- Sep 27, 2018
-
-
-
Linux Build Service Account authored
-
Mukesh Ojha authored
While we hotplug a CPU if any one of the callback (which is to be called after notify_online) fails, while doing rollback notify_dead() has not being called, as for step `notify:prepare` the flag `skipone_err` set to true and due to which sysfs nodes don't get released. If we call notify_dead(), it will send CPU_DEAD notification to the drivers and they could do their cleanup. So, there is no need to send CPU_UP_CANCEL notification on hotplug failure. This eventually reverts commit 5ec3ec14 ("kernel: cpu: send CPU_UP_CANCELLED notifcation"). Change-Id: I4ba42becec25a9d92acccae28a9fc28b9d9dedc1 Signed-off-by:
Mukesh Ojha <mojha@codeaurora.org>
-
Shrey Vijay authored
Disable RX and TX FIFO watermark interrupts in SE_DMA mode of transfer, as these interrupts are not required. Signed-off-by:Shrey Vijay <shreyv@codeaurora.org> Change-Id: I48b83d31b1eb2c651807bcd5b1052908b941dff2
-
- Sep 23, 2018
-
-
Linux Build Service Account authored
-
Alok Pandey authored
This driver provides interface to resource manager to get secure handle. The handle is used by secure camera interface. Change-Id: Ifa57770ae916f9269300860931e60a5fce0af225 Signed-off-by:Alok Pandey <akumarpa@codeaurora.org>
-
- Sep 22, 2018
-
-
Carl van Schaik authored
Add resource_manager header file definitions for communication between Linux and the Cog Resource Manager. Change-Id: I9a12c5d3b72017ccd822ab4a8296f4199ab61d2a Git-repo: https://github.com/CogSystems/linux-msm.git Git-commit: bc6eebfc1860b624c282d57293fad8600c94aa9e Signed-off-by:
Carl van Schaik <carl@cog.systems> Signed-off-by:
Sridhar Gujje <sgujje@codeaurora.org>
-
- Sep 20, 2018
-
-
Pavankumar Kondeti authored
The current code provides module parameters to enable/disable the reservation of CPUS and to specify the reserve CPUs. There are two problems with this approach. 1. Since the driver is compiled statically, the module parameters appears even when the driver initialization fails. 2. Since this driver manage the CPUs, /sys/devices/system/cpu is a better place to host this driver's sysfs files compared to /sys/module/hyp_core_ctl Move the enable module param to /sys/devices/system/cpu/hyp_core_ctl. The subsequent patches makes this driver a platform driver to receive the reserve CPUs from the device tree. So kill the reserve_cpus module parameter. Change-Id: I69ee1adb8b0c78846bac9ff44a8cb87f834bd0d6 Signed-off-by:Pavankumar Kondeti <pkondeti@codeaurora.org>
-
Neeraj Upadhyay authored
Enable VM watchdog driver, which pets the watchdog hardware at periodic intervals. Change-Id: I63ca5adae475114323789c2d93a0484a1828e406 Signed-off-by:Neeraj Upadhyay <neeraju@codeaurora.org>
-
Neeraj Upadhyay authored
Enable watchdog framework for SDM670 VM. Change-Id: I5772d056f3c75677380a76247d9c12d75d6cf3b5 Signed-off-by: -
Neeraj Upadhyay authored
Watchdog timer is configured with bark and bite time interval. If VM fails to reset the counter during bark interval, a bark interrupt (SPI) is send to the VM. Failing to respond to the bark interrupt causes a bite, when counter reaches the bite interval. The bite interrupt is routed to secure world, and causes a system reset. Change-Id: Ia71a5b1f5e18382fd3c7fb00818c80c150ae1ba5 Signed-off-by: -
Linux Build Service Account authored
-
Linux Build Service Account authored
Merge changes I76dc2a49,Idd7ddbc8,I66e3279b,I19a3a456,I62d267ca,If91d85fb,If9b7e1bd,I12635b4a,I6e52340b,I66abdfd9 into kernel.lnx.4.9.r18-rel * changes: kobject: Export kobject_get_unless_zero() block: Fix oops in locked_inode_to_wb_and_lock_list() bdi: Rename cgwb_bdi_destroy() to cgwb_bdi_unregister() bdi: Do not wait for cgwbs release in bdi_unregister() bdi: Shutdown writeback on all cgwbs in cgwb_bdi_destroy() bdi: Unify bdi->wb_list handling for root wb_writeback bdi: Make wb->bdi a proper reference bdi: Mark congested->bdi as internal block: Fix bdi assignment to bdev inode when racing with disk delete block: Make del_gendisk() safer for disks without queues
-
Linux Build Service Account authored
Merge changes Ibd57fbf5,Ie5502310,I69e154d5,Ieb5b6ef6,I8d384963,I7aabb82a,Ieda217d8,I8ed9ffc8,I00e61bff,Iec92b14c into kernel.lnx.4.9.r18-rel * changes: bdi: Fix use-after-free in wb_congested_put() block: Allow bdi re-registration block: Move bdi_unregister() to del_gendisk() block: Initialize bd_bdi on inode initialization block: Revalidate i_bdev reference in bd_aquire() block: Unhash also block device inode for the whole device block: Move bdev_unhash_inode() after invalidate_partition() block: Get rid of blk_get_backing_dev_info() block: Make blk_get_backing_dev_info() safe without open bdev block: Dynamically allocate and refcount backing_dev_info
-
Linux Build Service Account authored
-
Linux Build Service Account authored
-
Jan Kara authored
When device open races with device shutdown, we can get the following oops in scsi_disk_get(): [11863.044351] general protection fault: 0000 [#1] SMP [11863.045561] Modules linked in: scsi_debug xfs libcrc32c netconsole btrfs raid6_pq zlib_deflate lzo_compress xor [last unloaded: loop] [11863.047853] CPU: 3 PID: 13042 Comm: hald-probe-stor Tainted: G W 4.10.0-rc2-xen+ #35 [11863.048030] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [11863.048030] task: ffff88007f438200 task.stack: ffffc90000fd0000 [11863.048030] RIP: 0010:scsi_disk_get+0x43/0x70 [11863.048030] RSP: 0018:ffffc90000fd3a08 EFLAGS: 00010202 [11863.048030] RAX: 6b6b6b6b6b6b6b6b RBX: ffff88007f56d000 RCX: 0000000000000000 [11863.048030] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffff81a8d880 [11863.048030] RBP: ffffc90000fd3a18 R08: 0000000000000000 R09: 0000000000000001 [11863.059217] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffffa [11863.059217] R13: ffff880078872800 R14: ffff880070915540 R15: 000000000000001d [11863.059217] FS: 00007f2611f71800(0000) GS:ffff88007f0c0000(0000) knlGS:0000000000000000 [11863.059217] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [11863.059217] CR2: 000000000060e048 CR3: 00000000778d4000 CR4: 00000000000006e0 [11863.059217] Call Trace: [11863.059217] ? disk_get_part+0x22/0x1f0 [11863.059217] sd_open+0x39/0x130 [11863.059217] __blkdev_get+0x69/0x430 [11863.059217] ? bd_acquire+0x7f/0xc0 [11863.059217] ? bd_acquire+0x96/0xc0 [11863.059217] ? blkdev_get+0x350/0x350 [11863.059217] blkdev_get+0x126/0x350 [11863.059217] ? _raw_spin_unlock+0x2b/0x40 [11863.059217] ? bd_acquire+0x7f/0xc0 [11863.059217] ? blkdev_get+0x350/0x350 [11863.059217] blkdev_open+0x65/0x80 ... As you can see RAX value is already poisoned showing that gendisk we got is already freed. The problem is that get_gendisk() looks up device number in ext_devt_idr and then does get_disk() which does kobject_get() on the disks kobject. However the disk gets removed from ext_devt_idr only in disk_release() (through blk_free_devt()) at which moment it has already 0 refcount and is already on its way to be freed. Indeed we've got a warning from kobject_get() about 0 refcount shortly before the oops. We fix the problem by using kobject_get_unless_zero() in get_disk() so that get_disk() cannot get reference on a disk that is already being freed. Change-Id: I2146dd393f1071dde4ea0194ffc43fe3217528e2 Tested-by:
Lekshmi Pillai <lekshmicpillai@in.ibm.com> Reviewed-by:
Bart Van Assche <bart.vanassche@sandisk.com> Acked-by:
Tejun Heo <tj@kernel.org> Signed-off-by:
Jan Kara <jack@suse.cz> Signed-off-by:
Jens Axboe <axboe@fb.com> Git-commit: d01b2dcb Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git Signed-off-by:
Ritesh Harjani <riteshh@codeaurora.org>
-
Jan Kara authored
Make the function available for outside use and fortify it against NULL kobject. Change-Id: I76dc2a49293ce967309a882b5067bd85b8fc828e CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Reviewed-by:
-
Jan Kara authored
When block device is closed, we call inode_detach_wb() in __blkdev_put() which sets inode->i_wb to NULL. That is contrary to expectations that inode->i_wb stays valid once set during the whole inode's lifetime and leads to oops in wb_get() in locked_inode_to_wb_and_lock_list() because inode_to_wb() returned NULL. The reason why we called inode_detach_wb() is not valid anymore though. BDI is guaranteed to stay along until we call bdi_put() from bdev_evict_inode() so we can postpone calling inode_detach_wb() to that moment. Also add a warning to catch if someone uses inode_detach_wb() in a dangerous way. Change-Id: Idd7ddbc8120381b1649c4f82e2e8447c66b7ae4c Reported-by:
Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com> Acked-by:
-
Jan Kara authored
Rename cgwb_bdi_destroy() to cgwb_bdi_unregister() as it gets called from bdi_unregister() which is not necessarily called from bdi_destroy() and thus the name is somewhat misleading. Change-Id: I66e3279bc08b7a89a026af35a3e6d7f5d4cd6919 Acked-by:
-
Jan Kara authored
Currently we wait for all cgwbs to get released in cgwb_bdi_destroy() (called from bdi_unregister()). That is however unnecessary now when cgwb->bdi is a proper refcounted reference (thus bdi cannot get released before all cgwbs are released) and when cgwb_bdi_destroy() shuts down writeback directly. Change-Id: I19a3a456df4c215b2afd020a491f23fea9fc2181 Acked-by:
-
Jan Kara authored
Currently we waited for all cgwbs to get freed in cgwb_bdi_destroy() which also means that writeback has been shutdown on them. Since this wait is going away, directly shutdown writeback on cgwbs from cgwb_bdi_destroy() to avoid live writeback structures after bdi_unregister() has finished. To make that safe with concurrent shutdown from cgwb_release_workfn(), we also have to make sure wb_shutdown() returns only after the bdi_writeback structure is really shutdown. Change-Id: I62d267ca6dc7919ae16fc3226f857238ab42a8f0 Acked-by:
-
Jan Kara authored
Currently root wb_writeback structure is added to bdi->wb_list in bdi_init() and never removed. That is different from all other wb_writeback structures which get added to the list when created and removed from it before wb_shutdown(). So move list addition of root bdi_writeback to bdi_register() and list removal of all wb_writeback structures to wb_shutdown(). That way a wb_writeback structure is on bdi->wb_list if and only if it can handle writeback and it will make it easier for us to handle shutdown of all wb_writeback structures in bdi_unregister(). Change-Id: If91d85fb6d159fef895d8430f85d9809665d476a Acked-by:
-
Jan Kara authored
Make wb->bdi a proper refcounted reference to bdi for all bdi_writeback structures except for the one embedded inside struct backing_dev_info. That will allow us to simplify bdi unregistration. Change-Id: If9b7e1bd4e1e1f6fcc54d443bc9ec53db3ea7616 Acked-by:
-
Jan Kara authored
congested->bdi pointer is used only to be able to remove congested structure from bdi->cgwb_congested_tree on structure release. Moreover the pointer can become NULL when we unregister the bdi. Rename the field to __bdi and add a comment to make it more explicit this is internal stuff of memcg writeback code and people should not use the field as such use will be likely race prone. We do not bother with converting congested->bdi to a proper refcounted reference. It will be slightly ugly to special-case bdi->wb.congested to avoid effectively a cyclic reference of bdi to itself and the reference gets cleared from bdi_unregister() making it impossible to reference a freed bdi. Change-Id: I12635b4aad9b5689390c2c7c345957cad17bb7a2 Acked-by:
-
Jan Kara authored
When disk->fops->open() in __blkdev_get() returns -ERESTARTSYS, we restart the process of opening the block device. However we forget to switch bdev->bd_bdi back to noop_backing_dev_info and as a result bdev inode will be pointing to a stale bdi. Fix the problem by setting bdev->bd_bdi later when __blkdev_get() is already guaranteed to succeed. Change-Id: I6e52340b3a1d3619f0f3c85e40b3da3124084ae3 Acked-by:
Hannes Reinecke <hare@suse.com> Signed-off-by:
-
Jan Kara authored
Commit 165a5e22 "block: Move bdi_unregister() to del_gendisk()" added disk->queue dereference to del_gendisk(). Although del_gendisk() is not supposed to be called without disk->queue valid and blk_unregister_queue() warns in that case, this change will make it oops instead. Return to the old more robust behavior of just warning when del_gendisk() gets called for gendisk with disk->queue being NULL. Change-Id: I66abdfd9dc9a9d945aed7f9722b48a77215356b2 Reported-by:
Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
Omar Sandoval <osandov@fb.com> Signed-off-by:
-
Jan Kara authored
bdi_writeback_congested structures get created for each blkcg and bdi regardless whether bdi is registered or not. When they are created in unregistered bdi and the request queue (and thus bdi) is then destroyed while blkg still holds reference to bdi_writeback_congested structure, this structure will be referencing freed bdi and last wb_congested_put() will try to remove the structure from already freed bdi. With commit 165a5e22 "block: Move bdi_unregister() to del_gendisk()", SCSI started to destroy bdis without calling bdi_unregister() first (previously it was calling bdi_unregister() even for unregistered bdis) and thus the code detaching bdi_writeback_congested in cgwb_bdi_destroy() was not triggered and we started hitting this use-after-free-bug. It is enough to boot a KVM instance with virtio-scsi device to trigger this behavior. Fix the problem by detaching bdi_writeback_congested structures in bdi_exit() instead of bdi_unregister(). This is also more logical as they can get attached to bdi regardless whether it ever got registered or not. Change-Id: Ibd57fbf555b9b57f55fb5e6a992085223063e3eb Fixes: 165a5e22 Signed-off-by:
-
Jan Kara authored
SCSI can call device_add_disk() several times for one request queue when a device in unbound and bound, creating new gendisk each time. This will lead to bdi being repeatedly registered and unregistered. This was not a big problem until commit 165a5e22 "block: Move bdi_unregister() to del_gendisk()" since bdi was only registered repeatedly (bdi_register() handles repeated calls fine, only we ended up leaking reference to gendisk due to overwriting bdi->owner) but unregistered only in blk_cleanup_queue() which didn't get called repeatedly. After 165a5e22 we were doing correct bdi_register() - bdi_unregister() cycles however bdi_unregister() is not prepared for it. So make sure bdi_unregister() cleans up bdi in such a way that it is prepared for a possible following bdi_register() call. An easy way to provoke this behavior is to enable CONFIG_DEBUG_TEST_DRIVER_REMOVE and use scsi_debug driver to create a scsi disk which immediately hangs without this fix. Change-Id: Ie5502310e82cbb348ab5a3dfb96d96057c741ac4 Fixes: 165a5e22 Signed-off-by:
-
Jan Kara authored
Commit 6cd18e71 "block: destroy bdi before blockdev is unregistered." moved bdi unregistration (at that time through bdi_destroy()) from blk_release_queue() to blk_cleanup_queue() because it needs to happen before blk_unregister_region() call in del_gendisk() for MD. SCSI though will free up the device number from sd_remove() called through a maze of callbacks from device_del() in __scsi_remove_device() before blk_cleanup_queue() and thus similar races as described in 6cd18e71 can happen for SCSI as well as reported by Omar [1]. Moving bdi_unregister() to del_gendisk() works for MD and fixes the problem for SCSI since del_gendisk() gets called from sd_remove() before freeing the device number. This also makes device_add_disk() (calling bdi_register_owner()) more symmetric with del_gendisk(). [1] http://marc.info/?l=linux-block&m=148554717109098&w=2 Change-Id: I69e154d5b1222978daed6fd47073b16981f8602f Tested-by:
-
Jan Kara authored
So far we initialized bd_bdi only in bdget(). That is fine for normal bdev inodes however for the special case of the root inode of blockdev_superblock that function is never called and thus bd_bdi is left uninitialized. As a result bdev_evict_inode() may oops doing bdi_put(root->bd_bdi) on that inode as can be seen when doing: mount -t bdev none /mnt Fix the problem by initializing bd_bdi when first allocating the inode and then reinitializing bd_bdi in bdev_evict_inode(). Thanks to syzkaller team for finding the problem. Change-Id: Ieb5b6ef6f8eca0b2ba8e2607e04c295699391917 Reported-by:
Dmitry Vyukov <dvyukov@google.com> Fixes: b1d2dc56 ("block: Make blk_get_backing_dev_info() safe without open bdev") Signed-off-by:
-
Jan Kara authored
When a device gets removed, block device inode unhashed so that it is not used anymore (bdget() will not find it anymore). Later when a new device gets created with the same device number, we create new block device inode. However there may be file system device inodes whose i_bdev still points to the original block device inode and thus we get two active block device inodes for the same device. They will share the same gendisk so the only visible differences will be that page caches will not be coherent and BDIs will be different (the old block device inode still points to unregistered BDI). Fix the problem by checking in bd_acquire() whether i_bdev still points to active block device inode and re-lookup the block device if not. That way any open of a block device happening after the old device has been removed will get correct block device inode. Change-Id: I8d38496351d2612ccd04e935f2a8f8baeca0464b Tested-by:
-
Jan Kara authored
Iteration over partitions in del_gendisk() omits part0. Add bdev_unhash_inode() call for the whole device. Otherwise if the device number gets reused, bdev inode will be still associated with the old (stale) bdi. Change-Id: I7aabb82a791e19f6a5c5fa6ad21c5cdfa58bd5c4 Tested-by:
-
Jan Kara authored
Move bdev_unhash_inode() after invalidate_partition() as invalidate_partition() looks up bdev and it cannot find the right bdev inode after bdev_unhash_inode() is called. Thus invalidate_partition() would not invalidate page cache of the previously used bdev. Also use part_devt() when calling bdev_unhash_inode() instead of manually creating the device number. Change-Id: Ieda217d808e35b2d3d0a689e027b2022d6077943 Tested-by:
-
Jan Kara authored
blk_get_backing_dev_info() is now a simple dereference. Remove that function and simplify some code around that. Change-Id: I8ed9ffc88b53f3967adf93c7bc66be4282500e6d Signed-off-by:
-
Jan Kara authored
Currenly blk_get_backing_dev_info() is not safe to be called when the block device is not open as bdev->bd_disk is NULL in that case. However inode_to_bdi() uses this function and may be call called from flusher worker or other writeback related functions without bdev being open which leads to crashes such as: [113031.075540] Unable to handle kernel paging request for data at address 0x00000000 [113031.075614] Faulting instruction address: 0xc0000000003692e0 0:mon> t [c0000000fb65f900] c00000000036cb6c writeback_sb_inodes+0x30c/0x590 [c0000000fb65fa10] c00000000036ced4 __writeback_inodes_wb+0xe4/0x150 [c0000000fb65fa70] c00000000036d33c wb_writeback+0x30c/0x450 [c0000000fb65fb40] c00000000036e198 wb_workfn+0x268/0x580 [c0000000fb65fc50] c0000000000f3470 process_one_work+0x1e0/0x590 [c0000000fb65fce0] c0000000000f38c8 worker_thread+0xa8/0x660 [c0000000fb65fd80] c0000000000fc4b0 kthread+0x110/0x130 [c0000000fb65fe30] c0000000000098f0 ret_from_kernel_thread+0x5c/0x6c Change-Id: I00e61bff3be695768e3f836e864d3b72fb873ac1 Signed-off-by:
-
Jan Kara authored
Instead of storing backing_dev_info inside struct request_queue, allocate it dynamically, reference count it, and free it when the last reference is dropped. Currently only request_queue holds the reference but in the following patch we add other users referencing backing_dev_info. Change-Id: Iec92b14c5a1d4f25dd6e3abe9c18c121b2ae3fa4 Signed-off-by:
-
Jan Kara authored
We will want to have struct backing_dev_info allocated separately from struct request_queue. As the first step add pointer to backing_dev_info to request_queue and convert all users touching it. No functional changes in this patch. Change-Id: Ib99961747ed2d58cc2f9c0581c66c55a49aaee4b Reviewed-by:
Christoph Hellwig <hch@lst.de> Signed-off-by:
-
Jan Kara authored
Currently, block device inodes stay around after corresponding gendisk hash died until memory reclaim finds them and frees them. Since we will make block device inode pin the bdi, we want to free the block device inode as soon as the device goes away so that bdi does not stay around unnecessarily. Furthermore we need to avoid issues when new device with the same major,minor pair gets created since reusing the bdi structure would be rather difficult in this case. Unhashing block device inode on gendisk destruction nicely deals with these problems. Once last block device inode reference is dropped (which may be directly in del_gendisk()), the inode gets evicted. Furthermore if the major,minor pair gets reallocated, we are guaranteed to get new block device inode even if old block device inode is not yet evicted and thus we avoid issues with possible reuse of bdi. Change-Id: I43c46dafd900caf9d9c1430ff6ff02eff816cb7a Reviewed-by:
-
- Sep 19, 2018
-
-
Florian Westphal authored
We need to make sure the offsets are not out of range of the total size. Also check that they are in ascending order. The WARN_ON triggered by syzkaller (it sets panic_on_warn) is changed to also bail out, no point in continuing parsing. Briefly tested with simple ruleset of -A INPUT --limit 1/s' --log plus jump to custom chains using 32bit ebtables binary. Change-Id: Ic1b91b00521fb550f1774b916aa5b53c91940ed0 Reported-by:
<syzbot+845a53d13171abf8bf29@syzkaller.appspotmail.com> Signed-off-by:
Florian Westphal <fw@strlen.de> Signed-off-by:
Pablo Neira Ayuso <pablo@netfilter.org> Git-repo: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git Git-commit: b7181216 Signed-off-by:
Dennis Cagle <dcagle@codeaurora.org>
-
