5.10.78-rc1 review

From: Ming Lei <[email protected]>

commit f2b85040acec9a928b4eb1b57a989324e8e38d3f upstream.

SCSI host release is triggered when SCSI device is freed. We have to make sure that the low-level device driver module won't be unloaded before SCSI host instance is released because shost->hostt is required in the release handler.

Make sure to put LLD module refcnt after SCSI device is released.

Fixes a kernel panic of 'BUG: unable to handle page fault for address' reported by Changhui and Yi.

---
 drivers/scsi/scsi.c       |    4 +++-
 drivers/scsi/scsi_sysfs.c |    9 +++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

@@ -545,8 +545,10 @@ EXPORT_SYMBOL(scsi_device_get);
  */
 void scsi_device_put(struct scsi_device *sdev)
 {
-	module_put(sdev->host->hostt->module);
+	struct module *mod = sdev->host->hostt->module;
+
 	put_device(&sdev->sdev_gendev);
+	module_put(mod);
 }
 EXPORT_SYMBOL(scsi_device_put);
 

@@ -450,9 +450,12 @@ static void scsi_device_dev_release_user
 	struct scsi_vpd *vpd_pg80 = NULL, *vpd_pg83 = NULL;
 	struct scsi_vpd *vpd_pg0 = NULL, *vpd_pg89 = NULL;
 	unsigned long flags;
+	struct module *mod;
 
 	sdev = container_of(work, struct scsi_device, ew.work);
 
+	mod = sdev->host->hostt->module;
+
 	scsi_dh_release_device(sdev);
 
 	parent = sdev->sdev_gendev.parent;

@@ -501,11 +504,17 @@ static void scsi_device_dev_release_user
 
 	if (parent)
 		put_device(parent);
+	module_put(mod);
 }
 
 static void scsi_device_dev_release(struct device *dev)
 {
 	struct scsi_device *sdp = to_scsi_device(dev);
+
+	/* Set module pointer as NULL in case of module unloading */
+	if (!try_module_get(sdp->host->hostt->module))
+		sdp->host->hostt->module = NULL;
+
 	execute_in_process_context(scsi_device_dev_release_usercontext,
 				   &sdp->ew);
 }

From: Lee Jones <[email protected]>

This reverts commit 88dbd085a51ec78c83dde79ad63bca8aa4272a9d.

Causes the following Syzkaller reported issue:

BUG: kernel NULL pointer dereference, address: 0000000000000010
PGD 0 P4D 0
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 546 Comm: syz-executor631 Tainted: G    B             5.10.76-syzkaller-01178-g4944ec82ebb9 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:arch_atomic_try_cmpxchg syzkaller/managers/android-5-10/kernel/./arch/x86/include/asm/atomic.h:202 [inline]
RIP: 0010:atomic_try_cmpxchg_acquire syzkaller/managers/android-5-10/kernel/./include/asm-generic/atomic-instrumented.h:707 [inline]
RIP: 0010:queued_spin_lock syzkaller/managers/android-5-10/kernel/./include/asm-generic/qspinlock.h:82 [inline]
RIP: 0010:do_raw_spin_lock_flags syzkaller/managers/android-5-10/kernel/./include/linux/spinlock.h:195 [inline]
RIP: 0010:__raw_spin_lock_irqsave syzkaller/managers/android-5-10/kernel/./include/linux/spinlock_api_smp.h:119 [inline]
RIP: 0010:_raw_spin_lock_irqsave+0x10d/0x210 syzkaller/managers/android-5-10/kernel/kernel/locking/spinlock.c:159
Code: 00 00 00 e8 d5 29 09 fd 4c 89 e7 be 04 00 00 00 e8 c8 29 09 fd 42 8a 04 3b 84 c0 0f 85 be 00 00 00 8b 44 24 40 b9 01 00 00 00 <f0> 41 0f b1 4d 00 75 45 48 c7 44 24 20 0e 36 e0 45 4b c7 04 37 00
RSP: 0018:ffffc90000f174e0 EFLAGS: 00010097
RAX: 0000000000000000 RBX: 1ffff920001e2ea4 RCX: 0000000000000001
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90000f17520
RBP: ffffc90000f175b0 R08: dffffc0000000000 R09: 0000000000000003
R10: fffff520001e2ea5 R11: 0000000000000004 R12: ffffc90000f17520
R13: 0000000000000010 R14: 1ffff920001e2ea0 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 000000000640f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 prepare_to_wait+0x9c/0x290 syzkaller/managers/android-5-10/kernel/kernel/sched/wait.c:248
 io_uring_cancel_files syzkaller/managers/android-5-10/kernel/fs/io_uring.c:8690 [inline]
 io_uring_cancel_task_requests+0x16a9/0x1ed0 syzkaller/managers/android-5-10/kernel/fs/io_uring.c:8760
 io_uring_flush+0x170/0x6d0 syzkaller/managers/android-5-10/kernel/fs/io_uring.c:8923
 filp_close+0xb0/0x150 syzkaller/managers/android-5-10/kernel/fs/open.c:1319
 close_files syzkaller/managers/android-5-10/kernel/fs/file.c:401 [inline]
 put_files_struct+0x1d4/0x350 syzkaller/managers/android-5-10/kernel/fs/file.c:429
 exit_files+0x80/0xa0 syzkaller/managers/android-5-10/kernel/fs/file.c:458
 do_exit+0x6d9/0x23a0 syzkaller/managers/android-5-10/kernel/kernel/exit.c:808
 do_group_exit+0x16a/0x2d0 syzkaller/managers/android-5-10/kernel/kernel/exit.c:910
 get_signal+0x133e/0x1f80 syzkaller/managers/android-5-10/kernel/kernel/signal.c:2790
 arch_do_signal+0x8d/0x620 syzkaller/managers/android-5-10/kernel/arch/x86/kernel/signal.c:805
 exit_to_user_mode_loop syzkaller/managers/android-5-10/kernel/kernel/entry/common.c:161 [inline]
 exit_to_user_mode_prepare+0xaa/0xe0 syzkaller/managers/android-5-10/kernel/kernel/entry/common.c:191
 syscall_exit_to_user_mode+0x24/0x40 syzkaller/managers/android-5-10/kernel/kernel/entry/common.c:266
 do_syscall_64+0x3d/0x70 syzkaller/managers/android-5-10/kernel/arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7fc6d1589a89
Code: Unable to access opcode bytes at RIP 0x7fc6d1589a5f.
RSP: 002b:00007ffd2b5da728 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffdfc RBX: 0000000000005193 RCX: 00007fc6d1589a89
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc6d161142c
RBP: 0000000000000032 R08: 00007ffd2b5eb0b8 R09: 0000000000000000
R10: 00007ffd2b5da750 R11: 0000000000000246 R12: 00007fc6d161142c
R13: 00007ffd2b5da750 R14: 00007ffd2b5da770 R15: 0000000000000000
Modules linked in:
CR2: 0000000000000010
---[ end trace fe8044f7dc4d8d65 ]---
RIP: 0010:arch_atomic_try_cmpxchg syzkaller/managers/android-5-10/kernel/./arch/x86/include/asm/atomic.h:202 [inline]
RIP: 0010:atomic_try_cmpxchg_acquire syzkaller/managers/android-5-10/kernel/./include/asm-generic/atomic-instrumented.h:707 [inline]
RIP: 0010:queued_spin_lock syzkaller/managers/android-5-10/kernel/./include/asm-generic/qspinlock.h:82 [inline]
RIP: 0010:do_raw_spin_lock_flags syzkaller/managers/android-5-10/kernel/./include/linux/spinlock.h:195 [inline]
RIP: 0010:__raw_spin_lock_irqsave syzkaller/managers/android-5-10/kernel/./include/linux/spinlock_api_smp.h:119 [inline]
RIP: 0010:_raw_spin_lock_irqsave+0x10d/0x210 syzkaller/managers/android-5-10/kernel/kernel/locking/spinlock.c:159
Code: 00 00 00 e8 d5 29 09 fd 4c 89 e7 be 04 00 00 00 e8 c8 29 09 fd 42 8a 04 3b 84 c0 0f 85 be 00 00 00 8b 44 24 40 b9 01 00 00 00 <f0> 41 0f b1 4d 00 75 45 48 c7 44 24 20 0e 36 e0 45 4b c7 04 37 00
RSP: 0018:ffffc90000f174e0 EFLAGS: 00010097
RAX: 0000000000000000 RBX: 1ffff920001e2ea4 RCX: 0000000000000001
RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffc90000f17520
RBP: ffffc90000f175b0 R08: dffffc0000000000 R09: 0000000000000003
R10: fffff520001e2ea5 R11: 0000000000000004 R12: ffffc90000f17520
R13: 0000000000000010 R14: 1ffff920001e2ea0 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000010 CR3: 000000000640f000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
   0:	00 00                	add    %al,(%rax)
   2:	e8 d5 29 09 fd       	callq  0xfd0929dc
   7:	4c 89 e7             	mov    %r12,%rdi
   a:	be 04 00 00 00       	mov    $0x4,%esi
   f:	e8 c8 29 09 fd       	callq  0xfd0929dc
  14:	42 8a 04 3b          	mov    (%rbx,%r15,1),%al
  18:	84 c0                	test   %al,%al
  1a:	0f 85 be 00 00 00    	jne    0xde
  20:	8b 44 24 40          	mov    0x40(%rsp),%eax
  24:	b9 01 00 00 00       	mov    $0x1,%ecx
* 29:	f0 41 0f b1 4d 00    	lock cmpxchg %ecx,0x0(%r13) <-- trapping instruction
  2f:	75 45                	jne    0x76
  31:	48 c7 44 24 20 0e 36 	movq   $0x45e0360e,0x20(%rsp)
  38:	e0 45
  3a:	4b                   	rex.WXB
  3b:	c7                   	.byte 0xc7
  3c:	04 37                	add    $0x37,%al

---
 fs/io_uring.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

@@ -8759,9 +8759,10 @@ static void io_uring_cancel_task_request
 	io_cancel_defer_files(ctx, task, files);
 	io_cqring_overflow_flush(ctx, true, task, files);
 
-	io_uring_cancel_files(ctx, task, files);
 	if (!files)
 		__io_uring_cancel_task_requests(ctx, task);
+	else
+		io_uring_cancel_files(ctx, task, files);
 
 	if ((ctx->flags & IORING_SETUP_SQPOLL) && ctx->sq_data) {
 		atomic_dec(&task->io_uring->in_idle);

From: Erik Ekman <[email protected]>

commit 041c61488236a5a84789083e3d9f0a51139b6edf upstream.

Everything except the first 32 bits was lost when the pause flags were added. This makes the 50000baseCR2 mode flag (bit 34) not appear.

I have tested this with a 10G card (SFN5122F-R7) by modifying it to return a non-legacy link mode (10000baseCR).

---
 drivers/net/ethernet/sfc/ethtool_common.c |   10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

@@ -563,20 +563,14 @@ int efx_ethtool_get_link_ksettings(struc
 {
 	struct efx_nic *efx = netdev_priv(net_dev);
 	struct efx_link_state *link_state = &efx->link_state;
-	u32 supported;
 
 	mutex_lock(&efx->mac_lock);
 	efx_mcdi_phy_get_link_ksettings(efx, cmd);
 	mutex_unlock(&efx->mac_lock);
 
 	/* Both MACs support pause frames (bidirectional and respond-only) */
-	ethtool_convert_link_mode_to_legacy_u32(&supported,
-						cmd->link_modes.supported);
-
-	supported |= SUPPORTED_Pause | SUPPORTED_Asym_Pause;
-
-	ethtool_convert_legacy_u32_to_link_mode(cmd->link_modes.supported,
-						supported);
+	ethtool_link_ksettings_add_link_mode(cmd, supported, Pause);
+	ethtool_link_ksettings_add_link_mode(cmd, supported, Asym_Pause);
 
 	if (LOOPBACK_INTERNAL(efx)) {
 		cmd->base.speed = link_state->speed;

From: Eugene Crosser <[email protected]>

commit 55161e67d44fdd23900be166a81e996abd6e3be9 upstream.

This reverts commit 09e856d54bda5f288ef8437a90ab2b9b3eab83d1.

When an interface is enslaved in a VRF, prerouting conntrack hook is called twice: once in the context of the original input interface, and once in the context of the VRF interface. If no special precausions are taken, this leads to creation of two conntrack entries instead of one, and breaks SNAT.

Commit above was intended to avoid creation of extra conntrack entries when input interface is enslaved in a VRF. It did so by resetting conntrack related data associated with the skb when it enters VRF context.

However it breaks netfilter operation. Imagine a use case when conntrack zone must be assigned based on the original input interface, rather than VRF interface (that would make original interfaces indistinguishable). One could create netfilter rules similar to these:

        chain rawprerouting {
                type filter hook prerouting priority raw;
                iif realiface1 ct zone set 1 return
                iif realiface2 ct zone set 2 return
        }

This works before the mentioned commit, but not after: zone assignment is "forgotten", and any subsequent NAT or filtering that is dependent on the conntrack zone does not work.

Here is a reproducer script that demonstrates the difference in behaviour.

==========
#!/bin/sh

# This script demonstrates unexpected change of nftables behaviour

# caused by commit 09e856d54bda5f28 ""vrf: Reset skb conntrack
# connection on VRF rcv"
# https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=09e856d54bda5f288ef8437a90ab2b9b3eab83d1
#
# Before the commit, it was possible to assign conntrack zone to a
# packet (or mark it for `notracking`) in the prerouting chanin, raw
# priority, based on the `iif` (interface from which the packet
# arrived).
# After the change, # if the interface is enslaved in a VRF, such
# assignment is lost. Instead, assignment based on the `iif` matching
# the VRF master interface is honored. Thus it is impossible to
# distinguish packets based on the original interface.
#
# This script demonstrates this change of behaviour: conntrack zone 1
# or 2 is assigned depending on the match with the original interface
# or the vrf master interface. It can be observed that conntrack entry
# appears in different zone in the kernel versions before and after
# the commit.

IPIN=172.30.30.1
IPOUT=172.30.30.2
PFXL=30

ip li sh vein >/dev/null 2>&1 && ip li del vein
ip li sh tvrf >/dev/null 2>&1 && ip li del tvrf
nft list table testct >/dev/null 2>&1 && nft delete table testct

ip li add vein type veth peer veout
ip li add tvrf type vrf table 9876
ip li set veout master tvrf
ip li set vein up
ip li set veout up
ip li set tvrf up
/sbin/sysctl -w net.ipv4.conf.veout.accept_local=1 /sbin/sysctl -w net.ipv4.conf.veout.rp_filter=0 ip addr add $IPIN/$PFXL dev vein
ip addr add $IPOUT/$PFXL dev veout

nft -f - <<__END__

table testct {
	chain rawpre {
		type filter hook prerouting priority raw;
		iif { veout, tvrf } meta nftrace set 1
		iif veout ct zone set 1 return
		iif tvrf ct zone set 2 return
		notrack
	}
	chain rawout {
		type filter hook output priority raw;
		notrack
	}
}

__END__

uname -rv
conntrack -F
ping -W 1 -c 1 -I vein $IPOUT
conntrack -L

---
 drivers/net/vrf.c |    4 ----
 1 file changed, 4 deletions(-)

@@ -1313,8 +1313,6 @@ static struct sk_buff *vrf_ip6_rcv(struc
 	bool need_strict = rt6_need_strict(&ipv6_hdr(skb)->daddr);
 	bool is_ndisc = ipv6_ndisc_frame(skb);
 
-	nf_reset_ct(skb);
-
 	/* loopback, multicast & non-ND link-local traffic; do not push through
 	 * packet taps again. Reset pkt_type for upper layers to process skb.
 	 * For strict packets with a source LLA, determine the dst using the

@@ -1371,8 +1369,6 @@ static struct sk_buff *vrf_ip_rcv(struct
 	skb->skb_iif = vrf_dev->ifindex;
 	IPCB(skb)->flags |= IPSKB_L3SLAVE;
 
-	nf_reset_ct(skb);
-
 	if (ipv4_is_multicast(ip_hdr(skb)->daddr))
 		goto out;
 

From: Yuiko Oshino <[email protected]>

commit e8684db191e4164f3f5f3ad7dec04a6734c25f1c upstream.

The driver allocates skb during ndo_open with GFP_ATOMIC which has high chance of failure when there are multiple instances. GFP_KERNEL is enough while open and use GFP_ATOMIC only from interrupt context.

---
 drivers/net/ethernet/microchip/lan743x_main.c |   10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

@@ -1963,13 +1963,13 @@ static int lan743x_rx_next_index(struct
 	return ((++index) % rx->ring_size);
 }
 
-static struct sk_buff *lan743x_rx_allocate_skb(struct lan743x_rx *rx)
+static struct sk_buff *lan743x_rx_allocate_skb(struct lan743x_rx *rx, gfp_t gfp)
 {
 	int length = 0;
 
 	length = (LAN743X_MAX_FRAME_SIZE + ETH_HLEN + 4 + RX_HEAD_PADDING);
 	return __netdev_alloc_skb(rx->adapter->netdev,
-				  length, GFP_ATOMIC | GFP_DMA);
+				  length, gfp);
 }
 
 static void lan743x_rx_update_tail(struct lan743x_rx *rx, int index)

@@ -2141,7 +2141,8 @@ static int lan743x_rx_process_packet(str
 			struct sk_buff *new_skb = NULL;
 			int packet_length;
 
-			new_skb = lan743x_rx_allocate_skb(rx);
+			new_skb = lan743x_rx_allocate_skb(rx,
+							  GFP_ATOMIC | GFP_DMA);
 			if (!new_skb) {
 				/* failed to allocate next skb.
 				 * Memory is very low.

@@ -2377,7 +2378,8 @@ static int lan743x_rx_ring_init(struct l
 
 	rx->last_head = 0;
 	for (index = 0; index < rx->ring_size; index++) {
-		struct sk_buff *new_skb = lan743x_rx_allocate_skb(rx);
+		struct sk_buff *new_skb = lan743x_rx_allocate_skb(rx,
+								   GFP_KERNEL);
 
 		ret = lan743x_rx_init_ring_element(rx, index, new_skb);
 		if (ret)

From: Yang Shi <[email protected]>

commit c7cb42e94473aafe553c0f2a3d8ca904599399ed upstream.

When handling THP hwpoison checked if the THP is in allocation or free stage since hwpoison may mistreat it as hugetlb page. After commit 415c64c1453a ("mm/memory-failure: split thp earlier in memory error handling") the problem has been fixed, so this check is no longer needed. Remove it. The side effect of the removal is hwpoison may report unsplit THP instead of unknown error for shmem THP. It seems not like a big deal.

The following patch "mm: filemap: check if THP has hwpoisoned subpage for PMD page fault" depends on this, which fixes shmem THP with hwpoisoned subpage(s) are mapped PMD wrongly. So this patch needs to be backported to -stable as well.

---
 mm/memory-failure.c |   14 --------------
 1 file changed, 14 deletions(-)

@@ -956,20 +956,6 @@ static int get_hwpoison_page(struct page
 {
 	struct page *head = compound_head(page);
 
-	if (!PageHuge(head) && PageTransHuge(head)) {
-		/*
-		 * Non anonymous thp exists only in allocation/free time. We
-		 * can't handle such a case correctly, so let's give it up.
-		 * This should be better than triggering BUG_ON when kernel
-		 * tries to touch the "partially handled" page.
-		 */
-		if (!PageAnon(head)) {
-			pr_err("Memory failure: %#lx: non anonymous thp\n",
-				page_to_pfn(page));
-			return 0;
-		}
-	}
-
 	if (get_page_unless_zero(head)) {
 		if (head == compound_head(page))
 			return 1;

From: Yang Shi <[email protected]>

commit eac96c3efdb593df1a57bb5b95dbe037bfa9a522 upstream.

When handling shmem page fault the THP with corrupted subpage could be PMD mapped if certain conditions are satisfied. But kernel is supposed to send SIGBUS when trying to map hwpoisoned page.

There are two paths which may do PMD map: fault around and regular fault.

Before commit f9ce0be71d1f ("mm: Cleanup faultaround and finish_fault() codepaths") the thing was even worse in fault around path. The THP could be PMD mapped as long as the VMA fits regardless what subpage is accessed and corrupted. After this commit as long as head page is not corrupted the THP could be PMD mapped.

In the regular fault path the THP could be PMD mapped as long as the corrupted page is not accessed and the VMA fits.

This loophole could be fixed by iterating every subpage to check if any of them is hwpoisoned or not, but it is somewhat costly in page fault path.

So introduce a new page flag called HasHWPoisoned on the first tail page. It indicates the THP has hwpoisoned subpage(s). It is set if any subpage of THP is found hwpoisoned by memory failure and after the refcount is bumped successfully, then cleared when the THP is freed or split.

The soft offline path doesn't need this since soft offline handler just marks a subpage hwpoisoned when the subpage is migrated successfully. But shmem THP didn't get split then migrated at all.

---
 include/linux/page-flags.h |   23 +++++++++++++++++++++++
 mm/huge_memory.c           |    2 ++
 mm/memory-failure.c        |   14 ++++++++++++++
 mm/memory.c                |    9 +++++++++
 mm/page_alloc.c            |    4 +++-
 5 files changed, 51 insertions(+), 1 deletion(-)

@@ -169,6 +169,15 @@ enum pageflags {
 	/* Compound pages. Stored in first tail page's flags */
 	PG_double_map = PG_workingset,
 
+#ifdef CONFIG_MEMORY_FAILURE
+	/*
+	 * Compound pages. Stored in first tail page's flags.
+	 * Indicates that at least one subpage is hwpoisoned in the
+	 * THP.
+	 */
+	PG_has_hwpoisoned = PG_mappedtodisk,
+#endif
+
 	/* non-lru isolated movable page */
 	PG_isolated = PG_reclaim,
 

@@ -667,6 +676,20 @@ static inline int PageTransCompoundMap(s
 	       atomic_read(compound_mapcount_ptr(head));
 }
 
+#if defined(CONFIG_MEMORY_FAILURE) && defined(CONFIG_TRANSPARENT_HUGEPAGE)
+/*
+ * PageHasHWPoisoned indicates that at least one subpage is hwpoisoned in the
+ * compound page.
+ *
+ * This flag is set by hwpoison handler.  Cleared by THP split or free page.
+ */
+PAGEFLAG(HasHWPoisoned, has_hwpoisoned, PF_SECOND)
+	TESTSCFLAG(HasHWPoisoned, has_hwpoisoned, PF_SECOND)
+#else
+PAGEFLAG_FALSE(HasHWPoisoned)
+	TESTSCFLAG_FALSE(HasHWPoisoned)
+#endif
+
 /*
  * PageTransTail returns true for both transparent huge pages
  * and hugetlbfs pages, so it should only be called when it's known

@@ -2464,6 +2464,8 @@ static void __split_huge_page(struct pag
 		xa_lock(&swap_cache->i_pages);
 	}
 
+	ClearPageHasHWPoisoned(head);
+
 	for (i = nr - 1; i >= 1; i--) {
 		__split_huge_page_tail(head, i, lruvec, list);
 		/* Some pages can be beyond i_size: drop them from page cache */

@@ -1367,6 +1367,20 @@ int memory_failure(unsigned long pfn, in
 	}
 
 	if (PageTransHuge(hpage)) {
+		/*
+		 * The flag must be set after the refcount is bumped
+		 * otherwise it may race with THP split.
+		 * And the flag can't be set in get_hwpoison_page() since
+		 * it is called by soft offline too and it is just called
+		 * for !MF_COUNT_INCREASE.  So here seems to be the best
+		 * place.
+		 *
+		 * Don't need care about the above error handling paths for
+		 * get_hwpoison_page() since they handle either free page
+		 * or unhandlable page.  The refcount is bumped iff the
+		 * page is a valid handlable page.
+		 */
+		SetPageHasHWPoisoned(hpage);
 		if (try_to_split_thp_page(p, "Memory Failure") < 0) {
 			action_result(pfn, MF_MSG_UNSPLIT_THP, MF_IGNORED);
 			return -EBUSY;

@@ -3921,6 +3921,15 @@ vm_fault_t finish_fault(struct vm_fault
 		page = vmf->page;
 
 	/*
+	 * Just backoff if any subpage of a THP is corrupted otherwise
+	 * the corrupted page may mapped by PMD silently to escape the
+	 * check.  This kind of THP just can be PTE mapped.  Access to
+	 * the corrupted subpage should trigger SIGBUS as expected.
+	 */
+	if (unlikely(PageHasHWPoisoned(page)))
+		return ret;
+
+	/*
 	 * check even for read faults because we might have lost our CoWed
 	 * page
 	 */

@@ -1232,8 +1232,10 @@ static __always_inline bool free_pages_p
 
 		VM_BUG_ON_PAGE(compound && compound_order(page) != order, page);
 
-		if (compound)
+		if (compound) {
 			ClearPageDoubleMap(page);
+			ClearPageHasHWPoisoned(page);
+		}
 		for (i = 1; i < (1 << order); i++) {
 			if (compound)
 				bad += free_tail_pages_check(page, page + i);

From: Dan Carpenter <[email protected]>

commit 35d2969ea3c7d32aee78066b1f3cf61a0d935a4e upstream.

The bounds checking in avc_ca_pmt() is not strict enough. It should be checking "read_pos + 4" because it's reading 5 bytes. If the "es_info_length" is non-zero then it reads a 6th byte so there needs to be an additional check for that.

I also added checks for the "write_pos". I don't think these are required because "read_pos" and "write_pos" are tied together so checking one ought to be enough. But they make the code easier to understand for me. The check on write_pos is:

	if (write_pos + 4 >= sizeof(c->operand) - 4) {

The first "+ 4" is because we're writing 5 bytes and the last " - 4" is to leave space for the CRC.

The other problem is that "length" can be invalid. It comes from "data_length" in fdtv_ca_pmt().

---
 drivers/media/firewire/firedtv-avc.c |   14 +++++++++++---
 drivers/media/firewire/firedtv-ci.c  |    2 ++
 2 files changed, 13 insertions(+), 3 deletions(-)

@@ -1165,7 +1165,11 @@ int avc_ca_pmt(struct firedtv *fdtv, cha
 		read_pos += program_info_length;
 		write_pos += program_info_length;
 	}
-	while (read_pos < length) {
+	while (read_pos + 4 < length) {
+		if (write_pos + 4 >= sizeof(c->operand) - 4) {
+			ret = -EINVAL;
+			goto out;
+		}
 		c->operand[write_pos++] = msg[read_pos++];
 		c->operand[write_pos++] = msg[read_pos++];
 		c->operand[write_pos++] = msg[read_pos++];

@@ -1177,13 +1181,17 @@ int avc_ca_pmt(struct firedtv *fdtv, cha
 		c->operand[write_pos++] = es_info_length >> 8;
 		c->operand[write_pos++] = es_info_length & 0xff;
 		if (es_info_length > 0) {
+			if (read_pos >= length) {
+				ret = -EINVAL;
+				goto out;
+			}
 			pmt_cmd_id = msg[read_pos++];
 			if (pmt_cmd_id != 1 && pmt_cmd_id != 4)
 				dev_err(fdtv->device, "invalid pmt_cmd_id %d at stream level\n",
 					pmt_cmd_id);
 
-			if (es_info_length > sizeof(c->operand) - 4 -
-					     write_pos) {
+			if (es_info_length > sizeof(c->operand) - 4 - write_pos ||
+			    es_info_length > length - read_pos) {
 				ret = -EINVAL;
 				goto out;
 			}

@@ -134,6 +134,8 @@ static int fdtv_ca_pmt(struct firedtv *f
 	} else {
 		data_length = msg->msg[3];
 	}
+	if (data_length > sizeof(msg->msg) - data_pos)
+		return -EINVAL;
 
 	return avc_ca_pmt(fdtv, &msg->msg[data_pos], data_length);
 }

This is the start of the stable review cycle for the 5.10.78 release. There are 16 patches in this series, all will be posted as a response to this one. If anyone has any issues with these being applied, please let me know.

Responses should be made by Sat, 06 Nov 2021 14:11:51 +0000. Anything received after that time might be too late.

The whole patch series can be found in one patch at:

	https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.10.78-rc1.gz

or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.10.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>

    Linux 5.10.78-rc1

Takashi Iwai <[email protected]>
ALSA: usb-audio: Add Audient iD14 to mixer map quirk table

Takashi Iwai <[email protected]>
ALSA: usb-audio: Add Schiit Hel device to mixer map quirk table

Bryan O'Donoghue <[email protected]>
Revert "wcn36xx: Disable bmps when encryption is disabled"

Wang Kefeng <[email protected]>
ARM: 9120/1: Revert "amba: make use of -1 IRQs warn"

Greg Kroah-Hartman <[email protected]>
Revert "drm/ttm: fix memleak in ttm_transfered_destroy"

Yang Shi <[email protected]>
mm: khugepaged: skip huge page collapse for special files

Greg Kroah-Hartman <[email protected]>
Revert "usb: core: hcd: Add support for deferring roothub registration"

Greg Kroah-Hartman <[email protected]>
Revert "xhci: Set HCD flag to defer primary roothub registration"

Dan Carpenter <[email protected]>
media: firewire: firedtv-avc: fix a buffer overflow in avc_ca_pmt()

Yang Shi <[email protected]>
mm: filemap: check if THP has hwpoisoned subpage for PMD page fault

Yang Shi <[email protected]>
mm: hwpoison: remove the unnecessary THP check

Yuiko Oshino <[email protected]>
net: ethernet: microchip: lan743x: Fix skb allocation failure

Eugene Crosser <[email protected]>
vrf: Revert "Reset skb conntrack connection..."

Erik Ekman <[email protected]>
sfc: Fix reading non-legacy supported link modes

Lee Jones <[email protected]>
Revert "io_uring: reinforce cancel on flush during exit"

Ming Lei <[email protected]>
scsi: core: Put LLD module refcnt after SCSI device is released

-------------

Diffstat:

 Makefile                                      |  4 ++--
 drivers/amba/bus.c                            |  3 ---
 drivers/gpu/drm/ttm/ttm_bo_util.c             |  1 -
 drivers/media/firewire/firedtv-avc.c          | 14 ++++++++++---
 drivers/media/firewire/firedtv-ci.c           |  2 ++
 drivers/net/ethernet/microchip/lan743x_main.c | 10 +++++----
 drivers/net/ethernet/sfc/ethtool_common.c     | 10 ++-------
 drivers/net/vrf.c                             |  4 ----
 drivers/net/wireless/ath/wcn36xx/main.c       | 10 ---------
 drivers/net/wireless/ath/wcn36xx/pmc.c        |  5 +----
 drivers/net/wireless/ath/wcn36xx/wcn36xx.h    |  1 -
 drivers/scsi/scsi.c                           |  4 +++-
 drivers/scsi/scsi_sysfs.c                     |  9 +++++++++
 drivers/usb/core/hcd.c                        | 29 ++++++---------------------
 drivers/usb/host/xhci.c                       |  1 -
 fs/io_uring.c                                 |  3 ++-
 include/linux/page-flags.h                    | 23 +++++++++++++++++++++
 include/linux/usb/hcd.h                       |  2 --
 mm/huge_memory.c                              |  2 ++
 mm/khugepaged.c                               | 17 +++++++++-------
 mm/memory-failure.c                           | 28 +++++++++++++-------------
 mm/memory.c                                   |  9 +++++++++
 mm/page_alloc.c                               |  4 +++-
 sound/usb/mixer_maps.c                        |  8 ++++++++
 24 files changed, 113 insertions(+), 90 deletions(-)

From: Greg Kroah-Hartman <[email protected]>

This reverts commit d58fc9e9c15825e3a8fc1ef3b52495c93c41e71c which is commit 58877b0824da15698bd85a0a9dbfa8c354e6ecb7 upstream.

It has been reported to be causing problems in Arch and Fedora bug reports.

---
 drivers/usb/core/hcd.c  |   29 ++++++-----------------------
 include/linux/usb/hcd.h |    2 --
 2 files changed, 6 insertions(+), 25 deletions(-)

@@ -2640,7 +2640,6 @@ int usb_add_hcd(struct usb_hcd *hcd,
 {
 	int retval;
 	struct usb_device *rhdev;
-	struct usb_hcd *shared_hcd;
 
 	if (!hcd->skip_phy_initialization && usb_hcd_is_primary_hcd(hcd)) {
 		hcd->phy_roothub = usb_phy_roothub_alloc(hcd->self.sysdev);

@@ -2797,26 +2796,13 @@ int usb_add_hcd(struct usb_hcd *hcd,
 		goto err_hcd_driver_start;
 	}
 
-	/* starting here, usbcore will pay attention to the shared HCD roothub */
-	shared_hcd = hcd->shared_hcd;
-	if (!usb_hcd_is_primary_hcd(hcd) && shared_hcd && HCD_DEFER_RH_REGISTER(shared_hcd)) {
-		retval = register_root_hub(shared_hcd);
-		if (retval != 0)
-			goto err_register_root_hub;
-
-		if (shared_hcd->uses_new_polling && HCD_POLL_RH(shared_hcd))
-			usb_hcd_poll_rh_status(shared_hcd);
-	}
-
 	/* starting here, usbcore will pay attention to this root hub */
-	if (!HCD_DEFER_RH_REGISTER(hcd)) {
-		retval = register_root_hub(hcd);
-		if (retval != 0)
-			goto err_register_root_hub;
+	retval = register_root_hub(hcd);
+	if (retval != 0)
+		goto err_register_root_hub;
 
-		if (hcd->uses_new_polling && HCD_POLL_RH(hcd))
-			usb_hcd_poll_rh_status(hcd);
-	}
+	if (hcd->uses_new_polling && HCD_POLL_RH(hcd))
+		usb_hcd_poll_rh_status(hcd);
 
 	return retval;
 

@@ -2859,7 +2845,6 @@ EXPORT_SYMBOL_GPL(usb_add_hcd);
 void usb_remove_hcd(struct usb_hcd *hcd)
 {
 	struct usb_device *rhdev = hcd->self.root_hub;
-	bool rh_registered;
 
 	dev_info(hcd->self.controller, "remove, state %x\n", hcd->state);
 

@@ -2870,7 +2855,6 @@ void usb_remove_hcd(struct usb_hcd *hcd)
 
 	dev_dbg(hcd->self.controller, "roothub graceful disconnect\n");
 	spin_lock_irq (&hcd_root_hub_lock);
-	rh_registered = hcd->rh_registered;
 	hcd->rh_registered = 0;
 	spin_unlock_irq (&hcd_root_hub_lock);
 

@@ -2880,8 +2864,7 @@ void usb_remove_hcd(struct usb_hcd *hcd)
 	cancel_work_sync(&hcd->died_work);
 
 	mutex_lock(&usb_bus_idr_lock);
-	if (rh_registered)
-		usb_disconnect(&rhdev);		/* Sets rhdev to NULL */
+	usb_disconnect(&rhdev);		/* Sets rhdev to NULL */
 	mutex_unlock(&usb_bus_idr_lock);
 
 	/*

@@ -124,7 +124,6 @@ struct usb_hcd {
 #define HCD_FLAG_RH_RUNNING		5	/* root hub is running? */
 #define HCD_FLAG_DEAD			6	/* controller has died? */
 #define HCD_FLAG_INTF_AUTHORIZED	7	/* authorize interfaces? */
-#define HCD_FLAG_DEFER_RH_REGISTER	8	/* Defer roothub registration */
 
 	/* The flags can be tested using these macros; they are likely to
 	 * be slightly faster than test_bit().

@@ -135,7 +134,6 @@ struct usb_hcd {
 #define HCD_WAKEUP_PENDING(hcd)	((hcd)->flags & (1U << HCD_FLAG_WAKEUP_PENDING))
 #define HCD_RH_RUNNING(hcd)	((hcd)->flags & (1U << HCD_FLAG_RH_RUNNING))
 #define HCD_DEAD(hcd)		((hcd)->flags & (1U << HCD_FLAG_DEAD))
-#define HCD_DEFER_RH_REGISTER(hcd) ((hcd)->flags & (1U << HCD_FLAG_DEFER_RH_REGISTER))
 
 	/*
 	 * Specifies if interfaces are authorized by default

From: Yang Shi <[email protected]>

commit a4aeaa06d45e90f9b279f0b09de84bd00006e733 upstream.

The read-only THP for filesystems will collapse THP for files opened readonly and mapped with VM_EXEC. The intended usecase is to avoid TLB misses for large text segments. But it doesn't restrict the file types so a THP could be collapsed for a non-regular file, for example, block device, if it is opened readonly and mapped with EXEC permission. This may cause bugs, like [1] and [2].

This is definitely not the intended usecase, so just collapse THP for regular files in order to close the attack surface.

[[email protected]: fix vm_file check [3]]

---
 mm/khugepaged.c |   17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

@@ -443,21 +443,24 @@ static bool hugepage_vma_check(struct vm
 	if (!transhuge_vma_enabled(vma, vm_flags))
 		return false;
 
+	if (vma->vm_file && !IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) -
+				vma->vm_pgoff, HPAGE_PMD_NR))
+		return false;
+
 	/* Enabled via shmem mount options or sysfs settings. */
-	if (shmem_file(vma->vm_file) && shmem_huge_enabled(vma)) {
-		return IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff,
-				HPAGE_PMD_NR);
-	}
+	if (shmem_file(vma->vm_file))
+		return shmem_huge_enabled(vma);
 
 	/* THP settings require madvise. */
 	if (!(vm_flags & VM_HUGEPAGE) && !khugepaged_always())
 		return false;
 
-	/* Read-only file mappings need to be aligned for THP to work. */
+	/* Only regular file is valid */
 	if (IS_ENABLED(CONFIG_READ_ONLY_THP_FOR_FS) && vma->vm_file &&
 	    (vm_flags & VM_DENYWRITE)) {
-		return IS_ALIGNED((vma->vm_start >> PAGE_SHIFT) - vma->vm_pgoff,
-				HPAGE_PMD_NR);
+		struct inode *inode = vma->vm_file->f_inode;
+
+		return S_ISREG(inode->i_mode);
 	}
 
 	if (!vma->anon_vma || vma->vm_ops)

From: Greg Kroah-Hartman <[email protected]>

This reverts commit c21b4002214c1c7e7b627b9b53375612f7aab6db which is commit 0db55f9a1bafbe3dac750ea669de9134922389b5 upstream.

Seems that the older kernels can not handle this fix because, to quote Christian:
The problem is this memory leak could potentially happen with 5.10 as wel, just much much much less likely.

But my guess is that 5.10 is so buggy that when the leak does NOT happen we double free and obviously causing a crash.

So it needs to be reverted.

---
 drivers/gpu/drm/ttm/ttm_bo_util.c |    1 -
 1 file changed, 1 deletion(-)

@@ -322,7 +322,6 @@ static void ttm_transfered_destroy(struc
 	struct ttm_transfer_obj *fbo;
 
 	fbo = container_of(bo, struct ttm_transfer_obj, base);
-	dma_resv_fini(&fbo->base.base._resv);
 	ttm_bo_put(fbo->bo);
 	kfree(fbo);
 }

From: Wang Kefeng <[email protected]>

commit eb4f756915875b0ea0757751cd29841f0504d547 upstream.

After commit 77a7300abad7 ("of/irq: Get rid of NO_IRQ usage"), no irq case has been removed, irq_of_parse_and_map() will return 0 in all cases when get error from parse and map an interrupt into linux virq space.

amba_device_register() is only used on no-DT initialization, see
s3c64xx_pl080_init() arch/arm/mach-s3c/pl080.c
ep93xx_init_devices() arch/arm/mach-ep93xx/core.c

They won't set -1 to irq[0], so no need the warn.

This reverts commit 2eac58d5026e4ec8b17ff8b62877fea9e1d2f1b3.

---
 drivers/amba/bus.c |    3 ---
 1 file changed, 3 deletions(-)

@@ -375,9 +375,6 @@ static int amba_device_try_add(struct am
 	void __iomem *tmp;
 	int i, ret;
 
-	WARN_ON(dev->irq[0] == (unsigned int)-1);
-	WARN_ON(dev->irq[1] == (unsigned int)-1);
-
 	ret = request_resource(parent, &dev->res);
 	if (ret)
 		goto err_out;

From: Bryan O'Donoghue <[email protected]>

commit 285bb1738e196507bf985574d0bc1e9dd72d46b1 upstream.

This reverts commit c6522a5076e1a65877c51cfee313a74ef61cabf8.

Testing on tip-of-tree shows that this is working now. Revert this and re-enable BMPS for Open APs.

---
 drivers/net/wireless/ath/wcn36xx/main.c    |   10 ----------
 drivers/net/wireless/ath/wcn36xx/pmc.c     |    5 +----
 drivers/net/wireless/ath/wcn36xx/wcn36xx.h |    1 -
 3 files changed, 1 insertion(+), 15 deletions(-)

@@ -601,15 +601,6 @@ static int wcn36xx_set_key(struct ieee80
 				}
 			}
 		}
-		/* FIXME: Only enable bmps support when encryption is enabled.
-		 * For any reasons, when connected to open/no-security BSS,
-		 * the wcn36xx controller in bmps mode does not forward
-		 * 'wake-up' beacons despite AP sends DTIM with station AID.
-		 * It could be due to a firmware issue or to the way driver
-		 * configure the station.
-		 */
-		if (vif->type == NL80211_IFTYPE_STATION)
-			vif_priv->allow_bmps = true;
 		break;
 	case DISABLE_KEY:
 		if (!(IEEE80211_KEY_FLAG_PAIRWISE & key_conf->flags)) {

@@ -909,7 +900,6 @@ static void wcn36xx_bss_info_changed(str
 				    vif->addr,
 				    bss_conf->aid);
 			vif_priv->sta_assoc = false;
-			vif_priv->allow_bmps = false;
 			wcn36xx_smd_set_link_st(wcn,
 						bss_conf->bssid,
 						vif->addr,

@@ -23,10 +23,7 @@ int wcn36xx_pmc_enter_bmps_state(struct
 {
 	int ret = 0;
 	struct wcn36xx_vif *vif_priv = wcn36xx_vif_to_priv(vif);
-
-	if (!vif_priv->allow_bmps)
-		return -ENOTSUPP;
-
+	/* TODO: Make sure the TX chain clean */
 	ret = wcn36xx_smd_enter_bmps(wcn, vif);
 	if (!ret) {
 		wcn36xx_dbg(WCN36XX_DBG_PMC, "Entered BMPS\n");

@@ -127,7 +127,6 @@ struct wcn36xx_vif {
 	enum wcn36xx_hal_bss_type bss_type;
 
 	/* Power management */
-	bool allow_bmps;
 	enum wcn36xx_power_state pw_state;
 
 	u8 bss_index;

From: Takashi Iwai <[email protected]>

commit 22390ce786c59328ccd13c329959dee1e8757487 upstream.

This is a fix equivalent with the upstream commit 22390ce786c5 ("ALSA:
usb-audio: add Schiit Hel device to quirk table"), adapted to the earlier kernels up to 5.14.y. It adds the quirk entry with the old ignore_ctl_error flag to the usbmix_ctl_maps, instead.

The original patch description says:
The Shciit Hel device responds to the ctl message for the mic capture switch with a timeout of -EPIPE:

usb 7-2.2: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x1100, type = 1 usb 7-2.2: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x1100, type = 1 usb 7-2.2: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x1100, type = 1 usb 7-2.2: cannot get ctl value: req = 0x81, wValue = 0x100, wIndex = 0x1100, type = 1

This seems safe to ignore as the device works properly with the control message quirk, so add it to the quirk table so all is good.

---
 sound/usb/mixer_maps.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -539,6 +539,10 @@ static const struct usbmix_ctl_map usbmi
 		.map = scms_usb3318_map,
 	},
 	{
+		.id = USB_ID(0x30be, 0x0101), /*  Schiit Hel */
+		.ignore_ctl_error = 1,
+	},
+	{
 		/* Bose Companion 5 */
 		.id = USB_ID(0x05a7, 0x1020),
 		.map = bose_companion5_map,

From: Takashi Iwai <[email protected]>

commit df0380b9539b04c1ae8854a984098da06d5f1e67 upstream.

This is a fix equivalent with the upstream commit df0380b9539b ("ALSA:
usb-audio: Add quirk for Audient iD14"), adapted to the earlier kernels up to 5.14.y. It adds the quirk entry with the old ignore_ctl_error flag to the usbmix_ctl_maps, instead.

The original commit description says:
Audient iD14 (2708:0002) may get a control message error that interferes the operation e.g. with alsactl. Add the quirk to ignore such errors like other devices.

---
 sound/usb/mixer_maps.c |    4 ++++
 1 file changed, 4 insertions(+)

@@ -529,6 +529,10 @@ static const struct usbmix_ctl_map usbmi
 		.map = maya44_map,
 	},
 	{
+		.id = USB_ID(0x2708, 0x0002), /* Audient iD14 */
+		.ignore_ctl_error = 1,
+	},
+	{
 		/* KEF X300A */
 		.id = USB_ID(0x27ac, 0x1000),
 		.map = scms_usb3318_map,

From: Greg Kroah-Hartman <[email protected]>

This reverts commit 0ea9ac731a315cd10bd6d6b33817b68ca9111ecf which is commit b7a0a792f864583207c593b50fd1b752ed89f4c1 upstream.

It has been reported to be causing problems in Arch and Fedora bug reports.

---
 drivers/usb/host/xhci.c |    1 -
 1 file changed, 1 deletion(-)

@@ -693,7 +693,6 @@ int xhci_run(struct usb_hcd *hcd)
 		if (ret)
 			xhci_free_command(xhci, command);
 	}
-	set_bit(HCD_FLAG_DEFER_RH_REGISTER, &hcd->flags);
 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
 			"Finished xhci_run for USB2 roothub");
 

Hello!

Regressions detected.

Build failures on all architectures and all toolchains (GCC 8, 9, 10, 11; Clang 10, 11, 12, 13, nightly):
- arc
- arm (32-bits)
- arm (64-bits)
- i386
- mips
- parisc
- ppc
- riscv
- s390
- sh
- sparc
- x86

Failures look like this:

In file included from /builds/linux/include/linux/kernel.h:11,

                   from /builds/linux/include/linux/list.h:9,
                   from /builds/linux/include/linux/smp.h:12,
                   from /builds/linux/include/linux/kernel_stat.h:5,
                   from /builds/linux/mm/memory.c:42:
  /builds/linux/mm/memory.c: In function 'finish_fault':
  /builds/linux/mm/memory.c:3929:15: error: implicit declaration of function 'PageHasHWPoisoned'; did you mean 'PageHWPoison'? [-Werror=implicit-function-declaration]
   3929 |  if (unlikely(PageHasHWPoisoned(page)))
        |               ^~~~~~~~~~~~~~~~~
  /builds/linux/include/linux/compiler.h:78:42: note: in definition of macro 'unlikely'
     78 | # define unlikely(x) __builtin_expect(!!(x), 0)
        |                                          ^

cc1: some warnings being treated as errors

and this:

/builds/linux/mm/memory.c:3929:15: error: implicit declaration of function 'PageHasHWPoisoned' [-Werror,-Wimplicit-function-declaration]

          if (unlikely(PageHasHWPoisoned(page)))
                       ^

/builds/linux/mm/page_alloc.c:1237:4: error: implicit declaration of function 'ClearPageHasHWPoisoned' [-Werror,-Wimplicit-function-declaration]

                          ClearPageHasHWPoisoned(page);
                          ^

/builds/linux/mm/page_alloc.c:1237:4: note: did you mean 'ClearPageHWPoison'?

Greetings!

Daniel Díaz
[email protected]

What configuration? This builds for me on x86 here on allmodconfig.

thanks,

greg k-h

Hello!

Our main config also works, but defconfig, allnoconfig and tinyconfig all fail. That's across all architectures.

Here's a comprehensive list of failures:

* arc, build
- gcc-8-allnoconfig
- gcc-8-axs103_defconfig
- gcc-8-defconfig
- gcc-8-tinyconfig
- gcc-8-vdk_hs38_smp_defconfig
- gcc-9-allnoconfig
- gcc-9-axs103_defconfig
- gcc-9-defconfig
- gcc-9-tinyconfig
- gcc-9-vdk_hs38_smp_defconfig

* arm, build
- clang-10-allnoconfig
- clang-10-at91_dt_defconfig
- clang-10-axm55xx_defconfig
- clang-10-bcm2835_defconfig
- clang-10-clps711x_defconfig
- clang-10-davinci_all_defconfig
- clang-10-defconfig
- clang-10-exynos_defconfig
- clang-10-footbridge_defconfig
- clang-10-imx_v4_v5_defconfig
- clang-10-imx_v6_v7_defconfig
- clang-10-integrator_defconfig
- clang-10-ixp4xx_defconfig
- clang-10-keystone_defconfig
- clang-10-lpc32xx_defconfig
- clang-10-mini2440_defconfig
- clang-10-multi_v5_defconfig
- clang-10-mxs_defconfig
- clang-10-nhk8815_defconfig
- clang-10-omap1_defconfig
- clang-10-omap2plus_defconfig
- clang-10-orion5x_defconfig
- clang-10-pxa910_defconfig
- clang-10-s3c2410_defconfig
- clang-10-s3c6400_defconfig
- clang-10-s5pv210_defconfig
- clang-10-sama5_defconfig
- clang-10-shmobile_defconfig
- clang-10-tinyconfig
- clang-10-u8500_defconfig
- clang-10-vexpress_defconfig
- clang-11-allnoconfig
- clang-11-at91_dt_defconfig
- clang-11-axm55xx_defconfig
- clang-11-bcm2835_defconfig
- clang-11-clps711x_defconfig
- clang-11-davinci_all_defconfig
- clang-11-defconfig
- clang-11-exynos_defconfig
- clang-11-footbridge_defconfig
- clang-11-imx_v4_v5_defconfig
- clang-11-imx_v6_v7_defconfig
- clang-11-integrator_defconfig
- clang-11-ixp4xx_defconfig
- clang-11-keystone_defconfig
- clang-11-lpc32xx_defconfig
- clang-11-mini2440_defconfig
- clang-11-multi_v5_defconfig
- clang-11-mxs_defconfig
- clang-11-nhk8815_defconfig
- clang-11-omap1_defconfig
- clang-11-omap2plus_defconfig
- clang-11-orion5x_defconfig
- clang-11-pxa910_defconfig
- clang-11-s3c2410_defconfig
- clang-11-s3c6400_defconfig
- clang-11-s5pv210_defconfig
- clang-11-sama5_defconfig
- clang-11-shmobile_defconfig
- clang-11-tinyconfig
- clang-11-u8500_defconfig
- clang-11-vexpress_defconfig
- clang-12-allnoconfig
- clang-12-at91_dt_defconfig
- clang-12-axm55xx_defconfig
- clang-12-bcm2835_defconfig
- clang-12-clps711x_defconfig
- clang-12-davinci_all_defconfig
- clang-12-defconfig
- clang-12-defconfig-50bba0f5
- clang-12-exynos_defconfig
- clang-12-footbridge_defconfig
- clang-12-imx_v4_v5_defconfig
- clang-12-imx_v6_v7_defconfig
- clang-12-integrator_defconfig
- clang-12-ixp4xx_defconfig
- clang-12-keystone_defconfig
- clang-12-lpc32xx_defconfig
- clang-12-mini2440_defconfig
- clang-12-multi_v5_defconfig
- clang-12-mxs_defconfig
- clang-12-nhk8815_defconfig
- clang-12-omap1_defconfig
- clang-12-omap2plus_defconfig
- clang-12-orion5x_defconfig
- clang-12-pxa910_defconfig
- clang-12-s3c2410_defconfig
- clang-12-s3c6400_defconfig
- clang-12-s5pv210_defconfig
- clang-12-sama5_defconfig
- clang-12-shmobile_defconfig
- clang-12-tinyconfig
- clang-12-u8500_defconfig
- clang-12-vexpress_defconfig
- clang-13-allnoconfig
- clang-13-at91_dt_defconfig
- clang-13-axm55xx_defconfig
- clang-13-bcm2835_defconfig
- clang-13-clps711x_defconfig
- clang-13-davinci_all_defconfig
- clang-13-defconfig
- clang-13-defconfig-50bba0f5
- clang-13-exynos_defconfig
- clang-13-footbridge_defconfig
- clang-13-imx_v4_v5_defconfig
- clang-13-imx_v6_v7_defconfig
- clang-13-integrator_defconfig
- clang-13-ixp4xx_defconfig
- clang-13-keystone_defconfig
- clang-13-lpc32xx_defconfig
- clang-13-mini2440_defconfig
- clang-13-multi_v5_defconfig
- clang-13-mxs_defconfig
- clang-13-nhk8815_defconfig
- clang-13-omap1_defconfig
- clang-13-omap2plus_defconfig
- clang-13-orion5x_defconfig
- clang-13-pxa910_defconfig
- clang-13-s3c2410_defconfig
- clang-13-s3c6400_defconfig
- clang-13-s5pv210_defconfig
- clang-13-sama5_defconfig
- clang-13-shmobile_defconfig
- clang-13-tinyconfig
- clang-13-u8500_defconfig
- clang-13-vexpress_defconfig
- clang-nightly-allnoconfig
- clang-nightly-at91_dt_defconfig
- clang-nightly-axm55xx_defconfig
- clang-nightly-bcm2835_defconfig
- clang-nightly-clps711x_defconfig
- clang-nightly-davinci_all_defconfig
- clang-nightly-defconfig
- clang-nightly-defconfig-50bba0f5
- clang-nightly-exynos_defconfig
- clang-nightly-footbridge_defconfig
- clang-nightly-imx_v4_v5_defconfig
- clang-nightly-imx_v6_v7_defconfig
- clang-nightly-integrator_defconfig
- clang-nightly-ixp4xx_defconfig
- clang-nightly-keystone_defconfig
- clang-nightly-lpc32xx_defconfig
- clang-nightly-mini2440_defconfig
- clang-nightly-multi_v5_defconfig
- clang-nightly-mxs_defconfig
- clang-nightly-nhk8815_defconfig
- clang-nightly-omap1_defconfig
- clang-nightly-omap2plus_defconfig
- clang-nightly-orion5x_defconfig
- clang-nightly-pxa910_defconfig
- clang-nightly-s3c2410_defconfig
- clang-nightly-s3c6400_defconfig
- clang-nightly-s5pv210_defconfig
- clang-nightly-sama5_defconfig
- clang-nightly-shmobile_defconfig
- clang-nightly-tinyconfig
- clang-nightly-u8500_defconfig
- clang-nightly-vexpress_defconfig
- gcc-10-allnoconfig
- gcc-10-at91_dt_defconfig
- gcc-10-axm55xx_defconfig
- gcc-10-bcm2835_defconfig
- gcc-10-clps711x_defconfig
- gcc-10-davinci_all_defconfig
- gcc-10-defconfig
- gcc-10-defconfig-493f0879
- gcc-10-defconfig-50bba0f5
- gcc-10-defconfig-5a3a4204
- gcc-10-defconfig-6830ede0
- gcc-10-defconfig-883c3502
- gcc-10-defconfig-a05dd807
- gcc-10-defconfig-c58d92d2
- gcc-10-defconfig-ced87bbf
- gcc-10-exynos_defconfig
- gcc-10-footbridge_defconfig
- gcc-10-imx_v4_v5_defconfig
- gcc-10-imx_v6_v7_defconfig
- gcc-10-integrator_defconfig
- gcc-10-ixp4xx_defconfig
- gcc-10-keystone_defconfig
- gcc-10-lpc32xx_defconfig
- gcc-10-mini2440_defconfig
- gcc-10-multi_v5_defconfig
- gcc-10-mxs_defconfig
- gcc-10-nhk8815_defconfig
- gcc-10-omap1_defconfig
- gcc-10-omap2plus_defconfig
- gcc-10-orion5x_defconfig
- gcc-10-pxa910_defconfig
- gcc-10-s3c2410_defconfig
- gcc-10-s3c6400_defconfig
- gcc-10-s5pv210_defconfig
- gcc-10-sama5_defconfig
- gcc-10-shmobile_defconfig
- gcc-10-tinyconfig
- gcc-10-u8500_defconfig
- gcc-10-vexpress_defconfig
- gcc-11-allnoconfig
- gcc-11-at91_dt_defconfig
- gcc-11-axm55xx_defconfig
- gcc-11-bcm2835_defconfig
- gcc-11-clps711x_defconfig
- gcc-11-davinci_all_defconfig
- gcc-11-defconfig
- gcc-11-exynos_defconfig
- gcc-11-footbridge_defconfig
- gcc-11-imx_v4_v5_defconfig
- gcc-11-imx_v6_v7_defconfig
- gcc-11-integrator_defconfig
- gcc-11-ixp4xx_defconfig
- gcc-11-keystone_defconfig
- gcc-11-lpc32xx_defconfig
- gcc-11-mini2440_defconfig
- gcc-11-multi_v5_defconfig
- gcc-11-mxs_defconfig
- gcc-11-nhk8815_defconfig
- gcc-11-omap1_defconfig
- gcc-11-omap2plus_defconfig
- gcc-11-orion5x_defconfig
- gcc-11-pxa910_defconfig
- gcc-11-s3c2410_defconfig
- gcc-11-s3c6400_defconfig
- gcc-11-s5pv210_defconfig
- gcc-11-sama5_defconfig
- gcc-11-shmobile_defconfig
- gcc-11-tinyconfig
- gcc-11-u8500_defconfig
- gcc-11-vexpress_defconfig
- gcc-8-allnoconfig
- gcc-8-at91_dt_defconfig
- gcc-8-axm55xx_defconfig
- gcc-8-bcm2835_defconfig
- gcc-8-clps711x_defconfig
- gcc-8-davinci_all_defconfig
- gcc-8-defconfig
- gcc-8-exynos_defconfig
- gcc-8-footbridge_defconfig
- gcc-8-imx_v4_v5_defconfig
- gcc-8-imx_v6_v7_defconfig
- gcc-8-integrator_defconfig
- gcc-8-ixp4xx_defconfig
- gcc-8-keystone_defconfig
- gcc-8-lpc32xx_defconfig
- gcc-8-mini2440_defconfig
- gcc-8-multi_v5_defconfig
- gcc-8-mxs_defconfig
- gcc-8-nhk8815_defconfig
- gcc-8-omap1_defconfig
- gcc-8-omap2plus_defconfig
- gcc-8-orion5x_defconfig
- gcc-8-pxa910_defconfig
- gcc-8-s3c2410_defconfig
- gcc-8-s3c6400_defconfig
- gcc-8-s5pv210_defconfig
- gcc-8-sama5_defconfig
- gcc-8-shmobile_defconfig
- gcc-8-tinyconfig
- gcc-8-u8500_defconfig
- gcc-8-vexpress_defconfig
- gcc-9-allnoconfig
- gcc-9-at91_dt_defconfig
- gcc-9-axm55xx_defconfig
- gcc-9-bcm2835_defconfig
- gcc-9-clps711x_defconfig
- gcc-9-davinci_all_defconfig
- gcc-9-defconfig
- gcc-9-exynos_defconfig
- gcc-9-footbridge_defconfig
- gcc-9-imx_v4_v5_defconfig
- gcc-9-imx_v6_v7_defconfig
- gcc-9-integrator_defconfig
- gcc-9-ixp4xx_defconfig
- gcc-9-keystone_defconfig
- gcc-9-lpc32xx_defconfig
- gcc-9-mini2440_defconfig
- gcc-9-multi_v5_defconfig
- gcc-9-mxs_defconfig
- gcc-9-nhk8815_defconfig
- gcc-9-omap1_defconfig
- gcc-9-omap2plus_defconfig
- gcc-9-orion5x_defconfig
- gcc-9-pxa910_defconfig
- gcc-9-s3c2410_defconfig
- gcc-9-s3c6400_defconfig
- gcc-9-s5pv210_defconfig
- gcc-9-sama5_defconfig
- gcc-9-shmobile_defconfig
- gcc-9-tinyconfig
- gcc-9-u8500_defconfig
- gcc-9-vexpress_defconfig

* arm64, build
- clang-10-allnoconfig
- clang-10-tinyconfig
- clang-11-allnoconfig
- clang-11-tinyconfig
- clang-12-allnoconfig
- clang-12-tinyconfig
- clang-13-allnoconfig
- clang-13-tinyconfig
- clang-nightly-allnoconfig
- clang-nightly-tinyconfig
- gcc-10-allnoconfig
- gcc-10-tinyconfig
- gcc-11-allnoconfig
- gcc-11-tinyconfig
- gcc-8-allnoconfig
- gcc-8-tinyconfig
- gcc-9-allnoconfig
- gcc-9-tinyconfig

* i386, build
- clang-10-allnoconfig
- clang-10-defconfig
- clang-10-tinyconfig
- clang-11-allnoconfig
- clang-11-defconfig
- clang-11-tinyconfig
- clang-12-allnoconfig
- clang-12-defconfig
- clang-12-tinyconfig
- clang-13-allnoconfig
- clang-13-defconfig
- clang-13-tinyconfig
- clang-nightly-allnoconfig
- clang-nightly-defconfig
- clang-nightly-tinyconfig
- gcc-10-allnoconfig
- gcc-10-defconfig
- gcc-10-tinyconfig
- gcc-11-allnoconfig
- gcc-11-defconfig
- gcc-11-tinyconfig
- gcc-8-allnoconfig
- gcc-8-i386_defconfig
- gcc-8-tinyconfig
- gcc-9-allnoconfig
- gcc-9-i386_defconfig
- gcc-9-tinyconfig

* mips, build
- clang-10-allnoconfig
- clang-10-defconfig
- clang-10-tinyconfig
- clang-11-allnoconfig
- clang-11-defconfig
- clang-11-tinyconfig
- clang-12-allnoconfig
- clang-12-defconfig
- clang-12-tinyconfig
- clang-13-allnoconfig
- clang-13-defconfig
- clang-13-tinyconfig
- clang-nightly-allnoconfig
- clang-nightly-defconfig
- clang-nightly-tinyconfig
- gcc-10-allnoconfig
- gcc-10-ar7_defconfig
- gcc-10-ath79_defconfig
- gcc-10-bcm47xx_defconfig
- gcc-10-bcm63xx_defconfig
- gcc-10-defconfig
- gcc-10-e55_defconfig
- gcc-10-malta_defconfig
- gcc-10-rt305x_defconfig
- gcc-10-tinyconfig
- gcc-8-allnoconfig
- gcc-8-ar7_defconfig
- gcc-8-ath79_defconfig
- gcc-8-bcm47xx_defconfig
- gcc-8-bcm63xx_defconfig
- gcc-8-defconfig
- gcc-8-e55_defconfig
- gcc-8-malta_defconfig
- gcc-8-rt305x_defconfig
- gcc-8-tinyconfig

* parisc, build
- gcc-10-allnoconfig
- gcc-10-defconfig
- gcc-10-tinyconfig
- gcc-11-allnoconfig
- gcc-11-defconfig
- gcc-11-tinyconfig
- gcc-8-allnoconfig
- gcc-8-defconfig
- gcc-8-tinyconfig
- gcc-9-allnoconfig
- gcc-9-defconfig
- gcc-9-tinyconfig

* powerpc, build
- gcc-10-allnoconfig
- gcc-10-cell_defconfig
- gcc-10-maple_defconfig
- gcc-10-mpc83xx_defconfig
- gcc-10-ppc64e_defconfig
- gcc-10-ppc6xx_defconfig
- gcc-10-tinyconfig
- gcc-10-tqm8xx_defconfig
- gcc-11-allnoconfig
- gcc-11-cell_defconfig
- gcc-11-maple_defconfig
- gcc-11-mpc83xx_defconfig
- gcc-11-ppc64e_defconfig
- gcc-11-ppc6xx_defconfig
- gcc-11-tinyconfig
- gcc-11-tqm8xx_defconfig
- gcc-8-allnoconfig
- gcc-8-cell_defconfig
- gcc-8-maple_defconfig
- gcc-8-mpc83xx_defconfig
- gcc-8-ppc64e_defconfig
- gcc-8-ppc6xx_defconfig
- gcc-8-tinyconfig
- gcc-8-tqm8xx_defconfig
- gcc-9-allnoconfig
- gcc-9-cell_defconfig
- gcc-9-maple_defconfig
- gcc-9-mpc83xx_defconfig
- gcc-9-ppc64e_defconfig
- gcc-9-ppc6xx_defconfig
- gcc-9-tinyconfig
- gcc-9-tqm8xx_defconfig

* riscv, build
- clang-11-allnoconfig
- clang-11-defconfig
- clang-11-tinyconfig
- clang-12-allnoconfig
- clang-12-defconfig
- clang-12-tinyconfig
- clang-13-allnoconfig
- clang-13-defconfig
- clang-13-tinyconfig
- clang-nightly-allnoconfig
- clang-nightly-defconfig
- clang-nightly-tinyconfig
- gcc-10-allnoconfig
- gcc-10-defconfig
- gcc-10-tinyconfig
- gcc-11-allnoconfig
- gcc-11-defconfig
- gcc-11-tinyconfig
- gcc-8-allnoconfig
- gcc-8-defconfig
- gcc-8-tinyconfig
- gcc-9-allnoconfig
- gcc-9-defconfig
- gcc-9-tinyconfig

* s390, build
- clang-13-allnoconfig
- clang-13-tinyconfig
- clang-nightly-allnoconfig
- clang-nightly-tinyconfig
- gcc-10-allnoconfig
- gcc-10-tinyconfig
- gcc-11-allnoconfig
- gcc-11-tinyconfig
- gcc-8-allnoconfig
- gcc-8-tinyconfig
- gcc-9-allnoconfig
- gcc-9-tinyconfig

* sh, build
- gcc-10-allnoconfig
- gcc-10-defconfig
- gcc-10-dreamcast_defconfig
- gcc-10-microdev_defconfig
- gcc-10-shx3_defconfig
- gcc-10-tinyconfig
- gcc-11-allnoconfig
- gcc-11-defconfig
- gcc-11-dreamcast_defconfig
- gcc-11-microdev_defconfig
- gcc-11-shx3_defconfig
- gcc-11-tinyconfig
- gcc-8-allnoconfig
- gcc-8-defconfig
- gcc-8-dreamcast_defconfig
- gcc-8-microdev_defconfig
- gcc-8-shx3_defconfig
- gcc-8-tinyconfig
- gcc-9-allnoconfig
- gcc-9-defconfig
- gcc-9-dreamcast_defconfig
- gcc-9-microdev_defconfig
- gcc-9-shx3_defconfig
- gcc-9-tinyconfig

* sparc, build
- gcc-10-allnoconfig
- gcc-10-defconfig
- gcc-10-tinyconfig
- gcc-11-allnoconfig
- gcc-11-defconfig
- gcc-11-tinyconfig
- gcc-8-allnoconfig
- gcc-8-defconfig
- gcc-8-tinyconfig
- gcc-9-allnoconfig
- gcc-9-defconfig
- gcc-9-tinyconfig

* x86_64, build
- clang-10-allnoconfig
- clang-10-defconfig
- clang-10-tinyconfig
- clang-11-allnoconfig
- clang-11-tinyconfig
- clang-11-x86_64_defconfig
- clang-12-allnoconfig
- clang-12-tinyconfig
- clang-12-x86_64_defconfig
- clang-13-allnoconfig
- clang-13-tinyconfig
- clang-13-x86_64_defconfig
- clang-nightly-allnoconfig
- clang-nightly-tinyconfig
- clang-nightly-x86_64_defconfig
- gcc-10-allnoconfig
- gcc-10-defconfig
- gcc-10-tinyconfig
- gcc-11-allnoconfig
- gcc-11-defconfig
- gcc-11-tinyconfig
- gcc-8-allnoconfig
- gcc-8-tinyconfig
- gcc-8-x86_64_defconfig
- gcc-9-allnoconfig
- gcc-9-tinyconfig
- gcc-9-x86_64_defconfig

(It would have been easier to list the ones that _passed_ instead! :)

Greetings!

daniel Díaz
[email protected]

defconfig, and anything with CONFIG_MEMORY_FAILURE=n or CONFIG_TRANSPARENT_HUGEPAGE=n. Fix needs upstream commit e66435936756d (presumably, I did not check).

Guenter

Odd, no, I don't think that commit will help.

I'll go drop the offending commit now and push out a -rc2.

thanks,

greg k-h

5.10.78-rc1 Successfully Compiled and booted on my Raspberry PI 4b (8g) (bcm2711)

Boot hang during journal check on my system. I am building rc2 now and will let you know what happens.

thanks,
-- Shuah

Hi!

This explains why revert is a good idea for mainline, but it may still cause problems for 5.10. Is someone able to test it in 5.10?

Best regards,
Pavel

http://www.livejournal.com/~pavelmachek

Hi!

AFAICT this does not fix any bug. It is simply a WARN that can not trigger.

Best regards,
Pavel

DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany

I have to pull in a bunch of out-of-tree patches to boot on the target device but..

Sure, I can have a look over the weekend

---
bod