Eric Lee / smarc-fsl-linux-kernel

30 May, 2018

1 commit

  • 14488f253   kernel/relay.c: limit kmalloc size to KMALLOC_MAX_SIZE ... Browse Code »

    [ Upstream commit 88913bd8ea2a75d7e460a4bed5f75e1c32660d7e ]

    chan->n_subbufs is set by the user and relay_create_buf() does a kmalloc()
    of chan->n_subbufs * sizeof(size_t *).

    kmalloc_slab() will generate a warning when this fails if
    chan->subbufs * sizeof(size_t *) > KMALLOC_MAX_SIZE.

    Limit chan->n_subbufs to the maximum allowed kmalloc() size.

    Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1802061216100.122576@chino.kir.corp.google.com
    Fixes: f6302f1bcd75 ("relay: prevent integer overflow in relay_open()")
    Signed-off-by: David Rientjes
    Reviewed-by: Andrew Morton
    Cc: Jens Axboe
    Cc: Dave Jiang
    Cc: Al Viro
    Cc: Dan Carpenter
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds
    Signed-off-by: Sasha Levin
    Signed-off-by: Greg Kroah-Hartman

    David Rientjes
     

17 Feb, 2018

1 commit

  • 75526a9bd   kernel/relay.c: revert "kernel/relay.c: fix potential memory leak" ... Browse Code »

    commit a1be1f3931bfe0a42b46fef77a04593c2b136e7f upstream.

    This reverts commit ba62bafe942b ("kernel/relay.c: fix potential memory leak").

    This commit introduced a double free bug, because 'chan' is already
    freed by the line:

    kref_put(&chan->kref, relay_destroy_channel);

    This bug was found by syzkaller, using the BLKTRACESETUP ioctl.

    Link: http://lkml.kernel.org/r/20180127004759.101823-1-ebiggers3@gmail.com
    Fixes: ba62bafe942b ("kernel/relay.c: fix potential memory leak")
    Signed-off-by: Eric Biggers
    Reported-by: syzbot
    Reviewed-by: Andrew Morton
    Cc: Zhouyi Zhou
    Cc: Jens Axboe
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds
    Signed-off-by: Greg Kroah-Hartman

    Eric Biggers
     

03 May, 2017

1 commit

28 Feb, 2017

1 commit

  • 5b5e0928f   lib/vsprintf.c: remove %Z support ... Browse Code »

    Now that %z is standartised in C99 there is no reason to support %Z.
    Unlike %L it doesn't even make format strings smaller.

    Use BUILD_BUG_ON in a couple ATM drivers.

    In case anyone didn't notice lib/vsprintf.o is about half of SLUB which
    is in my opinion is quite an achievement. Hopefully this patch inspires
    someone else to trim vsprintf.c more.

    Link: http://lkml.kernel.org/r/20170103230126.GA30170@avx2
    Signed-off-by: Alexey Dobriyan
    Cc: Andy Shevchenko
    Cc: Rasmus Villemoes
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Alexey Dobriyan
     

25 Feb, 2017

1 commit

  • 11bac8000   mm, fs: reduce fault, page_mkwrite, and pfn_mkwrite to take only vmf ... Browse Code »

    ->fault(), ->page_mkwrite(), and ->pfn_mkwrite() calls do not need to
    take a vma and vmf parameter when the vma already resides in vmf.

    Remove the vma parameter to simplify things.

    [arnd@arndb.de: fix ARM build]
    Link: http://lkml.kernel.org/r/20170125223558.1451224-1-arnd@arndb.de
    Link: http://lkml.kernel.org/r/148521301778.19116.10840599906674778980.stgit@djiang5-desk3.ch.intel.com
    Signed-off-by: Dave Jiang
    Signed-off-by: Arnd Bergmann
    Reviewed-by: Ross Zwisler
    Cc: Theodore Ts'o
    Cc: Darrick J. Wong
    Cc: Matthew Wilcox
    Cc: Dave Hansen
    Cc: Christoph Hellwig
    Cc: Jan Kara
    Cc: Dan Williams
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Dave Jiang
     

27 Dec, 2016

1 commit

15 Dec, 2016

1 commit

  • 9a29d0fbc   relay: check array offset before using it ... Browse Code »

    Smatch complains that we started using the array offset before we
    checked that it was valid.

    Fixes: 017c59c042d0 ('relay: Use per CPU constructs for the relay channel buffer pointers')
    Link: http://lkml.kernel.org/r/20161013084947.GC16198@mwanda
    Signed-off-by: Dan Carpenter
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Dan Carpenter
     

12 Oct, 2016

1 commit

  • 26b5679e4   relay: Use irq_work instead of plain timer for deferred wakeup ... Browse Code »

    Relay avoids calling wake_up_interruptible() for doing the wakeup of
    readers/consumers, waiting for the generation of new data, from the
    context of a process which produced the data. This is apparently done to
    prevent the possibility of a deadlock in case Scheduler itself is is
    generating data for the relay, after acquiring rq->lock.

    The following patch used a timer (to be scheduled at next jiffy), for
    delegating the wakeup to another context.
    commit 7c9cb38302e78d24e37f7d8a2ea7eed4ae5f2fa7
    Author: Tom Zanussi
    Date: Wed May 9 02:34:01 2007 -0700

    relay: use plain timer instead of delayed work

    relay doesn't need to use schedule_delayed_work() for waking readers
    when a simple timer will do.

    Scheduling a plain timer, at next jiffies boundary, to do the wakeup
    causes a significant wakeup latency for the Userspace client, which makes
    relay less suitable for the high-frequency low-payload use cases where the
    data gets generated at a very high rate, like multiple sub buffers getting
    filled within a milli second. Moreover the timer is re-scheduled on every
    newly produced sub buffer so the timer keeps getting pushed out if sub
    buffers are filled in a very quick succession (less than a jiffy gap
    between filling of 2 sub buffers). As a result relay runs out of sub
    buffers to store the new data.

    By using irq_work it is ensured that wakeup of userspace client, blocked
    in the poll call, is done at earliest (through self IPI or next timer
    tick) enabling it to always consume the data in time. Also this makes
    relay consistent with printk & ring buffers (trace), as they too use
    irq_work for deferred wake up of readers.

    [arnd@arndb.de: select CONFIG_IRQ_WORK]
    Link: http://lkml.kernel.org/r/20160912154035.3222156-1-arnd@arndb.de
    [akpm@linux-foundation.org: coding-style fixes]
    Link: http://lkml.kernel.org/r/1472906487-1559-1-git-send-email-akash.goel@intel.com
    Signed-off-by: Peter Zijlstra
    Signed-off-by: Akash Goel
    Cc: Tom Zanussi
    Cc: Chris Wilson
    Cc: Tvrtko Ursulin
    Signed-off-by: Arnd Bergmann
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Peter Zijlstra
     

08 Oct, 2016

1 commit

  • d1f532337   Merge branch 'work.splice_read' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs ... Browse Code »

    Pull VFS splice updates from Al Viro:
    "There's a bunch of branches this cycle, both mine and from other folks
    and I'd rather send pull requests separately.

    This one is the conversion of ->splice_read() to ITER_PIPE iov_iter
    (and introduction of such). Gets rid of a lot of code in fs/splice.c
    and elsewhere; there will be followups, but these are for the next
    cycle... Some pipe/splice-related cleanups from Miklos in the same
    branch as well"

    * 'work.splice_read' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
    pipe: fix comment in pipe_buf_operations
    pipe: add pipe_buf_steal() helper
    pipe: add pipe_buf_confirm() helper
    pipe: add pipe_buf_release() helper
    pipe: add pipe_buf_get() helper
    relay: simplify relay_file_read()
    switch default_file_splice_read() to use of pipe-backed iov_iter
    switch generic_file_splice_read() to use of ->read_iter()
    new iov_iter flavour: pipe-backed
    fuse_dev_splice_read(): switch to add_to_pipe()
    skb_splice_bits(): get rid of callback
    new helper: add_to_pipe()
    splice: lift pipe_lock out of splice_to_pipe()
    splice: switch get_iovec_page_array() to iov_iter
    splice_to_pipe(): don't open-code wakeup_pipe_readers()
    consistent treatment of EFAULT on O_DIRECT read/write

    Linus Torvalds
     

06 Oct, 2016

1 commit

07 Sep, 2016

2 commits

  • e6d4989a9   relayfs: Convert to hotplug state machine ... Browse Code »

    Install the callbacks via the state machine. They are installed at run time but
    relay_prepare_cpu() does not need to be invoked by the boot CPU because
    relay_open() was not yet invoked and there are no pools that need to be created.

    Signed-off-by: Richard Weinberger
    Signed-off-by: Thomas Gleixner
    Signed-off-by: Sebastian Andrzej Siewior
    Reviewed-by: Sebastian Andrzej Siewior
    Cc: Peter Zijlstra
    Cc: rt@linutronix.de
    Cc: Andrew Morton
    Link: http://lkml.kernel.org/r/20160818125731.27256-3-bigeasy@linutronix.de
    Signed-off-by: Thomas Gleixner

    Richard Weinberger
     
  • 017c59c04   relay: Use per CPU constructs for the relay channel buffer pointers ... Browse Code »

    relay essentially needs to maintain a per CPU array of channel buffer
    pointers but it manually creates that array. Instead its better to use
    the per CPU constructs, provided by the kernel, to allocate & access the
    array of pointer to channel buffers.

    Signed-off-by: Akash Goel
    Reviewed-by: Chris Wilson
    Link: http://lkml.kernel.org/r/1470909140-25919-1-git-send-email-akash.goel@intel.com
    Signed-off-by: Andrew Morton
    Signed-off-by: Thomas Gleixner

    Akash Goel
     

03 Aug, 2016

1 commit

  • 59dbb2a06   relay: add global mode support for buffer-only channels ... Browse Code »

    Commit 20d8b67c06fa ("relay: add buffer-only channels; useful for early
    logging") added support to use channels with no associated files.

    This is useful when the exact location of relay file is not known or the
    the parent directory of relay file is not available, while creating the
    channel and the logging has to start right from the boot.

    But there was no provision to use global mode with buffer-only channels,
    which is added by this patch, without modifying the interface where
    initially there will be a dummy invocation of create_buf_file callback
    through which kernel client can convey the need of a global buffer.

    For the use case where drivers/kernel clients want a simple interface
    for the userspace, which enables them to capture data/logs from relay
    file inorder & without any post processing, support of Global buffer
    mode is warranted.

    Modules, like i915, using relay_open() in early init would have to later
    register their buffer-only relays, once debugfs is available, by calling
    relay_late_setup_files(). Hence relay_late_setup_files() symbol also
    needs to be exported.

    Link: http://lkml.kernel.org/r/1468404563-11653-1-git-send-email-akash.goel@intel.com
    Signed-off-by: Akash Goel
    Cc: Eduard - Gabriel Munteanu
    Cc: Tom Zanussi
    Cc: Chris Wilson
    Cc: Al Viro
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Akash Goel
     

10 Jun, 2016

1 commit

  • ba62bafe9   kernel/relay.c: fix potential memory leak ... Browse Code »

    When relay_open_buf() fails in relay_open(), code will goto free_bufs,
    but chan is nowhere freed.

    Link: http://lkml.kernel.org/r/1464777927-19675-1-git-send-email-yizhouzhou@ict.ac.cn
    Signed-off-by: Zhouyi Zhou
    Cc: Jens Axboe
    Cc: Al Viro
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Zhouyi Zhou
     

23 Jan, 2016

1 commit

  • 5955102c9   wrappers for ->i_mutex access ... Browse Code »

    parallel to mutex_{lock,unlock,trylock,is_locked,lock_nested},
    inode_foo(inode) being mutex_foo(&inode->i_mutex).

    Please, use those for access to ->i_mutex; over the coming cycle
    ->i_mutex will become rwsem, with ->lookup() done with it held
    only shared.

    Signed-off-by: Al Viro

    Al Viro
     

01 Jul, 2015

1 commit

16 Apr, 2015

1 commit

13 Apr, 2014

1 commit

  • 5166701b3   Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs ... Browse Code »

    Pull vfs updates from Al Viro:
    "The first vfs pile, with deep apologies for being very late in this
    window.

    Assorted cleanups and fixes, plus a large preparatory part of iov_iter
    work. There's a lot more of that, but it'll probably go into the next
    merge window - it *does* shape up nicely, removes a lot of
    boilerplate, gets rid of locking inconsistencie between aio_write and
    splice_write and I hope to get Kent's direct-io rewrite merged into
    the same queue, but some of the stuff after this point is having
    (mostly trivial) conflicts with the things already merged into
    mainline and with some I want more testing.

    This one passes LTP and xfstests without regressions, in addition to
    usual beating. BTW, readahead02 in ltp syscalls testsuite has started
    giving failures since "mm/readahead.c: fix readahead failure for
    memoryless NUMA nodes and limit readahead pages" - might be a false
    positive, might be a real regression..."

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs: (63 commits)
    missing bits of "splice: fix racy pipe->buffers uses"
    cifs: fix the race in cifs_writev()
    ceph_sync_{,direct_}write: fix an oops on ceph_osdc_new_request() failure
    kill generic_file_buffered_write()
    ocfs2_file_aio_write(): switch to generic_perform_write()
    ceph_aio_write(): switch to generic_perform_write()
    xfs_file_buffered_aio_write(): switch to generic_perform_write()
    export generic_perform_write(), start getting rid of generic_file_buffer_write()
    generic_file_direct_write(): get rid of ppos argument
    btrfs_file_aio_write(): get rid of ppos
    kill the 5th argument of generic_file_buffered_write()
    kill the 4th argument of __generic_file_aio_write()
    lustre: don't open-code kernel_recvmsg()
    ocfs2: don't open-code kernel_recvmsg()
    drbd: don't open-code kernel_recvmsg()
    constify blk_rq_map_user_iov() and friends
    lustre: switch to kernel_sendmsg()
    ocfs2: don't open-code kernel_sendmsg()
    take iov_iter stuff to mm/iov_iter.c
    process_vm_access: tidy up a bit
    ...

    Linus Torvalds
     

12 Apr, 2014

1 commit

02 Apr, 2014

1 commit

19 Feb, 2014

1 commit

15 Jul, 2013

1 commit

  • 0db0628d9   kernel: delete __cpuinit usage from all core kernel files ... Browse Code »

    The __cpuinit type of throwaway sections might have made sense
    some time ago when RAM was more constrained, but now the savings
    do not offset the cost and complications. For example, the fix in
    commit 5e427ec2d0 ("x86: Fix bit corruption at CPU resume time")
    is a good example of the nasty type of bugs that can be created
    with improper use of the various __init prefixes.

    After a discussion on LKML[1] it was decided that cpuinit should go
    the way of devinit and be phased out. Once all the users are gone,
    we can then finally remove the macros themselves from linux/init.h.

    This removes all the uses of the __cpuinit macros from C files in
    the core kernel directories (kernel, init, lib, mm, and include)
    that don't really have a specific maintainer.

    [1] https://lkml.org/lkml/2013/5/20/589

    Signed-off-by: Paul Gortmaker

    Paul Gortmaker
     

09 May, 2013

1 commit

  • 4de13d7aa   Merge branch 'for-3.10/core' of git://git.kernel.dk/linux-block ... Browse Code »

    Pull block core updates from Jens Axboe:

    - Major bit is Kents prep work for immutable bio vecs.

    - Stable candidate fix for a scheduling-while-atomic in the queue
    bypass operation.

    - Fix for the hang on exceeded rq->datalen 32-bit unsigned when merging
    discard bios.

    - Tejuns changes to convert the writeback thread pool to the generic
    workqueue mechanism.

    - Runtime PM framework, SCSI patches exists on top of these in James'
    tree.

    - A few random fixes.

    * 'for-3.10/core' of git://git.kernel.dk/linux-block: (40 commits)
    relay: move remove_buf_file inside relay_close_buf
    partitions/efi.c: replace useless kzalloc's by kmalloc's
    fs/block_dev.c: fix iov_shorten() criteria in blkdev_aio_read()
    block: fix max discard sectors limit
    blkcg: fix "scheduling while atomic" in blk_queue_bypass_start
    Documentation: cfq-iosched: update documentation help for cfq tunables
    writeback: expose the bdi_wq workqueue
    writeback: replace custom worker pool implementation with unbound workqueue
    writeback: remove unused bdi_pending_list
    aoe: Fix unitialized var usage
    bio-integrity: Add explicit field for owner of bip_buf
    block: Add an explicit bio flag for bios that own their bvec
    block: Add bio_alloc_pages()
    block: Convert some code to bio_for_each_segment_all()
    block: Add bio_for_each_segment_all()
    bounce: Refactor __blk_queue_bounce to not use bi_io_vec
    raid1: use bio_copy_data()
    pktcdvd: Use bio_reset() in disabled code to kill bi_idx usage
    pktcdvd: use bio_copy_data()
    block: Add bio_copy_data()
    ...

    Linus Torvalds
     

01 May, 2013

3 commits

30 Apr, 2013

1 commit

  • b8d4a5bf6   relay: move remove_buf_file inside relay_close_buf ... Browse Code »

    Currently remove_buf_file callback is called from from kobject
    release method. This result in follow issue:
    # blktrace -d /dev/sda1 -d /dev/sda -o test

    blktrace_setup()
    dir = create_dir()
    rchan = relay_open(dir,...)
    ->create_buf_file_callback
    buf_file = debugfs_create_file(dir, )

    Userspace will open buf_file.
    Later we make a decision to stop tracing
    blktrace_down()
    relay_close(rhcan) /* just decrement kobj reference */
    /* since it is not zero then callback not called */
    debugfs_remove(dir) /* FAIL due to non empty dir */

    Later user space will close the file and file will be deleted,
    but directory still exist.
    user_space_close()
    ->file_release
    ->release_buf_file_callback
    ->debugfs_remove(buf_file
    ## TESTCASE:
    # blktrace -d /dev/sda1 -d /dev/sda -o test
    # After that blktrace infrastructure will remain broken in
    # an unusable state so: blktrace -d /dev/sda1 will not work.

    In fact this is general issue, blktrace is just one of examples.
    We can not reliably remove parent dir until all users close the
    buf_file.

    Solution: We don't have to wait that long. File should be deleted inside
    relay_close_buf().

    Signed-off-by: Dmitry Monakhov
    Signed-off-by: Jens Axboe

    Dmitry Monakhov
     

23 Feb, 2013

1 commit

14 Jun, 2012

1 commit

  • 047fe3605   splice: fix racy pipe->buffers uses ... Browse Code »

    Dave Jones reported a kernel BUG at mm/slub.c:3474! triggered
    by splice_shrink_spd() called from vmsplice_to_pipe()

    commit 35f3d14dbbc5 (pipe: add support for shrinking and growing pipes)
    added capability to adjust pipe->buffers.

    Problem is some paths don't hold pipe mutex and assume pipe->buffers
    doesn't change for their duration.

    Fix this by adding nr_pages_max field in struct splice_pipe_desc, and
    use it in place of pipe->buffers where appropriate.

    splice_shrink_spd() loses its struct pipe_inode_info argument.

    Reported-by: Dave Jones
    Signed-off-by: Eric Dumazet
    Cc: Jens Axboe
    Cc: Alexander Viro
    Cc: Tom Herbert
    Cc: stable # 2.6.35
    Tested-by: Dave Jones
    Signed-off-by: Jens Axboe

    Eric Dumazet
     

10 Feb, 2012

1 commit

04 Jan, 2012

1 commit

31 Oct, 2011

1 commit

  • 9984de1a5   kernel: Map most files to use export.h instead of module.h ... Browse Code »

    The changed files were only including linux/module.h for the
    EXPORT_SYMBOL infrastructure, and nothing else. Revector them
    onto the isolated export header for faster compile times.

    Nothing to see here but a whole lot of instances of:

    -#include
    +#include

    This commit is only changing the kernel dir; next targets
    will probably be mm, fs, the arch dirs, etc.

    Signed-off-by: Paul Gortmaker

    Paul Gortmaker
     

05 Nov, 2010

1 commit

28 May, 2010

1 commit

22 May, 2010

1 commit

07 Mar, 2010

1 commit

  • 5f1664f92   splice: comparing unsigned int < 0 ... Browse Code »

    "ret" needs to be signed or the error handling for splice_to_pipe() won't
    work correctly.

    Signed-off-by: Dan Carpenter
    Cc: Tom Zanussi
    Cc: Jens Axboe
    Cc: Lai Jiangshan
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Dan Carpenter
     

16 Dec, 2009

1 commit

28 Sep, 2009

1 commit

06 Apr, 2009

1 commit

  • 714f83d5d   Merge branch 'tracing-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip ... Browse Code »

    * 'tracing-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip: (413 commits)
    tracing, net: fix net tree and tracing tree merge interaction
    tracing, powerpc: fix powerpc tree and tracing tree interaction
    ring-buffer: do not remove reader page from list on ring buffer free
    function-graph: allow unregistering twice
    trace: make argument 'mem' of trace_seq_putmem() const
    tracing: add missing 'extern' keywords to trace_output.h
    tracing: provide trace_seq_reserve()
    blktrace: print out BLK_TN_MESSAGE properly
    blktrace: extract duplidate code
    blktrace: fix memory leak when freeing struct blk_io_trace
    blktrace: fix blk_probes_ref chaos
    blktrace: make classic output more classic
    blktrace: fix off-by-one bug
    blktrace: fix the original blktrace
    blktrace: fix a race when creating blk_tree_root in debugfs
    blktrace: fix timestamp in binary output
    tracing, Text Edit Lock: cleanup
    tracing: filter fix for TRACE_EVENT_FORMAT events
    ftrace: Using FTRACE_WARN_ON() to check "freed record" in ftrace_release()
    x86: kretprobe-booster interrupt emulation code fix
    ...

    Fix up trivial conflicts in
    arch/parisc/include/asm/ftrace.h
    include/linux/memory.h
    kernel/extable.c
    kernel/module.c

    Linus Torvalds
     

03 Apr, 2009

1 commit

  • 2c53d9109   relay: fix for possible loss/corruption of produced subbufs ... Browse Code »

    Fix possible loss/corruption of produced subbufs in
    relay_subbufs_consumed().

    When buf->subbufs_produced wraps around after UINT_MAX and
    buf->subbufs_consumed is still < UINT_MAX, the condition

    if (buf->subbufs_consumed > buf->subbufs_produced)

    will be true even for certain valid values of subbufs_consumed. This may
    lead to loss or corruption of produced subbufs.

    Signed-off-by: Aravind Srinivasan
    Cc: Tom Zanussi
    Cc: Tom Zanussi
    Signed-off-by: Andrew Morton
    Signed-off-by: Linus Torvalds

    Aravind Srinivasan