4.8.16-stable review
Greg Kroah-Hartman
maintainercover 4.8.16-stable review
This is the start of the stable review cycle for the 4.8.16 release. There are 85 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri Jan 6 20:06:45 UTC 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.8.16-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.8.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <[email protected]>
Linux 4.8.16-rc1
Ming Lei <[email protected]>
driver core: fix race between creating/querying glue dir and its cleanup
Greg Kroah-Hartman <[email protected]>
Revert "netfilter: move nat hlist_head to nf_conn"
Greg Kroah-Hartman <[email protected]>
Revert "netfilter: nat: convert nat bysrc hash to rhashtable"
AKASHI Takahiro <[email protected]>
arm64: mark reserved memblock regions explicitly in iomem
Eric Sandeen <[email protected]>
xfs: set AGI buffer type in xlog_recover_clear_agi_bucket
Julien Grall <[email protected]>
arm/xen: Use alloc_percpu rather than __alloc_percpu
Boris Ostrovsky <[email protected]>
xen/gntdev: Use VM_MIXEDMAP instead of VM_IO to avoid NUMA balancing
Jason Gunthorpe <[email protected]>
tpm xen: Remove bogus tpm_chip_unregister
Douglas Anderson <[email protected]>
kernel/debug/debug_core.c: more properly delay for secondary CPUs
Christian Lamparter <[email protected]>
watchdog: qcom: fix kernel panic due to external abort on non-linefetch
Alexander Usyskin <[email protected]>
watchdog: mei_wdt: request stop on reboot to prevent false positive event
Konstantin Khlebnikov <[email protected]>
kernel/watchdog: use nmi registers snapshot in hardlockup handler
Pavel Shilovsky <[email protected]>
CIFS: Fix a possible memory corruption in push locks
Pavel Shilovsky <[email protected]>
CIFS: Fix missing nls unload in smb2_reconnect()
Pavel Shilovsky <[email protected]>
CIFS: Fix a possible memory corruption during reconnect
Takashi Iwai <[email protected]>
ASoC: intel: Fix crash at suspend/resume without card registration
Benjamin Marzinski <[email protected]>
dm space map metadata: fix 'struct sm_metadata' leak on failed create
Heinz Mauelshagen <[email protected]>
dm raid: fix discard support regression
Bart Van Assche <[email protected]>
dm rq: fix a race condition in rq_completed()
Ondrej Kozina <[email protected]>
dm crypt: mark key as invalid until properly loaded
Wei Yongjun <[email protected]>
dm flakey: return -EINVAL on interval bounds error in flakey_ctr()
Bart Van Assche <[email protected]>
dm table: an 'all_blk_mq' table must be loaded for a blk-mq DM device
Mike Snitzer <[email protected]>
dm table: fix 'all_blk_mq' inconsistency when an empty table is loaded
Bart Van Assche <[email protected]>
blk-mq: Do not invoke .queue_rq() for a stopped queue
Stephen Boyd <[email protected]>
PM / OPP: Pass opp_table to dev_pm_opp_put_regulator()
Felipe Balbi <[email protected]>
usb: gadget: composite: always set ep->mult to a sensible value
Mel Gorman <[email protected]>
mm, page_alloc: keep pcp count and list contents in sync if struct page is corrupted
Shaohua Li <[email protected]>
mm/vmscan.c: set correct defer count for shrinker
Solganik Alexander <[email protected]>
nvmet: Fix possible infinite loop triggered on hot namespace removal
Omar Sandoval <[email protected]>
loop: return proper error from loop_queue_rq()
Jaegeuk Kim <[email protected]>
f2fs: fix overflow due to condition check order
Nicolai Stange <[email protected]>
f2fs: set ->owner for debugfs status file's file_operations
Jaegeuk Kim <[email protected]>
Revert "f2fs: use percpu_counter for # of dirty pages in inode"
Sergey Karamov <[email protected]>
ext4: do not perform data journaling when data is encrypted
Dan Carpenter <[email protected]>
ext4: return -ENOMEM instead of success
Darrick J. Wong <[email protected]>
ext4: reject inodes with negative size
Theodore Ts'o <[email protected]>
ext4: add sanity checking to count_overhead()
Theodore Ts'o <[email protected]>
ext4: fix in-superblock mount options processing
Theodore Ts'o <[email protected]>
ext4: use more strict checks for inodes_per_block on mount
Chandan Rajendra <[email protected]>
ext4: fix stack memory corruption with 64k block size
Chandan Rajendra <[email protected]>
ext4: fix mballoc breakage with 64k block size
Alex Porosanu <[email protected]>
crypto: caam - fix AEAD givenc descriptors
Eric W. Biederman <[email protected]>
ptrace: Capture the ptracer's creds not PT_PTRACE_CAP
Linus Torvalds <[email protected]>
vfs,mm: fix return value of read() at s_maxbytes
Eric W. Biederman <[email protected]>
mm: Add a user_ns owner to mm_struct and fix ptrace permission checks
NeilBrown <[email protected]>
block_dev: don't test bdev->bd_contains when it is not stable
Aleksa Sarai <[email protected]>
fs: exec: apply CLOEXEC before changing dumpable task flags
Eric W. Biederman <[email protected]>
exec: Ensure mm->user_ns contains the execed files
Wang Xiaoguang <[email protected]>
btrfs: make file clone aware of fatal signals
Filipe Manana <[email protected]>
Btrfs: fix incremental send failure caused by balance
Josef Bacik <[email protected]>
Btrfs: don't BUG() during drop snapshot
Anand Jain <[email protected]>
btrfs: fix a possible umount deadlock
Liu Bo <[email protected]>
Btrfs: fix memory leak in do_walk_down
Jeff Mahoney <[email protected]>
btrfs: clean the old superblocks before freeing the device
Josef Bacik <[email protected]>
Btrfs: don't leak reloc root nodes on error
Liu Bo <[email protected]>
Btrfs: return gracefully from balance if fs tree is corrupted
Liu Bo <[email protected]>
Btrfs: bail out if block group has different mixed flag
Liu Bo <[email protected]>
Btrfs: fix memory leak in reading btree blocks
Richard Watts <[email protected]>
clk: ti: omap36xx: Work around sprz319 advisory 2.1
Kai-Heng Feng <[email protected]>
ALSA: hda: when comparing pin configurations, ignore assoc in addition to seq
Takashi Iwai <[email protected]>
ALSA: hda - Gate the mic jack on HP Z1 Gen3 AiO
Hui Wang <[email protected]>
ALSA: hda - fix headset-mic problem on a Dell laptop
Hui Wang <[email protected]>
ALSA: hda - ignore the assoc and seq when comparing pin configurations
Sven Hahne <[email protected]>
ALSA: hda/ca0132 - Add quirk for Alienware 15 R2 2016
Jussi Laako <[email protected]>
ALSA: hiface: Fix M2Tech hiFace driver sampling rate change
Con Kolivas <[email protected]>
ALSA: usb-audio: Add QuickCam Communicate Deluxe/S7500 to volume_control_quirks
Krzysztof Opasiak <[email protected]>
usbip: vudc: fix: Clear already_seen flag also for ep0
Alan Stern <[email protected]>
USB: UHCI: report non-PME wakeup signalling for Intel hardware
Felipe Balbi <[email protected]>
usb: gadget: composite: correctly initialize ep->maxpacket
Peter Chen <[email protected]>
usb: gadget: f_uac2: fix error handling at afunc_bind
Mathias Nyman <[email protected]>
usb: hub: Fix auto-remount of safely removed or ejected USB-3 devices
Felipe Balbi <[email protected]>
usb: dwc3: gadget: set PCM1 field of isochronous-first TRBs
Nathaniel Quillin <[email protected]>
USB: cdc-acm: add device id for GW Instek AFG-125
Johan Hovold <[email protected]>
USB: serial: kl5kusb105: fix open error path
Giuseppe Lippolis <[email protected]>
USB: serial: option: add dlink dwm-158
Daniele Palmas <[email protected]>
USB: serial: option: add support for Telit LE922A PIDs 0x1040, 0x1041
Filipe Manana <[email protected]>
Btrfs: fix qgroup rescan worker initialization
Filipe Manana <[email protected]>
Btrfs: fix emptiness check for dirtied extent buffers at check_leaf()
David Sterba <[email protected]>
btrfs: store and load values of stripes_min/stripes_max in balance status item
Filipe Manana <[email protected]>
Btrfs: fix relocation incorrectly dropping data references
Robbie Ko <[email protected]>
Btrfs: fix tree search logic when replaying directory entry deletes
Robbie Ko <[email protected]>
Btrfs: fix deadlock caused by fsync when logging directory entries
Liu Bo <[email protected]>
Btrfs: fix BUG_ON in btrfs_mark_buffer_dirty
Maxim Patlasov <[email protected]>
btrfs: limit async_work allocation and worker func duration
Jens Axboe <[email protected]>
aoe: fix crash in page count manipulation
-------------
Diffstat:
Makefile | 4 +- arch/arm/xen/enlighten.c | 3 +- arch/arm64/include/asm/acpi.h | 8 +- arch/arm64/kernel/setup.c | 9 +- block/blk-mq.c | 6 +- drivers/base/core.c | 39 ++++-- drivers/base/power/opp/core.c | 22 +-- drivers/block/aoe/aoecmd.c | 41 ------ drivers/block/loop.c | 2 +- drivers/char/tpm/xen-tpmfront.c | 1 - drivers/clk/ti/clk-3xxx.c | 20 +-- drivers/clk/ti/clock.h | 9 ++ drivers/clk/ti/dpll.c | 19 ++- drivers/clk/ti/dpll3xxx.c | 67 +++++++++ drivers/cpufreq/cpufreq-dt.c | 12 +- drivers/crypto/caam/caamalg.c | 4 +- drivers/md/dm-crypt.c | 7 +- drivers/md/dm-flakey.c | 2 + drivers/md/dm-raid.c | 9 +- drivers/md/dm-rq.c | 10 +- drivers/md/dm-table.c | 24 +++- drivers/md/persistent-data/dm-space-map-metadata.c | 14 +- drivers/nvme/target/configfs.c | 6 +- drivers/nvme/target/core.c | 14 +- drivers/nvme/target/nvmet.h | 6 +- drivers/usb/class/cdc-acm.c | 1 + drivers/usb/core/hub.c | 101 +++++--------- drivers/usb/dwc3/gadget.c | 13 +- drivers/usb/gadget/composite.c | 11 +- drivers/usb/gadget/function/f_uac2.c | 14 +- drivers/usb/gadget/function/uvc_video.c | 2 +- drivers/usb/host/uhci-pci.c | 4 + drivers/usb/serial/kl5kusb105.c | 33 +++-- drivers/usb/serial/option.c | 7 + drivers/usb/usbip/vudc_transfer.c | 2 + drivers/watchdog/mei_wdt.c | 2 + drivers/watchdog/qcom-wdt.c | 2 +- drivers/xen/gntdev.c | 2 +- fs/block_dev.c | 2 +- fs/btrfs/async-thread.c | 14 ++ fs/btrfs/async-thread.h | 1 + fs/btrfs/ctree.h | 4 + fs/btrfs/delayed-inode.c | 6 +- fs/btrfs/disk-io.c | 23 +++- fs/btrfs/extent-tree.c | 51 +++++-- fs/btrfs/extent_io.c | 9 ++ fs/btrfs/ioctl.c | 5 + fs/btrfs/qgroup.c | 5 +- fs/btrfs/relocation.c | 42 ++++-- fs/btrfs/send.c | 58 ++++++++ fs/btrfs/tree-log.c | 7 +- fs/btrfs/volumes.c | 64 +++++---- fs/cifs/cifsglob.h | 3 + fs/cifs/cifsproto.h | 3 + fs/cifs/connect.c | 34 ++++- fs/cifs/smb2file.c | 2 +- fs/cifs/smb2pdu.c | 77 +++++++---- fs/cifs/smb2proto.h | 1 + fs/exec.c | 31 ++++- fs/ext4/ext4_jbd2.h | 14 +- fs/ext4/inline.c | 4 +- fs/ext4/inode.c | 6 + fs/ext4/mballoc.c | 4 +- fs/ext4/super.c | 69 ++++++---- fs/f2fs/debug.c | 1 + fs/f2fs/f2fs.h | 10 +- fs/f2fs/file.c | 4 +- fs/f2fs/super.c | 7 +- fs/xfs/xfs_log_recover.c | 1 + include/linux/capability.h | 2 + include/linux/mm_types.h | 1 + include/linux/pm_opp.h | 11 +- include/linux/ptrace.h | 1 - include/linux/sched.h | 1 + include/net/netfilter/nf_conntrack.h | 4 - include/net/netfilter/nf_conntrack_extend.h | 3 + include/net/netfilter/nf_nat.h | 3 +- kernel/capability.c | 36 ++++- kernel/debug/debug_core.c | 4 +- kernel/fork.c | 9 +- kernel/ptrace.c | 28 ++-- kernel/watchdog.c | 1 - mm/filemap.c | 2 +- mm/init-mm.c | 2 + mm/page_alloc.c | 12 +- mm/vmscan.c | 14 +- net/netfilter/nf_conntrack_extend.c | 15 ++- net/netfilter/nf_nat_core.c | 149 +++++++++++---------- sound/pci/hda/hda_auto_parser.c | 4 +- sound/pci/hda/patch_ca0132.c | 1 + sound/pci/hda/patch_conexant.c | 17 +++ sound/pci/hda/patch_realtek.c | 3 + sound/soc/intel/atom/sst-mfld-platform-pcm.c | 6 + sound/usb/hiface/pcm.c | 2 + sound/usb/mixer.c | 3 +- 95 files changed, 957 insertions(+), 491 deletions(-)
Greg Kroah-Hartman
maintainerPATCH 1/85 aoe: fix crash in page count manipulation
4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jens Axboe <[email protected]>
commit 0cbc72a1781250f373327dd7e306e33859a42154 upstream.
aoeblk contains some mysterious code, that wants to elevate the bio vec page counts while it's under IO. That is not needed, it's fragile, and it's causing kernel oopses for some.
--- drivers/block/aoe/aoecmd.c | 41 ----------------------------------------- 1 file changed, 41 deletions(-)
drivers/block/aoe/aoecmd.c +0 -41
@@ -853,45 +853,6 @@ rqbiocnt(struct request *r)return n; } -/* This can be removed if we are certain that no users of the block -* layer will ever use zero-count pages in bios. Otherwise we have to -* protect against the put_page sometimes done by the network layer. -* -* See http://oss.sgi.com/archives/xfs/2007-01/msg00594.html for -* discussion. -* -* We cannot use get_page in the workaround, because it insists on a -* positive page count as a precondition. So we use _refcount directly. -*/ -static void -bio_pageinc (struct bio *bio) -{ -struct bio_vec bv; -struct page *page; -struct bvec_iter iter; - -bio_for_each_segment (bv, bio, iter) { -/* Non-zero page count for non-head members of -* compound pages is no longer allowed by the kernel. -*/ - page =compound_head (bv.bv_page); -page_ref_inc (page); - } -} - -static void -bio_pagedec (struct bio *bio) -{ -struct page *page; -struct bio_vec bv; -struct bvec_iter iter; - -bio_for_each_segment (bv, bio, iter) { - page =compound_head (bv.bv_page); -page_ref_dec (page); - } -} -static void bufinit (struct buf *buf,struct request *rq,struct bio *bio) {
@@ -899,7 +860,6 @@ bufinit(struct buf *buf, struct request buf->rq = rq; buf->bio = bio; buf->iter = bio->bi_iter; -bio_pageinc (bio); } static struct buf *
@@ -1127,7 +1087,6 @@ aoe_end_buf(struct aoedev *d, struct bufif (buf == d->ip.buf) d->ip.buf =NULL ; rq = buf->rq; -bio_pagedec (buf->bio);mempool_free (buf, d->bufpool); n = (unsigned long ) rq->special; rq->special = (void *) --n;
Greg Kroah-Hartman
maintainerPATCH 2/85 btrfs: limit async_work allocation and worker func duration
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Maxim Patlasov <[email protected]>
commit 2939e1a86f758b55cdba73e29397dd3d94df13bc upstream.
Problem statement: unprivileged user who has read-write access to more than one btrfs subvolume may easily consume all kernel memory (eventually triggering oom-killer).
Reproducer (./mkrmdir below essentially loops over mkdir/rmdir):
[root@kteam1 ~]# cat prep.sh
DEV=/dev/sdb
mkfs.btrfs -f $DEV
mount $DEV /mnt
for i in seq 1 16
do
mkdir /mnt/$i
btrfs subvolume create /mnt/SV_$i
ID=btrfs subvolume list /mnt |grep "SV_$i$" |cut -d ' ' -f 2 mount -t btrfs -o subvolid=$ID $DEV /mnt/$i
chmod a+rwx /mnt/$i
done
[root@kteam1 ~]# sh prep.sh
[maxim@kteam1 ~]$ for i in seq 1 16; do ./mkrmdir /mnt/$i 2000 2000 & done
[root@kteam1 ~]# for i in seq 1 4; do grep "kmalloc-128" /proc/slabinfo | grep -v dma; sleep 60; done
kmalloc-128 10144 10144 128 32 1 : tunables 0 0 0 : slabdata 317 317 0
kmalloc-128 9992352 9992352 128 32 1 : tunables 0 0 0 : slabdata 312261 312261 0 kmalloc-128 24226752 24226752 128 32 1 : tunables 0 0 0 : slabdata 757086 757086 0 kmalloc-128 42754240 42754240 128 32 1 : tunables 0 0 0 : slabdata 1336070 1336070 0
The huge numbers above come from insane number of async_work-s allocated and queued by btrfs_wq_run_delayed_node.
The problem is caused by btrfs_wq_run_delayed_node() queuing more and more works if the number of delayed items is above BTRFS_DELAYED_BACKGROUND. The worker func (btrfs_async_run_delayed_root) processes at least BTRFS_DELAYED_BATCH items (if they are present in the list). So, the machinery works as expected while the list is almost empty. As soon as it is getting bigger, worker func starts to process more than one item at a time, it takes longer, and the chances to have async_works queued more than needed is getting higher.
The problem above is worsened by another flaw of delayed-inode implementation:
if async_work was queued in a throttling branch (number of items >= BTRFS_DELAYED_WRITEBACK), corresponding worker func won't quit until the number of items < BTRFS_DELAYED_BACKGROUND / 2. So, it is possible that the func occupies CPU infinitely (up to 30sec in my experiments): while the func is trying to drain the list, the user activity may add more and more items to the list.
The patch fixes both problems in straightforward way: refuse queuing too many works in btrfs_wq_run_delayed_node and bail out of worker func if at least BTRFS_DELAYED_WRITEBACK items are processed.
Changed in v2: remove support of thresh == NO_THRESHOLD.
--- fs/btrfs/async-thread.c | 14 ++++++++++++++ fs/btrfs/async-thread.h | 1 + fs/btrfs/delayed-inode.c | 6 ++++-- 3 files changed, 19 insertions(+), 2 deletions(-)
fs/btrfs/async-thread.c +14 -0
@@ -86,6 +86,20 @@ btrfs_work_owner(struct btrfs_work *workreturn work->wq->fs_info; } +bool btrfs_workqueue_normal_congested (struct btrfs_workqueue *wq) +{ +/* +* We could compare wq->normal->pending with num_online_cpus() +* to support "thresh == NO_THRESHOLD" case, but it requires +* moving up atomic_inc/dec in thresh_queue/exec_hook. Let's +* postpone it until someone needs the support of that case. +*/ +if (wq->normal->thresh ==NO_THRESHOLD ) +return false; + +return atomic_read (&wq->normal->pending) > wq->normal->thresh *2 ; +} +BTRFS_WORK_HELPER (worker_helper);BTRFS_WORK_HELPER (delalloc_helper);BTRFS_WORK_HELPER (flush_delalloc_helper);
fs/btrfs/async-thread.h +1 -0
@@ -84,4 +84,5 @@ void btrfs_workqueue_set_max(struct btrfvoid btrfs_set_work_high_priority (struct btrfs_work *work);struct btrfs_fs_info *btrfs_work_owner (struct btrfs_work *work);struct btrfs_fs_info *btrfs_workqueue_owner (struct __btrfs_workqueue *wq); +bool btrfs_workqueue_normal_congested (struct btrfs_workqueue *wq);#endif
fs/btrfs/delayed-inode.c +4 -2
@@ -1356,7 +1356,8 @@ release_path: total_done++;btrfs_release_prepared_delayed_node (delayed_node); -if (async_work->nr ==0 || total_done < async_work->nr) +if ((async_work->nr ==0 && total_done <BTRFS_DELAYED_WRITEBACK ) || + total_done < async_work->nr) goto again; free_path:
@@ -1372,7 +1373,8 @@ static int btrfs_wq_run_delayed_node(str {struct btrfs_async_delayed_work *async_work; -if (atomic_read (&delayed_root->items) <BTRFS_DELAYED_BACKGROUND ) +if (atomic_read (&delayed_root->items) <BTRFS_DELAYED_BACKGROUND || +btrfs_workqueue_normal_congested (fs_info->delayed_workers))return 0 ; async_work =kmalloc (sizeof (*async_work),GFP_NOFS );
Greg Kroah-Hartman
maintainerPATCH 3/85 Btrfs: fix BUG_ON in btrfs_mark_buffer_dirty
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Bo <[email protected]>
commit ef85b25e982b5bba1530b936e283ef129f02ab9d upstream.
This can only happen with CONFIG_BTRFS_FS_CHECK_INTEGRITY=y.
Commit 1ba98d0 ("Btrfs: detect corruption when non-root leaf has zero item") assumes that a leaf is its root when leaf->bytenr == btrfs_root_bytenr(root), however, we should not use btrfs_root_bytenr(root) since it's mainly got updated during committing transaction. So the check can fail when doing COW on this leaf while it is a root.
This changes to use "if (leaf == btrfs_root_node(root))" instead, just like how we check whether leaf is a root in __btrfs_cow_block().
--- fs/btrfs/disk-io.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-)
fs/btrfs/disk-io.c +7 -3
@@ -572,13 +572,17 @@ static noinline int check_leaf(struct bt* open_ctree() some roots has not yet been set up. */ if (!IS_ERR_OR_NULL (check_root)) { +struct extent_buffer *eb; + + eb =btrfs_root_node (check_root);/* if leaf is the root, then it's fine */ -if (leaf->start != -btrfs_root_bytenr (&check_root->root_item)) { +if (leaf != eb) {CORRUPT ("non-root leaf's nritems is 0" , - leaf, root,0 ); + leaf, check_root,0 ); +free_extent_buffer (eb);return -EIO ; } +free_extent_buffer (eb); }return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 4/85 Btrfs: fix deadlock caused by fsync when logging directory entries
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robbie Ko <[email protected]>
commit ec125cfb7ae2157af3dd45dd8abe823e3e233eec upstream.
While logging new directory entries, at tree-log.c:log_new_dir_dentries(), after we call btrfs_search_forward() we get a leaf with a read lock on it, and without unlocking that leaf we can end up calling btrfs_iget() to get an inode pointer. The later (btrfs_iget()) can end up doing a read-only search on the same tree again, if the inode is not in memory already, which ends up causing a deadlock if some other task in the meanwhile started a write search on the tree and is attempting to write lock the same leaf that btrfs_search_forward() locked while holding write locks on upper levels of the tree blocking the read search from btrfs_iget(). In this scenario we get a deadlock.
So fix this by releasing the search path before calling btrfs_iget() at tree-log.c:log_new_dir_dentries().
Example trace of such deadlock:
[ 4077.478852] kworker/u24:10 D ffff88107fc90640 0 14431 2 0x00000000 [ 4077.486752] Workqueue: btrfs-endio-write btrfs_endio_write_helper [btrfs] [ 4077.494346] ffff880ffa56bad0 0000000000000046 0000000000009000 ffff880ffa56bfd8 [ 4077.502629] ffff880ffa56bfd8 ffff881016ce21c0 ffffffffa06ecb26 ffff88101a5d6138 [ 4077.510915] ffff880ebb5173b0 ffff880ffa56baf8 ffff880ebb517410 ffff881016ce21c0 [ 4077.519202] Call Trace: [ 4077.528752] [<ffffffffa06ed5ed>] ? btrfs_tree_lock+0xdd/0x2f0 [btrfs] [ 4077.536049] [<ffffffff81053680>] ? wake_up_atomic_t+0x30/0x30 [ 4077.542574] [<ffffffffa068cc1f>] ? btrfs_search_slot+0x79f/0xb10 [btrfs] [ 4077.550171] [<ffffffffa06a5073>] ? btrfs_lookup_file_extent+0x33/0x40 [btrfs] [ 4077.558252] [<ffffffffa06c600b>] ? __btrfs_drop_extents+0x13b/0xdf0 [btrfs] [ 4077.566140] [<ffffffffa06fc9e2>] ? add_delayed_data_ref+0xe2/0x150 [btrfs] [ 4077.573928] [<ffffffffa06fd629>] ? btrfs_add_delayed_data_ref+0x149/0x1d0 [btrfs] [ 4077.582399] [<ffffffffa06cf3c0>] ? __set_extent_bit+0x4c0/0x5c0 [btrfs] [ 4077.589896] [<ffffffffa06b4a64>] ? insert_reserved_file_extent.constprop.75+0xa4/0x320 [btrfs] [ 4077.599632] [<ffffffffa06b206d>] ? start_transaction+0x8d/0x470 [btrfs] [ 4077.607134] [<ffffffffa06bab57>] ? btrfs_finish_ordered_io+0x2e7/0x600 [btrfs] [ 4077.615329] [<ffffffff8104cbc2>] ? process_one_work+0x142/0x3d0 [ 4077.622043] [<ffffffff8104d729>] ? worker_thread+0x109/0x3b0 [ 4077.628459] [<ffffffff8104d620>] ? manage_workers.isra.26+0x270/0x270 [ 4077.635759] [<ffffffff81052b0f>] ? kthread+0xaf/0xc0 [ 4077.641404] [<ffffffff81052a60>] ? kthread_create_on_node+0x110/0x110 [ 4077.648696] [<ffffffff814a9ac8>] ? ret_from_fork+0x58/0x90 [ 4077.654926] [<ffffffff81052a60>] ? kthread_create_on_node+0x110/0x110
[ 4078.358087] kworker/u24:15 D ffff88107fcd0640 0 14436 2 0x00000000 [ 4078.365981] Workqueue: btrfs-endio-write btrfs_endio_write_helper [btrfs] [ 4078.373574] ffff880ffa57fad0 0000000000000046 0000000000009000 ffff880ffa57ffd8 [ 4078.381864] ffff880ffa57ffd8 ffff88103004d0a0 ffffffffa06ecb26 ffff88101a5d6138 [ 4078.390163] ffff880fbeffc298 ffff880ffa57faf8 ffff880fbeffc2f8 ffff88103004d0a0 [ 4078.398466] Call Trace: [ 4078.408019] [<ffffffffa06ed5ed>] ? btrfs_tree_lock+0xdd/0x2f0 [btrfs] [ 4078.415322] [<ffffffff81053680>] ? wake_up_atomic_t+0x30/0x30 [ 4078.421844] [<ffffffffa068cc1f>] ? btrfs_search_slot+0x79f/0xb10 [btrfs] [ 4078.429438] [<ffffffffa06a5073>] ? btrfs_lookup_file_extent+0x33/0x40 [btrfs] [ 4078.437518] [<ffffffffa06c600b>] ? __btrfs_drop_extents+0x13b/0xdf0 [btrfs] [ 4078.445404] [<ffffffffa06fc9e2>] ? add_delayed_data_ref+0xe2/0x150 [btrfs] [ 4078.453194] [<ffffffffa06fd629>] ? btrfs_add_delayed_data_ref+0x149/0x1d0 [btrfs] [ 4078.461663] [<ffffffffa06cf3c0>] ? __set_extent_bit+0x4c0/0x5c0 [btrfs] [ 4078.469161] [<ffffffffa06b4a64>] ? insert_reserved_file_extent.constprop.75+0xa4/0x320 [btrfs] [ 4078.478893] [<ffffffffa06b206d>] ? start_transaction+0x8d/0x470 [btrfs] [ 4078.486388] [<ffffffffa06bab57>] ? btrfs_finish_ordered_io+0x2e7/0x600 [btrfs] [ 4078.494561] [<ffffffff8104cbc2>] ? process_one_work+0x142/0x3d0 [ 4078.501278] [<ffffffff8104a507>] ? pwq_activate_delayed_work+0x27/0x40 [ 4078.508673] [<ffffffff8104d729>] ? worker_thread+0x109/0x3b0 [ 4078.515098] [<ffffffff8104d620>] ? manage_workers.isra.26+0x270/0x270 [ 4078.522396] [<ffffffff81052b0f>] ? kthread+0xaf/0xc0 [ 4078.528032] [<ffffffff81052a60>] ? kthread_create_on_node+0x110/0x110 [ 4078.535325] [<ffffffff814a9ac8>] ? ret_from_fork+0x58/0x90 [ 4078.541552] [<ffffffff81052a60>] ? kthread_create_on_node+0x110/0x110
[ 4079.355824] user-space-program D ffff88107fd30640 0 32020 1 0x00000000 [ 4079.363716] ffff880eae8eba10 0000000000000086 0000000000009000 ffff880eae8ebfd8 [ 4079.372003] ffff880eae8ebfd8 ffff881016c162c0 ffffffffa06ecb26 ffff88101a5d6138 [ 4079.380294] ffff880fbed4b4c8 ffff880eae8eba38 ffff880fbed4b528 ffff881016c162c0 [ 4079.388586] Call Trace: [ 4079.398134] [<ffffffffa06ed595>] ? btrfs_tree_lock+0x85/0x2f0 [btrfs] [ 4079.405431] [<ffffffff81053680>] ? wake_up_atomic_t+0x30/0x30 [ 4079.411955] [<ffffffffa06876fb>] ? btrfs_lock_root_node+0x2b/0x40 [btrfs] [ 4079.419644] [<ffffffffa068ce83>] ? btrfs_search_slot+0xa03/0xb10 [btrfs] [ 4079.427237] [<ffffffffa06aba52>] ? btrfs_buffer_uptodate+0x52/0x70 [btrfs] [ 4079.435041] [<ffffffffa0689b60>] ? generic_bin_search.constprop.38+0x80/0x190 [btrfs] [ 4079.443897] [<ffffffffa068ea44>] ? btrfs_insert_empty_items+0x74/0xd0 [btrfs] [ 4079.451975] [<ffffffffa072c443>] ? copy_items+0x128/0x850 [btrfs] [ 4079.458890] [<ffffffffa072da10>] ? btrfs_log_inode+0x629/0xbf3 [btrfs] [ 4079.466292] [<ffffffffa06f34a1>] ? btrfs_log_inode_parent+0xc61/0xf30 [btrfs] [ 4079.474373] [<ffffffffa06f45a9>] ? btrfs_log_dentry_safe+0x59/0x80 [btrfs] [ 4079.482161] [<ffffffffa06c298d>] ? btrfs_sync_file+0x20d/0x330 [btrfs] [ 4079.489558] [<ffffffff8112777c>] ? do_fsync+0x4c/0x80 [ 4079.495300] [<ffffffff81127a0a>] ? SyS_fdatasync+0xa/0x10 [ 4079.501422] [<ffffffff814a9b72>] ? system_call_fastpath+0x16/0x1b
[ 4079.508334] user-space-program D ffff88107fc30640 0 32021 1 0x00000004 [ 4079.516226] ffff880eae8efbf8 0000000000000086 0000000000009000 ffff880eae8effd8 [ 4079.524513] ffff880eae8effd8 ffff881030279610 ffffffffa06ecb26 ffff88101a5d6138 [ 4079.532802] ffff880ebb671d88 ffff880eae8efc20 ffff880ebb671de8 ffff881030279610 [ 4079.541092] Call Trace: [ 4079.550642] [<ffffffffa06ed595>] ? btrfs_tree_lock+0x85/0x2f0 [btrfs] [ 4079.557941] [<ffffffff81053680>] ? wake_up_atomic_t+0x30/0x30 [ 4079.564463] [<ffffffffa068cc1f>] ? btrfs_search_slot+0x79f/0xb10 [btrfs] [ 4079.572058] [<ffffffffa06bb7d8>] ? btrfs_truncate_inode_items+0x168/0xb90 [btrfs] [ 4079.580526] [<ffffffffa06b04be>] ? join_transaction.isra.15+0x1e/0x3a0 [btrfs] [ 4079.588701] [<ffffffffa06b206d>] ? start_transaction+0x8d/0x470 [btrfs] [ 4079.596196] [<ffffffffa0690ac6>] ? block_rsv_add_bytes+0x16/0x50 [btrfs] [ 4079.603789] [<ffffffffa06bc2e9>] ? btrfs_truncate+0xe9/0x2e0 [btrfs] [ 4079.610994] [<ffffffffa06bd00b>] ? btrfs_setattr+0x30b/0x410 [btrfs] [ 4079.618197] [<ffffffff81117c1c>] ? notify_change+0x1dc/0x680 [ 4079.624625] [<ffffffff8123c8a4>] ? aa_path_perm+0xd4/0x160 [ 4079.630854] [<ffffffff810f4fcb>] ? do_truncate+0x5b/0x90 [ 4079.636889] [<ffffffff810f59fa>] ? do_sys_ftruncate.constprop.15+0x10a/0x160 [ 4079.644869] [<ffffffff8110d87b>] ? SyS_fcntl+0x5b/0x570 [ 4079.650805] [<ffffffff814a9b72>] ? system_call_fastpath+0x16/0x1b
[ 4080.410607] user-space-program D ffff88107fc70640 0 32028 12639 0x00000004 [ 4080.418489] ffff880eaeccbbe0 0000000000000086 0000000000009000 ffff880eaeccbfd8 [ 4080.426778] ffff880eaeccbfd8 ffff880f317ef1e0 ffffffffa06ecb26 ffff88101a5d6138 [ 4080.435067] ffff880ef7e93928 ffff880f317ef1e0 ffff880eaeccbc08 ffff880f317ef1e0 [ 4080.443353] Call Trace: [ 4080.452920] [<ffffffffa06ed15d>] ? btrfs_tree_read_lock+0xdd/0x190 [btrfs] [ 4080.460703] [<ffffffff81053680>] ? wake_up_atomic_t+0x30/0x30 [ 4080.467225] [<ffffffffa06876bb>] ? btrfs_read_lock_root_node+0x2b/0x40 [btrfs] [ 4080.475400] [<ffffffffa068cc81>] ? btrfs_search_slot+0x801/0xb10 [btrfs] [ 4080.482994] [<ffffffffa06b2df0>] ? btrfs_clean_one_deleted_snapshot+0xe0/0xe0 [btrfs] [ 4080.491857] [<ffffffffa06a70a6>] ? btrfs_lookup_inode+0x26/0x90 [btrfs] [ 4080.499353] [<ffffffff810ec42f>] ? kmem_cache_alloc+0xaf/0xc0 [ 4080.505879] [<ffffffffa06bd905>] ? btrfs_iget+0xd5/0x5d0 [btrfs] [ 4080.512696] [<ffffffffa06caf04>] ? btrfs_get_token_64+0x104/0x120 [btrfs] [ 4080.520387] [<ffffffffa06f341f>] ? btrfs_log_inode_parent+0xbdf/0xf30 [btrfs] [ 4080.528469] [<ffffffffa06f45a9>] ? btrfs_log_dentry_safe+0x59/0x80 [btrfs] [ 4080.536258] [<ffffffffa06c298d>] ? btrfs_sync_file+0x20d/0x330 [btrfs] [ 4080.543657] [<ffffffff8112777c>] ? do_fsync+0x4c/0x80 [ 4080.549399] [<ffffffff81127a0a>] ? SyS_fdatasync+0xa/0x10 [ 4080.555534] [<ffffffff814a9b72>] ? system_call_fastpath+0x16/0x1b
--- fs/btrfs/tree-log.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
fs/btrfs/tree-log.c +2 -2
@@ -5205,6 +5205,7 @@ process_leaf:if (di_key.type ==BTRFS_ROOT_ITEM_KEY )continue ; +btrfs_release_path (path); di_inode =btrfs_iget (root->fs_info->sb, &di_key, root,NULL );if (IS_ERR (di_inode)) {
@@ -5214,13 +5215,12 @@ process_leaf:if (btrfs_inode_in_log (di_inode, trans->transid)) {iput (di_inode); -continue ; +break ; } ctx->log_new_dentries = false;if (type ==BTRFS_FT_DIR || type ==BTRFS_FT_SYMLINK ) log_mode =LOG_INODE_ALL ; -btrfs_release_path (path); ret =btrfs_log_inode (trans, root, di_inode, log_mode,0 ,LLONG_MAX , ctx); if (!ret &&
Greg Kroah-Hartman
maintainerPATCH 5/85 Btrfs: fix tree search logic when replaying directory entry deletes
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Robbie Ko <[email protected]>
commit 2a7bf53f577e49c43de4ffa7776056de26db65d9 upstream.
If a log tree has a layout like the following:
leaf N:
...
item 240 key (282 DIR_LOG_ITEM 0) itemoff 8189 itemsize 8
dir log end 1275809046
leaf N + 1:
item 0 key (282 DIR_LOG_ITEM 3936149215) itemoff 16275 itemsize 8
dir log end 18446744073709551615
...When we pass the value 1275809046 + 1 as the parameter start_ret to the function tree-log.c:find_dir_range() (done by replay_dir_deletes()), we end up with path->slots[0] having the value 239 (points to the last item of leaf N, item 240). Because the dir log item in that position has an offset value smaller than *start_ret (1275809046 + 1) we need to move on to the next leaf, however the logic for that is wrong since it compares the current slot to the number of items in the leaf, which is smaller and therefore we don't lookup for the next leaf but instead we set the slot to point to an item that does not exist, at slot 240, and we later operate on that slot which has unexpected content or in the worst case can result in an invalid memory access (accessing beyond the last page of leaf N's extent buffer).
So fix the logic that checks when we need to lookup at the next leaf by first incrementing the slot and only after to check if that slot is beyond the last item of the current leaf.
--- fs/btrfs/tree-log.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
fs/btrfs/tree-log.c +1 -2
@@ -1940,12 +1940,11 @@ static noinline int find_dir_range(struc next:/* check the next slot in the tree to see if it is a valid item */ nritems =btrfs_header_nritems (path->nodes[0 ]); + path->slots[0 ]++;if (path->slots[0 ] >= nritems) { ret =btrfs_next_leaf (root, path);if (ret) goto out; - }else { - path->slots[0 ]++; }btrfs_item_key_to_cpu (path->nodes[0 ], &key, path->slots[0 ]);
Greg Kroah-Hartman
maintainerPATCH 6/85 Btrfs: fix relocation incorrectly dropping data references
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit 054570a1dc94de20e7a612cddcc5a97db9c37b6f upstream.
During relocation of a data block group we create a relocation tree for each fs/subvol tree by making a snapshot of each tree using btrfs_copy_root() and the tree's commit root, and then setting the last snapshot field for the fs/subvol tree's root to the value of the current transaction id minus 1. However this can lead to relocation later dropping references that it did not create if we have qgroups enabled, leaving the filesystem in an inconsistent state that keeps aborting transactions.
Lets consider the following example to explain the problem, which requires qgroups to be enabled.
We are relocating data block group Y, we have a subvolume with id 258 that has a root at level 1, that subvolume is used to store directory entries for snapshots and we are currently at transaction 3404.
When committing transaction 3404, we have a pending snapshot and therefore we call btrfs_run_delayed_items() at transaction.c:create_pending_snapshot() in order to create its dentry at subvolume 258. This results in COWing leaf A from root 258 in order to add the dentry. Note that leaf A also contains file extent items referring to extents from some other block group X (we are currently relocating block group Y). Later on, still at create_pending_snapshot() we call qgroup_account_snapshot(), which switches the commit root for root 258 when it calls switch_commit_roots(), so now the COWed version of leaf A, lets call it leaf A', is accessible from the commit root of tree 258. At the end of qgroup_account_snapshot(), we call record_root_in_trans() with 258 as its argument, which results in btrfs_init_reloc_root() being called, which in turn calls relocation.c:create_reloc_root() in order to create a relocation tree associated to root 258, which results in assigning the value of 3403 (which is the current transaction id minus 1 = 3404 - 1) to the last_snapshot field of root 258. When creating the relocation tree root at ctree.c:btrfs_copy_root() we add a shared reference for leaf A', corresponding to the relocation tree's root, when we call btrfs_inc_ref() against the COWed root (a copy of the commit root from tree 258), which is at level 1. So at this point leaf A' has 2 references, one normal reference corresponding to root 258 and one shared reference corresponding to the root of the relocation tree.
Transaction 3404 finishes its commit and transaction 3405 is started by relocation when calling merge_reloc_root() for the relocation tree associated to root 258. In the meanwhile leaf A' is COWed again, in response to some filesystem operation, when we are still at transaction 3405. However when we COW leaf A', at ctree.c:update_ref_for_cow(), we call btrfs_block_can_be_shared() in order to figure out if other trees refer to the leaf and if any such trees exists, add a full back reference to leaf A' - but btrfs_block_can_be_shared() incorrectly returns false because the following condition is false:
btrfs_header_generation(buf) <= btrfs_root_last_snapshot(&root->root_item)
which evaluates to 3404 <= 3403. So after leaf A' is COWed, it stays with only one reference, corresponding to the shared reference we created when we called btrfs_copy_root() to create the relocation tree's root and btrfs_inc_ref() ends up not being called for leaf A' nor we end up setting the flag BTRFS_BLOCK_FLAG_FULL_BACKREF in leaf A'. This results in not adding shared references for the extents from block group X that leaf A' refers to with its file extent items.
Later, after merging the relocation root we do a call to to btrfs_drop_snapshot() in order to delete the relocation tree. This ends up calling do_walk_down() when path->slots[1] points to leaf A', which results in calling btrfs_lookup_extent_info() to get the number of references for leaf A', which is 1 at this time (only the shared reference exists) and this value is stored at wc->refs[0]. After this walk_up_proc() is called when wc->level is 0 and path->nodes[0] corresponds to leaf A'. Because the current level is 0 and wc->refs[0] is 1, it does call btrfs_dec_ref() against leaf A', which results in removing the single references that the extents from block group X have which are associated to root 258 - the expectation was to have each of these extents with 2 references - one reference for root 258 and one shared reference related to the root of the relocation tree, and so we would drop only the shared reference (because leaf A' was supposed to have the flag BTRFS_BLOCK_FLAG_FULL_BACKREF set).
This leaves the filesystem in an inconsistent state as we now have file extent items in a subvolume tree that point to extents from block group X without references in the extent tree. So later on when we try to decrement the references for these extents, for example due to a file unlink operation, truncate operation or overwriting ranges of a file, we fail because the expected references do not exist in the extent tree.
This leads to warnings and transaction aborts like the following:
[ 588.965795] ------------[ cut here ]------------ [ 588.965815] WARNING: CPU: 2 PID: 2479 at fs/btrfs/extent-tree.c:1625 lookup_inline_extent_backref+0x432/0x5b0 [btrfs] [ 588.965816] Modules linked in: af_packet iscsi_ibft iscsi_boot_sysfs xfs libcrc32c ppdev acpi_cpufreq button tpm_tis e1000 i2c_piix4 pcspkr parport_pc parport tpm qemu_fw_cfg joydev btrfs xor raid6_pq sr_mod cdrom ata_generic virtio_scsi ata_piix virtio_pci bochs_drm virtio_ring drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops virtio ttm serio_raw drm floppy sg [ 588.965831] CPU: 2 PID: 2479 Comm: kworker/u8:7 Not tainted 4.7.3-3-default-fdm+ #1 [ 588.965832] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.1-0-gb3ef39f-prebuilt.qemu-project.org 04/01/2014 [ 588.965844] Workqueue: btrfs-extent-refs btrfs_extent_refs_helper [btrfs] [ 588.965845] 0000000000000000 ffff8802263bfa28 ffffffff813af542 0000000000000000 [ 588.965847] 0000000000000000 ffff8802263bfa68 ffffffff81081e8b 0000065900000000 [ 588.965848] ffff8801db2af000 000000012bbe2000 0000000000000000 ffff880215703b48 [ 588.965849] Call Trace: [ 588.965852] [<ffffffff813af542>] dump_stack+0x63/0x81 [ 588.965854] [<ffffffff81081e8b>] __warn+0xcb/0xf0 [ 588.965855] [<ffffffff81081f7d>] warn_slowpath_null+0x1d/0x20 [ 588.965863] [<ffffffffa0175042>] lookup_inline_extent_backref+0x432/0x5b0 [btrfs] [ 588.965865] [<ffffffff81143220>] ? trace_clock_local+0x10/0x30 [ 588.965867] [<ffffffff8114c5df>] ? rb_reserve_next_event+0x6f/0x460 [ 588.965875] [<ffffffffa0175215>] insert_inline_extent_backref+0x55/0xd0 [btrfs] [ 588.965882] [<ffffffffa017531f>] __btrfs_inc_extent_ref.isra.55+0x8f/0x240 [btrfs] [ 588.965890] [<ffffffffa017acea>] __btrfs_run_delayed_refs+0x74a/0x1260 [btrfs] [ 588.965892] [<ffffffff810cb046>] ? cpuacct_charge+0x86/0xa0 [ 588.965900] [<ffffffffa017e74f>] btrfs_run_delayed_refs+0x9f/0x2c0 [btrfs] [ 588.965908] [<ffffffffa017ea04>] delayed_ref_async_start+0x94/0xb0 [btrfs] [ 588.965918] [<ffffffffa01c799a>] btrfs_scrubparity_helper+0xca/0x350 [btrfs] [ 588.965928] [<ffffffffa01c7c5e>] btrfs_extent_refs_helper+0xe/0x10 [btrfs] [ 588.965930] [<ffffffff8109b323>] process_one_work+0x1f3/0x4e0 [ 588.965931] [<ffffffff8109b658>] worker_thread+0x48/0x4e0 [ 588.965932] [<ffffffff8109b610>] ? process_one_work+0x4e0/0x4e0 [ 588.965934] [<ffffffff810a1659>] kthread+0xc9/0xe0 [ 588.965936] [<ffffffff816f2f1f>] ret_from_fork+0x1f/0x40 [ 588.965937] [<ffffffff810a1590>] ? kthread_worker_fn+0x170/0x170 [ 588.965938] ---[ end trace 34e5232c933a1749 ]--- [ 588.966187] ------------[ cut here ]------------ [ 588.966196] WARNING: CPU: 2 PID: 2479 at fs/btrfs/extent-tree.c:2966 btrfs_run_delayed_refs+0x28c/0x2c0 [btrfs] [ 588.966196] BTRFS: Transaction aborted (error -5) [ 588.966197] Modules linked in: af_packet iscsi_ibft iscsi_boot_sysfs xfs libcrc32c ppdev acpi_cpufreq button tpm_tis e1000 i2c_piix4 pcspkr parport_pc parport tpm qemu_fw_cfg joydev btrfs xor raid6_pq sr_mod cdrom ata_generic virtio_scsi ata_piix virtio_pci bochs_drm virtio_ring drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops virtio ttm serio_raw drm floppy sg [ 588.966206] CPU: 2 PID: 2479 Comm: kworker/u8:7 Tainted: G W 4.7.3-3-default-fdm+ #1 [ 588.966207] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.1-0-gb3ef39f-prebuilt.qemu-project.org 04/01/2014 [ 588.966217] Workqueue: btrfs-extent-refs btrfs_extent_refs_helper [btrfs] [ 588.966217] 0000000000000000 ffff8802263bfc98 ffffffff813af542 ffff8802263bfce8 [ 588.966219] 0000000000000000 ffff8802263bfcd8 ffffffff81081e8b 00000b96345ee000 [ 588.966220] ffffffffa021ae1c ffff880215703b48 00000000000005fe ffff8802345ee000 [ 588.966221] Call Trace: [ 588.966223] [<ffffffff813af542>] dump_stack+0x63/0x81 [ 588.966224] [<ffffffff81081e8b>] __warn+0xcb/0xf0 [ 588.966225] [<ffffffff81081eff>] warn_slowpath_fmt+0x4f/0x60 [ 588.966233] [<ffffffffa017e93c>] btrfs_run_delayed_refs+0x28c/0x2c0 [btrfs] [ 588.966241] [<ffffffffa017ea04>] delayed_ref_async_start+0x94/0xb0 [btrfs] [ 588.966250] [<ffffffffa01c799a>] btrfs_scrubparity_helper+0xca/0x350 [btrfs] [ 588.966259] [<ffffffffa01c7c5e>] btrfs_extent_refs_helper+0xe/0x10 [btrfs] [ 588.966260] [<ffffffff8109b323>] process_one_work+0x1f3/0x4e0 [ 588.966261] [<ffffffff8109b658>] worker_thread+0x48/0x4e0 [ 588.966263] [<ffffffff8109b610>] ? process_one_work+0x4e0/0x4e0 [ 588.966264] [<ffffffff810a1659>] kthread+0xc9/0xe0 [ 588.966265] [<ffffffff816f2f1f>] ret_from_fork+0x1f/0x40 [ 588.966267] [<ffffffff810a1590>] ? kthread_worker_fn+0x170/0x170 [ 588.966268] ---[ end trace 34e5232c933a174a ]--- [ 588.966269] BTRFS: error (device sda2) in btrfs_run_delayed_refs:2966: errno=-5 IO failure [ 588.966270] BTRFS info (device sda2): forced readonly
This was happening often on openSUSE and SLE systems using btrfs as the root filesystem (with its default layout where multiple subvolumes are used) where balance happens in the background triggered by a cron job and snapshots are automatically created before/after package installations, upgrades and removals. The issue could be triggered simply by running the following loop on the first system boot post installation:
while true; do
zypper -n in nfs-kernel-server
zypper -n rm nfs-kernel-server
done
(If we were fast enough and made that loop before the cron job triggered a balance operation and the balance finished)
So fix by setting the last_snapshot field of the root to the value of the generation of its commit root. Like this btrfs_block_can_be_shared() behaves correctly for the case where the relocation root is created during a transaction commit and for the case where it's created before a transaction commit.
--- fs/btrfs/relocation.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-)
fs/btrfs/relocation.c +12 -3
@@ -1387,14 +1387,23 @@ static struct btrfs_root *create_reloc_r root_key.offset = objectid;if (root->root_key.objectid == objectid) { +u64 commit_root_gen; +/* called by btrfs_init_reloc_root */ ret =btrfs_copy_root (trans, root, root->commit_root, &eb,BTRFS_TREE_RELOC_OBJECTID );BUG_ON (ret); - last_snap =btrfs_root_last_snapshot (&root->root_item); -btrfs_set_root_last_snapshot (&root->root_item, - trans->transid -1 ); +/* +* Set the last_snapshot field to the generation of the commit +* root - like this ctree.c:btrfs_block_can_be_shared() behaves +* correctly (returns true) when the relocation root is created +* either inside the critical section of a transaction commit +* (through transaction.c:qgroup_account_snapshot()) and when +* it's created before the transaction commit is started. +*/ + commit_root_gen =btrfs_header_generation (root->commit_root); +btrfs_set_root_last_snapshot (&root->root_item, commit_root_gen); }else {/* * called by btrfs_reloc_post_snapshot_hook.
Greg Kroah-Hartman
maintainerPATCH 7/85 btrfs: store and load values of stripes_min/stripes_max in balance status item
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: David Sterba <[email protected]>
commit ed0df618b1b06d7431ee4d985317fc5419a5d559 upstream.
The balance status item contains currently known filter values, but the stripes filter was unintentionally not among them. This would mean, that interrupted and automatically restarted balance does not apply the stripe filters.
--- fs/btrfs/ctree.h | 4 ++++ 1 file changed, 4 insertions(+)
fs/btrfs/ctree.h +4 -0
@@ -2210,6 +2210,8 @@ btrfs_disk_balance_args_to_cpu(struct bt cpu->target =le64_to_cpu (disk->target); cpu->flags =le64_to_cpu (disk->flags); cpu->limit =le64_to_cpu (disk->limit); + cpu->stripes_min =le32_to_cpu (disk->stripes_min); + cpu->stripes_max =le32_to_cpu (disk->stripes_max); } static inline void
@@ -2228,6 +2230,8 @@ btrfs_cpu_balance_args_to_disk(struct bt disk->target =cpu_to_le64 (cpu->target); disk->flags =cpu_to_le64 (cpu->flags); disk->limit =cpu_to_le64 (cpu->limit); + disk->stripes_min =cpu_to_le32 (cpu->stripes_min); + disk->stripes_max =cpu_to_le32 (cpu->stripes_max); }/* struct btrfs_super_block */
Greg Kroah-Hartman
maintainerPATCH 8/85 Btrfs: fix emptiness check for dirtied extent buffers at check_leaf()
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit f177d73949bf758542ca15a1c1945bd2e802cc65 upstream.
We can not simply use the owner field from an extent buffer's header to get the id of the respective tree when the extent buffer is from a relocation tree. When we create the root for a relocation tree we leave (on purpose) the owner field with the same value as the subvolume's tree root (we do this at ctree.c:btrfs_copy_root()). So we must ignore extent buffers from relocation trees, which have the BTRFS_HEADER_FLAG_RELOC flag set, because otherwise we will always consider the extent buffer as not being the root of the tree (the root of original subvolume tree is always different from the root of the respective relocation tree).
This lead to assertion failures when running with the integrity checker enabled (CONFIG_BTRFS_FS_CHECK_INTEGRITY=y) such as the following:
[ 643.393409] BTRFS critical (device sdg): corrupt leaf, non-root leaf's nritems is 0: block=38506496, root=260, slot=0 [ 643.397609] BTRFS info (device sdg): leaf 38506496 total ptrs 0 free space 3995 [ 643.407075] assertion failed: 0, file: fs/btrfs/disk-io.c, line: 4078 [ 643.408425] ------------[ cut here ]------------ [ 643.409112] kernel BUG at fs/btrfs/ctree.h:3419! [ 643.409773] invalid opcode: 0000 [#1] PREEMPT SMP [ 643.410447] Modules linked in: dm_flakey dm_mod crc32c_generic btrfs xor raid6_pq ppdev psmouse acpi_cpufreq parport_pc evdev parport tpm_tis tpm_tis_core pcspkr serio_raw i2c_piix4 sg tpm i2c_core button processor loop autofs4 ext4 crc16 jbd2 mbcache sr_mod cdrom sd_mod ata_generic virtio_scsi ata_piix libata virtio_pci virtio_ring scsi_mod virtio e1000 floppy [ 643.414356] CPU: 11 PID: 32726 Comm: btrfs Not tainted 4.8.0-rc8-btrfs-next-35+ #1 [ 643.414356] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.1-0-gb3ef39f-prebuilt.qemu-project.org 04/01/2014 [ 643.414356] task: ffff880145e95b00 task.stack: ffff88014826c000 [ 643.414356] RIP: 0010:[<ffffffffa0352759>] [<ffffffffa0352759>] assfail.constprop.41+0x1c/0x1e [btrfs] [ 643.414356] RSP: 0018:ffff88014826fa28 EFLAGS: 00010292 [ 643.414356] RAX: 0000000000000039 RBX: ffff88014e2d7c38 RCX: 0000000000000001 [ 643.414356] RDX: ffff88023f4d2f58 RSI: ffffffff81806c63 RDI: 00000000ffffffff [ 643.414356] RBP: ffff88014826fa28 R08: 0000000000000001 R09: 0000000000000000 [ 643.414356] R10: ffff88014826f918 R11: ffffffff82f3c5ed R12: ffff880172910000 [ 643.414356] R13: ffff880233992230 R14: ffff8801a68a3310 R15: fffffffffffffff8 [ 643.414356] FS: 00007f9ca305e8c0(0000) GS:ffff88023f4c0000(0000) knlGS:0000000000000000 [ 643.414356] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 643.414356] CR2: 00007f9ca3071000 CR3: 000000015d01b000 CR4: 00000000000006e0 [ 643.414356] Stack: [ 643.414356] ffff88014826fa50 ffffffffa02d655a 000000000000000a ffff88014e2d7c38 [ 643.414356] 0000000000000000 ffff88014826faa8 ffffffffa02b72f3 ffff88014826fab8 [ 643.414356] 00ffffffa03228e4 0000000000000000 0000000000000000 ffff8801bbd4e000 [ 643.414356] Call Trace: [ 643.414356] [<ffffffffa02d655a>] btrfs_mark_buffer_dirty+0xdf/0xe5 [btrfs] [ 643.414356] [<ffffffffa02b72f3>] btrfs_copy_root+0x18a/0x1d1 [btrfs] [ 643.414356] [<ffffffffa0322921>] create_reloc_root+0x72/0x1ba [btrfs] [ 643.414356] [<ffffffffa03267c2>] btrfs_init_reloc_root+0x7b/0xa7 [btrfs] [ 643.414356] [<ffffffffa02d9e44>] record_root_in_trans+0xdf/0xed [btrfs] [ 643.414356] [<ffffffffa02db04e>] btrfs_record_root_in_trans+0x50/0x6a [btrfs] [ 643.414356] [<ffffffffa030ad2b>] create_subvol+0x472/0x773 [btrfs] [ 643.414356] [<ffffffffa030b406>] btrfs_mksubvol+0x3da/0x463 [btrfs] [ 643.414356] [<ffffffffa030b406>] ? btrfs_mksubvol+0x3da/0x463 [btrfs] [ 643.414356] [<ffffffff810781ac>] ? preempt_count_add+0x65/0x68 [ 643.414356] [<ffffffff811a6e97>] ? __mnt_want_write+0x62/0x77 [ 643.414356] [<ffffffffa030b55d>] btrfs_ioctl_snap_create_transid+0xce/0x187 [btrfs] [ 643.414356] [<ffffffffa030b67d>] btrfs_ioctl_snap_create+0x67/0x81 [btrfs] [ 643.414356] [<ffffffffa030ecfd>] btrfs_ioctl+0x508/0x20dd [btrfs] [ 643.414356] [<ffffffff81293e39>] ? __this_cpu_preempt_check+0x13/0x15 [ 643.414356] [<ffffffff81155eca>] ? handle_mm_fault+0x976/0x9ab [ 643.414356] [<ffffffff81091300>] ? arch_local_irq_save+0x9/0xc [ 643.414356] [<ffffffff8119a2b0>] vfs_ioctl+0x18/0x34 [ 643.414356] [<ffffffff8119a8e8>] do_vfs_ioctl+0x581/0x600 [ 643.414356] [<ffffffff814b9552>] ? entry_SYSCALL_64_fastpath+0x5/0xa8 [ 643.414356] [<ffffffff81093fe9>] ? trace_hardirqs_on_caller+0x17b/0x197 [ 643.414356] [<ffffffff8119a9be>] SyS_ioctl+0x57/0x79 [ 643.414356] [<ffffffff814b9565>] entry_SYSCALL_64_fastpath+0x18/0xa8 [ 643.414356] [<ffffffff81091b08>] ? trace_hardirqs_off_caller+0x3f/0xaa [ 643.414356] Code: 89 83 88 00 00 00 31 c0 5b 41 5c 41 5d 5d c3 55 89 f1 48 c7 c2 98 bc 35 a0 48 89 fe 48 c7 c7 05 be 35 a0 48 89 e5 e8 13 46 dd e0 <0f> 0b 55 89 f1 48 c7 c2 9f d3 35 a0 48 89 fe 48 c7 c7 7a d5 35 [ 643.414356] RIP [<ffffffffa0352759>] assfail.constprop.41+0x1c/0x1e [btrfs] [ 643.414356] RSP <ffff88014826fa28> [ 643.468267] ---[ end trace 6a1b3fb1a9d7d6e3 ]---
This can be easily reproduced by running xfstests with the integrity checker enabled.
--- fs/btrfs/disk-io.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)
fs/btrfs/disk-io.c +12 -1
@@ -559,7 +559,15 @@ static noinline int check_leaf(struct btu32 nritems =btrfs_header_nritems (leaf);int slot; -if (nritems ==0 ) { +/* +* Extent buffers from a relocation tree have a owner field that +* corresponds to the subvolume tree they are based on. So just from an +* extent buffer alone we can not find out what is the id of the +* corresponding subvolume tree, so we can not figure out if the extent +* buffer corresponds to the root of the relocation tree or not. So skip +* this check for relocation trees. +*/ +if (nritems ==0 && !btrfs_header_flag (leaf,BTRFS_HEADER_FLAG_RELOC )) {struct btrfs_root *check_root; key.objectid =btrfs_header_owner (leaf);
@@ -587,6 +595,9 @@ static noinline int check_leaf(struct btreturn 0 ; } +if (nritems ==0 ) +return 0 ; +/* Check the 0 item */ if (btrfs_item_offset_nr (leaf,0 ) +btrfs_item_size_nr (leaf,0 ) !=BTRFS_LEAF_DATA_SIZE (root)) {
Greg Kroah-Hartman
maintainerPATCH 9/85 Btrfs: fix qgroup rescan worker initialization
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit 8d9eddad19467b008e0c881bc3133d7da94b7ec1 upstream.
We were setting the qgroup_rescan_running flag to true only after the rescan worker started (which is a task run by a queue). So if a user space task starts a rescan and immediately after asks to wait for the rescan worker to finish, this second call might happen before the rescan worker task starts running, in which case the rescan wait ioctl returns immediatley, not waiting for the rescan worker to finish.
This was making the fstest btrfs/022 fail very often.
--- fs/btrfs/qgroup.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-)
fs/btrfs/qgroup.c +1 -4
@@ -2332,10 +2332,6 @@ static void btrfs_qgroup_rescan_worker(sint err = -ENOMEM ;int ret =0 ; -mutex_lock (&fs_info->qgroup_rescan_lock); - fs_info->qgroup_rescan_running = true; -mutex_unlock (&fs_info->qgroup_rescan_lock); - path =btrfs_alloc_path ();if (!path) goto out;
@@ -2446,6 +2442,7 @@ qgroup_rescan_init(struct btrfs_fs_info sizeof(fs_info->qgroup_rescan_progress)); fs_info->qgroup_rescan_progress.objectid = progress_objectid;init_completion (&fs_info->qgroup_rescan_completion); + fs_info->qgroup_rescan_running = true;spin_unlock (&fs_info->qgroup_lock);mutex_unlock (&fs_info->qgroup_rescan_lock);
Greg Kroah-Hartman
maintainerPATCH 10/85 USB: serial: option: add support for Telit LE922A PIDs 0x1040, 0x1041
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Daniele Palmas <[email protected]>
commit 5b09eff0c379002527ad72ea5ea38f25da8a8650 upstream.
This patch adds support for PIDs 0x1040, 0x1041 of Telit LE922A.
Since the interface positions are the same than the ones used for other Telit compositions, previous defined blacklists are used.
--- drivers/usb/serial/option.c | 6 ++++++ 1 file changed, 6 insertions(+)
drivers/usb/serial/option.c +6 -0
@@ -268,6 +268,8 @@ static void option_instat_callback(struc#define TELIT_PRODUCT_CC864_SINGLE 0x1006#define TELIT_PRODUCT_DE910_DUAL 0x1010#define TELIT_PRODUCT_UE910_V2 0x1012 +#define TELIT_PRODUCT_LE922_USBCFG1 0x1040 +#define TELIT_PRODUCT_LE922_USBCFG2 0x1041#define TELIT_PRODUCT_LE922_USBCFG0 0x1042#define TELIT_PRODUCT_LE922_USBCFG3 0x1043#define TELIT_PRODUCT_LE922_USBCFG5 0x1045
@@ -1210,6 +1212,10 @@ static const struct usb_device_id option { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG0), .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG1), + .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG2), + .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG3), .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff),
Greg Kroah-Hartman
maintainerPATCH 11/85 USB: serial: option: add dlink dwm-158
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Giuseppe Lippolis <[email protected]>
commit d8a12b7117b42fd708f1e908498350232bdbd5ff upstream.
Adding registration for 3G modem DWM-158 in usb-serial-option
--- drivers/usb/serial/option.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/serial/option.c +1 -0
@@ -1995,6 +1995,7 @@ static const struct usb_device_id option { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d02, 0xff, 0x00, 0x00) }, { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) }, { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) }, + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) }, /* D-Link DWM-158 */ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
Greg Kroah-Hartman
maintainerPATCH 12/85 USB: serial: kl5kusb105: fix open error path
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Johan Hovold <[email protected]>
commit 6774d5f53271d5f60464f824748995b71da401ab upstream.
Kill urbs and disable read before returning from open on failure to retrieve the line state.
--- drivers/usb/serial/kl5kusb105.c | 33 ++++++++++++++++++++++++--------- 1 file changed, 24 insertions(+), 9 deletions(-)
drivers/usb/serial/kl5kusb105.c +24 -9
@@ -296,7 +296,7 @@ static int klsi_105_open(struct tty_str rc =usb_serial_generic_open (tty, port);if (rc) { retval = rc; - goto exit; + goto err_free_cfg; } rc = usb_control_msg(port->serial->dev,
@@ -315,17 +315,32 @@ static int klsi_105_open(struct tty_strdev_dbg (&port->dev,"%s - enabled reading\n" , __func__); rc =klsi_105_get_line_state (port, &line_state); -if (rc >=0 ) { -spin_lock_irqsave (&priv->lock, flags); - priv->line_state = line_state; -spin_unlock_irqrestore (&priv->lock, flags); -dev_dbg (&port->dev,"%s - read line state 0x%lx\n" , __func__, line_state); - retval =0 ; - }else +if (rc <0 ) { retval = rc; + goto err_disable_read; + } + +spin_lock_irqsave (&priv->lock, flags); + priv->line_state = line_state; +spin_unlock_irqrestore (&priv->lock, flags); +dev_dbg (&port->dev,"%s - read line state 0x%lx\n" , __func__, + line_state); + +return 0 ; -exit: +err_disable_read: +usb_control_msg (port->serial->dev, +usb_sndctrlpipe (port->serial->dev,0 ), +KL5KUSB105A_SIO_CONFIGURE , +USB_TYPE_VENDOR |USB_DIR_OUT , +KL5KUSB105A_SIO_CONFIGURE_READ_OFF , +0 ,/* index */ +NULL ,0 , +KLSI_TIMEOUT ); +usb_serial_generic_close (port); +err_free_cfg:kfree (cfg); +return retval; }
Greg Kroah-Hartman
maintainerPATCH 13/85 USB: cdc-acm: add device id for GW Instek AFG-125
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nathaniel Quillin <[email protected]>
commit 301216044e4c27d5a7323c1fa766266fad00db5e upstream.
Add device-id entry for GW Instek AFG-125, which has a byte swapped bInterfaceSubClass (0x20).
--- drivers/usb/class/cdc-acm.c | 1 + 1 file changed, 1 insertion(+)
drivers/usb/class/cdc-acm.c +1 -0
@@ -1732,6 +1732,7 @@ static const struct usb_device_id acm_id { USB_DEVICE(0x20df, 0x0001), /* Simtec Electronics Entropy Key */ .driver_info = QUIRK_CONTROL_LINE_STATE, }, { USB_DEVICE(0x2184, 0x001c) }, /* GW Instek AFG-2225 */ + { USB_DEVICE(0x2184, 0x0036) }, /* GW Instek AFG-125 */ { USB_DEVICE(0x22b8, 0x6425), /* Motorola MOTOMAGX phones */ },/* Motorola H24 HSPA module: */
Greg Kroah-Hartman
maintainerPATCH 14/85 usb: dwc3: gadget: set PCM1 field of isochronous-first TRBs
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit 6b9018d4c1e5c958625be94a160a5984351d4632 upstream.
In case of High-Speed, High-Bandwidth endpoints, we need to tell DWC3 that we have more than one packet per interval. We do that by setting PCM1 field of Isochronous-First TRB.
--- drivers/usb/dwc3/gadget.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-)
drivers/usb/dwc3/gadget.c +11 -2
@@ -775,6 +775,9 @@ static void dwc3_prepare_one_trb(struct unsigned length, unsigned last, unsigned chain, unsigned node) { struct dwc3_trb *trb; +struct dwc3 *dwc = dep->dwc; +struct usb_gadget *gadget = &dwc->gadget; +enum usb_device_speed speed = gadget->speed; dwc3_trace(trace_dwc3_gadget, "%s: req %p dma %08llx length %d%s%s", dep->name, req, (unsigned long long) dma,
@@ -804,10 +807,16 @@ static void dwc3_prepare_one_trb(structbreak ;case USB_ENDPOINT_XFER_ISOC : -if (!node) +if (!node) { trb->ctrl =DWC3_TRBCTL_ISOCHRONOUS_FIRST ; -else + +if (speed ==USB_SPEED_HIGH ) { +struct usb_ep *ep = &dep->endpoint; + trb->size |=DWC3_TRB_SIZE_PCM1 (ep->mult -1 ); + } + }else { trb->ctrl =DWC3_TRBCTL_ISOCHRONOUS ; + }/* always enable Interrupt on Missed ISOC */ trb->ctrl |=DWC3_TRB_CTRL_ISP_IMI ;
Greg Kroah-Hartman
maintainerPATCH 15/85 usb: hub: Fix auto-remount of safely removed or ejected USB-3 devices
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mathias Nyman <[email protected]>
commit 37be66767e3cae4fd16e064d8bb7f9f72bf5c045 upstream.
USB-3 does not have any link state that will avoid negotiating a connection with a plugged-in cable but will signal the host when the cable is unplugged.
For USB-3 we used to first set the link to Disabled, then to RxDdetect to be able to detect cable connects or disconnects. But in RxDetect the connected device is detected again and eventually enabled.
Instead set the link into U3 and disable remote wakeups for the device. This is what Windows does, and what Alan Stern suggested.
--- drivers/usb/core/hub.c | 101 +++++++++++++++++-------------------------------- 1 file changed, 36 insertions(+), 65 deletions(-)
drivers/usb/core/hub.c +36 -65
@@ -101,6 +101,8 @@ EXPORT_SYMBOL_GPL(ehci_cf_port_reset_rwsstatic void hub_release (struct kref *kref);static int usb_reset_and_verify_device (struct usb_device *udev); +static void hub_usb3_port_prepare_disable (struct usb_hub *hub, +struct usb_port *port_dev);static inline char *portspeed (struct usb_hub *hub,int portstatus) {
@@ -899,82 +901,28 @@ static int hub_set_port_link_state(struc }/* -* If USB 3.0 ports are placed into the Disabled state, they will no longer -* detect any device connects or disconnects. This is generally not what the -* USB core wants, since it expects a disabled port to produce a port status -* change event when a new device connects. -* -* Instead, set the link state to Disabled, wait for the link to settle into -* that state, clear any change bits, and then put the port into the RxDetect -* state. +* USB-3 does not have a similar link state as USB-2 that will avoid negotiating +* a connection with a plugged-in cable but will signal the host when the cable +* is unplugged. Disable remote wake and set link state to U3 for USB-3 devices */ -static int hub_usb3_port_disable (struct usb_hub *hub,int port1) -{ -int ret; -int total_time; -u16 portchange, portstatus; - -if (!hub_is_superspeed (hub->hdev)) -return -EINVAL ; - - ret =hub_port_status (hub, port1, &portstatus, &portchange); -if (ret <0 ) -return ret; - -/* -* USB controller Advanced Micro Devices, Inc. [AMD] FCH USB XHCI -* Controller [1022:7814] will have spurious result making the following -* usb 3.0 device hotplugging route to the 2.0 root hub and recognized -* as high-speed device if we set the usb 3.0 port link state to -* Disabled. Since it's already in USB_SS_PORT_LS_RX_DETECT state, we -* check the state here to avoid the bug. -*/ -if ((portstatus &USB_PORT_STAT_LINK_STATE ) == -USB_SS_PORT_LS_RX_DETECT ) { -dev_dbg (&hub->ports[port1 -1 ]->dev, -"Not disabling port; link state is RxDetect\n" ); -return ret; - } - - ret =hub_set_port_link_state (hub, port1,USB_SS_PORT_LS_SS_DISABLED ); -if (ret) -return ret; - -/* Wait for the link to enter the disabled state. */ -for (total_time =0 ; ; total_time +=HUB_DEBOUNCE_STEP ) { - ret =hub_port_status (hub, port1, &portstatus, &portchange); -if (ret <0 ) -return ret; - -if ((portstatus &USB_PORT_STAT_LINK_STATE ) == -USB_SS_PORT_LS_SS_DISABLED ) -break ; -if (total_time >=HUB_DEBOUNCE_TIMEOUT ) -break ; -msleep (HUB_DEBOUNCE_STEP ); - } -if (total_time >=HUB_DEBOUNCE_TIMEOUT ) -dev_warn (&hub->ports[port1 -1 ]->dev, -"Could not disable after %d ms\n" , total_time); - -return hub_set_port_link_state (hub, port1,USB_SS_PORT_LS_RX_DETECT ); -} -static int hub_port_disable (struct usb_hub *hub,int port1,int set_state) {struct usb_port *port_dev = hub->ports[port1 -1 ];struct usb_device *hdev = hub->hdev;int ret =0 ; -if (port_dev->child && set_state) -usb_set_device_state (port_dev->child,USB_STATE_NOTATTACHED );if (!hub->error) { -if (hub_is_superspeed (hub->hdev)) - ret =hub_usb3_port_disable (hub, port1); -else +if (hub_is_superspeed (hub->hdev)) { +hub_usb3_port_prepare_disable (hub, port_dev); + ret =hub_set_port_link_state (hub, port_dev->portnum, +USB_SS_PORT_LS_U3 ); + }else { ret =usb_clear_port_feature (hdev, port1,USB_PORT_FEAT_ENABLE ); + } } +if (port_dev->child && set_state) +usb_set_device_state (port_dev->child,USB_STATE_NOTATTACHED );if (ret && ret != -ENODEV )dev_err (&port_dev->dev,"cannot disable (err = %d)\n" , ret);return ret;
@@ -4142,6 +4090,26 @@ void usb_unlocked_enable_lpm(struct usb_ }EXPORT_SYMBOL_GPL (usb_unlocked_enable_lpm); +/* usb3 devices use U3 for disabled, make sure remote wakeup is disabled */ +static void hub_usb3_port_prepare_disable (struct usb_hub *hub, +struct usb_port *port_dev) +{ +struct usb_device *udev = port_dev->child; +int ret; + +if (udev && udev->port_is_suspended && udev->do_remote_wakeup) { + ret =hub_set_port_link_state (hub, port_dev->portnum, +USB_SS_PORT_LS_U0 ); +if (!ret) { +msleep (USB_RESUME_TIMEOUT ); + ret =usb_disable_remote_wakeup (udev); + } +if (ret) +dev_warn (&udev->dev, +"Port disable: can't disable remote wake\n" ); + udev->do_remote_wakeup =0 ; + } +}#else /* CONFIG_PM */
@@ -4149,6 +4117,9 @@ EXPORT_SYMBOL_GPL(usb_unlocked_enable_lp#define hub_resume NULL#define hub_reset_resume NULL +static inline void hub_usb3_port_prepare_disable (struct usb_hub *hub, +struct usb_port *port_dev) { } +int usb_disable_lpm (struct usb_device *udev) {return 0 ;
Greg Kroah-Hartman
maintainerPATCH 16/85 usb: gadget: f_uac2: fix error handling at afunc_bind
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Peter Chen <[email protected]>
commit f1d3861d63a5d79b8968a02eea1dcb01bb684e62 upstream.
The current error handling flow uses incorrect goto label, fix it
--- drivers/usb/gadget/function/f_uac2.c | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-)
drivers/usb/gadget/function/f_uac2.c +7 -7
@@ -1067,13 +1067,13 @@ afunc_bind(struct usb_configuration *cfg agdev->out_ep =usb_ep_autoconfig (gadget, &fs_epout_desc);if (!agdev->out_ep) {dev_err (dev,"%s:%d Error!\n" , __func__, __LINE__); - goto err; +return ret; } agdev->in_ep =usb_ep_autoconfig (gadget, &fs_epin_desc);if (!agdev->in_ep) {dev_err (dev,"%s:%d Error!\n" , __func__, __LINE__); - goto err; +return ret; } uac2->p_prm.uac2 = uac2;
@@ -1091,7 +1091,7 @@ afunc_bind(struct usb_configuration *cfg ret =usb_assign_descriptors (fn, fs_audio_desc, hs_audio_desc,NULL ,NULL );if (ret) - goto err; +return ret; prm = &agdev->uac2.c_prm; prm->max_psize = hs_epout_desc.wMaxPacketSize;
@@ -1106,19 +1106,19 @@ afunc_bind(struct usb_configuration *cfg prm->rbuf =kzalloc (prm->max_psize *USB_XFERS ,GFP_KERNEL );if (!prm->rbuf) { prm->max_psize =0 ; - goto err_free_descs; + goto err; } ret =alsa_uac2_init (agdev);if (ret) - goto err_free_descs; + goto err;return 0 ; -err_free_descs: -usb_free_all_descriptors (fn); err:kfree (agdev->uac2.p_prm.rbuf);kfree (agdev->uac2.c_prm.rbuf); +err_free_descs: +usb_free_all_descriptors (fn);return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 17/85 usb: gadget: composite: correctly initialize ep->maxpacket
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit e8f29bb719b47a234f33b0af62974d7a9521a52c upstream.
usb_endpoint_maxp() returns wMaxPacketSize in its raw form. Without taking into consideration that it also contains other bits reserved for isochronous endpoints.
This patch fixes one occasion where this is a problem by making sure that we initialize ep->maxpacket only with lower 10 bits of the value returned by usb_endpoint_maxp(). Note that seperate patches will be necessary to audit all call sites of usb_endpoint_maxp() and make sure that usb_endpoint_maxp() only returns lower 10 bits of wMaxPacketSize.
--- drivers/usb/gadget/composite.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/usb/gadget/composite.c +1 -1
@@ -197,7 +197,7 @@ int config_ep_by_speed(struct usb_gadget ep_found:/* commit results */ - _ep->maxpacket =usb_endpoint_maxp (chosen_desc); + _ep->maxpacket =usb_endpoint_maxp (chosen_desc) &0x7ff ; _ep->desc = chosen_desc; _ep->comp_desc =NULL ; _ep->maxburst =0 ;
Greg Kroah-Hartman
maintainerPATCH 18/85 USB: UHCI: report non-PME wakeup signalling for Intel hardware
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alan Stern <[email protected]>
commit ccdb6be9ec6580ef69f68949ebe26e0fb58a6fb0 upstream.
The UHCI controllers in Intel chipsets rely on a platform-specific non-PME mechanism for wakeup signalling. They can generate wakeup signals even though they don't support PME.
We need to let the USB core know this so that it will enable runtime suspend for UHCI controllers.
--- drivers/usb/host/uhci-pci.c | 4 ++++ 1 file changed, 4 insertions(+)
drivers/usb/host/uhci-pci.c +4 -0
@@ -129,6 +129,10 @@ static int uhci_pci_init(struct usb_hcdif (to_pci_dev (uhci_dev (uhci))->vendor ==PCI_VENDOR_ID_HP ) uhci->wait_for_hp =1 ; +/* Intel controllers use non-PME wakeup signalling */ +if (to_pci_dev (uhci_dev (uhci))->vendor ==PCI_VENDOR_ID_INTEL ) +device_set_run_wake (uhci_dev (uhci),1 ); +/* Set up pointers to PCI-specific functions */ uhci->reset_hc = uhci_pci_reset_hc; uhci->check_and_reset_hc = uhci_pci_check_and_reset_hc;
Greg Kroah-Hartman
maintainerPATCH 19/85 usbip: vudc: fix: Clear already_seen flag also for ep0
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Krzysztof Opasiak <[email protected]>
commit 3e448e13a662fb20145916636127995cbf37eb83 upstream.
ep_list inside gadget structure doesn't contain ep0. It is stored separately in ep0 field.
This causes an urb hang if gadget driver decides to delay setup handling. On host side this is visible as timeout error when setting configuration.
This bug can be reproduced using for example any gadget with mass storage function.
--- drivers/usb/usbip/vudc_transfer.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/usb/usbip/vudc_transfer.c +2 -0
@@ -339,6 +339,8 @@ static void v_timer(unsigned long _vudc) total = timer->frame_limit; } +/* We have to clear ep0 flags separately as it's not on the list */ + udc->ep[0 ].already_seen =0 ;list_for_each_entry (_ep, &udc->gadget.ep_list, ep_list) { ep =to_vep (_ep); ep->already_seen =0 ;
Greg Kroah-Hartman
maintainerPATCH 20/85 ALSA: usb-audio: Add QuickCam Communicate Deluxe/S7500 to volume_control_quirks
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Con Kolivas <[email protected]>
commit 82ffb6fc637150b279f49e174166d2aa3853eaf4 upstream.
The Logitech QuickCam Communicate Deluxe/S7500 microphone fails with the following warning.
[ 6.778995] usb 2-1.2.2.2: Warning! Unlikely big volume range (=3072), cval->res is probably wrong. [ 6.778996] usb 2-1.2.2.2: [5] FU [Mic Capture Volume] ch = 1, val =
4608/7680/1
Adding it to the list of devices in volume_control_quirks makes it work properly, fixing related typo.
--- sound/usb/mixer.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)
sound/usb/mixer.c +2 -1
@@ -932,9 +932,10 @@ static void volume_control_quirks(structcase USB_ID (0x046d ,0x0826 ):/* HD Webcam c525 */ case USB_ID (0x046d ,0x08ca ):/* Logitech Quickcam Fusion */ case USB_ID (0x046d ,0x0991 ): +case USB_ID (0x046d ,0x09a2 ):/* QuickCam Communicate Deluxe/S7500 */ /* Most audio usb devices lie about volume resolution. * Most Logitech webcams have res = 384. -* Proboly there is some logitech magic behind this number --fishor +* Probably there is some logitech magic behind this number --fishor */ if (!strcmp (kctl->id.name,"Mic Capture Volume" )) { usb_audio_info(chip,
Greg Kroah-Hartman
maintainerPATCH 21/85 ALSA: hiface: Fix M2Tech hiFace driver sampling rate change
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jussi Laako <[email protected]>
commit 995c6a7fd9b9212abdf01160f6ce3193176be503 upstream.
Sampling rate changes after first set one are not reflected to the hardware, while driver and ALSA think the rate has been changed.
Fix the problem by properly stopping the interface at the beginning of prepare call, allowing new rate to be set to the hardware. This keeps the hardware in sync with the driver.
--- sound/usb/hiface/pcm.c | 2 ++ 1 file changed, 2 insertions(+)
sound/usb/hiface/pcm.c +2 -0
@@ -445,6 +445,8 @@ static int hiface_pcm_prepare(struct sndmutex_lock (&rt->stream_mutex); +hiface_pcm_stream_stop (rt); + sub->dma_off =0 ; sub->period_off =0 ;
Greg Kroah-Hartman
maintainerPATCH 22/85 ALSA: hda/ca0132 - Add quirk for Alienware 15 R2 2016
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sven Hahne <[email protected]>
commit b5337cfe067e96b8a98699da90c7dcd2bec21133 upstream.
I'm using an Alienware 15 R2 and had to use the alienware quirks to get my headphone output working.
I fixed it by adding, SND_PCI_QUIRK(0x1028, 0x0708, "Alienware 15 R2 2016", QUIRK_ALIENWARE) to the patch.
--- sound/pci/hda/patch_ca0132.c | 1 + 1 file changed, 1 insertion(+)
sound/pci/hda/patch_ca0132.c +1 -0
@@ -780,6 +780,7 @@ static const struct hda_pintbl alienwarestatic const struct snd_pci_quirk ca0132_quirks[] = {SND_PCI_QUIRK (0x1028 ,0x0685 ,"Alienware 15 2015" ,QUIRK_ALIENWARE ),SND_PCI_QUIRK (0x1028 ,0x0688 ,"Alienware 17 2015" ,QUIRK_ALIENWARE ), +SND_PCI_QUIRK (0x1028 ,0x0708 ,"Alienware 15 R2 2016" ,QUIRK_ALIENWARE ), {} };
Greg Kroah-Hartman
maintainerPATCH 23/85 ALSA: hda - ignore the assoc and seq when comparing pin configurations
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <[email protected]>
commit 64047d7f4912de1769d1bf0d34c6322494b13779 upstream.
More and more pin configurations have been adding to the pin quirk table, lots of them are only different from assoc and seq, but they all apply to the same QUIRK_FIXUP, if we don't compare assoc and seq when matching pin configurations, it will greatly reduce the pin quirk table size.
We have tested this change on a couple of Dell laptops, it worked well.
--- sound/pci/hda/hda_auto_parser.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
sound/pci/hda/hda_auto_parser.c +1 -1
@@ -901,7 +901,7 @@ static bool pin_config_match(struct hda_for (; t_pins->nid; t_pins++) {if (t_pins->nid == nid) { found =1 ; -if (t_pins->val == cfg) +if ((t_pins->val &0xfffffff0 ) == (cfg &0xfffffff0 ))break ;else if ((cfg &0xf0000000 ) ==0x40000000 && (t_pins->val &0xf0000000 ) ==0x40000000 )break ;
Greg Kroah-Hartman
maintainerPATCH 24/85 ALSA: hda - fix headset-mic problem on a Dell laptop
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Hui Wang <[email protected]>
commit 989dbe4a30728c047316ab87e5fa8b609951ce7c upstream.
This group of new pins is not in the pin quirk table yet, adding them to the pin quirk table to fix the headset-mic problem.
--- sound/pci/hda/patch_realtek.c | 3 +++ 1 file changed, 3 insertions(+)
sound/pci/hda/patch_realtek.c +3 -0
@@ -5915,6 +5915,9 @@ static const struct snd_hda_pin_quirk al {0x12, 0x90a60180}, {0x14, 0x90170120}, {0x21, 0x02211030}), + SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + {0x1b, 0x01011020}, + {0x21, 0x02211010}), SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, {0x12, 0x90a60160}, {0x14, 0x90170120},
Greg Kroah-Hartman
maintainerPATCH 25/85 ALSA: hda - Gate the mic jack on HP Z1 Gen3 AiO
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit f73cd43ac3b41c0f09a126387f302bbc0d9c726d upstream.
HP Z1 Gen3 AiO with Conexant codec doesn't give an unsolicited event to the headset mic pin upon the jack plugging, it reports only to the headphone pin. It results in the missing mic switching. Let's fix up by simply gating the jack event.
--- sound/pci/hda/patch_conexant.c | 17 +++++++++++++++++ 1 file changed, 17 insertions(+)
sound/pci/hda/patch_conexant.c +17 -0
@@ -262,6 +262,7 @@ enum {CXT_FIXUP_CAP_MIX_AMP_5047 ,CXT_FIXUP_MUTE_LED_EAPD ,CXT_FIXUP_HP_SPECTRE , + CXT_FIXUP_HP_GATE_MIC, };/* for hda_fixup_thinkpad_acpi() */
@@ -633,6 +634,17 @@ static void cxt_fixup_cap_mix_amp_5047(s (1 << AC_AMPCAP_MUTE_SHIFT)); } +static void cxt_fixup_hp_gate_mic_jack (struct hda_codec *codec, +const struct hda_fixup *fix, +int action) +{ +/* the mic pin (0x19) doesn't give an unsolicited event; +* probe the mic pin together with the headphone pin (0x16) +*/ +if (action ==HDA_FIXUP_ACT_PROBE ) +snd_hda_jack_set_gating_jack (codec,0x19 ,0x16 ); +} +/* ThinkPad X200 & co with cxt5051 */ static const struct hda_pintbl cxt_pincfg_lenovo_x200[] = { {0x16 ,0x042140ff },/* HP (seq# overridden) */
@@ -774,6 +786,10 @@ static const struct hda_fixup cxt_fixups { } } }, + [CXT_FIXUP_HP_GATE_MIC] = { + .type = HDA_FIXUP_FUNC, + .v.func = cxt_fixup_hp_gate_mic_jack, + }, };static const struct snd_pci_quirk cxt5045_fixups[] = {
@@ -824,6 +840,7 @@ static const struct snd_pci_quirk cxt506SND_PCI_QUIRK (0x1025 ,0x054c ,"Acer Aspire 3830TG" ,CXT_FIXUP_ASPIRE_DMIC ),SND_PCI_QUIRK (0x1025 ,0x054f ,"Acer Aspire 4830T" ,CXT_FIXUP_ASPIRE_DMIC ),SND_PCI_QUIRK (0x103c ,0x8174 ,"HP Spectre x360" ,CXT_FIXUP_HP_SPECTRE ), +SND_PCI_QUIRK (0x103c ,0x8115 ,"HP Z1 Gen3" ,CXT_FIXUP_HP_GATE_MIC ),SND_PCI_QUIRK (0x1043 ,0x138d ,"Asus" ,CXT_FIXUP_HEADPHONE_MIC_PIN ),SND_PCI_QUIRK (0x152d ,0x0833 ,"OLPC XO-1.5" ,CXT_FIXUP_OLPC_XO ), SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410),
Greg Kroah-Hartman
maintainerPATCH 26/85 ALSA: hda: when comparing pin configurations, ignore assoc in addition to seq
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Kai-Heng Feng <[email protected]>
commit 5e0ad0d8747f3e4803a9c3d96d64dd7332506d3c upstream.
Commit [64047d7f4912 ALSA: hda - ignore the assoc and seq when comparing pin configurations] intented to ignore both seq and assoc at pin comparing, but it only ignored seq. So that commit may still fail to match pins on some machines.
Change the bitmask to also ignore assoc.
v2: Use macro to do bit masking.
Thanks to Hui Wang for the analysis.
--- sound/pci/hda/hda_auto_parser.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
sound/pci/hda/hda_auto_parser.c +3 -1
@@ -884,6 +884,8 @@ void snd_hda_apply_fixup(struct hda_code }EXPORT_SYMBOL_GPL (snd_hda_apply_fixup); +#define IGNORE_SEQ_ASSOC (~(AC_DEFCFG_SEQUENCE | AC_DEFCFG_DEF_ASSOC)) +static bool pin_config_match (struct hda_codec *codec,const struct hda_pintbl *pins) {
@@ -901,7 +903,7 @@ static bool pin_config_match(struct hda_for (; t_pins->nid; t_pins++) {if (t_pins->nid == nid) { found =1 ; -if ((t_pins->val &0xfffffff0 ) == (cfg &0xfffffff0 )) +if ((t_pins->val &IGNORE_SEQ_ASSOC ) == (cfg &IGNORE_SEQ_ASSOC ))break ;else if ((cfg &0xf0000000 ) ==0x40000000 && (t_pins->val &0xf0000000 ) ==0x40000000 )break ;
Greg Kroah-Hartman
maintainerPATCH 27/85 clk: ti: omap36xx: Work around sprz319 advisory 2.1
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Richard Watts <[email protected]>
commit 035cd485a47dda64f25ccf8a90b11a07d0b7aa7a upstream.
The OMAP36xx DPLL5, driving EHCI USB, can be subject to a long-term frequency drift. The frequency drift magnitude depends on the VCO update rate, which is inversely proportional to the PLL divider. The kernel DPLL configuration code results in a high value for the divider, leading to a long term drift high enough to cause USB transmission errors. In the worst case the USB PHY's ULPI interface can stop responding, breaking USB operation completely. This manifests itself on the Beagleboard xM by the LAN9514 reporting 'Cannot enable port 2. Maybe the cable is bad?' in the kernel log.
Errata sprz319 advisory 2.1 documents PLL values that minimize the drift. Use them automatically when DPLL5 is used for USB operation, which we detect based on the requested clock rate. The clock framework will still compute the PLL parameters and resulting rate as usual, but the PLL M and N values will then be overridden. This can result in the effective clock rate being slightly different than the rate cached by the clock framework, but won't cause any adverse effect to USB operation.
--- drivers/clk/ti/clk-3xxx.c | 20 ++++++------- drivers/clk/ti/clock.h | 9 ++++++ drivers/clk/ti/dpll.c | 19 ++++++++++++- drivers/clk/ti/dpll3xxx.c | 67 ++++++++++++++++++++++++++++++++++++++++++++++ 4 files changed, 104 insertions(+), 11 deletions(-)
drivers/clk/ti/clk-3xxx.c +10 -10
@@ -22,13 +22,6 @@#include "clock.h" -/* -* DPLL5_FREQ_FOR_USBHOST: USBHOST and USBTLL are the only clocks -* that are sourced by DPLL5, and both of these require this clock -* to be at 120 MHz for proper operation. -*/ -#define DPLL5_FREQ_FOR_USBHOST 120000000 -#define OMAP3430ES2_ST_DSS_IDLE_SHIFT 1#define OMAP3430ES2_ST_HSOTGUSB_IDLE_SHIFT 5#define OMAP3430ES2_ST_SSI_IDLE_SHIFT 8
@@ -546,14 +539,21 @@ void __init omap3_clk_lock_dpll5(void)struct clk *dpll5_clk;struct clk *dpll5_m2_clk; +/* +* Errata sprz319f advisory 2.1 documents a USB host clock drift issue +* that can be worked around using specially crafted dpll5 settings +* with a dpll5_m2 divider set to 8. Set the dpll5 rate to 8x the USB +* host clock rate, its .set_rate handler() will detect that frequency +* and use the errata settings. +*/ dpll5_clk =clk_get (NULL ,"dpll5_ck" ); -clk_set_rate (dpll5_clk,DPLL5_FREQ_FOR_USBHOST ); +clk_set_rate (dpll5_clk,OMAP3_DPLL5_FREQ_FOR_USBHOST *8 );clk_prepare_enable (dpll5_clk); -/* Program dpll5_m2_clk divider for no division */ +/* Program dpll5_m2_clk divider */ dpll5_m2_clk =clk_get (NULL ,"dpll5_m2_ck" );clk_prepare_enable (dpll5_m2_clk); -clk_set_rate (dpll5_m2_clk,DPLL5_FREQ_FOR_USBHOST ); +clk_set_rate (dpll5_m2_clk,OMAP3_DPLL5_FREQ_FOR_USBHOST );clk_disable_unprepare (dpll5_m2_clk);clk_disable_unprepare (dpll5_clk);
drivers/clk/ti/clock.h +9 -0
@@ -257,11 +257,20 @@ long omap2_dpll_round_rate(struct clk_hwunsigned long omap3_clkoutx2_recalc (struct clk_hw *hw,unsigned long parent_rate); +/* +* OMAP3_DPLL5_FREQ_FOR_USBHOST: USBHOST and USBTLL are the only clocks +* that are sourced by DPLL5, and both of these require this clock +* to be at 120 MHz for proper operation. +*/ +#define OMAP3_DPLL5_FREQ_FOR_USBHOST 120000000 +unsigned long omap3_dpll_recalc (struct clk_hw *hw,unsigned long parent_rate);int omap3_dpll4_set_rate (struct clk_hw *clk,unsigned long rate,unsigned long parent_rate);int omap3_dpll4_set_rate_and_parent (struct clk_hw *hw,unsigned long rate,unsigned long parent_rate,u8 index); +int omap3_dpll5_set_rate (struct clk_hw *hw,unsigned long rate, +unsigned long parent_rate);void omap3_clk_lock_dpll5 (void ); unsigned long omap4_dpll_regm4xen_recalc(struct clk_hw *hw,
drivers/clk/ti/dpll.c +18 -1
@@ -114,6 +114,18 @@ static const struct clk_ops omap3_dpll_c .round_rate = &omap2_dpll_round_rate, }; +static const struct clk_ops omap3_dpll5_ck_ops = { + .enable = &omap3_noncore_dpll_enable, + .disable = &omap3_noncore_dpll_disable, + .get_parent = &omap2_init_dpll_parent, + .recalc_rate = &omap3_dpll_recalc, + .set_rate = &omap3_dpll5_set_rate, + .set_parent = &omap3_noncore_dpll_set_parent, + .set_rate_and_parent = &omap3_noncore_dpll_set_rate_and_parent, + .determine_rate = &omap3_noncore_dpll_determine_rate, + .round_rate = &omap2_dpll_round_rate, +}; +static const struct clk_ops omap3_dpll_per_ck_ops = { .enable = &omap3_noncore_dpll_enable, .disable = &omap3_noncore_dpll_disable,
@@ -474,7 +486,12 @@ static void __init of_ti_omap3_dpll_setu .modes = (1 << DPLL_LOW_POWER_BYPASS) | (1 << DPLL_LOCKED), }; -of_ti_dpll_setup (node, &omap3_dpll_ck_ops, &dd); +if ((of_machine_is_compatible ("ti,omap3630" ) || +of_machine_is_compatible ("ti,omap36xx" )) && + !strcmp (node->name,"dpll5_ck" )) +of_ti_dpll_setup (node, &omap3_dpll5_ck_ops, &dd); +else +of_ti_dpll_setup (node, &omap3_dpll_ck_ops, &dd); }CLK_OF_DECLARE (ti_omap3_dpll_clock,"ti,omap3-dpll-clock" , of_ti_omap3_dpll_setup);
drivers/clk/ti/dpll3xxx.c +67 -0
70 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 28/85 Btrfs: fix memory leak in reading btree blocks
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Bo <[email protected]>
commit 2571e739677f1e4c0c63f5ed49adcc0857923625 upstream.
So we can read a btree block via readahead or intentional read, and we can end up with a memory leak when something happens as follows,
1) readahead starts to read block A but does not wait for read completion,
2) btree_readpage_end_io_hook finds that block A is corrupted, and it needs to clear all block A's pages' uptodate bit.
3) meanwhile an intentional read kicks in and checks block A's pages' uptodate to decide which page needs to be read.
4) when some pages have the uptodate bit during 3)'s check so
3) doesn't count them for eb->io_pages, but they are later cleared by 2) so we has to readpage on the page, we get the wrong eb->io_pages which results in a memory leak of this block.
This fixes the problem by firstly getting all pages's locking and then checking pages' uptodate bit.
t1(readahead) t2(readahead endio) t3(the following read)read_extent_buffer_pages end_bio_extent_readpage
for pg in eb: for page 0,1,2 in eb:
if pg is uptodate: btree_readpage_end_io_hook(pg)
num_reads++ if uptodate:
eb->io_pages = num_reads SetPageUptodate(pg) _______________
for pg in eb: for page 3 in eb: read_extent_buffer_pages
if pg is NOT uptodate: btree_readpage_end_io_hook(pg) for pg in eb:
__extent_read_full_page(pg) sanity check reports something wrong if pg is uptodate:
clear_extent_buffer_uptodate(eb) num_reads++
for pg in eb: eb->io_pages = num_reads
ClearPageUptodate(page) _______________
for pg in eb:
if pg is NOT uptodate:
__extent_read_full_page(pg)
So t3's eb->io_pages is not consistent with the number of pages it's reading, and during endio(), atomic_dec_and_test(&eb->io_pages) will get a negative number so that we're not able to free the eb.
--- fs/btrfs/extent_io.c | 9 +++++++++ 1 file changed, 9 insertions(+)
fs/btrfs/extent_io.c +9 -0
@@ -5209,11 +5209,20 @@ int read_extent_buffer_pages(struct extelock_page (page); } locked_pages++; + } +/* +* We need to firstly lock all pages to make sure that +* the uptodate bit of our pages won't be affected by +* clear_extent_buffer_uptodate(). +*/ +for (i = start_i; i < num_pages; i++) { + page = eb->pages[i];if (!PageUptodate (page)) { num_reads++; all_uptodate =0 ; } } +if (all_uptodate) {if (start_i ==0 )set_bit (EXTENT_BUFFER_UPTODATE , &eb->bflags);
Greg Kroah-Hartman
maintainerPATCH 29/85 Btrfs: bail out if block group has different mixed flag
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Bo <[email protected]>
commit 49303381f19ab16a371a061b67e783d3f570d56e upstream.
Currently we allow inconsistence about mixed flag
(BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_DATA).
We'd get ENOSPC if block group has mixed flag and btrfs doesn't. If that happens, we have one space_info with mixed flag and another space_info only with BTRFS_BLOCK_GROUP_METADATA, and global_block_rsv.space_info points to the latter one, but all bytes from block_group contributes to the mixed space_info, thus all the allocation will fail with ENOSPC.
This adds a check for the above case.
--- fs/btrfs/extent-tree.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+)
fs/btrfs/extent-tree.c +14 -0
@@ -10127,6 +10127,11 @@ int btrfs_read_block_groups(struct btrfsstruct extent_buffer *leaf;int need_clear =0 ;u64 cache_gen; +u64 feature; +int mixed; + + feature =btrfs_super_incompat_flags (info->super_copy); + mixed = !!(feature &BTRFS_FEATURE_INCOMPAT_MIXED_GROUPS ); root = info->extent_root; key.objectid =0 ;
@@ -10180,6 +10185,15 @@ int btrfs_read_block_groups(struct btrfsbtrfs_item_ptr_offset (leaf, path->slots[0 ]), sizeof(cache->item)); cache->flags =btrfs_block_group_flags (&cache->item); +if (!mixed && + ((cache->flags &BTRFS_BLOCK_GROUP_METADATA ) && + (cache->flags &BTRFS_BLOCK_GROUP_DATA ))) { +btrfs_err (info, +"bg %llu is a mixed block group but filesystem hasn't enabled mixed block groups" , + cache->key.objectid); + ret = -EINVAL ; + goto error; + } key.objectid = found_key.objectid + found_key.offset;btrfs_release_path (path);
Greg Kroah-Hartman
maintainerPATCH 30/85 Btrfs: return gracefully from balance if fs tree is corrupted
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Bo <[email protected]>
commit 3561b9db70928f207be4570b48fc19898eeaef54 upstream.
When relocating tree blocks, we firstly get block information from back references in the extent tree, we then search fs tree to try to find all parents of a block.
However, if fs tree is corrupted, eg. if there're some missing items, we could come across these WARN_ONs and BUG_ONs.
This makes us print some error messages and return gracefully from balance.
--- fs/btrfs/relocation.c | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-)
fs/btrfs/relocation.c +17 -6
@@ -923,9 +923,16 @@ again: path2->slots[level]--; eb = path2->nodes[level]; -WARN_ON (btrfs_node_blockptr (eb, path2->slots[level]) != - cur->bytenr); - +if (btrfs_node_blockptr (eb, path2->slots[level]) != + cur->bytenr) { +btrfs_err (root->fs_info, +"couldn't find block (%llu) (level %d) in tree (%llu) with key (%llu %u %llu)" , + cur->bytenr, level -1 , root->objectid, + node_key->objectid, node_key->type, + node_key->offset); + err = -ENOENT ; + goto out; + } lower = cur; need_check = true;for (; level <BTRFS_MAX_LEVEL ; level++) {
@@ -2695,11 +2702,15 @@ static int do_relocation(struct btrfs_trif (!upper->eb) { ret =btrfs_search_slot (trans, root, key, path,0 ,1 ); -if (ret <0 ) { - err = ret; +if (ret) { +if (ret <0 ) + err = ret; +else + err = -ENOENT ; + +btrfs_release_path (path);break ; } -BUG_ON (ret >0 );if (!upper->eb) { upper->eb = path->nodes[upper->level];
Greg Kroah-Hartman
maintainerPATCH 31/85 Btrfs: dont leak reloc root nodes on error
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
commit 6bdf131fac2336adb1a628f992ba32384f653a55 upstream.
We don't track the reloc roots in any sort of normal way, so the only way the root/commit_root nodes get free'd is if the relocation finishes successfully and the reloc root is deleted. Fix this by free'ing them in free_reloc_roots. Thanks,
--- fs/btrfs/relocation.c | 4 ++++ 1 file changed, 4 insertions(+)
fs/btrfs/relocation.c +4 -0
@@ -2366,6 +2366,10 @@ void free_reloc_roots(struct list_head *while (!list_empty (list)) { reloc_root = list_entry(list->next, struct btrfs_root, root_list); +free_extent_buffer (reloc_root->node); +free_extent_buffer (reloc_root->commit_root); + reloc_root->node =NULL ; + reloc_root->commit_root =NULL ;__del_reloc_root (reloc_root); } }
Greg Kroah-Hartman
maintainerPATCH 32/85 btrfs: clean the old superblocks before freeing the device
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jeff Mahoney <[email protected]>
commit cea67ab92d3d4da9f2b4141d87cb8664757daca0 upstream.
btrfs_rm_device frees the block device but then re-opens it using the saved device name. A race exists between the close and the re-open that allows the block size to be changed. The result is getting stuck forever in the reclaim loop in __getblk_slow.
This patch moves the superblock cleanup before closing the block device, which is also consistent with other callers. We also don't need a private copy of dev_name as the whole routine operates under the uuid_mutex.
--- fs/btrfs/volumes.c | 38 +++++++++++--------------------------- 1 file changed, 11 insertions(+), 27 deletions(-)
fs/btrfs/volumes.c +11 -27
@@ -1846,7 +1846,6 @@ int btrfs_rm_device(struct btrfs_root *ru64 num_devices;int ret =0 ;bool clear_super = false; -char *dev_name =NULL ;mutex_lock (&uuid_mutex);
@@ -1882,11 +1881,6 @@ int btrfs_rm_device(struct btrfs_root *rlist_del_init (&device->dev_alloc_list); device->fs_devices->rw_devices--;unlock_chunks (root); - dev_name =kstrdup (device->name->str,GFP_KERNEL ); -if (!dev_name) { - ret = -ENOMEM ; - goto error_undo; - } clear_super = true; }
@@ -1936,14 +1930,21 @@ int btrfs_rm_device(struct btrfs_root *rbtrfs_sysfs_rm_device_link (root->fs_info->fs_devices, device); } -btrfs_close_bdev (device); - -call_rcu (&device->rcu, free_device); - num_devices =btrfs_super_num_devices (root->fs_info->super_copy) -1 ;btrfs_set_super_num_devices (root->fs_info->super_copy, num_devices);mutex_unlock (&root->fs_info->fs_devices->device_list_mutex); +/* +* at this point, the device is zero sized and detached from +* the devices list. All that's left is to zero out the old +* supers and free the device. +*/ +if (device->writeable) +btrfs_scratch_superblocks (device->bdev, device->name->str); + +btrfs_close_bdev (device); +call_rcu (&device->rcu, free_device); +if (cur_devices->open_devices ==0 ) {struct btrfs_fs_devices *fs_devices; fs_devices = root->fs_info->fs_devices;
@@ -1962,24 +1963,7 @@ int btrfs_rm_device(struct btrfs_root *r root->fs_info->num_tolerated_disk_barrier_failures =btrfs_calc_num_tolerated_disk_barrier_failures (root->fs_info); -/* -* at this point, the device is zero sized. We want to -* remove it from the devices list and zero out the old super -*/ -if (clear_super) { -struct block_device *bdev; - - bdev =blkdev_get_by_path (dev_name,FMODE_READ |FMODE_EXCL , - root->fs_info->bdev_holder); -if (!IS_ERR (bdev)) { -btrfs_scratch_superblocks (bdev, dev_name); -blkdev_put (bdev,FMODE_READ |FMODE_EXCL ); - } - } - out: -kfree (dev_name); -mutex_unlock (&uuid_mutex);return ret;
Greg Kroah-Hartman
maintainerPATCH 33/85 Btrfs: fix memory leak in do_walk_down
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Liu Bo <[email protected]>
commit a958eab0ed7fdc1b977bc25d3af6efedaa945488 upstream.
The extent buffer 'next' needs to be free'd conditionally.
--- fs/btrfs/extent-tree.c | 1 + 1 file changed, 1 insertion(+)
fs/btrfs/extent-tree.c +1 -0
@@ -8886,6 +8886,7 @@ static noinline int do_walk_down(struct &wc->flags[level - 1]);if (ret <0 ) {btrfs_tree_unlock (next); +free_extent_buffer (next);return ret; }
Greg Kroah-Hartman
maintainerPATCH 34/85 btrfs: fix a possible umount deadlock
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Anand Jain <[email protected]>
commit 0ccd05285e7f5a8e297e1d6dfc41e7c65757d6fa upstream.
btrfs_show_devname() is using the device_list_mutex, sometimes a call to blkdev_put() leads vfs calling into this func. So call blkdev_put() outside of device_list_mutex, as of now.
[ 983.284212] ======================================================
[ 983.290401] [ INFO: possible circular locking dependency detected ]
[ 983.296677] 4.8.0-rc5-ceph-00023-g1b39cec2 #1 Not tainted
[ 983.302081] -------------------------------------------------------
[ 983.308357] umount/21720 is trying to acquire lock:
[ 983.313243] (&bdev->bd_mutex){+.+.+.}, at: [<ffffffff9128ec51>] blkdev_put+0x31/0x150
[ 983.321264]
[ 983.321264] but task is already holding lock:
[ 983.327101] (&fs_devs->device_list_mutex){+.+...}, at: [<ffffffffc033d6f6>] __btrfs_close_devices+0x46/0x200 [btrfs]
[ 983.337839]
[ 983.337839] which lock already depends on the new lock.
[ 983.337839]
[ 983.346024]
[ 983.346024] the existing dependency chain (in reverse order) is:
[ 983.353512]
-> #4 (&fs_devs->device_list_mutex){+.+...}:
[ 983.359096] [<ffffffff910dfd0c>] lock_acquire+0x1bc/0x1f0
[ 983.365143] [<ffffffff91823125>] mutex_lock_nested+0x65/0x350
[ 983.371521] [<ffffffffc02d8116>] btrfs_show_devname+0x36/0x1f0 [btrfs]
[ 983.378710] [<ffffffff9129523e>] show_vfsmnt+0x4e/0x150
[ 983.384593] [<ffffffff9126ffc7>] m_show+0x17/0x20
[ 983.389957] [<ffffffff91276405>] seq_read+0x2b5/0x3b0
[ 983.395669] [<ffffffff9124c808>] __vfs_read+0x28/0x100
[ 983.401464] [<ffffffff9124eb3b>] vfs_read+0xab/0x150
[ 983.407080] [<ffffffff9124ec32>] SyS_read+0x52/0xb0
[ 983.412609] [<ffffffff91825fc0>] entry_SYSCALL_64_fastpath+0x23/0xc1
[ 983.419617]
-> #3 (namespace_sem){++++++}:
[ 983.424024] [<ffffffff910dfd0c>] lock_acquire+0x1bc/0x1f0
[ 983.430074] [<ffffffff918239e9>] down_write+0x49/0x80
[ 983.435785] [<ffffffff91272457>] lock_mount+0x67/0x1c0
[ 983.441582] [<ffffffff91272ab2>] do_add_mount+0x32/0xf0
[ 983.447458] [<ffffffff9127363a>] finish_automount+0x5a/0xc0
[ 983.453682] [<ffffffff91259513>] follow_managed+0x1b3/0x2a0
[ 983.459912] [<ffffffff9125b750>] lookup_fast+0x300/0x350
[ 983.465875] [<ffffffff9125d6e7>] path_openat+0x3a7/0xaa0
[ 983.471846] [<ffffffff9125ef75>] do_filp_open+0x85/0xe0
[ 983.477731] [<ffffffff9124c41c>] do_sys_open+0x14c/0x1f0
[ 983.483702] [<ffffffff9124c4de>] SyS_open+0x1e/0x20
[ 983.489240] [<ffffffff91825fc0>] entry_SYSCALL_64_fastpath+0x23/0xc1
[ 983.496254]
-> #2 (&sb->s_type->i_mutex_key#3){+.+.+.}:
[ 983.501798] [<ffffffff910dfd0c>] lock_acquire+0x1bc/0x1f0
[ 983.507855] [<ffffffff918239e9>] down_write+0x49/0x80
[ 983.513558] [<ffffffff91366237>] start_creating+0x87/0x100
[ 983.519703] [<ffffffff91366647>] debugfs_create_dir+0x17/0x100
[ 983.526195] [<ffffffff911df153>] bdi_register+0x93/0x210
[ 983.532165] [<ffffffff911df313>] bdi_register_owner+0x43/0x70
[ 983.538570] [<ffffffff914080fb>] device_add_disk+0x1fb/0x450
[ 983.544888] [<ffffffff91580226>] loop_add+0x1e6/0x290
[ 983.550596] [<ffffffff91fec358>] loop_init+0x10b/0x14f
[ 983.556394] [<ffffffff91002207>] do_one_initcall+0xa7/0x180
[ 983.562618] [<ffffffff91f932e0>] kernel_init_freeable+0x1cc/0x266
[ 983.569370] [<ffffffff918174be>] kernel_init+0xe/0x100
[ 983.575166] [<ffffffff9182620f>] ret_from_fork+0x1f/0x40
[ 983.581131]
-> #1 (loop_index_mutex){+.+.+.}:
[ 983.585801] [<ffffffff910dfd0c>] lock_acquire+0x1bc/0x1f0
[ 983.591858] [<ffffffff91823125>] mutex_lock_nested+0x65/0x350
[ 983.598256] [<ffffffff9157ed3f>] lo_open+0x1f/0x60
[ 983.603704] [<ffffffff9128eec3>] __blkdev_get+0x123/0x400
[ 983.609757] [<ffffffff9128f4ea>] blkdev_get+0x34a/0x350
[ 983.615639] [<ffffffff9128f554>] blkdev_open+0x64/0x80
[ 983.621428] [<ffffffff9124aff6>] do_dentry_open+0x1c6/0x2d0
[ 983.627651] [<ffffffff9124c029>] vfs_open+0x69/0x80
[ 983.633181] [<ffffffff9125db74>] path_openat+0x834/0xaa0
[ 983.639152] [<ffffffff9125ef75>] do_filp_open+0x85/0xe0
[ 983.645035] [<ffffffff9124c41c>] do_sys_open+0x14c/0x1f0
[ 983.650999] [<ffffffff9124c4de>] SyS_open+0x1e/0x20
[ 983.656535] [<ffffffff91825fc0>] entry_SYSCALL_64_fastpath+0x23/0xc1
[ 983.663541]
-> #0 (&bdev->bd_mutex){+.+.+.}:
[ 983.668107] [<ffffffff910def43>] __lock_acquire+0x1003/0x17b0
[ 983.674510] [<ffffffff910dfd0c>] lock_acquire+0x1bc/0x1f0
[ 983.680561] [<ffffffff91823125>] mutex_lock_nested+0x65/0x350
[ 983.686967] [<ffffffff9128ec51>] blkdev_put+0x31/0x150
[ 983.692761] [<ffffffffc033481f>] btrfs_close_bdev+0x4f/0x60 [btrfs]
[ 983.699699] [<ffffffffc033d77b>] __btrfs_close_devices+0xcb/0x200 [btrfs]
[ 983.707178] [<ffffffffc033d8db>] btrfs_close_devices+0x2b/0xa0 [btrfs]
[ 983.714380] [<ffffffffc03081c5>] close_ctree+0x265/0x340 [btrfs]
[ 983.721061] [<ffffffffc02d7959>] btrfs_put_super+0x19/0x20 [btrfs]
[ 983.727908] [<ffffffff91250e2f>] generic_shutdown_super+0x6f/0x100
[ 983.734744] [<ffffffff91250f56>] kill_anon_super+0x16/0x30
[ 983.740888] [<ffffffffc02da97e>] btrfs_kill_super+0x1e/0x130 [btrfs]
[ 983.747909] [<ffffffff91250fe9>] deactivate_locked_super+0x49/0x80
[ 983.754745] [<ffffffff912515fd>] deactivate_super+0x5d/0x70
[ 983.760977] [<ffffffff91270a1c>] cleanup_mnt+0x5c/0x80
[ 983.766773] [<ffffffff91270a92>] __cleanup_mnt+0x12/0x20
[ 983.772738] [<ffffffff910aa2fe>] task_work_run+0x7e/0xc0
[ 983.778708] [<ffffffff91081b5a>] exit_to_usermode_loop+0x7e/0xb4
[ 983.785373] [<ffffffff910039eb>] syscall_return_slowpath+0xbb/0xd0
[ 983.792212] [<ffffffff9182605c>] entry_SYSCALL_64_fastpath+0xbf/0xc1
[ 983.799225]
[ 983.799225] other info that might help us debug this:
[ 983.799225]
[ 983.807291] Chain exists of:
&bdev->bd_mutex --> namespace_sem --> &fs_devs->device_list_mutex[ 983.816521] Possible unsafe locking scenario:
[ 983.816521]
[ 983.822489] CPU0 CPU1
[ 983.827043] ---- ----
[ 983.831599] lock(&fs_devs->device_list_mutex);
[ 983.836289] lock(namespace_sem);
[ 983.842268] lock(&fs_devs->device_list_mutex);
[ 983.849478] lock(&bdev->bd_mutex);
[ 983.853127]
[ 983.853127] *** DEADLOCK ***
[ 983.853127]
[ 983.859113] 3 locks held by umount/21720:
[ 983.863145] #0: (&type->s_umount_key#35){++++..}, at: [<ffffffff912515f5>] deactivate_super+0x55/0x70
[ 983.872713] #1: (uuid_mutex){+.+.+.}, at: [<ffffffffc033d8d3>] btrfs_close_devices+0x23/0xa0 [btrfs]
[ 983.882206] #2: (&fs_devs->device_list_mutex){+.+...}, at: [<ffffffffc033d6f6>] __btrfs_close_devices+0x46/0x200 [btrfs]
[ 983.893422]
[ 983.893422] stack backtrace:
[ 983.897824] CPU: 6 PID: 21720 Comm: umount Not tainted 4.8.0-rc5-ceph-00023-g1b39cec2 #1
[ 983.905958] Hardware name: Supermicro SYS-5018R-WR/X10SRW-F, BIOS 1.0c 09/07/2015
[ 983.913492] 0000000000000000 ffff8c8a53c17a38 ffffffff91429521 ffffffff9260f4f0
[ 983.921018] ffffffff92642760 ffff8c8a53c17a88 ffffffff911b2b04 0000000000000050
[ 983.928542] ffffffff9237d620 ffff8c8a5294aee0 ffff8c8a5294aeb8 ffff8c8a5294aee0
[ 983.936072] Call Trace:
[ 983.938545] [<ffffffff91429521>] dump_stack+0x85/0xc4
[ 983.943715] [<ffffffff911b2b04>] print_circular_bug+0x1fb/0x20c
[ 983.949748] [<ffffffff910def43>] __lock_acquire+0x1003/0x17b0
[ 983.955613] [<ffffffff910dfd0c>] lock_acquire+0x1bc/0x1f0
[ 983.961123] [<ffffffff9128ec51>] ? blkdev_put+0x31/0x150
[ 983.966550] [<ffffffff91823125>] mutex_lock_nested+0x65/0x350
[ 983.972407] [<ffffffff9128ec51>] ? blkdev_put+0x31/0x150
[ 983.977832] [<ffffffff9128ec51>] blkdev_put+0x31/0x150
[ 983.983101] [<ffffffffc033481f>] btrfs_close_bdev+0x4f/0x60 [btrfs]
[ 983.989500] [<ffffffffc033d77b>] __btrfs_close_devices+0xcb/0x200 [btrfs]
[ 983.996415] [<ffffffffc033d8db>] btrfs_close_devices+0x2b/0xa0 [btrfs]
[ 984.003068] [<ffffffffc03081c5>] close_ctree+0x265/0x340 [btrfs]
[ 984.009189] [<ffffffff9126cc5e>] ? evict_inodes+0x15e/0x170
[ 984.014881] [<ffffffffc02d7959>] btrfs_put_super+0x19/0x20 [btrfs]
[ 984.021176] [<ffffffff91250e2f>] generic_shutdown_super+0x6f/0x100
[ 984.027476] [<ffffffff91250f56>] kill_anon_super+0x16/0x30
[ 984.033082] [<ffffffffc02da97e>] btrfs_kill_super+0x1e/0x130 [btrfs]
[ 984.039548] [<ffffffff91250fe9>] deactivate_locked_super+0x49/0x80
[ 984.045839] [<ffffffff912515fd>] deactivate_super+0x5d/0x70
[ 984.051525] [<ffffffff91270a1c>] cleanup_mnt+0x5c/0x80
[ 984.056774] [<ffffffff91270a92>] __cleanup_mnt+0x12/0x20
[ 984.062201] [<ffffffff910aa2fe>] task_work_run+0x7e/0xc0
[ 984.067625] [<ffffffff91081b5a>] exit_to_usermode_loop+0x7e/0xb4
[ 984.073747] [<ffffffff910039eb>] syscall_return_slowpath+0xbb/0xd0
[ 984.080038] [<ffffffff9182605c>] entry_SYSCALL_64_fastpath+0xbf/0xc1--- fs/btrfs/volumes.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-)
fs/btrfs/volumes.c +20 -6
@@ -859,7 +859,7 @@ static void btrfs_close_bdev(struct btrfblkdev_put (device->bdev, device->mode); } -static void btrfs_close_one_device (struct btrfs_device *device) +static void btrfs_prepare_close_one_device (struct btrfs_device *device) {struct btrfs_fs_devices *fs_devices = device->fs_devices;struct btrfs_device *new_device;
@@ -877,8 +877,6 @@ static void btrfs_close_one_device(strucif (device->missing) fs_devices->missing_devices--; -btrfs_close_bdev (device); - new_device =btrfs_alloc_device (NULL , &device->devid, device->uuid);BUG_ON (IS_ERR (new_device));/* -ENOMEM */
@@ -892,23 +890,39 @@ static void btrfs_close_one_device(struclist_replace_rcu (&device->dev_list, &new_device->dev_list); new_device->fs_devices = device->fs_devices; - -call_rcu (&device->rcu, free_device); }static int __btrfs_close_devices (struct btrfs_fs_devices *fs_devices) {struct btrfs_device *device, *tmp; +struct list_head pending_put; + +INIT_LIST_HEAD (&pending_put);if (--fs_devices->opened >0 )return 0 ;mutex_lock (&fs_devices->device_list_mutex);list_for_each_entry_safe (device, tmp, &fs_devices->devices, dev_list) { -btrfs_close_one_device (device); +btrfs_prepare_close_one_device (device); +list_add (&device->dev_list, &pending_put); }mutex_unlock (&fs_devices->device_list_mutex); +/* +* btrfs_show_devname() is using the device_list_mutex, +* sometimes call to blkdev_put() leads vfs calling +* into this func. So do put outside of device_list_mutex, +* as of now. +*/ +while (!list_empty (&pending_put)) { + device =list_first_entry (&pending_put, + struct btrfs_device, dev_list); +list_del (&device->dev_list); +btrfs_close_bdev (device); +call_rcu (&device->rcu, free_device); + } +WARN_ON (fs_devices->open_devices);WARN_ON (fs_devices->rw_devices); fs_devices->opened =0 ;
Greg Kroah-Hartman
maintainerPATCH 35/85 Btrfs: dont BUG() during drop snapshot
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Josef Bacik <[email protected]>
commit 4867268c57ff709a7b6b86ae6f6537d846d1443a upstream.
Really there's lots of things that can go wrong here, kill all the BUG_ON()'s and replace the logic ones with ASSERT()'s and return EIO instead.
--- fs/btrfs/extent-tree.c | 38 +++++++++++++++++++++++++++----------- 1 file changed, 27 insertions(+), 11 deletions(-)
fs/btrfs/extent-tree.c +27 -11
@@ -8884,15 +8884,13 @@ static noinline int do_walk_down(struct ret =btrfs_lookup_extent_info (trans, root, bytenr, level -1 ,1 , &wc->refs[level -1 ], &wc->flags[level -1 ]); -if (ret <0 ) { -btrfs_tree_unlock (next); -free_extent_buffer (next); -return ret; - } +if (ret <0 ) + goto out_unlock;if (unlikely (wc->refs[level -1 ] ==0 )) {btrfs_err (root->fs_info,"Missing references." ); -BUG (); + ret = -EIO ; + goto out_unlock; } *lookup_info =0 ;
@@ -8944,7 +8942,12 @@ static noinline int do_walk_down(struct } level--; -BUG_ON (level !=btrfs_header_level (next)); +ASSERT (level ==btrfs_header_level (next)); +if (level !=btrfs_header_level (next)) { +btrfs_err (root->fs_info,"mismatched level" ); + ret = -EIO ; + goto out_unlock; + } path->nodes[level] = next; path->slots[level] =0 ; path->locks[level] =BTRFS_WRITE_LOCK_BLOCKING ;
@@ -8959,8 +8962,15 @@ skip:if (wc->flags[level] &BTRFS_BLOCK_FLAG_FULL_BACKREF ) { parent = path->nodes[level]->start; }else { -BUG_ON (root->root_key.objectid != +ASSERT (root->root_key.objectid ==btrfs_header_owner (path->nodes[level])); +if (root->root_key.objectid != +btrfs_header_owner (path->nodes[level])) { +btrfs_err (root->fs_info, +"mismatched block owner" ); + ret = -EIO ; + goto out_unlock; + } parent =0 ; }
@@ -8977,12 +8987,18 @@ skip: } ret =btrfs_free_extent (trans, root, bytenr, blocksize, parent, root->root_key.objectid, level -1 ,0 ); -BUG_ON (ret);/* -ENOMEM */ +if (ret) + goto out_unlock; } + + *lookup_info =1 ; + ret =1 ; + +out_unlock:btrfs_tree_unlock (next);free_extent_buffer (next); - *lookup_info =1 ; -return 1 ; + +return ret; }/*
Greg Kroah-Hartman
maintainerPATCH 36/85 Btrfs: fix incremental send failure caused by balance
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Filipe Manana <[email protected]>
commit d5e84fd8d0634d056248b67463b42f6c85896a19 upstream.
Commit 951555856b88 ("Btrfs: send, don't bug on inconsistent snapshots") removed some BUG_ON() statements (replacing them with returning errors to user space and logging error messages) when a snapshot is in an inconsistent state due to failures to update a delayed inode item (ENOMEM or ENOSPC) after adding/updating/deleting references, xattrs or file extent items.
However there is a case, when no errors happen, where a file extent item can be modified without having the corresponding inode item updated. This case happens during balance under very specific timings, when relocation is in the stage where it updates data pointers and a leaf that contains file extent items is COWed. When that happens file extent items get their disk_bytenr field updated to a new value that reflects the post relocation logical address of the extent, without updating their respective inode items (as there is nothing that needs to be updated on them). This is performed at relocation.c:replace_file_extents() through relocation.c:btrfs_reloc_cow_block().
So make an incremental send deal with this case and don't do any processing for a file extent item that got its disk_bytenr field updated by relocation, since the extent's data is the same as the one pointed by the file extent item in the parent snapshot.
After the recent commit mentioned above this case resulted in EIO errors returned to user space (and an error message logged to dmesg/syslog) when doing an incremental send, while before it, it resulted in hitting a BUG_ON leading to the following trace:
[ 952.206705] ------------[ cut here ]------------ [ 952.206714] kernel BUG at ../fs/btrfs/send.c:5653! [ 952.206719] Internal error: Oops - BUG: 0 [#1] SMP [ 952.209854] Modules linked in: st dm_mod nls_utf8 isofs fuse nf_log_ipv6 xt_pkttype xt_physdev br_netfilter nf_log_ipv4 nf_log_common xt_LOG xt_limit ebtable_filter ebtables af_packet bridge stp llc ip6t_REJECT xt_tcpudp nf_conntrack_ipv6 nf_defrag_ipv6 ip6table_raw ipt_REJECT iptable_raw xt_CT iptable_filter ip6table_mangle nf_conntrack_netbios_ns nf_conntrack_broadcast nf_conntrack_ipv4 nf_defrag_ipv4 ip_tables xt_conntrack nf_conntrack ip6table_filter ip6_tables x_tables xfs libcrc32c nls_iso8859_1 nls_cp437 vfat fat joydev aes_ce_blk ablk_helper cryptd snd_intel8x0 aes_ce_cipher snd_ac97_codec ac97_bus snd_pcm ghash_ce sha2_ce sha1_ce snd_timer snd virtio_net soundcore btrfs xor sr_mod cdrom hid_generic usbhid raid6_pq virtio_blk virtio_scsi bochs_drm drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm virtio_mmio xhci_pci xhci_hcd usbcore usb_common virtio_pci virtio_ring virtio drm sg efivarfs [ 952.228333] Supported: Yes [ 952.228908] CPU: 0 PID: 12779 Comm: snapperd Not tainted 4.4.14-50-default #1 [ 952.230329] Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 [ 952.231683] task: ffff800058e94100 ti: ffff8000d866c000 task.ti: ffff8000d866c000 [ 952.233279] PC is at changed_cb+0x9f4/0xa48 [btrfs] [ 952.234375] LR is at changed_cb+0x58/0xa48 [btrfs] [ 952.236552] pc : [<ffff7ffffc39de7c>] lr : [<ffff7ffffc39d4e0>] pstate: 80000145 [ 952.238049] sp : ffff8000d866fa20 [ 952.238732] x29: ffff8000d866fa20 x28: 0000000000000019 [ 952.239840] x27: 00000000000028d5 x26: 00000000000024a2 [ 952.241008] x25: 0000000000000002 x24: ffff8000e66e92f0 [ 952.242131] x23: ffff8000b8c76800 x22: ffff800092879140 [ 952.243238] x21: 0000000000000002 x20: ffff8000d866fb78 [ 952.244348] x19: ffff8000b8f8c200 x18: 0000000000002710 [ 952.245607] x17: 0000ffff90d42480 x16: ffff800000237dc0 [ 952.246719] x15: 0000ffff90de7510 x14: ab000c000a2faf08 [ 952.247835] x13: 0000000000577c2b x12: ab000c000b696665 [ 952.248981] x11: 2e65726f632f6966 x10: 652d34366d72612f [ 952.250101] x9 : 32627572672f746f x8 : ab000c00092f1671 [ 952.251352] x7 : 8000000000577c2b x6 : ffff800053eadf45 [ 952.252468] x5 : 0000000000000000 x4 : ffff80005e169494 [ 952.253582] x3 : 0000000000000004 x2 : ffff8000d866fb78 [ 952.254695] x1 : 000000000003e2a3 x0 : 000000000003e2a4 [ 952.255803] [ 952.256150] Process snapperd (pid: 12779, stack limit = 0xffff8000d866c020) [ 952.257516] Stack: (0xffff8000d866fa20 to 0xffff8000d8670000) [ 952.258654] fa20: ffff8000d866fae0 ffff7ffffc308fc0 ffff800092879140 ffff8000e66e92f0 [ 952.260219] fa40: 0000000000000035 ffff800055de6000 ffff8000b8c76800 ffff8000d866fb78 [ 952.261745] fa60: 0000000000000002 00000000000024a2 00000000000028d5 0000000000000019 [ 952.263269] fa80: ffff8000d866fae0 ffff7ffffc3090f0 ffff8000d866fae0 ffff7ffffc309128 [ 952.264797] faa0: ffff800092879140 ffff8000e66e92f0 0000000000000035 ffff800055de6000 [ 952.268261] fac0: ffff8000b8c76800 ffff8000d866fb78 0000000000000002 0000000000001000 [ 952.269822] fae0: ffff8000d866fbc0 ffff7ffffc39ecfc ffff8000b8f8c200 ffff8000b8f8c368 [ 952.271368] fb00: ffff8000b8f8c378 ffff800055de6000 0000000000000001 ffff8000ecb17500 [ 952.272893] fb20: ffff8000b8c76800 ffff800092879140 ffff800062b6d000 ffff80007a9e2470 [ 952.274420] fb40: ffff8000b8f8c208 0000000005784000 ffff8000580a8000 ffff8000b8f8c200 [ 952.276088] fb60: ffff7ffffc39d488 00000002b8f8c368 0000000000000000 000000000003e2a4 [ 952.280275] fb80: 000000000000006c ffff7ffffc39ec00 000000000003e2a4 000000000000006c [ 952.283219] fba0: ffff8000b8f8c300 0000000000000100 0000000000000001 ffff8000ecb17500 [ 952.286166] fbc0: ffff8000d866fcd0 ffff7ffffc3643c0 ffff8000f8842700 0000ffff8ffe9278 [ 952.289136] fbe0: 0000000040489426 ffff800055de6000 0000ffff8ffe9278 0000000040489426 [ 952.292083] fc00: 000000000000011d 000000000000001d ffff80007a9e4598 ffff80007a9e43e8 [ 952.294959] fc20: ffff8000b8c7693f 0000000000003b24 0000000000000019 ffff8000b8f8c218 [ 952.301161] fc40: 00000001d866fc70 ffff8000b8c76800 0000000000000128 ffffffffffffff84 [ 952.305749] fc60: ffff800058e941ff 0000000000003a58 ffff8000d866fcb0 ffff8000000f7390 [ 952.308875] fc80: 000000000000012a 0000000000010290 ffff8000d866fc00 000000000000007b [ 952.311915] fca0: 0000000000010290 ffff800046c1b100 74732d7366727462 000001006d616572 [ 952.314937] fcc0: ffff8000fffc4100 cb88537fdc8ba60e ffff8000d866fe10 ffff8000002499e8 [ 952.318008] fce0: 0000000040489426 ffff8000f8842700 0000ffff8ffe9278 ffff80007a9e4598 [ 952.321321] fd00: 0000ffff8ffe9278 0000000040489426 000000000000011d 000000000000001d [ 952.324280] fd20: ffff80000072c000 ffff8000d866c000 ffff8000d866fda0 ffff8000000e997c [ 952.327156] fd40: ffff8000fffc4180 00000000000031ed ffff8000fffc4180 ffff800046c1b7d4 [ 952.329895] fd60: 0000000000000140 0000ffff907ea170 000000000000011d 00000000000000dc [ 952.334641] fd80: ffff80000072c000 ffff8000d866c000 0000000000000000 0000000000000002 [ 952.338002] fda0: ffff8000d866fdd0 ffff8000000ebacc ffff800046c1b080 ffff800046c1b7d4 [ 952.340724] fdc0: ffff8000d866fdf0 ffff8000000db67c 0000000000000040 ffff800000e69198 [ 952.343415] fde0: 0000ffff8ffea790 00000000000031ed ffff8000d866fe20 ffff800000254000 [ 952.346101] fe00: 000000000000001d 0000000000000004 ffff8000d866fe90 ffff800000249d3c [ 952.348980] fe20: ffff8000f8842700 0000000000000000 ffff8000f8842701 0000000000000008 [ 952.351696] fe40: ffff8000d866fe70 0000000000000008 ffff8000d866fe90 ffff800000249cf8 [ 952.354387] fe60: ffff8000f8842700 0000ffff8ffe9170 ffff8000f8842701 0000000000000008 [ 952.357083] fe80: 0000ffff8ffe9278 ffff80008ff85500 0000ffff8ffe90c0 ffff800000085c84 [ 952.359800] fea0: 0000000000000000 0000ffff8ffe9170 ffffffffffffffff 0000ffff90d473bc [ 952.365351] fec0: 0000000000000000 0000000000000015 0000000000000008 0000000040489426 [ 952.369550] fee0: 0000ffff8ffe9278 0000ffff907ea790 0000ffff907ea170 0000ffff907ea790 [ 952.372416] ff00: 0000ffff907ea170 0000000000000000 000000000000001d 0000000000000004 [ 952.375223] ff20: 0000ffff90a32220 00000000003d0f00 0000ffff907ea0a0 0000ffff8ffe8f30 [ 952.378099] ff40: 0000ffff9100f554 0000ffff91147000 0000ffff91117bc0 0000ffff90d473b0 [ 952.381115] ff60: 0000ffff9100f620 0000ffff880069b0 0000ffff8ffe9170 0000ffff8ffe91a0 [ 952.384003] ff80: 0000ffff8ffe9160 0000ffff8ffe9140 0000ffff88006990 0000ffff8ffe9278 [ 952.386860] ffa0: 0000ffff88008a60 0000ffff8ffe9480 0000ffff88014ca0 0000ffff8ffe90c0 [ 952.389654] ffc0: 0000ffff910be8e8 0000ffff8ffe90c0 0000ffff90d473bc 0000000000000000 [ 952.410986] ffe0: 0000000000000008 000000000000001d 6e2079747265706f 72616d223d656d61 [ 952.415497] Call trace: [ 952.417403] [<ffff7ffffc39de7c>] changed_cb+0x9f4/0xa48 [btrfs] [ 952.420023] [<ffff7ffffc308fc0>] btrfs_compare_trees+0x500/0x6b0 [btrfs] [ 952.422759] [<ffff7ffffc39ecfc>] btrfs_ioctl_send+0xb4c/0xe10 [btrfs] [ 952.425601] [<ffff7ffffc3643c0>] btrfs_ioctl+0x374/0x29a4 [btrfs] [ 952.428031] [<ffff8000002499e8>] do_vfs_ioctl+0x33c/0x600 [ 952.430360] [<ffff800000249d3c>] SyS_ioctl+0x90/0xa4 [ 952.432552] [<ffff800000085c84>] el0_svc_naked+0x38/0x3c [ 952.434803] Code: 2a1503e0 17fffdac b9404282 17ffff28 (d4210000) [ 952.437457] ---[ end trace 9afd7090c466cf15 ]---
--- fs/btrfs/send.c | 58 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 58 insertions(+)
fs/btrfs/send.c +58 -0
@@ -5802,6 +5802,64 @@ static int changed_extent(struct send_ctint ret =0 ;if (sctx->cur_ino != sctx->cmp_key->objectid) { + +if (result ==BTRFS_COMPARE_TREE_CHANGED ) { +struct extent_buffer *leaf_l; +struct extent_buffer *leaf_r; +struct btrfs_file_extent_item *ei_l; +struct btrfs_file_extent_item *ei_r; + + leaf_l = sctx->left_path->nodes[0 ]; + leaf_r = sctx->right_path->nodes[0 ]; + ei_l =btrfs_item_ptr (leaf_l, + sctx->left_path->slots[0 ], + struct btrfs_file_extent_item); + ei_r =btrfs_item_ptr (leaf_r, + sctx->right_path->slots[0 ], + struct btrfs_file_extent_item); + +/* +* We may have found an extent item that has changed +* only its disk_bytenr field and the corresponding +* inode item was not updated. This case happens due to +* very specific timings during relocation when a leaf +* that contains file extent items is COWed while +* relocation is ongoing and its in the stage where it +* updates data pointers. So when this happens we can +* safely ignore it since we know it's the same extent, +* but just at different logical and physical locations +* (when an extent is fully replaced with a new one, we +* know the generation number must have changed too, +* since snapshot creation implies committing the current +* transaction, and the inode item must have been updated +* as well). +* This replacement of the disk_bytenr happens at +* relocation.c:replace_file_extents() through +* relocation.c:btrfs_reloc_cow_block(). +*/ +if (btrfs_file_extent_generation (leaf_l, ei_l) == +btrfs_file_extent_generation (leaf_r, ei_r) && +btrfs_file_extent_ram_bytes (leaf_l, ei_l) == +btrfs_file_extent_ram_bytes (leaf_r, ei_r) && +btrfs_file_extent_compression (leaf_l, ei_l) == +btrfs_file_extent_compression (leaf_r, ei_r) && +btrfs_file_extent_encryption (leaf_l, ei_l) == +btrfs_file_extent_encryption (leaf_r, ei_r) && +btrfs_file_extent_other_encoding (leaf_l, ei_l) == +btrfs_file_extent_other_encoding (leaf_r, ei_r) && +btrfs_file_extent_type (leaf_l, ei_l) == +btrfs_file_extent_type (leaf_r, ei_r) && +btrfs_file_extent_disk_bytenr (leaf_l, ei_l) != +btrfs_file_extent_disk_bytenr (leaf_r, ei_r) && +btrfs_file_extent_disk_num_bytes (leaf_l, ei_l) == +btrfs_file_extent_disk_num_bytes (leaf_r, ei_r) && +btrfs_file_extent_offset (leaf_l, ei_l) == +btrfs_file_extent_offset (leaf_r, ei_r) && +btrfs_file_extent_num_bytes (leaf_l, ei_l) == +btrfs_file_extent_num_bytes (leaf_r, ei_r)) +return 0 ; + } +inconsistent_snapshot_error (sctx, result,"extent" );return -EIO ; }
Greg Kroah-Hartman
maintainerPATCH 37/85 btrfs: make file clone aware of fatal signals
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wang Xiaoguang <[email protected]>
commit 69ae5e4459e43e56f03d0987e865fbac2b05af2a upstream.
Indeed this just make the behavior similar to xfs when process has fatal signals pending, and it'll make fstests/generic/298 happy.
--- fs/btrfs/ioctl.c | 5 +++++ 1 file changed, 5 insertions(+)
fs/btrfs/ioctl.c +5 -0
@@ -3813,6 +3813,11 @@ process_slot: }btrfs_release_path (path); key.offset = next_key_min_offset; + +if (fatal_signal_pending (current)) { + ret = -EINTR ; + goto out; + } } ret =0 ;
Greg Kroah-Hartman
maintainerPATCH 38/85 exec: Ensure mm->user_ns contains the execed files
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
commit f84df2a6f268de584a201e8911384a2d244876e3 upstream.
When the user namespace support was merged the need to prevent ptrace from revealing the contents of an unreadable executable was overlooked.
Correct this oversight by ensuring that the executed file or files are in mm->user_ns, by adjusting mm->user_ns.
Use the new function privileged_wrt_inode_uidgid to see if the executable is a member of the user namespace, and as such if having CAP_SYS_PTRACE in the user namespace should allow tracing the executable. If not update mm->user_ns to the parent user namespace until an appropriate parent is found.
--- fs/exec.c | 19 +++++++++++++++++-- include/linux/capability.h | 1 + kernel/capability.c | 16 ++++++++++++++-- 3 files changed, 32 insertions(+), 4 deletions(-)
fs/exec.c +17 -2
@@ -1270,8 +1270,22 @@ EXPORT_SYMBOL(flush_old_exec);void would_dump (struct linux_binprm *bprm,struct file *file) { -if (inode_permission (file_inode (file),MAY_READ ) <0 ) +struct inode *inode =file_inode (file); +if (inode_permission (inode,MAY_READ ) <0 ) { +struct user_namespace *old, *user_ns; bprm->interp_flags |=BINPRM_FLAGS_ENFORCE_NONDUMP ; + +/* Ensure mm->user_ns contains the executable */ + user_ns = old = bprm->mm->user_ns; +while ((user_ns != &init_user_ns) && + !privileged_wrt_inode_uidgid (user_ns, inode)) + user_ns = user_ns->parent; + +if (old != user_ns) { + bprm->mm->user_ns =get_user_ns (user_ns); +put_user_ns (old); + } + } }EXPORT_SYMBOL (would_dump);
@@ -1301,7 +1315,6 @@ void setup_new_exec(struct linux_binprm !gid_eq(bprm->cred->gid, current_egid())) { current->pdeath_signal = 0; } else { -would_dump (bprm, bprm->file);if (bprm->interp_flags &BINPRM_FLAGS_ENFORCE_NONDUMP )set_dumpable (current->mm, suid_dumpable); }
@@ -1736,6 +1749,8 @@ static int do_execveat_common(int fd, stif (retval <0 ) goto out; +would_dump (bprm, bprm->file); + retval =exec_binprm (bprm);if (retval <0 ) goto out;
include/linux/capability.h +1 -0
@@ -240,6 +240,7 @@ static inline bool ns_capable_noaudit(st return true; }#endif /* CONFIG_MULTIUSER */ +extern bool privileged_wrt_inode_uidgid (struct user_namespace *ns,const struct inode *inode);extern bool capable_wrt_inode_uidgid (const struct inode *inode,int cap);extern bool file_ns_capable (const struct file *file,struct user_namespace *ns,int cap);
kernel/capability.c +14 -2
@@ -457,6 +457,19 @@ bool file_ns_capable(const struct file *EXPORT_SYMBOL (file_ns_capable);/** +* privileged_wrt_inode_uidgid - Do capabilities in the namespace work over the inode? +* @ns: The user namespace in question +* @inode: The inode in question +* +* Return true if the inode uid and gid are within the namespace. +*/ +bool privileged_wrt_inode_uidgid (struct user_namespace *ns,const struct inode *inode) +{ +return kuid_has_mapping (ns, inode->i_uid) && +kgid_has_mapping (ns, inode->i_gid); +} + +/** * capable_wrt_inode_uidgid - Check nsown_capable and uid and gid mapped * @inode: The inode in question * @cap: The capability in question
@@ -469,7 +482,6 @@ bool capable_wrt_inode_uidgid(const stru {struct user_namespace *ns =current_user_ns (); -return ns_capable (ns, cap) &&kuid_has_mapping (ns, inode->i_uid) && -kgid_has_mapping (ns, inode->i_gid); +return ns_capable (ns, cap) &&privileged_wrt_inode_uidgid (ns, inode); }EXPORT_SYMBOL (capable_wrt_inode_uidgid);
Greg Kroah-Hartman
maintainerPATCH 39/85 fs: exec: apply CLOEXEC before changing dumpable task flags
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Aleksa Sarai <[email protected]>
commit 613cc2b6f272c1a8ad33aefa21cad77af23139f7 upstream.
If you have a process that has set itself to be non-dumpable, and it then undergoes exec(2), any CLOEXEC file descriptors it has open are "exposed" during a race window between the dumpable flags of the process being reset for exec(2) and CLOEXEC being applied to the file descriptors. This can be exploited by a process by attempting to access /proc/<pid>/fd/... during this window, without requiring CAP_SYS_PTRACE.
The race in question is after set_dumpable has been (for get_link, though the trace is basically the same for readlink):
[vfs]
-> proc_pid_link_inode_operations.get_link
-> proc_pid_get_link
-> proc_fd_access_allowed
-> ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS);Which will return 0, during the race window and CLOEXEC file descriptors will still be open during this window because do_close_on_exec has not been called yet. As a result, the ordering of these calls should be reversed to avoid this race window.
This is of particular concern to container runtimes, where joining a PID namespace with file descriptors referring to the host filesystem can result in security issues (since PRCTL_SET_DUMPABLE doesn't protect against access of CLOEXEC file descriptors -- file descriptors which may reference filesystem objects the container shouldn't have access to).
--- fs/exec.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
fs/exec.c +8 -2
@@ -19,7 +19,7 @@* current->executable is only used by the procfs. This allows a dispatch * table to check for several different types of binary formats. We keep * trying until we recognize the file or we run out of supported binary -* formats. +* formats. */ #include <linux/slab.h>
@@ -1261,6 +1261,13 @@ int flush_old_exec(struct linux_binprm *flush_thread (); current->personality &= ~bprm->per_clear; +/* +* We have to apply CLOEXEC before we change whether the process is +* dumpable (in setup_new_exec) to avoid a race with a process in userspace +* trying to access the should-be-closed file descriptors of a process +* undergoing exec(2). +*/ +do_close_on_exec (current->files);return 0 ; out:
@@ -1323,7 +1330,6 @@ void setup_new_exec(struct linux_binprmgroup */ current->self_exec_id++;flush_signal_handlers (current,0 ); -do_close_on_exec (current->files); }EXPORT_SYMBOL (setup_new_exec);
Greg Kroah-Hartman
maintainerPATCH 40/85 block_dev: dont test bdev->bd_contains when it is not stable
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: NeilBrown <[email protected]>
commit bcc7f5b4bee8e327689a4d994022765855c807ff upstream.
bdev->bd_contains is not stable before calling __blkdev_get(). When __blkdev_get() is called on a parition with ->bd_openers == 0 it sets
bdev->bd_contains = bdev;
which is not correct for a partition.
After a call to __blkdev_get() succeeds, ->bd_openers will be > 0 and then ->bd_contains is stable.
When FMODE_EXCL is used, blkdev_get() calls
bd_start_claiming() -> bd_prepare_to_claim() -> bd_may_claim()
This call happens before __blkdev_get() is called, so ->bd_contains is not stable. So bd_may_claim() cannot safely use ->bd_contains. It currently tries to use it, and this can lead to a BUG_ON().
This happens when a whole device is already open with a bd_holder (in use by dm in my particular example) and two threads race to open a partition of that device for the first time, one opening with O_EXCL and one without.
The thread that doesn't use O_EXCL gets through blkdev_get() to __blkdev_get(), gains the ->bd_mutex, and sets bdev->bd_contains = bdev;
Immediately thereafter the other thread, using FMODE_EXCL, calls bd_start_claiming() from blkdev_get(). This should fail because the whole device has a holder, but because bdev->bd_contains == bdev bd_may_claim() incorrectly reports success.
This thread continues and blocks on bd_mutex.
The first thread then sets bdev->bd_contains correctly and drops the mutex. The thread using FMODE_EXCL then continues and when it calls bd_may_claim() again in:
BUG_ON(!bd_may_claim(bdev, whole, holder));
The BUG_ON fires.
Fix this by removing the dependency on ->bd_contains in bd_may_claim(). As bd_may_claim() has direct access to the whole device, it can simply test if the target bdev is the whole device.
--- fs/block_dev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/block_dev.c +1 -1
@@ -837,7 +837,7 @@ static bool bd_may_claim(struct block_dereturn true;/* already a holder */ else if (bdev->bd_holder != NULL) return false; /* held by someone else */ - else if (bdev->bd_contains == bdev) + else if (whole == bdev) return true; /* is a whole device which isn't held */ else if (whole->bd_holder == bd_may_claim)
Greg Kroah-Hartman
maintainerPATCH 41/85 mm: Add a user_ns owner to mm_struct and fix ptrace permission checks
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
commit bfedb589252c01fa505ac9f6f2a3d5d68d707ef4 upstream.
During exec dumpable is cleared if the file that is being executed is not readable by the user executing the file. A bug in ptrace_may_access allows reading the file if the executable happens to enter into a subordinate user namespace (aka clone(CLONE_NEWUSER), unshare(CLONE_NEWUSER), or setns(fd, CLONE_NEWUSER).
This problem is fixed with only necessary userspace breakage by adding a user namespace owner to mm_struct, captured at the time of exec, so it is clear in which user namespace CAP_SYS_PTRACE must be present in to be able to safely give read permission to the executable.
The function ptrace_may_access is modified to verify that the ptracer has CAP_SYS_ADMIN in task->mm->user_ns instead of task->cred->user_ns. This ensures that if the task changes it's cred into a subordinate user namespace it does not become ptraceable.
The function ptrace_attach is modified to only set PT_PTRACE_CAP when CAP_SYS_PTRACE is held over task->mm->user_ns. The intent of PT_PTRACE_CAP is to be a flag to note that whatever permission changes the task might go through the tracer has sufficient permissions for it not to be an issue. task->cred->user_ns is always the same as or descendent of mm->user_ns. Which guarantees that having CAP_SYS_PTRACE over mm->user_ns is the worst case for the tasks credentials.
To prevent regressions mm->dumpable and mm->user_ns are not considered when a task has no mm. As simply failing ptrace_may_attach causes regressions in privileged applications attempting to read things such as /proc/<pid>/stat
--- include/linux/mm_types.h | 1 + kernel/fork.c | 9 ++++++--- kernel/ptrace.c | 26 +++++++++++--------------- mm/init-mm.c | 2 ++ 4 files changed, 20 insertions(+), 18 deletions(-)
include/linux/mm_types.h +1 -0
@@ -473,6 +473,7 @@ struct mm_struct {*/ struct task_struct __rcu *owner;#endif +struct user_namespace *user_ns;/* store ref to file /proc/<pid>/exe symlink points to */ struct file __rcu *exe_file;
kernel/fork.c +6 -3
@@ -598,7 +598,8 @@ static void mm_init_owner(struct mm_stru#endif } -static struct mm_struct *mm_init (struct mm_struct *mm,struct task_struct *p) +static struct mm_struct *mm_init (struct mm_struct *mm,struct task_struct *p, +struct user_namespace *user_ns) { mm->mmap =NULL ; mm->mm_rb =RB_ROOT ;
@@ -638,6 +639,7 @@ static struct mm_struct *mm_init(structif (init_new_context (p, mm)) goto fail_nocontext; + mm->user_ns =get_user_ns (user_ns);return mm; fail_nocontext:
@@ -683,7 +685,7 @@ struct mm_struct *mm_alloc(void)return NULL ;memset (mm,0 ,sizeof (*mm)); -return mm_init (mm, current); +return mm_init (mm, current,current_user_ns ()); }/*
@@ -698,6 +700,7 @@ void __mmdrop(struct mm_struct *mm)destroy_context (mm);mmu_notifier_mm_destroy (mm);check_mm (mm); +put_user_ns (mm->user_ns);free_mm (mm); }EXPORT_SYMBOL_GPL (__mmdrop);
@@ -977,7 +980,7 @@ static struct mm_struct *dup_mm(struct tmemcpy (mm, oldmm,sizeof (*mm)); -if (!mm_init (mm, tsk)) +if (!mm_init (mm, tsk, mm->user_ns)) goto fail_nomem; err =dup_mmap (mm, oldmm);
kernel/ptrace.c +11 -15
@@ -218,7 +218,7 @@ static int ptrace_has_cap(struct user_nastatic int __ptrace_may_access (struct task_struct *task,unsigned int mode) {const struct cred *cred =current_cred (), *tcred; -int dumpable =0 ; +struct mm_struct *mm;kuid_t caller_uid;kgid_t caller_gid;
@@ -269,16 +269,11 @@ static int __ptrace_may_access(struct tareturn -EPERM ; ok:rcu_read_unlock (); -smp_rmb (); -if (task->mm) - dumpable =get_dumpable (task->mm); -rcu_read_lock (); -if (dumpable !=SUID_DUMP_USER && - !ptrace_has_cap (__task_cred (task)->user_ns, mode)) { -rcu_read_unlock (); -return -EPERM ; - } -rcu_read_unlock (); + mm = task->mm; +if (mm && + ((get_dumpable (mm) !=SUID_DUMP_USER ) && + !ptrace_has_cap (mm->user_ns, mode))) +return -EPERM ;return security_ptrace_access_check (task, mode); }
@@ -329,6 +324,11 @@ static int ptrace_attach(struct task_strtask_lock (task); retval =__ptrace_may_access (task,PTRACE_MODE_ATTACH_REALCREDS ); +if (!retval) { +struct mm_struct *mm = task->mm; +if (mm &&ns_capable (mm->user_ns,CAP_SYS_PTRACE )) + flags |=PT_PTRACE_CAP ; + }task_unlock (task);if (retval) goto unlock_creds;
@@ -342,10 +342,6 @@ static int ptrace_attach(struct task_strif (seize) flags |=PT_SEIZED ; -rcu_read_lock (); -if (ns_capable (__task_cred (task)->user_ns,CAP_SYS_PTRACE )) - flags |=PT_PTRACE_CAP ; -rcu_read_unlock (); task->ptrace = flags;__ptrace_link (task, current);
mm/init-mm.c +2 -0
@@ -6,6 +6,7 @@#include <linux/cpumask.h> #include <linux/atomic.h> +#include <linux/user_namespace.h> #include <asm/pgtable.h> #include <asm/mmu.h>
@@ -21,5 +22,6 @@ struct mm_struct init_mm = { .mmap_sem = __RWSEM_INITIALIZER(init_mm.mmap_sem), .page_table_lock = __SPIN_LOCK_UNLOCKED(init_mm.page_table_lock), .mmlist = LIST_HEAD_INIT(init_mm.mmlist), + .user_ns = &init_user_ns, INIT_MM_CONTEXT(init_mm) };
Greg Kroah-Hartman
maintainerPATCH 42/85 vfs,mm: fix return value of read() at s_maxbytes
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Linus Torvalds <[email protected]>
commit d05c5f7ba164aed3db02fb188c26d0dd94f5455b upstream.
We truncated the possible read iterator to s_maxbytes in commit c2a9737f45e2 ("vfs,mm: fix a dead loop in truncate_inode_pages_range()"), but our end condition handling was wrong: it's not an error to try to read at the end of the file.
Reading past the end should return EOF (0), not EINVAL.
See for example
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1649342
http://lists.gnu.org/archive/html/bug-coreutils/2016-12/msg00008.html
where a md5sum of a maximally sized file fails because the final read is exactly at s_maxbytes.
--- mm/filemap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
mm/filemap.c +1 -1
@@ -1688,7 +1688,7 @@ static ssize_t do_generic_file_read(struint error =0 ;if (unlikely (*ppos >= inode->i_sb->s_maxbytes)) -return -EINVAL ; +return 0 ;iov_iter_truncate (iter, inode->i_sb->s_maxbytes); index = *ppos >>PAGE_SHIFT ;
Greg Kroah-Hartman
maintainerPATCH 43/85 ptrace: Capture the ptracers creds not PT_PTRACE_CAP
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric W. Biederman <[email protected]>
commit 64b875f7ac8a5d60a4e191479299e931ee949b67 upstream.
When the flag PT_PTRACE_CAP was added the PTRACE_TRACEME path was overlooked. This can result in incorrect behavior when an application like strace traces an exec of a setuid executable.
Further PT_PTRACE_CAP does not have enough information for making good security decisions as it does not report which user namespace the capability is in. This has already allowed one mistake through insufficient granulariy.
I found this issue when I was testing another corner case of exec and discovered that I could not get strace to set PT_PTRACE_CAP even when running strace as root with a full set of caps.
This change fixes the above issue with strace allowing stracing as root a setuid executable without disabling setuid. More fundamentaly this change allows what is allowable at all times, by using the correct information in it's decision.
--- fs/exec.c | 2 +- include/linux/capability.h | 1 + include/linux/ptrace.h | 1 - include/linux/sched.h | 1 + kernel/capability.c | 20 ++++++++++++++++++++ kernel/ptrace.c | 12 +++++++----- 6 files changed, 30 insertions(+), 7 deletions(-)
fs/exec.c +1 -1
@@ -1420,7 +1420,7 @@ static void check_unsafe_exec(struct linunsigned n_fs;if (p->ptrace) { -if (p->ptrace &PT_PTRACE_CAP ) +if (ptracer_capable (p,current_user_ns ())) bprm->unsafe |=LSM_UNSAFE_PTRACE_CAP ;else bprm->unsafe |=LSM_UNSAFE_PTRACE ;
include/linux/capability.h +1 -0
@@ -243,6 +243,7 @@ static inline bool ns_capable_noaudit(stextern bool privileged_wrt_inode_uidgid (struct user_namespace *ns,const struct inode *inode);extern bool capable_wrt_inode_uidgid (const struct inode *inode,int cap);extern bool file_ns_capable (const struct file *file,struct user_namespace *ns,int cap); +extern bool ptracer_capable (struct task_struct *tsk,struct user_namespace *ns);/* audit system wants to get cap info from files as well */ extern int get_vfs_caps_from_disk (const struct dentry *dentry,struct cpu_vfs_cap_data *cpu_caps);
include/linux/ptrace.h +0 -1
@@ -19,7 +19,6 @@#define PT_SEIZED 0x00010000/* SEIZE used, enable new behavior */ #define PT_PTRACED 0x00000001#define PT_DTRACE 0x00000002/* delayed trace (used on m68k, i386) */ -#define PT_PTRACE_CAP 0x00000004/* ptracer can follow suid-exec */ #define PT_OPT_FLAG_SHIFT 3/* PT_TRACE_* event enable flags */
include/linux/sched.h +1 -0
@@ -1631,6 +1631,7 @@ struct task_struct {struct list_head cpu_timers[3 ];/* process credentials */ +const struct cred __rcu *ptracer_cred;/* Tracer's credentials at attach */ const struct cred __rcu *real_cred;/* objective and real subjective task * credentials (COW) */ const struct cred __rcu *cred;/* effective (overridable) subjective task
kernel/capability.c +20 -0
@@ -485,3 +485,23 @@ bool capable_wrt_inode_uidgid(const strureturn ns_capable (ns, cap) &&privileged_wrt_inode_uidgid (ns, inode); }EXPORT_SYMBOL (capable_wrt_inode_uidgid); + +/** +* ptracer_capable - Determine if the ptracer holds CAP_SYS_PTRACE in the namespace +* @tsk: The task that may be ptraced +* @ns: The user namespace to search for CAP_SYS_PTRACE in +* +* Return true if the task that is ptracing the current task had CAP_SYS_PTRACE +* in the specified user namespace. +*/ +bool ptracer_capable (struct task_struct *tsk,struct user_namespace *ns) +{ +int ret =0 ;/* An absent tracer adds no restrictions */ +const struct cred *cred; +rcu_read_lock (); + cred =rcu_dereference (tsk->ptracer_cred); +if (cred) + ret =security_capable_noaudit (cred, ns,CAP_SYS_PTRACE ); +rcu_read_unlock (); +return (ret ==0 ); +}
kernel/ptrace.c +7 -5
@@ -39,6 +39,9 @@ void __ptrace_link(struct task_struct *cBUG_ON (!list_empty (&child->ptrace_entry));list_add (&child->ptrace_entry, &new_parent->ptraced); child->parent = new_parent; +rcu_read_lock (); + child->ptracer_cred =get_cred (__task_cred (new_parent)); +rcu_read_unlock (); }/**
@@ -71,10 +74,14 @@ void __ptrace_link(struct task_struct *c*/ void __ptrace_unlink (struct task_struct *child) { +const struct cred *old_cred;BUG_ON (!child->ptrace); child->parent = child->real_parent;list_del_init (&child->ptrace_entry); + old_cred = child->ptracer_cred; + child->ptracer_cred =NULL ; +put_cred (old_cred);spin_lock (&child->sighand->siglock); child->ptrace =0 ;
@@ -324,11 +331,6 @@ static int ptrace_attach(struct task_strtask_lock (task); retval =__ptrace_may_access (task,PTRACE_MODE_ATTACH_REALCREDS ); -if (!retval) { -struct mm_struct *mm = task->mm; -if (mm &&ns_capable (mm->user_ns,CAP_SYS_PTRACE )) - flags |=PT_PTRACE_CAP ; - }task_unlock (task);if (retval) goto unlock_creds;
Greg Kroah-Hartman
maintainerPATCH 45/85 ext4: fix mballoc breakage with 64k block size
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chandan Rajendra <[email protected]>
commit 69e43e8cc971a79dd1ee5d4343d8e63f82725123 upstream.
'border' variable is set to a value of 2 times the block size of the underlying filesystem. With 64k block size, the resulting value won't fit into a 16-bit variable. Hence this commit changes the data type of 'border' to 'unsigned int'.
--- fs/ext4/mballoc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/mballoc.c +1 -1
@@ -669,7 +669,7 @@ static void ext4_mb_mark_free_simple(strext4_grpblk_t min;ext4_grpblk_t max;ext4_grpblk_t chunk; -unsigned short border; +unsigned int border;BUG_ON (len >EXT4_CLUSTERS_PER_GROUP (sb));
Greg Kroah-Hartman
maintainerPATCH 46/85 ext4: fix stack memory corruption with 64k block size
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Chandan Rajendra <[email protected]>
commit 30a9d7afe70ed6bd9191d3000e2ef1a34fb58493 upstream.
The number of 'counters' elements needed in 'struct sg' is super_block->s_blocksize_bits + 2. Presently we have 16 'counters' elements in the array. This is insufficient for block sizes >= 32k. In such cases the memcpy operation performed in ext4_mb_seq_groups_show() would cause stack memory corruption.
--- fs/ext4/mballoc.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/ext4/mballoc.c +1 -1
@@ -2287,7 +2287,7 @@ static int ext4_mb_seq_groups_show(strucstruct ext4_group_info *grinfo;struct sg {struct ext4_group_info info; -ext4_grpblk_t counters[16 ]; +ext4_grpblk_t counters[EXT4_MAX_BLOCK_LOG_SIZE +2 ]; } sg; group--;
Greg Kroah-Hartman
maintainerPATCH 47/85 ext4: use more strict checks for inodes_per_block on mount
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit cd6bb35bf7f6d7d922509bf50265383a0ceabe96 upstream.
Centralize the checks for inodes_per_block and be more strict to make sure the inodes_per_block_group can't end up being zero.
--- fs/ext4/super.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-)
fs/ext4/super.c +6 -9
@@ -3613,12 +3613,16 @@ static int ext4_fill_super(struct super_ sbi->s_blocks_per_group =le32_to_cpu (es->s_blocks_per_group); sbi->s_inodes_per_group =le32_to_cpu (es->s_inodes_per_group); -if (EXT4_INODE_SIZE (sb) ==0 ||EXT4_INODES_PER_GROUP (sb) ==0 ) - goto cantfind_ext4; sbi->s_inodes_per_block = blocksize /EXT4_INODE_SIZE (sb);if (sbi->s_inodes_per_block ==0 ) goto cantfind_ext4; +if (sbi->s_inodes_per_group < sbi->s_inodes_per_block || + sbi->s_inodes_per_group > blocksize *8 ) { +ext4_msg (sb,KERN_ERR ,"invalid inodes per group: %lu\n" , + sbi->s_blocks_per_group); + goto failed_mount; + } sbi->s_itb_per_group = sbi->s_inodes_per_group / sbi->s_inodes_per_block; sbi->s_desc_per_block = blocksize /EXT4_DESC_SIZE (sb);
@@ -3701,13 +3705,6 @@ static int ext4_fill_super(struct super_ } sbi->s_cluster_ratio = clustersize / blocksize; -if (sbi->s_inodes_per_group > blocksize *8 ) { -ext4_msg (sb,KERN_ERR , -"#inodes per group too big: %lu" , - sbi->s_inodes_per_group); - goto failed_mount; - } -/* Do we have standard group size of clustersize * 8 blocks ? */ if (sbi->s_blocks_per_group == clustersize <<3 )set_opt2 (sb,STD_GROUP_SIZE );
Greg Kroah-Hartman
maintainerPATCH 48/85 ext4: fix in-superblock mount options processing
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit 5aee0f8a3f42c94c5012f1673420aee96315925a upstream.
Fix a large number of problems with how we handle mount options in the superblock. For one, if the string in the superblock is long enough that it is not null terminated, we could run off the end of the string and try to interpret superblocks fields as characters. It's unlikely this will cause a security problem, but it could result in an invalid parse. Also, parse_options is destructive to the string, so in some cases if there is a comma-separated string, it would be modified in the superblock. (Fortunately it only happens on file systems with a 1k block size.)
--- fs/ext4/super.c | 38 +++++++++++++++++++++++--------------- 1 file changed, 23 insertions(+), 15 deletions(-)
fs/ext4/super.c +23 -15
@@ -3254,7 +3254,7 @@ static int ext4_fill_super(struct super_char *orig_data =kstrdup (data,GFP_KERNEL );struct buffer_head *bh;struct ext4_super_block *es =NULL ; -struct ext4_sb_info *sbi; +struct ext4_sb_info *sbi =kzalloc (sizeof (*sbi),GFP_KERNEL );ext4_fsblk_t block;ext4_fsblk_t sb_block =get_sb_block (&data);ext4_fsblk_t logical_sb_block;
@@ -3273,16 +3273,14 @@ static int ext4_fill_super(struct super_unsigned int journal_ioprio =DEFAULT_JOURNAL_IOPRIO ;ext4_group_t first_not_zeroed; - sbi =kzalloc (sizeof (*sbi),GFP_KERNEL ); -if (!sbi) - goto out_free_orig; +if ((data && !orig_data) || !sbi) + goto out_free_base; sbi->s_blockgroup_lock =kzalloc (sizeof (struct blockgroup_lock ),GFP_KERNEL ); -if (!sbi->s_blockgroup_lock) { -kfree (sbi); - goto out_free_orig; - } +if (!sbi->s_blockgroup_lock) + goto out_free_base; + sb->s_fs_info = sbi; sbi->s_sb = sb; sbi->s_inode_readahead_blks =EXT4_DEF_INODE_READAHEAD_BLKS ;
@@ -3428,11 +3426,19 @@ static int ext4_fill_super(struct super_*/ sbi->s_li_wait_mult =EXT4_DEF_LI_WAIT_MULT ; -if (!parse_options ((char *) sbi->s_es->s_mount_opts, sb, - &journal_devnum, &journal_ioprio,0 )) { -ext4_msg (sb,KERN_WARNING , -"failed to parse options in superblock: %s" , - sbi->s_es->s_mount_opts); +if (sbi->s_es->s_mount_opts[0 ]) { +char *s_mount_opts =kstrndup (sbi->s_es->s_mount_opts, +sizeof (sbi->s_es->s_mount_opts), +GFP_KERNEL ); +if (!s_mount_opts) + goto failed_mount; +if (!parse_options (s_mount_opts, sb, &journal_devnum, + &journal_ioprio,0 )) { +ext4_msg (sb,KERN_WARNING , +"failed to parse options in superblock: %s" , + s_mount_opts); + } +kfree (s_mount_opts); } sbi->s_def_mount_opt = sbi->s_mount_opt; if (!parse_options((char *) data, sb, &journal_devnum,
@@ -4110,7 +4116,9 @@ no_journal:if (___ratelimit (&ext4_mount_msg_ratelimit,"EXT4-fs mount" ))ext4_msg (sb,KERN_INFO ,"mounted filesystem with%s. " -"Opts: %s%s%s" , descr, sbi->s_es->s_mount_opts, +"Opts: %.*s%s%s" , descr, + (int )sizeof (sbi->s_es->s_mount_opts), + sbi->s_es->s_mount_opts, *sbi->s_es->s_mount_opts ?"; " :"" , orig_data);if (es->s_error_count)
@@ -4189,8 +4197,8 @@ failed_mount: out_fail: sb->s_fs_info =NULL ;kfree (sbi->s_blockgroup_lock); +out_free_base:kfree (sbi); -out_free_orig:kfree (orig_data);return err ? err : ret; }
Greg Kroah-Hartman
maintainerPATCH 49/85 ext4: add sanity checking to count_overhead()
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Theodore Ts'o <[email protected]>
commit c48ae41bafe31e9a66d8be2ced4e42a6b57fa814 upstream.
The commit "ext4: sanity check the block and cluster size at mount time" should prevent any problems, but in case the superblock is modified while the file system is mounted, add an extra safety check to make sure we won't overrun the allocated buffer.
--- fs/ext4/super.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-)
fs/ext4/super.c +8 -3
@@ -3161,10 +3161,15 @@ static int count_overhead(struct super_bext4_set_bit (s++, buf); count++; } -for (j =ext4_bg_num_gdb (sb, grp); j >0 ; j--) { -ext4_set_bit (EXT4_B2C (sbi, s++), buf); - count++; + j =ext4_bg_num_gdb (sb, grp); +if (s + j >EXT4_BLOCKS_PER_GROUP (sb)) { +ext4_error (sb,"Invalid number of block group " +"descriptor blocks: %d" , j); + j =EXT4_BLOCKS_PER_GROUP (sb) - s; } + count += j; +for (; j >0 ; j--) +ext4_set_bit (EXT4_B2C (sbi, s++), buf); }if (!count)return 0 ;
Greg Kroah-Hartman
maintainerPATCH 50/85 ext4: reject inodes with negative size
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Darrick J. Wong <[email protected]>
commit 7e6e1ef48fc02f3ac5d0edecbb0c6087cd758d58 upstream.
Don't load an inode with a negative size; this causes integer overflow problems in the VFS.
[ Added EXT4_ERROR_INODE() to mark file system as corrupted. -TYT]
--- fs/ext4/inode.c | 6 ++++++ 1 file changed, 6 insertions(+)
fs/ext4/inode.c +6 -0
@@ -4438,6 +4438,7 @@ struct inode *ext4_iget(struct super_blostruct inode *inode;journal_t *journal =EXT4_SB (sb)->s_journal;long ret; +loff_t size;int block;uid_t i_uid;gid_t i_gid;
@@ -4538,6 +4539,11 @@ struct inode *ext4_iget(struct super_blo ei->i_file_acl |= ((__u64 )le16_to_cpu (raw_inode->i_file_acl_high)) <<32 ; inode->i_size =ext4_isize (raw_inode); +if ((size =i_size_read (inode)) <0 ) { +EXT4_ERROR_INODE (inode,"bad i_size value: %lld" , size); + ret = -EFSCORRUPTED ; + goto bad_inode; + } ei->i_disksize = inode->i_size;#ifdef CONFIG_QUOTA ei->i_reserved_quota =0 ;
Greg Kroah-Hartman
maintainerPATCH 51/85 ext4: return -ENOMEM instead of success
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Dan Carpenter <[email protected]>
commit 578620f451f836389424833f1454eeeb2ffc9e9f upstream.
We should set the error code if kzalloc() fails.
--- fs/ext4/inline.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
fs/ext4/inline.c +3 -1
@@ -336,8 +336,10 @@ static int ext4_update_inline_data(handl len -=EXT4_MIN_INLINE_DATA_SIZE ; value =kzalloc (len,GFP_NOFS ); -if (!value) +if (!value) { + error = -ENOMEM ; goto out; + } error =ext4_xattr_ibody_get (inode, i.name_index, i.name, value, len);
Greg Kroah-Hartman
maintainerPATCH 52/85 ext4: do not perform data journaling when data is encrypted
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Sergey Karamov <[email protected]>
commit 73b92a2a5e97d17cc4d5c4fe9d724d3273fb6fd2 upstream.
Currently data journalling is incompatible with encryption: enabling both at the same time has never been supported by design, and would result in unpredictable behavior. However, users are not precluded from turning on both features simultaneously. This change programmatically replaces data journaling for encrypted regular files with ordered data journaling mode.
Background:
Journaling encrypted data has not been supported because it operates on buffer heads of the page in the page cache. Namely, when the commit happens, which could be up to five seconds after caching, the commit thread uses the buffer heads attached to the page to copy the contents of the page to the journal. With encryption, it would have been required to keep the bounce buffer with ciphertext for up to the aforementioned five seconds, since the page cache can only hold plaintext and could not be used for journaling. Alternatively, it would be required to setup the journal to initiate a callback at the commit time to perform deferred encryption - in this case, not only would the data have to be written twice, but it would also have to be encrypted twice. This level of complexity was not justified for a mode that in practice is very rarely used because of the overhead from the data journalling.
Solution:
If data=journaled has been set as a mount option for a filesystem, or if journaling is enabled on a regular file, do not perform journaling if the file is also encrypted, instead fall back to the data=ordered mode for the file.
Rationale:
The intent is to allow seamless and proper filesystem operation when journaling and encryption have both been enabled, and have these two conflicting features gracefully resolved by the filesystem.
--- fs/ext4/ext4_jbd2.h | 14 ++++++++------ fs/ext4/super.c | 5 +++++ 2 files changed, 13 insertions(+), 6 deletions(-)
fs/ext4/ext4_jbd2.h +8 -6
@@ -414,17 +414,19 @@ static inline int ext4_inode_journal_modreturn EXT4_INODE_WRITEBACK_DATA_MODE ;/* writeback */ /* We do not support data journalling with delayed allocation */ if (!S_ISREG (inode->i_mode) || -test_opt (inode->i_sb,DATA_FLAGS ) ==EXT4_MOUNT_JOURNAL_DATA ) -return EXT4_INODE_JOURNAL_DATA_MODE ;/* journal data */ -if (ext4_test_inode_flag (inode,EXT4_INODE_JOURNAL_DATA ) && - !test_opt (inode->i_sb,DELALLOC )) +test_opt (inode->i_sb,DATA_FLAGS ) ==EXT4_MOUNT_JOURNAL_DATA || + (ext4_test_inode_flag (inode,EXT4_INODE_JOURNAL_DATA ) && + !test_opt (inode->i_sb,DELALLOC ))) { +/* We do not support data journalling for encrypted data */ +if (S_ISREG (inode->i_mode) &&ext4_encrypted_inode (inode)) +return EXT4_INODE_ORDERED_DATA_MODE ;/* ordered */ return EXT4_INODE_JOURNAL_DATA_MODE ;/* journal data */ + }if (test_opt (inode->i_sb,DATA_FLAGS ) ==EXT4_MOUNT_ORDERED_DATA )return EXT4_INODE_ORDERED_DATA_MODE ;/* ordered */ if (test_opt (inode->i_sb,DATA_FLAGS ) ==EXT4_MOUNT_WRITEBACK_DATA )return EXT4_INODE_WRITEBACK_DATA_MODE ;/* writeback */ -else -BUG (); +BUG (); }static inline int ext4_should_journal_data (struct inode *inode)
fs/ext4/super.c +5 -0
@@ -3469,6 +3469,11 @@ static int ext4_fill_super(struct super_ "both data=journal and dax"); goto failed_mount; } +if (ext4_has_feature_encrypt (sb)) { +ext4_msg (sb,KERN_WARNING , +"encrypted files will use data=ordered " +"instead of data journaling mode" ); + }if (test_opt (sb,DELALLOC ))clear_opt (sb,DELALLOC ); }else {
Greg Kroah-Hartman
maintainerPATCH 53/85 Revert "f2fs: use percpu_counter for # of dirty pages in inode"
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
commit 204706c7accfabb67b97eef9f9a28361b6201199 upstream.
This reverts commit 1beba1b3a953107c3ff5448ab4e4297db4619c76.
The perpcu_counter doesn't provide atomicity in single core and consume more DRAM. That incurs fs_mark test failure due to ENOMEM.
--- fs/f2fs/f2fs.h | 10 +++++----- fs/f2fs/file.c | 2 +- fs/f2fs/super.c | 7 +------ 3 files changed, 7 insertions(+), 12 deletions(-)
fs/f2fs/f2fs.h +5 -5
@@ -451,7 +451,7 @@ struct f2fs_inode_info {/* Use below internally in f2fs*/ unsigned long flags;/* use to pass per-file flags */ struct rw_semaphore i_sem;/* protect fi info */ -struct percpu_counter dirty_pages;/* # of dirty pages */ +atomic_t dirty_pages;/* # of dirty pages */ f2fs_hash_t chash;/* hash value of given file name */ unsigned int clevel;/* maximum level of given file name */ nid_t i_xattr_nid;/* node id that contains xattrs */
@@ -1198,7 +1198,7 @@ static inline void inc_page_count(structstatic inline void inode_inc_dirty_pages (struct inode *inode) { -percpu_counter_inc (&F2FS_I (inode)->dirty_pages); +atomic_inc (&F2FS_I (inode)->dirty_pages);inc_page_count (F2FS_I_SB (inode),S_ISDIR (inode->i_mode) ?F2FS_DIRTY_DENTS :F2FS_DIRTY_DATA ); }
@@ -1214,7 +1214,7 @@ static inline void inode_dec_dirty_pages !S_ISLNK(inode->i_mode))return ; -percpu_counter_dec (&F2FS_I (inode)->dirty_pages); +atomic_dec (&F2FS_I (inode)->dirty_pages);dec_page_count (F2FS_I_SB (inode),S_ISDIR (inode->i_mode) ?F2FS_DIRTY_DENTS :F2FS_DIRTY_DATA ); }
@@ -1224,9 +1224,9 @@ static inline s64 get_pages(struct f2fs_return percpu_counter_sum_positive (&sbi->nr_pages[count_type]); } -static inline s64 get_dirty_pages (struct inode *inode) +static inline int get_dirty_pages (struct inode *inode) { -return percpu_counter_sum_positive (&F2FS_I (inode)->dirty_pages); +return atomic_read (&F2FS_I (inode)->dirty_pages); }static inline int get_blocktype_secs (struct f2fs_sb_info *sbi,int block_type)
fs/f2fs/file.c +1 -1
@@ -1529,7 +1529,7 @@ static int f2fs_ioc_start_atomic_write(s goto out;f2fs_msg (F2FS_I_SB (inode)->sb,KERN_WARNING , -"Unexpected flush for atomic writes: ino=%lu, npages=%lld" , +"Unexpected flush for atomic writes: ino=%lu, npages=%u" , inode->i_ino,get_dirty_pages (inode)); ret =filemap_write_and_wait_range (inode->i_mapping,0 ,LLONG_MAX );if (ret)
fs/f2fs/super.c +1 -6
@@ -565,13 +565,9 @@ static struct inode *f2fs_alloc_inode(stinit_once ((void *) fi); -if (percpu_counter_init (&fi->dirty_pages,0 ,GFP_NOFS )) { -kmem_cache_free (f2fs_inode_cachep, fi); -return NULL ; - } -/* Initialize f2fs-specific inode info */ fi->vfs_inode.i_version =1 ; +atomic_set (&fi->dirty_pages,0 ); fi->i_current_depth =1 ; fi->i_advise =0 ;init_rwsem (&fi->i_sem);
@@ -694,7 +690,6 @@ static void f2fs_i_callback(struct rcu_hstatic void f2fs_destroy_inode (struct inode *inode) { -percpu_counter_destroy (&F2FS_I (inode)->dirty_pages);call_rcu (&inode->i_rcu, f2fs_i_callback); }
Greg Kroah-Hartman
maintainerPATCH 54/85 f2fs: set ->owner for debugfs status files file_operations
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nicolai Stange <[email protected]>
commit 05e6ea2685c964db1e675a24a4f4e2adc22d2388 upstream.
The struct file_operations instance serving the f2fs/status debugfs file lacks an initialization of its ->owner.
This means that although that file might have been opened, the f2fs module can still get removed. Any further operation on that opened file, releasing included, will cause accesses to unmapped memory.
Indeed, Mike Marshall reported the following:
BUG: unable to handle kernel paging request at ffffffffa0307430 IP: [<ffffffff8132a224>] full_proxy_release+0x24/0x90 <...> Call Trace: [] __fput+0xdf/0x1d0 [] ____fput+0xe/0x10 [] task_work_run+0x8e/0xc0 [] do_exit+0x2ae/0xae0 [] ? __audit_syscall_entry+0xae/0x100 [] ? syscall_trace_enter+0x1ca/0x310 [] do_group_exit+0x44/0xc0 [] SyS_exit_group+0x14/0x20 [] do_syscall_64+0x61/0x150 [] entry_SYSCALL64_slow_path+0x25/0x25 <...> ---[ end trace f22ae883fa3ea6b8 ]--- Fixing recursive fault but reboot is needed!
Fix this by initializing the f2fs/status file_operations' ->owner with THIS_MODULE.
This will allow debugfs to grab a reference to the f2fs module upon any open on that file, thus preventing it from getting removed.
--- fs/f2fs/debug.c | 1 + 1 file changed, 1 insertion(+)
fs/f2fs/debug.c +1 -0
@@ -362,6 +362,7 @@ static int stat_open(struct inode *inode }static const struct file_operations stat_fops = { + .owner =THIS_MODULE , .open = stat_open, .read = seq_read, .llseek = seq_lseek,
Greg Kroah-Hartman
maintainerPATCH 55/85 f2fs: fix overflow due to condition check order
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jaegeuk Kim <[email protected]>
commit e87f7329bbd6760c2acc4f1eb423362b08851a71 upstream.
In the last ilen case, i was already increased, resulting in accessing out- of-boundary entry of do_replace and blkaddr.
Fix to check ilen first to exit the loop.
--- fs/f2fs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/f2fs/file.c +1 -1
@@ -970,7 +970,7 @@ static int __clone_blkaddrs(struct inode new_size = (dst + i) <<PAGE_SHIFT ;if (dst_inode->i_size < new_size)f2fs_i_size_write (dst_inode, new_size); - }while ((do_replace[i] || blkaddr[i] ==NULL_ADDR ) && --ilen); + }while (--ilen && (do_replace[i] || blkaddr[i] ==NULL_ADDR ));f2fs_put_dnode (&dn); }else {
Greg Kroah-Hartman
maintainerPATCH 56/85 loop: return proper error from loop_queue_rq()
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Omar Sandoval <[email protected]>
commit b4a567e8114327518c09f5632339a5954ab975a3 upstream.
->queue_rq() should return one of the BLK_MQ_RQ_QUEUE_* constants, not an errno.
--- drivers/block/loop.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/block/loop.c +1 -1
@@ -1646,7 +1646,7 @@ static int loop_queue_rq(struct blk_mq_hblk_mq_start_request (bd->rq);if (lo->lo_state != Lo_bound) -return -EIO ; +return BLK_MQ_RQ_QUEUE_ERROR ;switch (req_op (cmd->rq)) {case REQ_OP_FLUSH :
Greg Kroah-Hartman
maintainerPATCH 57/85 nvmet: Fix possible infinite loop triggered on hot namespace removal
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Solganik Alexander <[email protected]>
commit e4fcf07cca6a3b6c4be00df16f08be894325eaa3 upstream.
When removing a namespace we delete it from the subsystem namespaces list with list_del_init which allows us to know if it is enabled or not.
The problem is that list_del_init initialize the list next and does not respect the RCU list-traversal we do on the IO path for locating a namespace. Instead we need to use list_del_rcu which is allowed to run concurrently with the _rcu list-traversal primitives (keeps list next intact) and guarantees concurrent nvmet_find_naespace forward progress.
By changing that, we cannot rely on ns->dev_link for knowing if the namspace is enabled, so add enabled indicator entry to nvmet_ns for that.
--- drivers/nvme/target/configfs.c | 6 +++--- drivers/nvme/target/core.c | 14 ++++++++------ drivers/nvme/target/nvmet.h | 6 +----- 3 files changed, 12 insertions(+), 14 deletions(-)
drivers/nvme/target/configfs.c +3 -3
@@ -271,7 +271,7 @@ static ssize_t nvmet_ns_device_path_stormutex_lock (&subsys->lock); ret = -EBUSY ; -if (nvmet_ns_enabled (ns)) +if (ns->enabled) goto out_unlock;kfree (ns->device_path);
@@ -307,7 +307,7 @@ static ssize_t nvmet_ns_device_nguid_stoint ret =0 ;mutex_lock (&subsys->lock); -if (nvmet_ns_enabled (ns)) { +if (ns->enabled) { ret = -EBUSY ; goto out_unlock; }
@@ -339,7 +339,7 @@ CONFIGFS_ATTR(nvmet_ns_, device_nguid);static ssize_t nvmet_ns_enable_show (struct config_item *item,char *page) { -return sprintf (page,"%d\n" ,nvmet_ns_enabled (to_nvmet_ns (item))); +return sprintf (page,"%d\n" ,to_nvmet_ns (item)->enabled); } static ssize_t nvmet_ns_enable_store(struct config_item *item,
drivers/nvme/target/core.c +8 -6
@@ -264,7 +264,7 @@ int nvmet_ns_enable(struct nvmet_ns *ns)int ret =0 ;mutex_lock (&subsys->lock); -if (!list_empty (&ns->dev_link)) +if (ns->enabled) goto out_unlock; ns->bdev = blkdev_get_by_path(ns->device_path, FMODE_READ | FMODE_WRITE,
@@ -309,6 +309,7 @@ int nvmet_ns_enable(struct nvmet_ns *ns)list_for_each_entry (ctrl, &subsys->ctrls, subsys_entry)nvmet_add_async_event (ctrl,NVME_AER_TYPE_NOTICE ,0 ,0 ); + ns->enabled = true; ret =0 ; out_unlock:mutex_unlock (&subsys->lock);
@@ -325,11 +326,11 @@ void nvmet_ns_disable(struct nvmet_ns *nstruct nvmet_ctrl *ctrl;mutex_lock (&subsys->lock); -if (list_empty (&ns->dev_link)) { -mutex_unlock (&subsys->lock); -return ; - } -list_del_init (&ns->dev_link); +if (!ns->enabled) + goto out_unlock; + + ns->enabled = false; +list_del_rcu (&ns->dev_link);mutex_unlock (&subsys->lock);/*
@@ -351,6 +352,7 @@ void nvmet_ns_disable(struct nvmet_ns *nif (ns->bdev)blkdev_put (ns->bdev,FMODE_WRITE |FMODE_READ ); +out_unlock:mutex_unlock (&subsys->lock); }
drivers/nvme/target/nvmet.h +1 -5
@@ -47,6 +47,7 @@ struct nvmet_ns {loff_t size;u8 nguid[16 ]; +bool enabled;struct nvmet_subsys *subsys;const char *device_path;
@@ -61,11 +62,6 @@ static inline struct nvmet_ns *to_nvmet_ return container_of(to_config_group(item), struct nvmet_ns, group); } -static inline bool nvmet_ns_enabled (struct nvmet_ns *ns) -{ -return !list_empty_careful (&ns->dev_link); -} -struct nvmet_cq {u16 qid;u16 size;
Greg Kroah-Hartman
maintainerPATCH 58/85 mm/vmscan.c: set correct defer count for shrinker
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Shaohua Li <[email protected]>
commit 5f33a0803bbd781de916f5c7448cbbbbc763d911 upstream.
Our system uses significantly more slab memory with memcg enabled with the latest kernel. With 3.10 kernel, slab uses 2G memory, while with 4.6 kernel, 6G memory is used. The shrinker has problem. Let's see we have two memcg for one shrinker. In do_shrink_slab:
1. Check cg1. nr_deferred = 0, assume total_scan = 700. batch size is 1024, then no memory is freed. nr_deferred = 700
2. Check cg2. nr_deferred = 700. Assume freeable = 20, then total_scan = 10 or 40. Let's assume it's 10. No memory is freed. nr_deferred = 10.
The deferred share of cg1 is lost in this case. kswapd will free no memory even run above steps again and again.
The fix makes sure one memcg's deferred share isn't lost.
--- mm/vmscan.c | 14 +++++++++++--- 1 file changed, 11 insertions(+), 3 deletions(-)
mm/vmscan.c +11 -3
@@ -291,6 +291,7 @@ static unsigned long do_shrink_slab(struint nid = shrinkctl->nid;long batch_size = shrinker->batch ? shrinker->batch :SHRINK_BATCH ; +long scanned =0 , next_deferred; freeable = shrinker->count_objects (shrinker, shrinkctl);if (freeable ==0 )
@@ -312,7 +313,9 @@ static unsigned long do_shrink_slab(strupr_err ("shrink_slab: %pF negative objects to delete nr=%ld\n" , shrinker->scan_objects, total_scan); total_scan = freeable; - } + next_deferred = nr; + }else + next_deferred = total_scan;/* * We need to avoid excessive windup on filesystem shrinkers
@@ -369,17 +372,22 @@ static unsigned long do_shrink_slab(strucount_vm_events (SLABS_SCANNED , nr_to_scan); total_scan -= nr_to_scan; + scanned += nr_to_scan;cond_resched (); } +if (next_deferred >= scanned) + next_deferred -= scanned; +else + next_deferred =0 ;/* * move the unused scan count back into the shrinker in a * manner that handles concurrent updates. If we exhausted the * scan, there is no need to do an update. */ -if (total_scan >0 ) - new_nr =atomic_long_add_return (total_scan, +if (next_deferred >0 ) + new_nr =atomic_long_add_return (next_deferred, &shrinker->nr_deferred[nid]);else new_nr =atomic_long_read (&shrinker->nr_deferred[nid]);
Greg Kroah-Hartman
maintainerPATCH 59/85 mm, page_alloc: keep pcp count and list contents in sync if struct page is corrupted
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mel Gorman <[email protected]>
commit a6de734bc002fe2027ccc074fbbd87d72957b7a4 upstream.
Vlastimil Babka pointed out that commit 479f854a207c ("mm, page_alloc:
defer debugging checks of pages allocated from the PCP") will allow the per-cpu list counter to be out of sync with the per-cpu list contents if a struct page is corrupted.
The consequence is an infinite loop if the per-cpu lists get fully drained by free_pcppages_bulk because all the lists are empty but the count is positive. The infinite loop occurs here
do {
batch_free++;
if (++migratetype == MIGRATE_PCPTYPES)
migratetype = 0;
list = &pcp->lists[migratetype];
} while (list_empty(list));What the user sees is a bad page warning followed by a soft lockup with interrupts disabled in free_pcppages_bulk().
This patch keeps the accounting in sync.
--- mm/page_alloc.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-)
mm/page_alloc.c +10 -2
@@ -2173,7 +2173,7 @@ static int rmqueue_bulk(struct zone *zon unsigned long count, struct list_head *list, int migratetype, bool cold) { - int i; + int i, alloced = 0;spin_lock (&zone->lock);for (i =0 ; i < count; ++i) {
@@ -2198,13 +2198,21 @@ static int rmqueue_bulk(struct zone *zonelse list_add_tail (&page->lru, list); list = &page->lru; + alloced++;if (is_migrate_cma (get_pcppage_migratetype (page)))__mod_zone_page_state (zone,NR_FREE_CMA_PAGES , -(1 << order)); } + +/* +* i pages were removed from the buddy list even if some leak due +* to check_pcp_refill failing so adjust NR_FREE_PAGES based +* on i. Do not confuse with 'alloced' which is the number of +* pages added to the pcp list. +*/ __mod_zone_page_state (zone,NR_FREE_PAGES , -(i << order));spin_unlock (&zone->lock); -return i; +return alloced; }#ifdef CONFIG_NUMA
Greg Kroah-Hartman
maintainerPATCH 60/85 usb: gadget: composite: always set ep->mult to a sensible value
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Felipe Balbi <[email protected]>
commit eaa496ffaaf19591fe471a36cef366146eeb9153 upstream.
ep->mult is supposed to be set to Isochronous and Interrupt Endapoint's multiplier value. This value is computed from different places depending on the link speed.
If we're dealing with HighSpeed, then it's part of bits [12:11] of wMaxPacketSize. This case wasn't taken into consideration before.
While at that, also make sure the ep->mult defaults to one so drivers can use it unconditionally and assume they'll never multiply ep->maxpacket to zero.
--- drivers/usb/gadget/composite.c | 9 +++++++-- drivers/usb/gadget/function/uvc_video.c | 2 +- 2 files changed, 8 insertions(+), 3 deletions(-)
drivers/usb/gadget/composite.c +7 -2
@@ -201,7 +201,12 @@ ep_found: _ep->desc = chosen_desc; _ep->comp_desc =NULL ; _ep->maxburst =0 ; - _ep->mult =0 ; + _ep->mult =1 ; + +if (g->speed ==USB_SPEED_HIGH && (usb_endpoint_xfer_isoc (_ep->desc) || +usb_endpoint_xfer_int (_ep->desc))) + _ep->mult =usb_endpoint_maxp (_ep->desc) &0x7ff ; +if (!want_comp_desc)return 0 ;
@@ -218,7 +223,7 @@ ep_found:switch (usb_endpoint_type (_ep->desc)) {case USB_ENDPOINT_XFER_ISOC :/* mult: bits 1:0 of bmAttributes */ - _ep->mult = comp_desc->bmAttributes &0x3 ; + _ep->mult = (comp_desc->bmAttributes &0x3 ) +1 ;case USB_ENDPOINT_XFER_BULK :case USB_ENDPOINT_XFER_INT : _ep->maxburst = comp_desc->bMaxBurst +1 ;
drivers/usb/gadget/function/uvc_video.c +1 -1
@@ -243,7 +243,7 @@ uvc_video_alloc_requests(struct uvc_vide req_size = video->ep->maxpacket * max_t(unsigned int, video->ep->maxburst, 1) - * (video->ep->mult +1 ); + * (video->ep->mult);for (i =0 ; i <UVC_NUM_REQUESTS ; ++i) { video->req_buffer[i] =kmalloc (req_size,GFP_KERNEL );
Greg Kroah-Hartman
maintainerPATCH 61/85 PM / OPP: Pass opp_table to dev_pm_opp_put_regulator()
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Stephen Boyd <[email protected]>
commit 91291d9ad92faa65a56a9a19d658d8049b78d3d4 upstream.
Joonyoung Shim reported an interesting problem on his ARM octa-core Odoroid-XU3 platform. During system suspend, dev_pm_opp_put_regulator() was failing for a struct device for which dev_pm_opp_set_regulator() is called earlier.
This happened because an earlier call to dev_pm_opp_of_cpumask_remove_table() function (from cpufreq-dt.c file) removed all the entries from opp_table->dev_list apart from the last CPU device in the cpumask of CPUs sharing the OPP.
But both dev_pm_opp_set_regulator() and dev_pm_opp_put_regulator() routines get CPU device for the first CPU in the cpumask. And so the OPP core failed to find the OPP table for the struct device.
This patch attempts to fix this problem by returning a pointer to the opp_table from dev_pm_opp_set_regulator() and using that as the parameter to dev_pm_opp_put_regulator(). This ensures that the dev_pm_opp_put_regulator() doesn't fail to find the opp table.
Note that similar design problem also exists with other dev_pm_opp_put_*() APIs, but those aren't used currently by anyone and so we don't need to update them for now.
--- drivers/base/power/opp/core.c | 22 ++++++---------------- drivers/cpufreq/cpufreq-dt.c | 12 ++++++++---- include/linux/pm_opp.h | 11 ++++++----- 3 files changed, 20 insertions(+), 25 deletions(-)
drivers/base/power/opp/core.c +6 -16
@@ -1320,7 +1320,7 @@ EXPORT_SYMBOL_GPL(dev_pm_opp_put_prop_na* that this function is *NOT* called under RCU protection or in contexts where * mutex cannot be locked. */ -int dev_pm_opp_set_regulator (struct device *dev,const char *name) +struct opp_table *dev_pm_opp_set_regulator (struct device *dev,const char *name) {struct opp_table *opp_table;struct regulator *reg;
@@ -1358,20 +1358,20 @@ int dev_pm_opp_set_regulator(struct devi opp_table->regulator = reg;mutex_unlock (&opp_table_lock); -return 0 ; +return opp_table; err:_remove_opp_table (opp_table); unlock:mutex_unlock (&opp_table_lock); -return ret; +return ERR_PTR (ret); }EXPORT_SYMBOL_GPL (dev_pm_opp_set_regulator);/** * dev_pm_opp_put_regulator() - Releases resources blocked for regulator -* @dev: Device for which regulator was set. +* @opp_table: OPP table returned from dev_pm_opp_set_regulator(). * * Locking: The internal opp_table and opp structures are RCU protected. * Hence this function internally uses RCU updater strategy with mutex locks
@@ -1379,22 +1379,12 @@ EXPORT_SYMBOL_GPL(dev_pm_opp_set_regulat* that this function is *NOT* called under RCU protection or in contexts where * mutex cannot be locked. */ -void dev_pm_opp_put_regulator (struct device *dev) +void dev_pm_opp_put_regulator (struct opp_table *opp_table) { -struct opp_table *opp_table; -mutex_lock (&opp_table_lock); -/* Check for existing table for 'dev' first */ - opp_table =_find_opp_table (dev); -if (IS_ERR (opp_table)) { -dev_err (dev,"Failed to find opp_table: %ld\n" , -PTR_ERR (opp_table)); - goto unlock; - } -if (IS_ERR (opp_table->regulator)) { -dev_err (dev,"%s: Doesn't have regulator set\n" , __func__); +pr_err ("%s: Doesn't have regulator set\n" , __func__); goto unlock; }
drivers/cpufreq/cpufreq-dt.c +8 -4
@@ -26,6 +26,7 @@#include <linux/thermal.h> struct private_data { +struct opp_table *opp_table;struct device *cpu_dev;struct thermal_cooling_device *cdev;const char *reg_name;
@@ -141,6 +142,7 @@ static int resources_available(void)static int cpufreq_init (struct cpufreq_policy *policy) {struct cpufreq_frequency_table *freq_table; +struct opp_table *opp_table =NULL ;struct private_data *priv;struct device *cpu_dev;struct clk *cpu_clk;
@@ -184,8 +186,9 @@ static int cpufreq_init(struct cpufreq_p*/ name =find_supply_name (cpu_dev);if (name) { - ret =dev_pm_opp_set_regulator (cpu_dev, name); -if (ret) { + opp_table =dev_pm_opp_set_regulator (cpu_dev, name); +if (IS_ERR (opp_table)) { + ret =PTR_ERR (opp_table);dev_err (cpu_dev,"Failed to set regulator for cpu%d: %d\n" , policy->cpu, ret); goto out_put_clk;
@@ -235,6 +238,7 @@ static int cpufreq_init(struct cpufreq_p } priv->reg_name = name; + priv->opp_table = opp_table; ret =dev_pm_opp_init_cpufreq_table (cpu_dev, &freq_table);if (ret) {
@@ -283,7 +287,7 @@ out_free_priv: out_free_opp:dev_pm_opp_of_cpumask_remove_table (policy->cpus);if (name) -dev_pm_opp_put_regulator (cpu_dev); +dev_pm_opp_put_regulator (opp_table); out_put_clk:clk_put (cpu_clk);
@@ -298,7 +302,7 @@ static int cpufreq_exit(struct cpufreq_pdev_pm_opp_free_cpufreq_table (priv->cpu_dev, &policy->freq_table);dev_pm_opp_of_cpumask_remove_table (policy->related_cpus);if (priv->reg_name) -dev_pm_opp_put_regulator (priv->cpu_dev); +dev_pm_opp_put_regulator (priv->opp_table);clk_put (policy->clk);kfree (priv);
include/linux/pm_opp.h +6 -5
@@ -19,6 +19,7 @@struct dev_pm_opp ;struct device ; +struct opp_table ;enum dev_pm_opp_event {OPP_EVENT_ADD ,OPP_EVENT_REMOVE ,OPP_EVENT_ENABLE ,OPP_EVENT_DISABLE ,
@@ -62,8 +63,8 @@ int dev_pm_opp_set_supported_hw(struct dvoid dev_pm_opp_put_supported_hw (struct device *dev);int dev_pm_opp_set_prop_name (struct device *dev,const char *name);void dev_pm_opp_put_prop_name (struct device *dev); -int dev_pm_opp_set_regulator (struct device *dev,const char *name); -void dev_pm_opp_put_regulator (struct device *dev); +struct opp_table *dev_pm_opp_set_regulator (struct device *dev,const char *name); +void dev_pm_opp_put_regulator (struct opp_table *opp_table);int dev_pm_opp_set_rate (struct device *dev,unsigned long target_freq);int dev_pm_opp_set_sharing_cpus (struct device *cpu_dev,const struct cpumask *cpumask);int dev_pm_opp_get_sharing_cpus (struct device *cpu_dev,struct cpumask *cpumask);
@@ -170,12 +171,12 @@ static inline int dev_pm_opp_set_prop_nastatic inline void dev_pm_opp_put_prop_name (struct device *dev) {} -static inline int dev_pm_opp_set_regulator (struct device *dev,const char *name) +static inline struct opp_table *dev_pm_opp_set_regulator (struct device *dev,const char *name) { -return -ENOTSUPP ; +return ERR_PTR (-ENOTSUPP ); } -static inline void dev_pm_opp_put_regulator (struct device *dev) {} +static inline void dev_pm_opp_put_regulator (struct opp_table *opp_table) {}static inline int dev_pm_opp_set_rate (struct device *dev,unsigned long target_freq) {
Greg Kroah-Hartman
maintainerPATCH 62/85 blk-mq: Do not invoke .queue_rq() for a stopped queue
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit bc27c01b5c46d3bfec42c96537c7a3fae0bb2cc4 upstream.
The meaning of the BLK_MQ_S_STOPPED flag is "do not call .queue_rq()". Hence modify blk_mq_make_request() such that requests are queued instead of issued if a queue has been stopped.
--- block/blk-mq.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)
block/blk-mq.c +3 -3
@@ -1371,9 +1371,9 @@ static blk_qc_t blk_mq_make_request(strublk_mq_put_ctx (data.ctx);if (!old_rq) goto done; -if (!blk_mq_direct_issue_request (old_rq, &cookie)) - goto done; -blk_mq_insert_request (old_rq, false, true, true); +if (test_bit (BLK_MQ_S_STOPPED , &data.hctx->state) || +blk_mq_direct_issue_request (old_rq, &cookie) !=0 ) +blk_mq_insert_request (old_rq, false, true, true); goto done; }
Greg Kroah-Hartman
maintainerPATCH 63/85 dm table: fix all_blk_mq inconsistency when an empty table is loaded
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Mike Snitzer <[email protected]>
commit 6936c12cf809850180b24947271b8f068fdb15e9 upstream.
An earlier DM multipath table could have been build ontop of underlying devices that were all using blk-mq. In that case, if that active multipath table is replaced with an empty DM multipath table (that reflects all paths have failed) then it is important that the 'all_blk_mq' state of the active table is transfered to the new empty DM table. Otherwise dm-rq.c:dm_old_prep_tio() will incorrectly clone a request that isn't needed by the DM multipath target when it is to issue IO to an underlying blk-mq device.
--- drivers/md/dm-table.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-)
drivers/md/dm-table.c +13 -6
@@ -924,12 +924,6 @@ static int dm_table_determine_type(strucBUG_ON (!request_based);/* No targets in this table */ -if (list_empty (devices) &&__table_type_request_based (live_md_type)) { -/* inherit live MD type */ - t->type = live_md_type; -return 0 ; - } -/* * The only way to establish DM_TYPE_MQ_REQUEST_BASED is by * having a compatible target use dm_table_set_type.
@@ -948,6 +942,19 @@ verify_rq_based:return -EINVAL ; } +if (list_empty (devices)) { +int srcu_idx; +struct dm_table *live_table =dm_get_live_table (t->md, &srcu_idx); + +/* inherit live table's type and all_blk_mq */ +if (live_table) { + t->type = live_table->type; + t->all_blk_mq = live_table->all_blk_mq; + } +dm_put_live_table (t->md, srcu_idx); +return 0 ; + } +/* Non-request-stackable devices can't be used for request-based dm */ list_for_each_entry (dd, devices, list) {struct request_queue *q =bdev_get_queue (dd->dm_dev->bdev);
Greg Kroah-Hartman
maintainerPATCH 64/85 dm table: an all_blk_mq table must be loaded for a blk-mq DM device
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit 301fc3f5efb98633115bd887655b19f42c6dfaa8 upstream.
When dm_table_set_type() is used by a target to establish a DM table's type (e.g. DM_TYPE_MQ_REQUEST_BASED in the case of DM multipath) the DM core must go on to verify that the devices in the table are compatible with the established type.
--- drivers/md/dm-table.c | 5 +++++ 1 file changed, 5 insertions(+)
drivers/md/dm-table.c +5 -0
@@ -981,6 +981,11 @@ verify_rq_based: t->all_blk_mq = true; } +if (t->type ==DM_TYPE_MQ_REQUEST_BASED && !t->all_blk_mq) { +DMERR ("table load rejected: all devices are not blk-mq request-stackable" ); +return -EINVAL ; + } +return 0 ; }
Greg Kroah-Hartman
maintainerPATCH 65/85 dm flakey: return -EINVAL on interval bounds error in flakey_ctr()
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Wei Yongjun <[email protected]>
commit bff7e067ee518f9ed7e1cbc63e4c9e01670d0b71 upstream.
Fix to return error code -EINVAL instead of 0, as is done elsewhere in this function.
--- drivers/md/dm-flakey.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/md/dm-flakey.c +2 -0
@@ -200,11 +200,13 @@ static int flakey_ctr(struct dm_target *if (!(fc->up_interval + fc->down_interval)) { ti->error ="Total (up + down) interval is zero" ; + r = -EINVAL ; goto bad; }if (fc->up_interval + fc->down_interval < fc->up_interval) { ti->error ="Interval overflow" ; + r = -EINVAL ; goto bad; }
Greg Kroah-Hartman
maintainerPATCH 66/85 dm crypt: mark key as invalid until properly loaded
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ondrej Kozina <[email protected]>
commit 265e9098bac02bc5e36cda21fdbad34cb5b2f48d upstream.
In crypt_set_key(), if a failure occurs while replacing the old key (e.g. tfm->setkey() fails) the key must not have DM_CRYPT_KEY_VALID flag set. Otherwise, the crypto layer would have an invalid key that still has DM_CRYPT_KEY_VALID flag set.
--- drivers/md/dm-crypt.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-)
drivers/md/dm-crypt.c +5 -2
@@ -1503,12 +1503,15 @@ static int crypt_set_key(struct crypt_coif (!cc->key_size &&strcmp (key,"-" )) goto out; +/* clear the flag since following operations may invalidate previously valid key */ +clear_bit (DM_CRYPT_KEY_VALID , &cc->flags); +if (cc->key_size &&crypt_decode_key (cc->key, key, cc->key_size) <0 ) goto out; -set_bit (DM_CRYPT_KEY_VALID , &cc->flags); - r =crypt_setkey_allcpus (cc); +if (!r) +set_bit (DM_CRYPT_KEY_VALID , &cc->flags); out:/* Hex key string not needed after here, so wipe it. */
Greg Kroah-Hartman
maintainerPATCH 67/85 dm rq: fix a race condition in rq_completed()
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Bart Van Assche <[email protected]>
commit d15bb3a6467e102e60d954aadda5fb19ce6fd8ec upstream.
It is required to hold the queue lock when calling blk_run_queue_async() to avoid that a race between blk_run_queue_async() and blk_cleanup_queue() is triggered.
--- drivers/md/dm-rq.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
drivers/md/dm-rq.c +8 -2
@@ -218,6 +218,9 @@ static void rq_end_stats(struct mapped_d*/ static void rq_completed (struct mapped_device *md,int rw,bool run_queue) { +struct request_queue *q = md->queue; +unsigned long flags; +atomic_dec (&md->pending[rw]);/* nudge anyone waiting on suspend queue */
@@ -230,8 +233,11 @@ static void rq_completed(struct mapped_d* back into ->request_fn() could deadlock attempting to grab the * queue lock again. */ -if (!md->queue->mq_ops && run_queue) -blk_run_queue_async (md->queue); +if (!q->mq_ops && run_queue) { +spin_lock_irqsave (q->queue_lock, flags); +blk_run_queue_async (q); +spin_unlock_irqrestore (q->queue_lock, flags); + }/* * dm_put() must be at the end of this function. See the comment above
Greg Kroah-Hartman
maintainerPATCH 68/85 dm raid: fix discard support regression
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Heinz Mauelshagen <[email protected]>
commit 11e2968478edc07a75ee1efb45011b3033c621c2 upstream.
Commit ecbfb9f118 ("dm raid: add raid level takeover support") moved the configure_discard_support() call from raid_ctr() to raid_preresume().
Enabling/disabling discard _must_ happen during table load (through the .ctr hook). Fix this regression by moving the configure_discard_support() call back to raid_ctr().
--- drivers/md/dm-raid.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-)
drivers/md/dm-raid.c +3 -6
@@ -2994,6 +2994,9 @@ static int raid_ctr(struct dm_target *ti } } +/* Disable/enable discard support on raid set. */ +configure_discard_support (rs); +mddev_unlock (&rs->md);return 0 ;
@@ -3580,12 +3583,6 @@ static int raid_preresume(struct dm_targif (test_bit (RT_FLAG_UPDATE_SBS , &rs->runtime_flags))rs_update_sbs (rs); -/* -* Disable/enable discard support on raid set after any -* conversion, because devices can have been added -*/ -configure_discard_support (rs); -/* Load the bitmap from disk unless raid0 */ r =__load_dirty_region_bitmap (rs);if (r)
Greg Kroah-Hartman
maintainerPATCH 69/85 dm space map metadata: fix struct sm_metadata leak on failed create
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Benjamin Marzinski <[email protected]>
commit 314c25c56c1ee5026cf99c570bdfe01847927acb upstream.
In dm_sm_metadata_create() we temporarily change the dm_space_map operations from 'ops' (whose .destroy function deallocates the sm_metadata) to 'bootstrap_ops' (whose .destroy function doesn't).
If dm_sm_metadata_create() fails in sm_ll_new_metadata() or sm_ll_extend(), it exits back to dm_tm_create_internal(), which calls dm_sm_destroy() with the intention of freeing the sm_metadata, but it doesn't (because the dm_space_map operations is still set to 'bootstrap_ops').
Fix this by setting the dm_space_map operations back to 'ops' if dm_sm_metadata_create() fails when it is set to 'bootstrap_ops'.
--- drivers/md/persistent-data/dm-space-map-metadata.c | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-)
drivers/md/persistent-data/dm-space-map-metadata.c +6 -8
@@ -775,17 +775,15 @@ int dm_sm_metadata_create(struct dm_spacmemcpy (&smm->sm, &bootstrap_ops,sizeof (smm->sm)); r =sm_ll_new_metadata (&smm->ll, tm); +if (!r) { +if (nr_blocks >DM_SM_METADATA_MAX_BLOCKS ) + nr_blocks =DM_SM_METADATA_MAX_BLOCKS ; + r =sm_ll_extend (&smm->ll, nr_blocks); + } +memcpy (&smm->sm, &ops,sizeof (smm->sm));if (r)return r; -if (nr_blocks >DM_SM_METADATA_MAX_BLOCKS ) - nr_blocks =DM_SM_METADATA_MAX_BLOCKS ; - r =sm_ll_extend (&smm->ll, nr_blocks); -if (r) -return r; - -memcpy (&smm->sm, &ops,sizeof (smm->sm)); -/* * Now we need to update the newly created data structures with the * allocated blocks that they were built from.
Greg Kroah-Hartman
maintainerPATCH 70/85 ASoC: intel: Fix crash at suspend/resume without card registration
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Takashi Iwai <[email protected]>
commit 2fc995a87f2efcd803438f07bfecd35cc3d90d32 upstream.
When ASoC Intel SST Medfield driver is probed but without codec / card assigned, it causes an Oops and freezes the kernel at suspend/resume,
PM: Suspending system (freeze)
Suspending console(s) (use no_console_suspend to debug)
BUG: unable to handle kernel NULL pointer dereference at 0000000000000018 IP: [<ffffffffc09d9409>] sst_soc_prepare+0x19/0xa0 [snd_soc_sst_mfld_platform] Oops: 0000 [#1] PREEMPT SMP CPU: 0 PID: 1552 Comm: systemd-sleep Tainted: G W 4.9.0-rc6-1.g5f5c2ad-default #1 Call Trace: [<ffffffffb45318f9>] dpm_prepare+0x209/0x460 [<ffffffffb4531b61>] dpm_suspend_start+0x11/0x60 [<ffffffffb40d3cc2>] suspend_devices_and_enter+0xb2/0x710 [<ffffffffb40d462e>] pm_suspend+0x30e/0x390 [<ffffffffb40d2eba>] state_store+0x8a/0x90 [<ffffffffb43c670f>] kobj_attr_store+0xf/0x20 [<ffffffffb42b0d97>] sysfs_kf_write+0x37/0x40 [<ffffffffb42b02bc>] kernfs_fop_write+0x11c/0x1b0 [<ffffffffb422be68>] __vfs_write+0x28/0x140 [<ffffffffb43728a8>] ? apparmor_file_permission+0x18/0x20 [<ffffffffb433b2ab>] ? security_file_permission+0x3b/0xc0 [<ffffffffb422d095>] vfs_write+0xb5/0x1a0 [<ffffffffb422e3d6>] SyS_write+0x46/0xa0 [<ffffffffb4719fbb>] entry_SYSCALL_64_fastpath+0x1e/0xad
Add proper NULL checks in the PM code of mdfld driver.
--- sound/soc/intel/atom/sst-mfld-platform-pcm.c | 6 ++++++ 1 file changed, 6 insertions(+)
sound/soc/intel/atom/sst-mfld-platform-pcm.c +6 -0
@@ -771,6 +771,9 @@ static int sst_soc_prepare(struct devicestruct sst_data *drv =dev_get_drvdata (dev);struct snd_soc_pcm_runtime *rtd; +if (!drv->soc_card) +return 0 ; +/* suspend all pcms first */ snd_soc_suspend (drv->soc_card->dev);snd_soc_poweroff (drv->soc_card->dev);
@@ -793,6 +796,9 @@ static void sst_soc_complete(struct devistruct sst_data *drv =dev_get_drvdata (dev);struct snd_soc_pcm_runtime *rtd; +if (!drv->soc_card) +return ; +/* restart SSPs */ list_for_each_entry (rtd, &drv->soc_card->rtd_list, list) {struct snd_soc_dai *dai = rtd->cpu_dai;
Greg Kroah-Hartman
maintainerPATCH 71/85 CIFS: Fix a possible memory corruption during reconnect
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <[email protected]>
commit 53e0e11efe9289535b060a51d4cf37c25e0d0f2b upstream.
We can not unlock/lock cifs_tcp_ses_lock while walking through ses and tcon lists because it can corrupt list iterator pointers and a tcon structure can be released if we don't hold an extra reference. Fix it by moving a reconnect process to a separate delayed work and acquiring a reference to every tcon that needs to be reconnected. Also do not send an echo request on newly established connections.
--- fs/cifs/cifsglob.h | 3 ++ fs/cifs/cifsproto.h | 3 ++ fs/cifs/connect.c | 34 ++++++++++++++++++----- fs/cifs/smb2pdu.c | 75 +++++++++++++++++++++++++++++++++++----------------- fs/cifs/smb2proto.h | 1 5 files changed, 85 insertions(+), 31 deletions(-)
fs/cifs/cifsglob.h +3 -0
@@ -629,6 +629,8 @@ struct TCP_Server_Info {unsigned int max_read;unsigned int max_write;__u8 preauth_hash[512 ]; +struct delayed_work reconnect;/* reconnect workqueue job */ +struct mutex reconnect_mutex;/* prevent simultaneous reconnects */ #endif /* CONFIG_CIFS_SMB2 */ unsigned long echo_interval; };
@@ -832,6 +834,7 @@ cap_unix(struct cifs_ses *ses)struct cifs_tcon {struct list_head tcon_list;int tc_count; +struct list_head rlist;/* reconnect list */ struct list_head openFileList;spinlock_t open_file_lock;/* protects list above */ struct cifs_ses *ses;/* pointer to session associated with */
fs/cifs/cifsproto.h +3 -0
@@ -204,6 +204,9 @@ extern void cifs_add_pending_open_lockedstruct tcon_link *tlink, struct cifs_pending_open *open);extern void cifs_del_pending_open (struct cifs_pending_open *open); +extern void cifs_put_tcp_session (struct TCP_Server_Info *server, +int from_reconnect); +extern void cifs_put_tcon (struct cifs_tcon *tcon);#if IS_ENABLED (CONFIG_CIFS_DFS_UPCALL )extern void cifs_dfs_release_automount_timer (void );
fs/cifs/connect.c +27 -7
@@ -52,6 +52,9 @@#include "nterr.h" #include "rfc1002pdu.h" #include "fscache.h" +#ifdef CONFIG_CIFS_SMB2 +#include "smb2proto.h" +#endif #define CIFS_PORT 445#define RFC1001_PORT 139
@@ -2076,8 +2079,8 @@ cifs_find_tcp_session(struct smb_vol *voreturn NULL ; } -static void -cifs_put_tcp_session (struct TCP_Server_Info *server) +void +cifs_put_tcp_session (struct TCP_Server_Info *server,int from_reconnect) {struct task_struct *task;
@@ -2094,6 +2097,19 @@ cifs_put_tcp_session(struct TCP_Server_Icancel_delayed_work_sync (&server->echo); +#ifdef CONFIG_CIFS_SMB2 +if (from_reconnect) +/* +* Avoid deadlock here: reconnect work calls +* cifs_put_tcp_session() at its end. Need to be sure +* that reconnect work does nothing with server pointer after +* that step. +*/ +cancel_delayed_work (&server->reconnect); +else +cancel_delayed_work_sync (&server->reconnect); +#endif +spin_lock (&GlobalMid_Lock); server->tcpStatus = CifsExiting;spin_unlock (&GlobalMid_Lock);
@@ -2158,6 +2174,10 @@ cifs_get_tcp_session(struct smb_vol *volINIT_LIST_HEAD (&tcp_ses->tcp_ses_list);INIT_LIST_HEAD (&tcp_ses->smb_ses_list);INIT_DELAYED_WORK (&tcp_ses->echo, cifs_echo_request); +#ifdef CONFIG_CIFS_SMB2 +INIT_DELAYED_WORK (&tcp_ses->reconnect, smb2_reconnect_server); +mutex_init (&tcp_ses->reconnect_mutex); +#endif memcpy (&tcp_ses->srcaddr, &volume_info->srcaddr,sizeof (tcp_ses->srcaddr)); memcpy(&tcp_ses->dstaddr, &volume_info->dstaddr,
@@ -2316,7 +2336,7 @@ cifs_put_smb_ses(struct cifs_ses *ses)spin_unlock (&cifs_tcp_ses_lock);sesInfoFree (ses); -cifs_put_tcp_session (server); +cifs_put_tcp_session (server,0 ); }#ifdef CONFIG_KEYS
@@ -2490,7 +2510,7 @@ cifs_get_smb_ses(struct TCP_Server_Infomutex_unlock (&ses->session_mutex);/* existing SMB ses has a server reference already */ -cifs_put_tcp_session (server); +cifs_put_tcp_session (server,0 );free_xid (xid);return ses; }
@@ -2580,7 +2600,7 @@ cifs_find_tcon(struct cifs_ses *ses, conreturn NULL ; } -static void +void cifs_put_tcon (struct cifs_tcon *tcon) {unsigned int xid;
@@ -3762,7 +3782,7 @@ mount_fail_check:else if (ses)cifs_put_smb_ses (ses);else -cifs_put_tcp_session (server); +cifs_put_tcp_session (server,0 );bdi_destroy (&cifs_sb->bdi); }
@@ -4073,7 +4093,7 @@ cifs_construct_tcon(struct cifs_sb_info ses =cifs_get_smb_ses (master_tcon->ses->server, vol_info);if (IS_ERR (ses)) { tcon = (struct cifs_tcon *)ses; -cifs_put_tcp_session (master_tcon->ses->server); +cifs_put_tcp_session (master_tcon->ses->server,0 ); goto out; }
fs/cifs/smb2pdu.c +51 -24
89 lines not on this page · raw message
fs/cifs/smb2proto.h +1 -0
@@ -96,6 +96,7 @@ extern int smb2_open_file(const unsignedextern int smb2_unlock_range (struct cifsFileInfo *cfile,struct file_lock *flock,const unsigned int xid);extern int smb2_push_mandatory_locks (struct cifsFileInfo *cfile); +extern void smb2_reconnect_server (struct work_struct *work);/* * SMB2 Worker functions - most of protocol specific implementation details
Greg Kroah-Hartman
maintainerPATCH 72/85 CIFS: Fix missing nls unload in smb2_reconnect()
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <[email protected]>
commit 4772c79599564bd08ee6682715a7d3516f67433f upstream.
--- fs/cifs/smb2pdu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/smb2pdu.c +1 -1
@@ -275,7 +275,7 @@ out:case SMB2_CHANGE_NOTIFY :case SMB2_QUERY_INFO :case SMB2_SET_INFO : -return -EAGAIN ; + rc = -EAGAIN ; }unload_nls (nls_codepage);return rc;
Greg Kroah-Hartman
maintainerPATCH 73/85 CIFS: Fix a possible memory corruption in push locks
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Pavel Shilovsky <[email protected]>
commit e3d240e9d505fc67f8f8735836df97a794bbd946 upstream.
If maxBuf is not 0 but less than a size of SMB2 lock structure we can end up with a memory corruption.
--- fs/cifs/smb2file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
fs/cifs/smb2file.c +1 -1
@@ -260,7 +260,7 @@ smb2_push_mandatory_locks(struct cifsFil* and check it for zero before using. */ max_buf =tlink_tcon (cfile->tlink)->ses->server->maxBuf; -if (!max_buf) { +if (max_buf <sizeof (struct smb2_lock_element )) {free_xid (xid);return -EINVAL ; }
Greg Kroah-Hartman
maintainerPATCH 74/85 kernel/watchdog: use nmi registers snapshot in hardlockup handler
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Konstantin Khlebnikov <[email protected]>
commit 4d1f0fb096aedea7bb5489af93498a82e467c480 upstream.
NMI handler doesn't call set_irq_regs(), it's set only by normal IRQ. Thus get_irq_regs() returns NULL or stale registers snapshot with IP/SP pointing to the code interrupted by IRQ which was interrupted by NMI. NULL isn't a problem: in this case watchdog calls dump_stack() and prints full stack trace including NMI. But if we're stuck in IRQ handler then NMI watchlog will print stack trace without IRQ part at all.
This patch uses registers snapshot passed into NMI handler as arguments:
these registers point exactly to the instruction interrupted by NMI.
--- kernel/watchdog.c | 1 - 1 file changed, 1 deletion(-)
kernel/watchdog.c +0 -1
@@ -344,7 +344,6 @@ static void watchdog_overflow_callback(s*/ if (is_hardlockup ()) {int this_cpu =smp_processor_id (); -struct pt_regs *regs =get_irq_regs ();/* only print hardlockups once */ if (__this_cpu_read (hard_watchdog_warn) == true)
Greg Kroah-Hartman
maintainerPATCH 75/85 watchdog: mei_wdt: request stop on reboot to prevent false positive event
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Alexander Usyskin <[email protected]>
commit 9eff1140a82db8c5520f76e51c21827b4af670b3 upstream.
Systemd on reboot enables shutdown watchdog that leaves the watchdog device open to ensure that even if power down process get stuck the platform reboots nonetheless.
The iamt_wdt is an alarm-only watchdog and can't reboot system, but the FW will generate an alarm event reboot was completed in time, as the watchdog is not automatically disabled during power cycle. So we should request stop watchdog on reboot to eliminate wrong alarm from the FW.
--- drivers/watchdog/mei_wdt.c | 2 ++ 1 file changed, 2 insertions(+)
drivers/watchdog/mei_wdt.c +2 -0
@@ -389,6 +389,8 @@ static int mei_wdt_register(struct mei_w wdt->wdd.max_timeout =MEI_WDT_MAX_TIMEOUT ;watchdog_set_drvdata (&wdt->wdd, wdt); +watchdog_stop_on_reboot (&wdt->wdd); + ret =watchdog_register_device (&wdt->wdd);if (ret) {dev_err (dev,"unable to register watchdog device = %d.\n" , ret);
Greg Kroah-Hartman
maintainerPATCH 76/85 watchdog: qcom: fix kernel panic due to external abort on non-linefetch
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Christian Lamparter <[email protected]>
commit f06f35c66fdbd5ac38901a3305ce763a0cd59375 upstream.
This patch fixes a off-by-one in the "watchdog: qcom: add option for standalone watchdog not in timer block" patch that causes the following panic on boot:
Quoted 16 lines
Unhandled fault: external abort on non-linefetch (
0x1008) at0xc8874002pgd =c0204000
[c8874002] *pgd=87806811, *pte=0b017653, *ppte=0b017453Internal error: : 1008 [#1] SMP ARM CPU: 2 PID: 1 Comm: swapper/0 Not tainted 4.8.6 #0 Hardware name: Generic DT based system PC is at 0xc02222f4 LR is at 0x1 pc : [<c02222f4>] lr : [<00000001>] psr: 00000113sp :
c782fc98ip : 00000003 fp : 00000000
r10: 00000004 r9 :c782e000r8 :c04ab98c
r7 : 00000001 r6 :c8874002r5 :c782fe00r4 : 00000002 r3 : 00000000 r2 :c782fe00r1 : 00100000 r0 :c8874002
Flags: nzcv IRQs on FIQs on ModeSVC_32ISA ARM Segment none
Control:10c5387dTable:8020406aDAC: 00000051 Process swapper/0 (pid: 1, stack limit =0xc782e210)
Quoted 2 lines
Stack: (0xc782fc98 to 0xc7830000)[...]
The WDT_STS (status) needs to be translated via wdt_addr as well.
--- drivers/watchdog/qcom-wdt.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/watchdog/qcom-wdt.c +1 -1
@@ -209,7 +209,7 @@ static int qcom_wdt_probe(struct platfor wdt->wdd.parent = &pdev->dev; wdt->layout = regs; -if (readl (wdt->base +WDT_STS ) &1 ) +if (readl (wdt_addr (wdt,WDT_STS )) &1 ) wdt->wdd.bootstatus =WDIOF_CARDRESET ;/*
Greg Kroah-Hartman
maintainerPATCH 77/85 kernel/debug/debug_core.c: more properly delay for secondary CPUs
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Douglas Anderson <[email protected]>
commit 2d13bb6494c807bcf3f78af0e96c0b8615a94385 upstream.
We've got a delay loop waiting for secondary CPUs. That loop uses loops_per_jiffy. However, loops_per_jiffy doesn't actually mean how many tight loops make up a jiffy on all architectures. It is quite common to see things like this in the boot log:
Calibrating delay loop (skipped), value calculated using timer frequency.. 48.00 BogoMIPS (lpj=24000)
In my case I was seeing lots of cases where other CPUs timed out entering the debugger only to print their stack crawls shortly after the kdb> prompt was written.
Elsewhere in kgdb we already use udelay(), so that should be safe enough to use to implement our timeout. We'll delay 1 ms for 1000 times, which should give us a full second of delay (just like the old code wanted) but allow us to notice that we're done every 1 ms.
--- kernel/debug/debug_core.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)
kernel/debug/debug_core.c +2 -2
@@ -598,11 +598,11 @@ return_normal:/* * Wait for the other CPUs to be notified and be waiting for us: */ - time_left = loops_per_jiffy *HZ ; + time_left =MSEC_PER_SEC ;while (kgdb_do_roundup && --time_left && (atomic_read (&masters_in_kgdb) +atomic_read (&slaves_in_kgdb)) != online_cpus) -cpu_relax (); +udelay (1000 );if (!time_left)pr_crit ("Timed out waiting for secondary CPUs.\n" );
Greg Kroah-Hartman
maintainerPATCH 78/85 tpm xen: Remove bogus tpm_chip_unregister
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Jason Gunthorpe <[email protected]>
commit 1f0f30e404b3d8f4597a2d9b77fba55452f8fd0e upstream.
tpm_chip_unregister can only be called after tpm_chip_register. devm manages the allocation so no unwind is needed here.
--- drivers/char/tpm/xen-tpmfront.c | 1 - 1 file changed, 1 deletion(-)
drivers/char/tpm/xen-tpmfront.c +0 -1
@@ -307,7 +307,6 @@ static int tpmfront_probe(struct xenbus_ rv =setup_ring (dev, priv);if (rv) { chip =dev_get_drvdata (&dev->dev); -tpm_chip_unregister (chip);ring_free (priv);return rv; }
Greg Kroah-Hartman
maintainerPATCH 79/85 xen/gntdev: Use VM_MIXEDMAP instead of VM_IO to avoid NUMA balancing
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Boris Ostrovsky <[email protected]>
commit 30faaafdfa0c754c91bac60f216c9f34a2bfdf7e upstream.
Commit 9c17d96500f7 ("xen/gntdev: Grant maps should not be subject to NUMA balancing") set VM_IO flag to prevent grant maps from being subjected to NUMA balancing.
It was discovered recently that this flag causes get_user_pages() to always fail with -EFAULT.
check_vma_flags__get_user_pages__get_user_pages_locked__get_user_pages_unlockedget_user_pages_fastiov_iter_get_pagesdio_refill_pagesdo_direct_IOdo_blockdev_direct_IOdo_blockdev_direct_IOext4_direct_IO_readgeneric_file_read_iteraio_run_iocb
(which can happen if guest's vdisk has direct-io-safe option).
To avoid this let's use VM_MIXEDMAP flag instead --- it prevents NUMA balancing just as VM_IO does and has no effect on check_vma_flags().
--- drivers/xen/gntdev.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
drivers/xen/gntdev.c +1 -1
@@ -1007,7 +1007,7 @@ static int gntdev_mmap(struct file *flip vma->vm_ops = &gntdev_vmops; - vma->vm_flags |=VM_DONTEXPAND |VM_DONTDUMP |VM_IO ; + vma->vm_flags |=VM_DONTEXPAND |VM_DONTDUMP |VM_MIXEDMAP ;if (use_ptemod) vma->vm_flags |=VM_DONTCOPY ;
Greg Kroah-Hartman
maintainerPATCH 80/85 arm/xen: Use alloc_percpu rather than __alloc_percpu
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Julien Grall <[email protected]>
commit 24d5373dda7c00a438d26016bce140299fae675e upstream.
The function xen_guest_init is using __alloc_percpu with an alignment which are not power of two.
However, the percpu allocator never supported alignments which are not power of two and has always behaved incorectly in thise case.
Commit 3ca45a4 "percpu: ensure requested alignment is power of two" introduced a check which trigger a warning [1] when booting linux-next on Xen. But in reality this bug was always present.
This can be fixed by replacing the call to __alloc_percpu with alloc_percpu. The latter will use an alignment which are a power of two.
[1]
[ 0.023921] illegal size (48) or align (48) for percpu allocation
[ 0.024167] ------------[ cut here ]------------
[ 0.024344] WARNING: CPU: 0 PID: 1 at linux/mm/percpu.c:892 pcpu_alloc+0x88/0x6c0
[ 0.024584] Modules linked in:
[ 0.024708]
[ 0.024804] CPU: 0 PID: 1 Comm: swapper/0 Not tainted
4.9.0-rc7-next-20161128 #473
[ 0.025012] Hardware name: Foundation-v8A (DT)
[ 0.025162] task: ffff80003d870000 task.stack: ffff80003d844000
[ 0.025351] PC is at pcpu_alloc+0x88/0x6c0
[ 0.025490] LR is at pcpu_alloc+0x88/0x6c0
[ 0.025624] pc : [<ffff00000818e678>] lr : [<ffff00000818e678>]
pstate: 60000045
[ 0.025830] sp : ffff80003d847cd0
[ 0.025946] x29: ffff80003d847cd0 x28: 0000000000000000
[ 0.026147] x27: 0000000000000000 x26: 0000000000000000
[ 0.026348] x25: 0000000000000000 x24: 0000000000000000
[ 0.026549] x23: 0000000000000000 x22: 00000000024000c0
[ 0.026752] x21: ffff000008e97000 x20: 0000000000000000
[ 0.026953] x19: 0000000000000030 x18: 0000000000000010
[ 0.027155] x17: 0000000000000a3f x16: 00000000deadbeef
[ 0.027357] x15: 0000000000000006 x14: ffff000088f79c3f
[ 0.027573] x13: ffff000008f79c4d x12: 0000000000000041
[ 0.027782] x11: 0000000000000006 x10: 0000000000000042
[ 0.027995] x9 : ffff80003d847a40 x8 : 6f697461636f6c6c
[ 0.028208] x7 : 6120757063726570 x6 : ffff000008f79c84
[ 0.028419] x5 : 0000000000000005 x4 : 0000000000000000
[ 0.028628] x3 : 0000000000000000 x2 : 000000000000017f
[ 0.028840] x1 : ffff80003d870000 x0 : 0000000000000035
[ 0.029056]
[ 0.029152] ---[ end trace 0000000000000000 ]---
[ 0.029297] Call trace:
[ 0.029403] Exception stack(0xffff80003d847b00 to
0xffff80003d847c30)
[ 0.029621] 7b00: 0000000000000030 0001000000000000
ffff80003d847cd0 ffff00000818e678
[ 0.029901] 7b20: 0000000000000002 0000000000000004
ffff000008f7c060 0000000000000035
[ 0.030153] 7b40: ffff000008f79000 ffff000008c4cd88
ffff80003d847bf0 ffff000008101778
[ 0.030402] 7b60: 0000000000000030 0000000000000000
ffff000008e97000 00000000024000c0
[ 0.030647] 7b80: 0000000000000000 0000000000000000
0000000000000000 0000000000000000
[ 0.030895] 7ba0: 0000000000000035 ffff80003d870000
000000000000017f 0000000000000000
[ 0.031144] 7bc0: 0000000000000000 0000000000000005
ffff000008f79c84 6120757063726570
[ 0.031394] 7be0: 6f697461636f6c6c ffff80003d847a40
0000000000000042 0000000000000006
[ 0.031643] 7c00: 0000000000000041 ffff000008f79c4d
ffff000088f79c3f 0000000000000006
[ 0.031877] 7c20: 00000000deadbeef 0000000000000a3f
[ 0.032051] [<ffff00000818e678>] pcpu_alloc+0x88/0x6c0
[ 0.032229] [<ffff00000818ece8>] __alloc_percpu+0x18/0x20
[ 0.032409] [<ffff000008d9606c>] xen_guest_init+0x174/0x2f4
[ 0.032591] [<ffff0000080830f8>] do_one_initcall+0x38/0x130
[ 0.032783] [<ffff000008d90c34>] kernel_init_freeable+0xe0/0x248
[ 0.032995] [<ffff00000899a890>] kernel_init+0x10/0x100
[ 0.033172] [<ffff000008082ec0>] ret_from_fork+0x10/0x50--- arch/arm/xen/enlighten.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-)
arch/arm/xen/enlighten.c +1 -2
@@ -372,8 +372,7 @@ static int __init xen_guest_init(void)* for secondary CPUs as they are brought up. * For uniformity we use VCPUOP_register_vcpu_info even on cpu0. */ - xen_vcpu_info =__alloc_percpu (sizeof (struct vcpu_info ), -sizeof (struct vcpu_info )); + xen_vcpu_info = alloc_percpu(struct vcpu_info);if (xen_vcpu_info ==NULL )return -ENOMEM ;
Greg Kroah-Hartman
maintainerPATCH 81/85 xfs: set AGI buffer type in xlog_recover_clear_agi_bucket
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Eric Sandeen <[email protected]>
commit 6b10b23ca94451fae153a5cc8d62fd721bec2019 upstream.
xlog_recover_clear_agi_bucket didn't set the type to XFS_BLFT_AGI_BUF, so we got a warning during log replay (or an ASSERT on a debug build).
XFS (md0): Unknown buffer type 0!
XFS (md0): _xfs_buf_ioapply: no ops on block 0xaea8802/0x1
Fix this, as was done in f19b872b for 2 other locations with the same problem.
--- fs/xfs/xfs_log_recover.c | 1 + 1 file changed, 1 insertion(+)
fs/xfs/xfs_log_recover.c +1 -0
@@ -4506,6 +4506,7 @@ xlog_recover_clear_agi_bucket( agi->agi_unlinked[bucket] =cpu_to_be32 (NULLAGINO ); offset = offsetof(xfs_agi_t , agi_unlinked) + (sizeof (xfs_agino_t) * bucket); +xfs_trans_buf_set_type (tp, agibp,XFS_BLFT_AGI_BUF );xfs_trans_log_buf (tp, agibp, offset, (offset +sizeof (xfs_agino_t) -1 ));
Greg Kroah-Hartman
maintainerPATCH 82/85 arm64: mark reserved memblock regions explicitly in iomem
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: AKASHI Takahiro <[email protected]>
commit e7cd190385d17790cc3eb3821b1094b00aacf325 upstream.
Kdump(kexec-tools) parses /proc/iomem to identify all the memory regions on the system. Since the current kernel names "nomap" regions, like UEFI runtime services code/data, as "System RAM," kexec-tools sets up elf core header to include them in a crash dump file (/proc/vmcore).
Then crash dump kernel parses UEFI memory map again, re-marks those regions as "nomap" and does not create a memory mapping for them unlike the other areas of System RAM. In this case, copying /proc/vmcore through copy_oldmem_page() on crash dump kernel will end up with a kernel abort, as reported in [1].
This patch names all the "nomap" regions explicitly as "reserved" so that we can exclude them from a crash dump file. acpi_os_ioremap() must also be modified because those regions have WB attributes [2].
Apart from kdump, this change also matches x86's use of acpi (and /proc/iomem).
[1] http://lists.infradead.org/pipermail/linux-arm-kernel/2016-August/448186.html
[2] http://lists.infradead.org/pipermail/linux-arm-kernel/2016-August/450089.html
--- arch/arm64/include/asm/acpi.h | 8 ++++++-- arch/arm64/kernel/setup.c | 9 +++++++-- 2 files changed, 13 insertions(+), 4 deletions(-)
arch/arm64/include/asm/acpi.h +6 -2
@@ -12,7 +12,7 @@#ifndef _ASM_ACPI_H#define _ASM_ACPI_H -#include <linux/mm.h> +#include <linux/memblock.h> #include <linux/psci.h> #include <asm/cputype.h>
@@ -32,7 +32,11 @@static inline void __iomem *acpi_os_ioremap (acpi_physical_address phys,acpi_size size) { -if (!page_is_ram (phys >>PAGE_SHIFT )) +/* +* EFI's reserve_regions() call adds memory with the WB attribute +* to memblock via early_init_dt_add_memory_arch(). +*/ +if (!memblock_is_memory (phys))return ioremap (phys, size);return ioremap_cache (phys, size);
arch/arm64/kernel/setup.c +7 -2
@@ -206,10 +206,15 @@ static void __init request_standard_resofor_each_memblock (memory, region) { res =alloc_bootmem_low (sizeof (*res)); - res->name ="System RAM" ; +if (memblock_is_nomap (region)) { + res->name ="reserved" ; + res->flags =IORESOURCE_MEM |IORESOURCE_BUSY ; + }else { + res->name ="System RAM" ; + res->flags =IORESOURCE_SYSTEM_RAM |IORESOURCE_BUSY ; + } res->start =__pfn_to_phys (memblock_region_memory_base_pfn (region)); res->end =__pfn_to_phys (memblock_region_memory_end_pfn (region)) -1 ; - res->flags =IORESOURCE_SYSTEM_RAM |IORESOURCE_BUSY ;request_resource (&iomem_resource, res);
Greg Kroah-Hartman
maintainerPATCH 83/85 Revert "netfilter: nat: convert nat bysrc hash to rhashtable"
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit 870190a9ec9075205c0fa795a09fa931694a3ff1 as it is not working properly. Please move to 4.9 to get the full fix.
--- include/net/netfilter/nf_conntrack.h | 3 include/net/netfilter/nf_nat.h | 1 net/netfilter/nf_nat_core.c | 122 ++++++++++++++++------------------- 3 files changed, 57 insertions(+), 69 deletions(-)
include/net/netfilter/nf_conntrack.h +1 -2
@@ -17,7 +17,6 @@#include <linux/bitops.h> #include <linux/compiler.h> #include <linux/atomic.h> -#include <linux/rhashtable.h> #include <linux/netfilter/nf_conntrack_tcp.h> #include <linux/netfilter/nf_conntrack_dccp.h>
@@ -119,7 +118,7 @@ struct nf_conn {struct nf_ct_ext *ext;#if IS_ENABLED (CONFIG_NF_NAT ) -struct rhash_head nat_bysource; +struct hlist_node nat_bysource;#endif /* Storage reserved for other modules, must be the last member */ union nf_conntrack_proto proto;
include/net/netfilter/nf_nat.h +0 -1
@@ -1,6 +1,5 @@#ifndef _NF_NAT_H#define _NF_NAT_H -#include <linux/rhashtable.h> #include <linux/netfilter_ipv4.h> #include <linux/netfilter/nf_nat.h> #include <net/netfilter/nf_conntrack_tuple.h>
net/netfilter/nf_nat_core.c +56 -66
206 lines not on this page · raw message
Greg Kroah-Hartman
maintainerPATCH 84/85 Revert "netfilter: move nat hlist_head to nf_conn"
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
This reverts commit 7c9664351980aaa6a4b8837a314360b3a4ad382a as it is not working properly. Please move to 4.9 to get the full fix.
--- include/net/netfilter/nf_conntrack.h | 3 -- include/net/netfilter/nf_conntrack_extend.h | 3 ++ include/net/netfilter/nf_nat.h | 2 + net/netfilter/nf_conntrack_extend.c | 15 +++++++++++- net/netfilter/nf_nat_core.c | 33 ++++++++++++++++++++++------ 5 files changed, 44 insertions(+), 12 deletions(-)
include/net/netfilter/nf_conntrack.h +0 -3
@@ -117,9 +117,6 @@ struct nf_conn {/* Extensions */ struct nf_ct_ext *ext; -#if IS_ENABLED (CONFIG_NF_NAT ) -struct hlist_node nat_bysource; -#endif /* Storage reserved for other modules, must be the last member */ union nf_conntrack_proto proto; };
include/net/netfilter/nf_conntrack_extend.h +3 -0
@@ -99,6 +99,9 @@ void *__nf_ct_ext_add_length(struct nf_cstruct nf_ct_ext_type {/* Destroys relationships (can be NULL). */ void (*destroy)(struct nf_conn *ct); +/* Called when realloacted (can be NULL). +Contents has already been moved. */ +void (*move)(void *new,void *old);enum nf_ct_ext_id id;
include/net/netfilter/nf_nat.h +2 -0
@@ -29,6 +29,8 @@ struct nf_conn;/* The structure embedded in the conntrack structure. */ struct nf_conn_nat { +struct hlist_node bysource; +struct nf_conn *ct;union nf_conntrack_nat_help help;#if IS_ENABLED (CONFIG_NF_NAT_MASQUERADE_IPV4 ) || \IS_ENABLED (CONFIG_NF_NAT_MASQUERADE_IPV6 )
net/netfilter/nf_conntrack_extend.c +13 -2
@@ -73,7 +73,7 @@ void *__nf_ct_ext_add_length(struct nf_c size_t var_alloc_len, gfp_t gfp) {struct nf_ct_ext *old, *new; -int newlen, newoff; +int i, newlen, newoff;struct nf_ct_ext_type *t;/* Conntrack must not be confirmed to avoid races on reallocation. */
@@ -99,8 +99,19 @@ void *__nf_ct_ext_add_length(struct nf_creturn NULL ;if (new != old) { +for (i =0 ; i <NF_CT_EXT_NUM ; i++) { +if (!__nf_ct_ext_exist (old, i)) +continue ; + +rcu_read_lock (); + t =rcu_dereference (nf_ct_ext_types[i]); +if (t && t->move) + t->move ((void *)new + new->offset[i], + (void *)old + old->offset[i]); +rcu_read_unlock (); + }kfree_rcu (old, rcu); -rcu_assign_pointer (ct->ext, new); + ct->ext = new; } new->offset[id] = newoff;
net/netfilter/nf_nat_core.c +26 -7
@@ -198,9 +198,11 @@ find_appropriate_src(struct net *net, const struct nf_nat_range *range) {unsigned int h =hash_by_src (net, tuple); +const struct nf_conn_nat *nat;const struct nf_conn *ct; -hlist_for_each_entry_rcu (ct, &nf_nat_bysource[h], nat_bysource) { +hlist_for_each_entry_rcu (nat, &nf_nat_bysource[h], bysource) { + ct = nat->ct;if (same_src (ct, tuple) &&net_eq (net,nf_ct_net (ct)) &&nf_ct_zone_equal (ct, zone,IP_CT_DIR_ORIGINAL )) {
@@ -434,7 +436,8 @@ nf_nat_setup_info(struct nf_conn *ct,spin_lock_bh (&nf_nat_lock);/* nf_conntrack_alter_reply might re-allocate extension aera */ nat =nfct_nat (ct); -hlist_add_head_rcu (&ct->nat_bysource, + nat->ct = ct; +hlist_add_head_rcu (&nat->bysource, &nf_nat_bysource[srchash]);spin_unlock_bh (&nf_nat_lock); }
@@ -541,7 +544,7 @@ static int nf_nat_proto_clean(struct nf_if (nf_nat_proto_remove (ct, data))return 1 ; -if (!nat) +if (!nat || !nat->ct)return 0 ;/* This netns is being destroyed, and conntrack has nat null binding.
@@ -554,8 +557,9 @@ static int nf_nat_proto_clean(struct nf_return 1 ;spin_lock_bh (&nf_nat_lock); -hlist_del_rcu (&ct->nat_bysource); +hlist_del_rcu (&nat->bysource); ct->status &= ~IPS_NAT_DONE_MASK ; + nat->ct =NULL ;spin_unlock_bh (&nf_nat_lock);add_timer (&ct->timeout);
@@ -685,13 +689,27 @@ static void nf_nat_cleanup_conntrack(str {struct nf_conn_nat *nat =nf_ct_ext_find (ct,NF_CT_EXT_NAT ); -if (!nat) +if (nat ==NULL || nat->ct ==NULL )return ; -NF_CT_ASSERT (ct->status &IPS_SRC_NAT_DONE ); +NF_CT_ASSERT (nat->ct->status &IPS_SRC_NAT_DONE ); + +spin_lock_bh (&nf_nat_lock); +hlist_del_rcu (&nat->bysource); +spin_unlock_bh (&nf_nat_lock); +} + +static void nf_nat_move_storage (void *new,void *old) +{ +struct nf_conn_nat *new_nat = new; +struct nf_conn_nat *old_nat = old; +struct nf_conn *ct = old_nat->ct; + +if (!ct || !(ct->status &IPS_SRC_NAT_DONE )) +return ;spin_lock_bh (&nf_nat_lock); -hlist_del_rcu (&ct->nat_bysource); +hlist_replace_rcu (&old_nat->bysource, &new_nat->bysource);spin_unlock_bh (&nf_nat_lock); }
@@ -699,6 +717,7 @@ static struct nf_ct_ext_type nat_extend .len = sizeof(struct nf_conn_nat), .align = __alignof__(struct nf_conn_nat), .destroy = nf_nat_cleanup_conntrack, + .move = nf_nat_move_storage, .id = NF_CT_EXT_NAT, .flags = NF_CT_EXT_F_PREALLOC, };
Greg Kroah-Hartman
maintainerPATCH 85/85 driver core: fix race between creating/querying glue dir and its cleanup
In reply to Greg Kroah-Hartman4.8-stable review patch. If anyone has any objections, please let me know.
------------------
From: Ming Lei <[email protected]>
commit cebf8fd16900fdfd58c0028617944f808f97fe50 upstream.
The global mutex of 'gdp_mutex' is used to serialize creating/querying glue dir and its cleanup. Turns out it isn't a perfect way because part(kobj_kset_leave()) of the actual cleanup action() is done inside the release handler of the glue dir kobject. That means gdp_mutex has to be held before releasing the last reference count of the glue dir kobject.
This patch moves glue dir's cleanup after kobject_del() in device_del() for avoiding the race.
--- drivers/base/core.c | 39 +++++++++++++++++++++++++++++---------- 1 file changed, 29 insertions(+), 10 deletions(-)
drivers/base/core.c +29 -10
@@ -836,11 +836,29 @@ static struct kobject *get_device_parentreturn NULL ; } +static inline bool live_in_glue_dir (struct kobject *kobj, +struct device *dev) +{ +if (!kobj || !dev->class || + kobj->kset != &dev->class->p->glue_dirs) +return false; +return true; +} + +static inline struct kobject *get_glue_dir (struct device *dev) +{ +return dev->kobj.parent; +} + +/* +* make sure cleaning up dir as the last step, we need to make +* sure .release handler of kobject is run with holding the +* global lock +*/ static void cleanup_glue_dir (struct device *dev,struct kobject *glue_dir) {/* see if we live in a "glue" directory */ -if (!glue_dir || !dev->class || - glue_dir->kset != &dev->class->p->glue_dirs) +if (!live_in_glue_dir (glue_dir, dev))return ;mutex_lock (&gdp_mutex);
@@ -848,11 +866,6 @@ static void cleanup_glue_dir(struct devimutex_unlock (&gdp_mutex); } -static void cleanup_device_parent (struct device *dev) -{ -cleanup_glue_dir (dev, dev->kobj.parent); -} -static int device_add_class_symlinks (struct device *dev) {struct device_node *of_node =dev_of_node (dev);
@@ -1028,6 +1041,7 @@ int device_add(struct device *dev)struct kobject *kobj;struct class_interface *class_intf;int error = -EINVAL ; +struct kobject *glue_dir =NULL ; dev =get_device (dev);if (!dev)
@@ -1072,8 +1086,10 @@ int device_add(struct device *dev)/* first, register with generic layer. */ /* we require the name to be set before, and pass NULL */ error =kobject_add (&dev->kobj, dev->kobj.parent,NULL ); -if (error) +if (error) { + glue_dir =get_glue_dir (dev); goto Error; + }/* notify platform of device entry */ if (platform_notify)
@@ -1154,9 +1170,10 @@ done:device_remove_file (dev, &dev_attr_uevent); attrError:kobject_uevent (&dev->kobj,KOBJ_REMOVE ); + glue_dir =get_glue_dir (dev);kobject_del (&dev->kobj); Error: -cleanup_device_parent (dev); +cleanup_glue_dir (dev, glue_dir);put_device (parent); name_error:kfree (dev->p);
@@ -1232,6 +1249,7 @@ EXPORT_SYMBOL_GPL(put_device);void device_del (struct device *dev) {struct device *parent = dev->parent; +struct kobject *glue_dir =NULL ;struct class_interface *class_intf;/* Notify clients of device removal. This call must come
@@ -1276,8 +1294,9 @@ void device_del(struct device *dev)blocking_notifier_call_chain (&dev->bus->p->bus_notifier,BUS_NOTIFY_REMOVED_DEVICE , dev);kobject_uevent (&dev->kobj,KOBJ_REMOVE ); -cleanup_device_parent (dev); + glue_dir =get_glue_dir (dev);kobject_del (&dev->kobj); +cleanup_glue_dir (dev, glue_dir);put_device (parent); }EXPORT_SYMBOL_GPL (device_del);
Quoted 9 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.8.16 release. There are 85 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri Jan 6 20:06:45 UTC 2017. Anything received after that time might be too late.
The whole patch series can be found in one patch at:
Quoted 9 lines
kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.8.16-rc1.gzor in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.gitlinux-4.8.y
and the diffstat can be found below.thanks,
greg k-h
Compiled and booted on my test system. No dmesg regressions.
thanks,
-- Shuah
Signature · 5 lines
Shuah Khan Sr. Linux Kernel Developer Open Source Innovation Group Samsung Research America(Silicon Valley) [email protected]
Quoted 8 lines · Greg Kroah-Hartman
This is the start of the stable review cycle for the 4.8.16 release. There are 85 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.
Responses should be made by Fri Jan 6 20:06:45 UTC 2017. Anything received after that time might be too late.
Build results:
total: 150 pass: 150 fail: 0 Qemu test results: total: 122 pass: 122 fail: 0
Details are available at http://kerneltests.org/builders.
Guenter