12466 Commits

Author SHA1 Message Date
qctecmdr
f052c13ba7 Merge "mm : retry for reclaim if lmk kill is possible" 2019-03-28 04:48:38 -07:00
qctecmdr Service
b552aaf68a Merge "Merge android-4.14-p.105 (e742253) into msm-4.14" 2019-03-22 17:41:41 -07:00
Blagovest Kolenichev
57c2bb95b7 Merge android-4.14-p.105 (e742253) into msm-4.14
* refs/heads/tmp-e742253:
  Linux 4.14.105
  x86/uaccess: Don't leak the AC flag into __put_user() value evaluation
  MIPS: eBPF: Fix icache flush end address
  MIPS: fix truncation in __cmpxchg_small for short values
  mm: enforce min addr even if capable() in expand_downwards()
  mmc: sdhci-esdhc-imx: correct the fix of ERR004536
  mmc: tmio: fix access width of Block Count Register
  mmc: tmio_mmc_core: don't claim spurious interrupts
  mmc: spi: Fix card detection during probe
  powerpc: Always initialize input array when calling epapr_hypercall()
  KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1
  svm: Fix AVIC incomplete IPI emulation
  cfg80211: extend range deviation for DMG
  mac80211: Add attribute aligned(2) to struct 'action'
  mac80211: don't initiate TDLS connection if station is not associated to AP
  ibmveth: Do not process frames after calling napi_reschedule
  net: dev_is_mac_header_xmit() true for ARPHRD_RAWIP
  net: usb: asix: ax88772_bind return error when hw_reset fail
  hv_netvsc: Fix ethtool change hash key error
  net: altera_tse: fix connect_local_phy error path
  scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state()
  writeback: synchronize sync(2) against cgroup writeback membership switches
  direct-io: allow direct writes to empty inodes
  staging: android: ion: Support cpu access during dma_buf_detach
  serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling
  drm/amd/powerplay: OD setting fix on Vega10
  locking/rwsem: Fix (possible) missed wakeup
  futex: Fix (possible) missed wakeup
  sched/wait: Fix rcuwait_wake_up() ordering
  mac80211: fix miscounting of ttl-dropped frames
  staging: rtl8723bs: Fix build error with Clang when inlining is disabled
  drivers: thermal: int340x_thermal: Fix sysfs race condition
  ARC: fix __ffs return value to avoid build warnings
  selftests: gpio-mockup-chardev: Check asprintf() for error
  selftests: seccomp: use LDLIBS instead of LDFLAGS
  ASoC: imx-audmux: change snprintf to scnprintf for possible overflow
  ASoC: dapm: change snprintf to scnprintf for possible overflow
  genirq: Make sure the initial affinity is not empty
  usb: gadget: Potential NULL dereference on allocation error
  usb: dwc3: gadget: Fix the uninitialized link_state when udc starts
  usb: dwc3: gadget: synchronize_irq dwc irq in suspend
  thermal: int340x_thermal: Fix a NULL vs IS_ERR() check
  clk: vc5: Abort clock configuration without upstream clock
  ASoC: Variable "val" in function rt274_i2c_probe() could be uninitialized
  ALSA: compress: prevent potential divide by zero bugs
  ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field
  drm/msm: Unblock writer if reader closes file
  scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached
  net: stmmac: Disable ACS Feature for GMAC >= 4
  net: stmmac: Fix reception of Broadcom switches tags
  Revert "loop: Fold __loop_release into loop_release"
  Revert "loop: Get rid of loop_index_mutex"
  Revert "loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl()"
  FROMGIT: binder: create node flag to request sender's security context

  Modify include/uapi/linux/android/binder.h, as commit:

  FROMGIT: binder: create node flag to request sender's security context

  introduces enums and structures, which are already defined in other
  userspace files that include the binder uapi file. Thus, the
  redeclaration of these enums and structures can lead to
  build errors. To avoid this, guard the redundant declarations
  in the uapi header with the __KERNEL__ header guard, so they
  are not exported to userspace.

Conflicts:
	drivers/gpu/drm/msm/msm_rd.c
	drivers/staging/android/ion/ion.c
	include/uapi/linux/android/binder.h
	sound/core/compress_offload.c

Change-Id: I5d470f222a6a1baa284813a11f847cfcbe6ee0a6
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
2019-03-20 16:37:04 -07:00
qctecmdr Service
51a60975fa Merge "ion: add ion pages to NR_UNRECLAIMABLE_PAGES" 2019-03-20 10:11:16 -07:00
qctecmdr Service
58d8e26bdd Merge "mm: show number of vmalloc pages in /proc/meminfo" 2019-03-20 10:11:15 -07:00
Vijayanand Jitta
76c3218c3c mm : retry for reclaim if lmk kill is possible
should_reclaim_retry could result in premature oom if there
are large number of unaccounted(eg: kgsl and ion pages), and
no reclaimable pages, held by positive adj tasks which will be
freed upon lmk kill. so, retry for reclaim when lmk kill is
possible to avoid premature oom.

Change-Id: I7f6be53e3b1ffdf282c74d68a103134c1da9b7cc
Signed-off-by: Vijayanand Jitta <vjitta@codeaurora.org>
2019-03-20 18:56:08 +05:30
Roman Gushchin
fd7f993edf mm: show number of vmalloc pages in /proc/meminfo
Vmalloc() is getting more and more used these days (kernel stacks,
bpf and percpu allocator are new top users), and the total %
of memory consumed by vmalloc() can be pretty significant
and changes dynamically.

/proc/meminfo is the best place to display this information:
its top goal is to show top consumers of the memory.

Since the VmallocUsed field in /proc/meminfo is not in use
for quite a long time (it has been defined to 0 by the
commit a5ad88ce8c7f ("mm: get rid of 'vmalloc_info' from
/proc/meminfo")), let's reuse it for showing the actual
physical memory consumption of vmalloc().

Change-Id: Ice4fd4b94c9c156b463487aaef033a8f8c3aa821
Signed-off-by: Roman Gushchin <guro@fb.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Patch-mainline: linux-mm @ Mon, 25 Feb 2019 12:30:37 -0800
Signed-off-by: Vijayanand Jitta <vjitta@codeaurora.org>
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
2019-03-19 22:53:38 -07:00
Vijayanand Jitta
1f1ecb4423 mm: introduce NR_UNRECLAIMABLE_PAGES
Introduce NR_UNRECLAIMABLE_PAGES memory counter which accounts
the pages that cannot be reclaimed under memory pressure.

Change-Id: I9afe50537b0d3c2e7ffc07916b23cce4329e3679
Signed-off-by: Vijayanand Jitta <vjitta@codeaurora.org>
2019-03-19 22:50:10 -07:00
Dave Chinner
1fd42a26cc Revert "mm: slowly shrink slabs with a relatively small number of objects"
This reverts commit 172b06c32b9497 ("mm: slowly shrink slabs with a
relatively small number of objects").

This change changes the agressiveness of shrinker reclaim, causing small
cache and low priority reclaim to greatly increase scanning pressure on
small caches.  As a result, light memory pressure has a disproportionate
affect on small caches, and causes large caches to be reclaimed much
faster than previously.

As a result, it greatly perturbs the delicate balance of the VFS caches
(dentry/inode vs file page cache) such that the inode/dentry caches are
reclaimed much, much faster than the page cache and this drives us into
several other caching imbalance related problems.

As such, this is a bad change and needs to be reverted.

[ Needs some massaging to retain the later seekless shrinker
  modifications.]

Change-Id: Icf1ce6d396cb08d4a4236b08bf714696ac151a91
Link: http://lkml.kernel.org/r/20190130041707.27750-3-david@fromorbit.com
Fixes: 172b06c32b9497 ("mm: slowly shrink slabs with a relatively small number of objects")
Signed-off-by: Dave Chinner <dchinner@redhat.com>
Cc: Wolfgang Walter <linux@stwm.de>
Cc: Roman Gushchin <guro@fb.com>
Cc: Spock <dairinin@gmail.com>
Cc: Rik van Riel <riel@surriel.com>
Cc: Michal Hocko <mhocko@kernel.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-Commit: a9a238e83fbb0df31c3b9b67003f8f9d1d1b6c96
Git-Repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
2019-03-19 18:31:24 +05:30
qctecmdr Service
637e9cd0d1 Merge "filemap-drop-the-mmap_sem-for-all-blocking-operations-fix" 2019-03-17 09:15:11 -07:00
qctecmdr Service
43d508e486 Merge "mm, oom: check LMK enabled for pagefault_out_of_memory()" 2019-03-16 19:59:00 -07:00
qctecmdr Service
f3b8bbbaf2 Merge "filemap: drop the mmap_sem for all blocking operations" 2019-03-14 05:18:35 -07:00
qctecmdr Service
87b811fc25 Merge "Merge android-4.14-p.104 (1912b02) into msm-4.14" 2019-03-08 04:23:20 -08:00
qctecmdr Service
0a1341254d Merge "Merge android-4.14-p.103 (d38adba) into msm-4.14" 2019-03-06 04:22:49 -08:00
Prakash Gupta
94c0e1ab2c mm, oom: check LMK enabled for pagefault_out_of_memory()
Rely on LMK to reclaim memory and avoid OOM, when out of memory
condition is detected in a pagefault.

Change-Id: Icfdaa51d7cfb0dfe9a665bcff23357101b15f421
Signed-off-by: Prakash Gupta <guptap@codeaurora.org>
2019-03-06 14:10:36 +05:30
Greg Kroah-Hartman
e742253322 This is the 4.14.105 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlx+qpsACgkQONu9yGCS
 aT6+Aw//WiHXgsyk+jnwuOzJ0rvx38ky6l7RRm6uZ5r2M+aYQJ12FEc+AVomyu6T
 lA7ciLeIWNQFO0xQJ5Tg8LMPumL4JbA/EVElPu5h5yHMXySkQuC6WLXnH083d+dZ
 QbXEk6O9xuIxbk2sy58BmQnmqdXipTnpNIXpT/137Rlz1/jzxyv8PpsihitFI9/C
 3HrMHgSodKEOnZbWdruYv30Ac6nMrWolGmGaQiRszE7FfoFLyGl3KEX7kp6sMAKU
 P4L+9qUDswRVs4Zfa07XiNlXAmZUYDzZPkQVstsgKOmXNHtBrSLE94pYllsHqW8C
 GDbtW5+ZpUm89LObhlZWPcxLXQkOUJUOb2SJChtaPUmOT0rEoExTB0bH1SADQM5d
 Mb3jLGD9CVrCjgxB4J6871xeCZPIL1XIXEKs0lDz7YDOSF7WTYXTrQOAiA+PZLlR
 VcD7WO7Z25XYP15WcU4ypzswsLPGro3QQi/nzk9qyh/NQt65LlpW/USZ3hiyp/Sh
 u4Wh2rrvAWyrOi01ShRmn87S9X/IuzB9cuzthxM7rWrF+/uj+vHOQp+/BAEFkkub
 njis6oFbkB2xfykRA99w1tLe6to3qNcWFtJuOBxjVFdbB24pqIWYmj4dwyE0TQCD
 7QLfDCXx3vBDAg30Qbxx4Bh2w0ruggtHWa+D24Qz4YehJv1ppNY=
 =Ofi4
 -----END PGP SIGNATURE-----

Merge 4.14.105 into android-4.14-p

Changes in 4.14.105
	Revert "loop: Fix double mutex_unlock(&loop_ctl_mutex) in loop_control_ioctl()"
	Revert "loop: Get rid of loop_index_mutex"
	Revert "loop: Fold __loop_release into loop_release"
	net: stmmac: Fix reception of Broadcom switches tags
	net: stmmac: Disable ACS Feature for GMAC >= 4
	scsi: libsas: Fix rphy phy_identifier for PHYs with end devices attached
	drm/msm: Unblock writer if reader closes file
	ASoC: Intel: Haswell/Broadwell: fix setting for .dynamic field
	ALSA: compress: prevent potential divide by zero bugs
	ASoC: Variable "val" in function rt274_i2c_probe() could be uninitialized
	clk: vc5: Abort clock configuration without upstream clock
	thermal: int340x_thermal: Fix a NULL vs IS_ERR() check
	usb: dwc3: gadget: synchronize_irq dwc irq in suspend
	usb: dwc3: gadget: Fix the uninitialized link_state when udc starts
	usb: gadget: Potential NULL dereference on allocation error
	genirq: Make sure the initial affinity is not empty
	ASoC: dapm: change snprintf to scnprintf for possible overflow
	ASoC: imx-audmux: change snprintf to scnprintf for possible overflow
	selftests: seccomp: use LDLIBS instead of LDFLAGS
	selftests: gpio-mockup-chardev: Check asprintf() for error
	ARC: fix __ffs return value to avoid build warnings
	drivers: thermal: int340x_thermal: Fix sysfs race condition
	staging: rtl8723bs: Fix build error with Clang when inlining is disabled
	mac80211: fix miscounting of ttl-dropped frames
	sched/wait: Fix rcuwait_wake_up() ordering
	futex: Fix (possible) missed wakeup
	locking/rwsem: Fix (possible) missed wakeup
	drm/amd/powerplay: OD setting fix on Vega10
	serial: fsl_lpuart: fix maximum acceptable baud rate with over-sampling
	staging: android: ion: Support cpu access during dma_buf_detach
	direct-io: allow direct writes to empty inodes
	writeback: synchronize sync(2) against cgroup writeback membership switches
	scsi: csiostor: fix NULL pointer dereference in csio_vport_set_state()
	net: altera_tse: fix connect_local_phy error path
	hv_netvsc: Fix ethtool change hash key error
	net: usb: asix: ax88772_bind return error when hw_reset fail
	net: dev_is_mac_header_xmit() true for ARPHRD_RAWIP
	ibmveth: Do not process frames after calling napi_reschedule
	mac80211: don't initiate TDLS connection if station is not associated to AP
	mac80211: Add attribute aligned(2) to struct 'action'
	cfg80211: extend range deviation for DMG
	svm: Fix AVIC incomplete IPI emulation
	KVM: nSVM: clear events pending from svm_complete_interrupts() when exiting to L1
	powerpc: Always initialize input array when calling epapr_hypercall()
	mmc: spi: Fix card detection during probe
	mmc: tmio_mmc_core: don't claim spurious interrupts
	mmc: tmio: fix access width of Block Count Register
	mmc: sdhci-esdhc-imx: correct the fix of ERR004536
	mm: enforce min addr even if capable() in expand_downwards()
	MIPS: fix truncation in __cmpxchg_small for short values
	MIPS: eBPF: Fix icache flush end address
	x86/uaccess: Don't leak the AC flag into __put_user() value evaluation
	Linux 4.14.105

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-03-05 18:03:29 +01:00
Jann Horn
f581706924 mm: enforce min addr even if capable() in expand_downwards()
commit 0a1d52994d440e21def1c2174932410b4f2a98a1 upstream.

security_mmap_addr() does a capability check with current_cred(), but
we can reach this code from contexts like a VFS write handler where
current_cred() must not be used.

This can be abused on systems without SMAP to make NULL pointer
dereferences exploitable again.

Fixes: 8869477a49c3 ("security: protect from stack expansion into low vm addresses")
Cc: stable@kernel.org
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-05 17:58:02 +01:00
Tejun Heo
494c4399ef writeback: synchronize sync(2) against cgroup writeback membership switches
[ Upstream commit 7fc5854f8c6efae9e7624970ab49a1eac2faefb1 ]

sync_inodes_sb() can race against cgwb (cgroup writeback) membership
switches and fail to writeback some inodes.  For example, if an inode
switches to another wb while sync_inodes_sb() is in progress, the new
wb might not be visible to bdi_split_work_to_wbs() at all or the inode
might jump from a wb which hasn't issued writebacks yet to one which
already has.

This patch adds backing_dev_info->wb_switch_rwsem to synchronize cgwb
switch path against sync_inodes_sb() so that sync_inodes_sb() is
guaranteed to see all the target wbs and inodes can't jump wbs to
escape syncing.

v2: Fixed misplaced rwsem init.  Spotted by Jiufei.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Jiufei Xue <xuejiufei@gmail.com>
Link: http://lkml.kernel.org/r/dc694ae2-f07f-61e1-7097-7c8411cee12d@gmail.com
Acked-by: Jan Kara <jack@suse.cz>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-03-05 17:58:01 +01:00
Blagovest Kolenichev
7ab08b2ef4 Merge android-4.14-p.104 (1912b02) into msm-4.14
* refs/heads/tmp-1912b02:
  Linux 4.14.104
  net: phylink: avoid resolving link state too early
  sched/sysctl: Fix attributes of some extern declarations
  phy: tegra: remove redundant self assignment of 'map'
  pinctrl: max77620: Use define directive for max77620_pinconf_param values
  netfilter: ipv6: Don't preserve original oif for loopback address
  netfilter: nft_compat: use-after-free when deleting targets
  netfilter: nf_tables: fix flush after rule deletion in the same batch
  Revert "bridge: do not add port to router list when receives query with source 0.0.0.0"
  net: avoid false positives in untrusted gso validation
  net: validate untrusted gso packets without csum offload
  drm/i915/fbdev: Actually configure untiled displays
  ARC: define ARCH_SLAB_MINALIGN = 8
  ARC: U-boot: check arguments paranoidly
  ARCv2: Enable unaligned access in early ASM code
  parisc: Fix ptrace syscall number modification
  KEYS: always initialize keyring_index_key::desc_len
  KEYS: user: Align the payload buffer
  RDMA/srp: Rework SCSI device reset handling
  inet_diag: fix reporting cgroup classid and fallback to priority
  net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames
  sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach()
  team: avoid complex list operations in team_nl_cmd_options_set()
  sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment
  net: sfp: do not probe SFP module before we're attached
  net/packet: fix 4gb buffer limit due to overflow check
  net/mlx5e: Don't overwrite pedit action when multiple pedit used
  ipv6: propagate genlmsg_reply return code
  batman-adv: fix uninit-value in batadv_interface_tx()
  isdn: avm: Fix string plus integer warning from Clang
  net/mlx5e: Fix wrong (zero) TX drop counter indication for representor
  mlxsw: spectrum_switchdev: Do not treat static FDB entries as sticky
  bpf: bpf_setsockopt: reset sock dst on SO_MARK changes
  leds: lp5523: fix a missing check of return value of lp55xx_read
  hwmon: (tmp421) Correct the misspelling of the tmp442 compatible attribute in OF device ID table
  atm: he: fix sign-extension overflow on large shift
  drm/meson: add missing of_node_put
  always clear the X2APIC_ENABLE bit for PV guest
  scsi: qedi: Add ep_state for login completion on un-reachable targets
  scsi: ufs: Fix system suspend status
  isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
  net: stmmac: Fix PCI module removal leak
  bpf: correctly set initial window on active Fast Open sender
  MIPS: jazz: fix 64bit build
  scsi: isci: initialize shost fully before calling scsi_add_host()
  scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param
  netfilter: nf_tables: fix leaking object reference count
  MIPS: ath79: Enable OF serial ports in the default config
  net: hns: Fix use after free identified by SLUB debug
  qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory barrier
  qed: Fix qed_chain_set_prod() for PBL chains with non power of 2 page count
  xen/pvcalls: remove set but not used variable 'intf'
  mfd: mc13xxx: Fix a missing check of a register-read failure
  mfd: tps65218: Use devm_regmap_add_irq_chip and clean up error path in probe()
  mfd: wm5110: Add missing ASRC rate register
  mfd: qcom_rpm: write fw_version to CTRL_REG
  mfd: bd9571mwv: Add volatile register to make DVFS work
  mfd: ab8500-core: Return zero in get_register_interruptible()
  mfd: mt6397: Do not call irq_domain_remove if PMIC unsupported
  mfd: db8500-prcmu: Fix some section annotations
  mfd: twl-core: Fix section annotations on {,un}protect_pm_master
  pvcalls-back: set -ENOTCONN in pvcalls_conn_back_read
  mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells
  KEYS: allow reaching the keys quotas exactly
  proc, oom: do not report alien mms when setting oom_score_adj
  numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES
  ceph: avoid repeatedly adding inode to mdsc->snap_flush_list
  libceph: handle an empty authorize reply
  mac80211: Free mpath object when rhashtable insertion fails
  mac80211: Restore vif beacon interval if start ap fails
  MIPS: eBPF: Always return sign extended 32b values
  tracing: Fix number of entries in trace header
  ARM: 8834/1: Fix: kprobes: optimized kprobes illegal instruction

Change-Id: Iaa9dd7842d9c83e5bfd7ea15e7d772fe0ce92438
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
2019-03-01 11:14:49 -08:00
Blagovest Kolenichev
f1b30ef999 Merge android-4.14-p.99 (b952da4) into msm-4.14
* refs/heads/tmp-b952da4:
  Revert "iommu/arm-smmu: Add support for qcom,smmu-v2 variant"
  Linux 4.14.99
  ath9k: dynack: check da->enabled first in sampling routines
  ath9k: dynack: make ewma estimation faster
  perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu()
  IB/hfi1: Add limit test for RC/UC send via loopback
  nfsd4: catch some false session retries
  nfsd4: fix cached replies to solo SEQUENCE compounds
  serial: 8250_pci: Make PCI class test non fatal
  serial: fix race between flush_to_ldisc and tty_open
  perf tests evsel-tp-sched: Fix bitwise operator
  perf/core: Don't WARN() for impossible ring-buffer sizes
  x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out()
  perf/x86/intel/uncore: Add Node ID mask
  cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM
  KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221)
  kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)
  KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)
  scsi: aic94xx: fix module loading
  scsi: cxlflash: Prevent deadlock when adapter probe fails
  staging: speakup: fix tty-operation NULL derefs
  usb: gadget: musb: fix short isoc packets with inventra dma
  usb: gadget: udc: net2272: Fix bitwise and boolean operations
  usb: dwc3: gadget: Handle 0 xfer length for OUT EP
  usb: phy: am335x: fix race condition in _probe
  irqchip/gic-v3-its: Plug allocation race for devices sharing a DevID
  futex: Handle early deadlock return correctly
  dmaengine: imx-dma: fix wrong callback invoke
  dmaengine: bcm2835: Fix abort of transactions
  dmaengine: bcm2835: Fix interrupt race on RT
  fuse: handle zero sized retrieve correctly
  fuse: decrement NR_WRITEBACK_TEMP on the right page
  fuse: call pipe_buf_release() under pipe lock
  ALSA: hda - Serialize codec registrations
  ALSA: compress: Fix stop handling on compressed capture streams
  net: dsa: slave: Don't propagate flag changes on down slave interfaces
  net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames
  net: systemport: Fix WoL with password after deep sleep
  rds: fix refcount bug in rds_sock_addref
  skge: potential memory corruption in skge_get_regs()
  rxrpc: bad unlock balance in rxrpc_recvmsg
  net: dp83640: expire old TX-skb
  enic: fix checksum validation for IPv6
  dccp: fool proof ccid_hc_[rt]x_parse_options()
  thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set
  scripts/gdb: fix lx-version string output
  exec: load_script: don't blindly truncate shebang string
  fs/epoll: drop ovflist branch prediction
  kernel/hung_task.c: force console verbose before panic
  proc/sysctl: fix return error for proc_doulongvec_minmax()
  kernel/hung_task.c: break RCU locks based on jiffies
  HID: lenovo: Add checks to fix of_led_classdev_register
  thermal: generic-adc: Fix adc to temp interpolation
  kdb: Don't back trace on a cpu that didn't round up
  thermal: bcm2835: enable hwmon explicitly
  block/swim3: Fix -EBUSY error when re-opening device after unmount
  fsl/fman: Use GFP_ATOMIC in {memac,tgec}_add_hash_mac_address()
  gdrom: fix a memory leak bug
  isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw()
  ocfs2: improve ocfs2 Makefile
  ocfs2: don't clear bh uptodate for block read
  scripts/decode_stacktrace: only strip base path when a prefix of the path
  cgroup: fix parsing empty mount option string
  f2fs: fix sbi->extent_list corruption issue
  niu: fix missing checks of niu_pci_eeprom_read
  um: Avoid marking pages with "changed protection"
  cifs: check ntwrk_buf_start for NULL before dereferencing it
  MIPS: ralink: Select CONFIG_CPU_MIPSR2_IRQ_VI on MT7620/8
  crypto: ux500 - Use proper enum in hash_set_dma_transfer
  crypto: ux500 - Use proper enum in cryp_set_dma_transfer
  seq_buf: Make seq_buf_puts() null-terminate the buffer
  hwmon: (lm80) fix a missing check of bus read in lm80 probe
  hwmon: (lm80) fix a missing check of the status of SMBus read
  NFS: nfs_compare_mount_options always compare auth flavors.
  kvm: Change offset in kvm_write_guest_offset_cached to unsigned
  powerpc/fadump: Do not allow hot-remove memory from fadump reserved area.
  KVM: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported
  pinctrl: meson: meson8b: fix the GPIO function for the GPIOAO pins
  pinctrl: meson: meson8: fix the GPIO function for the GPIOAO pins
  powerpc/mm: Fix reporting of kernel execute faults on the 8xx
  fbdev: fbcon: Fix unregister crash when more than one framebuffer
  ACPI/APEI: Clear GHES block_status before panic()
  igb: Fix an issue that PME is not enabled during runtime suspend
  i40e: define proper net_device::neigh_priv_len
  fbdev: fbmem: behave better with small rotated displays and many CPUs
  md: fix raid10 hang issue caused by barrier
  video: clps711x-fb: release disp device node in probe()
  drbd: Avoid Clang warning about pointless switch statment
  drbd: skip spurious timeout (ping-timeo) when failing promote
  drbd: disconnect, if the wrong UUIDs are attached on a connected peer
  drbd: narrow rcu_read_lock in drbd_sync_handshake
  powerpc/perf: Fix thresholding counter data for unknown type
  cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()
  scsi: smartpqi: increase fw status register read timeout
  scsi: smartpqi: correct volume status
  scsi: smartpqi: correct host serial num for ssa
  mlxsw: spectrum: Properly cleanup LAG uppers when removing port from LAG
  Bluetooth: Fix unnecessary error message for HCI request completion
  xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi
  mac80211: fix radiotap vendor presence bitmap handling
  powerpc/uaccess: fix warning/error with access_ok()
  percpu: convert spin_lock_irq to spin_lock_irqsave.
  usb: musb: dsps: fix otg state machine
  arm64: KVM: Skip MMIO insn after emulation
  perf probe: Fix unchecked usage of strncpy()
  perf header: Fix unchecked usage of strncpy()
  perf test: Fix perf_event_attr test failure
  tty: serial: samsung: Properly set flags in autoCTS mode
  mmc: sdhci-xenon: Fix timeout checks
  mmc: sdhci-of-esdhc: Fix timeout checks
  memstick: Prevent memstick host from getting runtime suspended during card detection
  mmc: bcm2835: reset host on timeout
  mmc: bcm2835: Recover from MMC_SEND_EXT_CSD
  KVM: PPC: Book3S: Only report KVM_CAP_SPAPR_TCE_VFIO on powernv machines
  ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M
  ARM: pxa: avoid section mismatch warning
  selftests/bpf: use __bpf_constant_htons in test_prog.c
  switchtec: Fix SWITCHTEC_IOCTL_EVENT_IDX_ALL flags overwrite
  udf: Fix BUG on corrupted inode
  phy: sun4i-usb: add support for missing USB PHY index
  i2c-axxia: check for error conditions first
  OPP: Use opp_table->regulators to verify no regulator case
  cpuidle: big.LITTLE: fix refcount leak
  clk: imx6sl: ensure MMDC CH0 handshake is bypassed
  sata_rcar: fix deferred probing
  iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer
  iommu/arm-smmu: Add support for qcom,smmu-v2 variant
  usb: dwc3: gadget: Disable CSP for stream OUT ep
  watchdog: renesas_wdt: don't set divider while watchdog is running
  ARM: dts: Fix up the D-Link DIR-685 MTD partition info
  media: coda: fix H.264 deblocking filter controls
  mips: bpf: fix encoding bug for mm_srlv32_op
  ARM: dts: Fix OMAP4430 SDP Ethernet startup
  iommu/amd: Fix amd_iommu=force_isolation
  pinctrl: sx150x: handle failure case of devm_kstrdup
  usb: dwc3: trace: add missing break statement to make compiler happy
  IB/hfi1: Unreserve a reserved request when it is completed
  kobject: return error code if writing /sys/.../uevent fails
  driver core: Move async_synchronize_full call
  clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all audio module clocks
  usb: mtu3: fix the issue about SetFeature(U1/U2_Enable)
  timekeeping: Use proper seqcount initializer
  usb: hub: delay hub autosuspend if USB3 port is still link training
  usb: dwc3: Correct the logic for checking TRB full in __dwc3_prepare_one_trb()
  smack: fix access permissions for keyring
  media: DaVinci-VPBE: fix error handling in vpbe_initialize()
  x86/fpu: Add might_fault() to user_insn()
  ARM: dts: mmp2: fix TWSI2
  arm64: ftrace: don't adjust the LR value
  s390/zcrypt: improve special ap message cmd handling
  firmware/efi: Add NULL pointer checks in efivars API functions
  Thermal: do not clear passive state during system sleep
  arm64: io: Ensure value passed to __iormb() is held in a 64-bit register
  drm: Clear state->acquire_ctx before leaving drm_atomic_helper_commit_duplicated_state()
  nfsd4: fix crash on writing v4_end_grace before nfsd startup
  soc: bcm: brcmstb: Don't leak device tree node reference
  sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN
  arm64: io: Ensure calls to delay routines are ordered against prior readX()
  i2c: sh_mobile: add support for r8a77990 (R-Car E3)
  f2fs: fix wrong return value of f2fs_acl_create
  f2fs: fix race between write_checkpoint and write_begin
  f2fs: move dir data flush to write checkpoint process
  staging: pi433: fix potential null dereference
  ACPI: SPCR: Consider baud rate 0 as preconfigured state
  media: adv*/tc358743/ths8200: fill in min width/height/pixelclock
  iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID
  iio: adc: meson-saradc: fix internal clock names
  iio: adc: meson-saradc: check for devm_kasprintf failure
  dmaengine: xilinx_dma: Remove __aligned attribute on zynqmp_dma_desc_ll
  ptp: Fix pass zero to ERR_PTR() in ptp_clock_register
  media: mtk-vcodec: Release device nodes in mtk_vcodec_init_enc_pm()
  soc/tegra: Don't leak device tree node reference
  perf tools: Add Hygon Dhyana support
  modpost: validate symbol names also in find_elf_symbol
  net/mlx5: EQ, Use the right place to store/read IRQ affinity hint
  ARM: OMAP2+: hwmod: Fix some section annotations
  drm/rockchip: fix for mailbox read size
  usbnet: smsc95xx: fix rx packet alignment
  staging: iio: ad7780: update voltage on read
  platform/chrome: don't report EC_MKBP_EVENT_SENSOR_FIFO as wakeup
  Tools: hv: kvp: Fix a warning of buffer overflow with gcc 8.0.1
  fpga: altera-cvp: Fix registration for CvP incapable devices
  staging:iio:ad2s90: Make probe handle spi_setup failure
  MIPS: Boston: Disable EG20T prefetch
  ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl
  serial: fsl_lpuart: clear parity enable bit when disable parity
  drm/vc4: ->x_scaling[1] should never be set to VC4_SCALING_NONE
  crypto: aes_ti - disable interrupts while accessing S-box
  powerpc/pseries: add of_node_put() in dlpar_detach_node()
  x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux)
  dlm: Don't swamp the CPU with callbacks queued during recovery
  clk: boston: fix possible memory leak in clk_boston_setup()
  ARM: 8808/1: kexec:offline panic_smp_self_stop CPU
  scsi: lpfc: Fix LOGO/PLOGI handling when triggerd by ABTS Timeout event
  scsi: mpt3sas: Call sas_remove_host before removing the target devices
  scsi: lpfc: Correct LCB RJT handling
  ath9k: dynack: use authentication messages for 'late' ack
  gpu: ipu-v3: image-convert: Prevent race between run and unprepare
  ASoC: Intel: mrfld: fix uninitialized variable access
  pinctrl: bcm2835: Use raw spinlock for RT compatibility
  drm/vgem: Fix vgem_init to get drm device available.
  staging: iio: adc: ad7280a: handle error from __ad7280_read32()
  drm/bufs: Fix Spectre v1 vulnerability

Conflicts:
	drivers/thermal/thermal_core.c

File below is aligned according to change [1] from this LTS import:

    arch/arm64/include/asm/io.h

[1] arm64: io: Ensure calls to delay routines are ordered against prior readX()

Change-Id: Ieae90a5ca7b81b08fcfedb150da732f5986aefe5
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
2019-03-01 11:14:23 -08:00
qctecmdr Service
7982699463 Merge "mm: reduce the time spend by killed tasks in alloc path" 2019-02-28 18:44:41 -08:00
Greg Kroah-Hartman
1912b02244 This is the 4.14.104 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlx2U3kACgkQONu9yGCS
 aT6ocg//RY5zNiVm1frgw1M6HrUUfPO0nXMs67X93sIZ+Iwym5gUBWAK9wfyLn/h
 7G5bGnKya9IS1ltU1Z2fwaIt+N7Wnih3sMk/6ypmf4VdDVE2mGrML0D3nPW7fO3A
 iiXzdixDQlt/VHNB2CXg/z0a7cvtw6ZNF+69QR+plHEGgy40tNvIYPbeCMgfKBAk
 hkv1BjN3SdHzM0CbIDBx/Wq/kFP/pUEcmVJ0gafdZiYAQM69nkQvFcoSslASfbP4
 /VP1vlXO0EINgGn8u6/C+iGoGbPYCXOcwafUXEFVh2bQML4IfOiX1mGE3ve5Pe5Z
 ooYbbhsyKfEtclNfBKUjuTfdrkHBedyoeohkEhzDzpQBpeoW3yp5y/1sTdIMHeHs
 j4L1qmgX3QfWrJXyaBWKaHOQjK+rpZPfbt+pfxE9l8+M+6jzHtnmabVdjxZ70LNn
 YySa4eCW57HIV3Z3aMDL9fWNEAYxsXNtfc0h9rh0Byery44HNDAAeBaVSDsZFcbI
 uLslCcKWNyJ/52Z+XkFWKzSYKHdpe2TvPzsDllokE7OpCRF35Wsdsf6V0LJrOXRO
 t5O4t6rimhCF/Icd1oJmyV/SmDd8yrw3tE9JBdzZEmlBZpKDP0UCx8fMsQNPgE8y
 NmKeDp0L4w44PBeTjqSrE8Q3o6BdtWsZEXz3x+zmkLyiZ7N6mzc=
 =ODN3
 -----END PGP SIGNATURE-----

Merge 4.14.104 into android-4.14-p

Changes in 4.14.104
	ARM: 8834/1: Fix: kprobes: optimized kprobes illegal instruction
	tracing: Fix number of entries in trace header
	MIPS: eBPF: Always return sign extended 32b values
	mac80211: Restore vif beacon interval if start ap fails
	mac80211: Free mpath object when rhashtable insertion fails
	libceph: handle an empty authorize reply
	ceph: avoid repeatedly adding inode to mdsc->snap_flush_list
	numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES
	proc, oom: do not report alien mms when setting oom_score_adj
	KEYS: allow reaching the keys quotas exactly
	mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd cells
	pvcalls-back: set -ENOTCONN in pvcalls_conn_back_read
	mfd: twl-core: Fix section annotations on {,un}protect_pm_master
	mfd: db8500-prcmu: Fix some section annotations
	mfd: mt6397: Do not call irq_domain_remove if PMIC unsupported
	mfd: ab8500-core: Return zero in get_register_interruptible()
	mfd: bd9571mwv: Add volatile register to make DVFS work
	mfd: qcom_rpm: write fw_version to CTRL_REG
	mfd: wm5110: Add missing ASRC rate register
	mfd: tps65218: Use devm_regmap_add_irq_chip and clean up error path in probe()
	mfd: mc13xxx: Fix a missing check of a register-read failure
	xen/pvcalls: remove set but not used variable 'intf'
	qed: Fix qed_chain_set_prod() for PBL chains with non power of 2 page count
	qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory barrier
	net: hns: Fix use after free identified by SLUB debug
	MIPS: ath79: Enable OF serial ports in the default config
	netfilter: nf_tables: fix leaking object reference count
	scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param
	scsi: isci: initialize shost fully before calling scsi_add_host()
	MIPS: jazz: fix 64bit build
	bpf: correctly set initial window on active Fast Open sender
	net: stmmac: Fix PCI module removal leak
	isdn: i4l: isdn_tty: Fix some concurrency double-free bugs
	scsi: ufs: Fix system suspend status
	scsi: qedi: Add ep_state for login completion on un-reachable targets
	always clear the X2APIC_ENABLE bit for PV guest
	drm/meson: add missing of_node_put
	atm: he: fix sign-extension overflow on large shift
	hwmon: (tmp421) Correct the misspelling of the tmp442 compatible attribute in OF device ID table
	leds: lp5523: fix a missing check of return value of lp55xx_read
	bpf: bpf_setsockopt: reset sock dst on SO_MARK changes
	mlxsw: spectrum_switchdev: Do not treat static FDB entries as sticky
	net/mlx5e: Fix wrong (zero) TX drop counter indication for representor
	isdn: avm: Fix string plus integer warning from Clang
	batman-adv: fix uninit-value in batadv_interface_tx()
	ipv6: propagate genlmsg_reply return code
	net/mlx5e: Don't overwrite pedit action when multiple pedit used
	net/packet: fix 4gb buffer limit due to overflow check
	net: sfp: do not probe SFP module before we're attached
	sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment
	team: avoid complex list operations in team_nl_cmd_options_set()
	sit: check if IPv6 enabled before calling ip6_err_gen_icmpv6_unreach()
	net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames
	inet_diag: fix reporting cgroup classid and fallback to priority
	RDMA/srp: Rework SCSI device reset handling
	KEYS: user: Align the payload buffer
	KEYS: always initialize keyring_index_key::desc_len
	parisc: Fix ptrace syscall number modification
	ARCv2: Enable unaligned access in early ASM code
	ARC: U-boot: check arguments paranoidly
	ARC: define ARCH_SLAB_MINALIGN = 8
	drm/i915/fbdev: Actually configure untiled displays
	net: validate untrusted gso packets without csum offload
	net: avoid false positives in untrusted gso validation
	Revert "bridge: do not add port to router list when receives query with source 0.0.0.0"
	netfilter: nf_tables: fix flush after rule deletion in the same batch
	netfilter: nft_compat: use-after-free when deleting targets
	netfilter: ipv6: Don't preserve original oif for loopback address
	pinctrl: max77620: Use define directive for max77620_pinconf_param values
	phy: tegra: remove redundant self assignment of 'map'
	sched/sysctl: Fix attributes of some extern declarations
	net: phylink: avoid resolving link state too early
	Linux 4.14.104

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-02-27 10:25:27 +01:00
Ralph Campbell
3af9907c2a numa: change get_mempolicy() to use nr_node_ids instead of MAX_NUMNODES
commit 050c17f239fd53adb55aa768d4f41bc76c0fe045 upstream.

The system call, get_mempolicy() [1], passes an unsigned long *nodemask
pointer and an unsigned long maxnode argument which specifies the length
of the user's nodemask array in bits (which is rounded up).  The manual
page says that if the maxnode value is too small, get_mempolicy will
return EINVAL but there is no system call to return this minimum value.
To determine this value, some programs search /proc/<pid>/status for a
line starting with "Mems_allowed:" and use the number of digits in the
mask to determine the minimum value.  A recent change to the way this line
is formatted [2] causes these programs to compute a value less than
MAX_NUMNODES so get_mempolicy() returns EINVAL.

Change get_mempolicy(), the older compat version of get_mempolicy(), and
the copy_nodes_to_user() function to use nr_node_ids instead of
MAX_NUMNODES, thus preserving the defacto method of computing the minimum
size for the nodemask array and the maxnode argument.

[1] http://man7.org/linux/man-pages/man2/get_mempolicy.2.html
[2] https://lore.kernel.org/lkml/1545405631-6808-1-git-send-email-longman@redhat.com

Link: http://lkml.kernel.org/r/20190211180245.22295-1-rcampbell@nvidia.com
Fixes: 4fb8e5b89bcbbbb ("include/linux/nodemask.h: use nr_node_ids (not MAX_NUMNODES) in __nodemask_pr_numnodes()")
Signed-off-by: Ralph Campbell <rcampbell@nvidia.com>
Suggested-by: Alexander Duyck <alexander.duyck@gmail.com>
Cc: Waiman Long <longman@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-27 10:08:01 +01:00
Vinayak Menon
c31eadb2f7 mm: reduce the time spend by killed tasks in alloc path
There are issues reported where the tasks killed by LMK
holding huge amounts of memory, loops for seconds in the
reclaim path, thus causing OOMs to happen from other
contexts or a panic when oom path finds that there are no
killable tasks. This patch brings back a change in older
kernel versions to avoid reclaim when a fatal signal is
pending. This is more improtant in our case unlike upstream,
as we loop almost forever in reclaim path when there are LMK
killable tasks (see lmk_kill_possible). Another change done
by the patch is to return without sleep in too_many_isolated
case for tasks with fatal signal pending.

Change-Id: Icd2bb7a9602ea6566425f7918e34c218bbed21cb
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
2019-02-25 13:19:24 +05:30
Kirill A. Shutemov
6834ecede6 filemap-drop-the-mmap_sem-for-all-blocking-operations-fix
Here's a fixup for "filemap: drop the mmap_sem for all blocking operations".

do_sync_mmap_readahead() drops mmap_sem now, so by the time of
dereferencing vmf->vma for count_memcg_event_mm() the VMA can be gone.

Change-Id: Icab68d33d514d951d7ef17d43358d783ecfe99f8
Link: http://lkml.kernel.org/r/20181228235106.okk3oastsnpxusxs@kshutemo-mobl1
Cc: Josef Bacik <josef@toxicpanda.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Dave Chinner <david@fromorbit.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Rik van Riel <riel@redhat.com>
Cc: Tejun Heo <tj@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Git-Commit: f547fff5b0e248f9b40a2d63b5e1fbbfc99e5515
Git-Repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Signed-off-by: Vijayanand Jitta <vjitta@codeaurora.org>
2019-02-21 05:09:13 -08:00
Josef Bacik
48f8cb5206 filemap-drop-the-mmap_sem-for-all-blocking-operations-v6
- added more comments as per Andrew's suggestion.
- fixed the fpin leaks in the two error paths that were pointed out.

Change-Id: I9933bc082581f0972aa6104ab1569ba1b25912a2
Link: http://lkml.kernel.org/r/20181212152757.10017-1-josef@toxicpanda.com
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Dave Chinner <david@fromorbit.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Rik van Riel <riel@redhat.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Git-Commit: 074eea6c5dae9a7ea26ec347607c4914b09a74b0
Git-Repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Signed-off-by: Vijayanand Jitta <vjitta@codeaurora.org>
2019-02-21 18:37:43 +05:30
Josef Bacik
4d7d9e6cb0 filemap: drop the mmap_sem for all blocking operations
Currently we only drop the mmap_sem if there is contention on the page
lock.  The idea is that we issue readahead and then go to lock the page
while it is under IO and we want to not hold the mmap_sem during the IO.

The problem with this is the assumption that the readahead does anything.
In the case that the box is under extreme memory or IO pressure we may end
up not reading anything at all for readahead, which means we will end up
reading in the page under the mmap_sem.

Even if the readahead does something, it could get throttled because of io
pressure on the system and the process is in a lower priority cgroup.

Holding the mmap_sem while doing IO is problematic because it can cause
system-wide priority inversions.  Consider some large company that does a
lot of web traffic.  This large company has load balancing logic in it's
core web server, cause some engineer thought this was a brilliant plan.

This load balancing logic gets statistics from /proc about the system,
which trip over processes mmap_sem for various reasons.  Now the web
server application is in a protected cgroup, but these other processes may
not be, and if they are being throttled while their mmap_sem is held we'll
stall, and cause this nice death spiral.

Instead rework filemap fault path to drop the mmap sem at any point that
we may do IO or block for an extended period of time.  This includes while
issuing readahead, locking the page, or needing to call ->readpage because
readahead did not occur.  Then once we have a fully uptodate page we can
return with VM_FAULT_RETRY and come back again to find our nicely in-cache
page that was gotten outside of the mmap_sem.

This patch also adds a new helper for locking the page with the mmap_sem
dropped.  This doesn't make sense currently as generally speaking if the
page is already locked it'll have been read in (unless there was an error)
before it was unlocked.  However a forthcoming patchset will change this
with the ability to abort read-ahead bio's if necessary, making it more
likely that we could contend for a page lock and still have a not uptodate
page.  This allows us to deal with this case by grabbing the lock and
issuing the IO without the mmap_sem held, and then returning
VM_FAULT_RETRY to come back around.

Change-Id: I5998402a4255eed5c732af3c7dfdd7bc3269a540
Link: http://lkml.kernel.org/r/20181211173801.29535-4-josef@toxicpanda.com
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Tested-by: syzbot+b437b5a429d680cf2217@syzkaller.appspotmail.com
Cc: Dave Chinner <david@fromorbit.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Git-Commit: 563a539cb194e2b782ee94ab813d942a29aac875
Git-Repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Signed-off-by: Vijayanand Jitta <vjitta@codeaurora.org>
2019-02-21 04:56:26 -08:00
Josef Bacik
cd405a097d filemap: pass vm_fault to the mmap ra helpers
All of the arguments to these functions come from the vmf, and the
following patches are going to add more arguments.  Cut down on the amount
of arguments passed by simply passing in the vmf to these two helpers.

Change-Id: I9c83716967e5ded64682a935c6a3c6b2fa01175f
Link: http://lkml.kernel.org/r/20181211173801.29535-3-josef@toxicpanda.com
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: Dave Chinner <david@fromorbit.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Rik van Riel <riel@redhat.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Git-Commit: 38db5b064e830732ee8c821517c065adb931ecdb
Git-Repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Signed-off-by: Vijayanand Jitta <vjitta@codeaurora.org>
2019-02-21 04:56:11 -08:00
Josef Bacik
bf8cd2d2ee filemap: kill page_cache_read usage in filemap_fault
Patch series "drop the mmap_sem when doing IO in the fault path", v6.

Now that we have proper isolation in place with cgroups2 we have started going
through and fixing the various priority inversions.  Most are all gone now, but
this one is sort of weird since it's not necessarily a priority inversion that
happens within the kernel, but rather because of something userspace does.

We have giant applications that we want to protect, and parts of these giant
applications do things like watch the system state to determine how healthy the
box is for load balancing and such.  This involves running 'ps' or other such
utilities.  These utilities will often walk /proc/<pid>/whatever, and these
files can sometimes need to down_read(&task->mmap_sem).  Not usually a big deal,
but we noticed when we are stress testing that sometimes our protected
application has latency spikes trying to get the mmap_sem for tasks that are in
lower priority cgroups.

This is because any down_write() on a semaphore essentially turns it into a
mutex, so even if we currently have it held for reading, any new readers will
not be allowed on to keep from starving the writer.  This is fine, except a
lower priority task could be stuck doing IO because it has been throttled to the
point that its IO is taking much longer than normal.  But because a higher
priority group depends on this completing it is now stuck behind lower priority
work.

In order to avoid this particular priority inversion we want to use the existing
retry mechanism to stop from holding the mmap_sem at all if we are going to do
IO.  This already exists in the read case sort of, but needed to be extended for
more than just grabbing the page lock.  With io.latency we throttle at
submit_bio() time, so the readahead stuff can block and even page_cache_read can
block, so all these paths need to have the mmap_sem dropped.

The other big thing is ->page_mkwrite.  btrfs is particularly shitty here
because we have to reserve space for the dirty page, which can be a very
expensive operation.  We use the same retry method as the read path, and simply
cache the page and verify the page is still setup properly the next pass through
->page_mkwrite().

I've tested these patches with xfstests and there are no regressions.

This patch (of 3):

If we do not have a page at filemap_fault time we'll do this weird forced
page_cache_read thing to populate the page, and then drop it again and
loop around and find it.  This makes for 2 ways we can read a page in
filemap_fault, and it's not really needed.  Instead add a FGP_FOR_MMAP
flag so that pagecache_get_page() will return a unlocked page that's in
pagecache.  Then use the normal page locking and readpage logic already in
filemap_fault.  This simplifies the no page in page cache case
significantly.

Link: http://lkml.kernel.org/r/20181211173801.29535-2-josef@toxicpanda.com
Signed-off-by: Josef Bacik <josef@toxicpanda.com>
Acked-by: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Cc: Tejun Heo <tj@kernel.org>
Cc: Dave Chinner <david@fromorbit.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
Git-Commit: b8e5ebc578b13da98f573cb9a5e509080c6efc21
Git-Repo: git://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git
Change-Id: Ia092d90831a798ddbfcb8a5bede8ada2df22c456
Signed-off-by: Vijayanand Jitta <vjitta@codeaurora.org>
2019-02-21 18:19:06 +05:30
Greg Kroah-Hartman
b952da4f0e This is the 4.14.99 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlxjFHYACgkQONu9yGCS
 aT5H0w/8D6sNHqN7RXJogmqrdCg6xzfwxdQs+56WWjOUrEjfzpT/x6c8+f/s8nuA
 lvTO12FKspWxLnwYNx+hcLUnIzs1LX6XxH/ls1mHWVqQ11We/yrUhnpEFhcCLITn
 n8fSx6OOI/MeblsvW6qkz+uIf7EwArvCdv956nSeF6UyJVXxe67kyJKZZYCsuvpL
 GvBmMpr+REhKu170bHP7cS783iLN6HavEcuzxnjxh7T6+InTa1zJQQATL3NR/PWZ
 Cy1RAwS3pSeGA6UqeXbslTPwuQ5MCCXucP3cGvAMRURxNEbUL44dBS1G3+HDurn6
 OqXxO4u0mBhRabm4cFGXrFXqVJOCn0O2E1Otjat7S9To/bRINZsVkj+XjqLHyHuN
 oPmsQUiRZ3iBOphr69WuxzjQRtHzkalJmo/poAdPhvA4OFqKB8n3Q4GLU1nqp4qx
 EXJ7pQo2AanClkP2j7lIQtdM7n8lPyy80hnR484ysP0pZaH2ErGMrK60rzZLDDlY
 Zk7i8uZ/jTrHsIXgWYL2F5Lz4St6MY49ePQaFR4Wjy7p76ZoPZMkYmxvA5ZrmOpT
 UyggwNwT6kh0/yzXTZZ5O1N+7IUeam9Br+2UHxmpYXMs/P6xjW0YAczDZ9crqiV8
 zys1u1gR+DKL/bw7JMEIMDsUZlhhzxmW9Eidfl7QlUpiYJNpM00=
 =ShQi
 -----END PGP SIGNATURE-----

Merge 4.14.99 into android-4.14-p

Changes in 4.14.99
	drm/bufs: Fix Spectre v1 vulnerability
	staging: iio: adc: ad7280a: handle error from __ad7280_read32()
	drm/vgem: Fix vgem_init to get drm device available.
	pinctrl: bcm2835: Use raw spinlock for RT compatibility
	ASoC: Intel: mrfld: fix uninitialized variable access
	gpu: ipu-v3: image-convert: Prevent race between run and unprepare
	ath9k: dynack: use authentication messages for 'late' ack
	scsi: lpfc: Correct LCB RJT handling
	scsi: mpt3sas: Call sas_remove_host before removing the target devices
	scsi: lpfc: Fix LOGO/PLOGI handling when triggerd by ABTS Timeout event
	ARM: 8808/1: kexec:offline panic_smp_self_stop CPU
	clk: boston: fix possible memory leak in clk_boston_setup()
	dlm: Don't swamp the CPU with callbacks queued during recovery
	x86/PCI: Fix Broadcom CNB20LE unintended sign extension (redux)
	powerpc/pseries: add of_node_put() in dlpar_detach_node()
	crypto: aes_ti - disable interrupts while accessing S-box
	drm/vc4: ->x_scaling[1] should never be set to VC4_SCALING_NONE
	serial: fsl_lpuart: clear parity enable bit when disable parity
	ptp: check gettime64 return code in PTP_SYS_OFFSET ioctl
	MIPS: Boston: Disable EG20T prefetch
	staging:iio:ad2s90: Make probe handle spi_setup failure
	fpga: altera-cvp: Fix registration for CvP incapable devices
	Tools: hv: kvp: Fix a warning of buffer overflow with gcc 8.0.1
	platform/chrome: don't report EC_MKBP_EVENT_SENSOR_FIFO as wakeup
	staging: iio: ad7780: update voltage on read
	usbnet: smsc95xx: fix rx packet alignment
	drm/rockchip: fix for mailbox read size
	ARM: OMAP2+: hwmod: Fix some section annotations
	net/mlx5: EQ, Use the right place to store/read IRQ affinity hint
	modpost: validate symbol names also in find_elf_symbol
	perf tools: Add Hygon Dhyana support
	soc/tegra: Don't leak device tree node reference
	media: mtk-vcodec: Release device nodes in mtk_vcodec_init_enc_pm()
	ptp: Fix pass zero to ERR_PTR() in ptp_clock_register
	dmaengine: xilinx_dma: Remove __aligned attribute on zynqmp_dma_desc_ll
	iio: adc: meson-saradc: check for devm_kasprintf failure
	iio: adc: meson-saradc: fix internal clock names
	iio: accel: kxcjk1013: Add KIOX010A ACPI Hardware-ID
	media: adv*/tc358743/ths8200: fill in min width/height/pixelclock
	ACPI: SPCR: Consider baud rate 0 as preconfigured state
	staging: pi433: fix potential null dereference
	f2fs: move dir data flush to write checkpoint process
	f2fs: fix race between write_checkpoint and write_begin
	f2fs: fix wrong return value of f2fs_acl_create
	i2c: sh_mobile: add support for r8a77990 (R-Car E3)
	arm64: io: Ensure calls to delay routines are ordered against prior readX()
	sunvdc: Do not spin in an infinite loop when vio_ldc_send() returns EAGAIN
	soc: bcm: brcmstb: Don't leak device tree node reference
	nfsd4: fix crash on writing v4_end_grace before nfsd startup
	drm: Clear state->acquire_ctx before leaving drm_atomic_helper_commit_duplicated_state()
	arm64: io: Ensure value passed to __iormb() is held in a 64-bit register
	Thermal: do not clear passive state during system sleep
	firmware/efi: Add NULL pointer checks in efivars API functions
	s390/zcrypt: improve special ap message cmd handling
	arm64: ftrace: don't adjust the LR value
	ARM: dts: mmp2: fix TWSI2
	x86/fpu: Add might_fault() to user_insn()
	media: DaVinci-VPBE: fix error handling in vpbe_initialize()
	smack: fix access permissions for keyring
	usb: dwc3: Correct the logic for checking TRB full in __dwc3_prepare_one_trb()
	usb: hub: delay hub autosuspend if USB3 port is still link training
	timekeeping: Use proper seqcount initializer
	usb: mtu3: fix the issue about SetFeature(U1/U2_Enable)
	clk: sunxi-ng: a33: Set CLK_SET_RATE_PARENT for all audio module clocks
	driver core: Move async_synchronize_full call
	kobject: return error code if writing /sys/.../uevent fails
	IB/hfi1: Unreserve a reserved request when it is completed
	usb: dwc3: trace: add missing break statement to make compiler happy
	pinctrl: sx150x: handle failure case of devm_kstrdup
	iommu/amd: Fix amd_iommu=force_isolation
	ARM: dts: Fix OMAP4430 SDP Ethernet startup
	mips: bpf: fix encoding bug for mm_srlv32_op
	media: coda: fix H.264 deblocking filter controls
	ARM: dts: Fix up the D-Link DIR-685 MTD partition info
	watchdog: renesas_wdt: don't set divider while watchdog is running
	usb: dwc3: gadget: Disable CSP for stream OUT ep
	iommu/arm-smmu: Add support for qcom,smmu-v2 variant
	iommu/arm-smmu-v3: Use explicit mb() when moving cons pointer
	sata_rcar: fix deferred probing
	clk: imx6sl: ensure MMDC CH0 handshake is bypassed
	cpuidle: big.LITTLE: fix refcount leak
	OPP: Use opp_table->regulators to verify no regulator case
	i2c-axxia: check for error conditions first
	phy: sun4i-usb: add support for missing USB PHY index
	udf: Fix BUG on corrupted inode
	switchtec: Fix SWITCHTEC_IOCTL_EVENT_IDX_ALL flags overwrite
	selftests/bpf: use __bpf_constant_htons in test_prog.c
	ARM: pxa: avoid section mismatch warning
	ASoC: fsl: Fix SND_SOC_EUKREA_TLV320 build error on i.MX8M
	KVM: PPC: Book3S: Only report KVM_CAP_SPAPR_TCE_VFIO on powernv machines
	mmc: bcm2835: Recover from MMC_SEND_EXT_CSD
	mmc: bcm2835: reset host on timeout
	memstick: Prevent memstick host from getting runtime suspended during card detection
	mmc: sdhci-of-esdhc: Fix timeout checks
	mmc: sdhci-xenon: Fix timeout checks
	tty: serial: samsung: Properly set flags in autoCTS mode
	perf test: Fix perf_event_attr test failure
	perf header: Fix unchecked usage of strncpy()
	perf probe: Fix unchecked usage of strncpy()
	arm64: KVM: Skip MMIO insn after emulation
	usb: musb: dsps: fix otg state machine
	percpu: convert spin_lock_irq to spin_lock_irqsave.
	powerpc/uaccess: fix warning/error with access_ok()
	mac80211: fix radiotap vendor presence bitmap handling
	xfrm6_tunnel: Fix spi check in __xfrm6_tunnel_alloc_spi
	Bluetooth: Fix unnecessary error message for HCI request completion
	mlxsw: spectrum: Properly cleanup LAG uppers when removing port from LAG
	scsi: smartpqi: correct host serial num for ssa
	scsi: smartpqi: correct volume status
	scsi: smartpqi: increase fw status register read timeout
	cw1200: Fix concurrency use-after-free bugs in cw1200_hw_scan()
	powerpc/perf: Fix thresholding counter data for unknown type
	drbd: narrow rcu_read_lock in drbd_sync_handshake
	drbd: disconnect, if the wrong UUIDs are attached on a connected peer
	drbd: skip spurious timeout (ping-timeo) when failing promote
	drbd: Avoid Clang warning about pointless switch statment
	video: clps711x-fb: release disp device node in probe()
	md: fix raid10 hang issue caused by barrier
	fbdev: fbmem: behave better with small rotated displays and many CPUs
	i40e: define proper net_device::neigh_priv_len
	igb: Fix an issue that PME is not enabled during runtime suspend
	ACPI/APEI: Clear GHES block_status before panic()
	fbdev: fbcon: Fix unregister crash when more than one framebuffer
	powerpc/mm: Fix reporting of kernel execute faults on the 8xx
	pinctrl: meson: meson8: fix the GPIO function for the GPIOAO pins
	pinctrl: meson: meson8b: fix the GPIO function for the GPIOAO pins
	KVM: x86: svm: report MSR_IA32_MCG_EXT_CTL as unsupported
	powerpc/fadump: Do not allow hot-remove memory from fadump reserved area.
	kvm: Change offset in kvm_write_guest_offset_cached to unsigned
	NFS: nfs_compare_mount_options always compare auth flavors.
	hwmon: (lm80) fix a missing check of the status of SMBus read
	hwmon: (lm80) fix a missing check of bus read in lm80 probe
	seq_buf: Make seq_buf_puts() null-terminate the buffer
	crypto: ux500 - Use proper enum in cryp_set_dma_transfer
	crypto: ux500 - Use proper enum in hash_set_dma_transfer
	MIPS: ralink: Select CONFIG_CPU_MIPSR2_IRQ_VI on MT7620/8
	cifs: check ntwrk_buf_start for NULL before dereferencing it
	um: Avoid marking pages with "changed protection"
	niu: fix missing checks of niu_pci_eeprom_read
	f2fs: fix sbi->extent_list corruption issue
	cgroup: fix parsing empty mount option string
	scripts/decode_stacktrace: only strip base path when a prefix of the path
	ocfs2: don't clear bh uptodate for block read
	ocfs2: improve ocfs2 Makefile
	isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw()
	gdrom: fix a memory leak bug
	fsl/fman: Use GFP_ATOMIC in {memac,tgec}_add_hash_mac_address()
	block/swim3: Fix -EBUSY error when re-opening device after unmount
	thermal: bcm2835: enable hwmon explicitly
	kdb: Don't back trace on a cpu that didn't round up
	thermal: generic-adc: Fix adc to temp interpolation
	HID: lenovo: Add checks to fix of_led_classdev_register
	kernel/hung_task.c: break RCU locks based on jiffies
	proc/sysctl: fix return error for proc_doulongvec_minmax()
	kernel/hung_task.c: force console verbose before panic
	fs/epoll: drop ovflist branch prediction
	exec: load_script: don't blindly truncate shebang string
	scripts/gdb: fix lx-version string output
	thermal: hwmon: inline helpers when CONFIG_THERMAL_HWMON is not set
	dccp: fool proof ccid_hc_[rt]x_parse_options()
	enic: fix checksum validation for IPv6
	net: dp83640: expire old TX-skb
	rxrpc: bad unlock balance in rxrpc_recvmsg
	skge: potential memory corruption in skge_get_regs()
	rds: fix refcount bug in rds_sock_addref
	net: systemport: Fix WoL with password after deep sleep
	net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames
	net: dsa: slave: Don't propagate flag changes on down slave interfaces
	ALSA: compress: Fix stop handling on compressed capture streams
	ALSA: hda - Serialize codec registrations
	fuse: call pipe_buf_release() under pipe lock
	fuse: decrement NR_WRITEBACK_TEMP on the right page
	fuse: handle zero sized retrieve correctly
	dmaengine: bcm2835: Fix interrupt race on RT
	dmaengine: bcm2835: Fix abort of transactions
	dmaengine: imx-dma: fix wrong callback invoke
	futex: Handle early deadlock return correctly
	irqchip/gic-v3-its: Plug allocation race for devices sharing a DevID
	usb: phy: am335x: fix race condition in _probe
	usb: dwc3: gadget: Handle 0 xfer length for OUT EP
	usb: gadget: udc: net2272: Fix bitwise and boolean operations
	usb: gadget: musb: fix short isoc packets with inventra dma
	staging: speakup: fix tty-operation NULL derefs
	scsi: cxlflash: Prevent deadlock when adapter probe fails
	scsi: aic94xx: fix module loading
	KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)
	kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)
	KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221)
	cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM
	perf/x86/intel/uncore: Add Node ID mask
	x86/MCE: Initialize mce.bank in the case of a fatal error in mce_no_way_out()
	perf/core: Don't WARN() for impossible ring-buffer sizes
	perf tests evsel-tp-sched: Fix bitwise operator
	serial: fix race between flush_to_ldisc and tty_open
	serial: 8250_pci: Make PCI class test non fatal
	nfsd4: fix cached replies to solo SEQUENCE compounds
	nfsd4: catch some false session retries
	IB/hfi1: Add limit test for RC/UC send via loopback
	perf/x86/intel: Delay memory deallocation until x86_pmu_dead_cpu()
	ath9k: dynack: make ewma estimation faster
	ath9k: dynack: check da->enabled first in sampling routines
	Linux 4.14.99

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-02-12 20:22:13 +01:00
Dennis Zhou
04fed9d3e7 percpu: convert spin_lock_irq to spin_lock_irqsave.
[ Upstream commit 6ab7d47bcbf0144a8cb81536c2cead4cde18acfe ]

From Michael Cree:
  "Bisection lead to commit b38d08f3181c ("percpu: restructure
   locking") as being the cause of lockups at initial boot on
   the kernel built for generic Alpha.

   On a suggestion by Tejun Heo that:

   So, the only thing I can think of is that it's calling
   spin_unlock_irq() while irq handling isn't set up yet.
   Can you please try the followings?

   1. Convert all spin_[un]lock_irq() to
      spin_lock_irqsave/unlock_irqrestore()."

Fixes: b38d08f3181c ("percpu: restructure locking")
Reported-and-tested-by: Michael Cree <mcree@orcon.net.nz>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Dennis Zhou <dennis@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-02-12 19:46:05 +01:00
Blagovest Kolenichev
a0c8d6ecf4 Merge android-4.14-p.98 (848d71f) into msm-4.14
* refs/heads/tmp-848d71f:
  Linux 4.14.98
  fanotify: fix handling of events on child sub-directory
  drivers: core: Remove glue dirs from sysfs earlier
  cifs: Always resolve hostname before reconnecting
  md/raid5: fix 'out of memory' during raid cache recovery
  mm: migrate: don't rely on __PageMovable() of newpage after unlocking it
  mm: hwpoison: use do_send_sig_info() instead of force_sig()
  mm, oom: fix use-after-free in oom_kill_process
  oom, oom_reaper: do not enqueue same task twice
  kernel/exit.c: release ptraced tasks before zap_pid_ns_processes
  mmc: sdhci-iproc: handle mmc_of_parse() errors during probe
  platform/x86: asus-nb-wmi: Drop mapping of 0x33 and 0x34 scan codes
  platform/x86: asus-nb-wmi: Map 0x35 to KEY_SCREENLOCK
  IB/hfi1: Remove overly conservative VM_EXEC flag check
  ALSA: hda/realtek - Fixed hp_pin no value
  mmc: bcm2835: Fix DMA channel leak on probe error
  gfs2: Revert "Fix loop in gfs2_rbm_find"
  gpio: pcf857x: Fix interrupts on multiple instances
  gpio: altera-a10sr: Set proper output level for direction_output
  arm64: hibernate: Clean the __hyp_text to PoC after resume
  arm64: hyp-stub: Forbid kprobing of the hyp-stub
  arm64: kaslr: ensure randomized quantities are clean also when kaslr is off
  ARM: cns3xxx: Fix writing to wrong PCI config registers after alignment
  NFS: Fix up return value on fatal errors in nfs_page_async_flush()
  selftests/seccomp: Enhance per-arch ptrace syscall skip tests
  iommu/vt-d: Fix memory leak in intel_iommu_put_resv_regions()
  fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb()
  CIFS: Do not count -ENODATA as failure for query directory
  ipvlan, l3mdev: fix broken l3s mode wrt local routes
  l2tp: fix reading optional fields of L2TPv3
  l2tp: remove l2specific_len dependency in l2tp_core
  sctp: improve the events for sctp stream reset
  sctp: improve the events for sctp stream adding
  virtio_net: Fix not restoring real_num_rx_queues
  virtio_net: Don't call free_old_xmit_skbs for xdp_frames
  virtio_net: Don't enable NAPI when interface is down
  Revert "net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager"
  net/mlx5e: Allow MAC invalidation while spoofchk is ON
  ucc_geth: Reset BQL queue when stopping device
  net: set default network namespace in init_dummy_netdev()
  net/rose: fix NULL ax25_cb kernel panic
  netrom: switch to sock timer API
  net/mlx4_core: Add masking for a few queries on HCA caps
  l2tp: copy 4 more bytes to linear part if necessary
  ipv6: sr: clear IP6CB(skb) on SRH ip4ip6 encapsulation
  ipv6: Consider sk_bound_dev_if when binding a socket to an address
  Fix "net: ipv4: do not handle duplicate fragments as overlapping"

Conflicts:
	mm/oom_kill.c

Change-Id: I647b62a46225034b3c6286a774bafb8c6439dbde
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
2019-02-11 05:48:15 -08:00
Blagovest Kolenichev
148d287536 Merge android-4.14-p.96 (053a46d) into msm-4.14
* refs/heads/tmp-053a46d:
  Linux 4.14.96
  ipmi:ssif: Fix handling of multi-part return messages
  PCI: dwc: Move interrupt acking into the proper callback
  drm/i915/gvt: Fix mmap range check
  cifs: allow disabling insecure dialects in the config
  ipmi:pci: Blacklist a Realtek "IPMI" device
  nfs: fix a deadlock in nfs client initialization
  mm, proc: be more verbose about unstable VMA flags in /proc/<pid>/smaps
  mm/swap: use nr_node_ids for avail_lists in swap_info_struct
  mm/page-writeback.c: don't break integrity writeback on ->writepage() error
  ocfs2: fix panic due to unrecovered local alloc
  scsi: megaraid: fix out-of-bound array accesses
  scsi: smartpqi: call pqi_free_interrupts() in pqi_shutdown()
  scsi: smartpqi: correct lun reset issues
  IB/usnic: Fix potential deadlock
  sysfs: Disable lockdep for driver bind/unbind files
  ALSA: bebob: fix model-id of unit for Apogee Ensemble
  clocksource/drivers/integrator-ap: Add missing of_node_put()
  quota: Lock s_umount in exclusive mode for Q_XQUOTA{ON,OFF} quotactls.
  dm snapshot: Fix excessive memory usage and workqueue stalls
  tools lib subcmd: Don't add the kernel sources to the include path
  dm kcopyd: Fix bug causing workqueue stalls
  dm crypt: use u64 instead of sector_t to store iv_offset
  netfilter: ipt_CLUSTERIP: check MAC address when duplicate config is set
  perf parse-events: Fix unchecked usage of strncpy()
  perf svghelper: Fix unchecked usage of strncpy()
  perf intel-pt: Fix error with config term "pt=0"
  tty/serial: do not free trasnmit buffer page under port lock
  btrfs: improve error handling of btrfs_add_link
  mmc: atmel-mci: do not assume idle after atmci_request_end
  kconfig: fix memory leak when EOF is encountered in quotation
  kconfig: fix file name and line number of warn_ignored_character()
  arm64: Fix minor issues with the dcache_by_line_op macro
  clk: imx6q: reset exclusive gates on init
  selftests: do not macro-expand failed assertion expressions
  scsi: target: use consistent left-aligned ASCII INQUIRY data
  net: call sk_dst_reset when set SO_DONTROUTE
  media: venus: core: Set dma maximum segment size
  media: firewire: Fix app_info parameter type in avc_ca{,_app}_info
  powerpc/pseries/cpuidle: Fix preempt warning
  powerpc/xmon: Fix invocation inside lock region
  pstore/ram: Do not treat empty buffers as valid
  clk: imx: make mux parent strings const
  jffs2: Fix use of uninitialized delayed_work, lockdep breakage
  rxe: IB_WR_REG_MR does not capture MR's iova field
  selinux: always allow mounting submounts
  usb: gadget: udc: renesas_usb3: add a safety connection way for forced_b_device
  arm64: perf: set suppress_bind_attrs flag to true
  MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur
  x86/mce: Fix -Wmissing-prototypes warnings
  ALSA: oxfw: add support for APOGEE duet FireWire
  serial: set suppress_bind_attrs flag only if builtin
  writeback: don't decrement wb->refcnt if !wb->bdi
  e1000e: allow non-monotonic SYSTIM readings
  platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey
  gpio: pl061: Move irq_chip definition inside struct pl061
  net: dsa: mv88x6xxx: mv88e6390 errata
  ipv6: Take rcu_read_lock in __inet6_bind for mapped addresses
  r8169: Add support for new Realtek Ethernet
  qmi_wwan: add MTU default to qmap network interface
  net, skbuff: do not prefer skb allocation fails early
  mlxsw: spectrum_switchdev: Set PVID correctly during VLAN deletion
  mlxsw: spectrum: Disable lag port TX before removing it
  ipv6: Consider sk_bound_dev_if when binding a socket to a v4 mapped address

Conflicts:
	include/linux/swap.h

Change-Id: I7d6bbb965eb4517b3972f1d3fb320f48bc43550c
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
2019-02-09 07:53:02 -08:00
Blagovest Kolenichev
2d15b054d3 Merge android-4.14-p.94 (1196d60) into msm-4.14
* refs/heads/tmp-1196d60:
  Linux 4.14.94
  KVM: arm/arm64: Fix VMID alloc race by reverting to lock-less
  sunrpc: use-after-free in svc_process_common()
  ext4: track writeback errors using the generic tracking infrastructure
  ext4: use ext4_write_inode() when fsyncing w/o a journal
  ext4: avoid kernel warning when writing the superblock to a dead device
  ext4: fix a potential fiemap/page fault deadlock w/ inline_data
  ext4: make sure enough credits are reserved for dioread_nolock writes
  rbd: don't return 0 on unmap if RBD_DEV_FLAG_REMOVING is set
  drm/fb-helper: Partially bring back workaround for bugs of SDL 1.2
  i2c: dev: prevent adapter retries and timeout being set as minus value
  ACPI / PMIC: xpower: Fix TS-pin current-source handling
  ACPI: power: Skip duplicate power resource references in _PRx
  mm, memcg: fix reclaim deadlock with writeback
  mm: page_mapped: don't assume compound page is huge or THP
  slab: alien caches must not be initialized if the allocation of the alien cache failed
  USB: Add USB_QUIRK_DELAY_CTRL_MSG quirk for Corsair K70 RGB
  USB: storage: add quirk for SMI SM3350
  USB: storage: don't insert sane sense for SPC3+ when bad sense specified
  usb: cdc-acm: send ZLP for Telit 3G Intel based modems
  cifs: Fix potential OOB access of lock element array
  CIFS: Do not hide EINTR after sending network packets
  CIFS: Fix adjustment of credits for MTU requests
  ALSA: hda/realtek - Disable headset Mic VREF for headset mode of ALC225
  ALSA: hda/realtek - Add unplug function into unplug state of Headset Mode for ALC225
  ALSA: hda/realtek - Support Dell headset mode for New AIO platform
  x86, modpost: Replace last remnants of RETPOLINE with CONFIG_RETPOLINE
  x86,kvm: move qemu/guest FPU switching out to vcpu_run
  Makefile: Fix 4.14.93 resolution

Change-Id: I644ccca67ce2131d42ba8936bc1626b451a9c6e9
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
2019-02-09 07:52:51 -08:00
Blagovest Kolenichev
cc949a9bfd Merge android-4.14-p.93 (ca78470) into msm-4.14
* refs/heads/tmp-ca78470:
  Linux 4.14.93
  tools: power/acpi, revert to LD = gcc
  bnx2x: Fix NULL pointer dereference in bnx2x_del_all_vlans() on some hw
  drm/vc4: Set ->is_yuv to false when num_planes == 1
  lib: fix build failure in CONFIG_DEBUG_VIRTUAL test
  power: supply: olpc_battery: correct the temperature units
  intel_th: msu: Fix an off-by-one in attribute store
  genwqe: Fix size check
  ceph: don't update importing cap's mseq when handing cap export
  sched/fair: Fix infinite loop in update_blocked_averages() by reverting a9e7f6544b9c
  iommu/vt-d: Handle domain agaw being less than iommu agaw
  rxe: fix error completion wr_id and qp_num
  9p/net: put a lower bound on msize
  powerpc/tm: Set MSR[TS] just prior to recheckpoint
  arm64: relocatable: fix inconsistencies in linker script and options
  arm64: drop linker script hack to hide __efistub_ symbols
  scripts/kallsyms: filter arm64's __efistub_ symbols
  lockd: Show pid of lockd for remote locks
  selinux: policydb - fix byte order and alignment issues
  b43: Fix error in cordic routine
  gfs2: Fix loop in gfs2_rbm_find
  gfs2: Get rid of potential double-freeing in gfs2_create_inode
  dlm: memory leaks on error path in dlm_user_request()
  dlm: lost put_lkb on error path in receive_convert() and receive_unlock()
  dlm: possible memory leak on error path in create_lkb()
  dlm: fixed memory leaks after failed ls_remove_names allocation
  ALSA: usb-audio: Fix an out-of-bound read in create_composite_quirks
  ALSA: usb-audio: Avoid access before bLength check in build_audio_procunit()
  ALSA: cs46xx: Potential NULL dereference in probe
  dm zoned: Fix target BIO completion handling
  dm verity: fix crash on bufio buffer that was allocated with vmalloc
  vhost/vsock: fix uninitialized vhost_vsock->guest_cid
  raid6/ppc: Fix build for clang
  powerpc/boot: Set target when cross-compiling for clang
  Makefile: Export clang toolchain variables
  kbuild: consolidate Clang compiler flags
  kbuild: add -no-integrated-as Clang option unconditionally
  md: raid10: remove VLAIS
  ftrace: Build with CPPFLAGS to get -Qunused-arguments
  powerpc: Disable -Wbuiltin-requires-header when setjmp is used
  powerpc: avoid -mno-sched-epilog on GCC 4.9 and newer
  sunrpc: use SVC_NET() in svcauth_gss_* functions
  sunrpc: fix cache_head leak due to queued request
  mm, swap: fix swapoff with KSM pages
  mm, hmm: mark hmm_devmem_{add, add_resource} EXPORT_SYMBOL_GPL
  mm, hmm: use devm semantics for hmm_devmem_{add, remove}
  mm, devm_memremap_pages: kill mapping "System RAM" support
  mm, devm_memremap_pages: mark devm_memremap_pages() EXPORT_SYMBOL_GPL
  hwpoison, memory_hotplug: allow hwpoisoned pages to be offlined
  zram: fix double free backing device
  fork: record start_time late
  tools: fix cross-compile var clobbering
  genirq/affinity: Don't return with empty affinity masks on error
  scsi: lpfc: do not set queue->page_count to 0 if pc_sli4_params.wqpcnt is invalid
  scsi: zfcp: fix posting too many status read buffers leading to adapter shutdown
  serial/sunsu: fix refcount leak
  qmi_wwan: Fix qmap header retrieval in qmimux_rx_fixup
  net: netxen: fix a missing check and an uninitialized use
  Input: synaptics - enable SMBus for HP EliteBook 840 G4
  gpio: mvebu: only fail on missing clk if pwm is actually to be used
  virtio: fix test build after uio.h change
  kbuild: fix false positive warning/error about missing libelf
  mac80211: free skb fraglist before freeing the skb
  vxge: ensure data0 is initialized in when fetching firmware version information
  lan78xx: Resolve issue with changing MAC address
  net: macb: fix dropped RX frames due to a race
  net: macb: fix random memory corruption on RX with 64-bit DMA
  qed: Fix an error code qed_ll2_start_xmit()
  SUNRPC: Fix a race with XPRT_CONNECTING
  net: hns: Fix ping failed when use net bridge and send multicast
  net: hns: Add mac pcs config when enable|disable mac
  net: hns: Fix ntuple-filters status error.
  net: hns: Avoid net reset caused by pause frames storm
  net: hns: Free irq when exit from abnormal branch
  net: hns: Clean rx fbd when ae stopped.
  net: hns: Fixed bug that netdev was opened twice
  net: hns: Some registers use wrong address according to the datasheet.
  net: hns: All ports can not work when insmod hns ko after rmmod.
  net: hns: Incorrect offset address used for some registers.
  w90p910_ether: remove incorrect __init annotation
  drivers: net: xgene: Remove unnecessary forward declarations
  x86, hyperv: remove PCI dependency
  scsi: target: iscsi: cxgbit: add missing spin_lock_init()
  scsi: target: iscsi: cxgbit: fix csk leak
  bnx2x: Send update-svid ramrod with retry/poll flags enabled
  bnx2x: Remove configured vlans as part of unload sequence.
  bnx2x: Clear fip MAC when fcoe offload support is disabled
  netfilter: nat: can't use dst_hold on noref dst
  netfilter: ipset: do not call ipset_nest_end after nla_nest_cancel
  i40e: fix mac filter delete when setting mac address
  x86/dump_pagetables: Fix LDT remap address marker
  x86/mm: Fix guard hole handling
  ieee802154: ca8210: fix possible u8 overflow in ca8210_rx_done
  ibmvnic: Fix non-atomic memory allocation in IRQ context
  Input: synaptics - enable RMI on ThinkPad T560
  Input: omap-keypad - fix idle configuration to not block SoC idle states
  scsi: bnx2fc: Fix NULL dereference in error handling
  netfilter: seqadj: re-load tcp header pointer after possible head reallocation
  xfrm: Fix NULL pointer dereference in xfrm_input when skb_dst_force clears the dst_entry.
  xfrm: Fix bucket count reported to userspace
  xfrm: Fix error return code in xfrm_output_one()
  checkstack.pl: fix for aarch64
  Input: restore EV_ABS ABS_RESERVED
  ARM: dts: imx7d-nitrogen7: Fix the description of the Wifi clock
  ARM: imx: update the cpu power up timing setting on i.mx6sx
  HID: ite: Add USB id match for another ITE based keyboard rfkill key quirk
  powerpc/mm: Fix linux page tables build with some configs
  powerpc: Fix COFF zImage booting on old powermacs
  pinctrl: meson: fix pull enable register calculation

Conflicts:
	mm/memory_hotplug.c

Change-Id: Ief6b04b21694f384fb73e20f770857068a13b458
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
2019-02-09 07:52:46 -08:00
Greg Kroah-Hartman
848d71fbb8 This is the 4.14.98 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlxbC+kACgkQONu9yGCS
 aT42nw/+JRU1ek6PaT+4Pzr9HDac3qQP9pQ4WG80X1ZqYdQYGcDkhmoQcHqaXCDe
 089OjoPlPToEdjpQhqfmN5i/TNLag4TuZLN6T3LpORWQWEfgnKt3TboSB/MWzCwr
 g9qVBEi9xVPU/no/I8M+XshE3v994wf5dhgEFiSxR5kDMwgbq6EdIWQeJZ2OdJg1
 x8LRQwqkcvnVns1khKOGweCQAL5GdeXbz+BxNaPs+g1R7li8GUS+UL16yEWvPpMq
 +emae6MqKcoyr3leV+dMd1RY+ICJjCPr1RJJlr3M3KYDU5OEfnaih2MxBT1optoI
 iABQFs8MNnU/zKt8k2CwMJuXdW6+OnVQq2+gC8ye6aQAQ0dWureyy8zj06vidI7a
 eIGDiLGudW8sUtyQOdGko7j9AHmxaTcNPby0voJuj3lJgguThaW+BlIhOct6wBz4
 6Em8jnQuaYqA9BG6UChHkf7o8vpfu4r4tI/IY07h7HN4r3HWZJy8F6NszTg531KK
 YWEiq6vV+hYHB2t21EEIWy8Ew1sZWo2Nt3Xayk8en23VENaXv7DGxmpQ30Rg6h07
 iA1ewCDcps20LlHbROAR73EBF4047R57X1E4TQLyhVncgyPVLvntDodhJSfKe3Ve
 UEC+wSWU/eKM11DF/gOjslN/s/JM3EeVmnIeolSkCvRqtIysGFs=
 =kskL
 -----END PGP SIGNATURE-----

Merge 4.14.98 into android-4.14-p

Changes in 4.14.98
	Fix "net: ipv4: do not handle duplicate fragments as overlapping"
	ipv6: Consider sk_bound_dev_if when binding a socket to an address
	ipv6: sr: clear IP6CB(skb) on SRH ip4ip6 encapsulation
	l2tp: copy 4 more bytes to linear part if necessary
	net/mlx4_core: Add masking for a few queries on HCA caps
	netrom: switch to sock timer API
	net/rose: fix NULL ax25_cb kernel panic
	net: set default network namespace in init_dummy_netdev()
	ucc_geth: Reset BQL queue when stopping device
	net/mlx5e: Allow MAC invalidation while spoofchk is ON
	Revert "net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager"
	virtio_net: Don't enable NAPI when interface is down
	virtio_net: Don't call free_old_xmit_skbs for xdp_frames
	virtio_net: Fix not restoring real_num_rx_queues
	sctp: improve the events for sctp stream adding
	sctp: improve the events for sctp stream reset
	l2tp: remove l2specific_len dependency in l2tp_core
	l2tp: fix reading optional fields of L2TPv3
	ipvlan, l3mdev: fix broken l3s mode wrt local routes
	CIFS: Do not count -ENODATA as failure for query directory
	fs/dcache: Fix incorrect nr_dentry_unused accounting in shrink_dcache_sb()
	iommu/vt-d: Fix memory leak in intel_iommu_put_resv_regions()
	selftests/seccomp: Enhance per-arch ptrace syscall skip tests
	NFS: Fix up return value on fatal errors in nfs_page_async_flush()
	ARM: cns3xxx: Fix writing to wrong PCI config registers after alignment
	arm64: kaslr: ensure randomized quantities are clean also when kaslr is off
	arm64: hyp-stub: Forbid kprobing of the hyp-stub
	arm64: hibernate: Clean the __hyp_text to PoC after resume
	gpio: altera-a10sr: Set proper output level for direction_output
	gpio: pcf857x: Fix interrupts on multiple instances
	gfs2: Revert "Fix loop in gfs2_rbm_find"
	mmc: bcm2835: Fix DMA channel leak on probe error
	ALSA: hda/realtek - Fixed hp_pin no value
	IB/hfi1: Remove overly conservative VM_EXEC flag check
	platform/x86: asus-nb-wmi: Map 0x35 to KEY_SCREENLOCK
	platform/x86: asus-nb-wmi: Drop mapping of 0x33 and 0x34 scan codes
	mmc: sdhci-iproc: handle mmc_of_parse() errors during probe
	kernel/exit.c: release ptraced tasks before zap_pid_ns_processes
	oom, oom_reaper: do not enqueue same task twice
	mm, oom: fix use-after-free in oom_kill_process
	mm: hwpoison: use do_send_sig_info() instead of force_sig()
	mm: migrate: don't rely on __PageMovable() of newpage after unlocking it
	md/raid5: fix 'out of memory' during raid cache recovery
	cifs: Always resolve hostname before reconnecting
	drivers: core: Remove glue dirs from sysfs earlier
	fanotify: fix handling of events on child sub-directory
	Linux 4.14.98

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-02-07 09:12:41 +01:00
David Hildenbrand
4ebbe06b6a mm: migrate: don't rely on __PageMovable() of newpage after unlocking it
commit e0a352fabce61f730341d119fbedf71ffdb8663f upstream.

We had a race in the old balloon compaction code before b1123ea6d3b3
("mm: balloon: use general non-lru movable page feature") refactored it
that became visible after backporting 195a8c43e93d ("virtio-balloon:
deflate via a page list") without the refactoring.

The bug existed from commit d6d86c0a7f8d ("mm/balloon_compaction:
redesign ballooned pages management") till b1123ea6d3b3 ("mm: balloon:
use general non-lru movable page feature").  d6d86c0a7f8d
("mm/balloon_compaction: redesign ballooned pages management") was
backported to 3.12, so the broken kernels are stable kernels [3.12 -
4.7].

There was a subtle race between dropping the page lock of the newpage in
__unmap_and_move() and checking for __is_movable_balloon_page(newpage).

Just after dropping this page lock, virtio-balloon could go ahead and
deflate the newpage, effectively dequeueing it and clearing PageBalloon,
in turn making __is_movable_balloon_page(newpage) fail.

This resulted in dropping the reference of the newpage via
putback_lru_page(newpage) instead of put_page(newpage), leading to
page->lru getting modified and a !LRU page ending up in the LRU lists.
With 195a8c43e93d ("virtio-balloon: deflate via a page list")
backported, one would suddenly get corrupted lists in
release_pages_balloon():

- WARNING: CPU: 13 PID: 6586 at lib/list_debug.c:59 __list_del_entry+0xa1/0xd0
- list_del corruption. prev->next should be ffffe253961090a0, but was dead000000000100

Nowadays this race is no longer possible, but it is hidden behind very
ugly handling of __ClearPageMovable() and __PageMovable().

__ClearPageMovable() will not make __PageMovable() fail, only
PageMovable().  So the new check (__PageMovable(newpage)) will still
hold even after newpage was dequeued by virtio-balloon.

If anybody would ever change that special handling, the BUG would be
introduced again.  So instead, make it explicit and use the information
of the original isolated page before migration.

This patch can be backported fairly easy to stable kernels (in contrast
to the refactoring).

Link: http://lkml.kernel.org/r/20190129233217.10747-1-david@redhat.com
Fixes: d6d86c0a7f8d ("mm/balloon_compaction: redesign ballooned pages management")
Signed-off-by: David Hildenbrand <david@redhat.com>
Reported-by: Vratislav Bendel <vbendel@redhat.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Rafael Aquini <aquini@redhat.com>
Cc: Mel Gorman <mgorman@techsingularity.net>
Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>
Cc: Michal Hocko <mhocko@suse.com>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: Jan Kara <jack@suse.cz>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Dominik Brodowski <linux@dominikbrodowski.net>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Vratislav Bendel <vbendel@redhat.com>
Cc: Rafael Aquini <aquini@redhat.com>
Cc: Konstantin Khlebnikov <k.khlebnikov@samsung.com>
Cc: Minchan Kim <minchan@kernel.org>
Cc: <stable@vger.kernel.org>	[3.12 - 4.7]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-06 17:31:37 +01:00
Naoya Horiguchi
0783205e1f mm: hwpoison: use do_send_sig_info() instead of force_sig()
commit 6376360ecbe525a9c17b3d081dfd88ba3e4ed65b upstream.

Currently memory_failure() is racy against process's exiting, which
results in kernel crash by null pointer dereference.

The root cause is that memory_failure() uses force_sig() to forcibly
kill asynchronous (meaning not in the current context) processes.  As
discussed in thread https://lkml.org/lkml/2010/6/8/236 years ago for OOM
fixes, this is not a right thing to do.  OOM solves this issue by using
do_send_sig_info() as done in commit d2d393099de2 ("signal:
oom_kill_task: use SEND_SIG_FORCED instead of force_sig()"), so this
patch is suggesting to do the same for hwpoison.  do_send_sig_info()
properly accesses to siglock with lock_task_sighand(), so is free from
the reported race.

I confirmed that the reported bug reproduces with inserting some delay
in kill_procs(), and it never reproduces with this patch.

Note that memory_failure() can send another type of signal using
force_sig_mceerr(), and the reported race shouldn't happen on it because
force_sig_mceerr() is called only for synchronous processes (i.e.
BUS_MCEERR_AR happens only when some process accesses to the corrupted
memory.)

Link: http://lkml.kernel.org/r/20190116093046.GA29835@hori1.linux.bs1.fc.nec.co.jp
Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Reported-by: Jane Chu <jane.chu@oracle.com>
Reviewed-by: Dan Williams <dan.j.williams@intel.com>
Reviewed-by: William Kucharski <william.kucharski@oracle.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-06 17:31:36 +01:00
Shakeel Butt
43f7e8bea6 mm, oom: fix use-after-free in oom_kill_process
commit cefc7ef3c87d02fc9307835868ff721ea12cc597 upstream.

Syzbot instance running on upstream kernel found a use-after-free bug in
oom_kill_process.  On further inspection it seems like the process
selected to be oom-killed has exited even before reaching
read_lock(&tasklist_lock) in oom_kill_process().  More specifically the
tsk->usage is 1 which is due to get_task_struct() in oom_evaluate_task()
and the put_task_struct within for_each_thread() frees the tsk and
for_each_thread() tries to access the tsk.  The easiest fix is to do
get/put across the for_each_thread() on the selected task.

Now the next question is should we continue with the oom-kill as the
previously selected task has exited? However before adding more
complexity and heuristics, let's answer why we even look at the children
of oom-kill selected task? The select_bad_process() has already selected
the worst process in the system/memcg.  Due to race, the selected
process might not be the worst at the kill time but does that matter?
The userspace can use the oom_score_adj interface to prefer children to
be killed before the parent.  I looked at the history but it seems like
this is there before git history.

Link: http://lkml.kernel.org/r/20190121215850.221745-1-shakeelb@google.com
Reported-by: syzbot+7fbbfa368521945f0e3d@syzkaller.appspotmail.com
Fixes: 6b0c81b3be11 ("mm, oom: reduce dependency on tasklist_lock")
Signed-off-by: Shakeel Butt <shakeelb@google.com>
Reviewed-by: Roman Gushchin <guro@fb.com>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: David Rientjes <rientjes@google.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-06 17:31:36 +01:00
Tetsuo Handa
731785481a oom, oom_reaper: do not enqueue same task twice
commit 9bcdeb51bd7d2ae9fe65ea4d60643d2aeef5bfe3 upstream.

Arkadiusz reported that enabling memcg's group oom killing causes
strange memcg statistics where there is no task in a memcg despite the
number of tasks in that memcg is not 0.  It turned out that there is a
bug in wake_oom_reaper() which allows enqueuing same task twice which
makes impossible to decrease the number of tasks in that memcg due to a
refcount leak.

This bug existed since the OOM reaper became invokable from
task_will_free_mem(current) path in out_of_memory() in Linux 4.7,

  T1@P1     |T2@P1     |T3@P1     |OOM reaper
  ----------+----------+----------+------------
                                   # Processing an OOM victim in a different memcg domain.
                        try_charge()
                          mem_cgroup_out_of_memory()
                            mutex_lock(&oom_lock)
             try_charge()
               mem_cgroup_out_of_memory()
                 mutex_lock(&oom_lock)
  try_charge()
    mem_cgroup_out_of_memory()
      mutex_lock(&oom_lock)
                            out_of_memory()
                              oom_kill_process(P1)
                                do_send_sig_info(SIGKILL, @P1)
                                mark_oom_victim(T1@P1)
                                wake_oom_reaper(T1@P1) # T1@P1 is enqueued.
                            mutex_unlock(&oom_lock)
                 out_of_memory()
                   mark_oom_victim(T2@P1)
                   wake_oom_reaper(T2@P1) # T2@P1 is enqueued.
                 mutex_unlock(&oom_lock)
      out_of_memory()
        mark_oom_victim(T1@P1)
        wake_oom_reaper(T1@P1) # T1@P1 is enqueued again due to oom_reaper_list == T2@P1 && T1@P1->oom_reaper_list == NULL.
      mutex_unlock(&oom_lock)
                                   # Completed processing an OOM victim in a different memcg domain.
                                   spin_lock(&oom_reaper_lock)
                                   # T1P1 is dequeued.
                                   spin_unlock(&oom_reaper_lock)

but memcg's group oom killing made it easier to trigger this bug by
calling wake_oom_reaper() on the same task from one out_of_memory()
request.

Fix this bug using an approach used by commit 855b018325737f76 ("oom,
oom_reaper: disable oom_reaper for oom_kill_allocating_task").  As a
side effect of this patch, this patch also avoids enqueuing multiple
threads sharing memory via task_will_free_mem(current) path.

Link: http://lkml.kernel.org/r/e865a044-2c10-9858-f4ef-254bc71d6cc2@i-love.sakura.ne.jp
Link: http://lkml.kernel.org/r/5ee34fc6-1485-34f8-8790-903ddabaa809@i-love.sakura.ne.jp
Fixes: af8e15cc85a25315 ("oom, oom_reaper: do not enqueue task if it is on the oom_reaper_list head")
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Reported-by: Arkadiusz Miskiewicz <arekm@maven.pl>
Tested-by: Arkadiusz Miskiewicz <arekm@maven.pl>
Acked-by: Michal Hocko <mhocko@suse.com>
Acked-by: Roman Gushchin <guro@fb.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Aleksa Sarai <asarai@suse.de>
Cc: Jay Kamat <jgkamat@fb.com>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-02-06 17:31:36 +01:00
Blagovest Kolenichev
0927a7b7f2 Merge android-4.14-p.91 (eef4cf6) into msm-4.14
* refs/heads/tmp-eef4cf6:
  Revert "mmc: core: Allow BKOPS and CACHE ctrl even if no HPI support"
  Linux 4.14.91
  drm/ioctl: Fix Spectre v1 vulnerabilities
  proc/sysctl: don't return ENOMEM on lookup when a table is unregistering
  mm: don't miss the last page because of round-off error
  ubifs: Handle re-linking of inodes correctly while recovery
  spi: imx: mx51-ecspi: Move some initialisation to prepare_message hook.
  spi: imx: add a device specific prepare_message callback
  iwlwifi: add new cards for 9560, 9462, 9461 and killer series
  iwlwifi: mvm: don't send GEO_TX_POWER_LIMIT to old firmwares
  panic: avoid deadlocks in re-entrant console drivers
  x86/mtrr: Don't copy uninitialized gentry fields back to userspace
  Drivers: hv: vmbus: Return -EINVAL for the sys files for unopened channels
  KVM: Fix UAF in nested posted interrupt processing
  kvm: x86: Add AMD's EX_CFG to the list of ignored MSRs
  posix-timers: Fix division by zero bug
  gpiolib-acpi: Only defer request_irq for GpioInt ACPI event handlers
  gpio: max7301: fix driver for use with CONFIG_VMAP_STACK
  mmc: omap_hsmmc: fix DMA API warning
  mmc: core: Use a minimum 1600ms timeout when enabling CACHE ctrl
  mmc: core: Allow BKOPS and CACHE ctrl even if no HPI support
  mmc: core: Reset HPI enabled state during re-init and in case of errors
  scsi: sd: use mempool for discard special page
  USB: serial: option: add Telit LN940 series
  USB: serial: option: add Fibocom NL668 series
  USB: serial: option: add Simcom SIM7500/SIM7600 (MBIM mode)
  USB: serial: option: add HP lt4132
  USB: serial: option: add GosunCn ZTE WeLink ME3630
  USB: xhci: fix 'broken_suspend' placement in struct xchi_hcd
  xhci: Don't prevent USB2 bus suspend in state check intended for USB3 only
  USB: hso: Fix OOB memory access in hso_probe/hso_get_config_data
  cifs: integer overflow in in SMB2_ioctl()
  perf record: Synthesize features before events in pipe mode
  ib_srpt: Fix a use-after-free in __srpt_close_all_ch()
  ubifs: Fix directory size calculation for symlinks
  ASoC: sta32x: set ->component pointer in private struct
  block: fix infinite loop if the device loses discard capability
  block: break discard submissions into the user defined size

Conflicts:
	drivers/mmc/core/mmc.c

Change-Id: I1f0d24983198c7aa704dd334696e72dc8bf93b67
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
2019-01-29 12:18:16 -08:00
Blagovest Kolenichev
0d58d668a7 Merge android-4.14-p.89 (15223da) into msm-4.14
* refs/heads/tmp-15223da:
  Linux 4.14.89
  tcp: lack of available data can also cause TSO defer
  IB/hfi1: Fix an out-of-bounds access in get_hw_stats
  ALSA: hda/realtek - Fixed headphone issue for ALC700
  ALSA: fireface: fix reference to wrong register for clock configuration
  staging: speakup: Replace strncpy with memcpy
  flexfiles: enforce per-mirror stateid only for v4 DSes
  lib/rbtree-test: lower default params
  printk: Wake klogd when passing console_lock owner
  printk: Never set console_may_schedule in console_trylock()
  printk: Hide console waiter logic into helpers
  printk: Add console owner and waiter logic to load balance console writes
  Revert "printk: Never set console_may_schedule in console_trylock()"
  ocfs2: fix potential use after free
  debugobjects: avoid recursive calls with kmemleak
  hfsplus: do not free node before using
  hfs: do not free node before using
  mm/page_alloc.c: fix calculation of pgdat->nr_zones
  ocfs2: fix deadlock caused by ocfs2_defrag_extent()
  ACPI/IORT: Fix iort_get_platform_device_domain() uninitialized pointer value
  nvme: flush namespace scanning work just before removing namespaces
  fscache, cachefiles: remove redundant variable 'cache'
  fscache: fix race between enablement and dropping of object
  pstore/ram: Correctly calculate usable PRZ bytes
  Revert "xen/balloon: Mark unallocated host memory as UNUSABLE"
  xen: xlate_mmu: add missing header to fix 'W=1' warning
  drm/ast: fixed reading monitor EDID not stable issue
  drm/amdgpu: Add delay after enable RLC ucode
  net: hisilicon: remove unexpected free_netdev
  ixgbe: recognize 1000BaseLX SFP modules as 1Gbps
  igb: fix uninitialized variables
  cachefiles: Fix page leak in cachefiles_read_backing_file while vmscan is active
  netfilter: nf_tables: deactivate expressions in rule replecement routine
  usb: gadget: u_ether: fix unsafe list iteration
  net: thunderx: fix NULL pointer dereference in nic_remove
  x86/kvm/vmx: fix old-style function declaration
  KVM: x86: fix empty-body warnings
  IB/mlx5: Fix page fault handling for MW
  netfilter: ipv6: Preserve link scope traffic original oif
  drm/meson: add support for 1080p25 mode
  USB: omap_udc: fix rejection of out transfers when DMA is used
  USB: omap_udc: fix USB gadget functionality on Palm Tungsten E
  USB: omap_udc: fix omap_udc_start() on 15xx machines
  USB: omap_udc: fix crashes on probe error and module removal
  USB: omap_udc: use devm_request_irq()
  ipvs: call ip_vs_dst_notifier earlier than ipv6_dev_notf
  bpf: fix check of allowed specifiers in bpf_trace_printk
  exportfs: do not read dentry after free
  ASoC: omap-dmic: Add pm_qos handling to avoid overruns with CPU_IDLE
  ASoC: omap-mcpdm: Add pm_qos handling to avoid under/overruns with CPU_IDLE
  ASoC: omap-mcbsp: Fix latency value calculation for pm_qos
  RDMA/rdmavt: Fix rvt_create_ah function signature
  RDMA/mlx5: Fix fence type for IB_WR_LOCAL_INV WR
  Btrfs: send, fix infinite loop due to directory rename dependencies
  ARM: dts: at91: sama5d2: use the divided clock for SMC
  objtool: Fix segfault in .cold detection with -ffunction-sections
  objtool: Fix double-free in .cold detection error path
  PCI: imx6: Fix link training status detection in link up check
  perf tools: Restore proper cwd on return from mnt namespace
  hwmon: (w83795) temp4_type has writable permission
  netfilter: xt_hashlimit: fix a possible memory leak in htable_create()
  iio/hid-sensors: Fix IIO_CHAN_INFO_RAW returning wrong values for signed numbers
  ASoC: dapm: Recalculate audio map forcely when card instantiated
  ASoC: omap-abe-twl6040: Fix missing audio card caused by deferred probing
  hwmon: (ina2xx) Fix current value calculation
  s390/cpum_cf: Reject request for sampling in event initialization
  ASoC: wm_adsp: Fix dma-unsafe read of scratch registers
  hwmon (ina2xx) Fix NULL id pointer in probe()
  netfilter: nf_tables: fix use-after-free when deleting compat expressions
  selftests: add script to stress-test nft packet path vs. control plane
  sysv: return 'err' instead of 0 in __sysv_write_inode
  ARM: OMAP1: ams-delta: Fix possible use of uninitialized field
  ARM: dts: logicpd-somlv: Fix interrupt on mmc3_dat1
  staging: rtl8723bs: Fix the return value in case of error in 'rtw_wx_read32()'
  ASoC: rsnd: fixup clock start checker
  ARM: OMAP2+: prm44xx: Fix section annotation on omap44xx_prm_enable_io_wakeup
  virtio-net: keep vnet header zeroed after processing XDP
  tun: forbid iface creation with rtnl ops
  tcp: fix NULL ref in tail loss probe
  tcp: Do not underestimate rwnd_limited
  sctp: kfree_rcu asoc
  rtnetlink: ndo_dflt_fdb_dump() only work for ARPHRD_ETHER devices
  net: Prevent invalid access to skb->prev in __qdisc_drop_all
  net: phy: don't allow __set_phy_supported to add unsupported modes
  net/mlx4_en: Change min MTU size to ETH_MIN_MTU
  net/mlx4_core: Correctly set PFC param if global pause is turned off.
  net: 8139cp: fix a BUG triggered by changing mtu with network traffic
  ipv6: sr: properly initialize flowi6 prior passing to ip6_route_output
  neighbour: Avoid writing before skb->head in neigh_hh_output()
  ipv6: Check available headroom in ip6_xmit() even without options
  ipv4: ipv6: netfilter: Adjust the frag mem limit when truesize changes

Change-Id: If2c3d06f2adb805736851021e7c0a4508e228d65
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
2019-01-28 06:16:20 -08:00
Blagovest Kolenichev
efc9710f17 Merge android-4.14-p.88 (761e571) into msm-4.14
* refs/heads/tmp-761e571:
  Linux 4.14.88
  mac80211: ignore NullFunc frames in the duplicate detection
  mac80211: fix reordering of buffered broadcast packets
  mac80211: ignore tx status for PS stations in ieee80211_tx_status_ext
  mac80211: Clear beacon_int in ieee80211_do_stop
  mac80211_hwsim: Timer should be initialized before device registered
  libnvdimm, pfn: Pad pfn namespaces relative to other regions
  kgdboc: fix KASAN global-out-of-bounds bug in param_set_kgdboc_var()
  tty: do not set TTY_IO_ERROR flag if console port
  tty: serial: 8250_mtk: always resume the device in probe.
  Drivers: hv: vmbus: Offload the handling of channels to two workqueues
  drm/amdgpu/gmc8: update MC firmware for polaris
  drm/amdgpu: update mc firmware image for polaris12 variants
  Revert commit ef9209b642f "staging: rtl8723bs: Fix indenting errors and an off-by-one mistake in core/rtw_mlme_ext.c"
  staging: rtl8712: Fix possible buffer overrun
  cifs: Fix separator when building path from dentry
  staging: atomisp: remove "fun" strncpy warning
  Staging: lustre: remove two build warnings
  swiotlb: clean up reporting
  f2fs: fix to do sanity check with block address in main area v2
  xhci: Prevent U1/U2 link pm states if exit latency is too long
  xhci: workaround CSS timeout on AMD SNPS 3.0 xHC
  ARM: 8806/1: kprobes: Fix false positive with FORTIFY_SOURCE
  dmaengine: cppi41: delete channel from pending list when stop channel
  dmaengine: dw: Fix FIFO size for Intel Merrifield
  SUNRPC: Fix leak of krb5p encode pages
  vhost/vsock: fix use-after-free in network stack callers
  virtio/s390: fix race in ccw_io_helper()
  virtio/s390: avoid race on vcdev->config
  ALSA: hda/realtek - Fix speaker output regression on Thinkpad T570
  ALSA: pcm: Fix interval evaluation with openmin/max
  ALSA: pcm: Call snd_pcm_unlink() conditionally at closing
  ALSA: pcm: Fix starvation on down_write_nonblock()
  ALSA: hda: Add support for AMD Stoney Ridge
  ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c
  USB: check usb_get_extra_descriptor for proper size
  usb: appledisplay: Add 27" Apple Cinema Display
  usb: quirk: add no-LPM quirk on SanDisk Ultra Flair device
  mm: don't warn about allocations which stall for too long
  net: amd: add missing of_node_put()
  team: no need to do team_notify_peers or team_mcast_rejoin when disabling port
  ibmvnic: Fix RX queue buffer cleanup
  flexfiles: use per-mirror specified stateid for IO
  iommu/vt-d: Use memunmap to free memremap
  net: faraday: ftmac100: remove netif_running(netdev) check before disabling interrupts
  qed: Fix QM getters to always return a valid pq
  qed: Fix bitmap_weight() check
  mtd: spi-nor: Fix Cadence QSPI page fault kernel panic
  HID: multitouch: Add pointstick support for Cirque Touchpad
  mtd: rawnand: qcom: Namespace prefix some commands
  gpio: mockup: fix indicated direction
  net/mlx4: Fix UBSAN warning of signed integer overflow
  net/mlx4_core: Fix uninitialized variable compilation warning
  net/mlx4_core: Zero out lkey field in SW2HW_MPT fw command
  Revert "usb: gadget: ffs: Fix BUG when userland exits with submitted AIO transfers"
  qed: Fix reading wrong value in loop condition
  qed: Fix PTT leak in qed_drain()
  bnx2x: Assign unique DMAE channel number for FW DMAE transactions.
  amd/iommu: Fix Guest Virtual APIC Log Tail Address Register
  batman-adv: Expand merged fragment buffer for full packet
  batman-adv: Use explicit tvlv padding for ELP packets
  HID: input: Ignore battery reported by Symbol DS4308
  test_firmware: fix error return getting clobbered
  can: rcar_can: Fix erroneous registration
  iommu/ipmmu-vmsa: Fix crash on early domain free
  brcmutil: really fix decoding channel info for 160 MHz bandwidth
  iommu/vt-d: Fix NULL pointer dereference in prq_event_thread()
  media: omap3isp: Unregister media device as first
  ANDROID: revert all remaining hisi_thermal.c changes

Conflicts:
	drivers/usb/gadget/function/f_fs.c
	drivers/usb/host/xhci.c
	sound/usb/card.c

Change-Id: I3ed3c6b3d303f0b8cd0b9dfe4afe7a25dee668c9
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
2019-01-28 06:16:13 -08:00
qctecmdr Service
091230177c Merge "Merge android-4.14-p.87 (11d6531a) into msm-4.14" 2019-01-27 06:46:43 -08:00
Greg Kroah-Hartman
053a46d9da This is the 4.14.96 stable release
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEEZH8oZUiU471FcZm+ONu9yGCSaT4FAlxMHDMACgkQONu9yGCS
 aT4oYQ/+OclwNUcJKM2zF4slFRZdvrLKWeOwnroUQ8vzOGrTQTs7G7okXTAI6v2t
 TcaNkz91ACbwpHLsGzXkKtjfxrbEgsPAfMzfycZqqg00//BW4VJqa/WYQOrJDe8q
 e7g2mVXBDwAyAHHPwlYc8MKWmptQn8qI8YySDN5jaSu8tyLjFuW3HvoUn6ex0Txh
 qKTx7z4g7N/SMzgwXtd9Ybi9ubqqolMhU1psXJMNGEZkudAOJHx7nXEoPXUlZV4t
 fb3TzAA3JSfXZMSobgYyVsv/KDoXutLdvP7LsexXTGnvZ2CfYeM9MUCLLH+U5Hq4
 NZ0ot7Qgd/sdKF9CYi+Z2urUF+Ug53toWqWSxfntPYmAHAZTFCDYbICzb+O/FaCr
 DFShHGbyaw7QVnsMOfhrRsIgRqnooOUJ1GlVXPAfROH3O0HFJ58xEYy5jzIPklQG
 l4vi8xkcmO67m4B1eGs3t+/VygMXxCZGKdj1+PkJYow44o6FYDq5UyEmPnl7FzG8
 JKBg8gye3AJla2lz+IzGDrGOlkxVphNH0ESPNDDSxD3E+2vKZtzK9Gmf99kfYByW
 tuAGmo/banQ5qrJpgJ7vQWpvapH454GA6U2/a4Z/G5oXI2paQ7benbLtyRvbHsMD
 ELsbyOdzxcWNTl+KQ0l2AU71TprwSI0/wDfO5mXYXfQ8U5ZTrWU=
 =Sxip
 -----END PGP SIGNATURE-----

Merge 4.14.96 into android-4.14-p

Changes in 4.14.96
	ipv6: Consider sk_bound_dev_if when binding a socket to a v4 mapped address
	mlxsw: spectrum: Disable lag port TX before removing it
	mlxsw: spectrum_switchdev: Set PVID correctly during VLAN deletion
	net, skbuff: do not prefer skb allocation fails early
	qmi_wwan: add MTU default to qmap network interface
	r8169: Add support for new Realtek Ethernet
	ipv6: Take rcu_read_lock in __inet6_bind for mapped addresses
	net: dsa: mv88x6xxx: mv88e6390 errata
	gpio: pl061: Move irq_chip definition inside struct pl061
	platform/x86: asus-wmi: Tell the EC the OS will handle the display off hotkey
	e1000e: allow non-monotonic SYSTIM readings
	writeback: don't decrement wb->refcnt if !wb->bdi
	serial: set suppress_bind_attrs flag only if builtin
	ALSA: oxfw: add support for APOGEE duet FireWire
	x86/mce: Fix -Wmissing-prototypes warnings
	MIPS: SiByte: Enable swiotlb for SWARM, LittleSur and BigSur
	arm64: perf: set suppress_bind_attrs flag to true
	usb: gadget: udc: renesas_usb3: add a safety connection way for forced_b_device
	selinux: always allow mounting submounts
	rxe: IB_WR_REG_MR does not capture MR's iova field
	jffs2: Fix use of uninitialized delayed_work, lockdep breakage
	clk: imx: make mux parent strings const
	pstore/ram: Do not treat empty buffers as valid
	powerpc/xmon: Fix invocation inside lock region
	powerpc/pseries/cpuidle: Fix preempt warning
	media: firewire: Fix app_info parameter type in avc_ca{,_app}_info
	media: venus: core: Set dma maximum segment size
	net: call sk_dst_reset when set SO_DONTROUTE
	scsi: target: use consistent left-aligned ASCII INQUIRY data
	selftests: do not macro-expand failed assertion expressions
	clk: imx6q: reset exclusive gates on init
	arm64: Fix minor issues with the dcache_by_line_op macro
	kconfig: fix file name and line number of warn_ignored_character()
	kconfig: fix memory leak when EOF is encountered in quotation
	mmc: atmel-mci: do not assume idle after atmci_request_end
	btrfs: improve error handling of btrfs_add_link
	tty/serial: do not free trasnmit buffer page under port lock
	perf intel-pt: Fix error with config term "pt=0"
	perf svghelper: Fix unchecked usage of strncpy()
	perf parse-events: Fix unchecked usage of strncpy()
	netfilter: ipt_CLUSTERIP: check MAC address when duplicate config is set
	dm crypt: use u64 instead of sector_t to store iv_offset
	dm kcopyd: Fix bug causing workqueue stalls
	tools lib subcmd: Don't add the kernel sources to the include path
	dm snapshot: Fix excessive memory usage and workqueue stalls
	quota: Lock s_umount in exclusive mode for Q_XQUOTA{ON,OFF} quotactls.
	clocksource/drivers/integrator-ap: Add missing of_node_put()
	ALSA: bebob: fix model-id of unit for Apogee Ensemble
	sysfs: Disable lockdep for driver bind/unbind files
	IB/usnic: Fix potential deadlock
	scsi: smartpqi: correct lun reset issues
	scsi: smartpqi: call pqi_free_interrupts() in pqi_shutdown()
	scsi: megaraid: fix out-of-bound array accesses
	ocfs2: fix panic due to unrecovered local alloc
	mm/page-writeback.c: don't break integrity writeback on ->writepage() error
	mm/swap: use nr_node_ids for avail_lists in swap_info_struct
	mm, proc: be more verbose about unstable VMA flags in /proc/<pid>/smaps
	nfs: fix a deadlock in nfs client initialization
	ipmi:pci: Blacklist a Realtek "IPMI" device
	cifs: allow disabling insecure dialects in the config
	drm/i915/gvt: Fix mmap range check
	PCI: dwc: Move interrupt acking into the proper callback
	ipmi:ssif: Fix handling of multi-part return messages
	Linux 4.14.96

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
2019-01-26 12:01:17 +01:00
Aaron Lu
4fb12a087a mm/swap: use nr_node_ids for avail_lists in swap_info_struct
[ Upstream commit 66f71da9dd38af17dc17209cdde7987d4679a699 ]

Since a2468cc9bfdf ("swap: choose swap device according to numa node"),
avail_lists field of swap_info_struct is changed to an array with
MAX_NUMNODES elements.  This made swap_info_struct size increased to 40KiB
and needs an order-4 page to hold it.

This is not optimal in that:
1 Most systems have way less than MAX_NUMNODES(1024) nodes so it
  is a waste of memory;
2 It could cause swapon failure if the swap device is swapped on
  after system has been running for a while, due to no order-4
  page is available as pointed out by Vasily Averin.

Solve the above two issues by using nr_node_ids(which is the actual
possible node number the running system has) for avail_lists instead of
MAX_NUMNODES.

nr_node_ids is unknown at compile time so can't be directly used when
declaring this array.  What I did here is to declare avail_lists as zero
element array and allocate space for it when allocating space for
swap_info_struct.  The reason why keep using array but not pointer is
plist_for_each_entry needs the field to be part of the struct, so pointer
will not work.

This patch is on top of Vasily Averin's fix commit.  I think the use of
kvzalloc for swap_info_struct is still needed in case nr_node_ids is
really big on some systems.

Link: http://lkml.kernel.org/r/20181115083847.GA11129@intel.com
Signed-off-by: Aaron Lu <aaron.lu@intel.com>
Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Vasily Averin <vvs@virtuozzo.com>
Cc: Huang Ying <ying.huang@intel.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-01-26 09:37:06 +01:00
Brian Foster
694c20fe01 mm/page-writeback.c: don't break integrity writeback on ->writepage() error
[ Upstream commit 3fa750dcf29e8606e3969d13d8e188cc1c0f511d ]

write_cache_pages() is used in both background and integrity writeback
scenarios by various filesystems.  Background writeback is mostly
concerned with cleaning a certain number of dirty pages based on various
mm heuristics.  It may not write the full set of dirty pages or wait for
I/O to complete.  Integrity writeback is responsible for persisting a set
of dirty pages before the writeback job completes.  For example, an
fsync() call must perform integrity writeback to ensure data is on disk
before the call returns.

write_cache_pages() unconditionally breaks out of its processing loop in
the event of a ->writepage() error.  This is fine for background
writeback, which had no strict requirements and will eventually come
around again.  This can cause problems for integrity writeback on
filesystems that might need to clean up state associated with failed page
writeouts.  For example, XFS performs internal delayed allocation
accounting before returning a ->writepage() error, where applicable.  If
the current writeback happens to be associated with an unmount and
write_cache_pages() completes the writeback prematurely due to error, the
filesystem is unmounted in an inconsistent state if dirty+delalloc pages
still exist.

To handle this problem, update write_cache_pages() to always process the
full set of pages for integrity writeback regardless of ->writepage()
errors.  Save the first encountered error and return it to the caller once
complete.  This facilitates XFS (or any other fs that expects integrity
writeback to process the entire set of dirty pages) to clean up its
internal state completely in the event of persistent mapping errors.
Background writeback continues to exit on the first error encountered.

[akpm@linux-foundation.org: fix typo in comment]
Link: http://lkml.kernel.org/r/20181116134304.32440-1-bfoster@redhat.com
Signed-off-by: Brian Foster <bfoster@redhat.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2019-01-26 09:37:06 +01:00
Blagovest Kolenichev
124f6fb729 Merge android-4.14-p.87 (11d6531a) into msm-4.14
* refs/heads/tmp-11d6531a:
  Linux 4.14.87
  tipc: use destination length for copy string
  net: qed: use correct strncpy() size
  mm: hide incomplete nr_indirectly_reclaimable in /proc/zoneinfo
  thermal/drivers/hisi: Remove costly sensor inspection
  thermal/drivers/hisi: Fix configuration register setting
  thermal/drivers/hisi: Encapsulate register writes into helpers
  thermal/drivers/hisi: Remove pointless lock
  thermal/drivers/hisi: Remove the multiple sensors support
  mm: cleancache: fix corruption on missed inode invalidation
  reset: remove remaining WARN_ON() in <linux/reset.h>
  reset: make device_reset_optional() really optional
  udf: Allow mounting volumes with incorrect identification strings
  arc: [devboards] Add support of NFSv3 ACL
  ARC: change defconfig defaults to ARCv2
  btrfs: Always try all copies when reading extent buffers
  btrfs: tree-checker: Don't check max block group size as current max chunk size limit is unreliable
  Input: elan_i2c - add support for ELAN0621 touchpad
  Input: elan_i2c - add ACPI ID for Lenovo IdeaPad 330-15ARR
  Input: elan_i2c - add ELAN0620 to the ACPI table
  Input: cros_ec_keyb - fix button/switch capability reports
  Input: matrix_keypad - check for errors from of_get_named_gpio()
  Input: synaptics - add PNP ID for ThinkPad P50 to SMBus
  Input: xpad - quirk all PDP Xbox One gamepads
  drm/msm: fix OF child-node lookup
  svm: Add mutex_lock to protect apic_access_page_done on AMD systems
  kgdboc: Fix warning with module build
  kgdboc: Fix restrict error
  ALSA: trident: Suppress gcc string warning
  userfaultfd: shmem/hugetlbfs: only allow to register VM_MAYWRITE vmas
  scsi: scsi_devinfo: cleanly zero-pad devinfo strings
  userfaultfd: shmem: UFFDIO_COPY: set the page dirty if VM_WRITE is not set
  userfaultfd: shmem: add i_size checks
  userfaultfd: shmem: allocate anonymous memory for MAP_PRIVATE shmem
  userfaultfd: use ENOENT instead of EFAULT if the atomic copy user fails
  drm/meson: Fix OOB memory accesses in meson_viu_set_osd_lut()
  drm/meson: Enable fast_io in meson_dw_hdmi_regmap_config
  drm: set is_master to 0 upon drm_new_set_master() failure
  drm/ast: Fix incorrect free on ioregs
  IB/mlx5: Avoid load failure due to unknown link width
  mips: fix mips_get_syscall_arg o32 check
  MIPS: ralink: Fix mt7620 nd_sd pinmux
  uprobes: Fix handle_swbp() vs. unregister() + register() race once more
  iser: set sector for ambiguous mr status errors
  kdb: use memmove instead of overlapping memcpy
  staging: rts5208: fix gcc-8 logic error warning
  scsi: bfa: convert to strlcpy/strlcat
  drm: gma500: fix logic error
  ip_tunnel: Fix name string concatenate in __ip_tunnel_create()
  kernfs: Replace strncpy with memcpy
  unifdef: use memcpy instead of strncpy
  ALSA: intel_hdmi: Use strlcpy() instead of strncpy()
  kobject: Replace strncpy with memcpy
  test_hexdump: use memcpy instead of strncpy
  disable stringop truncation warnings for now
  Kbuild: suppress packed-not-aligned warning for default setting only

Change-Id: I8b6e611925fe710d944256d011f76e29869f7508
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
2019-01-25 06:21:50 -08:00
Isaac J. Manjarres
63690ffd87 Merge android-4.14-p.86 (8629d9b) into msm-4.14
* refs/heads/tmp-8629d9b:
  Linux 4.14.86
  f2fs: fix missing up_read
  libceph: check authorizer reply/challenge length before reading
  libceph: weaken sizeof check in ceph_x_verify_authorizer_reply()
  binder: fix race that allows malicious free of live buffer
  misc: mic/scif: fix copy-paste error in scif_create_remote_lookup
  Drivers: hv: vmbus: check the creation_status in vmbus_establish_gpadl()
  mm: use swp_offset as key in shmem_replace_page()
  lib/test_kmod.c: fix rmmod double free
  iio:st_magn: Fix enable device after trigger
  Revert "usb: dwc3: gadget: skip Set/Clear Halt when invalid"
  usb: core: quirks: add RESET_RESUME quirk for Cherry G230 Stream series
  USB: usb-storage: Add new IDs to ums-realtek
  staging: rtl8723bs: Add missing return for cfg80211_rtw_get_station
  staging: vchiq_arm: fix compat VCHIQ_IOC_AWAIT_COMPLETION
  btrfs: release metadata before running delayed refs
  dmaengine: at_hdmac: fix module unloading
  dmaengine: at_hdmac: fix memory leak in at_dma_xlate()
  ARM: dts: rockchip: Remove @0 from the veyron memory node
  ext2: fix potential use after free
  ALSA: hda/realtek - fix headset mic detection for MSI MS-B171
  ALSA: hda/realtek - Support ALC300
  ALSA: sparc: Fix invalid snd_free_pages() at error path
  ALSA: control: Fix race between adding and removing a user element
  ALSA: ac97: Fix incorrect bit shift at AC97-SPSA control write
  ALSA: wss: Fix invalid snd_free_pages() at error path
  fs: fix lost error code in dio_complete
  perf/x86/intel: Add generic branch tracing check to intel_pmu_has_bts()
  perf/x86/intel: Move branch tracing setup to the Intel-specific source file
  x86/fpu: Disable bottom halves while loading FPU registers
  x86/MCE/AMD: Fix the thresholding machinery initialization order
  arm64: dts: rockchip: Fix PCIe reset polarity for rk3399-puma-haikou.
  PCI: layerscape: Fix wrong invocation of outbound window disable accessor
  btrfs: relocation: set trans to be NULL after ending transaction
  Btrfs: ensure path name is null terminated at btrfs_control_ioctl
  xtensa: fix coprocessor part of ptrace_{get,set}xregs
  xtensa: fix coprocessor context offset definitions
  xtensa: enable coprocessors that are being flushed
  KVM: X86: Fix scan ioapic use-before-initialization
  KVM: x86: Fix kernel info-leak in KVM_HC_CLOCK_PAIRING hypercall
  kvm: svm: Ensure an IBPB on all affected CPUs when freeing a vmcb
  kvm: mmu: Fix race in emulated page table writes
  x86/speculation: Provide IBPB always command line options
  x86/speculation: Add seccomp Spectre v2 user space protection mode
  x86/speculation: Enable prctl mode for spectre_v2_user
  x86/speculation: Add prctl() control for indirect branch speculation
  x86/speculation: Prepare arch_smt_update() for PRCTL mode
  x86/speculation: Prevent stale SPEC_CTRL msr content
  x86/speculation: Split out TIF update
  ptrace: Remove unused ptrace_may_access_sched() and MODE_IBRS
  x86/speculation: Prepare for conditional IBPB in switch_mm()
  x86/speculation: Avoid __switch_to_xtra() calls
  x86/process: Consolidate and simplify switch_to_xtra() code
  x86/speculation: Prepare for per task indirect branch speculation control
  x86/speculation: Add command line control for indirect branch speculation
  x86/speculation: Unify conditional spectre v2 print functions
  x86/speculataion: Mark command line parser data __initdata
  x86/speculation: Mark string arrays const correctly
  x86/speculation: Reorder the spec_v2 code
  x86/l1tf: Show actual SMT state
  x86/speculation: Rework SMT state change
  sched/smt: Expose sched_smt_present static key
  x86/Kconfig: Select SCHED_SMT if SMP enabled
  sched/smt: Make sched_smt_present track topology
  x86/speculation: Reorganize speculation control MSRs update
  x86/speculation: Rename SSBD update functions
  x86/speculation: Disable STIBP when enhanced IBRS is in use
  x86/speculation: Move STIPB/IBPB string conditionals out of cpu_show_common()
  x86/speculation: Remove unnecessary ret variable in cpu_show_common()
  x86/speculation: Clean up spectre_v2_parse_cmdline()
  x86/speculation: Update the TIF_SSBD comment
  x86/retpoline: Remove minimal retpoline support
  x86/retpoline: Make CONFIG_RETPOLINE depend on compiler support
  x86/speculation: Add RETPOLINE_AMD support to the inline asm CALL_NOSPEC variant
  x86/speculation: Propagate information about RSB filling mitigation to sysfs
  x86/speculation: Apply IBPB more strictly to avoid cross-process data leak
  x86/speculation: Enable cross-hyperthread spectre v2 STIBP mitigation
  x86/bugs: Fix the AMD SSBD usage of the SPEC_CTRL MSR
  x86/bugs: Update when to check for the LS_CFG SSBD mitigation
  x86/bugs: Switch the selection of mitigation from CPU vendor to CPU features
  x86/bugs: Add AMD's SPEC_CTRL MSR usage
  x86/bugs: Add AMD's variant of SSB_NO
  sched/core: Fix cpu.max vs. cpuhotplug deadlock
  usbnet: ipheth: fix potential recvmsg bug and recvmsg bug 2
  s390/qeth: fix length check in SNMP processing
  rapidio/rionet: do not free skb before reading its length
  packet: copy user buffers before orphan or clone
  net: thunderx: set tso_hdrs pointer to NULL in nicvf_free_snd_queue
  virtio-net: fail XDP set if guest csum is negotiated
  virtio-net: disable guest csum during XDP set
  net: thunderx: set xdp_prog to NULL if bpf_prog_add fails
  net: skb_scrub_packet(): Scrub offload_fwd_mark
  Revert "wlcore: Add missing PM call for wlcore_cmd_wait_for_event_or_timeout()"
  xfs: don't fail when converting shortform attr to long form during ATTR_REPLACE
  f2fs: fix to do sanity check with cp_pack_start_sum
  f2fs: fix to do sanity check with i_extra_isize
  f2fs: fix to do sanity check with block address in main area
  f2fs: fix to do sanity check with node footer and iblocks
  f2fs: fix to do sanity check with user_block_count
  f2fs: fix to do sanity check with extra_attr feature
  f2fs: Add sanity_check_inode() function
  f2fs: fix to do sanity check with secs_per_zone
  f2fs: introduce and spread verify_blkaddr
  f2fs: clean up with is_valid_blkaddr()
  f2fs: enhance sanity_check_raw_super() to avoid potential overflow
  f2fs: sanity check on sit entry
  f2fs: check blkaddr more accuratly before issue a bio
  btrfs: tree-checker: Fix misleading group system information
  btrfs: tree-checker: Check level for leaves and nodes
  btrfs: Check that each block group has corresponding chunk at mount time
  btrfs: tree-checker: Detect invalid and empty essential trees
  btrfs: tree-checker: Verify block_group_item
  btrfs: tree-check: reduce stack consumption in check_dir_item
  btrfs: tree-checker: use %zu format string for size_t
  btrfs: tree-checker: Add checker for dir item
  btrfs: tree-checker: Fix false panic for sanity test
  btrfs: tree-checker: Enhance btrfs_check_node output
  btrfs: Move leaf and node validation checker to tree-checker.c
  btrfs: Add checker for EXTENT_CSUM
  btrfs: Add sanity check for EXTENT_DATA when reading out leaf
  btrfs: Check if item pointer overlaps with the item itself
  btrfs: Refactor check_leaf function for later expansion
  btrfs: Verify that every chunk has corresponding block group at mount time
  btrfs: validate type when reading a chunk
  wil6210: missing length check in wmi_set_ie
  net/tls: Fixed return value when tls_complete_pending_work() fails
  tls: Use correct sk->sk_prot for IPV6
  tls: don't override sk_write_space if tls_set_sw_offload fails.
  tls: Avoid copying crypto_info again after cipher_type check.
  tls: Fix TLS ulp context leak, when TLS_TX setsockopt is not used.
  tls: Add function to update the TLS socket configuration
  bpf: Prevent memory disambiguation attack
  libceph: implement CEPHX_V2 calculation mode
  libceph: add authorizer challenge
  libceph: factor out encrypt_authorizer()
  libceph: factor out __ceph_x_decrypt()
  libceph: factor out __prepare_write_connect()
  libceph: store ceph_auth_handshake pointer in ceph_connection
  ubi: Initialize Fastmap checkmapping correctly
  media: em28xx: Fix use-after-free when disconnecting
  mm/khugepaged: collapse_shmem() do not crash on Compound
  mm/khugepaged: collapse_shmem() without freezing new_page
  mm/khugepaged: minor reorderings in collapse_shmem()
  mm/khugepaged: collapse_shmem() remember to clear holes
  mm/khugepaged: fix crashes due to misaccounted holes
  mm/khugepaged: collapse_shmem() stop if punched or truncated
  mm/huge_memory: fix lockdep complaint on 32-bit i_size_read()
  mm/huge_memory: splitting set mapping+index before unfreeze
  mm/huge_memory.c: reorder operations in __split_huge_page_tail()
  mm/huge_memory: rename freeze_page() to unmap_page()

Conflicts:
	drivers/net/wireless/ath/wil6210/wmi.c
	fs/f2fs/segment.c
	include/linux/sched.h

Extra change is added into this merge in file [1]:

  f2fs: Restore discarded delta from commit a7848c0dee2c

    a7848c0dee2c f2fs: support flexible inline xattr size

    Code is removed during conflict resolution on merging
    LTS tag v4.14.86 into android-4.14-p.

    Without this delta file system corruption issues are
    observed and the system fails to boot up completely.

  [1] fs/f2fs/inode.c

Change-Id: Icd2a2b2bf4e7be75795d6aede864dd9aa4e64bfa
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>
Signed-off-by: Isaac J. Manjarres <isaacm@codeaurora.org>
2019-01-25 05:30:23 -08:00
Yang Shi
1022f84ec6 mm: introduce arg_lock to protect arg_start|end and env_start|end in mm_struct
mmap_sem is on the hot path of kernel, and it very contended, but it is
abused too.  It is used to protect arg_start|end and evn_start|end when
reading /proc/$PID/cmdline and /proc/$PID/environ, but it doesn't make
sense since those proc files just expect to read 4 values atomically and
not related to VM, they could be set to arbitrary values by C/R.

And, the mmap_sem contention may cause unexpected issue like below:

INFO: task ps:14018 blocked for more than 120 seconds.
       Tainted: G            E 4.9.79-009.ali3000.alios7.x86_64 #1
 "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this
message.
 ps              D    0 14018      1 0x00000004
 Call Trace:
   schedule+0x36/0x80
   rwsem_down_read_failed+0xf0/0x150
   call_rwsem_down_read_failed+0x18/0x30
   down_read+0x20/0x40
   proc_pid_cmdline_read+0xd9/0x4e0
   __vfs_read+0x37/0x150
   vfs_read+0x96/0x130
   SyS_read+0x55/0xc0
   entry_SYSCALL_64_fastpath+0x1a/0xc5

Both Alexey Dobriyan and Michal Hocko suggested to use dedicated lock
for them to mitigate the abuse of mmap_sem.

So, introduce a new spinlock in mm_struct to protect the concurrent
access to arg_start|end, env_start|end and others, as well as replace
write map_sem to read to protect the race condition between prctl and
sys_brk which might break check_data_rlimit(), and makes prctl more
friendly to other VM operations.

This patch just eliminates the abuse of mmap_sem, but it can't resolve
the above hung task warning completely since the later
access_remote_vm() call needs acquire mmap_sem.  The mmap_sem
scalability issue will be solved in the future.

Change-Id: Ifa8f001ee2fc4f0ce60c18e771cebcf8a1f0943e
[yang.shi@linux.alibaba.com: add comment about mmap_sem and arg_lock]
  Link: http://lkml.kernel.org/r/1524077799-80690-1-git-send-email-yang.shi@linux.alibaba.com
Link: http://lkml.kernel.org/r/1523730291-109696-1-git-send-email-yang.shi@linux.alibaba.com
Signed-off-by: Yang Shi <yang.shi@linux.alibaba.com>
Reviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>
Acked-by: Michal Hocko <mhocko@suse.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Matthew Wilcox <willy@infradead.org>
Cc: Mateusz Guzik <mguzik@redhat.com>
Cc: Kirill Tkhai <ktkhai@virtuozzo.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Git-commit: 88aa7cc688d48ddd84558b41d5905a0db9535c4b
Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Signed-off-by: Srinivas Ramana <sramana@codeaurora.org>
2019-01-24 13:34:04 -08:00