From: Greg Kroah-Hartman Date: Sat, 5 Mar 2022 20:40:15 +0000 (+0100) Subject: 5.16-stable patches X-Git-Tag: v4.9.305~45 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=b53cbf2ce9c620f15234678a78987709e647b13b;p=thirdparty%2Fkernel%2Fstable-queue.git 5.16-stable patches added patches: memfd-fix-f_seal_write-after-shmem-huge-page-allocated.patch s390-extable-fix-exception-table-sorting.patch s390-setup-preserve-memory-at-oldmem_base-and-oldmem_size.patch --- diff --git a/queue-5.16/memfd-fix-f_seal_write-after-shmem-huge-page-allocated.patch b/queue-5.16/memfd-fix-f_seal_write-after-shmem-huge-page-allocated.patch new file mode 100644 index 00000000000..603d1518b75 --- /dev/null +++ b/queue-5.16/memfd-fix-f_seal_write-after-shmem-huge-page-allocated.patch @@ -0,0 +1,131 @@ +From f2b277c4d1c63a85127e8aa2588e9cc3bd21cb99 Mon Sep 17 00:00:00 2001 +From: Hugh Dickins +Date: Fri, 4 Mar 2022 20:29:01 -0800 +Subject: memfd: fix F_SEAL_WRITE after shmem huge page allocated + +From: Hugh Dickins + +commit f2b277c4d1c63a85127e8aa2588e9cc3bd21cb99 upstream. + +Wangyong reports: after enabling tmpfs filesystem to support transparent +hugepage with the following command: + + echo always > /sys/kernel/mm/transparent_hugepage/shmem_enabled + +the docker program tries to add F_SEAL_WRITE through the following +command, but it fails unexpectedly with errno EBUSY: + + fcntl(5, F_ADD_SEALS, F_SEAL_WRITE) = -1. + +That is because memfd_tag_pins() and memfd_wait_for_pins() were never +updated for shmem huge pages: checking page_mapcount() against +page_count() is hopeless on THP subpages - they need to check +total_mapcount() against page_count() on THP heads only. + +Make memfd_tag_pins() (compared > 1) as strict as memfd_wait_for_pins() +(compared != 1): either can be justified, but given the non-atomic +total_mapcount() calculation, it is better now to be strict. Bear in +mind that total_mapcount() itself scans all of the THP subpages, when +choosing to take an XA_CHECK_SCHED latency break. + +Also fix the unlikely xa_is_value() case in memfd_wait_for_pins(): if a +page has been swapped out since memfd_tag_pins(), then its refcount must +have fallen, and so it can safely be untagged. + +Link: https://lkml.kernel.org/r/a4f79248-df75-2c8c-3df-ba3317ccb5da@google.com +Signed-off-by: Hugh Dickins +Reported-by: Zeal Robot +Reported-by: wangyong +Cc: Mike Kravetz +Cc: Matthew Wilcox (Oracle) +Cc: CGEL ZTE +Cc: Kirill A. Shutemov +Cc: Song Liu +Cc: Yang Yang +Cc: +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + mm/memfd.c | 40 ++++++++++++++++++++++++++++------------ + 1 file changed, 28 insertions(+), 12 deletions(-) + +--- a/mm/memfd.c ++++ b/mm/memfd.c +@@ -31,20 +31,28 @@ + static void memfd_tag_pins(struct xa_state *xas) + { + struct page *page; +- unsigned int tagged = 0; ++ int latency = 0; ++ int cache_count; + + lru_add_drain(); + + xas_lock_irq(xas); + xas_for_each(xas, page, ULONG_MAX) { +- if (xa_is_value(page)) +- continue; +- page = find_subpage(page, xas->xa_index); +- if (page_count(page) - page_mapcount(page) > 1) ++ cache_count = 1; ++ if (!xa_is_value(page) && ++ PageTransHuge(page) && !PageHuge(page)) ++ cache_count = HPAGE_PMD_NR; ++ ++ if (!xa_is_value(page) && ++ page_count(page) - total_mapcount(page) != cache_count) + xas_set_mark(xas, MEMFD_TAG_PINNED); ++ if (cache_count != 1) ++ xas_set(xas, page->index + cache_count); + +- if (++tagged % XA_CHECK_SCHED) ++ latency += cache_count; ++ if (latency < XA_CHECK_SCHED) + continue; ++ latency = 0; + + xas_pause(xas); + xas_unlock_irq(xas); +@@ -73,7 +81,8 @@ static int memfd_wait_for_pins(struct ad + + error = 0; + for (scan = 0; scan <= LAST_SCAN; scan++) { +- unsigned int tagged = 0; ++ int latency = 0; ++ int cache_count; + + if (!xas_marked(&xas, MEMFD_TAG_PINNED)) + break; +@@ -87,10 +96,14 @@ static int memfd_wait_for_pins(struct ad + xas_lock_irq(&xas); + xas_for_each_marked(&xas, page, ULONG_MAX, MEMFD_TAG_PINNED) { + bool clear = true; +- if (xa_is_value(page)) +- continue; +- page = find_subpage(page, xas.xa_index); +- if (page_count(page) - page_mapcount(page) != 1) { ++ ++ cache_count = 1; ++ if (!xa_is_value(page) && ++ PageTransHuge(page) && !PageHuge(page)) ++ cache_count = HPAGE_PMD_NR; ++ ++ if (!xa_is_value(page) && cache_count != ++ page_count(page) - total_mapcount(page)) { + /* + * On the last scan, we clean up all those tags + * we inserted; but make a note that we still +@@ -103,8 +116,11 @@ static int memfd_wait_for_pins(struct ad + } + if (clear) + xas_clear_mark(&xas, MEMFD_TAG_PINNED); +- if (++tagged % XA_CHECK_SCHED) ++ ++ latency += cache_count; ++ if (latency < XA_CHECK_SCHED) + continue; ++ latency = 0; + + xas_pause(&xas); + xas_unlock_irq(&xas); diff --git a/queue-5.16/s390-extable-fix-exception-table-sorting.patch b/queue-5.16/s390-extable-fix-exception-table-sorting.patch new file mode 100644 index 00000000000..81564cf37db --- /dev/null +++ b/queue-5.16/s390-extable-fix-exception-table-sorting.patch @@ -0,0 +1,48 @@ +From c194dad21025dfd043210912653baab823bdff67 Mon Sep 17 00:00:00 2001 +From: Heiko Carstens +Date: Thu, 24 Feb 2022 22:03:29 +0100 +Subject: s390/extable: fix exception table sorting + +From: Heiko Carstens + +commit c194dad21025dfd043210912653baab823bdff67 upstream. + +s390 has a swap_ex_entry_fixup function, however it is not being used +since common code expects a swap_ex_entry_fixup define. If it is not +defined the default implementation will be used. So fix this by adding +a proper define. +However also the implementation of the function must be fixed, since a +NULL value for handler has a special meaning and must not be adjusted. + +Luckily all of this doesn't fix a real bug currently: the main extable +is correctly sorted during build time, and for runtime sorting there +is currently no case where the handler field is not NULL. + +Fixes: 05a68e892e89 ("s390/kernel: expand exception table logic to allow new handling options") +Acked-by: Ilya Leoshkevich +Reviewed-by: Alexander Gordeev +Signed-off-by: Heiko Carstens +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/include/asm/extable.h | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/arch/s390/include/asm/extable.h ++++ b/arch/s390/include/asm/extable.h +@@ -69,8 +69,13 @@ static inline void swap_ex_entry_fixup(s + { + a->fixup = b->fixup + delta; + b->fixup = tmp.fixup - delta; +- a->handler = b->handler + delta; +- b->handler = tmp.handler - delta; ++ a->handler = b->handler; ++ if (a->handler) ++ a->handler += delta; ++ b->handler = tmp.handler; ++ if (b->handler) ++ b->handler -= delta; + } ++#define swap_ex_entry_fixup swap_ex_entry_fixup + + #endif diff --git a/queue-5.16/s390-setup-preserve-memory-at-oldmem_base-and-oldmem_size.patch b/queue-5.16/s390-setup-preserve-memory-at-oldmem_base-and-oldmem_size.patch new file mode 100644 index 00000000000..56ae88d2020 --- /dev/null +++ b/queue-5.16/s390-setup-preserve-memory-at-oldmem_base-and-oldmem_size.patch @@ -0,0 +1,35 @@ +From 6b4b54c7ca347bcb4aa7a3cc01aa16e84ac7fbe4 Mon Sep 17 00:00:00 2001 +From: Alexander Egorenkov +Date: Wed, 9 Feb 2022 11:25:09 +0100 +Subject: s390/setup: preserve memory at OLDMEM_BASE and OLDMEM_SIZE + +From: Alexander Egorenkov + +commit 6b4b54c7ca347bcb4aa7a3cc01aa16e84ac7fbe4 upstream. + +We need to preserve the values at OLDMEM_BASE and OLDMEM_SIZE which are +used by zgetdump in case when kdump crashes. In that case zgetdump will +attempt to read OLDMEM_BASE and OLDMEM_SIZE in order to find out where +the memory range [0 - OLDMEM_SIZE] belonging to the production kernel is. + +Fixes: f1a546947431 ("s390/setup: don't reserve memory that occupied decompressor's head") +Cc: stable@vger.kernel.org # 5.15+ +Signed-off-by: Alexander Egorenkov +Acked-by: Vasily Gorbik +Signed-off-by: Vasily Gorbik +Signed-off-by: Greg Kroah-Hartman +--- + arch/s390/kernel/setup.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -800,6 +800,8 @@ static void __init check_initrd(void) + static void __init reserve_kernel(void) + { + memblock_reserve(0, STARTUP_NORMAL_OFFSET); ++ memblock_reserve(OLDMEM_BASE, sizeof(unsigned long)); ++ memblock_reserve(OLDMEM_SIZE, sizeof(unsigned long)); + memblock_reserve(__amode31_base, __eamode31 - __samode31); + memblock_reserve(__pa(sclp_early_sccb), EXT_SCCB_READ_SCP); + memblock_reserve(__pa(_stext), _end - _stext); diff --git a/queue-5.16/series b/queue-5.16/series index 6090787dc08..fa3909a987f 100644 --- a/queue-5.16/series +++ b/queue-5.16/series @@ -113,3 +113,6 @@ selftests-mlxsw-tc_police_scale-make-test-more-robust.patch pinctrl-sunxi-use-unique-lockdep-classes-for-irqs.patch igc-igc_write_phy_reg_gpy-drop-premature-return.patch ibmvnic-free-reset-work-item-when-flushing.patch +memfd-fix-f_seal_write-after-shmem-huge-page-allocated.patch +s390-setup-preserve-memory-at-oldmem_base-and-oldmem_size.patch +s390-extable-fix-exception-table-sorting.patch