Commit Graph

35267 Commits

Author SHA1 Message Date
Will Deacon
210463b39c FROMLIST: cpuset: Don't use the cpu_possible_mask as a last resort for cgroup v1
If the scheduler cannot find an allowed CPU for a task,
cpuset_cpus_allowed_fallback() will widen the affinity to cpu_possible_mask
if cgroup v1 is in use.

In preparation for allowing architectures to provide their own fallback
mask, just return early if we're not using cgroup v2 and allow
select_fallback_rq() to figure out the mask by itself.

Cc: Li Zefan <lizefan@huawei.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Johannes Weiner <hannes@cmpxchg.org>
Reviewed-by: Quentin Perret <qperret@google.com>
Signed-off-by: Will Deacon <will@kernel.org>
[will: Check task_cpu_possible_mask() in v2 mode as per on-list comments]
Link: https://lore.kernel.org/r/20201217121552.ds7g2icvqp5nvtha@e107158-lin.cambridge.arm.com
Bug: 178507149
Link: https://lore.kernel.org/linux-arch/20201208132835.6151-8-will@kernel.org/
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: I7a6b234c28495bae6feeecceafb841aae4de6046
2021-02-05 09:20:53 +00:00
Will Deacon
1a96879cb3 FROMLIST: sched: Introduce task_cpu_possible_mask() to limit fallback rq selection
Asymmetric systems may not offer the same level of userspace ISA support
across all CPUs, meaning that some applications cannot be executed by
some CPUs. As a concrete example, upcoming arm64 big.LITTLE designs do
not feature support for 32-bit applications on both clusters.

On such a system, we must take care not to migrate a task to an
unsupported CPU when forcefully moving tasks in select_fallback_rq()
in response to a CPU hot-unplug operation.

Introduce a task_cpu_possible_mask() hook which, given a task argument,
allows an architecture to return a cpumask of CPUs that are capable of
executing that task. The default implementation returns the
cpu_possible_mask, since sane machines do not suffer from per-cpu ISA
limitations that affect scheduling. The new mask is used when selecting
the fallback runqueue as a last resort before forcing a migration to the
first active CPU.

Reviewed-by: Quentin Perret <qperret@google.com>
Signed-off-by: Will Deacon <will@kernel.org>
Bug: 178507149
Link: https://lore.kernel.org/linux-arch/20201208132835.6151-7-will@kernel.org/
Signed-off-by: Will Deacon <willdeacon@google.com>
Change-Id: I75985976c196cee7b84043e1a03fcc62f8b6d1c4
2021-02-05 09:20:52 +00:00
Shaleen Agrawal
8d420888a4 ANDROID: sched: Add PELT cmdline arg
The PELT half-life is currently hard-coded to 32ms.

Create cmdline arg to enable switching to a PELT half-life of 8mS.

Bug: 177593580
Change-Id: I9f8cfc3d9554a500eec0f6a1b161f4155c296b4d
Signed-off-by: Shaleen Agrawal <shalagra@codeaurora.org>
2021-02-05 03:07:46 +00:00
Sangmoon Kim
18ebdc3746 ANDROID: sched: add vendor hooks for bad scheduling
Add hooks to gather data of bad scheduling and summarize it with
other information.

Bug: 177483057

Signed-off-by: Sangmoon Kim <sangmoon.kim@samsung.com>
Change-Id: I08a7097b60dd8eebc5c0205b31c463a36f576121
2021-02-04 23:56:20 +00:00
Sangmoon Kim
23f19a5f28 ANDROID: power: add vendor hooks for try_to_freeze fail
Add hooks to gather data of unfrozen tasks and summarize it
with other information.

Bug: 177483057

Signed-off-by: Sangmoon Kim <sangmoon.kim@samsung.com>
Change-Id: I6f3ed7320e828a8dd1e7ae5d4449420085a75b17
2021-02-04 23:55:59 +00:00
Sangmoon Kim
b127af3af9 ANDROID: softlockup: add vendor hook for a softlockup task
Add hook to gather data of softlockup and summarize it with
other information.

Bug: 177483057

Signed-off-by: Sangmoon Kim <sangmoon.kim@samsung.com>
Change-Id: I42b906f17ad689176f0cc5a1a46acd0b5971d6c5
2021-02-04 23:55:45 +00:00
Suren Baghdasaryan
bd3983c8a8 ANDROID: make per-cgroup PSI tracking configurable
With cgroup v2 hierarchy enabled PSI accounts stalls for each cgroup
separately and aggregates at each level of the hierarchy. That causes
additional overhead since psi_avgs_work would be called for each
cgroup in the hierarchy.
In Android we use PSI only at the system level, therefore this overhead
can be avoided.
Introduce CONFIG_PSI_PER_CGROUP_ACCT that controls per-cgroup PSI
tracking and is disabled by default.

Bug: 178872719
Signed-off-by: Suren Baghdasaryan <surenb@google.com>
Change-Id: I70a418aba76b46a27eb9e66080434aa870496384
2021-02-02 20:48:28 +00:00
Huang Yiwei
9789a88f42 ANDROID: timer: Add vendor hook for timer calc index
Since we're expecting timers more precisely in short period, add
a vendor hook to calc_index when adding timers. Then we can modify
the index this timer used to make it accurate.

Bug: 178758017
Signed-off-by: Huang Yiwei <hyiwei@codeaurora.org>
Change-Id: Ie0e6493ae7ad53b0cc57eb1bbcf8a0a11f652828
2021-02-02 02:04:18 +00:00
Greg Kroah-Hartman
39564d70ad Merge 5.10.12 into android12-5.10
Changes in 5.10.12
	gpio: mvebu: fix pwm .get_state period calculation
	Revert "mm/slub: fix a memory leak in sysfs_slab_add()"
	futex: Ensure the correct return value from futex_lock_pi()
	futex: Replace pointless printk in fixup_owner()
	futex: Provide and use pi_state_update_owner()
	rtmutex: Remove unused argument from rt_mutex_proxy_unlock()
	futex: Use pi_state_update_owner() in put_pi_state()
	futex: Simplify fixup_pi_state_owner()
	futex: Handle faults correctly for PI futexes
	HID: wacom: Correct NULL dereference on AES pen proximity
	HID: multitouch: Apply MT_QUIRK_CONFIDENCE quirk for multi-input devices
	media: Revert "media: videobuf2: Fix length check for single plane dmabuf queueing"
	media: v4l2-subdev.h: BIT() is not available in userspace
	RDMA/vmw_pvrdma: Fix network_hdr_type reported in WC
	iwlwifi: dbg: Don't touch the tlv data
	kernel/io_uring: cancel io_uring before task works
	io_uring: inline io_uring_attempt_task_drop()
	io_uring: add warn_once for io_uring_flush()
	io_uring: stop SQPOLL submit on creator's death
	io_uring: fix null-deref in io_disable_sqo_submit
	io_uring: do sqo disable on install_fd error
	io_uring: fix false positive sqo warning on flush
	io_uring: fix uring_flush in exit_files() warning
	io_uring: fix skipping disabling sqo on exec
	io_uring: dont kill fasync under completion_lock
	io_uring: fix sleeping under spin in __io_clean_op
	objtool: Don't fail on missing symbol table
	mm/page_alloc: add a missing mm_page_alloc_zone_locked() tracepoint
	mm: fix a race on nr_swap_pages
	tools: Factor HOSTCC, HOSTLD, HOSTAR definitions
	printk: fix buffer overflow potential for print_text()
	printk: fix string termination for record_print_text()
	Linux 5.10.12

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I6d96ec78494ebbc0daf4fdecfc13e522c6bd6b42
2021-01-30 14:29:02 +01:00
John Ogness
d5ac8304e1 printk: fix string termination for record_print_text()
commit 08d60e5999 upstream.

Commit f0e386ee0c ("printk: fix buffer overflow potential for
print_text()") added string termination in record_print_text().
However it used the wrong base pointer for adding the terminator.
This led to a 0-byte being written somewhere beyond the buffer.

Use the correct base pointer when adding the terminator.

Fixes: f0e386ee0c ("printk: fix buffer overflow potential for print_text()")
Reported-by: Sven Schnelle <svens@linux.ibm.com>
Signed-off-by: John Ogness <john.ogness@linutronix.de>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20210124202728.4718-1-john.ogness@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-30 13:55:20 +01:00
John Ogness
861c2e349a printk: fix buffer overflow potential for print_text()
commit f0e386ee0c upstream.

Before the commit 896fbe20b4 ("printk: use the lockless
ringbuffer"), msg_print_text() would only write up to size-1 bytes
into the provided buffer. Some callers expect this behavior and
append a terminator to returned string. In particular:

arch/powerpc/xmon/xmon.c:dump_log_buf()
arch/um/kernel/kmsg_dump.c:kmsg_dumper_stdout()

msg_print_text() has been replaced by record_print_text(), which
currently fills the full size of the buffer. This causes a
buffer overflow for the above callers.

Change record_print_text() so that it will only use size-1 bytes
for text data. Also, for paranoia sakes, add a terminator after
the text data.

And finally, document this behavior so that it is clear that only
size-1 bytes are used and a terminator is added.

Fixes: 896fbe20b4 ("printk: use the lockless ringbuffer")
Cc: stable@vger.kernel.org # 5.10+
Signed-off-by: John Ogness <john.ogness@linutronix.de>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Acked-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20210114170412.4819-1-john.ogness@linutronix.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-30 13:55:20 +01:00
Pavel Begunkov
7bf3fb6243 kernel/io_uring: cancel io_uring before task works
[ Upstream commit b1b6b5a30d ]

For cancelling io_uring requests it needs either to be able to run
currently enqueued task_works or having it shut down by that moment.
Otherwise io_uring_cancel_files() may be waiting for requests that won't
ever complete.

Go with the first way and do cancellations before setting PF_EXITING and
so before putting the task_work infrastructure into a transition state
where task_work_run() would better not be called.

Cc: stable@vger.kernel.org # 5.5+
Signed-off-by: Pavel Begunkov <asml.silence@gmail.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-30 13:55:18 +01:00
Thomas Gleixner
e843e4f782 futex: Handle faults correctly for PI futexes
commit 34b1a1ce14 upstream

fixup_pi_state_owner() tries to ensure that the state of the rtmutex,
pi_state and the user space value related to the PI futex are consistent
before returning to user space. In case that the user space value update
faults and the fault cannot be resolved by faulting the page in via
fault_in_user_writeable() the function returns with -EFAULT and leaves
the rtmutex and pi_state owner state inconsistent.

A subsequent futex_unlock_pi() operates on the inconsistent pi_state and
releases the rtmutex despite not owning it which can corrupt the RB tree of
the rtmutex and cause a subsequent kernel stack use after free.

It was suggested to loop forever in fixup_pi_state_owner() if the fault
cannot be resolved, but that results in runaway tasks which is especially
undesired when the problem happens due to a programming error and not due
to malice.

As the user space value cannot be fixed up, the proper solution is to make
the rtmutex and the pi_state consistent so both have the same owner. This
leaves the user space value out of sync. Any subsequent operation on the
futex will fail because the 10th rule of PI futexes (pi_state owner and
user space value are consistent) has been violated.

As a consequence this removes the inept attempts of 'fixing' the situation
in case that the current task owns the rtmutex when returning with an
unresolvable fault by unlocking the rtmutex which left pi_state::owner and
rtmutex::owner out of sync in a different and only slightly less dangerous
way.

Fixes: 1b7558e457 ("futexes: fix fault handling in futex_lock_pi")
Reported-by: gzobqq@gmail.com
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-30 13:55:17 +01:00
Thomas Gleixner
abc4dd792f futex: Simplify fixup_pi_state_owner()
commit f2dac39d93 upstream

Too many gotos already and an upcoming fix would make it even more
unreadable.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-30 13:55:17 +01:00
Thomas Gleixner
a597f12e97 futex: Use pi_state_update_owner() in put_pi_state()
commit 6ccc84f917 upstream

No point in open coding it. This way it gains the extra sanity checks.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-30 13:55:17 +01:00
Thomas Gleixner
6d28ac502f rtmutex: Remove unused argument from rt_mutex_proxy_unlock()
commit 2156ac1934 upstream

Nothing uses the argument. Remove it as preparation to use
pi_state_update_owner().

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-30 13:55:17 +01:00
Thomas Gleixner
5b2c5a9561 futex: Provide and use pi_state_update_owner()
commit c5cade200a upstream

Updating pi_state::owner is done at several places with the same
code. Provide a function for it and use that at the obvious places.

This is also a preparation for a bug fix to avoid yet another copy of the
same code or alternatively introducing a completely unpenetratable mess of
gotos.

Originally-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-30 13:55:17 +01:00
Thomas Gleixner
5ede8ee2cb futex: Replace pointless printk in fixup_owner()
commit 04b79c5520 upstream

If that unexpected case of inconsistent arguments ever happens then the
futex state is left completely inconsistent and the printk is not really
helpful. Replace it with a warning and make the state consistent.

Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-30 13:55:17 +01:00
Thomas Gleixner
ab5e9a320e futex: Ensure the correct return value from futex_lock_pi()
commit 12bb3f7f1b upstream

In case that futex_lock_pi() was aborted by a signal or a timeout and the
task returned without acquiring the rtmutex, but is the designated owner of
the futex due to a concurrent futex_unlock_pi() fixup_owner() is invoked to
establish consistent state. In that case it invokes fixup_pi_state_owner()
which in turn tries to acquire the rtmutex again. If that succeeds then it
does not propagate this success to fixup_owner() and futex_lock_pi()
returns -EINTR or -ETIMEOUT despite having the futex locked.

Return success from fixup_pi_state_owner() in all cases where the current
task owns the rtmutex and therefore the futex and propagate it correctly
through fixup_owner(). Fixup the other callsite which does not expect a
positive return value.

Fixes: c1e2f0eaf0 ("futex: Avoid violating the 10th rule of futex")
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-30 13:55:16 +01:00
Stephen Dickey
fe6f4b82d6 ANDROID: sched/core: prevent timers on paused cpus
The pause feature is designed to keep CPUs idle as
much as possible.

When the timers migration feature is enabled (with
sysctl_timer_migration = 1 ) timer/hrtimer can be
migrated to other CPUs than the CPU currently
queueing the CPU. For example, a pinned kworker
runs on a paused CPU and queued the timer. The
other use case is an interrupt coming on paused CPU
and queueing the time.

Update the get nohz cpu path to use the active
and online masks to prevent paused cpus from
being woken up to queue a timer.

Bug: 161210528
Change-Id: I3707164ab6ea35cb6202b6c6b2018e1583c3e95c
Signed-off-by: Stephen Dickey <dickey@codeaurora.org>
2021-01-29 10:54:29 +00:00
Pavankumar Kondeti
4b5f345c73 ANDROID: sched: Add restrict vendor hooks for balance_rt()
Add rvh called android_rvh_sched_balance_rt to influence
balance_rt() from vendor modules.

Bug: 178572414
Change-Id: I555c8ebcf5a3a5d8e3ab881ab9aa507f325285c2
Signed-off-by: Pavankumar Kondeti <pkondeti@codeaurora.org>
2021-01-28 08:48:23 +00:00
Greg Kroah-Hartman
ba152773be Merge 5.10.11 into android12-5.10
Changes in 5.10.11
	scsi: target: tcmu: Fix use-after-free of se_cmd->priv
	mtd: rawnand: gpmi: fix dst bit offset when extracting raw payload
	mtd: rawnand: nandsim: Fix the logic when selecting Hamming soft ECC engine
	i2c: tegra: Wait for config load atomically while in ISR
	i2c: bpmp-tegra: Ignore unknown I2C_M flags
	platform/x86: i2c-multi-instantiate: Don't create platform device for INT3515 ACPI nodes
	platform/x86: ideapad-laptop: Disable touchpad_switch for ELAN0634
	ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info()
	ALSA: hda/realtek - Limit int mic boost on Acer Aspire E5-575T
	ALSA: hda/via: Add minimum mute flag
	crypto: xor - Fix divide error in do_xor_speed()
	dm crypt: fix copy and paste bug in crypt_alloc_req_aead
	ACPI: scan: Make acpi_bus_get_device() clear return pointer on error
	btrfs: don't get an EINTR during drop_snapshot for reloc
	btrfs: do not double free backref nodes on error
	btrfs: fix lockdep splat in btrfs_recover_relocation
	btrfs: don't clear ret in btrfs_start_dirty_block_groups
	btrfs: send: fix invalid clone operations when cloning from the same file and root
	fs: fix lazytime expiration handling in __writeback_single_inode()
	pinctrl: ingenic: Fix JZ4760 support
	mmc: core: don't initialize block size from ext_csd if not present
	mmc: sdhci-of-dwcmshc: fix rpmb access
	mmc: sdhci-xenon: fix 1.8v regulator stabilization
	mmc: sdhci-brcmstb: Fix mmc timeout errors on S5 suspend
	dm: avoid filesystem lookup in dm_get_dev_t()
	dm integrity: fix a crash if "recalculate" used without "internal_hash"
	dm integrity: conditionally disable "recalculate" feature
	drm/atomic: put state on error path
	drm/syncobj: Fix use-after-free
	drm/amdgpu: remove gpu info firmware of green sardine
	drm/amd/display: DCN2X Find Secondary Pipe properly in MPO + ODM Case
	drm/i915/gt: Prevent use of engine->wa_ctx after error
	drm/i915: Check for rq->hwsp validity after acquiring RCU lock
	ASoC: Intel: haswell: Add missing pm_ops
	ASoC: rt711: mutex between calibration and power state changes
	SUNRPC: Handle TCP socket sends with kernel_sendpage() again
	HID: multitouch: Enable multi-input for Synaptics pointstick/touchpad device
	HID: sony: select CONFIG_CRC32
	dm integrity: select CRYPTO_SKCIPHER
	x86/hyperv: Fix kexec panic/hang issues
	scsi: ufs: Relax the condition of UFSHCI_QUIRK_SKIP_MANUAL_WB_FLUSH_CTRL
	scsi: ufs: Correct the LUN used in eh_device_reset_handler() callback
	scsi: qedi: Correct max length of CHAP secret
	scsi: scsi_debug: Fix memleak in scsi_debug_init()
	scsi: sd: Suppress spurious errors when WRITE SAME is being disabled
	riscv: Fix kernel time_init()
	riscv: Fix sifive serial driver
	riscv: Enable interrupts during syscalls with M-Mode
	HID: logitech-dj: add the G602 receiver
	HID: Ignore battery for Elan touchscreen on ASUS UX550
	clk: tegra30: Add hda clock default rates to clock driver
	ALSA: hda/tegra: fix tegra-hda on tegra30 soc
	riscv: cacheinfo: Fix using smp_processor_id() in preemptible
	arm64: make atomic helpers __always_inline
	xen: Fix event channel callback via INTX/GSI
	x86/xen: Add xen_no_vector_callback option to test PCI INTX delivery
	x86/xen: Fix xen_hvm_smp_init() when vector callback not available
	dts: phy: fix missing mdio device and probe failure of vsc8541-01 device
	dts: phy: add GPIO number and active state used for phy reset
	riscv: defconfig: enable gpio support for HiFive Unleashed
	drm/amdgpu/psp: fix psp gfx ctrl cmds
	drm/amd/display: disable dcn10 pipe split by default
	HID: logitech-hidpp: Add product ID for MX Ergo in Bluetooth mode
	drm/amd/display: Fix to be able to stop crc calculation
	drm/nouveau/bios: fix issue shadowing expansion ROMs
	drm/nouveau/privring: ack interrupts the same way as RM
	drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields
	drm/nouveau/mmu: fix vram heap sizing
	drm/nouveau/kms/nv50-: fix case where notifier buffer is at offset 0
	io_uring: flush timeouts that should already have expired
	libperf tests: If a test fails return non-zero
	libperf tests: Fail when failing to get a tracepoint id
	RISC-V: Set current memblock limit
	RISC-V: Fix maximum allowed phsyical memory for RV32
	x86/xen: fix 'nopvspin' build error
	nfsd: Fixes for nfsd4_encode_read_plus_data()
	nfsd: Don't set eof on a truncated READ_PLUS
	gpiolib: cdev: fix frame size warning in gpio_ioctl()
	pinctrl: aspeed: g6: Fix PWMG0 pinctrl setting
	pinctrl: mediatek: Fix fallback call path
	RDMA/ucma: Do not miss ctx destruction steps in some cases
	btrfs: print the actual offset in btrfs_root_name
	scsi: megaraid_sas: Fix MEGASAS_IOC_FIRMWARE regression
	scsi: ufs: ufshcd-pltfrm depends on HAS_IOMEM
	scsi: ufs: Fix tm request when non-fatal error happens
	crypto: omap-sham - Fix link error without crypto-engine
	bpf: Prevent double bpf_prog_put call from bpf_tracing_prog_attach
	powerpc: Use the common INIT_DATA_SECTION macro in vmlinux.lds.S
	powerpc: Fix alignment bug within the init sections
	arm64: entry: remove redundant IRQ flag tracing
	bpf: Reject too big ctx_size_in for raw_tp test run
	drm/amdkfd: Fix out-of-bounds read in kdf_create_vcrat_image_cpu()
	RDMA/umem: Avoid undefined behavior of rounddown_pow_of_two()
	RDMA/cma: Fix error flow in default_roce_mode_store
	printk: ringbuffer: fix line counting
	printk: fix kmsg_dump_get_buffer length calulations
	iov_iter: fix the uaccess area in copy_compat_iovec_from_user
	i2c: octeon: check correct size of maximum RECV_LEN packet
	drm/vc4: Unify PCM card's driver_name
	platform/x86: intel-vbtn: Drop HP Stream x360 Convertible PC 11 from allow-list
	platform/x86: hp-wmi: Don't log a warning on HPWMI_RET_UNKNOWN_COMMAND errors
	gpio: sifive: select IRQ_DOMAIN_HIERARCHY rather than depend on it
	ALSA: hda: Balance runtime/system PM if direct-complete is disabled
	xsk: Clear pool even for inactive queues
	selftests: net: fib_tests: remove duplicate log test
	can: dev: can_restart: fix use after free bug
	can: vxcan: vxcan_xmit: fix use after free bug
	can: peak_usb: fix use after free bugs
	perf evlist: Fix id index for heterogeneous systems
	i2c: sprd: depend on COMMON_CLK to fix compile tests
	iio: common: st_sensors: fix possible infinite loop in st_sensors_irq_thread
	iio: ad5504: Fix setting power-down state
	drivers: iio: temperature: Add delay after the addressed reset command in mlx90632.c
	iio: adc: ti_am335x_adc: remove omitted iio_kfifo_free()
	counter:ti-eqep: remove floor
	powerpc/64s: fix scv entry fallback flush vs interrupt
	cifs: do not fail __smb_send_rqst if non-fatal signals are pending
	irqchip/mips-cpu: Set IPI domain parent chip
	x86/fpu: Add kernel_fpu_begin_mask() to selectively initialize state
	x86/topology: Make __max_die_per_package available unconditionally
	x86/mmx: Use KFPU_387 for MMX string operations
	x86/setup: don't remove E820_TYPE_RAM for pfn 0
	proc_sysctl: fix oops caused by incorrect command parameters
	mm: memcg/slab: optimize objcg stock draining
	mm: memcg: fix memcg file_dirty numa stat
	mm: fix numa stats for thp migration
	io_uring: iopoll requests should also wake task ->in_idle state
	io_uring: fix SQPOLL IORING_OP_CLOSE cancelation state
	io_uring: fix short read retries for non-reg files
	intel_th: pci: Add Alder Lake-P support
	stm class: Fix module init return on allocation failure
	serial: mvebu-uart: fix tx lost characters at power off
	ehci: fix EHCI host controller initialization sequence
	USB: ehci: fix an interrupt calltrace error
	usb: gadget: aspeed: fix stop dma register setting.
	USB: gadget: dummy-hcd: Fix errors in port-reset handling
	usb: udc: core: Use lock when write to soft_connect
	usb: bdc: Make bdc pci driver depend on BROKEN
	usb: cdns3: imx: fix writing read-only memory issue
	usb: cdns3: imx: fix can't create core device the second time issue
	xhci: make sure TRB is fully written before giving it to the controller
	xhci: tegra: Delay for disabling LFPS detector
	drivers core: Free dma_range_map when driver probe failed
	driver core: Fix device link device name collision
	driver core: Extend device_is_dependent()
	drm/i915: s/intel_dp_sink_dpms/intel_dp_set_power/
	drm/i915: Only enable DFP 4:4:4->4:2:0 conversion when outputting YCbCr 4:4:4
	x86/entry: Fix noinstr fail
	x86/cpu/amd: Set __max_die_per_package on AMD
	cls_flower: call nla_ok() before nla_next()
	netfilter: rpfilter: mask ecn bits before fib lookup
	tools: gpio: fix %llu warning in gpio-event-mon.c
	tools: gpio: fix %llu warning in gpio-watch.c
	drm/i915/hdcp: Update CP property in update_pipe
	sh: dma: fix kconfig dependency for G2_DMA
	sh: Remove unused HAVE_COPY_THREAD_TLS macro
	locking/lockdep: Cure noinstr fail
	ASoC: SOF: Intel: fix page fault at probe if i915 init fails
	octeontx2-af: Fix missing check bugs in rvu_cgx.c
	net: dsa: mv88e6xxx: also read STU state in mv88e6250_g1_vtu_getnext
	selftests/powerpc: Fix exit status of pkey tests
	sh_eth: Fix power down vs. is_opened flag ordering
	nvme-pci: refactor nvme_unmap_data
	nvme-pci: fix error unwind in nvme_map_data
	cachefiles: Drop superfluous readpages aops NULL check
	lightnvm: fix memory leak when submit fails
	skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too
	kasan: fix unaligned address is unhandled in kasan_remove_zero_shadow
	kasan: fix incorrect arguments passing in kasan_add_zero_shadow
	tcp: fix TCP socket rehash stats mis-accounting
	net_sched: gen_estimator: support large ewma log
	udp: mask TOS bits in udp_v4_early_demux()
	ipv6: create multicast route with RTPROT_KERNEL
	net_sched: avoid shift-out-of-bounds in tcindex_set_parms()
	net_sched: reject silly cell_log in qdisc_get_rtab()
	ipv6: set multicast flag on the multicast route
	net: mscc: ocelot: allow offloading of bridge on top of LAG
	net: Disable NETIF_F_HW_TLS_RX when RXCSUM is disabled
	net: dsa: b53: fix an off by one in checking "vlan->vid"
	tcp: do not mess with cloned skbs in tcp_add_backlog()
	tcp: fix TCP_USER_TIMEOUT with zero window
	net: mscc: ocelot: Fix multicast to the CPU port
	net: core: devlink: use right genl user_ptr when handling port param get/set
	pinctrl: qcom: Allow SoCs to specify a GPIO function that's not 0
	pinctrl: qcom: No need to read-modify-write the interrupt status
	pinctrl: qcom: Properly clear "intr_ack_high" interrupts when unmasking
	pinctrl: qcom: Don't clear pending interrupts when enabling
	x86/sev: Fix nonistr violation
	tty: implement write_iter
	tty: fix up hung_up_tty_write() conversion
	net: systemport: free dev before on error path
	x86/sev-es: Handle string port IO to kernel memory properly
	tcp: Fix potential use-after-free due to double kfree()
	ASoC: SOF: Intel: hda: Avoid checking jack on system suspend
	drm/i915/hdcp: Get conn while content_type changed
	bpf: Local storage helpers should check nullness of owner ptr passed
	kernfs: implement ->read_iter
	kernfs: implement ->write_iter
	kernfs: wire up ->splice_read and ->splice_write
	interconnect: imx8mq: Use icc_sync_state
	fs/pipe: allow sendfile() to pipe again
	Commit 9bb48c82ac ("tty: implement write_iter") converted the tty layer to use write_iter. Fix the redirected_tty_write declaration also in n_tty and change the comparisons to use write_iter instead of write. also in n_tty and change the comparisons to use write_iter instead of write.
	mm: fix initialization of struct page for holes in memory layout
	Revert "mm: fix initialization of struct page for holes in memory layout"
	Linux 5.10.11

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I502239d06f9bcd68b59149376f3c796c64de5942
2021-01-27 12:12:33 +01:00
KP Singh
436bc4c45a bpf: Local storage helpers should check nullness of owner ptr passed
commit 1a9c72ad4c upstream.

The verifier allows ARG_PTR_TO_BTF_ID helper arguments to be NULL, so
helper implementations need to check this before dereferencing them.
This was already fixed for the socket storage helpers but not for task
and inode.

The issue can be reproduced by attaching an LSM program to
inode_rename hook (called when moving files) which tries to get the
inode of the new file without checking for its nullness and then trying
to move an existing file to a new path:

  mv existing_file new_file_does_not_exist

The report including the sample program and the steps for reproducing
the bug:

  https://lore.kernel.org/bpf/CANaYP3HWkH91SN=wTNO9FL_2ztHfqcXKX38SSE-JJ2voh+vssw@mail.gmail.com

Fixes: 4cf1bc1f10 ("bpf: Implement task local storage")
Fixes: 8ea636848a ("bpf: Implement bpf_local_storage for inodes")
Reported-by: Gilad Reti <gilad.reti@gmail.com>
Signed-off-by: KP Singh <kpsingh@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20210112075525.256820-3-kpsingh@kernel.org
[ just take 1/2 of this patch for 5.10.y - gregkh ]
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-27 11:55:28 +01:00
Peter Zijlstra
ba548335c8 locking/lockdep: Cure noinstr fail
commit 0afda3a888 upstream.

When the compiler doesn't feel like inlining, it causes a noinstr
fail:

  vmlinux.o: warning: objtool: lock_is_held_type()+0xb: call to lockdep_enabled() leaves .noinstr.text section

Fixes: 4d004099a6 ("lockdep: Fix lockdep recursion")
Reported-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Link: https://lore.kernel.org/r/20210106144017.592595176@infradead.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-27 11:55:21 +01:00
John Ogness
ce4d02da78 printk: fix kmsg_dump_get_buffer length calulations
[ Upstream commit 89ccf18f03 ]

kmsg_dump_get_buffer() uses @syslog to determine if the syslog
prefix should be written to the buffer. However, when calculating
the maximum number of records that can fit into the buffer, it
always counts the bytes from the syslog prefix.

Use @syslog when calculating the maximum number of records that can
fit into the buffer.

Fixes: e2ae715d66 ("kmsg - kmsg_dump() use iterator to receive log buffer content")
Signed-off-by: John Ogness <john.ogness@linutronix.de>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Acked-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20210113164413.1599-1-john.ogness@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-27 11:55:08 +01:00
John Ogness
cf3cca5f15 printk: ringbuffer: fix line counting
[ Upstream commit 668af87f99 ]

Counting text lines in a record simply involves counting the number
of newline characters (+1). However, it is searching the full data
block for newline characters, even though the text data can be (and
often is) a subset of that area. Since the extra area in the data
block was never initialized, the result is that extra newlines may
be seen and counted.

Restrict newline searching to the text data length.

Fixes: b6cf8b3f33 ("printk: add lockless ringbuffer")
Signed-off-by: John Ogness <john.ogness@linutronix.de>
Reviewed-by: Petr Mladek <pmladek@suse.com>
Acked-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com>
Signed-off-by: Petr Mladek <pmladek@suse.com>
Link: https://lore.kernel.org/r/20210113144234.6545-1-john.ogness@linutronix.de
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-27 11:55:08 +01:00
Jiri Olsa
7c7b2b5605 bpf: Prevent double bpf_prog_put call from bpf_tracing_prog_attach
[ Upstream commit 5541075a34 ]

The bpf_tracing_prog_attach error path calls bpf_prog_put
on prog, which causes refcount underflow when it's called
from link_create function.

  link_create
    prog = bpf_prog_get              <-- get
    ...
    tracing_bpf_link_attach(prog..
      bpf_tracing_prog_attach(prog..
        out_put_prog:
          bpf_prog_put(prog);        <-- put

    if (ret < 0)
      bpf_prog_put(prog);            <-- put

Removing bpf_prog_put call from bpf_tracing_prog_attach
and making sure its callers call it instead.

Fixes: 4a1e7c0c63 ("bpf: Support attaching freplace programs to multiple attach points")
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Toke Høiland-Jørgensen <toke@redhat.com>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20210111191650.1241578-1-jolsa@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-27 11:55:07 +01:00
Stephen Dickey
f7d52eda9f ANDROID: cpu/hotplug: create vendor hook for cpu_up/cpu_down
Include a vendor hook for cpu_up and cpu_down to force the
rebuilding of scheduling domains prior to issuing a new
cpu up/down.  Include a Kernel Export for
cpuset_wait_for_hotplug such that vendor hooks may refer
to this functionality, to ensure scheduling domains are
complete.

Bug: 176152285
Change-Id: I778dbc5e4f9d613f39b8c61f244c0f33020a3dd3
Signed-off-by: Stephen Dickey <dickey@codeaurora.org>
2021-01-26 19:30:11 +00:00
Park Bumgyu
fdb1f966f7 ANDROID: sched: export task_rq_lock
Declare task_rq_lock as EXPORT_SYMBOL_GPL needed by vendor module.

Bug: 178340230

Signed-off-by: Park Bumgyu <bumgyu.park@samsung.com>
Change-Id: I4afc2d67bd208b00e6c43590782196cb4ee07937
2021-01-26 08:53:04 +00:00
Minchan Kim
23ba990a3e FROMLIST: mm: cma: introduce gfp flag in cma_alloc instead of no_warn
The upcoming patch will introduce __GFP_NORETRY semantic
in alloc_contig_range which is a failfast mode of the API.
Instead of adding a additional parameter for gfp, replace
no_warn with gfp flag.

To keep old behaviors, it follows the rule below.

  no_warn 			gfp_flags

  false         		GFP_KERNEL
  true          		GFP_KERNEL|__GFP_NOWARN
  gfp & __GFP_NOWARN		GFP_KERNEL | (gfp & __GFP_NOWARN)

Bug: 170340257
Bug: 120293424
Link: https://lore.kernel.org/linux-mm/YAnM5PbNJZlk%2F%2FiX@google.com/T/#m36b144ff81fe0a8f0ecaf6813de4819ecc41f8fe
Reviewed-by: Suren Baghdasaryan <surenb@google.com>
Signed-off-by: Minchan Kim <minchan@kernel.org>
Signed-off-by: Minchan Kim <minchan@google.com>
Change-Id: I1ce020ab5d5fff34eb6464be4632ddef72fb43eb
2021-01-25 12:21:02 -08:00
Greg Kroah-Hartman
c4cf0788e1 Merge 5.10.10 into android12-5.10
Changes in 5.10.10
	Revert "kconfig: remove 'kvmconfig' and 'xenconfig' shorthands"
	bpf: Fix selftest compilation on clang 11
	x86/hyperv: Initialize clockevents after LAPIC is initialized
	drm/amdgpu/display: drop DCN support for aarch64
	bpf: Fix signed_{sub,add32}_overflows type handling
	X.509: Fix crash caused by NULL pointer
	nfsd4: readdirplus shouldn't return parent of export
	bpf: Don't leak memory in bpf getsockopt when optlen == 0
	bpf: Support PTR_TO_MEM{,_OR_NULL} register spilling
	bpf: Fix helper bpf_map_peek_elem_proto pointing to wrong callback
	net: ipa: modem: add missing SET_NETDEV_DEV() for proper sysfs links
	net: fix use-after-free when UDP GRO with shared fraglist
	udp: Prevent reuseport_select_sock from reading uninitialized socks
	netxen_nic: fix MSI/MSI-x interrupts
	net: ipv6: Validate GSO SKB before finish IPv6 processing
	tipc: fix NULL deref in tipc_link_xmit()
	mlxsw: core: Add validation of transceiver temperature thresholds
	mlxsw: core: Increase critical threshold for ASIC thermal zone
	net: mvpp2: Remove Pause and Asym_Pause support
	rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request
	esp: avoid unneeded kmap_atomic call
	net: dcb: Validate netlink message in DCB handler
	net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands
	rxrpc: Call state should be read with READ_ONCE() under some circumstances
	i40e: fix potential NULL pointer dereferencing
	net: stmmac: Fixed mtu channged by cache aligned
	net: sit: unregister_netdevice on newlink's error path
	net: stmmac: fix taprio schedule configuration
	net: stmmac: fix taprio configuration when base_time is in the past
	net: avoid 32 x truesize under-estimation for tiny skbs
	dt-bindings: net: renesas,etheravb: RZ/G2H needs tx-internal-delay-ps
	net: phy: smsc: fix clk error handling
	net: dsa: clear devlink port type before unregistering slave netdevs
	rxrpc: Fix handling of an unsupported token type in rxrpc_read()
	net: stmmac: use __napi_schedule() for PREEMPT_RT
	can: mcp251xfd: mcp251xfd_handle_rxif_one(): fix wrong NULL pointer check
	drm/panel: otm8009a: allow using non-continuous dsi clock
	mac80211: do not drop tx nulldata packets on encrypted links
	mac80211: check if atf has been disabled in __ieee80211_schedule_txq
	net: dsa: unbind all switches from tree when DSA master unbinds
	cxgb4/chtls: Fix tid stuck due to wrong update of qid
	spi: fsl: Fix driver breakage when SPI_CS_HIGH is not set in spi->mode
	spi: cadence: cache reference clock rate during probe
	Linux 5.10.10

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I6528a325f8f0105e55906930796038affe6a86f6
2021-01-23 16:16:06 +01:00
Mircea Cirjaliu
31ad072925 bpf: Fix helper bpf_map_peek_elem_proto pointing to wrong callback
commit 301a33d518 upstream.

I assume this was obtained by copy/paste. Point it to bpf_map_peek_elem()
instead of bpf_map_pop_elem(). In practice it may have been less likely
hit when under JIT given shielded via 84430d4232 ("bpf, verifier: avoid
retpoline for map push/pop/peek operation").

Fixes: f1a2e44a3a ("bpf: add queue and stack maps")
Signed-off-by: Mircea Cirjaliu <mcirjaliu@bitdefender.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Mauricio Vasquez <mauriciovasquezbernal@gmail.com>
Link: https://lore.kernel.org/bpf/AM7PR02MB6082663DFDCCE8DA7A6DD6B1BBA30@AM7PR02MB6082.eurprd02.prod.outlook.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-23 16:03:59 +01:00
Gilad Reti
de661caaee bpf: Support PTR_TO_MEM{,_OR_NULL} register spilling
commit 744ea4e388 upstream.

Add support for pointer to mem register spilling, to allow the verifier
to track pointers to valid memory addresses. Such pointers are returned
for example by a successful call of the bpf_ringbuf_reserve helper.

The patch was partially contributed by CyberArk Software, Inc.

Fixes: 457f44363a ("bpf: Implement BPF ring buffer and verifier support for it")
Suggested-by: Yonghong Song <yhs@fb.com>
Signed-off-by: Gilad Reti <gilad.reti@gmail.com>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: KP Singh <kpsingh@kernel.org>
Link: https://lore.kernel.org/bpf/20210113053810.13518-1-gilad.reti@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-23 16:03:58 +01:00
Stanislav Fomichev
3ed29995c2 bpf: Don't leak memory in bpf getsockopt when optlen == 0
commit 4be34f3d07 upstream.

optlen == 0 indicates that the kernel should ignore BPF buffer
and use the original one from the user. We, however, forget
to free the temporary buffer that we've allocated for BPF.

Fixes: d8fe449a9c ("bpf: Don't return EINVAL from {get,set}sockopt when optlen > PAGE_SIZE")
Reported-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: Stanislav Fomichev <sdf@google.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Link: https://lore.kernel.org/bpf/20210112162829.775079-1-sdf@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-23 16:03:58 +01:00
Daniel Borkmann
5f52a8a71b bpf: Fix signed_{sub,add32}_overflows type handling
commit bc895e8b2a upstream.

Fix incorrect signed_{sub,add32}_overflows() input types (and a related buggy
comment). It looks like this might have slipped in via copy/paste issue, also
given prior to 3f50f132d8 ("bpf: Verifier, do explicit ALU32 bounds tracking")
the signature of signed_sub_overflows() had s64 a and s64 b as its input args
whereas now they are truncated to s32. Thus restore proper types. Also, the case
of signed_add32_overflows() is not consistent to signed_sub32_overflows(). Both
have s32 as inputs, therefore align the former.

Fixes: 3f50f132d8 ("bpf: Verifier, do explicit ALU32 bounds tracking")
Reported-by: De4dCr0w <sa516203@mail.ustc.edu.cn>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Reviewed-by: John Fastabend <john.fastabend@gmail.com>
Acked-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-01-23 16:03:58 +01:00
Peter Collingbourne
a30c848d10 UPSTREAM: signal: define the SA_EXPOSE_TAGBITS bit in sa_flags
Architectures that support address tagging, such as arm64, may want to
expose fault address tag bits to the signal handler to help diagnose
memory errors. However, these bits have not been previously set,
and their presence may confuse unaware user applications. Therefore,
introduce a SA_EXPOSE_TAGBITS flag bit in sa_flags that a signal
handler may use to explicitly request that the bits are set.

The generic signal handler APIs expect to receive tagged addresses.
Architectures may specify how to untag addresses in the case where
SA_EXPOSE_TAGBITS is clear by defining the arch_untagged_si_addr
function.

Signed-off-by: Peter Collingbourne <pcc@google.com>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Link: https://linux-review.googlesource.com/id/I16dd0ed2081f091fce97be0190cb8caa874c26cb
Link: https://lkml.kernel.org/r/13cf24d00ebdd8e1f55caf1821c7c29d54100191.1605904350.git.pcc@google.com
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
(cherry picked from commit 6ac05e832a)
Bug: 135772972
Change-Id: I16dd0ed2081f091fce97be0190cb8caa874c26cb
2021-01-22 10:05:52 -08:00
Peter Collingbourne
4225576f6a UPSTREAM: signal: define the SA_UNSUPPORTED bit in sa_flags
Define a sa_flags bit, SA_UNSUPPORTED, which will never be supported
in the uapi. The purpose of this flag bit is to allow userspace to
distinguish an old kernel that does not clear unknown sa_flags bits
from a kernel that supports every flag bit.

In other words, if userspace does something like:

  act.sa_flags |= SA_UNSUPPORTED;
  sigaction(SIGSEGV, &act, 0);
  sigaction(SIGSEGV, 0, &oldact);

and finds that SA_UNSUPPORTED remains set in oldact.sa_flags, it means
that the kernel cannot be trusted to have cleared unknown flag bits
from sa_flags, so no assumptions about flag bit support can be made.

Signed-off-by: Peter Collingbourne <pcc@google.com>
Reviewed-by: Dave Martin <Dave.Martin@arm.com>
Link: https://linux-review.googlesource.com/id/Ic2501ad150a3a79c1cf27fb8c99be342e9dffbcb
Link: https://lkml.kernel.org/r/bda7ddff8895a9bc4ffc5f3cf3d4d37a32118077.1605582887.git.pcc@google.com
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
(cherry picked from commit a54f0dfda7)
Bug: 135772972
Change-Id: Ic2501ad150a3a79c1cf27fb8c99be342e9dffbcb
2021-01-22 10:05:52 -08:00
Peter Collingbourne
62daaaec31 UPSTREAM: signal: clear non-uapi flag bits when passing/returning sa_flags
Previously we were not clearing non-uapi flag bits in
sigaction.sa_flags when storing the userspace-provided sa_flags or
when returning them via oldact. Start doing so.

This allows userspace to detect missing support for flag bits and
allows the kernel to use non-uapi bits internally, as we are already
doing in arch/x86 for two flag bits. Now that this change is in
place, we no longer need the code in arch/x86 that was hiding these
bits from userspace, so remove it.

This is technically a userspace-visible behavior change for sigaction, as
the unknown bits returned via oldact.sa_flags are no longer set. However,
we are free to define the behavior for unknown bits exactly because
their behavior is currently undefined, so for now we can define the
meaning of each of them to be "clear the bit in oldact.sa_flags unless
the bit becomes known in the future". Furthermore, this behavior is
consistent with OpenBSD [1], illumos [2] and XNU [3] (FreeBSD [4] and
NetBSD [5] fail the syscall if unknown bits are set). So there is some
precedent for this behavior in other kernels, and in particular in XNU,
which is probably the most popular kernel among those that I looked at,
which means that this change is less likely to be a compatibility issue.

Link: [1] f634a6a4b5/sys/kern/kern_sig.c (L278)
Link: [2] 76f19f5fdc/usr/src/uts/common/syscall/sigaction.c (L86)
Link: [3] a449c6a3b8/bsd/kern/kern_sig.c (L480)
Link: [4] eded70c370/sys/kern/kern_sig.c (L699)
Link: [5] 3365779bec/sys/kern/sys_sig.c (L473)
Signed-off-by: Peter Collingbourne <pcc@google.com>
Reviewed-by: Dave Martin <Dave.Martin@arm.com>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Link: https://linux-review.googlesource.com/id/I35aab6f5be932505d90f3b3450c083b4db1eca86
Link: https://lkml.kernel.org/r/878dbcb5f47bc9b11881c81f745c0bef5c23f97f.1605235762.git.pcc@google.com
Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>
(cherry picked from commit 23acdc76f1)
Bug: 135772972
Change-Id: I35aab6f5be932505d90f3b3450c083b4db1eca86
2021-01-22 10:05:52 -08:00
Laurent Dufour
5eca9e121f FROMLIST: mm: protect against PTE changes done by dup_mmap()
Vinayak Menon and Ganesh Mahendran reported that the following scenario may
lead to thread being blocked due to data corruption:

    CPU 1                   CPU 2                    CPU 3
    Process 1,              Process 1,               Process 1,
    Thread A                Thread B                 Thread C

    while (1) {             while (1) {              while(1) {
    pthread_mutex_lock(l)   pthread_mutex_lock(l)    fork
    pthread_mutex_unlock(l) pthread_mutex_unlock(l)  }
    }                       }

In the details this happens because :

    CPU 1                CPU 2                       CPU 3
    fork()
    copy_pte_range()
      set PTE rdonly
    got to next VMA...
     .                   PTE is seen rdonly          PTE still writable
     .                   thread is writing to page
     .                   -> page fault
     .                     copy the page             Thread writes to page
     .                      .                        -> no page fault
     .                     update the PTE
     .                     flush TLB for that PTE
   flush TLB                                        PTE are now rdonly

So the write done by the CPU 3 is interfering with the page copy operation
done by CPU 2, leading to the data corruption.

To avoid this we mark all the VMA involved in the COW mechanism as changing
by calling vm_write_begin(). This ensures that the speculative page fault
handler will not try to handle a fault on these pages.
The marker is set until the TLB is flushed, ensuring that all the CPUs will
now see the PTE as not writable.
Once the TLB is flush, the marker is removed by calling vm_write_end().

The variable last is used to keep tracked of the latest VMA marked to
handle the error path where part of the VMA may have been marked.

Change-Id: I3fe07109e27d8f77c9b435053567fe5c287703aa
Reported-by: Ganesh Mahendran <opensource.ganesh@gmail.com>
Reported-by: Vinayak Menon <vinmenon@codeaurora.org>
Signed-off-by: Laurent Dufour <ldufour@linux.ibm.com>
Link: https://www.spinics.net/lists/linux-mm/msg171207.html
Bug: 161210518
Signed-off-by: Charan Teja Reddy <charante@codeaurora.org>
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
2021-01-22 18:02:09 +00:00
Laurent Dufour
6d8fc36d9e FROMLIST: mm: protect mm_rb tree with a rwlock
This change is inspired by the Peter's proposal patch [1] which was
protecting the VMA using SRCU. Unfortunately, SRCU is not scaling well in
that particular case, and it is introducing major performance degradation
due to excessive scheduling operations.

To allow access to the mm_rb tree without grabbing the mmap_sem, this patch
is protecting it access using a rwlock.  As the mm_rb tree is a O(log n)
search it is safe to protect it using such a lock.  The VMA cache is not
protected by the new rwlock and it should not be used without holding the
mmap_sem.

To allow the picked VMA structure to be used once the rwlock is released, a
use count is added to the VMA structure. When the VMA is allocated it is
set to 1.  Each time the VMA is picked with the rwlock held its use count
is incremented. Each time the VMA is released it is decremented. When the
use count hits zero, this means that the VMA is no more used and should be
freed.

This patch is preparing for 2 kind of VMA access :
 - as usual, under the control of the mmap_sem,
 - without holding the mmap_sem for the speculative page fault handler.

Access done under the control the mmap_sem doesn't require to grab the
rwlock to protect read access to the mm_rb tree, but access in write must
be done under the protection of the rwlock too. This affects inserting and
removing of elements in the RB tree.

The patch is introducing 2 new functions:
 - vma_get() to find a VMA based on an address by holding the new rwlock.
 - vma_put() to release the VMA when its no more used.
These services are designed to be used when access are made to the RB tree
without holding the mmap_sem.

When a VMA is removed from the RB tree, its vma->vm_rb field is cleared and
we rely on the WMB done when releasing the rwlock to serialize the write
with the RMB done in a later patch to check for the VMA's validity.

When free_vma is called, the file associated with the VMA is closed
immediately, but the policy and the file structure remained in used until
the VMA's use count reach 0, which may happens later when exiting an
in progress speculative page fault.

[1] https://patchwork.kernel.org/patch/5108281/

Change-Id: I9ecc922b8efa4b28975cc6a8e9531284c24ac14e
Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Matthew Wilcox <willy@infradead.org>
Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>
Link: https://lore.kernel.org/lkml/1523975611-15978-18-git-send-email-ldufour@linux.vnet.ibm.com/
Bug: 161210518
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
Signed-off-by: Charan Teja Reddy <charante@codeaurora.org>
2021-01-22 18:00:57 +00:00
Laurent Dufour
0076600734 FROMLIST: mm: introduce INIT_VMA()
Some VMA struct fields need to be initialized once the VMA structure is
allocated.
Currently this only concerns anon_vma_chain field but some other will be
added to support the speculative page fault.

Instead of spreading the initialization calls all over the code, let's
introduce a dedicated inline function.

Change-Id: I9f6b29dc74055354318b548e2b6b22c37d4c61bb
Signed-off-by: Laurent Dufour <ldufour@linux.vnet.ibm.com>
Link: https://lore.kernel.org/lkml/1523975611-15978-8-git-send-email-ldufour@linux.vnet.ibm.com/
Bug: 161210518
Signed-off-by: Vinayak Menon <vinmenon@codeaurora.org>
Signed-off-by: Charan Teja Reddy <charante@codeaurora.org>
2021-01-22 17:59:31 +00:00
Saravana Kannan
58c1020cf9 UPSTREAM: driver core: Add fwnode_init()
There are multiple locations in the kernel where a struct fwnode_handle
is initialized. Add fwnode_init() so that we have one way of
initializing a fwnode_handle.

Acked-by: Rob Herring <robh@kernel.org>
Signed-off-by: Saravana Kannan <saravanak@google.com>
Link: https://lore.kernel.org/r/20201121020232.908850-8-saravanak@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 01bb86b380)
Bug: 178143855
Bug: 169667932
Change-Id: I60284dbea72db0d7f003ab0e89b8c11f24e00b45
2021-01-21 18:02:19 -08:00
Yun Hsiang
18b294fa4c ANDROID: sched: add em_cpu_energy vendor hook
We add a vendor hook for util to freq calculation in schedutil,
so we need to do corresponding change for energy calculation.

android_vh_em_cpu_energy
	adjust energy calculation

Bug: 178047619

Signed-off-by: Yun Hsiang <yun.hsiang@mediatek.com>
Change-Id: Iae772cf07881602eea3f27aeb75fba753e7c2635
2021-01-21 08:38:56 -08:00
Andrey Konovalov
37f77a6fb3 UPSTREAM: kasan: rename (un)poison_shadow to (un)poison_range
[ Upstream commit cebd0eb29a ]

This is a preparatory commit for the upcoming addition of a new hardware
tag-based (MTE-based) KASAN mode.

The new mode won't be using shadow memory.  Rename external annotation
kasan_unpoison_shadow() to kasan_unpoison_range(), and introduce internal
functions (un)poison_range() (without kasan_ prefix).

Co-developed-by: Marco Elver <elver@google.com>
Link: https://lkml.kernel.org/r/fccdcaa13dc6b2211bf363d6c6d499279a54fe3a.1606161801.git.andreyknvl@google.com
Signed-off-by: Marco Elver <elver@google.com>
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Reviewed-by: Alexander Potapenko <glider@google.com>
Tested-by: Vincenzo Frascino <vincenzo.frascino@arm.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Branislav Rankov <Branislav.Rankov@arm.com>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Dmitry Vyukov <dvyukov@google.com>
Cc: Evgenii Stepanov <eugenis@google.com>
Cc: Kevin Brodsky <kevin.brodsky@arm.com>
Cc: Vasily Gorbik <gor@linux.ibm.com>
Cc: Will Deacon <will.deacon@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Bug: 172318110
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Change-Id: If25b1b58a3a38a2643367a165e1c9bbd69d42455
2021-01-19 21:47:27 -08:00
Walter Wu
789956f2bc UPSTREAM: workqueue: kasan: record workqueue stack
[ Upstream commit e89a85d63f ]

Patch series "kasan: add workqueue stack for generic KASAN", v5.

Syzbot reports many UAF issues for workqueue, see [1].

In some of these access/allocation happened in process_one_work(), we
see the free stack is useless in KASAN report, it doesn't help
programmers to solve UAF for workqueue issue.

This patchset improves KASAN reports by making them to have workqueue
queueing stack.  It is useful for programmers to solve use-after-free or
double-free memory issue.

Generic KASAN also records the last two workqueue stacks and prints them
in KASAN report.  It is only suitable for generic KASAN.

[1] https://groups.google.com/g/syzkaller-bugs/search?q=%22use-after-free%22+process_one_work
[2] https://bugzilla.kernel.org/show_bug.cgi?id=198437

This patch (of 4):

When analyzing use-after-free or double-free issue, recording the
enqueuing work stacks is helpful to preserve usage history which
potentially gives a hint about the affected code.

For workqueue it has turned out to be useful to record the enqueuing work
call stacks.  Because user can see KASAN report to determine whether it is
root cause.  They don't need to enable debugobjects, but they have a
chance to find out the root cause.

Link: https://lkml.kernel.org/r/20201203022148.29754-1-walter-zh.wu@mediatek.com
Link: https://lkml.kernel.org/r/20201203022442.30006-1-walter-zh.wu@mediatek.com
Signed-off-by: Walter Wu <walter-zh.wu@mediatek.com>
Suggested-by: Marco Elver <elver@google.com>
Acked-by: Marco Elver <elver@google.com>
Acked-by: Tejun Heo <tj@kernel.org>
Reviewed-by: Dmitry Vyukov <dvyukov@google.com>
Reviewed-by: Andrey Konovalov <andreyknvl@google.com>
Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
Cc: Alexander Potapenko <glider@google.com>
Cc: Lai Jiangshan <jiangshanlai@gmail.com>
Cc: Marco Elver <elver@google.com>
Cc: Matthias Brugger <matthias.bgg@gmail.com>
Cc: Jonathan Corbet <corbet@lwn.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Bug: 172318110
Signed-off-by: Andrey Konovalov <andreyknvl@google.com>
Change-Id: I3a27e632eb744742bf09e24013f4fcc341fb867f
2021-01-19 21:47:26 -08:00
Yun Hsiang
11d9d07f3f ANDROID: schedutil: add vendor hook for adjusting util to freq calculation
Currently, the frequency is calculated by max freq * 1.25 * util / max cap.
Add a vendor hook to adjust the frequency when the calculation
overestimate.

android_vh_map_util_freq
	adjust util to freq calculation

Bug: 177854431

Signed-off-by: Yun Hsiang <yun.hsiang@mediatek.com>
Change-Id: I9aa9079f00af7d3380b19f2fe21b75cddd107d15
(cherry picked from commit 3122e3ec9672036384304fdeaa1b1815f60ba817)
2021-01-19 20:33:51 +00:00
Greg Kroah-Hartman
88e2d5fd10 Merge 5.10.9 into android12-5.10
Changes in 5.10.9
	btrfs: reloc: fix wrong file extent type check to avoid false ENOENT
	btrfs: prevent NULL pointer dereference in extent_io_tree_panic
	ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machines
	ALSA: doc: Fix reference to mixart.rst
	ASoC: AMD Renoir - add DMI entry for Lenovo ThinkPad X395
	ASoC: dapm: remove widget from dirty list on free
	x86/hyperv: check cpu mask after interrupt has been disabled
	drm/amdgpu: add green_sardine device id (v2)
	drm/amdgpu: fix DRM_INFO flood if display core is not supported (bug 210921)
	Revert "drm/amd/display: Fixed Intermittent blue screen on OLED panel"
	drm/amdgpu: add new device id for Renior
	drm/i915: Allow the sysadmin to override security mitigations
	drm/i915/gt: Limit VFE threads based on GT
	drm/i915/backlight: fix CPU mode backlight takeover on LPT
	drm/bridge: sii902x: Refactor init code into separate function
	dt-bindings: display: sii902x: Add supply bindings
	drm/bridge: sii902x: Enable I/O and core VCC supplies if present
	tracing/kprobes: Do the notrace functions check without kprobes on ftrace
	tools/bootconfig: Add tracing_on support to helper scripts
	ext4: use IS_ERR instead of IS_ERR_OR_NULL and set inode null when IS_ERR
	ext4: fix wrong list_splice in ext4_fc_cleanup
	ext4: fix bug for rename with RENAME_WHITEOUT
	cifs: check pointer before freeing
	cifs: fix interrupted close commands
	riscv: Drop a duplicated PAGE_KERNEL_EXEC
	riscv: return -ENOSYS for syscall -1
	riscv: Fixup CONFIG_GENERIC_TIME_VSYSCALL
	riscv: Fix KASAN memory mapping.
	mips: fix Section mismatch in reference
	mips: lib: uncached: fix non-standard usage of variable 'sp'
	MIPS: boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB
	MIPS: Fix malformed NT_FILE and NT_SIGINFO in 32bit coredumps
	MIPS: relocatable: fix possible boot hangup with KASLR enabled
	RDMA/ocrdma: Fix use after free in ocrdma_dealloc_ucontext_pd()
	ACPI: scan: Harden acpi_device_add() against device ID overflows
	xen/privcmd: allow fetching resource sizes
	compiler.h: Raise minimum version of GCC to 5.1 for arm64
	mm/vmalloc.c: fix potential memory leak
	mm/hugetlb: fix potential missing huge page size info
	mm/process_vm_access.c: include compat.h
	dm raid: fix discard limits for raid1
	dm snapshot: flush merged data before committing metadata
	dm integrity: fix flush with external metadata device
	dm integrity: fix the maximum number of arguments
	dm crypt: use GFP_ATOMIC when allocating crypto requests from softirq
	dm crypt: do not wait for backlogged crypto request completion in softirq
	dm crypt: do not call bio_endio() from the dm-crypt tasklet
	dm crypt: defer decryption to a tasklet if interrupts disabled
	stmmac: intel: change all EHL/TGL to auto detect phy addr
	r8152: Add Lenovo Powered USB-C Travel Hub
	btrfs: tree-checker: check if chunk item end overflows
	ext4: don't leak old mountpoint samples
	io_uring: don't take files/mm for a dead task
	io_uring: drop mm and files after task_work_run
	ARC: build: remove non-existing bootpImage from KBUILD_IMAGE
	ARC: build: add uImage.lzma to the top-level target
	ARC: build: add boot_targets to PHONY
	ARC: build: move symlink creation to arch/arc/Makefile to avoid race
	ARM: omap2: pmic-cpcap: fix maximum voltage to be consistent with defaults on xt875
	ath11k: fix crash caused by NULL rx_channel
	netfilter: ipset: fixes possible oops in mtype_resize
	ath11k: qmi: try to allocate a big block of DMA memory first
	btrfs: fix async discard stall
	btrfs: merge critical sections of discard lock in workfn
	btrfs: fix transaction leak and crash after RO remount caused by qgroup rescan
	regulator: bd718x7: Add enable times
	ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram
	ARM: dts: ux500/golden: Set display max brightness
	habanalabs: adjust pci controller init to new firmware
	habanalabs/gaudi: retry loading TPC f/w on -EINTR
	habanalabs: register to pci shutdown callback
	staging: spmi: hisi-spmi-controller: Fix some error handling paths
	spi: altera: fix return value for altera_spi_txrx()
	habanalabs: Fix memleak in hl_device_reset
	hwmon: (pwm-fan) Ensure that calculation doesn't discard big period values
	lib/raid6: Let $(UNROLL) rules work with macOS userland
	kconfig: remove 'kvmconfig' and 'xenconfig' shorthands
	spi: fix the divide by 0 error when calculating xfer waiting time
	io_uring: drop file refs after task cancel
	bfq: Fix computation of shallow depth
	arch/arc: add copy_user_page() to <asm/page.h> to fix build error on ARC
	misdn: dsp: select CONFIG_BITREVERSE
	net: ethernet: fs_enet: Add missing MODULE_LICENSE
	selftests: fix the return value for UDP GRO test
	nvme-pci: mark Samsung PM1725a as IGNORE_DEV_SUBNQN
	nvme: avoid possible double fetch in handling CQE
	nvmet-rdma: Fix list_del corruption on queue establishment failure
	drm/amd/display: fix sysfs amdgpu_current_backlight_pwm NULL pointer issue
	drm/amdgpu: fix a GPU hang issue when remove device
	drm/amd/pm: fix the failure when change power profile for renoir
	drm/amdgpu: fix potential memory leak during navi12 deinitialization
	usb: typec: Fix copy paste error for NVIDIA alt-mode description
	iommu/vt-d: Fix lockdep splat in sva bind()/unbind()
	ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI
	drm/msm: Call msm_init_vram before binding the gpu
	ARM: picoxcell: fix missing interrupt-parent properties
	poll: fix performance regression due to out-of-line __put_user()
	rcu-tasks: Move RCU-tasks initialization to before early_initcall()
	bpf: Simplify task_file_seq_get_next()
	bpf: Save correct stopping point in file seq iteration
	x86/sev-es: Fix SEV-ES OUT/IN immediate opcode vc handling
	cfg80211: select CONFIG_CRC32
	nvme-fc: avoid calling _nvme_fc_abort_outstanding_ios from interrupt context
	iommu/vt-d: Update domain geometry in iommu_ops.at(de)tach_dev
	net/mlx5e: CT: Use per flow counter when CT flow accounting is enabled
	net/mlx5: Fix passing zero to 'PTR_ERR'
	net/mlx5: E-Switch, fix changing vf VLANID
	blk-mq-debugfs: Add decode for BLK_MQ_F_TAG_HCTX_SHARED
	mm: fix clear_refs_write locking
	mm: don't play games with pinned pages in clear_page_refs
	mm: don't put pinned pages into the swap cache
	perf intel-pt: Fix 'CPU too large' error
	dump_common_audit_data(): fix racy accesses to ->d_name
	ASoC: meson: axg-tdm-interface: fix loopback
	ASoC: meson: axg-tdmin: fix axg skew offset
	ASoC: Intel: fix error code cnl_set_dsp_D0()
	nvmet-rdma: Fix NULL deref when setting pi_enable and traddr INADDR_ANY
	nvme: don't intialize hwmon for discovery controllers
	nvme-tcp: fix possible data corruption with bio merges
	nvme-tcp: Fix warning with CONFIG_DEBUG_PREEMPT
	NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock
	pNFS: We want return-on-close to complete when evicting the inode
	pNFS: Mark layout for return if return-on-close was not sent
	pNFS: Stricter ordering of layoutget and layoutreturn
	NFS: Adjust fs_context error logging
	NFS/pNFS: Don't call pnfs_free_bucket_lseg() before removing the request
	NFS/pNFS: Don't leak DS commits in pnfs_generic_retry_commit()
	NFS/pNFS: Fix a leak of the layout 'plh_outstanding' counter
	NFS: nfs_delegation_find_inode_server must first reference the superblock
	NFS: nfs_igrab_and_active must first reference the superblock
	scsi: ufs: Fix possible power drain during system suspend
	ext4: fix superblock checksum failure when setting password salt
	RDMA/restrack: Don't treat as an error allocation ID wrapping
	RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp
	bnxt_en: Improve stats context resource accounting with RDMA driver loaded.
	RDMA/mlx5: Fix wrong free of blue flame register on error
	IB/mlx5: Fix error unwinding when set_has_smi_cap fails
	umount(2): move the flag validity checks first
	dm zoned: select CONFIG_CRC32
	drm/i915/dsi: Use unconditional msleep for the panel_on_delay when there is no reset-deassert MIPI-sequence
	drm/i915/icl: Fix initing the DSI DSC power refcount during HW readout
	drm/i915/gt: Restore clear-residual mitigations for Ivybridge, Baytrail
	mm, slub: consider rest of partial list if acquire_slab() fails
	riscv: Trace irq on only interrupt is enabled
	iommu/vt-d: Fix unaligned addresses for intel_flush_svm_range_dev()
	net: sunrpc: interpret the return value of kstrtou32 correctly
	selftests: netfilter: Pass family parameter "-f" to conntrack tool
	dm: eliminate potential source of excessive kernel log noise
	ALSA: fireface: Fix integer overflow in transmit_midi_msg()
	ALSA: firewire-tascam: Fix integer overflow in midi_port_work()
	netfilter: conntrack: fix reading nf_conntrack_buckets
	netfilter: nf_nat: Fix memleak in nf_nat_init
	Linux 5.10.9

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: I609e501511889081e03d2d18ee7e1be95406f396
2021-01-19 18:49:54 +01:00
Jonathan Lemon
1f63b3393b bpf: Save correct stopping point in file seq iteration
[ Upstream commit 69ca310f34 ]

On some systems, some variant of the following splat is
repeatedly seen.  The common factor in all traces seems
to be the entry point to task_file_seq_next().  With the
patch, all warnings go away.

    rcu: INFO: rcu_sched self-detected stall on CPU
    rcu: \x0926-....: (20992 ticks this GP) idle=d7e/1/0x4000000000000002 softirq=81556231/81556231 fqs=4876
    \x09(t=21033 jiffies g=159148529 q=223125)
    NMI backtrace for cpu 26
    CPU: 26 PID: 2015853 Comm: bpftool Kdump: loaded Not tainted 5.6.13-0_fbk4_3876_gd8d1f9bf80bb #1
    Hardware name: Quanta Twin Lakes MP/Twin Lakes Passive MP, BIOS F09_3A12 10/08/2018
    Call Trace:
     <IRQ>
     dump_stack+0x50/0x70
     nmi_cpu_backtrace.cold.6+0x13/0x50
     ? lapic_can_unplug_cpu.cold.30+0x40/0x40
     nmi_trigger_cpumask_backtrace+0xba/0xca
     rcu_dump_cpu_stacks+0x99/0xc7
     rcu_sched_clock_irq.cold.90+0x1b4/0x3aa
     ? tick_sched_do_timer+0x60/0x60
     update_process_times+0x24/0x50
     tick_sched_timer+0x37/0x70
     __hrtimer_run_queues+0xfe/0x270
     hrtimer_interrupt+0xf4/0x210
     smp_apic_timer_interrupt+0x5e/0x120
     apic_timer_interrupt+0xf/0x20
     </IRQ>
    RIP: 0010:get_pid_task+0x38/0x80
    Code: 89 f6 48 8d 44 f7 08 48 8b 00 48 85 c0 74 2b 48 83 c6 55 48 c1 e6 04 48 29 f0 74 19 48 8d 78 20 ba 01 00 00 00 f0 0f c1 50 20 <85> d2 74 27 78 11 83 c2 01 78 0c 48 83 c4 08 c3 31 c0 48 83 c4 08
    RSP: 0018:ffffc9000d293dc8 EFLAGS: 00000202 ORIG_RAX: ffffffffffffff13
    RAX: ffff888637c05600 RBX: ffffc9000d293e0c RCX: 0000000000000000
    RDX: 0000000000000001 RSI: 0000000000000550 RDI: ffff888637c05620
    RBP: ffffffff8284eb80 R08: ffff88831341d300 R09: ffff88822ffd8248
    R10: ffff88822ffd82d0 R11: 00000000003a93c0 R12: 0000000000000001
    R13: 00000000ffffffff R14: ffff88831341d300 R15: 0000000000000000
     ? find_ge_pid+0x1b/0x20
     task_seq_get_next+0x52/0xc0
     task_file_seq_get_next+0x159/0x220
     task_file_seq_next+0x4f/0xa0
     bpf_seq_read+0x159/0x390
     vfs_read+0x8a/0x140
     ksys_read+0x59/0xd0
     do_syscall_64+0x42/0x110
     entry_SYSCALL_64_after_hwframe+0x44/0xa9
    RIP: 0033:0x7f95ae73e76e
    Code: Bad RIP value.
    RSP: 002b:00007ffc02c1dbf8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
    RAX: ffffffffffffffda RBX: 000000000170faa0 RCX: 00007f95ae73e76e
    RDX: 0000000000001000 RSI: 00007ffc02c1dc30 RDI: 0000000000000007
    RBP: 00007ffc02c1ec70 R08: 0000000000000005 R09: 0000000000000006
    R10: fffffffffffff20b R11: 0000000000000246 R12: 00000000019112a0
    R13: 0000000000000000 R14: 0000000000000007 R15: 00000000004283c0

If unable to obtain the file structure for the current task,
proceed to the next task number after the one returned from
task_seq_get_next(), instead of the next task number from the
original iterator.

Also, save the stopping task number from task_seq_get_next()
on failure in case of restarts.

Fixes: eaaacd2391 ("bpf: Add task and task/file iterator targets")
Signed-off-by: Jonathan Lemon <jonathan.lemon@gmail.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Andrii Nakryiko <andrii@kernel.org>
Link: https://lore.kernel.org/bpf/20201218185032.2464558-2-jonathan.lemon@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-19 18:27:28 +01:00
Song Liu
a3a51c69c1 bpf: Simplify task_file_seq_get_next()
[ Upstream commit 91b2db27d3 ]

Simplify task_file_seq_get_next() by removing two in/out arguments: task
and fstruct. Use info->task and info->files instead.

Signed-off-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Acked-by: Yonghong Song <yhs@fb.com>
Link: https://lore.kernel.org/bpf/20201120002833.2481110-1-songliubraving@fb.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-19 18:27:28 +01:00
Uladzislau Rezki (Sony)
30b491e2b6 rcu-tasks: Move RCU-tasks initialization to before early_initcall()
[ Upstream commit 1b04fa9900 ]

PowerPC testing encountered boot failures due to RCU Tasks not being
fully initialized until core_initcall() time.  This commit therefore
initializes RCU Tasks (along with Rude RCU and RCU Tasks Trace) just
before early_initcall() time, thus allowing waiting on RCU Tasks grace
periods from early_initcall() handlers.

Link: https://lore.kernel.org/rcu/87eekfh80a.fsf@dja-thinkpad.axtens.net/
Fixes: 36dadef23f ("kprobes: Init kprobes in early_initcall")
Tested-by: Daniel Axtens <dja@axtens.net>
Signed-off-by: Uladzislau Rezki (Sony) <urezki@gmail.com>
Signed-off-by: Paul E. McKenney <paulmck@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-01-19 18:27:28 +01:00