Linux 3.3.1
This commit is contained in:
parent
d15571e206
commit
b6cb947f14
@ -1,48 +0,0 @@
|
||||
Commit 4949be16822e92a18ea0cc1616319926628092ee changed the behaviour of
|
||||
pcie_aspm_sanity_check() to always return 0 if aspm is disabled, in order
|
||||
to avoid cases where we changed ASPM state on pre-PCIe 1.1 devices. This
|
||||
skipped the secondary function of pcie_aspm_sanity_check which was to avoid
|
||||
us enabling ASPM on devices that had non-PCIe children, causing us to hit
|
||||
a BUG_ON later on. Move the aspm_disabled check so we continue to honour
|
||||
that scenario.
|
||||
|
||||
Signed-off-by: Matthew Garrett <mjg@redhat.com>
|
||||
Cc: stable@vger.kernel.org
|
||||
---
|
||||
drivers/pci/pcie/aspm.c | 13 ++++++++++---
|
||||
1 files changed, 10 insertions(+), 3 deletions(-)
|
||||
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
|
||||
index 86111d9..41e367b 100644
|
||||
--- a/drivers/pci/pcie/aspm.c
|
||||
+++ b/drivers/pci/pcie/aspm.c
|
||||
@@ -521,9 +521,6 @@ static int pcie_aspm_sanity_check(struct pci_dev *pdev)
|
||||
int pos;
|
||||
u32 reg32;
|
||||
|
||||
- if (aspm_disabled)
|
||||
- return 0;
|
||||
-
|
||||
/*
|
||||
* Some functions in a slot might not all be PCIe functions,
|
||||
* very strange. Disable ASPM for the whole slot
|
||||
@@ -532,6 +529,16 @@ static int pcie_aspm_sanity_check(struct pci_dev *pdev)
|
||||
pos = pci_pcie_cap(child);
|
||||
if (!pos)
|
||||
return -EINVAL;
|
||||
+
|
||||
+ /*
|
||||
+ * If ASPM is disabled then we're not going to change
|
||||
+ * the BIOS state. It's safe to continue even if it's a
|
||||
+ * pre-1.1 device
|
||||
+ */
|
||||
+
|
||||
+ if (aspm_disabled)
|
||||
+ continue;
|
||||
+
|
||||
/*
|
||||
* Disable ASPM for pre-1.1 PCIe device, we follow MS to use
|
||||
* RBER bit to determine if a function is 1.1 version device
|
||||
--
|
||||
1.7.7.6
|
||||
|
||||
|
@ -1,92 +0,0 @@
|
||||
From 3fa016a0b5c5237e9c387fc3249592b2cb5391c6 Mon Sep 17 00:00:00 2001
|
||||
From: Dave Airlie <airlied@redhat.com>
|
||||
Date: Wed, 28 Mar 2012 10:48:49 +0100
|
||||
Subject: [PATCH] drm/i915: suspend fbdev device around suspend/hibernate
|
||||
|
||||
Looking at hibernate overwriting I though it looked like a cursor,
|
||||
so I tracked down this missing piece to stop the cursor blink
|
||||
timer. I've no idea if this is sufficient to fix the hibernate
|
||||
problems people are seeing, but please test it.
|
||||
|
||||
Both radeon and nouveau have done this for a long time.
|
||||
|
||||
I've run this personally all night hib/resume cycles with no fails.
|
||||
|
||||
Reviewed-by: Keith Packard <keithp@keithp.com>
|
||||
Reported-by: Petr Tesarik <kernel@tesarici.cz>
|
||||
Reported-by: Stanislaw Gruszka <sgruszka@redhat.com>
|
||||
Reported-by: Lots of misc segfaults after hibernate across the world.
|
||||
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=37142
|
||||
Tested-by: Dave Airlie <airlied@redhat.com>
|
||||
Tested-by: Bojan Smojver <bojan@rexursive.com>
|
||||
Tested-by: Andreas Hartmann <andihartmann@01019freenet.de>
|
||||
Cc: stable@vger.kernel.org
|
||||
Signed-off-by: Dave Airlie <airlied@redhat.com>
|
||||
---
|
||||
drivers/gpu/drm/i915/i915_drv.c | 7 +++++++
|
||||
drivers/gpu/drm/i915/intel_drv.h | 2 +-
|
||||
drivers/gpu/drm/i915/intel_fb.c | 10 ++++++++++
|
||||
3 files changed, 18 insertions(+), 1 deletions(-)
|
||||
|
||||
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
|
||||
index 0694e17..1a7559b 100644
|
||||
--- a/drivers/gpu/drm/i915/i915_drv.c
|
||||
+++ b/drivers/gpu/drm/i915/i915_drv.c
|
||||
@@ -467,6 +467,10 @@ static int i915_drm_freeze(struct drm_device *dev)
|
||||
/* Modeset on resume, not lid events */
|
||||
dev_priv->modeset_on_lid = 0;
|
||||
|
||||
+ console_lock();
|
||||
+ intel_fbdev_set_suspend(dev, 1);
|
||||
+ console_unlock();
|
||||
+
|
||||
return 0;
|
||||
}
|
||||
|
||||
@@ -539,6 +543,9 @@ static int i915_drm_thaw(struct drm_device *dev)
|
||||
|
||||
dev_priv->modeset_on_lid = 0;
|
||||
|
||||
+ console_lock();
|
||||
+ intel_fbdev_set_suspend(dev, 0);
|
||||
+ console_unlock();
|
||||
return error;
|
||||
}
|
||||
|
||||
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
|
||||
index 9cec6c3..5a14149 100644
|
||||
--- a/drivers/gpu/drm/i915/intel_drv.h
|
||||
+++ b/drivers/gpu/drm/i915/intel_drv.h
|
||||
@@ -382,7 +382,7 @@ extern int intel_framebuffer_init(struct drm_device *dev,
|
||||
struct drm_i915_gem_object *obj);
|
||||
extern int intel_fbdev_init(struct drm_device *dev);
|
||||
extern void intel_fbdev_fini(struct drm_device *dev);
|
||||
-
|
||||
+extern void intel_fbdev_set_suspend(struct drm_device *dev, int state);
|
||||
extern void intel_prepare_page_flip(struct drm_device *dev, int plane);
|
||||
extern void intel_finish_page_flip(struct drm_device *dev, int pipe);
|
||||
extern void intel_finish_page_flip_plane(struct drm_device *dev, int plane);
|
||||
diff --git a/drivers/gpu/drm/i915/intel_fb.c b/drivers/gpu/drm/i915/intel_fb.c
|
||||
index 2d87669..19ecd78 100644
|
||||
--- a/drivers/gpu/drm/i915/intel_fb.c
|
||||
+++ b/drivers/gpu/drm/i915/intel_fb.c
|
||||
@@ -254,6 +254,16 @@ void intel_fbdev_fini(struct drm_device *dev)
|
||||
kfree(dev_priv->fbdev);
|
||||
dev_priv->fbdev = NULL;
|
||||
}
|
||||
+
|
||||
+void intel_fbdev_set_suspend(struct drm_device *dev, int state)
|
||||
+{
|
||||
+ drm_i915_private_t *dev_priv = dev->dev_private;
|
||||
+ if (!dev_priv->fbdev)
|
||||
+ return;
|
||||
+
|
||||
+ fb_set_suspend(dev_priv->fbdev->helper.fbdev, state);
|
||||
+}
|
||||
+
|
||||
MODULE_LICENSE("GPL and additional rights");
|
||||
|
||||
void intel_fb_output_poll_changed(struct drm_device *dev)
|
||||
--
|
||||
1.7.7.6
|
||||
|
@ -1,91 +0,0 @@
|
||||
Path: news.gmane.org!not-for-mail
|
||||
From: Eric Sandeen <sandeen@redhat.com>
|
||||
Newsgroups: gmane.comp.file-systems.ext4
|
||||
Subject: [PATCH] jbd2: clear BH_Delay & BH_Unwritten in journal_unmap_buffer
|
||||
Date: Tue, 07 Feb 2012 16:07:20 -0600
|
||||
Lines: 42
|
||||
Approved: news@gmane.org
|
||||
Message-ID: <4F31A098.4050601@redhat.com>
|
||||
NNTP-Posting-Host: plane.gmane.org
|
||||
Mime-Version: 1.0
|
||||
Content-Type: text/plain; charset=ISO-8859-1
|
||||
Content-Transfer-Encoding: 7bit
|
||||
X-Trace: dough.gmane.org 1328656072 12026 80.91.229.3 (7 Feb 2012 23:07:52 GMT)
|
||||
X-Complaints-To: usenet@dough.gmane.org
|
||||
NNTP-Posting-Date: Tue, 7 Feb 2012 23:07:52 +0000 (UTC)
|
||||
To: ext4 development <linux-ext4@vger.kernel.org>
|
||||
Original-X-From: linux-ext4-owner@vger.kernel.org Wed Feb 08 00:07:52 2012
|
||||
Return-path: <linux-ext4-owner@vger.kernel.org>
|
||||
Envelope-to: gcfe-linux-ext4@plane.gmane.org
|
||||
Original-Received: from vger.kernel.org ([209.132.180.67])
|
||||
by plane.gmane.org with esmtp (Exim 4.69)
|
||||
(envelope-from <linux-ext4-owner@vger.kernel.org>)
|
||||
id 1Ruu8d-0000lK-5P
|
||||
for gcfe-linux-ext4@plane.gmane.org; Wed, 08 Feb 2012 00:07:51 +0100
|
||||
Original-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
|
||||
id S1756187Ab2BGXHt (ORCPT <rfc822;gcfe-linux-ext4@m.gmane.org>);
|
||||
Tue, 7 Feb 2012 18:07:49 -0500
|
||||
Original-Received: from mx1.redhat.com ([209.132.183.28]:19432 "EHLO mx1.redhat.com"
|
||||
rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
|
||||
id S1753992Ab2BGXHs (ORCPT <rfc822;linux-ext4@vger.kernel.org>);
|
||||
Tue, 7 Feb 2012 18:07:48 -0500
|
||||
Original-Received: from int-mx01.intmail.prod.int.phx2.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11])
|
||||
by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id q17N7dj0027622
|
||||
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK)
|
||||
for <linux-ext4@vger.kernel.org>; Tue, 7 Feb 2012 18:07:48 -0500
|
||||
Original-Received: from liberator.sandeen.net (ovpn01.gateway.prod.ext.phx2.redhat.com [10.5.9.1])
|
||||
by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id q17M7Kgt001990
|
||||
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO)
|
||||
for <linux-ext4@vger.kernel.org>; Tue, 7 Feb 2012 17:07:21 -0500
|
||||
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:10.0) Gecko/20120129 Thunderbird/10.0
|
||||
X-Enigmail-Version: 1.3.5
|
||||
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.11
|
||||
Original-Sender: linux-ext4-owner@vger.kernel.org
|
||||
Precedence: bulk
|
||||
List-ID: <linux-ext4.vger.kernel.org>
|
||||
X-Mailing-List: linux-ext4@vger.kernel.org
|
||||
Xref: news.gmane.org gmane.comp.file-systems.ext4:30623
|
||||
Archived-At: <http://permalink.gmane.org/gmane.comp.file-systems.ext4/30623>
|
||||
|
||||
journal_unmap_buffer()'s zap_buffer: code clears a lot of buffer head
|
||||
state ala discard_buffer(), but does not touch _Delay or _Unwritten
|
||||
as discard_buffer() does.
|
||||
|
||||
This can be problematic in some areas of the ext4 code which assume
|
||||
that if they have found a buffer marked unwritten or delay, then it's
|
||||
a live one. Perhaps those spots should check whether it is mapped
|
||||
as well, but if jbd2 is going to tear down a buffer, let's really
|
||||
tear it down completely.
|
||||
|
||||
Without this I get some fsx failures on sub-page-block filesystems
|
||||
up until v3.2, at which point 4e96b2dbbf1d7e81f22047a50f862555a6cb87cb
|
||||
and 189e868fa8fdca702eb9db9d8afc46b5cb9144c9 make the failures go
|
||||
away, because buried within that large change is some more flag
|
||||
clearing. I still think it's worth doing in jbd2, since
|
||||
->invalidatepage leads here directly, and it's the right place
|
||||
to clear away these flags.
|
||||
|
||||
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
|
||||
Cc: stable@vger.kernel.org
|
||||
---
|
||||
|
||||
diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c
|
||||
index 35ae096..52653306 100644
|
||||
--- a/fs/jbd2/transaction.c
|
||||
+++ b/fs/jbd2/transaction.c
|
||||
@@ -1949,6 +1949,8 @@ zap_buffer_unlocked:
|
||||
clear_buffer_mapped(bh);
|
||||
clear_buffer_req(bh);
|
||||
clear_buffer_new(bh);
|
||||
+ clear_buffer_delay(bh);
|
||||
+ clear_buffer_unwritten(bh);
|
||||
bh->b_bdev = NULL;
|
||||
return may_free;
|
||||
}
|
||||
|
||||
|
||||
--
|
||||
To unsubscribe from this list: send the line "unsubscribe linux-ext4" in
|
||||
the body of a message to majordomo@vger.kernel.org
|
||||
More majordomo info at http://vger.kernel.org/majordomo-info.html
|
||||
|
32
kernel.spec
32
kernel.spec
@ -54,7 +54,7 @@ Summary: The Linux kernel
|
||||
# For non-released -rc kernels, this will be appended after the rcX and
|
||||
# gitX tags, so a 3 here would become part of release "0.rcX.gitX.3"
|
||||
#
|
||||
%global baserelease 9
|
||||
%global baserelease 1
|
||||
%global fedora_build %{baserelease}
|
||||
|
||||
# base_sublevel is the kernel version we're starting with and patching
|
||||
@ -66,7 +66,7 @@ Summary: The Linux kernel
|
||||
%if 0%{?released_kernel}
|
||||
|
||||
# Do we have a -stable update to apply?
|
||||
%define stable_update 0
|
||||
%define stable_update 1
|
||||
# Is it a -stable RC?
|
||||
%define stable_rc 0
|
||||
# Set rpm version accordingly
|
||||
@ -700,7 +700,6 @@ Patch1825: drm-i915-dp-stfu.patch
|
||||
|
||||
# hush the i915 fbc noise
|
||||
Patch1826: drm-i915-fbc-stfu.patch
|
||||
Patch1827: drm-i915-suspend-fbdev-device-around-suspend-hiberna.patch
|
||||
|
||||
Patch1900: linux-2.6-intel-iommu-igfx.patch
|
||||
|
||||
@ -755,9 +754,6 @@ Patch21226: pci-crs-blacklist.patch
|
||||
#rhbz 772772
|
||||
Patch21232: rt2x00_fix_MCU_request_failures.patch
|
||||
|
||||
#rhbz 788260
|
||||
Patch21233: jbd2-clear-BH_Delay-and-BH_Unwritten-in-journal_unmap_buf.patch
|
||||
|
||||
#rhbz 754518
|
||||
#Patch21235: scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch
|
||||
|
||||
@ -770,9 +766,6 @@ Patch21240: ACPICA-Fix-regression-in-FADT-revision-checks.patch
|
||||
#rhbz 728478
|
||||
Patch21242: sony-laptop-Enable-keyboard-backlight-by-default.patch
|
||||
|
||||
#rhbz 803809 CVE-2012-1179
|
||||
Patch21244: mm-thp-fix-pmd_bad-triggering.patch
|
||||
|
||||
Patch21300: unhandled-irqs-switch-to-polling.patch
|
||||
|
||||
#rhbz 804007
|
||||
@ -781,8 +774,6 @@ Patch21305: mac80211-fix-possible-tid_rx-reorder_timer-use-after-free.patch
|
||||
#rhbz 804957 CVE-2012-1568
|
||||
Patch21306: shlib_base_randomize.patch
|
||||
|
||||
Patch21350: x86-ioapic-add-register-checks-for-bogus-io-apic-entries.patch
|
||||
|
||||
#rhbz 804347
|
||||
Patch21351: x86-add-io_apic_ops-to-allow-interception.patch
|
||||
Patch21352: x86-apic_ops-Replace-apic_ops-with-x86_apic_ops.patch
|
||||
@ -792,7 +783,6 @@ Patch21353: xen-x86-Implement-x86_apic_ops.patch
|
||||
Patch21370: iwlegacy-do-not-nulify-il-vif-on-reset.patch
|
||||
Patch21371: iwlwifi-do-not-nulify-ctx-vif-on-reset.patch
|
||||
|
||||
Patch21500: ASPM-Fix-pcie-devs-with-non-pcie-children.patch
|
||||
Patch21501: nfs-Fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch
|
||||
|
||||
#rhbz 808207 CVE-2012-1601
|
||||
@ -1404,8 +1394,6 @@ ApplyPatch drm-i915-fbc-stfu.patch
|
||||
|
||||
ApplyPatch linux-2.6-intel-iommu-igfx.patch
|
||||
|
||||
ApplyPatch drm-i915-suspend-fbdev-device-around-suspend-hiberna.patch
|
||||
|
||||
# silence the ACPI blacklist code
|
||||
ApplyPatch linux-2.6-silence-acpi-blacklist.patch
|
||||
ApplyPatch quite-apm.patch
|
||||
@ -1425,7 +1413,8 @@ ApplyPatch dmar-disable-when-ricoh-multifunction.patch
|
||||
|
||||
ApplyPatch efi-dont-map-boot-services-on-32bit.patch
|
||||
|
||||
ApplyPatch hibernate-freeze-filesystems.patch
|
||||
# FIXME
|
||||
#ApplyPatch hibernate-freeze-filesystems.patch
|
||||
|
||||
ApplyPatch lis3-improve-handling-of-null-rate.patch
|
||||
|
||||
@ -1443,9 +1432,6 @@ ApplyPatch ext4-Support-check-none-nocheck-mount-options.patch
|
||||
#rhbz 772772
|
||||
ApplyPatch rt2x00_fix_MCU_request_failures.patch
|
||||
|
||||
#rhbz 788269
|
||||
ApplyPatch jbd2-clear-BH_Delay-and-BH_Unwritten-in-journal_unmap_buf.patch
|
||||
|
||||
#rhbz 754518
|
||||
#ApplyPatch scsi-sd_revalidate_disk-prevent-NULL-ptr-deref.patch
|
||||
|
||||
@ -1468,8 +1454,6 @@ ApplyPatch unhandled-irqs-switch-to-polling.patch
|
||||
|
||||
ApplyPatch weird-root-dentry-name-debug.patch
|
||||
|
||||
ApplyPatch x86-ioapic-add-register-checks-for-bogus-io-apic-entries.patch
|
||||
|
||||
#rhbz 804347
|
||||
ApplyPatch x86-add-io_apic_ops-to-allow-interception.patch
|
||||
ApplyPatch x86-apic_ops-Replace-apic_ops-with-x86_apic_ops.patch
|
||||
@ -1479,11 +1463,6 @@ ApplyPatch xen-x86-Implement-x86_apic_ops.patch
|
||||
ApplyPatch iwlegacy-do-not-nulify-il-vif-on-reset.patch
|
||||
ApplyPatch iwlwifi-do-not-nulify-ctx-vif-on-reset.patch
|
||||
|
||||
#rhbz 803809 CVE-2012-1179
|
||||
ApplyPatch mm-thp-fix-pmd_bad-triggering.patch
|
||||
|
||||
ApplyPatch ASPM-Fix-pcie-devs-with-non-pcie-children.patch
|
||||
|
||||
ApplyPatch nfs-Fix-length-of-buffer-copied-in-__nfs4_get_acl_uncached.patch
|
||||
|
||||
#rhbz 808207 CVE-2012-1601
|
||||
@ -2227,6 +2206,9 @@ fi
|
||||
# and build.
|
||||
|
||||
%changelog
|
||||
* Mon Apr 02 2012 Dave Jones <davej@redhat.com> 3.3.1-1
|
||||
- Linux 3.3.1
|
||||
|
||||
* Fri Mar 30 2012 Dave Jones <davej@redhat.com>
|
||||
- Silence the timekeeping "Adjusting tsc more then 11%" spew. (rhbz 798600)
|
||||
|
||||
|
@ -1,447 +0,0 @@
|
||||
In some cases it may happen that pmd_none_or_clear_bad() is called
|
||||
with the mmap_sem hold in read mode. In those cases the huge page
|
||||
faults can allocate hugepmds under pmd_none_or_clear_bad() and that
|
||||
can trigger a false positive from pmd_bad() that will not like to see
|
||||
a pmd materializing as trans huge.
|
||||
|
||||
It's not khugepaged the problem, khugepaged holds the mmap_sem in
|
||||
write mode (and all those sites must hold the mmap_sem in read mode to
|
||||
prevent pagetables to go away from under them, during code review it
|
||||
seems vm86 mode on 32bit kernels requires that too unless it's
|
||||
restricted to 1 thread per process or UP builds). The race is only
|
||||
with the huge pagefaults that can convert a pmd_none() into a
|
||||
pmd_trans_huge().
|
||||
|
||||
Effectively all these pmd_none_or_clear_bad() sites running with
|
||||
mmap_sem in read mode are somewhat speculative with the page faults,
|
||||
and the result is always undefined when they run simultaneously. This
|
||||
is probably why it wasn't common to run into this. For example if the
|
||||
madvise(MADV_DONTNEED) runs zap_page_range() shortly before the page
|
||||
fault, the hugepage will not be zapped, if the page fault runs first
|
||||
it will be zapped.
|
||||
|
||||
Altering pmd_bad() not to error out if it finds hugepmds won't be
|
||||
enough to fix this, because zap_pmd_range would then proceed to call
|
||||
zap_pte_range (which would be incorrect if the pmd become a
|
||||
pmd_trans_huge()).
|
||||
|
||||
The simplest way to fix this is to read the pmd in the local stack
|
||||
(regardless of what we read, no need of actual CPU barriers, only
|
||||
compiler barrier needed), and be sure it is not changing under the
|
||||
code that computes its value. Even if the real pmd is changing under
|
||||
the value we hold on the stack, we don't care. If we actually end up
|
||||
in zap_pte_range it means the pmd was not none already and it was not
|
||||
huge, and it can't become huge from under us (khugepaged locking
|
||||
explained above).
|
||||
|
||||
All we need is to enforce that there is no way anymore that in a code
|
||||
path like below, pmd_trans_huge can be false, but
|
||||
pmd_none_or_clear_bad can run into a hugepmd. The overhead of a
|
||||
barrier() is just a compiler tweak and should not be measurable (I
|
||||
only added it for THP builds). I don't exclude different compiler
|
||||
versions may have prevented the race too by caching the value of *pmd
|
||||
on the stack (that hasn't been verified, but it wouldn't be impossible
|
||||
considering pmd_none_or_clear_bad, pmd_bad, pmd_trans_huge, pmd_none
|
||||
are all inlines and there's no external function called in between
|
||||
pmd_trans_huge and pmd_none_or_clear_bad).
|
||||
|
||||
if (pmd_trans_huge(*pmd)) {
|
||||
if (next-addr != HPAGE_PMD_SIZE) {
|
||||
VM_BUG_ON(!rwsem_is_locked(&tlb->mm->mmap_sem));
|
||||
split_huge_page_pmd(vma->vm_mm, pmd);
|
||||
} else if (zap_huge_pmd(tlb, vma, pmd, addr))
|
||||
continue;
|
||||
/* fall through */
|
||||
}
|
||||
if (pmd_none_or_clear_bad(pmd))
|
||||
|
||||
Because this race condition could be exercised without special
|
||||
privileges this was reported in CVE-2012-1179.
|
||||
|
||||
The race was identified and fully explained by Ulrich who debugged it.
|
||||
I'm quoting his accurate explanation below, for reference.
|
||||
|
||||
====== start quote =======
|
||||
mapcount 0 page_mapcount 1
|
||||
kernel BUG at mm/huge_memory.c:1384!
|
||||
|
||||
At some point prior to the panic, a "bad pmd ..." message similar to the
|
||||
following is logged on the console:
|
||||
|
||||
mm/memory.c:145: bad pmd ffff8800376e1f98(80000000314000e7).
|
||||
|
||||
The "bad pmd ..." message is logged by pmd_clear_bad() before it clears
|
||||
the page's PMD table entry.
|
||||
|
||||
143 void pmd_clear_bad(pmd_t *pmd)
|
||||
144 {
|
||||
-> 145 pmd_ERROR(*pmd);
|
||||
146 pmd_clear(pmd);
|
||||
147 }
|
||||
|
||||
After the PMD table entry has been cleared, there is an inconsistency
|
||||
between the actual number of PMD table entries that are mapping the page
|
||||
and the page's map count (_mapcount field in struct page). When the page
|
||||
is subsequently reclaimed, __split_huge_page() detects this inconsistency.
|
||||
|
||||
1381 if (mapcount != page_mapcount(page))
|
||||
1382 printk(KERN_ERR "mapcount %d page_mapcount %d\n",
|
||||
1383 mapcount, page_mapcount(page));
|
||||
-> 1384 BUG_ON(mapcount != page_mapcount(page));
|
||||
|
||||
The root cause of the problem is a race of two threads in a multithreaded
|
||||
process. Thread B incurs a page fault on a virtual address that has never
|
||||
been accessed (PMD entry is zero) while Thread A is executing an madvise()
|
||||
system call on a virtual address within the same 2 MB (huge page) range.
|
||||
|
||||
virtual address space
|
||||
.---------------------.
|
||||
| |
|
||||
| |
|
||||
.-|---------------------|
|
||||
| | |
|
||||
| | |<-- B(fault)
|
||||
| | |
|
||||
2 MB | |/////////////////////|-.
|
||||
huge < |/////////////////////| > A(range)
|
||||
page | |/////////////////////|-'
|
||||
| | |
|
||||
| | |
|
||||
'-|---------------------|
|
||||
| |
|
||||
| |
|
||||
'---------------------'
|
||||
|
||||
- Thread A is executing an madvise(..., MADV_DONTNEED) system call
|
||||
on the virtual address range "A(range)" shown in the picture.
|
||||
|
||||
sys_madvise
|
||||
// Acquire the semaphore in shared mode.
|
||||
down_read(¤t->mm->mmap_sem)
|
||||
...
|
||||
madvise_vma
|
||||
switch (behavior)
|
||||
case MADV_DONTNEED:
|
||||
madvise_dontneed
|
||||
zap_page_range
|
||||
unmap_vmas
|
||||
unmap_page_range
|
||||
zap_pud_range
|
||||
zap_pmd_range
|
||||
//
|
||||
// Assume that this huge page has never been accessed.
|
||||
// I.e. content of the PMD entry is zero (not mapped).
|
||||
//
|
||||
if (pmd_trans_huge(*pmd)) {
|
||||
// We don't get here due to the above assumption.
|
||||
}
|
||||
//
|
||||
// Assume that Thread B incurred a page fault and
|
||||
.---------> // sneaks in here as shown below.
|
||||
| //
|
||||
| if (pmd_none_or_clear_bad(pmd))
|
||||
| {
|
||||
| if (unlikely(pmd_bad(*pmd)))
|
||||
| pmd_clear_bad
|
||||
| {
|
||||
| pmd_ERROR
|
||||
| // Log "bad pmd ..." message here.
|
||||
| pmd_clear
|
||||
| // Clear the page's PMD entry.
|
||||
| // Thread B incremented the map count
|
||||
| // in page_add_new_anon_rmap(), but
|
||||
| // now the page is no longer mapped
|
||||
| // by a PMD entry (-> inconsistency).
|
||||
| }
|
||||
| }
|
||||
|
|
||||
v
|
||||
- Thread B is handling a page fault on virtual address "B(fault)" shown
|
||||
in the picture.
|
||||
|
||||
...
|
||||
do_page_fault
|
||||
__do_page_fault
|
||||
// Acquire the semaphore in shared mode.
|
||||
down_read_trylock(&mm->mmap_sem)
|
||||
...
|
||||
handle_mm_fault
|
||||
if (pmd_none(*pmd) && transparent_hugepage_enabled(vma))
|
||||
// We get here due to the above assumption (PMD entry is zero).
|
||||
do_huge_pmd_anonymous_page
|
||||
alloc_hugepage_vma
|
||||
// Allocate a new transparent huge page here.
|
||||
...
|
||||
__do_huge_pmd_anonymous_page
|
||||
...
|
||||
spin_lock(&mm->page_table_lock)
|
||||
...
|
||||
page_add_new_anon_rmap
|
||||
// Here we increment the page's map count (starts at -1).
|
||||
atomic_set(&page->_mapcount, 0)
|
||||
set_pmd_at
|
||||
// Here we set the page's PMD entry which will be cleared
|
||||
// when Thread A calls pmd_clear_bad().
|
||||
...
|
||||
spin_unlock(&mm->page_table_lock)
|
||||
|
||||
The mmap_sem does not prevent the race because both threads are acquiring
|
||||
it in shared mode (down_read). Thread B holds the page_table_lock while
|
||||
the page's map count and PMD table entry are updated. However, Thread A
|
||||
does not synchronize on that lock.
|
||||
====== end quote =======
|
||||
|
||||
Reported-by: Ulrich Obergfell <uobergfe@redhat.com>
|
||||
Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
|
||||
---
|
||||
arch/x86/kernel/vm86_32.c | 2 +
|
||||
fs/proc/task_mmu.c | 9 ++++++
|
||||
include/asm-generic/pgtable.h | 57 +++++++++++++++++++++++++++++++++++++++++
|
||||
mm/memcontrol.c | 4 +++
|
||||
mm/memory.c | 14 ++++++++--
|
||||
mm/mempolicy.c | 2 +-
|
||||
mm/mincore.c | 2 +-
|
||||
mm/pagewalk.c | 2 +-
|
||||
mm/swapfile.c | 4 +--
|
||||
9 files changed, 87 insertions(+), 9 deletions(-)
|
||||
|
||||
diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
|
||||
index b466cab..328cb37 100644
|
||||
--- a/arch/x86/kernel/vm86_32.c
|
||||
+++ b/arch/x86/kernel/vm86_32.c
|
||||
@@ -172,6 +172,7 @@ static void mark_screen_rdonly(struct mm_struct *mm)
|
||||
spinlock_t *ptl;
|
||||
int i;
|
||||
|
||||
+ down_write(&mm->mmap_sem);
|
||||
pgd = pgd_offset(mm, 0xA0000);
|
||||
if (pgd_none_or_clear_bad(pgd))
|
||||
goto out;
|
||||
@@ -190,6 +191,7 @@ static void mark_screen_rdonly(struct mm_struct *mm)
|
||||
}
|
||||
pte_unmap_unlock(pte, ptl);
|
||||
out:
|
||||
+ up_write(&mm->mmap_sem);
|
||||
flush_tlb();
|
||||
}
|
||||
|
||||
diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
|
||||
index 7dcd2a2..3efa725 100644
|
||||
--- a/fs/proc/task_mmu.c
|
||||
+++ b/fs/proc/task_mmu.c
|
||||
@@ -409,6 +409,9 @@ static int smaps_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
|
||||
} else {
|
||||
spin_unlock(&walk->mm->page_table_lock);
|
||||
}
|
||||
+
|
||||
+ if (pmd_trans_unstable(pmd))
|
||||
+ return 0;
|
||||
/*
|
||||
* The mmap_sem held all the way back in m_start() is what
|
||||
* keeps khugepaged out of here and from collapsing things
|
||||
@@ -507,6 +510,8 @@ static int clear_refs_pte_range(pmd_t *pmd, unsigned long addr,
|
||||
struct page *page;
|
||||
|
||||
split_huge_page_pmd(walk->mm, pmd);
|
||||
+ if (pmd_trans_unstable(pmd))
|
||||
+ return 0;
|
||||
|
||||
pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
|
||||
for (; addr != end; pte++, addr += PAGE_SIZE) {
|
||||
@@ -670,6 +675,8 @@ static int pagemap_pte_range(pmd_t *pmd, unsigned long addr, unsigned long end,
|
||||
int err = 0;
|
||||
|
||||
split_huge_page_pmd(walk->mm, pmd);
|
||||
+ if (pmd_trans_unstable(pmd))
|
||||
+ return 0;
|
||||
|
||||
/* find the first VMA at or above 'addr' */
|
||||
vma = find_vma(walk->mm, addr);
|
||||
@@ -961,6 +968,8 @@ static int gather_pte_stats(pmd_t *pmd, unsigned long addr,
|
||||
spin_unlock(&walk->mm->page_table_lock);
|
||||
}
|
||||
|
||||
+ if (pmd_trans_unstable(pmd))
|
||||
+ return 0;
|
||||
orig_pte = pte = pte_offset_map_lock(walk->mm, pmd, addr, &ptl);
|
||||
do {
|
||||
struct page *page = can_gather_numa_stats(*pte, md->vma, addr);
|
||||
diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
|
||||
index 76bff2b..10f8291 100644
|
||||
--- a/include/asm-generic/pgtable.h
|
||||
+++ b/include/asm-generic/pgtable.h
|
||||
@@ -443,6 +443,63 @@ static inline int pmd_write(pmd_t pmd)
|
||||
#endif /* __HAVE_ARCH_PMD_WRITE */
|
||||
#endif
|
||||
|
||||
+/*
|
||||
+ * This function is meant to be used by sites walking pagetables with
|
||||
+ * the mmap_sem hold in read mode to protect against MADV_DONTNEED and
|
||||
+ * transhuge page faults. MADV_DONTNEED can convert a transhuge pmd
|
||||
+ * into a null pmd and the transhuge page fault can convert a null pmd
|
||||
+ * into an hugepmd or into a regular pmd (if the hugepage allocation
|
||||
+ * fails). While holding the mmap_sem in read mode the pmd becomes
|
||||
+ * stable and stops changing under us only if it's not null and not a
|
||||
+ * transhuge pmd. When those races occurs and this function makes a
|
||||
+ * difference vs the standard pmd_none_or_clear_bad, the result is
|
||||
+ * undefined so behaving like if the pmd was none is safe (because it
|
||||
+ * can return none anyway). The compiler level barrier() is critically
|
||||
+ * important to compute the two checks atomically on the same pmdval.
|
||||
+ */
|
||||
+static inline int pmd_none_or_trans_huge_or_clear_bad(pmd_t *pmd)
|
||||
+{
|
||||
+ /* depend on compiler for an atomic pmd read */
|
||||
+ pmd_t pmdval = *pmd;
|
||||
+ /*
|
||||
+ * The barrier will stabilize the pmdval in a register or on
|
||||
+ * the stack so that it will stop changing under the code.
|
||||
+ */
|
||||
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
|
||||
+ barrier();
|
||||
+#endif
|
||||
+ if (pmd_none(pmdval))
|
||||
+ return 1;
|
||||
+ if (unlikely(pmd_bad(pmdval))) {
|
||||
+ if (!pmd_trans_huge(pmdval))
|
||||
+ pmd_clear_bad(pmd);
|
||||
+ return 1;
|
||||
+ }
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
+/*
|
||||
+ * This is a noop if Transparent Hugepage Support is not built into
|
||||
+ * the kernel. Otherwise it is equivalent to
|
||||
+ * pmd_none_or_trans_huge_or_clear_bad(), and shall only be called in
|
||||
+ * places that already verified the pmd is not none and they want to
|
||||
+ * walk ptes while holding the mmap sem in read mode (write mode don't
|
||||
+ * need this). If THP is not enabled, the pmd can't go away under the
|
||||
+ * code even if MADV_DONTNEED runs, but if THP is enabled we need to
|
||||
+ * run a pmd_trans_unstable before walking the ptes after
|
||||
+ * split_huge_page_pmd returns (because it may have run when the pmd
|
||||
+ * become null, but then a page fault can map in a THP and not a
|
||||
+ * regular page).
|
||||
+ */
|
||||
+static inline int pmd_trans_unstable(pmd_t *pmd)
|
||||
+{
|
||||
+#ifdef CONFIG_TRANSPARENT_HUGEPAGE
|
||||
+ return pmd_none_or_trans_huge_or_clear_bad(pmd);
|
||||
+#else
|
||||
+ return 0;
|
||||
+#endif
|
||||
+}
|
||||
+
|
||||
#endif /* !__ASSEMBLY__ */
|
||||
|
||||
#endif /* _ASM_GENERIC_PGTABLE_H */
|
||||
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
|
||||
index d0e57a3..67b0578 100644
|
||||
--- a/mm/memcontrol.c
|
||||
+++ b/mm/memcontrol.c
|
||||
@@ -5193,6 +5193,8 @@ static int mem_cgroup_count_precharge_pte_range(pmd_t *pmd,
|
||||
spinlock_t *ptl;
|
||||
|
||||
split_huge_page_pmd(walk->mm, pmd);
|
||||
+ if (pmd_trans_unstable(pmd))
|
||||
+ return 0;
|
||||
|
||||
pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
|
||||
for (; addr != end; pte++, addr += PAGE_SIZE)
|
||||
@@ -5355,6 +5357,8 @@ static int mem_cgroup_move_charge_pte_range(pmd_t *pmd,
|
||||
spinlock_t *ptl;
|
||||
|
||||
split_huge_page_pmd(walk->mm, pmd);
|
||||
+ if (pmd_trans_unstable(pmd))
|
||||
+ return 0;
|
||||
retry:
|
||||
pte = pte_offset_map_lock(vma->vm_mm, pmd, addr, &ptl);
|
||||
for (; addr != end; addr += PAGE_SIZE) {
|
||||
diff --git a/mm/memory.c b/mm/memory.c
|
||||
index fa2f04e..e3090fc 100644
|
||||
--- a/mm/memory.c
|
||||
+++ b/mm/memory.c
|
||||
@@ -1251,12 +1251,20 @@ static inline unsigned long zap_pmd_range(struct mmu_gather *tlb,
|
||||
VM_BUG_ON(!rwsem_is_locked(&tlb->mm->mmap_sem));
|
||||
split_huge_page_pmd(vma->vm_mm, pmd);
|
||||
} else if (zap_huge_pmd(tlb, vma, pmd, addr))
|
||||
- continue;
|
||||
+ goto next;
|
||||
/* fall through */
|
||||
}
|
||||
- if (pmd_none_or_clear_bad(pmd))
|
||||
- continue;
|
||||
+ /*
|
||||
+ * Here there can be other concurrent MADV_DONTNEED or
|
||||
+ * trans huge page faults running, and if the pmd is
|
||||
+ * none or trans huge it can change under us. This is
|
||||
+ * because MADV_DONTNEED holds the mmap_sem in read
|
||||
+ * mode.
|
||||
+ */
|
||||
+ if (pmd_none_or_trans_huge_or_clear_bad(pmd))
|
||||
+ goto next;
|
||||
next = zap_pte_range(tlb, vma, pmd, addr, next, details);
|
||||
+ next:
|
||||
cond_resched();
|
||||
} while (pmd++, addr = next, addr != end);
|
||||
|
||||
diff --git a/mm/mempolicy.c b/mm/mempolicy.c
|
||||
index 47296fe..0a37570 100644
|
||||
--- a/mm/mempolicy.c
|
||||
+++ b/mm/mempolicy.c
|
||||
@@ -512,7 +512,7 @@ static inline int check_pmd_range(struct vm_area_struct *vma, pud_t *pud,
|
||||
do {
|
||||
next = pmd_addr_end(addr, end);
|
||||
split_huge_page_pmd(vma->vm_mm, pmd);
|
||||
- if (pmd_none_or_clear_bad(pmd))
|
||||
+ if (pmd_none_or_trans_huge_or_clear_bad(pmd))
|
||||
continue;
|
||||
if (check_pte_range(vma, pmd, addr, next, nodes,
|
||||
flags, private))
|
||||
diff --git a/mm/mincore.c b/mm/mincore.c
|
||||
index 636a868..936b4ce 100644
|
||||
--- a/mm/mincore.c
|
||||
+++ b/mm/mincore.c
|
||||
@@ -164,7 +164,7 @@ static void mincore_pmd_range(struct vm_area_struct *vma, pud_t *pud,
|
||||
}
|
||||
/* fall through */
|
||||
}
|
||||
- if (pmd_none_or_clear_bad(pmd))
|
||||
+ if (pmd_none_or_trans_huge_or_clear_bad(pmd))
|
||||
mincore_unmapped_range(vma, addr, next, vec);
|
||||
else
|
||||
mincore_pte_range(vma, pmd, addr, next, vec);
|
||||
diff --git a/mm/pagewalk.c b/mm/pagewalk.c
|
||||
index 2f5cf10..aa9701e 100644
|
||||
--- a/mm/pagewalk.c
|
||||
+++ b/mm/pagewalk.c
|
||||
@@ -59,7 +59,7 @@ again:
|
||||
continue;
|
||||
|
||||
split_huge_page_pmd(walk->mm, pmd);
|
||||
- if (pmd_none_or_clear_bad(pmd))
|
||||
+ if (pmd_none_or_trans_huge_or_clear_bad(pmd))
|
||||
goto again;
|
||||
err = walk_pte_range(pmd, addr, next, walk);
|
||||
if (err)
|
||||
diff --git a/mm/swapfile.c b/mm/swapfile.c
|
||||
index d999f09..f31b29d 100644
|
||||
--- a/mm/swapfile.c
|
||||
+++ b/mm/swapfile.c
|
||||
@@ -932,9 +932,7 @@ static inline int unuse_pmd_range(struct vm_area_struct *vma, pud_t *pud,
|
||||
pmd = pmd_offset(pud, addr);
|
||||
do {
|
||||
next = pmd_addr_end(addr, end);
|
||||
- if (unlikely(pmd_trans_huge(*pmd)))
|
||||
- continue;
|
||||
- if (pmd_none_or_clear_bad(pmd))
|
||||
+ if (pmd_none_or_trans_huge_or_clear_bad(pmd))
|
||||
continue;
|
||||
ret = unuse_pte_range(vma, pmd, addr, next, entry, page);
|
||||
if (ret)
|
||||
|
||||
--
|
||||
To unsubscribe, send a message with 'unsubscribe linux-mm' in
|
||||
the body to majordomo@kvack.org. For more info on Linux MM,
|
||||
see: http://www.linux-mm.org/ .
|
||||
Fight unfair telecom internet charges in Canada: sign http://stopthemeter.ca/
|
||||
Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
|
1
sources
1
sources
@ -1 +1,2 @@
|
||||
7133f5a2086a7d7ef97abac610c094f5 linux-3.3.tar.xz
|
||||
10771d657c5bf342bcfe66ed06653ecb patch-3.3.1.xz
|
||||
|
@ -1,93 +0,0 @@
|
||||
On Tue, 2012-01-31 at 09:26 -0500, Josh Boyer wrote:
|
||||
> On Wed, Jan 25, 2012 at 06:15:35PM -0500, Josh Boyer wrote:
|
||||
> > On Wed, Jan 25, 2012 at 02:04:08PM -0800, Suresh Siddha wrote:
|
||||
> > > On Wed, 2012-01-25 at 08:49 -0500, Josh Boyer wrote:
|
||||
> > > > [ 0.000000] IOAPIC[1]: apic_id 2, version 255, address 0xfec28000, GSI 24-279
|
||||
> > >
|
||||
> > > This looks indeed like a bogus entry probably returning all 1's for
|
||||
> > > RTE's etc. Can you please send me a dmesg with "apic=verbose" boot
|
||||
> > > parameter?
|
||||
> >
|
||||
> > Here you go:
|
||||
> >
|
||||
> > https://bugzilla.redhat.com/attachment.cgi?id=557552
|
||||
>
|
||||
> Was this helpful at all? I've been watching lkml for a related patch
|
||||
> in case I was missed on CC but haven't seen anything as of yet.
|
||||
|
||||
Yes, it was helpful. Something like the appended patch should ignore the
|
||||
bogus io-apic entry all together. As I can't test this, can you or the
|
||||
reporter give the appended patch a try and ack please?
|
||||
|
||||
thanks,
|
||||
suresh
|
||||
---
|
||||
|
||||
From: Suresh Siddha <suresh.b.siddha@intel.com>
|
||||
Subject: x86, ioapic: add register checks for bogus io-apic entries
|
||||
|
||||
With the recent changes to clear_IO_APIC_pin() which tries to clear
|
||||
remoteIRR bit explicitly, some of the users started to see
|
||||
"Unable to reset IRR for apic .." messages.
|
||||
|
||||
Close look shows that these are related to bogus IO-APIC entries which
|
||||
return's all 1's for their io-apic registers. And the above mentioned error
|
||||
messages are benign. But kernel should have ignored such io-apic's in the
|
||||
first place.
|
||||
|
||||
Check if register 0, 1, 2 of the listed io-apic are all 1's and ignore
|
||||
such io-apic.
|
||||
|
||||
Reported-by: Álvaro Castillo <midgoon@gmail.com>
|
||||
Signed-off-by: Suresh Siddha <suresh.b.siddha@intel.com>
|
||||
---
|
||||
arch/x86/kernel/apic/io_apic.c | 26 ++++++++++++++++++++++++++
|
||||
1 files changed, 26 insertions(+), 0 deletions(-)
|
||||
|
||||
diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c
|
||||
index fb07275..953e54d 100644
|
||||
--- a/arch/x86/kernel/apic/io_apic.c
|
||||
+++ b/arch/x86/kernel/apic/io_apic.c
|
||||
@@ -3979,6 +3979,26 @@ static __init int bad_ioapic(unsigned long address)
|
||||
return 0;
|
||||
}
|
||||
|
||||
+static __init int bad_ioapic_regs(int idx)
|
||||
+{
|
||||
+ union IO_APIC_reg_00 reg_00;
|
||||
+ union IO_APIC_reg_01 reg_01;
|
||||
+ union IO_APIC_reg_02 reg_02;
|
||||
+
|
||||
+ reg_00.raw = io_apic_read(idx, 0);
|
||||
+ reg_01.raw = io_apic_read(idx, 1);
|
||||
+ reg_02.raw = io_apic_read(idx, 2);
|
||||
+
|
||||
+ if (reg_00.raw == -1 && reg_01.raw == -1 && reg_02.raw == -1) {
|
||||
+ printk(KERN_WARNING
|
||||
+ "I/O APIC 0x%x regs return all ones, skipping!\n",
|
||||
+ mpc_ioapic_addr(idx));
|
||||
+ return 1;
|
||||
+ }
|
||||
+
|
||||
+ return 0;
|
||||
+}
|
||||
+
|
||||
void __init mp_register_ioapic(int id, u32 address, u32 gsi_base)
|
||||
{
|
||||
int idx = 0;
|
||||
@@ -3995,6 +4015,12 @@ void __init mp_register_ioapic(int id, u32 address, u32 gsi_base)
|
||||
ioapics[idx].mp_config.apicaddr = address;
|
||||
|
||||
set_fixmap_nocache(FIX_IO_APIC_BASE_0 + idx, address);
|
||||
+
|
||||
+ if (bad_ioapic_regs(idx)) {
|
||||
+ clear_fixmap(FIX_IO_APIC_BASE_0 + idx);
|
||||
+ return;
|
||||
+ }
|
||||
+
|
||||
ioapics[idx].mp_config.apicid = io_apic_unique_id(id);
|
||||
ioapics[idx].mp_config.apicver = io_apic_get_version(idx);
|
||||
|
||||
|
||||
|
||||
|
Loading…
Reference in New Issue
Block a user