Skip to content
  1. Nov 18, 2016
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs · bec1b089
      Linus Torvalds authored
      Pull vfs fixes from Al Viro:
       "A couple of regression fixes"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
        fix iov_iter_advance() for ITER_PIPE
        xattr: Fix setting security xattrs on sockfs
      bec1b089
    • Linus Torvalds's avatar
      Merge tag 'for-linus-4.9-rc5-ofs-1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux · d46bc34d
      Linus Torvalds authored
      Pull orangefs fix from Mike Marshall:
       "orangefs: add .owner to debugfs file_operations
      
        Without ".owner = THIS_MODULE" it is possible to crash the kernel by
        unloading the Orangefs module while someone is reading debugfs files"
      
      * tag 'for-linus-4.9-rc5-ofs-1' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux:
        orangefs: add .owner to debugfs file_operations
      d46bc34d
    • Aaron Lu's avatar
      mremap: fix race between mremap() and page cleanning · 5d190420
      Aaron Lu authored
      
      
      Prior to 3.15, there was a race between zap_pte_range() and
      page_mkclean() where writes to a page could be lost.  Dave Hansen
      discovered by inspection that there is a similar race between
      move_ptes() and page_mkclean().
      
      We've been able to reproduce the issue by enlarging the race window with
      a msleep(), but have not been able to hit it without modifying the code.
      So, we think it's a real issue, but is difficult or impossible to hit in
      practice.
      
      The zap_pte_range() issue is fixed by commit 1cf35d47("mm: split
      'tlb_flush_mmu()' into tlb flushing and memory freeing parts").  And
      this patch is to fix the race between page_mkclean() and mremap().
      
      Here is one possible way to hit the race: suppose a process mmapped a
      file with READ | WRITE and SHARED, it has two threads and they are bound
      to 2 different CPUs, e.g.  CPU1 and CPU2.  mmap returned X, then thread
      1 did a write to addr X so that CPU1 now has a writable TLB for addr X
      on it.  Thread 2 starts mremaping from addr X to Y while thread 1
      cleaned the page and then did another write to the old addr X again.
      The 2nd write from thread 1 could succeed but the value will get lost.
      
              thread 1                           thread 2
           (bound to CPU1)                    (bound to CPU2)
      
        1: write 1 to addr X to get a
           writeable TLB on this CPU
      
                                              2: mremap starts
      
                                              3: move_ptes emptied PTE for addr X
                                                 and setup new PTE for addr Y and
                                                 then dropped PTL for X and Y
      
        4: page laundering for N by doing
           fadvise FADV_DONTNEED. When done,
           pageframe N is deemed clean.
      
        5: *write 2 to addr X
      
                                              6: tlb flush for addr X
      
        7: munmap (Y, pagesize) to make the
           page unmapped
      
        8: fadvise with FADV_DONTNEED again
           to kick the page off the pagecache
      
        9: pread the page from file to verify
           the value. If 1 is there, it means
           we have lost the written 2.
      
        *the write may or may not cause segmentation fault, it depends on
        if the TLB is still on the CPU.
      
      Please note that this is only one specific way of how the race could
      occur, it didn't mean that the race could only occur in exact the above
      config, e.g. more than 2 threads could be involved and fadvise() could
      be done in another thread, etc.
      
      For anonymous pages, they could race between mremap() and page reclaim:
      THP: a huge PMD is moved by mremap to a new huge PMD, then the new huge
      PMD gets unmapped/splitted/pagedout before the flush tlb happened for
      the old huge PMD in move_page_tables() and we could still write data to
      it.  The normal anonymous page has similar situation.
      
      To fix this, check for any dirty PTE in move_ptes()/move_huge_pmd() and
      if any, did the flush before dropping the PTL.  If we did the flush for
      every move_ptes()/move_huge_pmd() call then we do not need to do the
      flush in move_pages_tables() for the whole range.  But if we didn't, we
      still need to do the whole range flush.
      
      Alternatively, we can track which part of the range is flushed in
      move_ptes()/move_huge_pmd() and which didn't to avoid flushing the whole
      range in move_page_tables().  But that would require multiple tlb
      flushes for the different sub-ranges and should be less efficient than
      the single whole range flush.
      
      KBuild test on my Sandybridge desktop doesn't show any noticeable change.
      v4.9-rc4:
        real    5m14.048s
        user    32m19.800s
        sys     4m50.320s
      
      With this commit:
        real    5m13.888s
        user    32m19.330s
        sys     4m51.200s
      
      Reported-by: default avatarDave Hansen <dave.hansen@intel.com>
      Signed-off-by: default avatarAaron Lu <aaron.lu@intel.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      5d190420
  2. Nov 17, 2016
    • Abhi Das's avatar
      fix iov_iter_advance() for ITER_PIPE · 680bb946
      Abhi Das authored
      
      
      iov_iter_advance() needs to decrement iter->count by the number of
      bytes we'd moved beyond.  Normal flavours do that, but ITER_PIPE
      doesn't and ITER_PIPE generic_file_read_iter() for O_DIRECT files
      ends up with a bogus fallback to page cache read, resulting in incorrect
      values for file offset and bytes read.
      
      Signed-off-by: default avatarAbhi Das <adas@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      680bb946
    • Andreas Gruenbacher's avatar
      xattr: Fix setting security xattrs on sockfs · 4a590153
      Andreas Gruenbacher authored
      
      
      The IOP_XATTR flag is set on sockfs because sockfs supports getting the
      "system.sockprotoname" xattr.  Since commit 6c6ef9f2, this flag is checked for
      setxattr support as well.  This is wrong on sockfs because security xattr
      support there is supposed to be provided by security_inode_setsecurity.  The
      smack security module relies on socket labels (xattrs).
      
      Fix this by adding a security xattr handler on sockfs that returns
      -EAGAIN, and by checking for -EAGAIN in setxattr.
      
      We cannot simply check for -EOPNOTSUPP in setxattr because there are
      filesystems that neither have direct security xattr support nor support
      via security_inode_setsecurity.  A more proper fix might be to move the
      call to security_inode_setsecurity into sockfs, but it's not clear to me
      if that is safe: we would end up calling security_inode_post_setxattr after
      that as well.
      
      Signed-off-by: default avatarAndreas Gruenbacher <agruenba@redhat.com>
      Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      4a590153
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-for-v4.9-rc6' of git://people.freedesktop.org/~airlied/linux · 961b708e
      Linus Torvalds authored
      Pull drm fixes fr9om Dave Airlie:
       "Fixes for amdgpu, and a bunch of arm drivers.
      
        There seems to be an uptick in the ARM drivers sending things for
        fixes which is good, so I've decided to dequeue a bit early, more
        stuff may arrive before the weekend.
      
        This contains mediatek, arcpgu, sunxi, fsl-dcu display controller
        fixes along with 3 amdgpu fixes, one for a fencing issue with
        secondary GPUs"
      
      * tag 'drm-fixes-for-v4.9-rc6' of git://people.freedesktop.org/~airlied/linux:
        drm/amdgpu:fix vpost_needed routine
        drm/amdgpu/powerplay: drop a redundant NULL check
        drm/amdgpu: Attach exclusive fence to prime exported bo's. (v5)
        drm/arcpgu: Accommodate adv7511 switch to DRM bridge
        drm/fsl-dcu: disable planes before disabling CRTC
        drm/fsl-dcu: update all registers on flush
        drm/fsl-dcu: do not update when modifying irq registers
        drm/sun4i: Propagate error to the caller
        drm/sun4i: Fix error handling
        drm/mediatek: modify the factor to make the pll_rate set in the 1G-2G range
        drm/mediatek: enhance the HDMI driving current
        drm/mediatek: do mtk_hdmi_send_infoframe after HDMI clock enable
        drm/mediatek: clear IRQ status before enable OVL interrupt
        drm/mediatek: set vblank_disable_allowed to true
        drm/mediatek: fix a typo of OD_CFG to OD_RELAYMODE
        drm/sun4i: rgb: Remove the bridge enable/disable functions
        drm/sun4i: rgb: Enable panel after controller
      961b708e
    • Linus Torvalds's avatar
      Merge tag 'xtensa-20161116' of git://github.com/jcmvbkbc/linux-xtensa · 5fd0f1ca
      Linus Torvalds authored
      Pull Xtensa fixes from Max Filippov:
      
       - fix register dumps, stack dumps and stack traces that got torn due to
         recent printk changes
      
       - wire up pkey_{mprotect,alloc,free} syscalls
      
      * tag 'xtensa-20161116' of git://github.com/jcmvbkbc/linux-xtensa:
        xtensa: wire up new pkey_{mprotect,alloc,free} syscalls
        xtensa: clean up printk usage for boot/crash logging
      5fd0f1ca
    • Dave Airlie's avatar
      Merge branch 'drm-fixes-4.9' of git://people.freedesktop.org/~agd5f/linux into drm-fixes · 29ed1973
      Dave Airlie authored
      Just a few bug fixes for 4.9.  The big one is Mario's prime fencing fix.
      
      * 'drm-fixes-4.9' of git://people.freedesktop.org/~agd5f/linux:
        drm/amdgpu:fix vpost_needed routine
        drm/amdgpu/powerplay: drop a redundant NULL check
        drm/amdgpu: Attach exclusive fence to prime exported bo's. (v5)
      29ed1973
    • Dave Airlie's avatar
      Merge branch 'mediatek-drm-fixes-2016-11-11' of... · 51a4c38a
      Dave Airlie authored
      Merge branch 'mediatek-drm-fixes-2016-11-11' of https://github.com/ckhu-mediatek/linux.git-tags into drm-fixes
      
      This branch include one patch to fix a typo, two patches to disable
      vblank interrupt, and three patches to support HDMI 4K resolution.
      
      * 'mediatek-drm-fixes-2016-11-11' of https://github.com/ckhu-mediatek/linux.git-tags:
        drm/mediatek: modify the factor to make the pll_rate set in the 1G-2G range
        drm/mediatek: enhance the HDMI driving current
        drm/mediatek: do mtk_hdmi_send_infoframe after HDMI clock enable
        drm/mediatek: clear IRQ status before enable OVL interrupt
        drm/mediatek: set vblank_disable_allowed to true
        drm/mediatek: fix a typo of OD_CFG to OD_RELAYMODE
      51a4c38a
    • Linus Torvalds's avatar
      Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse · 984573ab
      Linus Torvalds authored
      Pull fuse fixes from Miklos Szeredi:
       "A regression fix and bug fix bound for stable"
      
      * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
        fuse: fix fuse_write_end() if zero bytes were copied
        fuse: fix root dentry initialization
      984573ab
    • Linus Torvalds's avatar
      Merge tag 'mfd-fixes-4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd · 116fc01f
      Linus Torvalds authored
      Pull MFD fixes from Lee Jones:
       - Fix PCI properties in intel-lpss-pci
       - Fix Resetting issue during suspend in intel-lpss-pci
       - Seperate IRQs for USBC device and CHRG in intel_soc_pmic_bxtwc
       - Add timeout to fix Resetting issue in stmpe
       - Ensure we 'put' reference to device when done in mfd-core
      
      * tag 'mfd-fixes-4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd:
        mfd: core: Fix device reference leak in mfd_clone_cell
        mfd: stmpe: Fix RESET regression on STMPE2401
        mfd: intel_soc_pmic_bxtwc: Fix usbc interrupt
        mfd: intel-lpss: Do not put device in reset state on suspend
        mfd: lpss: Fix Intel Kaby Lake PCH-H properties
      116fc01f
    • Mike Marshall's avatar
      orangefs: add .owner to debugfs file_operations · 19ff7fcc
      Mike Marshall authored
      
      
      Without ".owner = THIS_MODULE" it is possible to crash the kernel
      by unloading the Orangefs module while someone is reading debugfs
      files.
      
      Signed-off-by: default avatarMike Marshall <hubcap@omnibond.com>
      19ff7fcc
  3. Nov 16, 2016
  4. Nov 15, 2016