From: Greg Kroah-Hartman Date: Mon, 3 Apr 2017 13:31:09 +0000 (+0200) Subject: 4.4-stable patches X-Git-Tag: v4.9.21~12 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0dc8f3a308dbf90dd6be5083e21fad70f5b9b4a8;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: drm-radeon-override-fpfn-for-all-vram-placements-in-radeon_evict_flags.patch kvm-x86-clear-bus-pointer-when-destroyed.patch mm-hugetlb-use-pte_present-instead-of-pmd_present-in-follow_huge_pmd.patch --- diff --git a/queue-4.4/drm-radeon-override-fpfn-for-all-vram-placements-in-radeon_evict_flags.patch b/queue-4.4/drm-radeon-override-fpfn-for-all-vram-placements-in-radeon_evict_flags.patch new file mode 100644 index 00000000000..35ff4ea097f --- /dev/null +++ b/queue-4.4/drm-radeon-override-fpfn-for-all-vram-placements-in-radeon_evict_flags.patch @@ -0,0 +1,48 @@ +From ce4b4f228e51219b0b79588caf73225b08b5b779 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Michel=20D=C3=A4nzer?= +Date: Fri, 24 Mar 2017 19:01:09 +0900 +Subject: drm/radeon: Override fpfn for all VRAM placements in radeon_evict_flags +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Michel Dänzer + +commit ce4b4f228e51219b0b79588caf73225b08b5b779 upstream. + +We were accidentally only overriding the first VRAM placement. For BOs +with the RADEON_GEM_NO_CPU_ACCESS flag set, +radeon_ttm_placement_from_domain creates a second VRAM placment with +fpfn == 0. If VRAM is almost full, the first VRAM placement with +fpfn > 0 may not work, but the second one with fpfn == 0 always will +(the BO's current location trivially satisfies it). Because "moving" +the BO to its current location puts it back on the LRU list, this +results in an infinite loop. + +Fixes: 2a85aedd117c ("drm/radeon: Try evicting from CPU accessible to + inaccessible VRAM first") +Reported-by: Zachary Michaels +Reported-and-Tested-by: Julien Isorce +Reviewed-by: Christian König +Reviewed-by: Alex Deucher +Signed-off-by: Michel Dänzer +Signed-off-by: Alex Deucher +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/gpu/drm/radeon/radeon_ttm.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/gpu/drm/radeon/radeon_ttm.c ++++ b/drivers/gpu/drm/radeon/radeon_ttm.c +@@ -213,8 +213,8 @@ static void radeon_evict_flags(struct tt + rbo->placement.num_busy_placement = 0; + for (i = 0; i < rbo->placement.num_placement; i++) { + if (rbo->placements[i].flags & TTM_PL_FLAG_VRAM) { +- if (rbo->placements[0].fpfn < fpfn) +- rbo->placements[0].fpfn = fpfn; ++ if (rbo->placements[i].fpfn < fpfn) ++ rbo->placements[i].fpfn = fpfn; + } else { + rbo->placement.busy_placement = + &rbo->placements[i]; diff --git a/queue-4.4/kvm-x86-clear-bus-pointer-when-destroyed.patch b/queue-4.4/kvm-x86-clear-bus-pointer-when-destroyed.patch new file mode 100644 index 00000000000..e52f2281c98 --- /dev/null +++ b/queue-4.4/kvm-x86-clear-bus-pointer-when-destroyed.patch @@ -0,0 +1,53 @@ +From df630b8c1e851b5e265dc2ca9c87222e342c093b Mon Sep 17 00:00:00 2001 +From: Peter Xu +Date: Wed, 15 Mar 2017 16:01:17 +0800 +Subject: KVM: x86: clear bus pointer when destroyed +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Peter Xu + +commit df630b8c1e851b5e265dc2ca9c87222e342c093b upstream. + +When releasing the bus, let's clear the bus pointers to mark it out. If +any further device unregister happens on this bus, we know that we're +done if we found the bus being released already. + +Signed-off-by: Peter Xu +Signed-off-by: Radim Krčmář +Signed-off-by: Greg Kroah-Hartman + +--- + virt/kvm/kvm_main.c | 12 +++++++++++- + 1 file changed, 11 insertions(+), 1 deletion(-) + +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -654,8 +654,10 @@ static void kvm_destroy_vm(struct kvm *k + list_del(&kvm->vm_list); + spin_unlock(&kvm_lock); + kvm_free_irq_routing(kvm); +- for (i = 0; i < KVM_NR_BUSES; i++) ++ for (i = 0; i < KVM_NR_BUSES; i++) { + kvm_io_bus_destroy(kvm->buses[i]); ++ kvm->buses[i] = NULL; ++ } + kvm_coalesced_mmio_free(kvm); + #if defined(CONFIG_MMU_NOTIFIER) && defined(KVM_ARCH_WANT_MMU_NOTIFIER) + mmu_notifier_unregister(&kvm->mmu_notifier, kvm->mm); +@@ -3376,6 +3378,14 @@ int kvm_io_bus_unregister_dev(struct kvm + struct kvm_io_bus *new_bus, *bus; + + bus = kvm->buses[bus_idx]; ++ ++ /* ++ * It's possible the bus being released before hand. If so, ++ * we're done here. ++ */ ++ if (!bus) ++ return 0; ++ + r = -ENOENT; + for (i = 0; i < bus->dev_count; i++) + if (bus->range[i].dev == dev) { diff --git a/queue-4.4/mm-hugetlb-use-pte_present-instead-of-pmd_present-in-follow_huge_pmd.patch b/queue-4.4/mm-hugetlb-use-pte_present-instead-of-pmd_present-in-follow_huge_pmd.patch new file mode 100644 index 00000000000..0bb58ebcd09 --- /dev/null +++ b/queue-4.4/mm-hugetlb-use-pte_present-instead-of-pmd_present-in-follow_huge_pmd.patch @@ -0,0 +1,103 @@ +From c9d398fa237882ea07167e23bcfc5e6847066518 Mon Sep 17 00:00:00 2001 +From: Naoya Horiguchi +Date: Fri, 31 Mar 2017 15:11:55 -0700 +Subject: mm, hugetlb: use pte_present() instead of pmd_present() in follow_huge_pmd() + +From: Naoya Horiguchi + +commit c9d398fa237882ea07167e23bcfc5e6847066518 upstream. + +I found the race condition which triggers the following bug when +move_pages() and soft offline are called on a single hugetlb page +concurrently. + + Soft offlining page 0x119400 at 0x700000000000 + BUG: unable to handle kernel paging request at ffffea0011943820 + IP: follow_huge_pmd+0x143/0x190 + PGD 7ffd2067 + PUD 7ffd1067 + PMD 0 + [61163.582052] Oops: 0000 [#1] SMP + Modules linked in: binfmt_misc ppdev virtio_balloon parport_pc pcspkr i2c_piix4 parport i2c_core acpi_cpufreq ip_tables xfs libcrc32c ata_generic pata_acpi virtio_blk 8139too crc32c_intel ata_piix serio_raw libata virtio_pci 8139cp virtio_ring virtio mii floppy dm_mirror dm_region_hash dm_log dm_mod [last unloaded: cap_check] + CPU: 0 PID: 22573 Comm: iterate_numa_mo Tainted: P OE 4.11.0-rc2-mm1+ #2 + Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 + RIP: 0010:follow_huge_pmd+0x143/0x190 + RSP: 0018:ffffc90004bdbcd0 EFLAGS: 00010202 + RAX: 0000000465003e80 RBX: ffffea0004e34d30 RCX: 00003ffffffff000 + RDX: 0000000011943800 RSI: 0000000000080001 RDI: 0000000465003e80 + RBP: ffffc90004bdbd18 R08: 0000000000000000 R09: ffff880138d34000 + R10: ffffea0004650000 R11: 0000000000c363b0 R12: ffffea0011943800 + R13: ffff8801b8d34000 R14: ffffea0000000000 R15: 000077ff80000000 + FS: 00007fc977710740(0000) GS:ffff88007dc00000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: ffffea0011943820 CR3: 000000007a746000 CR4: 00000000001406f0 + Call Trace: + follow_page_mask+0x270/0x550 + SYSC_move_pages+0x4ea/0x8f0 + SyS_move_pages+0xe/0x10 + do_syscall_64+0x67/0x180 + entry_SYSCALL64_slow_path+0x25/0x25 + RIP: 0033:0x7fc976e03949 + RSP: 002b:00007ffe72221d88 EFLAGS: 00000246 ORIG_RAX: 0000000000000117 + RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fc976e03949 + RDX: 0000000000c22390 RSI: 0000000000001400 RDI: 0000000000005827 + RBP: 00007ffe72221e00 R08: 0000000000c2c3a0 R09: 0000000000000004 + R10: 0000000000c363b0 R11: 0000000000000246 R12: 0000000000400650 + R13: 00007ffe72221ee0 R14: 0000000000000000 R15: 0000000000000000 + Code: 81 e4 ff ff 1f 00 48 21 c2 49 c1 ec 0c 48 c1 ea 0c 4c 01 e2 49 bc 00 00 00 00 00 ea ff ff 48 c1 e2 06 49 01 d4 f6 45 bc 04 74 90 <49> 8b 7c 24 20 40 f6 c7 01 75 2b 4c 89 e7 8b 47 1c 85 c0 7e 2a + RIP: follow_huge_pmd+0x143/0x190 RSP: ffffc90004bdbcd0 + CR2: ffffea0011943820 + ---[ end trace e4f81353a2d23232 ]--- + Kernel panic - not syncing: Fatal exception + Kernel Offset: disabled + +This bug is triggered when pmd_present() returns true for non-present +hugetlb, so fixing the present check in follow_huge_pmd() prevents it. +Using pmd_present() to determine present/non-present for hugetlb is not +correct, because pmd_present() checks multiple bits (not only +_PAGE_PRESENT) for historical reason and it can misjudge hugetlb state. + +Fixes: e66f17ff7177 ("mm/hugetlb: take page table lock in follow_huge_pmd()") +Link: http://lkml.kernel.org/r/1490149898-20231-1-git-send-email-n-horiguchi@ah.jp.nec.com +Signed-off-by: Naoya Horiguchi +Acked-by: Hillf Danton +Cc: Hugh Dickins +Cc: Michal Hocko +Cc: "Kirill A. Shutemov" +Cc: Mike Kravetz +Cc: Christian Borntraeger +Cc: Gerald Schaefer +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + mm/hugetlb.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -4362,6 +4362,7 @@ follow_huge_pmd(struct mm_struct *mm, un + { + struct page *page = NULL; + spinlock_t *ptl; ++ pte_t pte; + retry: + ptl = pmd_lockptr(mm, pmd); + spin_lock(ptl); +@@ -4371,12 +4372,13 @@ retry: + */ + if (!pmd_huge(*pmd)) + goto out; +- if (pmd_present(*pmd)) { ++ pte = huge_ptep_get((pte_t *)pmd); ++ if (pte_present(pte)) { + page = pmd_page(*pmd) + ((address & ~PMD_MASK) >> PAGE_SHIFT); + if (flags & FOLL_GET) + get_page(page); + } else { +- if (is_hugetlb_entry_migration(huge_ptep_get((pte_t *)pmd))) { ++ if (is_hugetlb_entry_migration(pte)) { + spin_unlock(ptl); + __migration_entry_wait(mm, (pte_t *)pmd, ptl); + goto retry; diff --git a/queue-4.4/series b/queue-4.4/series index fbf789e984e..dbe3d4f5d77 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -11,3 +11,6 @@ acpi-do-not-create-a-platform_device-for-ioapic-ioxapic.patch tty-serial-atmel-fix-race-condition-tx-dma.patch tty-serial-atmel-fix-tx-path-in-atmel_console_write.patch usb-fix-linked-list-corruption-in-rh_call_control.patch +kvm-x86-clear-bus-pointer-when-destroyed.patch +drm-radeon-override-fpfn-for-all-vram-placements-in-radeon_evict_flags.patch +mm-hugetlb-use-pte_present-instead-of-pmd_present-in-follow_huge_pmd.patch