1. 17 Jul, 2021 6 commits
    • Linus Torvalds's avatar
      Merge tag '5.14-rc1-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6 · 44cb60b4
      Linus Torvalds authored
      Pull cifs fixes from Steve French:
       "Eight cifs/smb3 fixes, including three for stable.
      
        Three are DFS related fixes, and two to fix problems pointed out by
        static checkers"
      
      * tag '5.14-rc1-smb3-fixes' of git://git.samba.org/sfrench/cifs-2.6:
        cifs: do not share tcp sessions of dfs connections
        SMB3.1.1: fix mount failure to some servers when compression enabled
        cifs: added WARN_ON for all the count decrements
        cifs: fix missing null session check in mount
        cifs: handle reconnect of tcon when there is no cached dfs referral
        cifs: fix the out of range assignment to bit fields in parse_server_interfaces
        cifs: Do not use the original cruid when following DFS links for multiuser mounts
        cifs: use the expiry output of dns_query to schedule next resolution
      44cb60b4
    • Linus Torvalds's avatar
      Merge tag 'linux-kselftest-kunit-fixes-5.14-rc2' of... · ccbb22b9
      Linus Torvalds authored
      Merge tag 'linux-kselftest-kunit-fixes-5.14-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
      
      Pull kunit fixes from Shuah Khan:
       "Fixes to kunit tool and documentation:
      
         - fix asserts on older python versions
      
         - fixes to misleading error messages when TAP header format is
           incorrect or when file is missing
      
         - documentation fix: drop obsolete information about uml_abort
           coverage
      
         - remove unnecessary annotations"
      
      * tag 'linux-kselftest-kunit-fixes-5.14-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
        kunit: tool: Assert the version requirement
        kunit: tool: remove unnecessary "annotations" import
        Documentation: kunit: drop obsolete note about uml_abort for coverage
        kunit: tool: Fix error messages for cases of no tests and wrong TAP header
      ccbb22b9
    • Linus Torvalds's avatar
      Merge tag 'linux-kselftest-fixes-5.14-rc2' of... · 00397e74
      Linus Torvalds authored
      Merge tag 'linux-kselftest-fixes-5.14-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest
      
      Pull kselftest fix from Shuah Khan:
       "A fix to memory-hotplug hot-remove test to stop spamming logs with
        dump_page() entries and slowing the system down to a crawl"
      
      * tag 'linux-kselftest-fixes-5.14-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
        selftests: memory-hotplug: avoid spamming logs with dump_page(), ratio limit hot-remove error test
      00397e74
    • Linus Torvalds's avatar
      Merge tag 'trace-v5.14-5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace · 3fdacf40
      Linus Torvalds authored
      Pull tracing fix from Steven Rostedt:
       "Fix the histogram logic from possibly crashing the kernel
      
        Working on the histogram code, I found that if you dereference a char
        pointer in a trace event that happens to point to user space, it can
        crash the kernel, as it does no checks of that pointer. I have code
        coming that will do this better, so just remove this ability to treat
        character pointers in trace events as stings in the histogram"
      
      * tag 'trace-v5.14-5' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace:
        tracing: Do not reference char * as a string in histograms
      3fdacf40
    • Linus Torvalds's avatar
      Merge tag 'devicetree-fixes-for-5.14-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux · d980cc06
      Linus Torvalds authored
      Pull devicetree fixes from Rob Herring:
      
       - Drop 'resets' as required on renesas,du
      
       - Moving of fixed string patterns for 'properties' instead of
         'patternProperties'
      
       - Drop more redundant minItems/maxItems that we merged in the merge
         window
      
       - Indentation warning fix for sja1105
      
      * tag 'devicetree-fixes-for-5.14-1' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux:
        dt-bindings: display: renesas,du: Make resets optional on R-Car H1
        dt-bindings: Move fixed string 'patternProperties' to 'properties'
        dt-bindings: More dropping redundant minItems/maxItems
        dt-bindings: net: dsa: sja1105: Fix indentation warnings
      d980cc06
    • Linus Torvalds's avatar
      Merge tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux · 5f06a790
      Linus Torvalds authored
      Pull arm64 fixes from Will Deacon:
       "The bulk of the diffstat consists of changes to our uaccess routines
        so that they fall back to bytewise copying prior to reporting complete
        failure when the initial (multi-byte) access faults.
      
        However, the most disappointing change here is that we've had to bump
        ARCH_DMA_MINALIGN back to 128 bytes thanks to Qualcomm's "Kryo" CPU,
        which ended up in the MSM8996 mobile SoC. Still, at least we're now
        aware of this design and one of the hardware designers confirmed the
        L2 cacheline size for us.
      
        Summary:
      
         - Fix instrumentation annotations for entry code
      
         - Ensure kernel MTE state is restored correctly on resume from suspend
      
         - Fix MTE fault from new strlen() routine
      
         - Fallback to byte-wise accesses on initial uaccess fault
      
         - Bump Clang requirement for BTI
      
         - Revert ARCH_DMA_MINALIGN back to 128 bytes (shakes fist at Qualcomm)"
      
      * tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
        arm64: entry: fix KCOV suppression
        arm64: entry: add missing noinstr
        arm64: mte: fix restoration of GCR_EL1 from suspend
        arm64: Avoid premature usercopy failure
        arm64: Restrict ARM64_BTI_KERNEL to clang 12.0.0 and newer
        Revert "arm64: cache: Lower ARCH_DMA_MINALIGN to 64 (L1_CACHE_BYTES)"
        arm64: Add missing header <asm/smp.h> in two files
        arm64: fix strlen() with CONFIG_KASAN_HW_TAGS
      5f06a790
  2. 16 Jul, 2021 18 commits
  3. 15 Jul, 2021 16 commits
    • Dave Airlie's avatar
      Merge tag 'amd-drm-fixes-5.14-2021-07-14' of... · 2ea2086c
      Dave Airlie authored
      Merge tag 'amd-drm-fixes-5.14-2021-07-14' of https://gitlab.freedesktop.org/agd5f/linux
      
       into drm-fixes
      
      amd-drm-fixes-5.14-2021-07-14:
      
      amdgpu:
      - SR-IOV fixes
      - RAS fixes
      - eDP fixes
      - SMU13 code unification to facilitate fixes in the future
      - Add new renoir DID
      - Yellow Carp fixes
      - Beige Goby fixes
      - Revert a bunch of TLB fixes that caused regressions
      - Revert an LTTPR display regression
      
      amdkfd
      - Fix VRAM access regression
      - SVM fixes
      Signed-off-by: default avatarDave Airlie <airlied@redhat.com>
      From: Alex Deucher <alexander.deucher@amd.com>
      Link: https://patchwork.freedesktop.org/patch/msgid/20210714220858.5553-1-alexander.deucher@amd.com
      2ea2086c
    • Steven Rostedt (VMware)'s avatar
      tracing: Do not reference char * as a string in histograms · 704adfb5
      Steven Rostedt (VMware) authored
      The histogram logic was allowing events with char * pointers to be used as
      normal strings. But it was easy to crash the kernel with:
      
       # echo 'hist:keys=filename' > events/syscalls/sys_enter_openat/trigger
      
      And open some files, and boom!
      
       BUG: unable to handle page fault for address: 00007f2ced0c3280
       #PF: supervisor read access in kernel mode
       #PF: error_code(0x0000) - not-present page
       PGD 1173fa067 P4D 1173fa067 PUD 1171b6067 PMD 1171dd067 PTE 0
       Oops: 0000 [#1] PREEMPT SMP
       CPU: 6 PID: 1810 Comm: cat Not tainted 5.13.0-rc5-test+ #61
       Hardware name: Hewlett-Packard HP Compaq Pro 6300 SFF/339A, BIOS K01
      v03.03 07/14/2016
       RIP: 0010:strlen+0x0/0x20
       Code: f6 82 80 2a 0b a9 20 74 11 0f b6 50 01 48 83 c0 01 f6 82 80 2a 0b
      a9 20 75 ef c3 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 <80> 3f 00 74
      10 48 89 f8 48 83 c0 01 80 38 00 75 f7 48 29 f8 c3
      
       RSP: 0018:ffffbdbf81567b50 EFLAGS: 00010246
       RAX: 0000000000000003 RBX: ffff93815cdb3800 RCX: ffff9382401a22d0
       RDX: 0000000000000100 RSI: 0000000000000000 RDI: 00007f2ced0c3280
       RBP: 0000000000000100 R08: ffff9382409ff074 R09: ffffbdbf81567c98
       R10: ffff9382409ff074 R11: 0000000000000000 R12: ffff9382409ff074
       R13: 0000000000000001 R14: ffff93815a744f00 R15: 00007f2ced0c3280
       FS:  00007f2ced0f8580(0000) GS:ffff93825a800000(0000)
      knlGS:0000000000000000
       CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
       CR2: 00007f2ced0c3280 CR3: 0000000107069005 CR4: 00000000001706e0
       Call Trace:
        event_hist_trigger+0x463/0x5f0
        ? find_held_lock+0x32/0x90
        ? sched_clock_cpu+0xe/0xd0
        ? lock_release+0x155/0x440
        ? kernel_init_free_pages+0x6d/0x90
        ? preempt_count_sub+0x9b/0xd0
        ? kernel_init_free_pages+0x6d/0x90
        ? get_page_from_freelist+0x12c4/0x1680
        ? __rb_reserve_next+0xe5/0x460
        ? ring_buffer_lock_reserve+0x12a/0x3f0
        event_triggers_call+0x52/0xe0
        ftrace_syscall_enter+0x264/0x2c0
        syscall_trace_enter.constprop.0+0x1ee/0x210
        do_syscall_64+0x1c/0x80
        entry_SYSCALL_64_after_hwframe+0x44/0xae
      
      Where it triggered a fault on strlen(key) where key was the filename.
      
      The reason is that filename is a char * to user space, and the histogram
      code just blindly dereferenced it, with obvious bad results.
      
      I originally tried to use strncpy_from_user/kernel_nofault() but found
      that there's other places that its dereferenced and not worth the effort.
      
      Just do not allow "char *" to act like strings.
      
      Link: https://lkml.kernel.org/r/20210715000206.025df9d2@rorschach.local.home
      
      
      
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Andrew Morton <akpm@linux-foundation.org>
      Cc: Masami Hiramatsu <mhiramat@kernel.org>
      Cc: Tzvetomir Stoyanov <tz.stoyanov@gmail.com>
      Cc: stable@vger.kernel.org
      Acked-by: default avatarNamhyung Kim <namhyung@kernel.org>
      Acked-by: default avatarTom Zanussi <zanussi@kernel.org>
      Fixes: 79e577cb ("tracing: Support string type key properly")
      Fixes: 5967bd5c
      
       ("tracing: Let filter_assign_type() detect FILTER_PTR_STRING")
      Signed-off-by: default avatarSteven Rostedt (VMware) <rostedt@goodmis.org>
      704adfb5
    • Linus Torvalds's avatar
      Merge tag 'Wimplicit-fallthrough-clang-5.14-rc2' of... · e9338abf
      Linus Torvalds authored
      Merge tag 'Wimplicit-fallthrough-clang-5.14-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux
      
      Pull fallthrough fixes from Gustavo Silva:
       "This fixes many fall-through warnings when building with Clang and
        -Wimplicit-fallthrough, and also enables -Wimplicit-fallthrough for
        Clang, globally.
      
        It's also important to notice that since we have adopted the use of
        the pseudo-keyword macro fallthrough, we also want to avoid having
        more /* fall through */ comments being introduced. Contrary to GCC,
        Clang doesn't recognize any comments as implicit fall-through markings
        when the -Wimplicit-fallthrough option is enabled.
      
        So, in order to avoid having more comments being introduced, we use
        the option -Wimplicit-fallthrough=5 for GCC, which similar to Clang,
        will cause a warning in case a code comment is intended to be used as
        a fall-through marking. The patch for Makefile also enforces this.
      
        We had almost 4,000 of these issues for Clang in the beginning, and
        there might be a couple more out there when building some
        architectures with certain configurations. However, with the recent
        fixes I think we are in good shape and it is now possible to enable
        the warning for Clang"
      
      * tag 'Wimplicit-fallthrough-clang-5.14-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux: (27 commits)
        Makefile: Enable -Wimplicit-fallthrough for Clang
        powerpc/smp: Fix fall-through warning for Clang
        dmaengine: mpc512x: Fix fall-through warning for Clang
        usb: gadget: fsl_qe_udc: Fix fall-through warning for Clang
        powerpc/powernv: Fix fall-through warning for Clang
        MIPS: Fix unreachable code issue
        MIPS: Fix fall-through warnings for Clang
        ASoC: Mediatek: MT8183: Fix fall-through warning for Clang
        power: supply: Fix fall-through warnings for Clang
        dmaengine: ti: k3-udma: Fix fall-through warning for Clang
        s390: Fix fall-through warnings for Clang
        dmaengine: ipu: Fix fall-through warning for Clang
        iommu/arm-smmu-v3: Fix fall-through warning for Clang
        mmc: jz4740: Fix fall-through warning for Clang
        PCI: Fix fall-through warning for Clang
        scsi: libsas: Fix fall-through warning for Clang
        video: fbdev: Fix fall-through warning for Clang
        math-emu: Fix fall-through warning
        cpufreq: Fix fall-through warning for Clang
        drm/msm: Fix fall-through warning in msm_gem_new_impl()
        ...
      e9338abf
    • Linus Torvalds's avatar
      Merge branch 'akpm' (patches from Andrew) · dd9c7df9
      Linus Torvalds authored
      Merge misc fixes from Andrew Morton:
       "13 patches.
      
        Subsystems affected by this patch series: mm (kasan, pagealloc, rmap,
        hmm, and hugetlb), and hfs"
      
      * emailed patches from Andrew Morton <akpm@linux-foundation.org>:
        mm/hugetlb: fix refs calculation from unaligned @vaddr
        hfs: add lock nesting notation to hfs_find_init
        hfs: fix high memory mapping in hfs_bnode_read
        hfs: add missing clean-up in hfs_fill_super
        lib/test_hmm: remove set but unused page variable
        mm: fix the try_to_unmap prototype for !CONFIG_MMU
        mm/page_alloc: further fix __alloc_pages_bulk() return value
        mm/page_alloc: correct return value when failing at preparing
        mm/page_alloc: avoid page allocator recursion with pagesets.lock held
        Revert "mm/page_alloc: make should_fail_alloc_page() static"
        kasan: fix build by including kernel.h
        kasan: add memzero init for unaligned size at DEBUG
        mm: move helper to check slub_debug_enabled
      dd9c7df9
    • Randy Dunlap's avatar
      EDAC/igen6: fix core dependency AGAIN · a1c9ca5f
      Randy Dunlap authored
      My previous patch had a typo/thinko which prevents this driver
      from being enabled: change X64_64 to X86_64.
      
      Fixes: 0a9ece9b
      
       ("EDAC/igen6: fix core dependency")
      Signed-off-by: default avatarRandy Dunlap <rdunlap@infradead.org>
      Cc: Qiuxu Zhuo <qiuxu.zhuo@intel.com>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Mauro Carvalho Chehab <mchehab@kernel.org>
      Cc: linux-edac@vger.kernel.org
      Cc: bowsingbetee <bowsingbetee@protonmail.com>
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarTony Luck <tony.luck@intel.com>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      a1c9ca5f
    • Linus Torvalds's avatar
      Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm · 405386b0
      Linus Torvalds authored
      Pull kvm fixes from Paolo Bonzini:
      
       - Allow again loading KVM on 32-bit non-PAE builds
      
       - Fixes for host SMIs on AMD
      
       - Fixes for guest SMIs on AMD
      
       - Fixes for selftests on s390 and ARM
      
       - Fix memory leak
      
       - Enforce no-instrumentation area on vmentry when hardware breakpoints
         are in use.
      
      * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (25 commits)
        KVM: selftests: smm_test: Test SMM enter from L2
        KVM: nSVM: Restore nested control upon leaving SMM
        KVM: nSVM: Fix L1 state corruption upon return from SMM
        KVM: nSVM: Introduce svm_copy_vmrun_state()
        KVM: nSVM: Check that VM_HSAVE_PA MSR was set before VMRUN
        KVM: nSVM: Check the value written to MSR_VM_HSAVE_PA
        KVM: SVM: Fix sev_pin_memory() error checks in SEV migration utilities
        KVM: SVM: Return -EFAULT if copy_to_user() for SEV mig packet header fails
        KVM: SVM: add module param to control the #SMI interception
        KVM: SVM: remove INIT intercept handler
        KVM: SVM: #SMI interception must not skip the instruction
        KVM: VMX: Remove vmx_msr_index from vmx.h
        KVM: X86: Disable hardware breakpoints unconditionally before kvm_x86->run()
        KVM: selftests: Address extra memslot parameters in vm_vaddr_alloc
        kvm: debugfs: fix memory leak in kvm_create_vm_debugfs
        KVM: x86/pmu: Clear anythread deprecated bit when 0xa leaf is unsupported on the SVM
        KVM: mmio: Fix use-after-free Read in kvm_vm_ioctl_unregister_coalesced_mmio
        KVM: SVM: Revert clearing of C-bit on GPA in #NPF handler
        KVM: x86/mmu: Do not apply HPA (memory encryption) mask to GPAs
        KVM: x86: Use kernel's x86_phys_bits to handle reduced MAXPHYADDR
        ...
      405386b0
    • Linus Torvalds's avatar
      Merge tag 'iommu-fixes-v5.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu · f3523a22
      Linus Torvalds authored
      Pull iommu fixes from Joerg Roedel:
      
       - Revert a patch which caused boot failures with QCOM IOMMU
      
       - Two fixes for Intel VT-d context table handling
      
       - Physical address decoding fix for Rockchip IOMMU
      
       - Add a reviewer for AMD IOMMU
      
      * tag 'iommu-fixes-v5.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
        MAINTAINERS: Add Suravee Suthikulpanit as Reviewer for AMD IOMMU (AMD-Vi)
        iommu/rockchip: Fix physical address decoding
        iommu/vt-d: Fix clearing real DMA device's scalable-mode context entries
        iommu/vt-d: Global devTLB flush when present context entry changed
        iommu/qcom: Revert "iommu/arm: Cleanup resources in case of probe error path"
      f3523a22
    • Joao Martins's avatar
      mm/hugetlb: fix refs calculation from unaligned @vaddr · d08af0a5
      Joao Martins authored
      Commit 82e5d378 ("mm/hugetlb: refactor subpage recording")
      refactored the count of subpages but missed an edge case when @vaddr is
      not aligned to PAGE_SIZE e.g.  when close to vma->vm_end.  It would then
      errousnly set @refs to 0 and record_subpages_vmas() wouldn't set the
      @pages array element to its value, consequently causing the reported
      null-deref by syzbot.
      
      Fix it by aligning down @vaddr by PAGE_SIZE in @refs calculation.
      
      Link: https://lkml.kernel.org/r/20210713152440.28650-1-joao.m.martins@oracle.com
      Fixes: 82e5d378
      
       ("mm/hugetlb: refactor subpage recording")
      Reported-by: syzbot+a3fcd59df1b372066f5a@syzkaller.appspotmail.com
      Signed-off-by: default avatarJoao Martins <joao.m.martins@oracle.com>
      Reviewed-by: default avatarMike Kravetz <mike.kravetz@oracle.com>
      Cc: <stable@vger.kernel.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      d08af0a5
    • Desmond Cheong Zhi Xi's avatar
      hfs: add lock nesting notation to hfs_find_init · b3b2177a
      Desmond Cheong Zhi Xi authored
      Syzbot reports a possible recursive lock in [1].
      
      This happens due to missing lock nesting information.  From the logs, we
      see that a call to hfs_fill_super is made to mount the hfs filesystem.
      While searching for the root inode, the lock on the catalog btree is
      grabbed.  Then, when the parent of the root isn't found, a call to
      __hfs_bnode_create is made to create the parent of the root.  This
      eventually leads to a call to hfs_ext_read_extent which grabs a lock on
      the extents btree.
      
      Since the order of locking is catalog btree -> extents btree, this lock
      hierarchy does not lead to a deadlock.
      
      To tell lockdep that this locking is safe, we add nesting notation to
      distinguish between catalog btrees, extents btrees, and attributes
      btrees (for HFS+).  This has already been done in hfsplus.
      
      Link: https://syzkaller.appspot.com/bug?id=f007ef1d7a31a469e3be7aeb0fde0769b18585db [1]
      Link: https://lkml.kernel.org/r/20210701030756.58760-4-desmondcheongzx@gmail.com
      
      Signed-off-by: default avatarDesmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
      Reported-by: syzbot+b718ec84a87b7e73ade4@syzkaller.appspotmail.com
      Tested-by: syzbot+b718ec84a87b7e73ade4@syzkaller.appspotmail.com
      Reviewed-by: default avatarViacheslav Dubeyko <slava@dubeyko.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
      Cc: Shuah Khan <skhan@linuxfoundation.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      b3b2177a
    • Desmond Cheong Zhi Xi's avatar
      hfs: fix high memory mapping in hfs_bnode_read · 54a5ead6
      Desmond Cheong Zhi Xi authored
      Pages that we read in hfs_bnode_read need to be kmapped into kernel
      address space.  However, currently only the 0th page is kmapped.  If the
      given offset + length exceeds this 0th page, then we have an invalid
      memory access.
      
      To fix this, we kmap relevant pages one by one and copy their relevant
      portions of data.
      
      An example of invalid memory access occurring without this fix can be seen
      in the following crash report:
      
        ==================================================================
        BUG: KASAN: use-after-free in memcpy include/linux/fortify-string.h:191 [inline]
        BUG: KASAN: use-after-free in hfs_bnode_read+0xc4/0xe0 fs/hfs/bnode.c:26
        Read of size 2 at addr ffff888125fdcffe by task syz-executor5/4634
      
        CPU: 0 PID: 4634 Comm: syz-executor5 Not tainted 5.13.0-syzkaller #0
        Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
        Call Trace:
         __dump_stack lib/dump_stack.c:79 [inline]
         dump_stack+0x195/0x1f8 lib/dump_stack.c:120
         print_address_description.constprop.0+0x1d/0x110 mm/kasan/report.c:233
         __kasan_report mm/kasan/report.c:419 [inline]
         kasan_report.cold+0x7b/0xd4 mm/kasan/report.c:436
         check_region_inline mm/kasan/generic.c:180 [inline]
         kasan_check_range+0x154/0x1b0 mm/kasan/generic.c:186
         memcpy+0x24/0x60 mm/kasan/shadow.c:65
         memcpy include/linux/fortify-string.h:191 [inline]
         hfs_bnode_read+0xc4/0xe0 fs/hfs/bnode.c:26
         hfs_bnode_read_u16 fs/hfs/bnode.c:34 [inline]
         hfs_bnode_find+0x880/0xcc0 fs/hfs/bnode.c:365
         hfs_brec_find+0x2d8/0x540 fs/hfs/bfind.c:126
         hfs_brec_read+0x27/0x120 fs/hfs/bfind.c:165
         hfs_cat_find_brec+0x19a/0x3b0 fs/hfs/catalog.c:194
         hfs_fill_super+0xc13/0x1460 fs/hfs/super.c:419
         mount_bdev+0x331/0x3f0 fs/super.c:1368
         hfs_mount+0x35/0x40 fs/hfs/super.c:457
         legacy_get_tree+0x10c/0x220 fs/fs_context.c:592
         vfs_get_tree+0x93/0x300 fs/super.c:1498
         do_new_mount fs/namespace.c:2905 [inline]
         path_mount+0x13f5/0x20e0 fs/namespace.c:3235
         do_mount fs/namespace.c:3248 [inline]
         __do_sys_mount fs/namespace.c:3456 [inline]
         __se_sys_mount fs/namespace.c:3433 [inline]
         __x64_sys_mount+0x2b8/0x340 fs/namespace.c:3433
         do_syscall_64+0x37/0xc0 arch/x86/entry/common.c:47
         entry_SYSCALL_64_after_hwframe+0x44/0xae
        RIP: 0033:0x45e63a
        Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 88 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
        RSP: 002b:00007f9404d410d8 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
        RAX: ffffffffffffffda RBX: 0000000020000248 RCX: 000000000045e63a
        RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f9404d41120
        RBP: 00007f9404d41120 R08: 00000000200002c0 R09: 0000000020000000
        R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
        R13: 0000000000000003 R14: 00000000004ad5d8 R15: 0000000000000000
      
        The buggy address belongs to the page:
        page:00000000dadbcf3e refcount:0 mapcount:0 mapping:0000000000000000 index:0x1 pfn:0x125fdc
        flags: 0x2fffc0000000000(node=0|zone=2|lastcpupid=0x3fff)
        raw: 02fffc0000000000 ffffea000497f748 ffffea000497f6c8 0000000000000000
        raw: 0000000000000001 0000000000000000 00000000ffffffff 0000000000000000
        page dumped because: kasan: bad access detected
      
        Memory state around the buggy address:
         ffff888125fdce80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
         ffff888125fdcf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        >ffff888125fdcf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                                        ^
         ffff888125fdd000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
         ffff888125fdd080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
        ==================================================================
      
      Link: https://lkml.kernel.org/r/20210701030756.58760-3-desmondcheongzx@gmail.com
      
      Signed-off-by: default avatarDesmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
      Reviewed-by: default avatarViacheslav Dubeyko <slava@dubeyko.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
      Cc: Shuah Khan <skhan@linuxfoundation.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      54a5ead6
    • Desmond Cheong Zhi Xi's avatar
      hfs: add missing clean-up in hfs_fill_super · 16ee572e
      Desmond Cheong Zhi Xi authored
      Patch series "hfs: fix various errors", v2.
      
      This series ultimately aims to address a lockdep warning in
      hfs_find_init reported by Syzbot [1].
      
      The work done for this led to the discovery of another bug, and the
      Syzkaller repro test also reveals an invalid memory access error after
      clearing the lockdep warning.  Hence, this series is broken up into
      three patches:
      
      1. Add a missing call to hfs_find_exit for an error path in
         hfs_fill_super
      
      2. Fix memory mapping in hfs_bnode_read by fixing calls to kmap
      
      3. Add lock nesting notation to tell lockdep that the observed locking
         hierarchy is safe
      
      This patch (of 3):
      
      Before exiting hfs_fill_super, the struct hfs_find_data used in
      hfs_find_init should be passed to hfs_find_exit to be cleaned up, and to
      release the lock held on the btree.
      
      The call to hfs_find_exit is missing from an error path.  We add it back
      in by consolidating calls to hfs_find_exit for error paths.
      
      Link: https://syzkaller.appspot.com/bug?id=f007ef1d7a31a469e3be7aeb0fde0769b18585db [1]
      Link: https://lkml.kernel.org/r/20210701030756.58760-1-desmondcheongzx@gmail.com
      Link: https://lkml.kernel.org/r/20210701030756.58760-2-desmondcheongzx@gmail.com
      
      Signed-off-by: default avatarDesmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
      Reviewed-by: default avatarViacheslav Dubeyko <slava@dubeyko.com>
      Cc: Gustavo A. R. Silva <gustavoars@kernel.org>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Cc: Shuah Khan <skhan@linuxfoundation.org>
      Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      16ee572e
    • Alistair Popple's avatar
      lib/test_hmm: remove set but unused page variable · c52114d9
      Alistair Popple authored
      The HMM selftests use atomic_check_access() to check atomic access to a
      page has been revoked.  It doesn't matter if the page mapping has been
      removed from the mirrored page tables as that also implies atomic access
      has been revoked.  Therefore remove the unused page variable to fix this
      compiler warning:
      
        lib/test_hmm.c:631:16: warning: variable `page' set but not used [-Wunused-but-set-variable]
      
      Link: https://lkml.kernel.org/r/20210706025603.4059-1-apopple@nvidia.com
      Fixes: b659baea
      
       ("mm: selftests for exclusive device memory")
      Signed-off-by: default avatarAlistair Popple <apopple@nvidia.com>
      Reported-by: default avatarHulk Robot <hulkci@huawei.com>
      Reported-by: default avatarkernel test robot <oliver.sang@intel.com>
      Reported-by: default avatarYang Yingliang <yangyingliang@huawei.com>
      Acked-by: default avatarSouptick Joarder <jrdr.linux@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      c52114d9
    • Christoph Hellwig's avatar
      mm: fix the try_to_unmap prototype for !CONFIG_MMU · ab7965de
      Christoph Hellwig authored
      Adjust the nommu stub of try_to_unmap to match the changed protype for the
      full version.  Turn it into an inline instead of a macro to generally
      improve the type checking.
      
      Link: https://lkml.kernel.org/r/20210705053944.885828-1-hch@lst.de
      Fixes: 1fb08ac6
      
       ("mm: rmap: make try_to_unmap() void function")
      Signed-off-by: default avatarChristoph Hellwig <hch@lst.de>
      Reviewed-by: default avatarYang Shi <shy828301@gmail.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      ab7965de
    • Chuck Lever's avatar
      mm/page_alloc: further fix __alloc_pages_bulk() return value · 06147843
      Chuck Lever authored
      The author of commit b3b64ebd ("mm/page_alloc: do bulk array
      bounds check after checking populated elements") was possibly
      confused by the mixture of return values throughout the function.
      
      The API contract is clear that the function "Returns the number of pages
      on the list or array." It does not list zero as a unique return value with
      a special meaning.  Therefore zero is a plausible return value only if
      @nr_pages is zero or less.
      
      Clean up the return logic to make it clear that the returned value is
      always the total number of pages in the array/list, not the number of
      pages that were allocated during this call.
      
      The only change in behavior with this patch is the value returned if
      prepare_alloc_pages() fails.  To match the API contract, the number of
      pages currently in the array/list is returned in this case.
      
      The call site in __page_pool_alloc_pages_slow() also seems to be confused
      on this matter.  It should be attended to by someone who is familiar with
      that code.
      
      [mel@techsingularity.net: Return nr_populated if 0 pages are requested]
      
      Link: https://lkml.kernel.org/r/20210713152100.10381-4-mgorman@techsingularity.net
      
      Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
      Signed-off-by: default avatarMel Gorman <mgorman@techsingularity.net>
      Acked-by: default avatarJesper Dangaard Brouer <brouer@redhat.com>
      Cc: Desmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
      Cc: Zhang Qiang <Qiang.Zhang@windriver.com>
      Cc: Yanfei Xu <yanfei.xu@windriver.com>
      Cc: Matteo Croce <mcroce@microsoft.com>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      06147843
    • Yanfei Xu's avatar
      mm/page_alloc: correct return value when failing at preparing · e5c15cea
      Yanfei Xu authored
      If the array passed in is already partially populated, we should return
      "nr_populated" even failing at preparing arguments stage.
      
      Link: https://lkml.kernel.org/r/20210713152100.10381-3-mgorman@techsingularity.net
      
      Signed-off-by: default avatarYanfei Xu <yanfei.xu@windriver.com>
      Signed-off-by: default avatarMel Gorman <mgorman@techsingularity.net>
      Link: https://lore.kernel.org/r/20210709102855.55058-1-yanfei.xu@windriver.com
      
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      e5c15cea
    • Mel Gorman's avatar
      mm/page_alloc: avoid page allocator recursion with pagesets.lock held · 187ad460
      Mel Gorman authored
      Syzbot is reporting potential deadlocks due to pagesets.lock when
      PAGE_OWNER is enabled.  One example from Desmond Cheong Zhi Xi is as
      follows
      
        __alloc_pages_bulk()
          local_lock_irqsave(&pagesets.lock, flags) <---- outer lock here
          prep_new_page():
            post_alloc_hook():
              set_page_owner():
                __set_page_owner():
                  save_stack():
                    stack_depot_save():
                      alloc_pages():
                        alloc_page_interleave():
                          __alloc_pages():
                            get_page_from_freelist():
                              rm_queue():
                                rm_queue_pcplist():
                                  local_lock_irqsave(&pagesets.lock, flags);
                                  *** DEADLOCK ***
      
      Zhang, Qiang also reported
      
        BUG: sleeping function called from invalid context at mm/page_alloc.c:5179
        in_atomic(): 0, irqs_disabled(): 1, non_block: 0, pid: 1, name: swapper/0
        .....
        __dump_stack lib/dump_stack.c:79 [inline]
        dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:96
        ___might_sleep.cold+0x1f1/0x237 kernel/sched/core.c:9153
        prepare_alloc_pages+0x3da/0x580 mm/page_alloc.c:5179
        __alloc_pages+0x12f/0x500 mm/page_alloc.c:5375
        alloc_page_interleave+0x1e/0x200 mm/mempolicy.c:2147
        alloc_pages+0x238/0x2a0 mm/mempolicy.c:2270
        stack_depot_save+0x39d/0x4e0 lib/stackdepot.c:303
        save_stack+0x15e/0x1e0 mm/page_owner.c:120
        __set_page_owner+0x50/0x290 mm/page_owner.c:181
        prep_new_page mm/page_alloc.c:2445 [inline]
        __alloc_pages_bulk+0x8b9/0x1870 mm/page_alloc.c:5313
        alloc_pages_bulk_array_node include/linux/gfp.h:557 [inline]
        vm_area_alloc_pages mm/vmalloc.c:2775 [inline]
        __vmalloc_area_node mm/vmalloc.c:2845 [inline]
        __vmalloc_node_range+0x39d/0x960 mm/vmalloc.c:2947
        __vmalloc_node mm/vmalloc.c:2996 [inline]
        vzalloc+0x67/0x80 mm/vmalloc.c:3066
      
      There are a number of ways it could be fixed.  The page owner code could
      be audited to strip GFP flags that allow sleeping but it'll impair the
      functionality of PAGE_OWNER if allocations fail.  The bulk allocator could
      add a special case to release/reacquire the lock for prep_new_page and
      lookup PCP after the lock is reacquired at the cost of performance.  The
      pages requiring prep could be tracked using the least significant bit and
      looping through the array although it is more complicated for the list
      interface.  The options are relatively complex and the second one still
      incurs a performance penalty when PAGE_OWNER is active so this patch takes
      the simple approach -- disable bulk allocation of PAGE_OWNER is active.
      The caller will be forced to allocate one page at a time incurring a
      performance penalty but PAGE_OWNER is already a performance penalty.
      
      Link: https://lkml.kernel.org/r/20210708081434.GV3840@techsingularity.net
      Fixes: dbbee9d5
      
       ("mm/page_alloc: convert per-cpu list protection to local_lock")
      Signed-off-by: default avatarMel Gorman <mgorman@techsingularity.net>
      Reported-by: default avatarDesmond Cheong Zhi Xi <desmondcheongzx@gmail.com>
      Reported-by: default avatar"Zhang, Qiang" <Qiang.Zhang@windriver.com>
      Reported-by: syzbot+127fd7828d6eeb611703@syzkaller.appspotmail.com
      Tested-by: syzbot+127fd7828d6eeb611703@syzkaller.appspotmail.com
      Acked-by: default avatarRafael Aquini <aquini@redhat.com>
      Cc: Shuah Khan <skhan@linuxfoundation.org>
      Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      187ad460