summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* usb: dwc3: add ReST documentationFelipe Balbi2017-06-022-0/+713
| | | | | | | Document a few details about DWC3 in order to help people report bugs and debug DWC3. Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: dwc3: trace: decode ctrl requestFelipe Balbi2017-06-022-4/+238
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Instead of *always* dumping raw ctrl bytes, let's decode standard requests which will make the lives of those debugging DWC3 quite a bit easier. Output will now look like so: irq/34-dwc3-1594 [000] d..1 107.573081: dwc3_ctrl_req: Get Device Descriptor(Index = 0, Length = 18) irq/34-dwc3-1594 [000] d..1 107.573694: dwc3_ctrl_req: Set Address(Addr = 01) irq/34-dwc3-1594 [000] d..1 107.588319: dwc3_ctrl_req: Get Device Descriptor(Index = 0, Length = 18) irq/34-dwc3-1594 [000] d..1 107.588816: dwc3_ctrl_req: Get Configuration Descriptor(Index = 0, Length = 9) irq/34-dwc3-1594 [000] d..1 107.589191: dwc3_ctrl_req: Set Configuration(Config = 3) irq/34-dwc3-1594 [000] d..1 107.589846: dwc3_ctrl_req: Get BOS Descriptor(Index = 0, Length = 5) irq/34-dwc3-1594 [000] d..1 107.590146: dwc3_ctrl_req: Get BOS Descriptor(Index = 0, Length = 22) irq/34-dwc3-1594 [000] d..1 107.590546: dwc3_ctrl_req: Get Configuration Descriptor(Index = 0, Length = 9) irq/34-dwc3-1594 [000] d..1 107.590840: dwc3_ctrl_req: Get Configuration Descriptor(Index = 0, Length = 69) irq/34-dwc3-1594 [000] d..1 107.591138: dwc3_ctrl_req: Get Configuration Descriptor(Index = 1, Length = 9) irq/34-dwc3-1594 [000] d..1 107.591541: dwc3_ctrl_req: Get Configuration Descriptor(Index = 1, Length = 32) irq/34-dwc3-1594 [000] d..1 107.591834: dwc3_ctrl_req: Get Device Descriptor(Index = 0, Length = 18) irq/34-dwc3-1594 [000] d..1 114.701005: dwc3_ctrl_req: Get Device Descriptor(Index = 0, Length = 18) irq/34-dwc3-1594 [000] d..1 114.721080: dwc3_ctrl_req: Get Device Descriptor(Index = 0, Length = 18) irq/34-dwc3-1594 [000] d..1 114.722709: dwc3_ctrl_req: Get Device Descriptor(Index = 0, Length = 18) irq/34-dwc3-1594 [000] d..1 114.728979: dwc3_ctrl_req: Get Device Descriptor(Index = 0, Length = 18) irq/34-dwc3-1594 [000] d..1 114.730544: dwc3_ctrl_req: Get Device Qualifier Descriptor(Index = 0, Length = 10) irq/34-dwc3-1594 [000] d..1 115.776018: dwc3_ctrl_req: Get Configuration Descriptor(Index = 0, Length = 9) irq/34-dwc3-1594 [000] d..1 115.776760: dwc3_ctrl_req: Set Configuration(Config = 0) irq/34-dwc3-1594 [000] d..1 115.777676: dwc3_ctrl_req: Get Configuration(Length = 1) irq/34-dwc3-1594 [000] d..1 115.924797: dwc3_ctrl_req: Get Device Descriptor(Index = 0, Length = 18) irq/34-dwc3-1594 [000] d..1 115.929025: dwc3_ctrl_req: Get String Descriptor(Index = 0, Length = 500) irq/34-dwc3-1594 [000] d..1 115.929566: dwc3_ctrl_req: Get String Descriptor(Index = 1, Length = 500) irq/34-dwc3-1594 [000] d..1 115.930911: dwc3_ctrl_req: Get String Descriptor(Index = 0, Length = 500) irq/34-dwc3-1594 [000] d..1 115.931528: dwc3_ctrl_req: Get String Descriptor(Index = 2, Length = 500) irq/34-dwc3-1594 [000] d..1 115.932950: dwc3_ctrl_req: Get String Descriptor(Index = 0, Length = 500) irq/34-dwc3-1594 [000] d..1 115.933533: dwc3_ctrl_req: Get String Descriptor(Index = 3, Length = 500) Note that Class and Vendor requests won't be decoded for obvious reasons. Those will be printed as a raw sequence of bytes. This patch has been tested against a normal host (both Linux and Windows) and USB30CV Chapter 9 tests. Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: dwc3: debug: remove static char buffer from dwc3_decode_event()Felipe Balbi2017-06-022-8/+9
| | | | | | | Instead, we can require caller to pass a buffer for the function to use. This cleans things quite a bit. Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: dwc3: trace: rely on __string() and __assign_str()Felipe Balbi2017-06-021-8/+8
| | | | | | | Instead of going for a 512 byte buffer and using snprintf(), let's rely on helps __string() and __assign_str() where possible. Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: dwc3: gadget: slight cleanup to dwc3_process_event_entry()Felipe Balbi2017-06-021-12/+4
| | | | | | No functional changes, just a slight readability improvement. Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: dwc3: debugfs: slightly improve output of trb_ringFelipe Balbi2017-06-021-5/+4
| | | | | | | | Instead of printing out enqueue and dequeue pointer value as a header to the output, let's mark the TRBs in question with 'E' and 'D'. The output looks slightly easier to read. Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: dwc3: update documentationFelipe Balbi2017-06-024-65/+124
| | | | | | | No functional changes, just making sure we can use these for ReST docs later. Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* tools: usb: testusb: update default vary for superspeedFelipe Balbi2017-06-021-7/+9
| | | | | | | | | | Currently, default vary will not accomodate superspeed endpoints causing unexpected babble errors in the IN direction. Let's update default 'vary' parameter so that we can maintain a "short-less" transfer as hinted at the comment. Reported-by: Ammy Yi <ammy.yi@intel.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: dwc3: replace %p with %pKFelipe Balbi2017-06-022-7/+4
| | | | | | | | | | %p will leak kernel pointers, so let's not expose the information on dmesg and instead use %pK. %pK will only show the actual addresses if explicitly enabled under /proc/sys/kernel/kptr_restrict. Cc: <stable@vger.kernel.org> Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: gadget: udc-xilinx: clean up a variable nameDan Carpenter2017-05-171-1/+1
| | | | | | | | | "ep->udc->lock" and "udc->lock" are the same thing. It confuses Smatch if we don't use the same name consistently. Reviewed-by: Sören Brinkmann <soren.brinkmann@xilinx.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: dwc3: add disable u2mac linestate check quirkWilliam Wu2017-05-173-6/+20
| | | | | | | | | | | | | | | | | | | | | | This patch adds a quirk to disable USB 2.0 MAC linestate check during HS transmit. Refer the dwc3 databook, we can use it for some special platforms if the linestate not reflect the expected line state(J) during transmission. When use this quirk, the controller implements a fixed 40-bit TxEndDelay after the packet is given on UTMI and ignores the linestate during the transmit of a token (during token-to-token and token-to-data IPGAP). On some rockchip platforms (e.g. rk3399), it requires to disable the u2mac linestate check to decrease the SSPLIT token to SETUP token inter-packet delay from 566ns to 466ns, and fix the issue that FS/LS devices not recognized if inserted through USB 3.0 HUB. Acked-by: Rob Herring <robh@kernel.org> Reviewed-by: Guenter Roeck <groeck@chromium.org> Signed-off-by: William Wu <william.wu@rock-chips.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: gadget: udc: add null check before pointer dereferenceGustavo A. R. Silva2017-05-171-2/+3
| | | | | | | | | | Add null check before dereferencing dev->regs pointer inside net2280_led_shutdown() function. Addresses-Coverity-ID: 101783 Acked-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Gustavo A. R. Silva <garsilva@embeddedor.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: phy: phy-msm-usb: Remove redundant extcon register/unregisterBaolin Wang2017-05-171-67/+18
| | | | | | | | | Since usb phy core has added common code to register or unregister extcon device, then phy-msm-usb driver does not need its own code to register/unregister extcon device, then remove them. Signed-off-by: Baolin Wang <baolin.wang@linaro.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: phy: phy-qcom-8x16-usb: Remove redundant extcon register/unregisterBaolin Wang2017-05-171-15/+5
| | | | | | | | | Since usb phy core has added common code to register or unregister extcon device, then phy-qcom-8x16-usb driver does not need its own code to register/unregister extcon device, then remove them. Signed-off-by: Baolin Wang <baolin.wang@linaro.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: phy: Introduce one extcon device into usb phyBaolin Wang2017-05-173-3/+67
| | | | | | | | | | | Usually usb phy need register one extcon device to get the connection notifications. It will remove some duplicate code if the extcon device is registered using common code instead of each phy driver having its own related extcon APIs. So we add one pointer of extcon device into usb phy structure, and some other helper functions to register extcon. Signed-off-by: Baolin Wang <baolin.wang@linaro.org> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: fix the comment with regards to DocBookMauro Carvalho Chehab2017-05-171-1/+1
| | | | | | | | | | | | | | The USB gadget documentation is not at DocBook anymore. The main file was converted to ReST, and stored at Documentation/driver-api/usb/gadget.rst, but there are still several plain text files related to gadget under Documentation/usb. So, be generic and just mention documentation without specifying where it is. Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: gadget: f_uac2: calculate wMaxPacketSize before endpoint matchSekhar Nori2017-05-171-6/+6
| | | | | | | | | | | | | | | | | | Calculate wMaxPacketSize before endpoint matching the descriptor is found. This allows audio gadget to be used with controllers which have a shortage or unavailability of endpoints that can handle max packet size of 1023 (FS) or 1024 (HS). With this audio gadget can be used on TI's OMAP-L138 SoC which has a MUSB HS controller with endpoints having max packet size much less than 1023 or 1024. See mode_2_cfg in drivers/usb/musb/musb_core.c Signed-off-by: Sekhar Nori <nsekhar@ti.com> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: dwc3: gadget: lazily map requests for DMAFelipe Balbi2017-05-171-9/+12
| | | | | | | | | | | | | Some functions might want to have very, very long request queues. We can't make any assumptions about how many requests we *are* able to map, so instead of mapping requests early, let's map them late. This way, functions can queue as many requests as they'd like but we won't take DMA resources until they are needed. Also, we can now stop processing requests when we run out of DMA resources but still keep requests in the queue for late processing. Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* usb: dwc3: gadget: don't WARN about lack of TRBsFelipe Balbi2017-05-171-3/+1
| | | | | | | | We don't need a big fat warning with stack dump at all. Running out of TRBs is a normal condition and we will have more TRBs available as soon as some transfers complete. Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* USB: f_mass_storage: improve memory barriers and synchronizationAlan Stern2017-05-162-206/+156
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch reworks the way f_mass_storage.c handles memory barriers and synchronization: The driver now uses a wait_queue instead of doing its own task-state manipulations (even though only one task will ever use the wait_queue). The thread_wakeup_needed variable is removed. It was only a source of trouble; although it was what the driver tested to see whether it should wake up, what we really wanted to see was whether a USB transfer had completed. All the explicit memory barriers scattered throughout the driver are replaced by a few calls to smp_load_acquire() and smp_store_release(). The inreq_busy and outreq_busy fields are removed. In their place, the driver keeps track of the current I/O direction by splitting BUF_STATE_BUSY into two states: BUF_STATE_SENDING and BUF_STATE_RECEIVING. The buffer states are no longer protected by a lock. Mutual exclusion isn't needed; the state is changed only by the driver's main thread when it owns the buffer, and only by the request completion routine when the gadget core owns the buffer. The do_write() and throw_away_data() routines were reorganized to make efficient use of the new sleeping mechanism. This resulted in the removal of one indentation level in those routines, making the patch appear to be more more complicated than it really is. In a few places, the driver allowed itself to be frozen although it really shouldn't have (in the middle of executing a SCSI command). Those places have been fixed. The logic in the exception handler for aborting transfers and waiting for them to stop has been simplified. Tested-by: Thinh Nguyen <thinhn@synopsys.com> Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* USB: f_mass_storage: improve async notification handlingAlan Stern2017-05-162-55/+24
| | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch makes several adjustments to the way f_mass_storage.c handles its internal state and asynchronous notifications (AKA exceptions): A number of states weren't being used for anything. They are removed. The FSG_STATE_IDLE state was renamed to FSG_STATE_NORMAL, because it now applies whenever the gadget is operating normally, not just when the gadget is idle. The FSG_STATE_RESET state was renamed to FSG_STATE_PROTOCOL_RESET, indicating that it represents a Bulk-Only Transport protocol reset and not a general USB reset. When a signal arrives, it's silly for the signal handler to send itself another signal! Now it takes care of everything inline. Along with an assortment of other minor changes in the same category. Tested-by: Thinh Nguyen <thinhn@synopsys.com> Signed-off-by: Alan Stern <stern@rowland.harvard.edu> Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
* Linux 4.12-rc1v4.12-rc1Linus Torvalds2017-05-131-2/+2
|
* Merge branch 'for-linus' of ↵Linus Torvalds2017-05-135-7/+445
|\ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input Pull some more input subsystem updates from Dmitry Torokhov: "An updated xpad driver with a few more recognized device IDs, and a new psxpad-spi driver, allowing connecting Playstation 1 and 2 joypads via SPI bus" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input: Input: cros_ec_keyb - remove extraneous 'const' Input: add support for PlayStation 1/2 joypads connected via SPI Input: xpad - add USB IDs for Mad Catz Brawlstick and Razer Sabertooth Input: xpad - sync supported devices with xboxdrv Input: xpad - sort supported devices by USB ID
| * Input: cros_ec_keyb - remove extraneous 'const'Arnd Bergmann2017-05-121-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | gcc-7 warns about 'const SIMPLE_DEV_PM_OPS', as that macro already contains a 'const' keyword: drivers/input/keyboard/cros_ec_keyb.c:663:14: error: duplicate 'const' declaration specifier [-Werror=duplicate-decl-specifier] static const SIMPLE_DEV_PM_OPS(cros_ec_keyb_pm_ops, NULL, cros_ec_keyb_resume); This removes the extra one. Fixes: 6af6dc2d2aa6 ("input: Add ChromeOS EC keyboard driver") Signed-off-by: Arnd Bergmann <arnd@arndb.de> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| * Input: add support for PlayStation 1/2 joypads connected via SPITomohiro Yoshidomi2017-05-103-0/+423
| | | | | | | | | | | | | | | | PlayStation 1/2 joypads can be connected directly to the SPI interface. Signed-off-by: Tomohiro Yoshidomi <sylph23k@gmail.com> Acked-by: David Herrmann <dh.herrmann@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| * Input: xpad - add USB IDs for Mad Catz Brawlstick and Razer SabertoothBenjamin Valentin2017-05-071-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | Add USB IDs for two more Xbox 360 controllers. I found them in the pull requests for the xboxdrv userspace driver, which seems abandoned. Thanks to psychogony and mkaito for reporting the IDs there! Signed-off-by: Benjamin Valentin <benpicco@googlemail.com> Reviewed-by: Cameron Gutman <aicommander@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| * Input: xpad - sync supported devices with xboxdrvBenjamin Valentin2017-05-071-0/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The userspace xboxdrv driver [0] contains some USB IDs unknown to the kernel driver. I have created a simple script [1] to extract the missing devices and add them to xpad. A quick google search confirmed that all the new devices called Fightstick/pad are Arcade-type devices [2] where the MAP_TRIGGERS_TO_BUTTONS option should apply. There are some similar devices in the existing device table where this flag is not set, but I did refrain from changing those. [0] https://github.com/xboxdrv/xboxdrv/blob/stable/src/xpad_device.cpp [1] http://codepad.org/CHV98BNH [2] https://www.google.com/search?q=SFxT+Fightstick+Pro&tbm=isch Signed-off-by: Benjamin Valentin <benpicco@googlemail.com> Reviewed-by: Cameron Gutman <aicommander@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
| * Input: xpad - sort supported devices by USB IDBenjamin Valentin2017-05-071-6/+6
| | | | | | | | | | | | | | | | Some entries in the table of supported devices are out of order. To not create a mess when adding new ones using a script, sort them first. Signed-off-by: Benjamin Valentin <benpicco@googlemail.com> Reviewed-by: Cameron Gutman <aicommander@gmail.com> Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
* | Merge tag 'upstream-4.12-rc1' of git://git.infradead.org/linux-ubifsLinus Torvalds2017-05-139-18/+195
|\ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Pull UBI/UBIFS updates from Richard Weinberger: - new config option CONFIG_UBIFS_FS_SECURITY - minor improvements - random fixes * tag 'upstream-4.12-rc1' of git://git.infradead.org/linux-ubifs: ubi: Add debugfs file for tracking PEB state ubifs: Fix a typo in comment of ioctl2ubifs & ubifs2ioctl ubifs: Remove unnecessary assignment ubifs: Fix cut and paste error on sb type comparisons ubi: fastmap: Fix slab corruption ubifs: Add CONFIG_UBIFS_FS_SECURITY to disable/enable security labels ubi: Make mtd parameter readable ubi: Fix section mismatch
| * | ubi: Add debugfs file for tracking PEB stateBen Shelton2017-05-081-1/+125
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Add a file under debugfs to allow easy access to the erase count for each physical erase block on an UBI device. This is useful when debugging data integrity issues with UBIFS on NAND flash devices. Signed-off-by: Ben Shelton <ben.shelton@ni.com> Signed-off-by: Zach Brown <zach.brown@ni.com> v2: * If ubi_io_is_bad eraseblk_count_seq_show just returns the err. * if ubi->lookuptbl returns null, its no longer treated as an error instead info for that block is not printeded * Removed check for UBI_MAX_ERASECOUNTER since it is impossible to hit * Removed block state from print, if a block is printed then it is good and if it is not printed, then it is bad. v3: * Remove errant ! symbol from if statement checking if erase count is valid. Signed-off-by: Richard Weinberger <richard@nod.at>
| * | ubifs: Fix a typo in comment of ioctl2ubifs & ubifs2ioctlRock Lee2017-05-081-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | Change 'convert' to 'converts' Change 'UBIFS' to 'UBIFS inode flags' Signed-off-by: Rock Lee <rockdotlee@gmail.com> Signed-off-by: Richard Weinberger <richard@nod.at>
| * | ubifs: Remove unnecessary assignmentStefan Agner2017-05-081-1/+0
| | | | | | | | | | | | | | | | | | | | | Assigning a value of a variable to itself is not useful. Signed-off-by: Stefan Agner <stefan@agner.ch> Signed-off-by: Richard Weinberger <richard@nod.at>
| * | ubifs: Fix cut and paste error on sb type comparisonsColin Ian King2017-05-081-2/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The check for the bad node type of sb->type is checking sa->type and not sb-type. This looks like a cut and paste error. Fix this. Detected by PVS-Studio, warning: V581 Signed-off-by: Colin Ian King <colin.king@canonical.com> Signed-off-by: Richard Weinberger <richard@nod.at>
| * | ubi: fastmap: Fix slab corruptionRabin Vincent2017-05-081-4/+29
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Booting with UBI fastmap and SLUB debugging enabled results in the following splats. The problem is that ubi_scan_fastmap() moves the fastmap blocks from the scan_ai (allocated in scan_fast()) to the ai allocated in ubi_attach(). This results in two problems: - When the scan_ai is freed, aebs which were allocated from its slab cache are still in use. - When the other ai is being destroyed in destroy_ai(), the arguments to kmem_cache_free() call are incorrect since aebs on its ->fastmap list were allocated with a slab cache from a differnt ai. Fix this by making a copy of the aebs in ubi_scan_fastmap() instead of moving them. ============================================================================= BUG ubi_aeb_slab_cache (Not tainted): Objects remaining in ubi_aeb_slab_cache on __kmem_cache_shutdown() ----------------------------------------------------------------------------- INFO: Slab 0xbfd2da3c objects=17 used=1 fp=0xb33d7748 flags=0x40000080 CPU: 1 PID: 118 Comm: ubiattach Tainted: G B 4.9.15 #3 [<80111910>] (unwind_backtrace) from [<8010d498>] (show_stack+0x18/0x1c) [<8010d498>] (show_stack) from [<804a3274>] (dump_stack+0xb4/0xe0) [<804a3274>] (dump_stack) from [<8026c47c>] (slab_err+0x78/0x88) [<8026c47c>] (slab_err) from [<802735bc>] (__kmem_cache_shutdown+0x180/0x3e0) [<802735bc>] (__kmem_cache_shutdown) from [<8024e13c>] (shutdown_cache+0x1c/0x60) [<8024e13c>] (shutdown_cache) from [<8024ed64>] (kmem_cache_destroy+0x19c/0x20c) [<8024ed64>] (kmem_cache_destroy) from [<8057cc14>] (destroy_ai+0x1dc/0x1e8) [<8057cc14>] (destroy_ai) from [<8057f04c>] (ubi_attach+0x3f4/0x450) [<8057f04c>] (ubi_attach) from [<8056fe70>] (ubi_attach_mtd_dev+0x60c/0xff8) [<8056fe70>] (ubi_attach_mtd_dev) from [<80571d78>] (ctrl_cdev_ioctl+0x110/0x2b8) [<80571d78>] (ctrl_cdev_ioctl) from [<8029c77c>] (do_vfs_ioctl+0xac/0xa00) [<8029c77c>] (do_vfs_ioctl) from [<8029d10c>] (SyS_ioctl+0x3c/0x64) [<8029d10c>] (SyS_ioctl) from [<80108860>] (ret_fast_syscall+0x0/0x1c) INFO: Object 0xb33d7e88 @offset=3720 INFO: Allocated in scan_peb+0x608/0x81c age=72 cpu=1 pid=118 kmem_cache_alloc+0x3b0/0x43c scan_peb+0x608/0x81c ubi_attach+0x124/0x450 ubi_attach_mtd_dev+0x60c/0xff8 ctrl_cdev_ioctl+0x110/0x2b8 do_vfs_ioctl+0xac/0xa00 SyS_ioctl+0x3c/0x64 ret_fast_syscall+0x0/0x1c kmem_cache_destroy ubi_aeb_slab_cache: Slab cache still has objects CPU: 1 PID: 118 Comm: ubiattach Tainted: G B 4.9.15 #3 [<80111910>] (unwind_backtrace) from [<8010d498>] (show_stack+0x18/0x1c) [<8010d498>] (show_stack) from [<804a3274>] (dump_stack+0xb4/0xe0) [<804a3274>] (dump_stack) from [<8024ed80>] (kmem_cache_destroy+0x1b8/0x20c) [<8024ed80>] (kmem_cache_destroy) from [<8057cc14>] (destroy_ai+0x1dc/0x1e8) [<8057cc14>] (destroy_ai) from [<8057f04c>] (ubi_attach+0x3f4/0x450) [<8057f04c>] (ubi_attach) from [<8056fe70>] (ubi_attach_mtd_dev+0x60c/0xff8) [<8056fe70>] (ubi_attach_mtd_dev) from [<80571d78>] (ctrl_cdev_ioctl+0x110/0x2b8) [<80571d78>] (ctrl_cdev_ioctl) from [<8029c77c>] (do_vfs_ioctl+0xac/0xa00) [<8029c77c>] (do_vfs_ioctl) from [<8029d10c>] (SyS_ioctl+0x3c/0x64) [<8029d10c>] (SyS_ioctl) from [<80108860>] (ret_fast_syscall+0x0/0x1c) cache_from_obj: Wrong slab cache. ubi_aeb_slab_cache but object is from ubi_aeb_slab_cache ------------[ cut here ]------------ WARNING: CPU: 1 PID: 118 at mm/slab.h:354 kmem_cache_free+0x39c/0x450 Modules linked in: CPU: 1 PID: 118 Comm: ubiattach Tainted: G B 4.9.15 #3 [<80111910>] (unwind_backtrace) from [<8010d498>] (show_stack+0x18/0x1c) [<8010d498>] (show_stack) from [<804a3274>] (dump_stack+0xb4/0xe0) [<804a3274>] (dump_stack) from [<80120e40>] (__warn+0xf4/0x10c) [<80120e40>] (__warn) from [<80120f20>] (warn_slowpath_null+0x28/0x30) [<80120f20>] (warn_slowpath_null) from [<80271fe0>] (kmem_cache_free+0x39c/0x450) [<80271fe0>] (kmem_cache_free) from [<8057cb88>] (destroy_ai+0x150/0x1e8) [<8057cb88>] (destroy_ai) from [<8057ef1c>] (ubi_attach+0x2c4/0x450) [<8057ef1c>] (ubi_attach) from [<8056fe70>] (ubi_attach_mtd_dev+0x60c/0xff8) [<8056fe70>] (ubi_attach_mtd_dev) from [<80571d78>] (ctrl_cdev_ioctl+0x110/0x2b8) [<80571d78>] (ctrl_cdev_ioctl) from [<8029c77c>] (do_vfs_ioctl+0xac/0xa00) [<8029c77c>] (do_vfs_ioctl) from [<8029d10c>] (SyS_ioctl+0x3c/0x64) [<8029d10c>] (SyS_ioctl) from [<80108860>] (ret_fast_syscall+0x0/0x1c) ---[ end trace 2bd8396277fd0a0b ]--- ============================================================================= BUG ubi_aeb_slab_cache (Tainted: G B W ): page slab pointer corrupt. ----------------------------------------------------------------------------- INFO: Allocated in scan_peb+0x608/0x81c age=104 cpu=1 pid=118 kmem_cache_alloc+0x3b0/0x43c scan_peb+0x608/0x81c ubi_attach+0x124/0x450 ubi_attach_mtd_dev+0x60c/0xff8 ctrl_cdev_ioctl+0x110/0x2b8 do_vfs_ioctl+0xac/0xa00 SyS_ioctl+0x3c/0x64 ret_fast_syscall+0x0/0x1c INFO: Slab 0xbfd2da3c objects=17 used=1 fp=0xb33d7748 flags=0x40000081 INFO: Object 0xb33d7e88 @offset=3720 fp=0xb33d7da0 Redzone b33d7e80: cc cc cc cc cc cc cc cc ........ Object b33d7e88: 02 00 00 00 01 00 00 00 00 f0 ff 7f ff ff ff ff ................ Object b33d7e98: 00 00 00 00 00 00 00 00 bd 16 00 00 00 00 00 00 ................ Object b33d7ea8: 00 01 00 00 00 02 00 00 00 00 00 00 00 00 00 00 ................ Redzone b33d7eb8: cc cc cc cc .... Padding b33d7f60: 5a 5a 5a 5a 5a 5a 5a 5a ZZZZZZZZ CPU: 1 PID: 118 Comm: ubiattach Tainted: G B W 4.9.15 #3 [<80111910>] (unwind_backtrace) from [<8010d498>] (show_stack+0x18/0x1c) [<8010d498>] (show_stack) from [<804a3274>] (dump_stack+0xb4/0xe0) [<804a3274>] (dump_stack) from [<80271770>] (free_debug_processing+0x320/0x3c4) [<80271770>] (free_debug_processing) from [<80271ad0>] (__slab_free+0x2bc/0x430) [<80271ad0>] (__slab_free) from [<80272024>] (kmem_cache_free+0x3e0/0x450) [<80272024>] (kmem_cache_free) from [<8057cb88>] (destroy_ai+0x150/0x1e8) [<8057cb88>] (destroy_ai) from [<8057ef1c>] (ubi_attach+0x2c4/0x450) [<8057ef1c>] (ubi_attach) from [<8056fe70>] (ubi_attach_mtd_dev+0x60c/0xff8) [<8056fe70>] (ubi_attach_mtd_dev) from [<80571d78>] (ctrl_cdev_ioctl+0x110/0x2b8) [<80571d78>] (ctrl_cdev_ioctl) from [<8029c77c>] (do_vfs_ioctl+0xac/0xa00) [<8029c77c>] (do_vfs_ioctl) from [<8029d10c>] (SyS_ioctl+0x3c/0x64) [<8029d10c>] (SyS_ioctl) from [<80108860>] (ret_fast_syscall+0x0/0x1c) FIX ubi_aeb_slab_cache: Object at 0xb33d7e88 not freed Signed-off-by: Rabin Vincent <rabinv@axis.com> Signed-off-by: Richard Weinberger <richard@nod.at>
| * | ubifs: Add CONFIG_UBIFS_FS_SECURITY to disable/enable security labelsHyunchul Lee2017-05-083-2/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When write syscall is called, every time security label is searched to determine that file's privileges should be changed. If LSM(Linux Security Model) is not used, this is useless. So introduce CONFIG_UBIFS_SECURITY to disable security labels. it's default value is "y". Signed-off-by: Hyunchul Lee <cheol.lee@lge.com> Signed-off-by: Richard Weinberger <richard@nod.at>
| * | ubi: Make mtd parameter readableAndy Shevchenko2017-05-081-1/+1
| | | | | | | | | | | | | | | | | | | | | Fix permissions to allow read mtd parameter back (only for owner). Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Richard Weinberger <richard@nod.at>
| * | ubi: Fix section mismatchAndy Shevchenko2017-05-081-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | WARNING: vmlinux.o(.text+0x1f2a80): Section mismatch in reference from the variable __param_ops_mtd to the function .init.text:ubi_mtd_param_parse() The function __param_ops_mtd() references the function __init ubi_mtd_param_parse(). This is often because __param_ops_mtd lacks a __init annotation or the annotation of ubi_mtd_param_parse is wrong. Cc: Richard Weinberger <richard@nod.at> Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> Signed-off-by: Richard Weinberger <richard@nod.at>
* | | Merge branch 'for-linus-4.12-rc1' of ↵Linus Torvalds2017-05-137-19/+17
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml Pull UML fixes from Richard Weinberger: "No new stuff, just fixes" * 'for-linus-4.12-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml: um: Add missing NR_CPUS include um: Fix to call read_initrd after init_bootmem um: Include kbuild.h instead of duplicating its macros um: Fix PTRACE_POKEUSER on x86_64 um: Set number of CPUs um: Fix _print_addr()
| * | | um: Add missing NR_CPUS includeRichard Weinberger2017-05-041-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We need linux/threads.h for that variable. Fixes: 8bba077066d6d0 ("um: Set number of CPUs") Signed-off-by: Richard Weinberger <richard@nod.at>
| * | | um: Fix to call read_initrd after init_bootmemMasami Hiramatsu2017-05-032-3/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Since read_initrd() invokes alloc_bootmem() for allocating memory to load initrd image, it must be called after init_bootmem. This makes read_initrd() called directly from setup_arch() after init_bootmem() and mem_total_pages(). Cc: <stable@vger.kernel.org> Fixes: b63236972e1 ("um: Setup physical memory in setup_arch()") Signed-off-by: Masami Hiramatsu <mhiramat@kernel.org> Signed-off-by: Richard Weinberger <richard@nod.at>
| * | | um: Include kbuild.h instead of duplicating its macrosMatthias Kaehlcke2017-05-031-8/+1
| | | | | | | | | | | | | | | | | | | | | | | | Signed-off-by: Matthias Kaehlcke <mka@chromium.org> Reviewed-by: Masahiro Yamada <yamada.masahiro@socionext.com> Signed-off-by: Richard Weinberger <richard@nod.at>
| * | | um: Fix PTRACE_POKEUSER on x86_64Richard Weinberger2017-05-031-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is broken since ever but sadly nobody noticed. Recent versions of GDB set DR_CONTROL unconditionally and UML dies due to a heap corruption. It turns out that the PTRACE_POKEUSER was copy&pasted from i386 and assumes that addresses are 4 bytes long. Fix that by using 8 as address size in the calculation. Cc: <stable@vger.kernel.org> Reported-by: jie cao <cj3054@gmail.com> Signed-off-by: Richard Weinberger <richard@nod.at>
| * | | um: Set number of CPUsNikola Kotur2017-05-032-3/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Define NR_CPUS required by the timer subsystem. Fixes this make warning: scripts/kconfig/conf --oldconfig arch/x86/um/Kconfig kernel/time/Kconfig:155:warning: range is invalid Signed-off-by: Nikola Kotur <kotnick@gmail.com> Signed-off-by: Richard Weinberger <richard@nod.at>
| * | | um: Fix _print_addr()Richard Weinberger2017-05-031-4/+2
| |/ / | | | | | | | | | | | | | | | | | | | | | Recent changes to printk() broke UML's stack trace output. Kill the root of the problem by using a single printk() statement. Signed-off-by: Richard Weinberger <richard@nod.at>
* | | Merge branch 'akpm' (patches from Andrew)Linus Torvalds2017-05-1323-126/+145
|\ \ \ | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Merge misc fixes from Andrew Morton: "15 fixes" * emailed patches from Andrew Morton <akpm@linux-foundation.org>: mm, docs: update memory.stat description with workingset* entries mm: vmscan: scan until it finds eligible pages mm, thp: copying user pages must schedule on collapse dax: fix PMD data corruption when fault races with write dax: fix data corruption when fault races with write ext4: return to starting transaction in ext4_dax_huge_fault() mm: fix data corruption due to stale mmap reads dax: prevent invalidation of mapped DAX entries Tigran has moved mm, vmalloc: fix vmalloc users tracking properly mm/khugepaged: add missed tracepoint for collapse_huge_page_swapin gcov: support GCC 7.1 mm, vmstat: Remove spurious WARN() during zoneinfo print time: delete current_fs_time() hwpoison, memcg: forcibly uncharge LRU pages
| * | | mm, docs: update memory.stat description with workingset* entriesRoman Gushchin2017-05-131-0/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Commit 4b4cea91691d ("mm: vmscan: fix IO/refault regression in cache workingset transition") introduced three new entries in memory stat file: - workingset_refault - workingset_activate - workingset_nodereclaim This commit adds a corresponding description to the cgroup v2 docs. Link: http://lkml.kernel.org/r/1494530293-31236-1-git-send-email-guro@fb.com Signed-off-by: Roman Gushchin <guro@fb.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Michal Hocko <mhocko@kernel.org> Cc: Vladimir Davydov <vdavydov.dev@gmail.com> Cc: Tejun Heo <tj@kernel.org> Cc: Li Zefan <lizefan@huawei.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| * | | mm: vmscan: scan until it finds eligible pagesMinchan Kim2017-05-131-6/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Although there are a ton of free swap and anonymous LRU page in elgible zones, OOM happened. balloon invoked oom-killer: gfp_mask=0x17080c0(GFP_KERNEL_ACCOUNT|__GFP_ZERO|__GFP_NOTRACK), nodemask=(null), order=0, oom_score_adj=0 CPU: 7 PID: 1138 Comm: balloon Not tainted 4.11.0-rc6-mm1-zram-00289-ge228d67e9677-dirty #17 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014 Call Trace: oom_kill_process+0x21d/0x3f0 out_of_memory+0xd8/0x390 __alloc_pages_slowpath+0xbc1/0xc50 __alloc_pages_nodemask+0x1a5/0x1c0 pte_alloc_one+0x20/0x50 __pte_alloc+0x1e/0x110 __handle_mm_fault+0x919/0x960 handle_mm_fault+0x77/0x120 __do_page_fault+0x27a/0x550 trace_do_page_fault+0x43/0x150 do_async_page_fault+0x2c/0x90 async_page_fault+0x28/0x30 Mem-Info: active_anon:424716 inactive_anon:65314 isolated_anon:0 active_file:52 inactive_file:46 isolated_file:0 unevictable:0 dirty:27 writeback:0 unstable:0 slab_reclaimable:3967 slab_unreclaimable:4125 mapped:133 shmem:43 pagetables:1674 bounce:0 free:4637 free_pcp:225 free_cma:0 Node 0 active_anon:1698864kB inactive_anon:261256kB active_file:208kB inactive_file:184kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:532kB dirty:108kB writeback:0kB shmem:172kB writeback_tmp:0kB unstable:0kB all_unreclaimable? no DMA free:7316kB min:32kB low:44kB high:56kB active_anon:8064kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15908kB mlocked:0kB slab_reclaimable:464kB slab_unreclaimable:40kB kernel_stack:0kB pagetables:24kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB lowmem_reserve[]: 0 992 992 1952 DMA32 free:9088kB min:2048kB low:3064kB high:4080kB active_anon:952176kB inactive_anon:0kB active_file:36kB inactive_file:0kB unevictable:0kB writepending:88kB present:1032192kB managed:1019388kB mlocked:0kB slab_reclaimable:13532kB slab_unreclaimable:16460kB kernel_stack:3552kB pagetables:6672kB bounce:0kB free_pcp:56kB local_pcp:24kB free_cma:0kB lowmem_reserve[]: 0 0 0 959 Movable free:3644kB min:1980kB low:2960kB high:3940kB active_anon:738560kB inactive_anon:261340kB active_file:188kB inactive_file:640kB unevictable:0kB writepending:20kB present:1048444kB managed:1010816kB mlocked:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB bounce:0kB free_pcp:832kB local_pcp:60kB free_cma:0kB lowmem_reserve[]: 0 0 0 0 DMA: 1*4kB (E) 0*8kB 18*16kB (E) 10*32kB (E) 10*64kB (E) 9*128kB (ME) 8*256kB (E) 2*512kB (E) 2*1024kB (E) 0*2048kB 0*4096kB = 7524kB DMA32: 417*4kB (UMEH) 181*8kB (UMEH) 68*16kB (UMEH) 48*32kB (UMEH) 14*64kB (MH) 3*128kB (M) 1*256kB (H) 1*512kB (M) 2*1024kB (M) 0*2048kB 0*4096kB = 9836kB Movable: 1*4kB (M) 1*8kB (M) 1*16kB (M) 1*32kB (M) 0*64kB 1*128kB (M) 2*256kB (M) 4*512kB (M) 1*1024kB (M) 0*2048kB 0*4096kB = 3772kB 378 total pagecache pages 17 pages in swap cache Swap cache stats: add 17325, delete 17302, find 0/27 Free swap = 978940kB Total swap = 1048572kB 524157 pages RAM 0 pages HighMem/MovableOnly 12629 pages reserved 0 pages cma reserved 0 pages hwpoisoned [ pid ] uid tgid total_vm rss nr_ptes nr_pmds swapents oom_score_adj name [ 433] 0 433 4904 5 14 3 82 0 upstart-udev-br [ 438] 0 438 12371 5 27 3 191 -1000 systemd-udevd With investigation, skipping page of isolate_lru_pages makes reclaim void because it returns zero nr_taken easily so LRU shrinking is effectively nothing and just increases priority aggressively. Finally, OOM happens. The problem is that get_scan_count determines nr_to_scan with eligible zones so although priority drops to zero, it couldn't reclaim any pages if the LRU contains mostly ineligible pages. get_scan_count: size = lruvec_lru_size(lruvec, lru, sc->reclaim_idx); size = size >> sc->priority; Assumes sc->priority is 0 and LRU list is as follows. N-N-N-N-H-H-H-H-H-H-H-H-H-H-H-H-H-H-H-H (Ie, small eligible pages are in the head of LRU but others are almost ineligible pages) In that case, size becomes 4 so VM want to scan 4 pages but 4 pages from tail of the LRU are not eligible pages. If get_scan_count counts skipped pages, it doesn't reclaim any pages remained after scanning 4 pages so it ends up OOM happening. This patch makes isolate_lru_pages try to scan pages until it encounters eligible zones's pages. [akpm@linux-foundation.org: clean up mind-bending `for' statement. Tweak comment text] Fixes: 3db65812d688 ("Revert "mm, vmscan: account for skipped pages as a partial scan"") Link: http://lkml.kernel.org/r/1494457232-27401-1-git-send-email-minchan@kernel.org Signed-off-by: Minchan Kim <minchan@kernel.org> Acked-by: Michal Hocko <mhocko@suse.com> Acked-by: Johannes Weiner <hannes@cmpxchg.org> Cc: Mel Gorman <mgorman@techsingularity.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| * | | mm, thp: copying user pages must schedule on collapseDavid Rientjes2017-05-131-4/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We have encountered need_resched warnings in __collapse_huge_page_copy() while doing {clear,copy}_user_highpage() over HPAGE_PMD_NR source pages. mm->mmap_sem is held for write, but the iteration is well bounded. Reschedule as needed. Link: http://lkml.kernel.org/r/alpine.DEB.2.10.1705101426380.109808@chino.kir.corp.google.com Signed-off-by: David Rientjes <rientjes@google.com> Acked-by: Vlastimil Babka <vbabka@suse.cz> Cc: "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com> Cc: Johannes Weiner <hannes@cmpxchg.org> Cc: Mel Gorman <mgorman@techsingularity.net> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| * | | dax: fix PMD data corruption when fault races with writeRoss Zwisler2017-05-131-14/+14
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is based on a patch from Jan Kara that fixed the equivalent race in the DAX PTE fault path. Currently DAX PMD read fault can race with write(2) in the following way: CPU1 - write(2) CPU2 - read fault dax_iomap_pmd_fault() ->iomap_begin() - sees hole dax_iomap_rw() iomap_apply() ->iomap_begin - allocates blocks dax_iomap_actor() invalidate_inode_pages2_range() - there's nothing to invalidate grab_mapping_entry() - we add huge zero page to the radix tree and map it to page tables The result is that hole page is mapped into page tables (and thus zeros are seen in mmap) while file has data written in that place. Fix the problem by locking exception entry before mapping blocks for the fault. That way we are sure invalidate_inode_pages2_range() call for racing write will either block on entry lock waiting for the fault to finish (and unmap stale page tables after that) or read fault will see already allocated blocks by write(2). Fixes: 9f141d6ef6258 ("dax: Call ->iomap_begin without entry lock during dax fault") Link: http://lkml.kernel.org/r/20170510172700.18991-1-ross.zwisler@linux.intel.com Signed-off-by: Ross Zwisler <ross.zwisler@linux.intel.com> Reviewed-by: Jan Kara <jack@suse.cz> Cc: Dan Williams <dan.j.williams@intel.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
| * | | dax: fix data corruption when fault races with writeJan Kara2017-05-131-16/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Currently DAX read fault can race with write(2) in the following way: CPU1 - write(2) CPU2 - read fault dax_iomap_pte_fault() ->iomap_begin() - sees hole dax_iomap_rw() iomap_apply() ->iomap_begin - allocates blocks dax_iomap_actor() invalidate_inode_pages2_range() - there's nothing to invalidate grab_mapping_entry() - we add zero page in the radix tree and map it to page tables The result is that hole page is mapped into page tables (and thus zeros are seen in mmap) while file has data written in that place. Fix the problem by locking exception entry before mapping blocks for the fault. That way we are sure invalidate_inode_pages2_range() call for racing write will either block on entry lock waiting for the fault to finish (and unmap stale page tables after that) or read fault will see already allocated blocks by write(2). Fixes: 9f141d6ef6258a3a37a045842d9ba7e68f368956 Link: http://lkml.kernel.org/r/20170510085419.27601-5-jack@suse.cz Signed-off-by: Jan Kara <jack@suse.cz> Reviewed-by: Ross Zwisler <ross.zwisler@linux.intel.com> Cc: Dan Williams <dan.j.williams@intel.com> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-13 22:32:00 +0100