Skip to content
  1. May 08, 2019
  2. May 07, 2019
  3. May 06, 2019
  4. May 05, 2019
    • Jiri Olsa's avatar
      perf/x86/intel: Fix race in intel_pmu_disable_event() · 6f55967a
      Jiri Olsa authored
      
      
      New race in x86_pmu_stop() was introduced by replacing the
      atomic __test_and_clear_bit() of cpuc->active_mask by separate
      test_bit() and __clear_bit() calls in the following commit:
      
        3966c3fe ("x86/perf/amd: Remove need to check "running" bit in NMI handler")
      
      The race causes panic for PEBS events with enabled callchains:
      
        BUG: unable to handle kernel NULL pointer dereference at 0000000000000000
        ...
        RIP: 0010:perf_prepare_sample+0x8c/0x530
        Call Trace:
         <NMI>
         perf_event_output_forward+0x2a/0x80
         __perf_event_overflow+0x51/0xe0
         handle_pmi_common+0x19e/0x240
         intel_pmu_handle_irq+0xad/0x170
         perf_event_nmi_handler+0x2e/0x50
         nmi_handle+0x69/0x110
         default_do_nmi+0x3e/0x100
         do_nmi+0x11a/0x180
         end_repeat_nmi+0x16/0x1a
        RIP: 0010:native_write_msr+0x6/0x20
        ...
         </NMI>
         intel_pmu_disable_event+0x98/0xf0
         x86_pmu_stop+0x6e/0xb0
         x86_pmu_del+0x46/0x140
         event_sched_out.isra.97+0x7e/0x160
        ...
      
      The event is configured to make samples from PEBS drain code,
      but when it's disabled, we'll go through NMI path instead,
      where data->callchain will not get allocated and we'll crash:
      
                x86_pmu_stop
                  test_bit(hwc->idx, cpuc->active_mask)
                  intel_pmu_disable_event(event)
                  {
                    ...
                    intel_pmu_pebs_disable(event);
                    ...
      
      EVENT OVERFLOW ->  <NMI>
                           intel_pmu_handle_irq
                             handle_pmi_common
         TEST PASSES ->        test_bit(bit, cpuc->active_mask))
                                 perf_event_overflow
                                   perf_prepare_sample
                                   {
                                     ...
                                     if (!(sample_type & __PERF_SAMPLE_CALLCHAIN_EARLY))
                                           data->callchain = perf_callchain(event, regs);
      
               CRASH ->              size += data->callchain->nr;
                                   }
                         </NMI>
                    ...
                    x86_pmu_disable_event(event)
                  }
      
                  __clear_bit(hwc->idx, cpuc->active_mask);
      
      Fixing this by disabling the event itself before setting
      off the PEBS bit.
      
      Signed-off-by: default avatarJiri Olsa <jolsa@kernel.org>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
      Cc: David Arcari <darcari@redhat.com>
      Cc: Jiri Olsa <jolsa@redhat.com>
      Cc: Lendacky Thomas <Thomas.Lendacky@amd.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Stephane Eranian <eranian@google.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Vince Weaver <vincent.weaver@maine.edu>
      Fixes: 3966c3fe ("x86/perf/amd: Remove need to check "running" bit in NMI handler")
      Link: http://lkml.kernel.org/r/20190504151556.31031-1-jolsa@kernel.org
      
      
      Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
      6f55967a
    • Linus Torvalds's avatar
      Merge tag 'powerpc-5.1-7' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux · 6203838d
      Linus Torvalds authored
      Pull powerpc fix from Michael Ellerman:
       "One regression fix.
      
        Changes we merged to STRICT_KERNEL_RWX on 32-bit were causing crashes
        under load on some machines depending on memory layout.
      
        Thanks to Christophe Leroy"
      
      * tag 'powerpc-5.1-7' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
        powerpc/32s: Fix BATs setting with CONFIG_STRICT_KERNEL_RWX
      6203838d
  5. May 04, 2019
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · aa1be08f
      Linus Torvalds authored
      Pull KVM fixes from Paolo Bonzini:
      
       - PPC and ARM bugfixes from submaintainers
      
       - Fix old Windows versions on AMD (recent regression)
      
       - Fix old Linux versions on processors without EPT
      
       - Fixes for LAPIC timer optimizations
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (21 commits)
        KVM: nVMX: Fix size checks in vmx_set_nested_state
        KVM: selftests: make hyperv_cpuid test pass on AMD
        KVM: lapic: Check for in-kernel LAPIC before deferencing apic pointer
        KVM: fix KVM_CLEAR_DIRTY_LOG for memory slots of unaligned size
        x86/kvm/mmu: reset MMU context when 32-bit guest switches PAE
        KVM: x86: Whitelist port 0x7e for pre-incrementing %rip
        Documentation: kvm: fix dirty log ioctl arch lists
        KVM: VMX: Move RSB stuffing to before the first RET after VM-Exit
        KVM: arm/arm64: Don't emulate virtual timers on userspace ioctls
        kvm: arm: Skip stage2 huge mappings for unaligned ipa backed by THP
        KVM: arm/arm64: Ensure vcpu target is unset on reset failure
        KVM: lapic: Convert guest TSC to host time domain if necessary
        KVM: lapic: Allow user to disable adaptive tuning of timer advancement
        KVM: lapic: Track lapic timer advance per vCPU
        KVM: lapic: Disable timer advancement if adaptive tuning goes haywire
        x86: kvm: hyper-v: deal with buggy TLB flush requests from WS2012
        KVM: x86: Consider LAPIC TSC-Deadline timer expired if deadline too short
        KVM: PPC: Book3S: Protect memslots while validating user address
        KVM: PPC: Book3S HV: Perserve PSSCR FAKE_SUSPEND bit on guest exit
        KVM: arm/arm64: vgic-v3: Retire pending interrupts on disabling LPIs
        ...
      aa1be08f
    • Linus Torvalds's avatar
      Merge branch 'i2c/for-current-fixed' of... · 82463436
      Linus Torvalds authored
      Merge branch 'i2c/for-current-fixed' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wsa/linux
      
      Pull i2c fixes from Wolfram Sang:
       "I2C driver bugfixes and a MAINTAINERS update for you"
      
      * 'i2c/for-current-fixed' of ssh://gitolite.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
        i2c: Prevent runtime suspend of adapter when Host Notify is required
        i2c: synquacer: fix enumeration of slave devices
        MAINTAINERS: friendly takeover of i2c-gpio driver
        i2c: designware: ratelimit 'transfer when suspended' errors
        i2c: imx: correct the method of getting private data in notifier_call
      82463436
    • Linus Torvalds's avatar
      Merge tag 'drm-fixes-2019-05-03' of git://anongit.freedesktop.org/drm/drm · a4ccb5f9
      Linus Torvalds authored
      Pull drm fix from Dave Airlie:
       "Just a single qxl revert"
      
      * tag 'drm-fixes-2019-05-03' of git://anongit.freedesktop.org/drm/drm:
        Revert "drm/qxl: drop prime import/export callbacks"
      a4ccb5f9
  6. May 03, 2019