip and hflip controls from imx219_set_stream
	media: i2c: imx219: Balance runtime PM use-count
	media: v4l2-ctrls.c: fix race condition in hdl->requests list
	vfio/fsl-mc: Re-order vfio_fsl_mc_probe()
	vfio/pci: Move VGA and VF initialization to functions
	vfio/pci: Re-order vfio_pci_probe()
	vfio/mdev: Do not allow a mdev_type to have a NULL parent pointer
	clk: zynqmp: move zynqmp_pll_set_mode out of round_rate callback
	clk: zynqmp: pll: add set_pll_mode to check condition in zynqmp_pll_enable
	drm: xlnx: zynqmp: fix a memset in zynqmp_dp_train()
	clk: qcom: a53-pll: Add missing MODULE_DEVICE_TABLE
	clk: qcom: apss-ipq-pll: Add missing MODULE_DEVICE_TABLE
	drm/amd/display: use GFP_ATOMIC in dcn20_resource_construct
	drm/radeon: Fix a missing check bug in radeon_dp_mst_detect()
	clk: uniphier: Fix potential infinite loop
	scsi: pm80xx: Increase timeout for pm80xx mpi_uninit_check()
	scsi: pm80xx: Fix potential infinite loop
	scsi: ufs: ufshcd-pltfrm: Fix deferred probing
	scsi: hisi_sas: Fix IRQ checks
	scsi: jazz_esp: Add IRQ check
	scsi: sun3x_esp: Add IRQ check
	scsi: sni_53c710: Add IRQ check
	scsi: ibmvfc: Fix invalid state machine BUG_ON()
	mailbox: sprd: Introduce refcnt when clients requests/free channels
	mfd: stm32-timers: Avoid clearing auto reload register
	nvmet-tcp: fix a segmentation fault during io parsing error
	nvme-pci: don't simple map sgl when sgls are disabled
	media: cedrus: Fix H265 status definitions
	HSI: core: fix resource leaks in hsi_add_client_from_dt()
	x86/events/amd/iommu: Fix sysfs type mismatch
	perf/amd/uncore: Fix sysfs type mismatch
	io_uring: fix overflows checks in provide buffers
	sched/debug: Fix cgroup_path[] serialization
	drivers/block/null_blk/main: Fix a double free in null_init.
	xsk: Respect device's headroom and tailroom on generic xmit path
	HID: plantronics: Workaround for double volume key presses
	perf symbols: Fix dso__fprintf_symbols_by_name() to return the number of printed chars
	ASoC: Intel: boards: sof-wm8804: add check for PLL setting
	ASoC: Intel: Skylake: Compile when any configuration is selected
	RDMA/mlx5: Fix mlx5 rates to IB rates map
	wilc1000: write value to WILC_INTR2_ENABLE register
	KVM: x86/mmu: Retry page faults that hit an invalid memslot
	Bluetooth: avoid deadlock between hci_dev->lock and socket lock
	net: lapbether: Prevent racing when checking whether the netif is running
	libbpf: Add explicit padding to bpf_xdp_set_link_opts
	bpftool: Fix maybe-uninitialized warnings
	iommu: Check dev->iommu in iommu_dev_xxx functions
	iommu/vt-d: Reject unsupported page request modes
	selftests/bpf: Re-generate vmlinux.h and BPF skeletons if bpftool changed
	libbpf: Add explicit padding to btf_dump_emit_type_decl_opts
	powerpc/fadump: Mark fadump_calculate_reserve_size as __init
	powerpc/prom: Mark identical_pvr_fixup as __init
	MIPS: fix local_irq_{disable,enable} in asmmacro.h
	ima: Fix the error code for restoring the PCR value
	inet: use bigger hash table for IP ID generation
	pinctrl: pinctrl-single: remove unused parameter
	pinctrl: pinctrl-single: fix pcs_pin_dbg_show() when bits_per_mux is not zero
	MIPS: loongson64: fix bug when PAGE_SIZE > 16KB
	ASoC: wm8960: Remove bitclk relax condition in wm8960_configure_sysclk
	iommu/arm-smmu-v3: add bit field SFM into GERROR_ERR_MASK
	RDMA/mlx5: Fix drop packet rule in egress table
	IB/isert: Fix a use after free in isert_connect_request
	powerpc: Fix HAVE_HARDLOCKUP_DETECTOR_ARCH build configuration
	MIPS/bpf: Enable bpf_probe_read{, str}() on MIPS again
	gpio: guard gpiochip_irqchip_add_domain() with GPIOLIB_IRQCHIP
	ALSA: core: remove redundant spin_lock pair in snd_card_disconnect
	net: phy: lan87xx: fix access to wrong register of LAN87xx
	udp: never accept GSO_FRAGLIST packets
	powerpc/pseries: Only register vio drivers if vio bus exists
	net/tipc: fix missing destroy_workqueue() on error in tipc_crypto_start()
	bug: Remove redundant condition check in report_bug
	RDMA/core: Fix corrupted SL on passive side
	nfc: pn533: prevent potential memory corruption
	net: hns3: Limiting the scope of vector_ring_chain variable
	mips: bmips: fix syscon-reboot nodes
	iommu/vt-d: Don't set then clear private data in prq_event_thread()
	iommu: Fix a boundary issue to avoid performance drop
	iommu/vt-d: Report right snoop capability when using FL for IOVA
	iommu/vt-d: Report the right page fault address
	iommu/vt-d: Preset Access/Dirty bits for IOVA over FL
	iommu/vt-d: Remove WO permissions on second-level paging entries
	iommu/vt-d: Invalidate PASID cache when root/context entry changed
	ALSA: usb-audio: Add error checks for usb_driver_claim_interface() calls
	HID: lenovo: Use brightness_set_blocking callback for setting LEDs brightness
	HID: lenovo: Fix lenovo_led_set_tp10ubkbd() error handling
	HID: lenovo: Check hid_get_drvdata() returns non NULL in lenovo_event()
	HID: lenovo: Map mic-mute button to KEY_F20 instead of KEY_MICMUTE
	KVM: arm64: Initialize VCPU mdcr_el2 before loading it
	ASoC: simple-card: fix possible uninitialized single_cpu local variable
	liquidio: Fix unintented sign extension of a left shift of a u16
	IB/hfi1: Use kzalloc() for mmu_rb_handler allocation
	powerpc/64s: Fix pte update for kernel memory on radix
	powerpc/perf: Fix PMU constraint check for EBB events
	powerpc: iommu: fix build when neither PCI or IBMVIO is set
	mac80211: bail out if cipher schemes are invalid
	perf vendor events amd: Fix broken L2 Cache Hits from L2 HWPF metric
	xfs: fix return of uninitialized value in variable error
	rtw88: Fix an error code in rtw_debugfs_set_rsvd_page()
	mt7601u: fix always true expression
	mt76: mt7615: fix tx skb dma unmap
	mt76: mt7915: fix tx skb dma unmap
	mt76: mt7915: fix aggr len debugfs node
	mt76: mt7615: fix mib stats counter reporting to mac80211
	mt76: mt7915: fix mib stats counter reporting to mac80211
	mt76: mt7663s: make all of packets 4-bytes aligned in sdio tx aggregation
	mt76: mt7663s: fix the possible device hang in high traffic
	KVM: PPC: Book3S HV P9: Restore host CTRL SPR after guest exit
	ovl: invalidate readdir cache on changes to dir with origin
	RDMA/qedr: Fix error return code in qedr_iw_connect()
	IB/hfi1: Fix error return code in parse_platform_config()
	RDMA/bnxt_re: Fix error return code in bnxt_qplib_cq_process_terminal()
	cxgb4: Fix unintentional sign extension issues
	net: thunderx: Fix unintentional sign extension issue
	RDMA/srpt: Fix error return code in srpt_cm_req_recv()
	RDMA/rtrs-clt: destroy sysfs after removing session from active list
	i2c: cadence: fix reference leak when pm_runtime_get_sync fails
	i2c: img-scb: fix reference leak when pm_runtime_get_sync fails
	i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync fails
	i2c: imx: fix reference leak when pm_runtime_get_sync fails
	i2c: omap: fix reference leak when pm_runtime_get_sync fails
	i2c: sprd: fix reference leak when pm_runtime_get_sync fails
	i2c: stm32f7: fix reference leak when pm_runtime_get_sync fails
	i2c: xiic: fix reference leak when pm_runtime_get_sync fails
	i2c: cadence: add IRQ check
	i2c: emev2: add IRQ check
	i2c: jz4780: add IRQ check
	i2c: mlxbf: add IRQ check
	i2c: rcar: make sure irq is not threaded on Gen2 and earlier
	i2c: rcar: protect against supurious interrupts on V3U
	i2c: rcar: add IRQ check
	i2c: sh7760: add IRQ check
	powerpc/xive: Drop check on irq_data in xive_core_debug_show()
	powerpc/xive: Fix xmon command "dxi"
	ASoC: ak5558: correct reset polarity
	net/mlx5: Fix bit-wise and with zero
	net/packet: make packet_fanout.arr size configurable up to 64K
	net/packet: remove data races in fanout operations
	drm/i915/gvt: Fix error code in intel_gvt_init_device()
	iommu/amd: Put newline after closing bracket in warning
	perf beauty: Fix fsconfig generator
	drm/amd/pm: fix error code in smu_set_power_limit()
	MIPS: pci-legacy: stop using of_pci_range_to_resource
	powerpc/pseries: extract host bridge from pci_bus prior to bus removal
	powerpc/smp: Reintroduce cpu_core_mask
	KVM: x86: dump_vmcs should not assume GUEST_IA32_EFER is valid
	rtlwifi: 8821ae: upgrade PHY and RF parameters
	wlcore: fix overlapping snprintf arguments in debugfs
	i2c: sh7760: fix IRQ error path
	i2c: mediatek: Fix wrong dma sync flag
	mwl8k: Fix a double Free in mwl8k_probe_hw
	netfilter: nft_payload: fix C-VLAN offload support
	netfilter: nftables_offload: VLAN id needs host byteorder in flow dissector
	netfilter: nftables_offload: special ethertype handling for VLAN
	vsock/vmci: log once the failed queue pair allocation
	libbpf: Initialize the bpf_seq_printf parameters array field by field
	net: ethernet: ixp4xx: Set the DMA masks explicitly
	gro: fix napi_gro_frags() Fast GRO breakage due to IP alignment check
	RDMA/cxgb4: add missing qpid increment
	RDMA/i40iw: Fix error unwinding when i40iw_hmc_sd_one fails
	ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check fails
	sfc: ef10: fix TX queue lookup in TX event handling
	vsock/virtio: free queued packets when closing socket
	net: marvell: prestera: fix port event handling on init
	net: davinci_emac: Fix incorrect masking of tx and rx error channel
	mt76: mt7615: fix memleak when mt7615_unregister_device()
	crypto: ccp: Detect and reject "invalid" addresses destined for PSP
	nfp: devlink: initialize the devlink port attribute "lanes"
	net: stmmac: fix TSO and TBS feature enabling during driver open
	net: renesas: ravb: Fix a stuck issue when a lot of frames are received
	net: phy: intel-xway: enable integrated led functions
	RDMA/rxe: Fix a bug in rxe_fill_ip_info()
	RDMA/core: Add CM to restrack after successful attachment to a device
	powerpc/64: Fix the definition of the fixmap area
	ath9k: Fix error check in ath9k_hw_read_revisions() for PCI devices
	ath10k: Fix a use after free in ath10k_htc_send_bundle
	ath10k: Fix ath10k_wmi_tlv_op_pull_peer_stats_info() unlock without lock
	wlcore: Fix buffer overrun by snprintf due to incorrect buffer size
	powerpc/perf: Fix the threshold event selection for memory events in power10
	powerpc/52xx: Fix an invalid ASM expression ('addi' used instead of 'add')
	net: phy: marvell: fix m88e1011_set_downshift
	net: phy: marvell: fix m88e1111_set_downshift
	net: enetc: fix link error again
	bnxt_en: fix ternary sign extension bug in bnxt_show_temp()
	ARM: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E
	arm64: dts: uniphier: Change phy-mode to RGMII-ID to enable delay pins for RTL8211E
	net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb
	selftests: net: mirror_gre_vlan_bridge_1q: Make an FDB entry static
	selftests: mlxsw: Remove a redundant if statement in tc_flower_scale test
	bnxt_en: Fix RX consumer index logic in the error path.
	KVM: VMX: Intercept FS/GS_BASE MSR accesses for 32-bit KVM
	net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send
	selftests/bpf: Fix BPF_CORE_READ_BITFIELD() macro
	selftests/bpf: Fix field existence CO-RE reloc tests
	selftests/bpf: Fix core_reloc test runner
	bpf: Fix propagation of 32 bit unsigned bounds from 64 bit bounds
	RDMA/siw: Fix a use after free in siw_alloc_mr
	RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res
	net: bridge: mcast: fix broken length + header check for MRDv6 Adv.
	net:nfc:digital: Fix a double free in digital_tg_recv_dep_req
	perf tools: Change fields type in perf_record_time_conv
	perf jit: Let convert_timestamp() to be backwards-compatible
	perf session: Add swap operation for event TIME_CONV
	ia64: fix EFI_DEBUG build
	kfifo: fix ternary sign extension bugs
	mm/sl?b.c: remove ctor argument from kmem_cache_flags
	mm: memcontrol: slab: fix obtain a reference to a freeing memcg
	mm/sparse: add the missing sparse_buffer_fini() in error branch
	mm/memory-failure: unnecessary amount of unmapping
	afs: Fix speculative status fetches
	bpf: Fix alu32 const subreg bound tracking on bitwise operations
	bpf, ringbuf: Deny reserve of buffers larger than ringbuf
	bpf: Prevent writable memory-mapping of read-only ringbuf pages
	arm64: Remove arm64_dma32_phys_limit and its uses
	net: Only allow init netns to set default tcp cong to a restricted algo
	smp: Fix smp_call_function_single_async prototype
	Revert "net/sctp: fix race condition in sctp_destroy_sock"
	sctp: delay auto_asconf init until binding the first addr
	Linux 5.10.37

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ie783c33e5795514a40672a8273d584ea970fb549
2021-05-14 10:31:07 +02:00
Jane Chu
949e7c5f49 mm/memory-failure: unnecessary amount of unmapping
[ Upstream commit 4d75136be8 ]

It appears that unmap_mapping_range() actually takes a 'size' as its third
argument rather than a location, the current calling fashion causes
unnecessary amount of unmapping to occur.

Link: https://lkml.kernel.org/r/20210420002821.2749748-1-jane.chu@oracle.com
Fixes: 6100e34b25 ("mm, memory_failure: Teach memory_failure() about dev_pagemap pages")
Signed-off-by: Jane Chu <jane.chu@oracle.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Reviewed-by: Naoya Horiguchi <naoya.horiguchi@nec.com>
Cc: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-14 09:50:45 +02:00
Wang Wensheng
62d96faa74 mm/sparse: add the missing sparse_buffer_fini() in error branch
[ Upstream commit 2284f47fe9 ]

sparse_buffer_init() and sparse_buffer_fini() should appear in pair, or a
WARN issue would be through the next time sparse_buffer_init() runs.

Add the missing sparse_buffer_fini() in error branch.

Link: https://lkml.kernel.org/r/20210325113155.118574-1-wangwensheng4@huawei.com
Fixes: 85c77f7913 ("mm/sparse: add new sparse_init_nid() and sparse_init()")
Signed-off-by: Wang Wensheng <wangwensheng4@huawei.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Oscar Salvador <osalvador@suse.de>
Cc: Pavel Tatashin <pasha.tatashin@oracle.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-14 09:50:45 +02:00
Muchun Song
31df8bc4d3 mm: memcontrol: slab: fix obtain a reference to a freeing memcg
[ Upstream commit 9f38f03ae8 ]

Patch series "Use obj_cgroup APIs to charge kmem pages", v5.

Since Roman's series "The new cgroup slab memory controller" applied.
All slab objects are charged with the new APIs of obj_cgroup.  The new
APIs introduce a struct obj_cgroup to charge slab objects.  It prevents
long-living objects from pinning the original memory cgroup in the
memory.  But there are still some corner objects (e.g.  allocations
larger than order-1 page on SLUB) which are not charged with the new
APIs.  Those objects (include the pages which are allocated from buddy
allocator directly) are charged as kmem pages which still hold a
reference to the memory cgroup.

E.g.  We know that the kernel stack is charged as kmem pages because the
size of the kernel stack can be greater than 2 pages (e.g.  16KB on
x86_64 or arm64).  If we create a thread (suppose the thread stack is
charged to memory cgroup A) and then move it from memory cgroup A to
memory cgroup B.  Because the kernel stack of the thread hold a
reference to the memory cgroup A.  The thread can pin the memory cgroup
A in the memory even if we remove the cgroup A.  If we want to see this
scenario by using the following script.  We can see that the system has
added 500 dying cgroups (This is not a real world issue, just a script
to show that the large kmallocs are charged as kmem pages which can pin
the memory cgroup in the memory).

	#!/bin/bash

	cat /proc/cgroups | grep memory

	cd /sys/fs/cgroup/memory
	echo 1 > memory.move_charge_at_immigrate

	for i in range{1..500}
	do
		mkdir kmem_test
		echo $$ > kmem_test/cgroup.procs
		sleep 3600 &
		echo $$ > cgroup.procs
		echo `cat kmem_test/cgroup.procs` > cgroup.procs
		rmdir kmem_test
	done

	cat /proc/cgroups | grep memory

This patchset aims to make those kmem pages to drop the reference to
memory cgroup by using the APIs of obj_cgroup.  Finally, we can see that
the number of the dying cgroups will not increase if we run the above test
script.

This patch (of 7):

The rcu_read_lock/unlock only can guarantee that the memcg will not be
freed, but it cannot guarantee the success of css_get (which is in the
refill_stock when cached memcg changed) to memcg.

  rcu_read_lock()
  memcg = obj_cgroup_memcg(old)
  __memcg_kmem_uncharge(memcg)
      refill_stock(memcg)
          if (stock->cached != memcg)
              // css_get can change the ref counter from 0 back to 1.
              css_get(&memcg->css)
  rcu_read_unlock()

This fix is very like the commit:

  eefbfa7fd6 ("mm: memcg/slab: fix use after free in obj_cgroup_charge")

Fix this by holding a reference to the memcg which is passed to the
__memcg_kmem_uncharge() before calling __memcg_kmem_uncharge().

Link: https://lkml.kernel.org/r/20210319163821.20704-1-songmuchun@bytedance.com
Link: https://lkml.kernel.org/r/20210319163821.20704-2-songmuchun@bytedance.com
Fixes: 3de7d4f25a ("mm: memcg/slab: optimize objcg stock draining")
Signed-off-by: Muchun Song <songmuchun@bytedance.com>
Reviewed-by: Shakeel Butt <shakeelb@google.com>
Acked-by: Roman Gushchin <guro@fb.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Vladimir Davydov <vdavydov.dev@gmail.com>
Cc: Xiongchun Duan <duanxiongchun@bytedance.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-14 09:50:45 +02:00
Nikolay Borisov
2e95bc6cfe mm/sl?b.c: remove ctor argument from kmem_cache_flags
[ Upstream commit 3754000872 ]

This argument hasn't been used since e153362a50 ("slub: Remove objsize
check in kmem_cache_flags()") so simply remove it.

Link: https://lkml.kernel.org/r/20210126095733.974665-1-nborisov@suse.com
Signed-off-by: Nikolay Borisov <nborisov@suse.com>
Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
Reviewed-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Christoph Lameter <cl@linux.com>
Acked-by: David Rientjes <rientjes@google.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-05-14 09:50:45 +02:00
Greg Kroah-Hartman
532ebc0875 Merge 5.10.32 into android13-5.10
Changes in 5.10.32
	net/sctp: fix race condition in sctp_destroy_sock
	mtd: rawnand: mtk: Fix WAITRDY break condition and timeout
	Input: nspire-keypad - enable interrupts only when opened
	gpio: sysfs: Obey valid_mask
	dmaengine: idxd: Fix clobbering of SWERR overflow bit on writeback
	dmaengine: idxd: fix delta_rec and crc size field for completion record
	dmaengine: idxd: fix opcap sysfs attribute output
	dmaengine: idxd: fix wq size store permission state
	dmaengine: dw: Make it dependent to HAS_IOMEM
	dmaengine: Fix a double free in dma_async_device_register
	dmaengine: plx_dma: add a missing put_device() on error path
	dmaengine: idxd: fix wq cleanup of WQCFG registers
	ACPI: x86: Call acpi_boot_table_init() after acpi_table_upgrade()
	ARM: dts: Drop duplicate sha2md5_fck to fix clk_disable race
	ARM: dts: Fix moving mmc devices with aliases for omap4 & 5
	lockdep: Add a missing initialization hint to the "INFO: Trying to register non-static key" message
	arc: kernel: Return -EFAULT if copy_to_user() fails
	iwlwifi: Fix softirq/hardirq disabling in iwl_pcie_enqueue_hcmd()
	xfrm: BEET mode doesn't support fragments for inner packets
	ASoC: max98373: Changed amp shutdown register as volatile
	ASoC: max98373: Added 30ms turn on/off time delay
	gpu/xen: Fix a use after free in xen_drm_drv_init
	neighbour: Disregard DEAD dst in neigh_update
	ARM: keystone: fix integer overflow warning
	ARM: omap1: fix building with clang IAS
	drm/msm: Fix a5xx/a6xx timestamps
	ASoC: fsl_esai: Fix TDM slot setup for I2S mode
	scsi: scsi_transport_srp: Don't block target in SRP_PORT_LOST state
	iwlwifi: add support for Qu with AX201 device
	net: ieee802154: stop dump llsec keys for monitors
	net: ieee802154: forbid monitor for add llsec key
	net: ieee802154: forbid monitor for del llsec key
	net: ieee802154: stop dump llsec devs for monitors
	net: ieee802154: forbid monitor for add llsec dev
	net: ieee802154: forbid monitor for del llsec dev
	net: ieee802154: stop dump llsec devkeys for monitors
	net: ieee802154: forbid monitor for add llsec devkey
	net: ieee802154: forbid monitor for del llsec devkey
	net: ieee802154: stop dump llsec seclevels for monitors
	net: ieee802154: forbid monitor for add llsec seclevel
	pcnet32: Use pci_resource_len to validate PCI resource
	mac80211: clear sta->fast_rx when STA removed from 4-addr VLAN
	virt_wifi: Return micros for BSS TSF values
	lib: fix kconfig dependency on ARCH_WANT_FRAME_POINTERS
	Input: s6sy761 - fix coordinate read bit shift
	Input: i8042 - fix Pegatron C15B ID entry
	HID: wacom: set EV_KEY and EV_ABS only for non-HID_GENERIC type of devices
	dm verity fec: fix misaligned RS roots IO
	readdir: make sure to verify directory entry for legacy interfaces too
	arm64: fix inline asm in load_unaligned_zeropad()
	arm64: alternatives: Move length validation in alternative_{insn, endif}
	vfio/pci: Add missing range check in vfio_pci_mmap
	riscv: Fix spelling mistake "SPARSEMEM" to "SPARSMEM"
	scsi: libsas: Reset num_scatter if libata marks qc as NODATA
	ixgbe: fix unbalanced device enable/disable in suspend/resume
	netfilter: flowtable: fix NAT IPv6 offload mangling
	netfilter: conntrack: do not print icmpv6 as unknown via /proc
	ice: Fix potential infinite loop when using u8 loop counter
	libnvdimm/region: Fix nvdimm_has_flush() to handle ND_REGION_ASYNC
	netfilter: bridge: add pre_exit hooks for ebtable unregistration
	netfilter: arp_tables: add pre_exit hook for table unregister
	libbpf: Fix potential NULL pointer dereference
	net: macb: fix the restore of cmp registers
	net/mlx5e: fix ingress_ifindex check in mlx5e_flower_parse_meta
	netfilter: nft_limit: avoid possible divide error in nft_limit_init
	net/mlx5e: Fix setting of RS FEC mode
	net: davicom: Fix regulator not turned off on failed probe
	net: sit: Unregister catch-all devices
	net: ip6_tunnel: Unregister catch-all devices
	mm: ptdump: fix build failure
	net: Make tcp_allowed_congestion_control readonly in non-init netns
	i40e: fix the panic when running bpf in xdpdrv mode
	ethtool: pause: make sure we init driver stats
	ia64: remove duplicate entries in generic_defconfig
	ia64: tools: remove inclusion of ia64-specific version of errno.h header
	ibmvnic: avoid calling napi_disable() twice
	ibmvnic: remove duplicate napi_schedule call in do_reset function
	ibmvnic: remove duplicate napi_schedule call in open function
	ch_ktls: Fix kernel panic
	ch_ktls: fix device connection close
	ch_ktls: tcb close causes tls connection failure
	ch_ktls: do not send snd_una update to TCB in middle
	gro: ensure frag0 meets IP header alignment
	ARM: OMAP2+: Fix warning for omap_init_time_of()
	ARM: 9069/1: NOMMU: Fix conversion for_each_membock() to for_each_mem_range()
	ARM: footbridge: fix PCI interrupt mapping
	ARM: OMAP2+: Fix uninitialized sr_inst
	arm64: dts: allwinner: Fix SD card CD GPIO for SOPine systems
	arm64: dts: allwinner: h6: beelink-gs1: Remove ext. 32 kHz osc reference
	bpf: Use correct permission flag for mixed signed bounds arithmetic
	KVM: VMX: Convert vcpu_vmx.exit_reason to a union
	KVM: VMX: Don't use vcpu->run->internal.ndata as an array index
	r8169: tweak max read request size for newer chips also in jumbo mtu mode
	r8169: don't advertise pause in jumbo mode
	bpf: Ensure off_reg has no mixed signed bounds for all types
	bpf: Move off_reg into sanitize_ptr_alu
	ARM: 9071/1: uprobes: Don't hook on thumb instructions
	arm64: mte: Ensure TIF_MTE_ASYNC_FAULT is set atomically
	bpf: Rework ptr_limit into alu_limit and add common error path
	bpf: Improve verifier error messages for users
	bpf: Move sanitize_val_alu out of op switch
	net: phy: marvell: fix detection of PHY on Topaz switches
	Linux 5.10.32

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I200a0efb16e3d7a5b26e5f3e93d6de83cb2655a0
2021-04-22 09:44:13 +02:00
Christophe Leroy
76af8126a6 mm: ptdump: fix build failure
commit 458376913d upstream.

READ_ONCE() cannot be used for reading PTEs.  Use ptep_get() instead, to
avoid the following errors:

    CC      mm/ptdump.o
  In file included from <command-line>:
  mm/ptdump.c: In function 'ptdump_pte_entry':
  include/linux/compiler_types.h:320:38: error: call to '__compiletime_assert_207' declared with attribute error: Unsupported access size for {READ,WRITE}_ONCE().
    320 |  _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
        |                                      ^
  include/linux/compiler_types.h:301:4: note: in definition of macro '__compiletime_assert'
    301 |    prefix ## suffix();    \
        |    ^~~~~~
  include/linux/compiler_types.h:320:2: note: in expansion of macro '_compiletime_assert'
    320 |  _compiletime_assert(condition, msg, __compiletime_assert_, __COUNTER__)
        |  ^~~~~~~~~~~~~~~~~~~
  include/asm-generic/rwonce.h:36:2: note: in expansion of macro 'compiletime_assert'
     36 |  compiletime_assert(__native_word(t) || sizeof(t) == sizeof(long long), \
        |  ^~~~~~~~~~~~~~~~~~
  include/asm-generic/rwonce.h:49:2: note: in expansion of macro 'compiletime_assert_rwonce_type'
     49 |  compiletime_assert_rwonce_type(x);    \
        |  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  mm/ptdump.c:114:14: note: in expansion of macro 'READ_ONCE'
    114 |  pte_t val = READ_ONCE(*pte);
        |              ^~~~~~~~~
  make[2]: *** [mm/ptdump.o] Error 1

See commit 481e980a7c ("mm: Allow arches to provide ptep_get()") and
commit c0e1c8c22b ("powerpc/8xx: Provide ptep_get() with 16k pages")
for details.

Link: https://lkml.kernel.org/r/912b349e2bcaa88939904815ca0af945740c6bd4.1618478922.git.christophe.leroy@csgroup.eu
Fixes: 30d621f672 ("mm: add generic ptdump")
Signed-off-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Cc: Steven Price <steven.price@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-04-21 13:00:57 +02:00
Carlos Llamas
df55d57f2e ANDROID: mm: fix mixed declaration and code warning
This fixes the following warning:
mm/memory.c: In function ‘___handle_speculative_fault’:
mm/memory.c:4871:2: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]
 4871 |  struct mempolicy *pol;
      |  ^~~~~~

Bug: 183339614
Fixes: 1c53717440 (FROMLIST: mm: provide speculative fault infrastructure)
Reported-by: kernelci.org bot <bot@kernelci.org>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: Iebb8c7b4f7c01688bfbb9770653063015ae47020
(cherry picked from commit e98d2de6a6)
2021-04-19 16:57:25 +00:00
Carlos Llamas
6ce86f7d97 ANDROID: mm/memory_hotplug: fix minor printk format warnings
Use the correct printk length specifier [%llx] for u64 variables.
This fixes several warnings of the following type:

mm/memory_hotplug.c: In function ‘add_memory_subsection’:
./include/linux/kern_levels.h:5:18: warning: format ‘%lx’ expects argument of type ‘long unsigned int’, but argument 3 has type ‘u64’ {aka ‘long long unsigned int’} [-Wformat=]
mm/memory_hotplug.c:1144:25: note: format string is defined here
   pr_err("%s: start 0x%lx size 0x%lx not aligned to subsection size\n",
                       ~~^
                       %llx

Bug: 183339614
Fixes: 417ac617ea (ANDROID: mm/memory_hotplug: implement {add/remove}_memory_subsection)
Reported-by: kernelci.org bot <bot@kernelci.org>
Signed-off-by: Carlos Llamas <cmllamas@google.com>
Change-Id: Iee89be07cb40513661e336dd0671f65b1161e830
(cherry picked from commit f226790096)
2021-04-14 18:07:14 +00:00
Greg Kroah-Hartman
f592625f0e Merge 5.10.30 into android13-5.10
Changes in 5.10.30
	xfrm/compat: Cleanup WARN()s that can be user-triggered
	ALSA: aloop: Fix initialization of controls
	ALSA: hda/realtek: Fix speaker amp setup on Acer Aspire E1
	ALSA: hda/conexant: Apply quirk for another HP ZBook G5 model
	ASoC: intel: atom: Stop advertising non working S24LE support
	nfc: fix refcount leak in llcp_sock_bind()
	nfc: fix refcount leak in llcp_sock_connect()
	nfc: fix memory leak in llcp_sock_connect()
	nfc: Avoid endless loops caused by repeated llcp_sock_connect()
	selinux: make nslot handling in avtab more robust
	selinux: fix cond_list corruption when changing booleans
	selinux: fix race between old and new sidtab
	xen/evtchn: Change irq_info lock to raw_spinlock_t
	net: ipv6: check for validity before dereferencing cfg->fc_nlinfo.nlh
	net: dsa: lantiq_gswip: Let GSWIP automatically set the xMII clock
	net: dsa: lantiq_gswip: Don't use PHY auto polling
	net: dsa: lantiq_gswip: Configure all remaining GSWIP_MII_CFG bits
	drm/i915: Fix invalid access to ACPI _DSM objects
	ACPI: processor: Fix build when CONFIG_ACPI_PROCESSOR=m
	IB/hfi1: Fix probe time panic when AIP is enabled with a buggy BIOS
	LOOKUP_MOUNTPOINT: we are cleaning "jumped" flag too late
	gcov: re-fix clang-11+ support
	ia64: fix user_stack_pointer() for ptrace()
	nds32: flush_dcache_page: use page_mapping_file to avoid races with swapoff
	ocfs2: fix deadlock between setattr and dio_end_io_write
	fs: direct-io: fix missing sdio->boundary
	ethtool: fix incorrect datatype in set_eee ops
	of: property: fw_devlink: do not link ".*,nr-gpios"
	parisc: parisc-agp requires SBA IOMMU driver
	parisc: avoid a warning on u8 cast for cmpxchg on u8 pointers
	ARM: dts: turris-omnia: configure LED[2]/INTn pin as interrupt pin
	batman-adv: initialize "struct batadv_tvlv_tt_vlan_data"->reserved field
	ice: Continue probe on link/PHY errors
	ice: Increase control queue timeout
	ice: prevent ice_open and ice_stop during reset
	ice: fix memory allocation call
	ice: remove DCBNL_DEVRESET bit from PF state
	ice: Fix for dereference of NULL pointer
	ice: Use port number instead of PF ID for WoL
	ice: Cleanup fltr list in case of allocation issues
	iwlwifi: pcie: properly set LTR workarounds on 22000 devices
	ice: fix memory leak of aRFS after resuming from suspend
	net: hso: fix null-ptr-deref during tty device unregistration
	libbpf: Fix bail out from 'ringbuf_process_ring()' on error
	bpf: Enforce that struct_ops programs be GPL-only
	bpf: link: Refuse non-O_RDWR flags in BPF_OBJ_GET
	ethernet/netronome/nfp: Fix a use after free in nfp_bpf_ctrl_msg_rx
	libbpf: Ensure umem pointer is non-NULL before dereferencing
	libbpf: Restore umem state after socket create failure
	libbpf: Only create rx and tx XDP rings when necessary
	bpf: Refcount task stack in bpf_get_task_stack
	bpf, sockmap: Fix sk->prot unhash op reset
	bpf, sockmap: Fix incorrect fwd_alloc accounting
	net: ensure mac header is set in virtio_net_hdr_to_skb()
	i40e: Fix sparse warning: missing error code 'err'
	i40e: Fix sparse error: 'vsi->netdev' could be null
	i40e: Fix sparse error: uninitialized symbol 'ring'
	i40e: Fix sparse errors in i40e_txrx.c
	vdpa/mlx5: Fix suspend/resume index restoration
	net: sched: sch_teql: fix null-pointer dereference
	net: sched: fix action overwrite reference counting
	nl80211: fix beacon head validation
	nl80211: fix potential leak of ACL params
	cfg80211: check S1G beacon compat element length
	mac80211: fix time-is-after bug in mlme
	mac80211: fix TXQ AC confusion
	net: hsr: Reset MAC header for Tx path
	net-ipv6: bugfix - raw & sctp - switch to ipv6_can_nonlocal_bind()
	net: let skb_orphan_partial wake-up waiters.
	thunderbolt: Fix a leak in tb_retimer_add()
	thunderbolt: Fix off by one in tb_port_find_retimer()
	usbip: add sysfs_lock to synchronize sysfs code paths
	usbip: stub-dev synchronize sysfs code paths
	usbip: vudc synchronize sysfs code paths
	usbip: synchronize event handler with sysfs code paths
	driver core: Fix locking bug in deferred_probe_timeout_work_func()
	scsi: pm80xx: Fix chip initialization failure
	scsi: target: iscsi: Fix zero tag inside a trace event
	percpu: make pcpu_nr_empty_pop_pages per chunk type
	i2c: turn recovery error on init to debug
	KVM: x86/mmu: change TDP MMU yield function returns to match cond_resched
	KVM: x86/mmu: Merge flush and non-flush tdp_mmu_iter_cond_resched
	KVM: x86/mmu: Rename goal_gfn to next_last_level_gfn
	KVM: x86/mmu: Ensure forward progress when yielding in TDP MMU iter
	KVM: x86/mmu: Yield in TDU MMU iter even if no SPTES changed
	KVM: x86/mmu: Ensure TLBs are flushed when yielding during GFN range zap
	KVM: x86/mmu: Ensure TLBs are flushed for TDP MMU during NX zapping
	KVM: x86/mmu: Don't allow TDP MMU to yield when recovering NX pages
	KVM: x86/mmu: preserve pending TLB flush across calls to kvm_tdp_mmu_zap_sp
	net: sched: fix err handler in tcf_action_init()
	ice: Refactor DCB related variables out of the ice_port_info struct
	ice: Recognize 860 as iSCSI port in CEE mode
	xfrm: interface: fix ipv4 pmtu check to honor ip header df
	xfrm: Use actual socket sk instead of skb socket for xfrm_output_resume
	remoteproc: qcom: pil_info: avoid 64-bit division
	regulator: bd9571mwv: Fix AVS and DVFS voltage range
	ARM: OMAP4: Fix PMIC voltage domains for bionic
	ARM: OMAP4: PM: update ROM return address for OSWR and OFF
	net: xfrm: Localize sequence counter per network namespace
	esp: delete NETIF_F_SCTP_CRC bit from features for esp offload
	ASoC: SOF: Intel: HDA: fix core status verification
	ASoC: wm8960: Fix wrong bclk and lrclk with pll enabled for some chips
	xfrm: Fix NULL pointer dereference on policy lookup
	virtchnl: Fix layout of RSS structures
	i40e: Added Asym_Pause to supported link modes
	i40e: Fix kernel oops when i40e driver removes VF's
	hostfs: fix memory handling in follow_link()
	amd-xgbe: Update DMA coherency values
	vxlan: do not modify the shared tunnel info when PMTU triggers an ICMP reply
	geneve: do not modify the shared tunnel info when PMTU triggers an ICMP reply
	sch_red: fix off-by-one checks in red_check_params()
	drivers/net/wan/hdlc_fr: Fix a double free in pvc_xmit
	arm64: dts: imx8mm/q: Fix pad control of SD1_DATA0
	xfrm: Provide private skb extensions for segmented and hw offloaded ESP packets
	can: bcm/raw: fix msg_namelen values depending on CAN_REQUIRED_SIZE
	can: isotp: fix msg_namelen values depending on CAN_REQUIRED_SIZE
	mlxsw: spectrum: Fix ECN marking in tunnel decapsulation
	ethernet: myri10ge: Fix a use after free in myri10ge_sw_tso
	gianfar: Handle error code at MAC address change
	net: dsa: Fix type was not set for devlink port
	cxgb4: avoid collecting SGE_QBASE regs during traffic
	net:tipc: Fix a double free in tipc_sk_mcast_rcv
	ARM: dts: imx6: pbab01: Set vmmc supply for both SD interfaces
	net/ncsi: Avoid channel_monitor hrtimer deadlock
	net: qrtr: Fix memory leak on qrtr_tx_wait failure
	nfp: flower: ignore duplicate merge hints from FW
	net: phy: broadcom: Only advertise EEE for supported modes
	I2C: JZ4780: Fix bug for Ingenic X1000.
	ASoC: sunxi: sun4i-codec: fill ASoC card owner
	net/mlx5e: Fix mapping of ct_label zero
	net/mlx5e: Fix ethtool indication of connector type
	net/mlx5: Don't request more than supported EQs
	net/rds: Fix a use after free in rds_message_map_pages
	xdp: fix xdp_return_frame() kernel BUG throw for page_pool memory model
	soc/fsl: qbman: fix conflicting alignment attributes
	i40e: Fix display statistics for veb_tc
	RDMA/rtrs-clt: Close rtrs client conn before destroying rtrs clt session files
	drm/msm: Set drvdata to NULL when msm_drm_init() fails
	net: udp: Add support for getsockopt(..., ..., UDP_GRO, ..., ...);
	mptcp: forbit mcast-related sockopt on MPTCP sockets
	scsi: ufs: core: Fix task management request completion timeout
	scsi: ufs: core: Fix wrong Task Tag used in task management request UPIUs
	net: cls_api: Fix uninitialised struct field bo->unlocked_driver_cb
	net: macb: restore cmp registers on resume path
	clk: fix invalid usage of list cursor in register
	clk: fix invalid usage of list cursor in unregister
	workqueue: Move the position of debug_work_activate() in __queue_work()
	s390/cpcmd: fix inline assembly register clobbering
	perf inject: Fix repipe usage
	net: openvswitch: conntrack: simplify the return expression of ovs_ct_limit_get_default_limit()
	openvswitch: fix send of uninitialized stack memory in ct limit reply
	i2c: designware: Adjust bus_freq_hz when refuse high speed mode set
	iwlwifi: fix 11ax disabled bit in the regulatory capability flags
	can: mcp251x: fix support for half duplex SPI host controllers
	tipc: increment the tmp aead refcnt before attaching it
	net: hns3: clear VF down state bit before request link status
	net/mlx5: Fix placement of log_max_flow_counter
	net/mlx5: Fix PPLM register mapping
	net/mlx5: Fix PBMC register mapping
	RDMA/cxgb4: check for ipv6 address properly while destroying listener
	perf report: Fix wrong LBR block sorting
	RDMA/qedr: Fix kernel panic when trying to access recv_cq
	drm/vc4: crtc: Reduce PV fifo threshold on hvs4
	i40e: Fix parameters in aq_get_phy_register()
	RDMA/addr: Be strict with gid size
	vdpa/mlx5: should exclude header length and fcs from mtu
	vdpa/mlx5: Fix wrong use of bit numbers
	RAS/CEC: Correct ce_add_elem()'s returned values
	clk: socfpga: fix iomem pointer cast on 64-bit
	lockdep: Address clang -Wformat warning printing for %hd
	dt-bindings: net: ethernet-controller: fix typo in NVMEM
	net: sched: bump refcount for new action in ACT replace mode
	gpiolib: Read "gpio-line-names" from a firmware node
	cfg80211: remove WARN_ON() in cfg80211_sme_connect
	net: tun: set tun->dev->addr_len during TUNSETLINK processing
	drivers: net: fix memory leak in atusb_probe
	drivers: net: fix memory leak in peak_usb_create_dev
	net: mac802154: Fix general protection fault
	net: ieee802154: nl-mac: fix check on panid
	net: ieee802154: fix nl802154 del llsec key
	net: ieee802154: fix nl802154 del llsec dev
	net: ieee802154: fix nl802154 add llsec key
	net: ieee802154: fix nl802154 del llsec devkey
	net: ieee802154: forbid monitor for set llsec params
	net: ieee802154: forbid monitor for del llsec seclevel
	net: ieee802154: stop dump llsec params for monitors
	Revert "net: sched: bump refcount for new action in ACT replace mode"
	Linux 5.10.30

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I88d580f3578c13c0c8d6a7b5918b3be60314105d
2021-04-14 12:15:14 +02:00
Roman Gushchin
efa869b68b percpu: make pcpu_nr_empty_pop_pages per chunk type
commit 0760fa3d8f upstream.

nr_empty_pop_pages is used to guarantee that there are some free
populated pages to satisfy atomic allocations. Accounted and
non-accounted allocations are using separate sets of chunks,
so both need to have a surplus of empty pages.

This commit makes pcpu_nr_empty_pop_pages and the corresponding logic
per chunk type.

[Dennis]
This issue came up as I was reviewing [1] and realized I missed this.
Simultaneously, it was reported btrfs was seeing failed atomic
allocations in fsstress tests [2] and [3].

[1] https://lore.kernel.org/linux-mm/20210324190626.564297-1-guro@fb.com/
[2] https://lore.kernel.org/linux-mm/20210401185158.3275.409509F4@e16-tech.com/
[3] https://lore.kernel.org/linux-mm/CAL3q7H5RNBjCi708GH7jnczAOe0BLnacT9C+OBgA-Dx9jhB6SQ@mail.gmail.com/

Fixes: 3c7be18ac9 ("mm: memcg/percpu: account percpu memory to memory cgroups")
Cc: stable@vger.kernel.org # 5.9+
Signed-off-by: Roman Gushchin <guro@fb.com>
Tested-by: Filipe Manana <fdmanana@suse.com>
Signed-off-by: Dennis Zhou <dennis@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-04-14 08:42:03 +02:00
Greg Kroah-Hartman
d5b8bd204f Merge 5.10.28 into android13-5.10
Changes in 5.10.28
	arm64: mm: correct the inside linear map range during hotplug check
	bpf: Fix fexit trampoline.
	virtiofs: Fail dax mount if device does not support it
	ext4: shrink race window in ext4_should_retry_alloc()
	ext4: fix bh ref count on error paths
	fs: nfsd: fix kconfig dependency warning for NFSD_V4
	rpc: fix NULL dereference on kmalloc failure
	iomap: Fix negative assignment to unsigned sis->pages in iomap_swapfile_activate
	ASoC: rt1015: fix i2c communication error
	ASoC: rt5640: Fix dac- and adc- vol-tlv values being off by a factor of 10
	ASoC: rt5651: Fix dac- and adc- vol-tlv values being off by a factor of 10
	ASoC: sgtl5000: set DAP_AVC_CTRL register to correct default value on probe
	ASoC: es8316: Simplify adc_pga_gain_tlv table
	ASoC: soc-core: Prevent warning if no DMI table is present
	ASoC: cs42l42: Fix Bitclock polarity inversion
	ASoC: cs42l42: Fix channel width support
	ASoC: cs42l42: Fix mixer volume control
	ASoC: cs42l42: Always wait at least 3ms after reset
	NFSD: fix error handling in NFSv4.0 callbacks
	kernel: freezer should treat PF_IO_WORKER like PF_KTHREAD for freezing
	vhost: Fix vhost_vq_reset()
	io_uring: fix ->flags races by linked timeouts
	scsi: st: Fix a use after free in st_open()
	scsi: qla2xxx: Fix broken #endif placement
	staging: comedi: cb_pcidas: fix request_irq() warn
	staging: comedi: cb_pcidas64: fix request_irq() warn
	ASoC: rt5659: Update MCLK rate in set_sysclk()
	ASoC: rt711: add snd_soc_component remove callback
	thermal/core: Add NULL pointer check before using cooling device stats
	locking/ww_mutex: Simplify use_ww_ctx & ww_ctx handling
	locking/ww_mutex: Fix acquire/release imbalance in ww_acquire_init()/ww_acquire_fini()
	nvmet-tcp: fix kmap leak when data digest in use
	io_uring: imply MSG_NOSIGNAL for send[msg]()/recv[msg]() calls
	static_call: Align static_call_is_init() patching condition
	ext4: do not iput inode under running transaction in ext4_rename()
	io_uring: call req_set_fail_links() on short send[msg]()/recv[msg]() with MSG_WAITALL
	net: mvpp2: fix interrupt mask/unmask skip condition
	flow_dissector: fix TTL and TOS dissection on IPv4 fragments
	can: dev: move driver related infrastructure into separate subdir
	net: introduce CAN specific pointer in the struct net_device
	can: tcan4x5x: fix max register value
	brcmfmac: clear EAP/association status bits on linkdown events
	ath11k: add ieee80211_unregister_hw to avoid kernel crash caused by NULL pointer
	rtw88: coex: 8821c: correct antenna switch function
	netdevsim: dev: Initialize FIB module after debugfs
	iwlwifi: pcie: don't disable interrupts for reg_lock
	ath10k: hold RCU lock when calling ieee80211_find_sta_by_ifaddr()
	net: ethernet: aquantia: Handle error cleanup of start on open
	appletalk: Fix skb allocation size in loopback case
	net: ipa: remove two unused register definitions
	net: ipa: fix register write command validation
	net: wan/lmc: unregister device when no matching device is found
	net: 9p: advance iov on empty read
	bpf: Remove MTU check in __bpf_skb_max_len
	ACPI: tables: x86: Reserve memory occupied by ACPI tables
	ACPI: processor: Fix CPU0 wakeup in acpi_idle_play_dead()
	ALSA: usb-audio: Apply sample rate quirk to Logitech Connect
	ALSA: hda: Re-add dropped snd_poewr_change_state() calls
	ALSA: hda: Add missing sanity checks in PM prepare/complete callbacks
	ALSA: hda/realtek: fix a determine_headset_type issue for a Dell AIO
	ALSA: hda/realtek: call alc_update_headset_mode() in hp_automute_hook
	ALSA: hda/realtek: fix mute/micmute LEDs for HP 640 G8
	xtensa: fix uaccess-related livelock in do_page_fault
	xtensa: move coprocessor_flush to the .text section
	KVM: SVM: load control fields from VMCB12 before checking them
	KVM: SVM: ensure that EFER.SVME is set when running nested guest or on nested vmexit
	PM: runtime: Fix race getting/putting suppliers at probe
	PM: runtime: Fix ordering in pm_runtime_get_suppliers()
	tracing: Fix stack trace event size
	s390/vdso: copy tod_steering_delta value to vdso_data page
	s390/vdso: fix tod_steering_delta type
	mm: fix race by making init_zero_pfn() early_initcall
	drm/amdkfd: dqm fence memory corruption
	drm/amdgpu: fix offset calculation in amdgpu_vm_bo_clear_mappings()
	drm/amdgpu: check alignment on CPU page for bo map
	reiserfs: update reiserfs_xattrs_initialized() condition
	drm/imx: fix memory leak when fails to init
	drm/tegra: dc: Restore coupling of display controllers
	drm/tegra: sor: Grab runtime PM reference across reset
	vfio/nvlink: Add missing SPAPR_TCE_IOMMU depends
	pinctrl: rockchip: fix restore error in resume
	extcon: Add stubs for extcon_register_notifier_all() functions
	extcon: Fix error handling in extcon_dev_register
	firmware: stratix10-svc: reset COMMAND_RECONFIG_FLAG_PARTIAL to 0
	usb: dwc3: pci: Enable dis_uX_susphy_quirk for Intel Merrifield
	video: hyperv_fb: Fix a double free in hvfb_probe
	firewire: nosy: Fix a use-after-free bug in nosy_ioctl()
	usbip: vhci_hcd fix shift out-of-bounds in vhci_hub_control()
	USB: quirks: ignore remote wake-up on Fibocom L850-GL LTE modem
	usb: musb: Fix suspend with devices connected for a64
	usb: xhci-mtk: fix broken streams issue on 0.96 xHCI
	cdc-acm: fix BREAK rx code path adding necessary calls
	USB: cdc-acm: untangle a circular dependency between callback and softint
	USB: cdc-acm: downgrade message to debug
	USB: cdc-acm: fix double free on probe failure
	USB: cdc-acm: fix use-after-free after probe failure
	usb: gadget: udc: amd5536udc_pci fix null-ptr-dereference
	usb: dwc2: Fix HPRT0.PrtSusp bit setting for HiKey 960 board.
	usb: dwc2: Prevent core suspend when port connection flag is 0
	usb: dwc3: qcom: skip interconnect init for ACPI probe
	usb: dwc3: gadget: Clear DEP flags after stop transfers in ep disable
	soc: qcom-geni-se: Cleanup the code to remove proxy votes
	staging: rtl8192e: Fix incorrect source in memcpy()
	staging: rtl8192e: Change state information from u16 to u8
	driver core: clear deferred probe reason on probe retry
	drivers: video: fbcon: fix NULL dereference in fbcon_cursor()
	riscv: evaluate put_user() arg before enabling user access
	Revert "kernel: freezer should treat PF_IO_WORKER like PF_KTHREAD for freezing"
	bpf: Use NOP_ATOMIC5 instead of emit_nops(&prog, 5) for BPF_TRAMP_F_CALL_ORIG
	Linux 5.10.28

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ia9203eedb381703178c538e353eba96c437f406a
2021-04-08 09:47:14 +02:00
Ilya Lipnitskiy
ec3e06e06f mm: fix race by making init_zero_pfn() early_initcall
commit e720e7d0e9 upstream.

There are code paths that rely on zero_pfn to be fully initialized
before core_initcall.  For example, wq_sysfs_init() is a core_initcall
function that eventually results in a call to kernel_execve, which
causes a page fault with a subsequent mmput.  If zero_pfn is not
initialized by then it may not get cleaned up properly and result in an
error:

  BUG: Bad rss-counter state mm:(ptrval) type:MM_ANONPAGES val:1

Here is an analysis of the race as seen on a MIPS device. On this
particular MT7621 device (Ubiquiti ER-X), zero_pfn is PFN 0 until
initialized, at which point it becomes PFN 5120:

  1. wq_sysfs_init calls into kobject_uevent_env at core_initcall:
       kobject_uevent_env+0x7e4/0x7ec
       kset_register+0x68/0x88
       bus_register+0xdc/0x34c
       subsys_virtual_register+0x34/0x78
       wq_sysfs_init+0x1c/0x4c
       do_one_initcall+0x50/0x1a8
       kernel_init_freeable+0x230/0x2c8
       kernel_init+0x10/0x100
       ret_from_kernel_thread+0x14/0x1c

  2. kobject_uevent_env() calls call_usermodehelper_exec() which executes
     kernel_execve asynchronously.

  3. Memory allocations in kernel_execve cause a page fault, bumping the
     MM reference counter:
       add_mm_counter_fast+0xb4/0xc0
       handle_mm_fault+0x6e4/0xea0
       __get_user_pages.part.78+0x190/0x37c
       __get_user_pages_remote+0x128/0x360
       get_arg_page+0x34/0xa0
       copy_string_kernel+0x194/0x2a4
       kernel_execve+0x11c/0x298
       call_usermodehelper_exec_async+0x114/0x194

  4. In case zero_pfn has not been initialized yet, zap_pte_range does
     not decrement the MM_ANONPAGES RSS counter and the BUG message is
     triggered shortly afterwards when __mmdrop checks the ref counters:
       __mmdrop+0x98/0x1d0
       free_bprm+0x44/0x118
       kernel_execve+0x160/0x1d8
       call_usermodehelper_exec_async+0x114/0x194
       ret_from_kernel_thread+0x14/0x1c

To avoid races such as described above, initialize init_zero_pfn at
early_initcall level.  Depending on the architecture, ZERO_PAGE is
either constant or gets initialized even earlier, at paging_init, so
there is no issue with initializing zero_pfn earlier.

Link: https://lkml.kernel.org/r/CALCv0x2YqOXEAy2Q=hafjhHCtTHVodChv1qpM=niAXOpqEbt7w@mail.gmail.com
Signed-off-by: Ilya Lipnitskiy <ilya.lipnitskiy@gmail.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: stable@vger.kernel.org
Tested-by: 周琰杰 (Zhou Yanjie) <zhouyanjie@wanyeetech.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-04-07 15:00:10 +02:00
Greg Kroah-Hartman
b9a61f9a56 Merge 5.10.27 into android12-5.10
Changes in 5.10.27
	mm/memcg: rename mem_cgroup_split_huge_fixup to split_page_memcg and add nr_pages argument
	mm/memcg: set memcg when splitting page
	mt76: fix tx skb error handling in mt76_dma_tx_queue_skb
	net: stmmac: fix dma physical address of descriptor when display ring
	net: fec: ptp: avoid register access when ipg clock is disabled
	powerpc/4xx: Fix build errors from mfdcr()
	atm: eni: dont release is never initialized
	atm: lanai: dont run lanai_dev_close if not open
	Revert "r8152: adjust the settings about MAC clock speed down for RTL8153"
	ALSA: hda: ignore invalid NHLT table
	ixgbe: Fix memleak in ixgbe_configure_clsu32
	scsi: ufs: ufs-qcom: Disable interrupt in reset path
	blk-cgroup: Fix the recursive blkg rwstat
	net: tehuti: fix error return code in bdx_probe()
	net: intel: iavf: fix error return code of iavf_init_get_resources()
	sun/niu: fix wrong RXMAC_BC_FRM_CNT_COUNT count
	gianfar: fix jumbo packets+napi+rx overrun crash
	cifs: ask for more credit on async read/write code paths
	gfs2: fix use-after-free in trans_drain
	cpufreq: blacklist Arm Vexpress platforms in cpufreq-dt-platdev
	gpiolib: acpi: Add missing IRQF_ONESHOT
	nfs: fix PNFS_FLEXFILE_LAYOUT Kconfig default
	NFS: Correct size calculation for create reply length
	net: hisilicon: hns: fix error return code of hns_nic_clear_all_rx_fetch()
	net: wan: fix error return code of uhdlc_init()
	net: davicom: Use platform_get_irq_optional()
	net: enetc: set MAC RX FIFO to recommended value
	atm: uPD98402: fix incorrect allocation
	atm: idt77252: fix null-ptr-dereference
	cifs: change noisy error message to FYI
	irqchip/ingenic: Add support for the JZ4760
	kbuild: add image_name to no-sync-config-targets
	kbuild: dummy-tools: fix inverted tests for gcc
	umem: fix error return code in mm_pci_probe()
	sparc64: Fix opcode filtering in handling of no fault loads
	habanalabs: Call put_pid() when releasing control device
	staging: rtl8192e: fix kconfig dependency on CRYPTO
	u64_stats,lockdep: Fix u64_stats_init() vs lockdep
	kselftest: arm64: Fix exit code of sve-ptrace
	regulator: qcom-rpmh: Correct the pmic5_hfsmps515 buck
	block: Fix REQ_OP_ZONE_RESET_ALL handling
	drm/amd/display: Revert dram_clock_change_latency for DCN2.1
	drm/amdgpu: fb BO should be ttm_bo_type_device
	drm/radeon: fix AGP dependency
	nvme: simplify error logic in nvme_validate_ns()
	nvme: add NVME_REQ_CANCELLED flag in nvme_cancel_request()
	nvme-fc: set NVME_REQ_CANCELLED in nvme_fc_terminate_exchange()
	nvme-fc: return NVME_SC_HOST_ABORTED_CMD when a command has been aborted
	nvme-core: check ctrl css before setting up zns
	nvme-rdma: Fix a use after free in nvmet_rdma_write_data_done
	nvme-pci: add the DISABLE_WRITE_ZEROES quirk for a Samsung PM1725a
	nfs: we don't support removing system.nfs4_acl
	block: Suppress uevent for hidden device when removed
	mm/fork: clear PASID for new mm
	ia64: fix ia64_syscall_get_set_arguments() for break-based syscalls
	ia64: fix ptrace(PTRACE_SYSCALL_INFO_EXIT) sign
	static_call: Pull some static_call declarations to the type headers
	static_call: Allow module use without exposing static_call_key
	static_call: Fix the module key fixup
	static_call: Fix static_call_set_init()
	KVM: x86: Protect userspace MSR filter with SRCU, and set atomically-ish
	btrfs: fix sleep while in non-sleep context during qgroup removal
	selinux: don't log MAC_POLICY_LOAD record on failed policy load
	selinux: fix variable scope issue in live sidtab conversion
	netsec: restore phy power state after controller reset
	platform/x86: intel-vbtn: Stop reporting SW_DOCK events
	psample: Fix user API breakage
	z3fold: prevent reclaim/free race for headless pages
	squashfs: fix inode lookup sanity checks
	squashfs: fix xattr id and id lookup sanity checks
	hugetlb_cgroup: fix imbalanced css_get and css_put pair for shared mappings
	kasan: fix per-page tags for non-page_alloc pages
	gcov: fix clang-11+ support
	ACPI: video: Add missing callback back for Sony VPCEH3U1E
	ACPICA: Always create namespace nodes using acpi_ns_create_node()
	arm64: stacktrace: don't trace arch_stack_walk()
	arm64: dts: ls1046a: mark crypto engine dma coherent
	arm64: dts: ls1012a: mark crypto engine dma coherent
	arm64: dts: ls1043a: mark crypto engine dma coherent
	ARM: dts: at91: sam9x60: fix mux-mask for PA7 so it can be set to A, B and C
	ARM: dts: at91: sam9x60: fix mux-mask to match product's datasheet
	ARM: dts: at91-sama5d27_som1: fix phy address to 7
	integrity: double check iint_cache was initialized
	drm/etnaviv: Use FOLL_FORCE for userptr
	drm/amd/pm: workaround for audio noise issue
	drm/amdgpu/display: restore AUX_DPHY_TX_CONTROL for DCN2.x
	drm/amdgpu: Add additional Sienna Cichlid PCI ID
	drm/i915: Fix the GT fence revocation runtime PM logic
	dm verity: fix DM_VERITY_OPTS_MAX value
	dm ioctl: fix out of bounds array access when no devices
	bus: omap_l3_noc: mark l3 irqs as IRQF_NO_THREAD
	ARM: OMAP2+: Fix smartreflex init regression after dropping legacy data
	soc: ti: omap-prm: Fix occasional abort on reset deassert for dra7 iva
	veth: Store queue_mapping independently of XDP prog presence
	bpf: Change inode_storage's lookup_elem return value from NULL to -EBADF
	libbpf: Fix INSTALL flag order
	net/mlx5e: RX, Mind the MPWQE gaps when calculating offsets
	net/mlx5e: When changing XDP program without reset, take refs for XSK RQs
	net/mlx5e: Don't match on Geneve options in case option masks are all zero
	ipv6: fix suspecious RCU usage warning
	drop_monitor: Perform cleanup upon probe registration failure
	macvlan: macvlan_count_rx() needs to be aware of preemption
	net: sched: validate stab values
	net: dsa: bcm_sf2: Qualify phydev->dev_flags based on port
	igc: reinit_locked() should be called with rtnl_lock
	igc: Fix Pause Frame Advertising
	igc: Fix Supported Pause Frame Link Setting
	igc: Fix igc_ptp_rx_pktstamp()
	e1000e: add rtnl_lock() to e1000_reset_task
	e1000e: Fix error handling in e1000_set_d0_lplu_state_82571
	net/qlcnic: Fix a use after free in qlcnic_83xx_get_minidump_template
	net: phy: broadcom: Add power down exit reset state delay
	ftgmac100: Restart MAC HW once
	clk: qcom: gcc-sc7180: Use floor ops for the correct sdcc1 clk
	net: ipa: terminate message handler arrays
	net: qrtr: fix a kernel-infoleak in qrtr_recvmsg()
	flow_dissector: fix byteorder of dissected ICMP ID
	selftests/bpf: Set gopt opt_class to 0 if get tunnel opt failed
	netfilter: ctnetlink: fix dump of the expect mask attribute
	net: hdlc_x25: Prevent racing between "x25_close" and "x25_xmit"/"x25_rx"
	net: phylink: Fix phylink_err() function name error in phylink_major_config
	tipc: better validate user input in tipc_nl_retrieve_key()
	tcp: relookup sock for RST+ACK packets handled by obsolete req sock
	can: isotp: isotp_setsockopt(): only allow to set low level TX flags for CAN-FD
	can: isotp: TX-path: ensure that CAN frame flags are initialized
	can: peak_usb: add forgotten supported devices
	can: flexcan: flexcan_chip_freeze(): fix chip freeze for missing bitrate
	can: kvaser_pciefd: Always disable bus load reporting
	can: c_can_pci: c_can_pci_remove(): fix use-after-free
	can: c_can: move runtime PM enable/disable to c_can_platform
	can: m_can: m_can_do_rx_poll(): fix extraneous msg loss warning
	can: m_can: m_can_rx_peripheral(): fix RX being blocked by errors
	mac80211: fix rate mask reset
	mac80211: Allow HE operation to be longer than expected.
	selftests/net: fix warnings on reuseaddr_ports_exhausted
	nfp: flower: fix unsupported pre_tunnel flows
	nfp: flower: add ipv6 bit to pre_tunnel control message
	nfp: flower: fix pre_tun mask id allocation
	ftrace: Fix modify_ftrace_direct.
	drm/msm/dsi: fix check-before-set in the 7nm dsi_pll code
	ionic: linearize tso skb with too many frags
	net/sched: cls_flower: fix only mask bit check in the validate_ct_state
	netfilter: nftables: report EOPNOTSUPP on unsupported flowtable flags
	netfilter: nftables: allow to update flowtable flags
	netfilter: flowtable: Make sure GC works periodically in idle system
	libbpf: Fix error path in bpf_object__elf_init()
	libbpf: Use SOCK_CLOEXEC when opening the netlink socket
	ARM: dts: imx6ull: fix ubi filesystem mount failed
	ipv6: weaken the v4mapped source check
	octeontx2-af: Formatting debugfs entry rsrc_alloc.
	octeontx2-af: Modify default KEX profile to extract TX packet fields
	octeontx2-af: Remove TOS field from MKEX TX
	octeontx2-af: Fix irq free in rvu teardown
	octeontx2-pf: Clear RSS enable flag on interace down
	octeontx2-af: fix infinite loop in unmapping NPC counter
	net: check all name nodes in __dev_alloc_name
	net: cdc-phonet: fix data-interface release on probe failure
	igb: check timestamp validity
	r8152: limit the RX buffer size of RTL8153A for USB 2.0
	net: stmmac: dwmac-sun8i: Provide TX and RX fifo sizes
	selinux: vsock: Set SID for socket returned by accept()
	selftests: forwarding: vxlan_bridge_1d: Fix vxlan ecn decapsulate value
	libbpf: Fix BTF dump of pointer-to-array-of-struct
	bpf: Fix umd memory leak in copy_process()
	can: isotp: tx-path: zero initialize outgoing CAN frames
	drm/msm: fix shutdown hook in case GPU components failed to bind
	drm/msm: Fix suspend/resume on i.MX5
	arm64: kdump: update ppos when reading elfcorehdr
	PM: runtime: Defer suspending suppliers
	net/mlx5: Add back multicast stats for uplink representor
	net/mlx5e: Allow to match on MPLS parameters only for MPLS over UDP
	net/mlx5e: Offload tuple rewrite for non-CT flows
	net/mlx5e: Fix error path for ethtool set-priv-flag
	PM: EM: postpone creating the debugfs dir till fs_initcall
	net: bridge: don't notify switchdev for local FDB addresses
	octeontx2-af: Fix memory leak of object buf
	xen/x86: make XEN_BALLOON_MEMORY_HOTPLUG_LIMIT depend on MEMORY_HOTPLUG
	RDMA/cxgb4: Fix adapter LE hash errors while destroying ipv6 listening server
	bpf: Don't do bpf_cgroup_storage_set() for kuprobe/tp programs
	net: Consolidate common blackhole dst ops
	net, bpf: Fix ip6ip6 crash with collect_md populated skbs
	igb: avoid premature Rx buffer reuse
	net: axienet: Properly handle PCS/PMA PHY for 1000BaseX mode
	net: axienet: Fix probe error cleanup
	net: phy: introduce phydev->port
	net: phy: broadcom: Avoid forward for bcm54xx_config_clock_delay()
	net: phy: broadcom: Set proper 1000BaseX/SGMII interface mode for BCM54616S
	net: phy: broadcom: Fix RGMII delays for BCM50160 and BCM50610M
	Revert "netfilter: x_tables: Switch synchronization to RCU"
	netfilter: x_tables: Use correct memory barriers.
	dm table: Fix zoned model check and zone sectors check
	mm/mmu_notifiers: ensure range_end() is paired with range_start()
	Revert "netfilter: x_tables: Update remaining dereference to RCU"
	ACPI: scan: Rearrange memory allocation in acpi_device_add()
	ACPI: scan: Use unique number for instance_no
	perf auxtrace: Fix auxtrace queue conflict
	perf synthetic events: Avoid write of uninitialized memory when generating PERF_RECORD_MMAP* records
	io_uring: fix provide_buffers sign extension
	block: recalculate segment count for multi-segment discards correctly
	scsi: Revert "qla2xxx: Make sure that aborted commands are freed"
	scsi: qedi: Fix error return code of qedi_alloc_global_queues()
	scsi: mpt3sas: Fix error return code of mpt3sas_base_attach()
	smb3: fix cached file size problems in duplicate extents (reflink)
	cifs: Adjust key sizes and key generation routines for AES256 encryption
	locking/mutex: Fix non debug version of mutex_lock_io_nested()
	x86/mem_encrypt: Correct physical address calculation in __set_clr_pte_enc()
	mm/memcg: fix 5.10 backport of splitting page memcg
	fs/cachefiles: Remove wait_bit_key layout dependency
	ch_ktls: fix enum-conversion warning
	can: dev: Move device back to init netns on owning netns delete
	r8169: fix DMA being used after buffer free if WoL is enabled
	net: dsa: b53: VLAN filtering is global to all users
	mac80211: fix double free in ibss_leave
	ext4: add reclaim checks to xattr code
	fs/ext4: fix integer overflow in s_log_groups_per_flex
	Revert "xen: fix p2m size in dom0 for disabled memory hotplug case"
	Revert "net: bonding: fix error return code of bond_neigh_init()"
	nvme: fix the nsid value to print in nvme_validate_or_alloc_ns
	can: peak_usb: Revert "can: peak_usb: add forgotten supported devices"
	xen-blkback: don't leak persistent grants from xen_blkbk_map()
	Linux 5.10.27

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I7eafe976fd6bf33db6db4adb8ebf2ff087294a23
2021-04-02 15:25:50 +02:00
Vijayanand Jitta
1430928b8a ANDROID: mm: Make slub_debug global
Make slub_debug a global variable so that it can
be used by the minidump module to reserve memory
for slab owner.

Bug: 177377077
Change-Id: I0548a0f0d7abfa1d2df864669fa3aae443fbd6ec
Signed-off-by: Vijayanand Jitta <vjitta@codeaurora.org>
2021-04-01 00:09:35 +00:00
Vijayanand Jitta
29d1a0e310 ANDROID: mm: Make page_owner_enabled global
Make page_owner_enabled variable global so that it
can be used by the minidump module to reserve memory
for page owner.

Bug: 177374907
Change-Id: Ib6189466c810321d109fa7d32773728215887e84
Signed-off-by: Vijayanand Jitta <vjitta@codeaurora.org>
2021-04-01 00:09:00 +00:00
Georgi Djakov
f8765be36f FROMGIT: mm/page_owner: record the timestamp of all pages during free
Collect the time when each allocation is freed, to help with memory
analysis with kdump/ramdump.  Add the timestamp also in the page_owner
debugfs file and print it in dump_page().

Having another timestamp when we free the page helps for debugging page
migration issues.  For example both alloc and free timestamps being the
same can gave hints that there is an issue with migrating memory, as
opposed to a page just being dropped during migration.

Link: https://lkml.kernel.org/r/20210203175905.12267-1-georgi.djakov@linaro.org
Signed-off-by: Georgi Djakov <georgi.djakov@linaro.org>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Bug: 178721506
(cherry picked from https://lore.kernel.org/mm-commits/20210309004326.M_rrImRZI%25akpm@linux-foundation.org/)

Signed-off-by: Chris Goldsworthy <cgoldswo@codeaurora.org>
Change-Id: I99567a372536b4541ed81378baccecc171f78a72
2021-03-30 18:46:11 +00:00
Georgi Djakov
ed2e69d22b UPSTREAM: mm/page_io: use pr_alert_ratelimited for swap read/write errors
If there are errors during swap read or write, they can easily fill the
log buffer and remove any previous messages that might be useful for
debugging, especially on systems that rely for logging only on the kernel
ring-buffer.

For example, on a systems using zram as swap, we are more likely to see
any page allocation errors preceding the swap write errors if the alerts
are ratelimited.

Link: https://lkml.kernel.org/r/20210201142055.29068-1-georgi.djakov@linaro.org
Signed-off-by: Georgi Djakov <georgi.djakov@linaro.org>
Acked-by: Minchan Kim <minchan@kernel.org>
Reviewed-by: Miaohe Lin <linmiaohe@huawei.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Bug: 178886143
(cherry picked from commit 25eaab438d)

Change-Id: Id9ec7098ee381128090a2aca181baed7f17b9843
Signed-off-by: Chris Goldsworthy <cgoldswo@codeaurora.org>
2021-03-30 18:44:11 +00:00
Hugh Dickins
002ea848d7 mm/memcg: fix 5.10 backport of splitting page memcg
The straight backport of 5.12's e1baddf847 ("mm/memcg: set memcg when
splitting page") works fine in 5.11, but turned out to be wrong for 5.10:
because that relies on a separate flag, which must also be set for the
memcg to be recognized and uncharged and cleared when freeing. Fix that.

Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-03-30 14:32:07 +02:00
Sean Christopherson
de2e6b4e32 mm/mmu_notifiers: ensure range_end() is paired with range_start()
[ Upstream commit c2655835fd ]

If one or more notifiers fails .invalidate_range_start(), invoke
.invalidate_range_end() for "all" notifiers.  If there are multiple
notifiers, those that did not fail are expecting _start() and _end() to
be paired, e.g.  KVM's mmu_notifier_count would become imbalanced.
Disallow notifiers that can fail _start() from implementing _end() so
that it's unnecessary to either track which notifiers rejected _start(),
or had already succeeded prior to a failed _start().

Note, the existing behavior of calling _start() on all notifiers even
after a previous notifier failed _start() was an unintented "feature".
Make it canon now that the behavior is depended on for correctness.

As of today, the bug is likely benign:

  1. The only caller of the non-blocking notifier is OOM kill.
  2. The only notifiers that can fail _start() are the i915 and Nouveau
     drivers.
  3. The only notifiers that utilize _end() are the SGI UV GRU driver
     and KVM.
  4. The GRU driver will never coincide with the i195/Nouveau drivers.
  5. An imbalanced kvm->mmu_notifier_count only causes soft lockup in the
     _guest_, and the guest is already doomed due to being an OOM victim.

Fix the bug now to play nice with future usage, e.g.  KVM has a
potential use case for blocking memslot updates in KVM while an
invalidation is in-progress, and failure to unblock would result in said
updates being blocked indefinitely and hanging.

Found by inspection.  Verified by adding a second notifier in KVM that
periodically returns -EAGAIN on non-blockable ranges, triggering OOM,
and observing that KVM exits with an elevated notifier count.

Link: https://lkml.kernel.org/r/20210311180057.1582638-1-seanjc@google.com
Fixes: 93065ac753 ("mm, oom: distinguish blockable mode for mmu notifiers")
Signed-off-by: Sean Christopherson <seanjc@google.com>
Suggested-by: Jason Gunthorpe <jgg@ziepe.ca>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Ben Gardon <bgardon@google.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: "Jérôme Glisse" <jglisse@redhat.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Dimitri Sivanich <dimitri.sivanich@hpe.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-03-30 14:32:06 +02:00
Miaohe Lin
fe03ccc3ce hugetlb_cgroup: fix imbalanced css_get and css_put pair for shared mappings
commit d85aecf284 upstream.

The current implementation of hugetlb_cgroup for shared mappings could
have different behavior.  Consider the following two scenarios:

 1.Assume initial css reference count of hugetlb_cgroup is 1:
  1.1 Call hugetlb_reserve_pages with from = 1, to = 2. So css reference
      count is 2 associated with 1 file_region.
  1.2 Call hugetlb_reserve_pages with from = 2, to = 3. So css reference
      count is 3 associated with 2 file_region.
  1.3 coalesce_file_region will coalesce these two file_regions into
      one. So css reference count is 3 associated with 1 file_region
      now.

 2.Assume initial css reference count of hugetlb_cgroup is 1 again:
  2.1 Call hugetlb_reserve_pages with from = 1, to = 3. So css reference
      count is 2 associated with 1 file_region.

Therefore, we might have one file_region while holding one or more css
reference counts. This inconsistency could lead to imbalanced css_get()
and css_put() pair. If we do css_put one by one (i.g. hole punch case),
scenario 2 would put one more css reference. If we do css_put all
together (i.g. truncate case), scenario 1 will leak one css reference.

The imbalanced css_get() and css_put() pair would result in a non-zero
reference when we try to destroy the hugetlb cgroup. The hugetlb cgroup
directory is removed __but__ associated resource is not freed. This
might result in OOM or can not create a new hugetlb cgroup in a busy
workload ultimately.

In order to fix this, we have to make sure that one file_region must
hold exactly one css reference. So in coalesce_file_region case, we
should release one css reference before coalescence. Also only put css
reference when the entire file_region is removed.

The last thing to note is that the caller of region_add() will only hold
one reference to h_cg->css for the whole contiguous reservation region.
But this area might be scattered when there are already some
file_regions reside in it. As a result, many file_regions may share only
one h_cg->css reference. In order to ensure that one file_region must
hold exactly one css reference, we should do css_get() for each
file_region and release the reference held by caller when they are done.

[linmiaohe@huawei.com: fix imbalanced css_get and css_put pair for shared mappings]
  Link: https://lkml.kernel.org/r/20210316023002.53921-1-linmiaohe@huawei.com

Link: https://lkml.kernel.org/r/20210301120540.37076-1-linmiaohe@huawei.com
Fixes: 075a61d07a ("hugetlb_cgroup: add accounting for shared mappings")
Reported-by: kernel test robot <lkp@intel.com> (auto build test ERROR)
Signed-off-by: Miaohe Lin <linmiaohe@huawei.com>
Reviewed-by: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Cc: Wanpeng Li <liwp.linux@gmail.com>
Cc: Mina Almasry <almasrymina@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-03-30 14:31:54 +02:00
Thomas Hebb
1d215fcbc4 z3fold: prevent reclaim/free race for headless pages
commit 6d679578fe upstream.

Commit ca0246bb97 ("z3fold: fix possible reclaim races") introduced
the PAGE_CLAIMED flag "to avoid racing on a z3fold 'headless' page
release." By atomically testing and setting the bit in each of
z3fold_free() and z3fold_reclaim_page(), a double-free was avoided.

However, commit dcf5aedb24 ("z3fold: stricter locking and more careful
reclaim") appears to have unintentionally broken this behavior by moving
the PAGE_CLAIMED check in z3fold_reclaim_page() to after the page lock
gets taken, which only happens for non-headless pages.  For headless
pages, the check is now skipped entirely and races can occur again.

I have observed such a race on my system:

    page:00000000ffbd76b7 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x165316
    flags: 0x2ffff0000000000()
    raw: 02ffff0000000000 ffffea0004535f48 ffff8881d553a170 0000000000000000
    raw: 0000000000000000 0000000000000011 00000000ffffffff 0000000000000000
    page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0)
    ------------[ cut here ]------------
    kernel BUG at include/linux/mm.h:707!
    invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI
    CPU: 2 PID: 291928 Comm: kworker/2:0 Tainted: G    B             5.10.7-arch1-1-kasan #1
    Hardware name: Gigabyte Technology Co., Ltd. H97N-WIFI/H97N-WIFI, BIOS F9b 03/03/2016
    Workqueue: zswap-shrink shrink_worker
    RIP: 0010:__free_pages+0x10a/0x130
    Code: c1 e7 06 48 01 ef 45 85 e4 74 d1 44 89 e6 31 d2 41 83 ec 01 e8 e7 b0 ff ff eb da 48 c7 c6 e0 32 91 88 48 89 ef e8 a6 89 f8 ff <0f> 0b 4c 89 e7 e8 fc 79 07 00 e9 33 ff ff ff 48 89 ef e8 ff 79 07
    RSP: 0000:ffff88819a2ffb98 EFLAGS: 00010296
    RAX: 0000000000000000 RBX: ffffea000594c5a8 RCX: 0000000000000000
    RDX: 1ffffd4000b298b7 RSI: 0000000000000000 RDI: ffffea000594c5b8
    RBP: ffffea000594c580 R08: 000000000000003e R09: ffff8881d5520bbb
    R10: ffffed103aaa4177 R11: 0000000000000001 R12: ffffea000594c5b4
    R13: 0000000000000000 R14: ffff888165316000 R15: ffffea000594c588
    FS:  0000000000000000(0000) GS:ffff8881d5500000(0000) knlGS:0000000000000000
    CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    CR2: 00007f7c8c3654d8 CR3: 0000000103f42004 CR4: 00000000001706e0
    Call Trace:
     z3fold_zpool_shrink+0x9b6/0x1240
     shrink_worker+0x35/0x90
     process_one_work+0x70c/0x1210
     worker_thread+0x539/0x1200
     kthread+0x330/0x400
     ret_from_fork+0x22/0x30
    Modules linked in: rfcomm ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter ccm algif_aead des_generic libdes ecb algif_skcipher cmac bnep md4 algif_hash af_alg vfat fat intel_rapl_msr intel_rapl_common x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel iwlmvm hid_logitech_hidpp kvm at24 mac80211 snd_hda_codec_realtek iTCO_wdt snd_hda_codec_generic intel_pmc_bxt snd_hda_codec_hdmi ledtrig_audio iTCO_vendor_support mei_wdt mei_hdcp snd_hda_intel snd_intel_dspcfg libarc4 soundwire_intel irqbypass iwlwifi soundwire_generic_allocation rapl soundwire_cadence intel_cstate snd_hda_codec intel_uncore btusb joydev mousedev snd_usb_audio pcspkr btrtl uvcvideo nouveau btbcm i2c_i801 btintel snd_hda_core videobuf2_vmalloc i2c_smbus snd_usbmidi_lib videobuf2_memops bluetooth snd_hwdep soundwire_bus snd_soc_rt5640 videobuf2_v4l2 cfg80211 snd_soc_rl6231 videobuf2_common snd_rawmidi lpc_ich alx videodev mdio snd_seq_device snd_soc_core mc ecdh_generic mxm_wmi mei_me
     hid_logitech_dj wmi snd_compress e1000e ac97_bus mei ttm rfkill snd_pcm_dmaengine ecc snd_pcm snd_timer snd soundcore mac_hid acpi_pad pkcs8_key_parser it87 hwmon_vid crypto_user fuse ip_tables x_tables ext4 crc32c_generic crc16 mbcache jbd2 dm_crypt cbc encrypted_keys trusted tpm rng_core usbhid dm_mod crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper xhci_pci xhci_pci_renesas i915 video intel_gtt i2c_algo_bit drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops cec drm agpgart
    ---[ end trace 126d646fc3dc0ad8 ]---

To fix the issue, re-add the earlier test and set in the case where we
have a headless page.

Link: https://lkml.kernel.org/r/c8106dbe6d8390b290cd1d7f873a2942e805349e.1615452048.git.tommyhebb@gmail.com
Fixes: dcf5aedb24 ("z3fold: stricter locking and more careful reclaim")
Signed-off-by: Thomas Hebb <tommyhebb@gmail.com>
Reviewed-by: Vitaly Wool <vitaly.wool@konsulko.com>
Cc: Jongseok Kim <ks77sj@gmail.com>
Cc: Snild Dolkow <snild@sony.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-03-30 14:31:54 +02:00
Zhou Guanghui
efb12c03fc mm/memcg: set memcg when splitting page
commit e1baddf847 upstream.

As described in the split_page() comment, for the non-compound high order
page, the sub-pages must be freed individually.  If the memcg of the first
page is valid, the tail pages cannot be uncharged when be freed.

For example, when alloc_pages_exact is used to allocate 1MB continuous
physical memory, 2MB is charged(kmemcg is enabled and __GFP_ACCOUNT is
set).  When make_alloc_exact free the unused 1MB and free_pages_exact free
the applied 1MB, actually, only 4KB(one page) is uncharged.

Therefore, the memcg of the tail page needs to be set when splitting a
page.

Michel:

There are at least two explicit users of __GFP_ACCOUNT with
alloc_exact_pages added recently.  See 7efe8ef274 ("KVM: arm64:
Allocate stage-2 pgd pages with GFP_KERNEL_ACCOUNT") and c419621873
("KVM: s390: Add memcg accounting to KVM allocations"), so this is not
just a theoretical issue.

Link: https://lkml.kernel.org/r/20210304074053.65527-3-zhouguanghui1@huawei.com
Signed-off-by: Zhou Guanghui <zhouguanghui1@huawei.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Shakeel Butt <shakeelb@google.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Hanjun Guo <guohanjun@huawei.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Rui Xiang <rui.xiang@huawei.com>
Cc: Tianhong Ding <dingtianhong@huawei.com>
Cc: Weilong Chen <chenweilong@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-03-30 14:31:47 +02:00
Zhou Guanghui
6143a1d193 mm/memcg: rename mem_cgroup_split_huge_fixup to split_page_memcg and add nr_pages argument
commit be6c8982e4 upstream.

Rename mem_cgroup_split_huge_fixup to split_page_memcg and explicitly pass
in page number argument.

In this way, the interface name is more common and can be used by
potential users.  In addition, the complete info(memcg and flag) of the
memcg needs to be set to the tail pages.

Link: https://lkml.kernel.org/r/20210304074053.65527-2-zhouguanghui1@huawei.com
Signed-off-by: Zhou Guanghui <zhouguanghui1@huawei.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Zi Yan <ziy@nvidia.com>
Reviewed-by: Shakeel Butt <shakeelb@google.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Nicholas Piggin <npiggin@gmail.com>
Cc: Kefeng Wang <wangkefeng.wang@huawei.com>
Cc: Hanjun Guo <guohanjun@huawei.com>
Cc: Tianhong Ding <dingtianhong@huawei.com>
Cc: Weilong Chen <chenweilong@huawei.com>
Cc: Rui Xiang <rui.xiang@huawei.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Hugh Dickins <hughd@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-03-30 14:31:47 +02:00
Greg Kroah-Hartman
99941e23f7 Merge branch 'android12-5.10-lts' into 'android12-5.10'
Updates the branch to the 5.10.26 upstream kernel version.

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I84aa29bf4e4e809051eb346830c4c4b5acb78c8c
2021-03-26 08:25:46 +01:00
Brian Geffon
1d695ccfc6 FROMLIST: mm: Extend MREMAP_DONTUNMAP to non-anonymous mappings
Currently MREMAP_DONTUNMAP only accepts private anonymous mappings.
This restriction was placed initially for simplicity and not because
there exists a technical reason to do so.

This change will widen the support to include any mappings which are not
VM_DONTEXPAND or VM_PFNMAP. The primary use case is to support
MREMAP_DONTUNMAP on mappings which may have been created from a memfd.
This change will result in mremap(MREMAP_DONTUNMAP) returning -EINVAL
if VM_DONTEXPAND or VM_PFNMAP mappings are specified.

Lokesh Gidra who works on the Android JVM, provided an explanation of how
such a feature will improve Android JVM garbage collection:
"Android is developing a new garbage collector (GC), based on userfaultfd.
The garbage collector will use userfaultfd (uffd) on the java heap during
compaction. On accessing any uncompacted page, the application threads will
find it missing, at which point the thread will create the compacted page
and then use UFFDIO_COPY ioctl to get it mapped and then resume execution.
Before starting this compaction, in a stop-the-world pause the heap will be
mremap(MREMAP_DONTUNMAP) so that the java heap is ready to receive
UFFD_EVENT_PAGEFAULT events after resuming execution.

To speedup mremap operations, pagetable movement was optimized by moving
PUD entries instead of PTE entries [1]. It was necessary as mremap of even
modest sized memory ranges also took several milliseconds, and stopping the
application for that long isn't acceptable in response-time sensitive
cases.

With UFFDIO_CONTINUE feature [2], it will be even more efficient to
implement this GC, particularly the 'non-moveable' portions of the heap.
It will also help in reducing the need to copy (UFFDIO_COPY) the pages.
However, for this to work, the java heap has to be on a 'shared' vma.
Currently MREMAP_DONTUNMAP only supports private anonymous mappings, this
patch will enable using UFFDIO_CONTINUE for the new userfaultfd-based heap
compaction."

[1] https://lore.kernel.org/linux-mm/20201215030730.NC3CU98e4%25akpm@linux-foundation.org/
[2] https://lore.kernel.org/linux-mm/20210302000133.272579-1-axelrasmussen@google.com/

Signed-off-by: Brian Geffon <bgeffon@google.com>
Acked-by: Hugh Dickins <hughd@google.com>
Tested-by: Lokesh Gidra <lokeshgidra@google.com>
Reviewed-by: Dmitry Safonov <0x7f454c46@gmail.com>

Signed-off-by: Lokesh Gidra <lokeshgidra@google.com>
Link: https://lore.kernel.org/patchwork/patch/1401224/
Bug: 160737021
Bug: 169683130
Change-Id: Ic4f023dff404d7b0e35adbe92c7a12536aa0f70d
2021-03-25 22:44:44 +00:00
Minchan Kim
2cf6f07bf0 ANDROID: make cma_sysfs experimental
Since it's not stable until it could be merged into Linus's tree
lets make it as experimental. If a vendor want to use it, they
should carry on cma_sysfs.experimental=Y on kernel parameter.
Otherwise, it will be disabled.
If some vendor enables it, it means they know this is experimental
faeture so Android never guarantee it in the future.

Bug: 179256052
Signed-off-by: Minchan Kim <minchan@google.com>
Change-Id: Ic6566197a7865dfcab6964d008103d3686c9d14b
2021-03-25 19:20:18 +00:00
Minchan Kim
a590359259 FROMLIST: mm: cma: support sysfs
Since CMA is getting used more widely, it's more important to
keep monitoring CMA statistics for system health since it's
directly related to user experience.

This patch introduces sysfs statistics for CMA, in order to provide
some basic monitoring of the CMA allocator.

 * the number of CMA page successful allocations
 * the number of CMA page allocation failures

These two values allow the user to calcuate the allocation
failure rate for each CMA area.

e.g.)
  /sys/kernel/mm/cma/WIFI/alloc_pages_[success|fail]
  /sys/kernel/mm/cma/SENSOR/alloc_pages_[success|fail]
  /sys/kernel/mm/cma/BLUETOOTH/alloc_pages_[success|fail]

The cma_stat was intentionally allocated by dynamic allocation
to harmonize with kobject lifetime management.
https://lore.kernel.org/linux-mm/YCOAmXqt6dZkCQYs@kroah.com/

Link: https://lore.kernel.org/linux-mm/20210324230759.2213957-1-minchan@kernel.org/
Bug: 179256052
Tested-by: Dmitry Osipenko <digetx@gmail.com>
Reviewed-by: Dmitry Osipenko <digetx@gmail.com>
Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Reviewed-by: John Hubbard <jhubbard@nvidia.com>
Link: https://lore.kernel.org/linux-mm/20210316100433.17665-1-colin.king@canonical.com/
Addresses-Coverity: ("Dereference after null check")
Signed-off-by: Colin Ian King <colin.king@canonical.com>
Signed-off-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Minchan Kim <minchan@google.com>
Change-Id: I86239db91c7853a62a22b2161d1bf8c9099152b7
2021-03-25 19:20:09 +00:00
Walter Wu
f176a3f463 FROMGIT: kasan: record task_work_add() call stack
Why record task_work_add() call stack?  Syzbot reports many use-after-free
issues for task_work, see [1].  After seeing the free stack and the
current auxiliary stack, we think they are useless, we don't know where
the work was registered.  This work may be the free call stack, so we miss
the root cause and don't solve the use-after-free.

Add the task_work_add() call stack into the KASAN auxiliary stack in order
to improve KASAN reports.  It helps programmers solve use-after-free
issues.

[1]: https://groups.google.com/g/syzkaller-bugs/search?q=kasan%20use-after-free%20task_work_run

Link: https://lkml.kernel.org/r/20210316024410.19967-1-walter-zh.wu@mediatek.com
Signed-off-by: Walter Wu <walter-zh.wu@mediatek.com>
Suggested-by: Dmitry Vyukov <dvyukov@google.com>
Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Reviewed-by: Jens Axboe <axboe@kernel.dk>
Acked-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Matthias Brugger <matthias.bgg@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 357e2e021b3a5c473b43a5a4d752139564bf27b8
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Bug: 182930667
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: I38b2e1856ba9605bcdf0fb4fd4a7031596c8fe4a
2021-03-24 15:09:18 -07:00
Andrey Konovalov
24690d7d25 FROMGIT: kasan, mm: integrate slab init_on_free with HW_TAGS
This change uses the previously added memory initialization feature of
HW_TAGS KASAN routines for slab memory when init_on_free is enabled.

With this change, memory initialization memset() is no longer called when
both HW_TAGS KASAN and init_on_free are enabled.  Instead, memory is
initialized in KASAN runtime.

For SLUB, the memory initialization memset() is moved into
slab_free_hook() that currently directly follows the initialization loop.
A new argument is added to slab_free_hook() that indicates whether to
initialize the memory or not.

To avoid discrepancies with which memory gets initialized that can be
caused by future changes, both KASAN hook and initialization memset() are
put together and a warning comment is added.

Combining setting allocation tags with memory initialization improves
HW_TAGS KASAN performance when init_on_free is enabled.

Link: https://lkml.kernel.org/r/190fd15c1886654afdec0d19ebebd5ade665b601.1615296150.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Marco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Branislav Rankov <Branislav.Rankov@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Kevin Brodsky <kevin.brodsky@arm.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Peter Collingbourne <pcc@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 6b548c253039de9a1658bb4c38e13e963f06489d
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Bug: 182930667
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: I3bdfe966b27dc93964ad38c9a8385ca744932307
2021-03-24 15:09:18 -07:00
Andrey Konovalov
5a7af11e34 FROMGIT: kasan, mm: integrate slab init_on_alloc with HW_TAGS
This change uses the previously added memory initialization feature of
HW_TAGS KASAN routines for slab memory when init_on_alloc is enabled.

With this change, memory initialization memset() is no longer called when
both HW_TAGS KASAN and init_on_alloc are enabled.  Instead, memory is
initialized in KASAN runtime.

The memory initialization memset() is moved into slab_post_alloc_hook()
that currently directly follows the initialization loop.  A new argument
is added to slab_post_alloc_hook() that indicates whether to initialize
the memory or not.

To avoid discrepancies with which memory gets initialized that can be
caused by future changes, both KASAN hook and initialization memset() are
put together and a warning comment is added.

Combining setting allocation tags with memory initialization improves
HW_TAGS KASAN performance when init_on_alloc is enabled.

Link: https://lkml.kernel.org/r/c1292aeb5d519da221ec74a0684a949b027d7720.1615296150.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Marco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Branislav Rankov <Branislav.Rankov@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Kevin Brodsky <kevin.brodsky@arm.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Peter Collingbourne <pcc@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit c7948d4407ed85251c6de1a09589e69e4072abb4
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Bug: 182930667
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: I257917062e2cc5bfb3dbb46508200c30631a00a3
2021-03-24 15:09:18 -07:00
Andrey Konovalov
a15989497e FROMGIT: kasan, mm: integrate page_alloc init with HW_TAGS
This change uses the previously added memory initialization feature of
HW_TAGS KASAN routines for page_alloc memory when init_on_alloc/free is
enabled.

With this change, kernel_init_free_pages() is no longer called when both
HW_TAGS KASAN and init_on_alloc/free are enabled.  Instead, memory is
initialized in KASAN runtime.

To avoid discrepancies with which memory gets initialized that can be
caused by future changes, both KASAN and kernel_init_free_pages() hooks
are put together and a warning comment is added.

This patch changes the order in which memory initialization and page
poisoning hooks are called.  This doesn't lead to any side-effects, as
whenever page poisoning is enabled, memory initialization gets disabled.

Combining setting allocation tags with memory initialization improves
HW_TAGS KASAN performance when init_on_alloc/free is enabled.

Link: https://lkml.kernel.org/r/e77f0d5b1b20658ef0b8288625c74c2b3690e725.1615296150.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Marco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Branislav Rankov <Branislav.Rankov@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Kevin Brodsky <kevin.brodsky@arm.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Peter Collingbourne <pcc@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 26a7ee1a170e0bc17505d04120e595cba0b9cc1b
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Bug: 182930667
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: Iac6cf801657c260b15ec9ef49bd1b02dc83660bc
2021-03-24 15:09:18 -07:00
Mike Rapoport
9538c5a8c5 FROMGIT: mm: introduce debug_pagealloc_{map,unmap}_pages() helpers
Patch series "arch, mm: improve robustness of direct map manipulation", v7.

During recent discussion about KVM protected memory, David raised a
concern about usage of __kernel_map_pages() outside of DEBUG_PAGEALLOC
scope [1].

Indeed, for architectures that define CONFIG_ARCH_HAS_SET_DIRECT_MAP it is
possible that __kernel_map_pages() would fail, but since this function is
void, the failure will go unnoticed.

Moreover, there's lack of consistency of __kernel_map_pages() semantics
across architectures as some guard this function with #ifdef
DEBUG_PAGEALLOC, some refuse to update the direct map if page allocation
debugging is disabled at run time and some allow modifying the direct map
regardless of DEBUG_PAGEALLOC settings.

This set straightens this out by restoring dependency of
__kernel_map_pages() on DEBUG_PAGEALLOC and updating the call sites
accordingly.

Since currently the only user of __kernel_map_pages() outside
DEBUG_PAGEALLOC is hibernation, it is updated to make direct map accesses
there more explicit.

[1] https://lore.kernel.org/lkml/2759b4bf-e1e3-d006-7d86-78a40348269d@redhat.com

This patch (of 4):

When CONFIG_DEBUG_PAGEALLOC is enabled, it unmaps pages from the kernel
direct mapping after free_pages().  The pages than need to be mapped back
before they could be used.  Theese mapping operations use
__kernel_map_pages() guarded with with debug_pagealloc_enabled().

The only place that calls __kernel_map_pages() without checking whether
DEBUG_PAGEALLOC is enabled is the hibernation code that presumes
availability of this function when ARCH_HAS_SET_DIRECT_MAP is set.  Still,
on arm64, __kernel_map_pages() will bail out when DEBUG_PAGEALLOC is not
enabled but set_direct_map_invalid_noflush() may render some pages not
present in the direct map and hibernation code won't be able to save such
pages.

To make page allocation debugging and hibernation interaction more robust,
the dependency on DEBUG_PAGEALLOC or ARCH_HAS_SET_DIRECT_MAP has to be
made more explicit.

Start with combining the guard condition and the call to
__kernel_map_pages() into debug_pagealloc_map_pages() and
debug_pagealloc_unmap_pages() functions to emphasize that
__kernel_map_pages() should not be called without DEBUG_PAGEALLOC and use
these new functions to map/unmap pages when page allocation debugging is
enabled.

Link: https://lkml.kernel.org/r/20201109192128.960-1-rppt@kernel.org
Link: https://lkml.kernel.org/r/20201109192128.960-2-rppt@kernel.org
Signed-off-by: Mike Rapoport <rppt@linux.ibm.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Cc: Albert Ou <aou@eecs.berkeley.edu>
Cc: Andy Lutomirski <luto@kernel.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Borislav Petkov <bp@alien8.de>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Christian Borntraeger <borntraeger@de.ibm.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Dave Hansen <dave.hansen@linux.intel.com>
Cc: David Rientjes <rientjes@google.com>
Cc: "Edgecombe, Rick P" <rick.p.edgecombe@intel.com>
Cc: "H. Peter Anvin" <hpa@zytor.com>
Cc: Heiko Carstens <hca@linux.ibm.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Len Brown <len.brown@intel.com>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Paul Walmsley <paul.walmsley@sifive.com>
Cc: Pavel Machek <pavel@ucw.cz>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: "Rafael J. Wysocki" <rjw@rjwysocki.net>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: Will Deacon <will@kernel.org>
Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

(cherry picked from commit 77bc7fd607
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Bug: 182930667
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: I9f0dac574bc3a7ea7d88bff051b77eca19610ce9
2021-03-24 15:09:17 -07:00
Vlastimil Babka
fa44968ac4 FROMGIT: mm, page_poison: remove CONFIG_PAGE_POISONING_ZERO
CONFIG_PAGE_POISONING_ZERO uses the zero pattern instead of 0xAA.  It was
introduced by commit 1414c7f4f7 ("mm/page_poisoning.c: allow for zero
poisoning"), noting that using zeroes retains the benefit of sanitizing
content of freed pages, with the benefit of not having to zero them again
on alloc, and the downside of making some forms of corruption (stray
writes of NULLs) harder to detect than with the 0xAA pattern.  Together
with CONFIG_PAGE_POISONING_NO_SANITY it made possible to sanitize the
contents on free without checking it back on alloc.

These days we have the init_on_free() option to achieve sanitization with
zeroes and to save clearing on alloc (and without checking on alloc).
Arguably if someone does choose to check the poison for corruption on
alloc, the savings of not clearing the page are secondary, and it makes
sense to always use the 0xAA poison pattern.  Thus, remove the
CONFIG_PAGE_POISONING_ZERO option for being redundant.

Link: https://lkml.kernel.org/r/20201113104033.22907-6-vbabka@suse.cz
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Laura Abbott <labbott@kernel.org>
Cc: Mateusz Nosek <mateusznosek0@gmail.com>
Cc: Michal Hocko <mhocko@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

(cherry picked from commit f289041ed4
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Bug: 182930667
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: I57e19d1dd77d3d5eec40f94c1b64a877c3710baa
2021-03-24 15:09:17 -07:00
David Hildenbrand
ca96c45d7a FROMGIT: mm/page_alloc: clear all pages in post_alloc_hook() with init_on_alloc=1
commit 6471384af2 ("mm: security: introduce init_on_alloc=1 and
init_on_free=1 boot options") resulted with init_on_alloc=1 in all pages
leaving the buddy via alloc_pages() and friends to be
initialized/cleared/zeroed on allocation.

However, the same logic is currently not applied to alloc_contig_pages():
allocated pages leaving the buddy aren't cleared with init_on_alloc=1 and
init_on_free=0.  Let's also properly clear pages on that allocation path.

To achieve that, let's move clearing into post_alloc_hook().  This will
not only affect alloc_contig_pages() allocations but also any pages used
as migration target in compaction code via compaction_alloc().

While this sounds sub-optimal, it's the very same handling as when
allocating migration targets via alloc_migration_target() - pages will get
properly cleared with init_on_free=1.  In case we ever want to optimize
migration in that regard, we should tackle all such migration users - if
we believe migration code can be fully trusted.

With this change, we will see double clearing of pages in some cases.  One
example are gigantic pages (either allocated via CMA, or allocated
dynamically via alloc_contig_pages()) - which is the right thing to do
(and to be optimized outside of the buddy in the callers) as discussed in:
https://lkml.kernel.org/r/20201019182853.7467-1-gpiccoli@canonical.com

This change implies that with init_on_alloc=1

 - All CMA allocations will be cleared

 - Gigantic pages allocated via alloc_contig_pages() will be cleared

 - virtio-mem memory to be unplugged will be cleared. While this is
   suboptimal, it's similar to memory balloon drivers handling, where
   all pages to be inflated will get cleared as well.

 - Pages isolated for compaction will be cleared

Link: https://lkml.kernel.org/r/20201120180452.19071-1-david@redhat.com
Signed-off-by: David Hildenbrand <david@redhat.com>
Acked-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Mike Kravetz <mike.kravetz@oracle.com>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: Oscar Salvador <osalvador@suse.de>
Cc: Kees Cook <keescook@chromium.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

(cherry picked from commit 862b6dee20
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Bug: 182930667
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: Ie400a475598a5fae888d6bad32f32355a2d153b7
2021-03-24 15:09:17 -07:00
Vlastimil Babka
07f5a281d6 FROMGIT: mm, page_poison: remove CONFIG_PAGE_POISONING_NO_SANITY
CONFIG_PAGE_POISONING_NO_SANITY skips the check on page alloc whether the
poison pattern was corrupted, suggesting a use-after-free.  The motivation
to introduce it in commit 8823b1dbc0 ("mm/page_poison.c: enable
PAGE_POISONING as a separate option") was to simply sanitize freed pages,
optimally together with CONFIG_PAGE_POISONING_ZERO.

These days we have an init_on_free=1 boot option, which makes this use
case of page poisoning redundant.  For sanitizing, writing zeroes is
sufficient, there is pretty much no benefit from writing the 0xAA poison
pattern to freed pages, without checking it back on alloc.  Thus, remove
this option and suggest init_on_free instead in the main config's help.

Link: https://lkml.kernel.org/r/20201113104033.22907-5-vbabka@suse.cz
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: David Hildenbrand <david@redhat.com>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Laura Abbott <labbott@kernel.org>
Cc: Mateusz Nosek <mateusznosek0@gmail.com>
Cc: Michal Hocko <mhocko@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

(cherry picked from commit 8f424750ba
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Bug: 182930667
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: I2ecd65191b6954db33d22df9cab0eb11bd934b8a
2021-03-24 15:09:17 -07:00
Vlastimil Babka
a2bbfa414c FROMGIT: kernel/power: allow hibernation with page_poison sanity checking
Page poisoning used to be incompatible with hibernation, as the state of
poisoned pages was lost after resume, thus enabling CONFIG_HIBERNATION
forces CONFIG_PAGE_POISONING_NO_SANITY.  For the same reason, the
poisoning with zeroes variant CONFIG_PAGE_POISONING_ZERO used to disable
hibernation.  The latter restriction was removed by commit 1ad1410f63
("PM / Hibernate: allow hibernation with PAGE_POISONING_ZERO") and
similarly for init_on_free by commit 18451f9f9e ("PM: hibernate: fix
crashes with init_on_free=1") by making sure free pages are cleared after
resume.

We can use the same mechanism to instead poison free pages with
PAGE_POISON after resume.  This covers both zero and 0xAA patterns.  Thus
we can remove the Kconfig restriction that disables page poison sanity
checking when hibernation is enabled.

Link: https://lkml.kernel.org/r/20201113104033.22907-4-vbabka@suse.cz
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Acked-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>	[hibernation]
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Laura Abbott <labbott@kernel.org>
Cc: Mateusz Nosek <mateusznosek0@gmail.com>
Cc: Michal Hocko <mhocko@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

(cherry picked from commit 03b6c9a3e8
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Bug: 182930667
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: Ieea49ebb4d3eeddd18eb2040f13b8121978facca
2021-03-24 15:09:16 -07:00
Vlastimil Babka
e871c7feeb FROMGIT: mm, page_poison: use static key more efficiently
Commit 11c9c7edae ("mm/page_poison.c: replace bool variable with static
key") changed page_poisoning_enabled() to a static key check.  However,
the function is not inlined, so each check still involves a function call
with overhead not eliminated when page poisoning is disabled.

Analogically to how debug_pagealloc is handled, this patch converts
page_poisoning_enabled() back to boolean check, and introduces
page_poisoning_enabled_static() for fast paths.  Both functions are
inlined.

The function kernel_poison_pages() is also called unconditionally and does
the static key check inside.  Remove it from there and put it to callers.
Also split it to two functions kernel_poison_pages() and
kernel_unpoison_pages() instead of the confusing bool parameter.

Also optimize the check that enables page poisoning instead of
debug_pagealloc for architectures without proper debug_pagealloc support.
Move the check to init_mem_debugging_and_hardening() to enable a single
static key instead of having two static branches in
page_poisoning_enabled_static().

Link: https://lkml.kernel.org/r/20201113104033.22907-3-vbabka@suse.cz
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Reviewed-by: David Hildenbrand <david@redhat.com>
Cc: Mike Rapoport <rppt@linux.ibm.com>
Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Laura Abbott <labbott@kernel.org>
Cc: Mateusz Nosek <mateusznosek0@gmail.com>
Cc: Michal Hocko <mhocko@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

(cherry picked from commit 8db26a3d47
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Bug: 182930667
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: Ifc3fdf5cd58f3b8346bf81480df3836811e7458b
2021-03-24 15:09:16 -07:00
Vlastimil Babka
0879d44ddd BACKPORT: mm, page_alloc: do not rely on the order of page_poison and init_on_alloc/free parameters
Patch series "cleanup page poisoning", v3.

I have identified a number of issues and opportunities for cleanup with
CONFIG_PAGE_POISON and friends:

 - interaction with init_on_alloc and init_on_free parameters depends on
   the order of parameters (Patch 1)

 - the boot time enabling uses static key, but inefficienty (Patch 2)

 - sanity checking is incompatible with hibernation (Patch 3)

 - CONFIG_PAGE_POISONING_NO_SANITY can be removed now that we have
   init_on_free (Patch 4)

 - CONFIG_PAGE_POISONING_ZERO can be most likely removed now that we
   have init_on_free (Patch 5)

This patch (of 5):

Enabling page_poison=1 together with init_on_alloc=1 or init_on_free=1
produces a warning in dmesg that page_poison takes precedence.  However,
as these warnings are printed in early_param handlers for
init_on_alloc/free, they are not printed if page_poison is enabled later
on the command line (handlers are called in the order of their
parameters), or when init_on_alloc/free is always enabled by the
respective config option - before the page_poison early param handler is
called, it is not considered to be enabled.  This is inconsistent.

We can remove the dependency on order by making the init_on_* parameters
only set a boolean variable, and postponing the evaluation after all early
params have been processed.  Introduce a new
init_mem_debugging_and_hardening() function for that, and move the related
debug_pagealloc processing there as well.

As a result init_mem_debugging_and_hardening() knows always accurately if
init_on_* and/or page_poison options were enabled.  Thus we can also
optimize want_init_on_alloc() and want_init_on_free().  We don't need to
check page_poisoning_enabled() there, we can instead not enable the
init_on_* static keys at all, if page poisoning is enabled.  This results
in a simpler and more effective code.

Link: https://lkml.kernel.org/r/20201113104033.22907-1-vbabka@suse.cz
Link: https://lkml.kernel.org/r/20201113104033.22907-2-vbabka@suse.cz
Signed-off-by: Vlastimil Babka <vbabka@suse.cz>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Mike Rapoport <rppt@linux.ibm.com>
Cc: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: Mateusz Nosek <mateusznosek0@gmail.com>
Cc: Laura Abbott <labbott@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

(cherry picked from commit 04013513cc
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Bug: 182930667
[glider: resolved a minor conflict in init/main.c - API change]
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: I6c0ffcb0d8e2f56a688986aa1dc201adf89de067
2021-03-24 15:09:16 -07:00
Andrey Konovalov
7186ac0c43 FROMGIT: kasan: init memory in kasan_(un)poison for HW_TAGS
This change adds an argument to kasan_poison() and kasan_unpoison() that
allows initializing memory along with setting the tags for HW_TAGS.

Combining setting allocation tags with memory initialization will improve
HW_TAGS KASAN performance when init_on_alloc/free is enabled.

This change doesn't integrate memory initialization with KASAN, this is
done is subsequent patches in this series.

Link: https://lkml.kernel.org/r/3054314039fa64510947e674180d675cab1b4c41.1615296150.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Marco Elver <elver@google.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Branislav Rankov <Branislav.Rankov@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Kevin Brodsky <kevin.brodsky@arm.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Peter Collingbourne <pcc@google.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit b5feba92b2290c2216281d2863891d587d131d06
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Bug: 182930667
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: Ie28bfd789f67a02901c2dd42b115a1c24d89e9da
2021-03-24 15:09:16 -07:00
Andrey Konovalov
0de58767b7 FROMGIT: arm64: kasan: allow to init memory when setting tags
Patch series "kasan: integrate with init_on_alloc/free", v3.

This patch series integrates HW_TAGS KASAN with init_on_alloc/free by
initializing memory via the same arm64 instruction that sets memory tags.

This is expected to improve HW_TAGS KASAN performance when
init_on_alloc/free is enabled.  The exact perfomance numbers are unknown
as MTE-enabled hardware doesn't exist yet.

This patch (of 5):

This change adds an argument to mte_set_mem_tag_range() that allows to
enable memory initialization when settinh the allocation tags.  The
implementation uses stzg instruction instead of stg when this argument
indicates to initialize memory.

Combining setting allocation tags with memory initialization will improve
HW_TAGS KASAN performance when init_on_alloc/free is enabled.

This change doesn't integrate memory initialization with KASAN, this is
done is subsequent patches in this series.

Link: https://lkml.kernel.org/r/cover.1615296150.git.andreyknvl@google.com
Link: https://lkml.kernel.org/r/d04ae90cc36be3fe246ea8025e5085495681c3d7.1615296150.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Marco Elver <elver@google.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: David Rientjes <rientjes@google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Peter Collingbourne <pcc@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Branislav Rankov <Branislav.Rankov@arm.com>
Cc: Kevin Brodsky <kevin.brodsky@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 75393a0acbc3c0fd2307622ef2b1d49e5f64916a
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Bug: 182930667
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: I986bcd4a94e6d75793dab04fcca2f2e9e3ebc4f9
2021-03-24 15:09:15 -07:00
Andrey Konovalov
e1675ffaf8 FROMGIT: mm, kasan: don't poison boot memory with tag-based modes
During boot, all non-reserved memblock memory is exposed to page_alloc via
memblock_free_pages->__free_pages_core().  This results in
kasan_free_pages() being called, which poisons that memory.

Poisoning all that memory lengthens boot time.  The most noticeable effect
is observed with the HW_TAGS mode.  A boot-time impact may potentially
also affect systems with large amount of RAM.

This patch changes the tag-based modes to not poison the memory during the
memblock->page_alloc transition.

An exception is made for KASAN_GENERIC.  Since it marks all new memory as
accessible, not poisoning the memory released from memblock will lead to
KASAN missing invalid boot-time accesses to that memory.

With KASAN_SW_TAGS, as it uses the invalid 0xFE tag as the default tag for
all memory, it won't miss bad boot-time accesses even if the poisoning of
memblock memory is removed.

With KASAN_HW_TAGS, the default memory tags values are unspecified.
Therefore, if memblock poisoning is removed, this KASAN mode will miss the
mentioned type of boot-time bugs with a 1/16 probability.  This is taken
as an acceptable trafe-off.

Internally, the poisoning is removed as follows.  __free_pages_core() is
used when exposing fresh memory during system boot and when onlining
memory during hotplug.  This patch adds a new FPI_SKIP_KASAN_POISON flag
and passes it to __free_pages_ok() through free_pages_prepare() from
__free_pages_core().  If FPI_SKIP_KASAN_POISON is set, kasan_free_pages()
is not called.

All memory allocated normally when the boot is over keeps getting poisoned
as usual.

Link: https://lkml.kernel.org/r/a0570dc1e3a8f39a55aa343a1fc08cd5c2d4cad6.1613692950.git.andreyknvl@google.com
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Reviewed-by: Catalin Marinas <catalin.marinas@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Peter Collingbourne <pcc@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Branislav Rankov <Branislav.Rankov@arm.com>
Cc: Kevin Brodsky <kevin.brodsky@arm.com>
Cc: Christoph Hellwig <hch@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit d07a05953b6067f4295dc1a81ee4cda10615f784
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Bug: 182930667
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: I3b26994bb3e2b9d8e85d001d817a37892bf0477c
2021-03-24 15:09:15 -07:00
Zhiyuan Dai
fcf7fb524a FROMGIT: mm/kasan: switch from strlcpy to strscpy
strlcpy is marked as deprecated in Documentation/process/deprecated.rst,
and there is no functional difference when the caller expects truncation
(when not checking the return value).  strscpy is relatively better as it
also avoids scanning the whole source string.

Link: https://lkml.kernel.org/r/1613970647-23272-1-git-send-email-daizhiyuan@phytium.com.cn
Signed-off-by: Zhiyuan Dai <daizhiyuan@phytium.com.cn>
Acked-by: Alexander Potapenko <glider@google.com>
Reviewed-by: Andrey Konovalov <andreyknvl@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit e5bbe620e7a10d60161638cb0feece9466c8f511
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Bug: 182930667
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: I34a961043c1d0505e67547f1200d768e4f82a851
2021-03-24 15:09:15 -07:00
Walter Wu
86a1ff2750 BACKPORT: kasan: remove redundant config option
CONFIG_KASAN_STACK and CONFIG_KASAN_STACK_ENABLE both enable KASAN stack
instrumentation, but we should only need one config, so that we remove
CONFIG_KASAN_STACK_ENABLE and make CONFIG_KASAN_STACK workable.  see [1].

When enable KASAN stack instrumentation, then for gcc we could do no
prompt and default value y, and for clang prompt and default value n.

[1]: https://bugzilla.kernel.org/show_bug.cgi?id=210221

Link: https://lkml.kernel.org/r/20210226012531.29231-1-walter-zh.wu@mediatek.com
Signed-off-by: Walter Wu <walter-zh.wu@mediatek.com>
Suggested-by: Dmitry Vyukov <dvyukov@google.com>
Reviewed-by: Nathan Chancellor <natechancellor@gmail.com>
Acked-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Andrey Ryabinin <ryabinin.a.a@gmail.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Alexander Potapenko <glider@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

(cherry picked from commit 3bc29a8e251a9469ce69e62118d70eaf0caa5acb
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
(cherry picked from commit 0d9e60b66271414a18a1d4f1fe2c923245f1e3a8
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
[glider: resolved a minor merge conflict, squashed two patches together]

Bug: 182930667
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: I1b3d2cdcf45727a25d36ac7f417a4f026152d6a8
2021-03-24 15:09:15 -07:00
Andrey Konovalov
23ba14e38e FROMGIT: kasan, mm: fix crash with HW_TAGS and DEBUG_PAGEALLOC
Currently, kasan_free_nondeferred_pages()->kasan_free_pages() is called
after debug_pagealloc_unmap_pages(). This causes a crash when
debug_pagealloc is enabled, as HW_TAGS KASAN can't set tags on an
unmapped page.

This patch puts kasan_free_nondeferred_pages() before
debug_pagealloc_unmap_pages() and arch_free_page(), which can also make
the page unavailable.

Link: https://lkml.kernel.org/r/24cd7db274090f0e5bc3adcdc7399243668e3171.1614987311.git.andreyknvl@google.com
Fixes: 94ab5b61ee ("kasan, arm64: enable CONFIG_KASAN_HW_TAGS")
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Marco Elver <elver@google.com>
Cc: Peter Collingbourne <pcc@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Branislav Rankov <Branislav.Rankov@arm.com>
Cc: Kevin Brodsky <kevin.brodsky@arm.com>
Cc: Christoph Hellwig <hch@infradead.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

(cherry picked from commit f9d79e8dce
 https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git akpm)
Bug: 182930667
Signed-off-by: Alexander Potapenko <glider@google.com>
Change-Id: Iab88e1e7ab63e6e5ec4b5e0160baf16e0335ee9e
2021-03-24 15:09:14 -07:00
Minchan Kim
a0a0b3f42e FROMLIST: mm: fs: Invalidate BH LRU during page migration
Pages containing buffer_heads that are in one of the per-CPU
buffer_head LRU caches will be pinned and thus cannot be migrated.
This can prevent CMA allocations from succeeding, which are often used
on platforms with co-processors (such as a DSP) that can only use
physically contiguous memory. It can also prevent memory
hot-unplugging from succeeding, which involves migrating at least
MIN_MEMORY_BLOCK_SIZE bytes of memory, which ranges from 8 MiB to 1
GiB based on the architecture in use.

Correspondingly, invalidate the BH LRU caches before a migration
starts and stop any buffer_head from being cached in the LRU caches,
until migration has finished.

Bug: 180018981
Link: https://lore.kernel.org/linux-mm/20210319175127.886124-3-minchan@kernel.org/
Tested-by: Oliver Sang <oliver.sang@intel.com>
Reported-by: kernel test robot <oliver.sang@intel.com>
Signed-off-by: Chris Goldsworthy <cgoldswo@codeaurora.org>
Signed-off-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Minchan Kim <minchan@google.com>
Change-Id: Idb8279cb561812f5f1b43ddbb742c1808700754e
2021-03-23 04:05:31 +00:00
Minchan Kim
c6bc1396ce FROMLIST: mm: replace migrate_[prep|finish] with lru_cache_[disable|enable]
Currently, migrate_[prep|finish] is merely a wrapper of
lru_cache_[disable|enable]. There is not much to gain from
having additional abstraction.

Use lru_cache_[disable|enable] instead of migrate_[prep|finish],
which would be more descriptive.

note: migrate_prep_local in compaction.c changed into lru_add_drain
to avoid CPU schedule cost with involving many other CPUs to keep
keep old behavior.

Bug: 180018981
Link: https://lore.kernel.org/linux-mm/20210319175127.886124-2-minchan@kernel.org/
Acked-by: Michal Hocko <mhocko@suse.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Minchan Kim <minchan@google.com>
Change-Id: I2f298c9ff53c8693527f1207ff25ab76a4ac3ada
2021-03-23 04:05:24 +00:00
Minchan Kim
68a4731181 BACKPORT: FROMLIST: mm: disable LRU pagevec during the migration temporarily
LRU pagevec holds refcount of pages until the pagevec are drained.
It could prevent migration since the refcount of the page is greater
than the expection in migration logic. To mitigate the issue,
callers of migrate_pages drains LRU pagevec via migrate_prep or
lru_add_drain_all before migrate_pages call.

However, it's not enough because pages coming into pagevec after the
draining call still could stay at the pagevec so it could keep
preventing page migration. Since some callers of migrate_pages have
retrial logic with LRU draining, the page would migrate at next trail
but it is still fragile in that it doesn't close the fundamental race
between upcoming LRU pages into pagvec and migration so the migration
failure could cause contiguous memory allocation failure in the end.

To close the race, this patch disables lru caches(i.e, pagevec)
during ongoing migration until migrate is done.

Since it's really hard to reproduce, I measured how many times
migrate_pages retried with force mode(it is about a fallback to a
sync migration) with below debug code.

int migrate_pages(struct list_head *from, new_page_t get_new_page,
			..
			..

if (rc && reason == MR_CONTIG_RANGE && pass > 2) {
       printk(KERN_ERR, "pfn 0x%lx reason %d\n", page_to_pfn(page), rc);
       dump_page(page, "fail to migrate");
}

The test was repeating android apps launching with cma allocation
in background every five seconds. Total cma allocation count was
about 500 during the testing. With this patch, the dump_page count
was reduced from 400 to 30.

The new interface is also useful for memory hotplug which currently
drains lru pcp caches after each migration failure. This is rather
suboptimal as it has to disrupt others running during the operation.
With the new interface the operation happens only once. This is also in
line with pcp allocator cache which are disabled for the offlining as
well.

Bug: 180018981
Link: https://lore.kernel.org/linux-mm/20210319175127.886124-1-minchan@kernel.org/
Reviewed-by: Chris Goldsworthy <cgoldswo@codeaurora.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Signed-off-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Minchan Kim <minchan@google.com>
Change-Id: I838c63d11ca49a8734d8b37a7d5272ab6b802f9f
2021-03-23 04:05:15 +00:00
Minchan Kim
d3c1bf42af Revert "FROMLIST: mm: replace migrate_prep with lru_add_drain_all"
This reverts commit 134ac2d4dc.

Bug: 180018981
Signed-off-by: Minchan Kim <minchan@google.com>
Change-Id: I579c72398447f770c235e4fefd246f1dbbd250d0
2021-03-23 04:05:07 +00:00
Minchan Kim
7ed55d7025 Revert "BACKPORT: FROMLIST: mm: disable LRU pagevec during the migration temporarily"
This reverts commit 3039d8580c.

Bug: 180018981
Signed-off-by: Minchan Kim <minchan@google.com>
Change-Id: Iadadd7f4c7aafa439afd7a1c3e575e5e31602bef
2021-03-23 04:04:58 +00:00