2019-06-13 16:24:00

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.19 000/118] 4.19.51-stable review

This is the start of the stable review cycle for the 4.19.51 release.
There are 118 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.

Responses should be made by Sat 15 Jun 2019 07:54:44 AM UTC.
Anything received after that time might be too late.

The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.51-rc1.gz
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
and the diffstat can be found below.

thanks,

greg k-h

-------------
Pseudo-Shortlog of commits:

Greg Kroah-Hartman <[email protected]>
Linux 4.19.51-rc1

Helen Koike <[email protected]>
drm/vc4: fix fb references in async update

Amir Goldstein <[email protected]>
ovl: support stacked SEEK_HOLE/SEEK_DATA

Jiufei Xue <[email protected]>
ovl: check the capability before cred overridden

Greg Kroah-Hartman <[email protected]>
Revert "drm/nouveau: add kconfig option to turn off nouveau legacy contexts. (v3)"

Greg Kroah-Hartman <[email protected]>
Revert "Bluetooth: Align minimum encryption key size for LE and BR/EDR connections"

Dennis Zhou <[email protected]>
percpu: do not search past bitmap when allocating an area

Andrey Smirnov <[email protected]>
gpio: vf610: Do not share irq_chip

Takeshi Kihara <[email protected]>
soc: renesas: Identify R-Car M3-W ES1.3

Hans de Goede <[email protected]>
usb: typec: fusb302: Check vconn is off when we start toggling

Marek Szyprowski <[email protected]>
ARM: exynos: Fix undefined instruction during Exynos5422 resume

Phong Hoang <[email protected]>
pwm: Fix deadlock warning when removing PWM device

Krzysztof Kozlowski <[email protected]>
ARM: dts: exynos: Always enable necessary APIO_1V8 and ABB_1V8 regulators on Arndale Octa

Christoph Vogtländer <[email protected]>
pwm: tiehrpwm: Update shadow register for disabling PWMs

Andy Shevchenko <[email protected]>
dmaengine: idma64: Use actual device for DMA transfers

Brett Creeley <[email protected]>
ice: Add missing case in print_link_msg for printing flow control

Tony Lindgren <[email protected]>
gpio: gpio-omap: add check for off wake capable gpios

Kangjie Lu <[email protected]>
PCI: xilinx: Check for __get_free_pages() failure

Paolo Valente <[email protected]>
block, bfq: increase idling for weight-raised queues

Kangjie Lu <[email protected]>
video: imsttfb: fix potential NULL pointer dereferences

Kangjie Lu <[email protected]>
video: hgafb: fix potential NULL pointer dereference

Giridhar Malavali <[email protected]>
scsi: qla2xxx: Reset the FCF_ASYNC_{SENT|ACTIVE} flags

Marek Vasut <[email protected]>
PCI: rcar: Fix 64bit MSI message address handling

Kangjie Lu <[email protected]>
PCI: rcar: Fix a potential NULL pointer dereference

Peng Li <[email protected]>
net: hns3: return 0 and print warning when hit duplicate MAC

Sven Van Asbroeck <[email protected]>
power: supply: max14656: fix potential use-before-alloc

Junxiao Chang <[email protected]>
platform/x86: intel_pmc_ipc: adding error handling

Kabir Sahane <[email protected]>
ARM: OMAP2+: pm33xx-core: Do not Turn OFF CEFUSE as PPA may be using it

Takashi Iwai <[email protected]>
ALSA: seq: Protect in-kernel ioctl calls with mutex

Nicholas Kazlauskas <[email protected]>
drm/amd/display: Use plane->color_space for dpp if specified

Tyrel Datwyler <[email protected]>
PCI: rpadlpar: Fix leaked device_node references in add/remove paths

Andrey Smirnov <[email protected]>
ARM: dts: imx6qdl: Specify IMX6QDL_CLK_IPG as "ipg" clock to SDMA

Andrey Smirnov <[email protected]>
ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ipg" clock to SDMA

Andrey Smirnov <[email protected]>
ARM: dts: imx6ul: Specify IMX6UL_CLK_IPG as "ipg" clock to SDMA

Andrey Smirnov <[email protected]>
ARM: dts: imx7d: Specify IMX7D_CLK_IPG as "ipg" clock to SDMA

Andrey Smirnov <[email protected]>
ARM: dts: imx6sll: Specify IMX6SLL_CLK_IPG as "ipg" clock to SDMA

Andrey Smirnov <[email protected]>
ARM: dts: imx6sx: Specify IMX6SX_CLK_IPG as "ahb" clock to SDMA

Andrey Smirnov <[email protected]>
ARM: dts: imx53: Specify IMX5_CLK_IPG as "ahb" clock to SDMA

Andrey Smirnov <[email protected]>
ARM: dts: imx50: Specify IMX5_CLK_IPG as "ahb" clock to SDMA

Andrey Smirnov <[email protected]>
ARM: dts: imx51: Specify IMX5_CLK_IPG as "ahb" clock to SDMA

Douglas Anderson <[email protected]>
soc: rockchip: Set the proper PWM for rk3288

Douglas Anderson <[email protected]>
clk: rockchip: Turn on "aclk_dmac1" for suspend on rk3288

Nathan Chancellor <[email protected]>
soc: mediatek: pwrap: Zero initialize rdata in pwrap_init_cipher

Kishon Vijay Abraham I <[email protected]>
PCI: keystone: Prevent ARM32 specific code to be compiled for ARM64

Enrico Granata <[email protected]>
platform/chrome: cros_ec_proto: check for NULL transfer function

Adam Ludkiewicz <[email protected]>
i40e: Queues are reserved despite "Invalid argument" error

Wenwen Wang <[email protected]>
x86/PCI: Fix PCI IRQ routing table memory leak

Mika Westerberg <[email protected]>
net: thunderbolt: Unregister ThunderboltIP protocol handler when suspending

Wesley Sheng <[email protected]>
switchtec: Fix unintended mask of MRPC event

Will Deacon <[email protected]>
iommu/arm-smmu-v3: Don't disable SMMU in kdump kernel

Farhan Ali <[email protected]>
vfio: Fix WARNING "do not call blocking ops when !TASK_RUNNING"

Arnd Bergmann <[email protected]>
nfsd: avoid uninitialized variable warning

J. Bruce Fields <[email protected]>
nfsd: allow fh_want_write to be called twice

Kirill Smelkov <[email protected]>
fuse: retrieve: cap requested size to negotiated max_write

Chen-Yu Tsai <[email protected]>
nvmem: sunxi_sid: Support SID on A83T and H5

Jorge Ramirez-Ortiz <[email protected]>
nvmem: core: fix read buffer in place

Takashi Iwai <[email protected]>
ALSA: hda - Register irq handler after the chip initialization

Taehee Yoo <[email protected]>
netfilter: nf_flow_table: fix netdev refcnt leak

Taehee Yoo <[email protected]>
netfilter: nf_flow_table: check ttl value in flow offload data path

Keith Busch <[email protected]>
nvme-pci: shutdown on timeout during deletion

Keith Busch <[email protected]>
nvme-pci: unquiesce admin queue on shutdown

Kishon Vijay Abraham I <[email protected]>
PCI: designware-ep: Use aligned ATU window for raising MSI interrupts

Kishon Vijay Abraham I <[email protected]>
misc: pci_endpoint_test: Fix test_reg_bar to be updated in pci_endpoint_test

Lu Baolu <[email protected]>
iommu/vt-d: Set intel_iommu_gfx_mapped correctly

Ming Lei <[email protected]>
blk-mq: move cancel of requeue_work into blk_mq_release

Vladimir Zapolskiy <[email protected]>
watchdog: fix compile time error of pretimeout governors

Georg Hofmann <[email protected]>
watchdog: imx2_wdt: Fix set_timeout for big timeout values

Florian Westphal <[email protected]>
netfilter: nf_tables: fix base chain stat rcu_dereference usage

Serge Semin <[email protected]>
mips: Make sure dt memory regions are valid

Jakub Jankowski <[email protected]>
netfilter: nf_conntrack_h323: restore boundary check correctness

Taehee Yoo <[email protected]>
netfilter: nf_flow_table: fix missing error check for rhashtable_insert_fast

Ludovic Barre <[email protected]>
mmc: mmci: Prevent polling for busy detection in IRQ context

Amir Goldstein <[email protected]>
ovl: do not generate duplicate fsnotify events for "fake" path

Jisheng Zhang <[email protected]>
PCI: dwc: Free MSI IRQ page in dw_pcie_free_msi()

Jisheng Zhang <[email protected]>
PCI: dwc: Free MSI in dw_pcie_host_init() error path

Maciej Żenczykowski <[email protected]>
uml: fix a boot splat wrt use of cpu_all_mask

YueHaibing <[email protected]>
configfs: fix possible use-after-free in configfs_register_group

John Sperbeck <[email protected]>
percpu: remove spurious lock dependency between percpu and sched

Chao Yu <[email protected]>
f2fs: fix to do checksum even if inode page is uptodate

Chao Yu <[email protected]>
f2fs: fix to do sanity check on valid block count of segment

Chao Yu <[email protected]>
f2fs: fix to use inline space only if inline_xattr is enable

Chao Yu <[email protected]>
f2fs: fix to avoid panic in dec_valid_block_count()

Chao Yu <[email protected]>
f2fs: fix to clear dirty inode in error path of f2fs_iget()

Chao Yu <[email protected]>
f2fs: fix to do sanity check on free nid

Chao Yu <[email protected]>
f2fs: fix to avoid panic in f2fs_remove_inode_page()

Chao Yu <[email protected]>
f2fs: fix to avoid panic in f2fs_inplace_write_data()

Chao Yu <[email protected]>
f2fs: fix to avoid panic in do_recover_data()

Miroslav Lichvar <[email protected]>
ntp: Allow TAI-UTC offset to be set to zero

Fabien Dessenne <[email protected]>
mailbox: stm32-ipcc: check invalid irq

Martin Blumenstingl <[email protected]>
pwm: meson: Use the spin-lock only to protect register modifications

Michael Ellerman <[email protected]>
EDAC/mpc85xx: Prevent building as a module

Krzesimir Nowak <[email protected]>
bpf: fix undefined behavior in narrow load handling

Ben Skeggs <[email protected]>
drm/nouveau/kms/gv100-: fix spurious window immediate interlocks

Josh Poimboeuf <[email protected]>
objtool: Don't use ignore flag for fake jumps

Matt Redfearn <[email protected]>
drm/bridge: adv7511: Fix low refresh rate selection

Ben Skeggs <[email protected]>
drm/nouveau/kms/gf119-gp10x: push HeadSetControlOutputResource() mthd when encoders change

Stephane Eranian <[email protected]>
perf/x86/intel: Allow PEBS multi-entry in watermark mode

Tony Lindgren <[email protected]>
mfd: twl6040: Fix device init errors for ACCCTL register

Ben Skeggs <[email protected]>
drm/nouveau/disp/dp: respect sink limits when selecting failsafe link configuration

Binbin Wu <[email protected]>
mfd: intel-lpss: Set the device in reset state when init

Daniel Gomez <[email protected]>
mfd: tps65912-spi: Add missing of table registration

Amit Kucheria <[email protected]>
drivers: thermal: tsens: Don't print error message on -EPROBE_DEFER

Jiada Wang <[email protected]>
thermal: rcar_gen3_thermal: disable interrupt in .remove

Cyrill Gorcunov <[email protected]>
kernel/sys.c: prctl: fix false positive in validate_prctl_map()

Qian Cai <[email protected]>
mm/slab.c: fix an infinite loop in leaks_show()

Yue Hu <[email protected]>
mm/cma_debug.c: fix the break condition in cma_maxchunk_get()

Aneesh Kumar K.V <[email protected]>
mm: page_mkclean vs MADV_DONTNEED race

Yue Hu <[email protected]>
mm/cma.c: fix the bitmap status to show failed allocation reason

Christoph Hellwig <[email protected]>
initramfs: free initrd memory if opening /initrd.image fails

Yue Hu <[email protected]>
mm/cma.c: fix crash on CMA allocation if bitmap allocation fails

Linxu Fang <[email protected]>
mem-hotplug: fix node spanned pages when we have a node with only ZONE_MOVABLE

Mike Kravetz <[email protected]>
hugetlbfs: on restore reserve error path retain subpool reservation

Jérôme Glisse <[email protected]>
mm/hmm: select mmu notifier when selecting HMM

Arnd Bergmann <[email protected]>
ARM: prevent tracing IPI_CPU_BACKTRACE

Guenter Roeck <[email protected]>
drm/pl111: Initialize clock spinlock early

Li Rongqing <[email protected]>
ipc: prevent lockup on alloc_msg and free_msg

Christian Brauner <[email protected]>
sysctl: return -EINVAL if val violates minmax

Hou Tao <[email protected]>
fs/fat/file.c: issue flush after the writeback of FAT

Kangjie Lu <[email protected]>
rapidio: fix a NULL pointer dereference when create_workqueue() fails


-------------

Diffstat:

Makefile | 4 +-
arch/arm/boot/dts/exynos5420-arndale-octa.dts | 2 +
arch/arm/boot/dts/imx50.dtsi | 2 +-
arch/arm/boot/dts/imx51.dtsi | 2 +-
arch/arm/boot/dts/imx53.dtsi | 2 +-
arch/arm/boot/dts/imx6qdl.dtsi | 2 +-
arch/arm/boot/dts/imx6sl.dtsi | 2 +-
arch/arm/boot/dts/imx6sll.dtsi | 2 +-
arch/arm/boot/dts/imx6sx.dtsi | 2 +-
arch/arm/boot/dts/imx6ul.dtsi | 2 +-
arch/arm/boot/dts/imx7s.dtsi | 4 +-
arch/arm/include/asm/hardirq.h | 1 +
arch/arm/kernel/smp.c | 6 +-
arch/arm/mach-exynos/suspend.c | 19 +++
arch/arm/mach-omap2/pm33xx-core.c | 8 +-
arch/mips/kernel/prom.c | 14 ++-
arch/um/kernel/time.c | 2 +-
arch/x86/events/intel/core.c | 2 +-
arch/x86/pci/irq.c | 10 +-
block/bfq-iosched.c | 2 +
block/blk-core.c | 1 -
block/blk-mq.c | 2 +
drivers/clk/rockchip/clk-rk3288.c | 11 ++
drivers/dma/idma64.c | 6 +-
drivers/dma/idma64.h | 2 +
drivers/edac/Kconfig | 4 +-
drivers/gpio/gpio-omap.c | 25 ++--
drivers/gpio/gpio-vf610.c | 26 ++---
drivers/gpu/drm/amd/display/dc/dcn10/dcn10_dpp.c | 6 +-
.../drm/amd/display/dc/dcn10/dcn10_hw_sequencer.c | 2 +-
drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 6 +-
drivers/gpu/drm/nouveau/Kconfig | 13 +--
drivers/gpu/drm/nouveau/dispnv50/disp.h | 1 +
drivers/gpu/drm/nouveau/dispnv50/head.c | 2 +-
drivers/gpu/drm/nouveau/dispnv50/wimmc37b.c | 1 +
drivers/gpu/drm/nouveau/dispnv50/wndw.c | 2 +-
drivers/gpu/drm/nouveau/nouveau_drm.c | 7 +-
drivers/gpu/drm/nouveau/nvkm/engine/disp/dp.c | 11 +-
drivers/gpu/drm/pl111/pl111_display.c | 5 +-
drivers/gpu/drm/vc4/vc4_plane.c | 1 +
drivers/iommu/arm-smmu-v3.c | 10 +-
drivers/iommu/intel-iommu.c | 7 +-
drivers/mailbox/stm32-ipcc.c | 13 ++-
drivers/mfd/intel-lpss.c | 3 +
drivers/mfd/tps65912-spi.c | 1 +
drivers/mfd/twl6040.c | 13 ++-
drivers/misc/pci_endpoint_test.c | 1 +
drivers/mmc/host/mmci.c | 5 +-
.../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 7 +-
drivers/net/ethernet/intel/i40e/i40e_main.c | 3 +
drivers/net/ethernet/intel/ice/ice_main.c | 3 +
drivers/net/thunderbolt.c | 3 +
drivers/nvme/host/pci.c | 10 +-
drivers/nvmem/core.c | 15 ++-
drivers/nvmem/sunxi_sid.c | 2 +
drivers/pci/controller/dwc/pci-keystone.c | 4 +
drivers/pci/controller/dwc/pcie-designware-ep.c | 7 +-
drivers/pci/controller/dwc/pcie-designware-host.c | 21 ++--
drivers/pci/controller/dwc/pcie-designware.h | 1 +
drivers/pci/controller/pcie-rcar.c | 10 +-
drivers/pci/controller/pcie-xilinx.c | 12 +-
drivers/pci/hotplug/rpadlpar_core.c | 4 +
drivers/pci/switch/switchtec.c | 3 +-
drivers/platform/chrome/cros_ec_proto.c | 11 ++
drivers/platform/x86/intel_pmc_ipc.c | 6 +-
drivers/power/supply/max14656_charger_detector.c | 14 +--
drivers/pwm/core.c | 10 +-
drivers/pwm/pwm-meson.c | 25 ++--
drivers/pwm/pwm-tiehrpwm.c | 2 +
drivers/pwm/sysfs.c | 14 +--
drivers/rapidio/rio_cm.c | 8 ++
drivers/scsi/qla2xxx/qla_gs.c | 3 +
drivers/soc/mediatek/mtk-pmic-wrap.c | 2 +-
drivers/soc/renesas/renesas-soc.c | 3 +
drivers/soc/rockchip/grf.c | 2 +
drivers/spi/spi-pxa2xx.c | 7 +-
drivers/thermal/qcom/tsens.c | 3 +-
drivers/thermal/rcar_gen3_thermal.c | 3 +
drivers/tty/serial/8250/8250_dw.c | 4 +-
drivers/usb/typec/fusb302/fusb302.c | 2 +
drivers/vfio/vfio.c | 30 ++---
drivers/video/fbdev/hgafb.c | 2 +
drivers/video/fbdev/imsttfb.c | 5 +
drivers/watchdog/Kconfig | 1 +
drivers/watchdog/imx2_wdt.c | 4 +-
fs/configfs/dir.c | 17 ++-
fs/dax.c | 2 +-
fs/f2fs/f2fs.h | 16 ++-
fs/f2fs/inode.c | 5 +-
fs/f2fs/node.c | 20 +++-
fs/f2fs/recovery.c | 10 +-
fs/f2fs/segment.c | 9 +-
fs/f2fs/segment.h | 3 +-
fs/fat/file.c | 11 +-
fs/fuse/dev.c | 2 +-
fs/nfsd/nfs4xdr.c | 4 +
fs/nfsd/vfs.h | 5 +-
fs/overlayfs/file.c | 130 +++++++++++++++++----
include/linux/pwm.h | 5 -
include/net/bluetooth/hci_core.h | 3 -
init/initramfs.c | 14 +--
ipc/mqueue.c | 10 +-
ipc/msgutil.c | 6 +
kernel/bpf/verifier.c | 2 +-
kernel/sys.c | 2 +-
kernel/sysctl.c | 6 +-
kernel/time/ntp.c | 2 +-
mm/Kconfig | 2 +-
mm/cma.c | 23 ++--
mm/cma_debug.c | 2 +-
mm/hugetlb.c | 21 +++-
mm/page_alloc.c | 6 +-
mm/percpu.c | 9 +-
mm/rmap.c | 2 +-
mm/slab.c | 6 +-
net/bluetooth/hci_conn.c | 8 --
net/netfilter/nf_conntrack_h323_asn1.c | 2 +-
net/netfilter/nf_flow_table_core.c | 25 ++--
net/netfilter/nf_flow_table_ip.c | 6 +
net/netfilter/nf_tables_api.c | 9 +-
net/netfilter/nft_flow_offload.c | 1 +
sound/core/seq/seq_clientmgr.c | 9 +-
sound/pci/hda/hda_intel.c | 6 +-
tools/objtool/check.c | 8 +-
124 files changed, 668 insertions(+), 304 deletions(-)



2019-06-13 16:24:04

by Greg Kroah-Hartman

[permalink] [raw]
Subject: [PATCH 4.19 004/118] ipc: prevent lockup on alloc_msg and free_msg

[ Upstream commit d6a2946a88f524a47cc9b79279667137899db807 ]

msgctl10 of ltp triggers the following lockup When CONFIG_KASAN is
enabled on large memory SMP systems, the pages initialization can take a
long time, if msgctl10 requests a huge block memory, and it will block
rcu scheduler, so release cpu actively.

After adding schedule() in free_msg, free_msg can not be called when
holding spinlock, so adding msg to a tmp list, and free it out of
spinlock

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-1 rcu_node (CPUs 16-31): P32505
rcu: Tasks blocked on level-1 rcu_node (CPUs 48-63): P34978
rcu: (detected by 11, t=35024 jiffies, g=44237529, q=16542267)
msgctl10 R running task 21608 32505 2794 0x00000082
Call Trace:
preempt_schedule_irq+0x4c/0xb0
retint_kernel+0x1b/0x2d
RIP: 0010:__is_insn_slot_addr+0xfb/0x250
Code: 82 1d 00 48 8b 9b 90 00 00 00 4c 89 f7 49 c1 ee 03 e8 59 83 1d 00 48 b8 00 00 00 00 00 fc ff df 4c 39 eb 48 89 9d 58 ff ff ff <41> c6 04 06 f8 74 66 4c 8d 75 98 4c 89 f1 48 c1 e9 03 48 01 c8 48
RSP: 0018:ffff88bce041f758 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: ffffffff8471bc50 RCX: ffffffff828a2a57
RDX: dffffc0000000000 RSI: dffffc0000000000 RDI: ffff88bce041f780
RBP: ffff88bce041f828 R08: ffffed15f3f4c5b3 R09: ffffed15f3f4c5b3
R10: 0000000000000001 R11: ffffed15f3f4c5b2 R12: 000000318aee9b73
R13: ffffffff8471bc50 R14: 1ffff1179c083ef0 R15: 1ffff1179c083eec
kernel_text_address+0xc1/0x100
__kernel_text_address+0xe/0x30
unwind_get_return_address+0x2f/0x50
__save_stack_trace+0x92/0x100
create_object+0x380/0x650
__kmalloc+0x14c/0x2b0
load_msg+0x38/0x1a0
do_msgsnd+0x19e/0xcf0
do_syscall_64+0x117/0x400
entry_SYSCALL_64_after_hwframe+0x49/0xbe

rcu: INFO: rcu_preempt detected stalls on CPUs/tasks:
rcu: Tasks blocked on level-1 rcu_node (CPUs 0-15): P32170
rcu: (detected by 14, t=35016 jiffies, g=44237525, q=12423063)
msgctl10 R running task 21608 32170 32155 0x00000082
Call Trace:
preempt_schedule_irq+0x4c/0xb0
retint_kernel+0x1b/0x2d
RIP: 0010:lock_acquire+0x4d/0x340
Code: 48 81 ec c0 00 00 00 45 89 c6 4d 89 cf 48 8d 6c 24 20 48 89 3c 24 48 8d bb e4 0c 00 00 89 74 24 0c 48 c7 44 24 20 b3 8a b5 41 <48> c1 ed 03 48 c7 44 24 28 b4 25 18 84 48 c7 44 24 30 d0 54 7a 82
RSP: 0018:ffff88af83417738 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: ffff88bd335f3080 RCX: 0000000000000002
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88bd335f3d64
RBP: ffff88af83417758 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: ffffed13f3f745b2 R12: 0000000000000000
R13: 0000000000000002 R14: 0000000000000000 R15: 0000000000000000
is_bpf_text_address+0x32/0xe0
kernel_text_address+0xec/0x100
__kernel_text_address+0xe/0x30
unwind_get_return_address+0x2f/0x50
__save_stack_trace+0x92/0x100
save_stack+0x32/0xb0
__kasan_slab_free+0x130/0x180
kfree+0xfa/0x2d0
free_msg+0x24/0x50
do_msgrcv+0x508/0xe60
do_syscall_64+0x117/0x400
entry_SYSCALL_64_after_hwframe+0x49/0xbe

Davidlohr said:
"So after releasing the lock, the msg rbtree/list is empty and new
calls will not see those in the newly populated tmp_msg list, and
therefore they cannot access the delayed msg freeing pointers, which
is good. Also the fact that the node_cache is now freed before the
actual messages seems to be harmless as this is wanted for
msg_insert() avoiding GFP_ATOMIC allocations, and after releasing the
info->lock the thing is freed anyway so it should not change things"

Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Li RongQing <[email protected]>
Signed-off-by: Zhang Yu <[email protected]>
Reviewed-by: Davidlohr Bueso <[email protected]>
Cc: Manfred Spraul <[email protected]>
Cc: Arnd Bergmann <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Signed-off-by: Sasha Levin <[email protected]>
---
ipc/mqueue.c | 10 ++++++++--
ipc/msgutil.c | 6 ++++++
2 files changed, 14 insertions(+), 2 deletions(-)

diff --git a/ipc/mqueue.c b/ipc/mqueue.c
index c0d58f390c3b..bce7af1546d9 100644
--- a/ipc/mqueue.c
+++ b/ipc/mqueue.c
@@ -391,7 +391,8 @@ static void mqueue_evict_inode(struct inode *inode)
struct user_struct *user;
unsigned long mq_bytes, mq_treesize;
struct ipc_namespace *ipc_ns;
- struct msg_msg *msg;
+ struct msg_msg *msg, *nmsg;
+ LIST_HEAD(tmp_msg);

clear_inode(inode);

@@ -402,10 +403,15 @@ static void mqueue_evict_inode(struct inode *inode)
info = MQUEUE_I(inode);
spin_lock(&info->lock);
while ((msg = msg_get(info)) != NULL)
- free_msg(msg);
+ list_add_tail(&msg->m_list, &tmp_msg);
kfree(info->node_cache);
spin_unlock(&info->lock);

+ list_for_each_entry_safe(msg, nmsg, &tmp_msg, m_list) {
+ list_del(&msg->m_list);
+ free_msg(msg);
+ }
+
/* Total amount of bytes accounted for the mqueue */
mq_treesize = info->attr.mq_maxmsg * sizeof(struct msg_msg) +
min_t(unsigned int, info->attr.mq_maxmsg, MQ_PRIO_MAX) *
diff --git a/ipc/msgutil.c b/ipc/msgutil.c
index 84598025a6ad..e65593742e2b 100644
--- a/ipc/msgutil.c
+++ b/ipc/msgutil.c
@@ -18,6 +18,7 @@
#include <linux/utsname.h>
#include <linux/proc_ns.h>
#include <linux/uaccess.h>
+#include <linux/sched.h>

#include "util.h"

@@ -64,6 +65,9 @@ static struct msg_msg *alloc_msg(size_t len)
pseg = &msg->next;
while (len > 0) {
struct msg_msgseg *seg;
+
+ cond_resched();
+
alen = min(len, DATALEN_SEG);
seg = kmalloc(sizeof(*seg) + alen, GFP_KERNEL_ACCOUNT);
if (seg == NULL)
@@ -176,6 +180,8 @@ void free_msg(struct msg_msg *msg)
kfree(msg);
while (seg != NULL) {
struct msg_msgseg *tmp = seg->next;
+
+ cond_resched();
kfree(seg);
seg = tmp;
}
--
2.20.1



2019-06-13 18:36:37

by Naresh Kamboju

[permalink] [raw]
Subject: Re: [PATCH 4.19 000/118] 4.19.51-stable review

On Thu, 13 Jun 2019 at 14:09, Greg Kroah-Hartman
<[email protected]> wrote:
>
> This is the start of the stable review cycle for the 4.19.51 release.
> There are 118 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat 15 Jun 2019 07:54:44 AM UTC.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.51-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

Results from Linaro’s test farm.
No regressions on arm64, arm, x86_64, and i386.

Summary
------------------------------------------------------------------------

kernel: 4.19.51-rc2
git repo: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git
git branch: linux-4.19.y
git commit: c6c7a311e997d044523cae077b58b1849cb8858f
git describe: v4.19.50-119-gc6c7a311e997
Test details: https://qa-reports.linaro.org/lkft/linux-stable-rc-4.19-oe/build/v4.19.50-119-gc6c7a311e997

No regressions (compared to build v4.19.49-53-g768292d05361)

No fixes (compared to build v4.19.49-53-g768292d05361)

Ran 24778 total tests in the following environments and test suites.

Environments
--------------
- dragonboard-410c - arm64
- hi6220-hikey - arm64
- i386
- juno-r2 - arm64
- qemu_arm
- qemu_arm64
- qemu_i386
- qemu_x86_64
- x15 - arm
- x86_64

Test Suites
-----------
* build
* install-android-platform-tools-r2600
* kselftest
* libgpiod
* libhugetlbfs
* ltp-cap_bounds-tests
* ltp-commands-tests
* ltp-containers-tests
* ltp-cpuhotplug-tests
* ltp-cve-tests
* ltp-dio-tests
* ltp-fcntl-locktests-tests
* ltp-filecaps-tests
* ltp-fs-tests
* ltp-fs_bind-tests
* ltp-fs_perms_simple-tests
* ltp-fsx-tests
* ltp-hugetlb-tests
* ltp-io-tests
* ltp-ipc-tests
* ltp-math-tests
* ltp-mm-tests
* ltp-nptl-tests
* ltp-pty-tests
* ltp-sched-tests
* ltp-securebits-tests
* ltp-syscalls-tests
* ltp-timers-tests
* perf
* spectre-meltdown-checker-test
* v4l2-compliance
* network-basic-tests
* ltp-open-posix-tests
* kvm-unit-tests
* kselftest-vsyscall-mode-native
* kselftest-vsyscall-mode-none

--
Linaro LKFT
https://lkft.linaro.org

2019-06-13 20:03:03

by Guenter Roeck

[permalink] [raw]
Subject: Re: [PATCH 4.19 000/118] 4.19.51-stable review

On 6/13/19 1:32 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.19.51 release.
> There are 118 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat 15 Jun 2019 07:54:44 AM UTC.
> Anything received after that time might be too late.
>

Build results:
total: 156 pass: 156 fail: 0
Qemu test results:
total: 354 pass: 354 fail: 0

Guenter

2019-06-14 02:39:34

by Shuah Khan

[permalink] [raw]
Subject: Re: [PATCH 4.19 000/118] 4.19.51-stable review

On 6/13/19 2:32 AM, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.19.51 release.
> There are 118 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat 15 Jun 2019 07:54:44 AM UTC.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.51-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h
>

Compiled and booted on my test system. No dmesg regressions.

thanks,
-- Shuah

2019-06-14 10:31:15

by Jon Hunter

[permalink] [raw]
Subject: Re: [PATCH 4.19 000/118] 4.19.51-stable review


On 13/06/2019 09:32, Greg Kroah-Hartman wrote:
> This is the start of the stable review cycle for the 4.19.51 release.
> There are 118 patches in this series, all will be posted as a response
> to this one. If anyone has any issues with these being applied, please
> let me know.
>
> Responses should be made by Sat 15 Jun 2019 07:54:44 AM UTC.
> Anything received after that time might be too late.
>
> The whole patch series can be found in one patch at:
> https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.19.51-rc1.gz
> or in the git tree and branch at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.19.y
> and the diffstat can be found below.
>
> thanks,
>
> greg k-h

All tests are passing for Tegra ...

Test results for stable-v4.19:
12 builds: 12 pass, 0 fail
22 boots: 22 pass, 0 fail
32 tests: 32 pass, 0 fail

Linux version: 4.19.51-rc2-gc6c7a311e997
Boards tested: tegra124-jetson-tk1, tegra186-p2771-0000,
tegra194-p2972-0000, tegra20-ventana,
tegra210-p2371-2180, tegra30-cardhu-a04

Cheers
Jon

--
nvpublic