{"push_id":2122393714,"size":1000,"distinct_size":14699,"ref":"refs/heads/eds","head":"417835b0c7d072649b2de13ba9dfe6eb5f3b8775","before":"54f9552249b720ef9d33a7eb9e0d1f8f53ce1025","commits":[{"sha":"df0062b27ebf473b372914a3e3574d93790e2b72","author":{"name":"Will Deacon","email":"b2e33b86f3f248a395aadfb8ef1908ac314f4233@arm.com"},"message":"perf/core: Avoid freeing static PMU contexts when PMU is unregistered\n\nSince commit:\n\n  1fd7e4169954 (\"perf/core: Remove perf_cpu_context::unique_pmu\")\n\n... when a PMU is unregistered then its associated ->pmu_cpu_context is\nunconditionally freed. Whilst this is fine for dynamically allocated\ncontext types (i.e. those registered using perf_invalid_context), this\ncauses a problem for sharing of static contexts such as\nperf_{sw,hw}_context, which are used by multiple built-in PMUs and\neffectively have a global lifetime.\n\nWhilst testing the ARM SPE driver, which must use perf_sw_context to\nsupport per-task AUX tracing, unregistering the driver as a result of a\nmodule unload resulted in:\n\n Unable to handle kernel NULL pointer dereference at virtual address 00000038\n Internal error: Oops: 96000004 [#1] PREEMPT SMP\n Modules linked in: [last unloaded: arm_spe_pmu]\n PC is at ctx_resched+0x38/0xe8\n LR is at perf_event_exec+0x20c/0x278\n [...]\n ctx_resched+0x38/0xe8\n perf_event_exec+0x20c/0x278\n setup_new_exec+0x88/0x118\n load_elf_binary+0x26c/0x109c\n search_binary_handler+0x90/0x298\n do_execveat_common.isra.14+0x540/0x618\n SyS_execve+0x38/0x48\n\nsince the software context has been freed and the ctx.pmu->pmu_disable_count\nfield has been set to NULL.\n\nThis patch fixes the problem by avoiding the freeing of static PMU contexts\naltogether. Whilst the sharing of dynamic contexts is questionable, this\nactually requires the caller to share their context pointer explicitly\nand so the burden is on them to manage the object lifetime.\n\nReported-by: Kim Phillips <kim.phillips@arm.com>\nSigned-off-by: Will Deacon <will.deacon@arm.com>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nAcked-by: Mark Rutland <mark.rutland@arm.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nFixes: 1fd7e4169954 (\"perf/core: Remove perf_cpu_context::unique_pmu\")\nLink: http://lkml.kernel.org/r/1507040450-7730-1-git-send-email-will.deacon@arm.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/df0062b27ebf473b372914a3e3574d93790e2b72"},{"sha":"e6a5203399d19871021c1fa0eb2a08fc63b67e91","author":{"name":"leilei.lin","email":"19af2c6cbacc16b90bb1f2614f2863e5d3c8689e@alibaba-inc.com"},"message":"perf/core: Fix cgroup time when scheduling descendants\n\nUpdate cgroup time when an event is scheduled in by descendants.\n\nReviewed-and-tested-by: Jiri Olsa <jolsa@kernel.org>\nSigned-off-by: leilei.lin <leilei.lin@alibaba-inc.com>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Jiri Olsa <jolsa@redhat.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Stephane Eranian <eranian@gmail.com>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: acme@kernel.org\nCc: alexander.shishkin@linux.intel.com\nCc: brendan.d.gregg@gmail.com\nCc: yang_oliver@hotmail.com\nLink: http://lkml.kernel.org/r/CALPjY3mkHiekRkRECzMi9G-bjUQOvOjVBAqxmWkTzc-g+0LwMg@mail.gmail.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/e6a5203399d19871021c1fa0eb2a08fc63b67e91"},{"sha":"d153b153446f7d8832bb2ebd92309c8a6003b3bb","author":{"name":"Peter Zijlstra","email":"4d3106856cce90e8f40acc5180f60ddda3a23b6e@infradead.org"},"message":"sched/core: Fix wake_affine() performance regression\n\nEric reported a sysbench regression against commit:\n\n  3fed382b46ba (\"sched/numa: Implement NUMA node level wake_affine()\")\n\nSimilarly, Rik was looking at the NAS-lu.C benchmark, which regressed\nagainst his v3.10 enterprise kernel.\n\nPRE (current tip/master):\n\n ivb-ep sysbench:\n\n   2: [30 secs]     transactions:                        64110  (2136.94 per sec.)\n   5: [30 secs]     transactions:                        143644 (4787.99 per sec.)\n  10: [30 secs]     transactions:                        274298 (9142.93 per sec.)\n  20: [30 secs]     transactions:                        418683 (13955.45 per sec.)\n  40: [30 secs]     transactions:                        320731 (10690.15 per sec.)\n  80: [30 secs]     transactions:                        355096 (11834.28 per sec.)\n\n hsw-ex NAS:\n\n OMP_PROC_BIND/lu.C.x_threads_144_run_1.log: Time in seconds =                    18.01\n OMP_PROC_BIND/lu.C.x_threads_144_run_2.log: Time in seconds =                    17.89\n OMP_PROC_BIND/lu.C.x_threads_144_run_3.log: Time in seconds =                    17.93\n lu.C.x_threads_144_run_1.log: Time in seconds =                   434.68\n lu.C.x_threads_144_run_2.log: Time in seconds =                   405.36\n lu.C.x_threads_144_run_3.log: Time in seconds =                   433.83\n\nPOST (+patch):\n\n ivb-ep sysbench:\n\n   2: [30 secs]     transactions:                        64494  (2149.75 per sec.)\n   5: [30 secs]     transactions:                        145114 (4836.99 per sec.)\n  10: [30 secs]     transactions:                        278311 (9276.69 per sec.)\n  20: [30 secs]     transactions:                        437169 (14571.60 per sec.)\n  40: [30 secs]     transactions:                        669837 (22326.73 per sec.)\n  80: [30 secs]     transactions:                        631739 (21055.88 per sec.)\n\n hsw-ex NAS:\n\n lu.C.x_threads_144_run_1.log: Time in seconds =                    23.36\n lu.C.x_threads_144_run_2.log: Time in seconds =                    22.96\n lu.C.x_threads_144_run_3.log: Time in seconds =                    22.52\n\nThis patch takes out all the shiny wake_affine() stuff and goes back to\nutter basics. Between the two CPUs involved with the wakeup (the CPU\ndoing the wakeup and the CPU we ran on previously) pick the CPU we can\nrun on _now_.\n\nThis restores much of the regressions against the older kernels,\nbut leaves some ground in the overloaded case. The default-enabled\nWA_WEIGHT (which will be introduced in the next patch) is an attempt\nto address the overloaded situation.\n\nReported-by: Eric Farman <farman@linux.vnet.ibm.com>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Christian Borntraeger <borntraeger@de.ibm.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Matthew Rosato <mjrosato@linux.vnet.ibm.com>\nCc: Mike Galbraith <efault@gmx.de>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Rik van Riel <riel@redhat.com>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: jinpuwang@gmail.com\nCc: vcaputo@pengaru.com\nFixes: 3fed382b46ba (\"sched/numa: Implement NUMA node level wake_affine()\")\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/d153b153446f7d8832bb2ebd92309c8a6003b3bb"},{"sha":"f2cdd9cc6c97e617b95f430f527a6e3165e1bee8","author":{"name":"Peter Zijlstra","email":"4d3106856cce90e8f40acc5180f60ddda3a23b6e@infradead.org"},"message":"sched/core: Address more wake_affine() regressions\n\nThe trivial wake_affine_idle() implementation is very good for a\nnumber of workloads, but it comes apart at the moment there are no\nidle CPUs left, IOW. the overloaded case.\n\nhackbench:\n\n\t\tNO_WA_WEIGHT\t\tWA_WEIGHT\n\nhackbench-20  : 7.362717561 seconds\t6.450509391 seconds\n\n(win)\n\nnetperf:\n\n\t\t  NO_WA_WEIGHT\t\tWA_WEIGHT\n\nTCP_SENDFILE-1\t: Avg: 54524.6\t\tAvg: 52224.3\nTCP_SENDFILE-10\t: Avg: 48185.2          Avg: 46504.3\nTCP_SENDFILE-20\t: Avg: 29031.2          Avg: 28610.3\nTCP_SENDFILE-40\t: Avg: 9819.72          Avg: 9253.12\nTCP_SENDFILE-80\t: Avg: 5355.3           Avg: 4687.4\n\nTCP_STREAM-1\t: Avg: 41448.3          Avg: 42254\nTCP_STREAM-10\t: Avg: 24123.2          Avg: 25847.9\nTCP_STREAM-20\t: Avg: 15834.5          Avg: 18374.4\nTCP_STREAM-40\t: Avg: 5583.91          Avg: 5599.57\nTCP_STREAM-80\t: Avg: 2329.66          Avg: 2726.41\n\nTCP_RR-1\t: Avg: 80473.5          Avg: 82638.8\nTCP_RR-10\t: Avg: 72660.5          Avg: 73265.1\nTCP_RR-20\t: Avg: 52607.1          Avg: 52634.5\nTCP_RR-40\t: Avg: 57199.2          Avg: 56302.3\nTCP_RR-80\t: Avg: 25330.3          Avg: 26867.9\n\nUDP_RR-1\t: Avg: 108266           Avg: 107844\nUDP_RR-10\t: Avg: 95480            Avg: 95245.2\nUDP_RR-20\t: Avg: 68770.8          Avg: 68673.7\nUDP_RR-40\t: Avg: 76231            Avg: 75419.1\nUDP_RR-80\t: Avg: 34578.3          Avg: 35639.1\n\nUDP_STREAM-1\t: Avg: 64684.3          Avg: 66606\nUDP_STREAM-10\t: Avg: 52701.2          Avg: 52959.5\nUDP_STREAM-20\t: Avg: 30376.4          Avg: 29704\nUDP_STREAM-40\t: Avg: 15685.8          Avg: 15266.5\nUDP_STREAM-80\t: Avg: 8415.13          Avg: 7388.97\n\n(wins and losses)\n\nsysbench:\n\n\t\t    NO_WA_WEIGHT\t\tWA_WEIGHT\n\nsysbench-mysql-2  :  2135.17 per sec.\t\t 2142.51 per sec.\nsysbench-mysql-5  :  4809.68 per sec.            4800.19 per sec.\nsysbench-mysql-10 :  9158.59 per sec.            9157.05 per sec.\nsysbench-mysql-20 : 14570.70 per sec.           14543.55 per sec.\nsysbench-mysql-40 : 22130.56 per sec.           22184.82 per sec.\nsysbench-mysql-80 : 20995.56 per sec.           21904.18 per sec.\n\nsysbench-psql-2   :  1679.58 per sec.            1705.06 per sec.\nsysbench-psql-5   :  3797.69 per sec.            3879.93 per sec.\nsysbench-psql-10  :  7253.22 per sec.            7258.06 per sec.\nsysbench-psql-20  : 11166.75 per sec.           11220.00 per sec.\nsysbench-psql-40  : 17277.28 per sec.           17359.78 per sec.\nsysbench-psql-80  : 17112.44 per sec.           17221.16 per sec.\n\n(increase on the top end)\n\ntbench:\n\nNO_WA_WEIGHT\n\nThroughput 685.211 MB/sec   2 clients   2 procs  max_latency=0.123 ms\nThroughput 1596.64 MB/sec   5 clients   5 procs  max_latency=0.119 ms\nThroughput 2985.47 MB/sec  10 clients  10 procs  max_latency=0.262 ms\nThroughput 4521.15 MB/sec  20 clients  20 procs  max_latency=0.506 ms\nThroughput 9438.1  MB/sec  40 clients  40 procs  max_latency=2.052 ms\nThroughput 8210.5  MB/sec  80 clients  80 procs  max_latency=8.310 ms\n\nWA_WEIGHT\n\nThroughput 697.292 MB/sec   2 clients   2 procs  max_latency=0.127 ms\nThroughput 1596.48 MB/sec   5 clients   5 procs  max_latency=0.080 ms\nThroughput 2975.22 MB/sec  10 clients  10 procs  max_latency=0.254 ms\nThroughput 4575.14 MB/sec  20 clients  20 procs  max_latency=0.502 ms\nThroughput 9468.65 MB/sec  40 clients  40 procs  max_latency=2.069 ms\nThroughput 8631.73 MB/sec  80 clients  80 procs  max_latency=8.605 ms\n\n(increase on the top end)\n\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Mike Galbraith <efault@gmx.de>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Rik van Riel <riel@redhat.com>\nCc: linux-kernel@vger.kernel.org\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/f2cdd9cc6c97e617b95f430f527a6e3165e1bee8"},{"sha":"024c9d2faebdad3fb43fe49ad68e91a36190f1e2","author":{"name":"Peter Zijlstra","email":"4d3106856cce90e8f40acc5180f60ddda3a23b6e@infradead.org"},"message":"sched/core: Ensure load_balance() respects the active_mask\n\nWhile load_balance() masks the source CPUs against active_mask, it had\na hole against the destination CPU. Ensure the destination CPU is also\npart of the 'domain-mask & active-mask' set.\n\nReported-by: Levin, Alexander (Sasha Levin) <alexander.levin@verizon.com>\nSigned-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Mike Galbraith <efault@gmx.de>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nFixes: 77d1dfda0e79 (\"sched/topology, cpuset: Avoid spurious/wrong domain rebuilds\")\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/024c9d2faebdad3fb43fe49ad68e91a36190f1e2"},{"sha":"5a866ec0014b2baa4ecbb1eaa19c835482829d08","author":{"name":"Maxime Chevallier","email":"366b7ba31324f21eb0a1756e51570597569e6539@smile.fr"},"message":"spi: a3700: Return correct value on timeout detection\n\nWhen waiting for transfer completion, a3700_spi_wait_completion\nreturns a boolean indicating if a timeout occurred.\n\nThe function was returning 'true' everytime, failing to detect any\ntimeout.\n\nThis patch makes it return 'false' when a timeout is reached.\n\nSigned-off-by: Maxime Chevallier <maxime.chevallier@smile.fr>\nSigned-off-by: Mark Brown <broonie@kernel.org>\nCc: stable@vger.kernel.org","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/5a866ec0014b2baa4ecbb1eaa19c835482829d08"},{"sha":"b0490a04e736356e427e227902b17f9927a56caf","author":{"name":"Sandipan Das","email":"20195ca740741e1ab704ab9cb7a3e97d8849e546@linux.vnet.ibm.com"},"message":"powerpc/lib/sstep: Fix count leading zeros instructions\n\nAccording to the GCC documentation, the behaviour of __builtin_clz()\nand __builtin_clzl() is undefined if the value of the input argument\nis zero. Without handling this special case, these builtins have been\nused for emulating the following instructions:\n  * Count Leading Zeros Word (cntlzw[.])\n  * Count Leading Zeros Doubleword (cntlzd[.])\n\nThis fixes the emulated behaviour of these instructions by adding an\nadditional check for this special case.\n\nFixes: 3cdfcbfd32b9d (\"powerpc: Change analyse_instr so it doesn't modify *regs\")\nSigned-off-by: Sandipan Das <sandipan@linux.vnet.ibm.com>\nReviewed-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/b0490a04e736356e427e227902b17f9927a56caf"},{"sha":"6b2c08f989250c54f31b53dba9ace863a1f3fff6","author":{"name":"Thiago Jung Bauermann","email":"d0df6085a5964d5522651aade9112cbd17dd5a08@linux.vnet.ibm.com"},"message":"powerpc: Don't call lockdep_assert_cpus_held() from arch_update_cpu_topology()\n\nIt turns out that not all paths calling arch_update_cpu_topology() hold\ncpu_hotplug_lock, but that's OK because those paths can't race with\nany concurrent hotplug events.\n\nWarnings were reported with the following trace:\n\n  lockdep_assert_cpus_held\n  arch_update_cpu_topology\n  sched_init_domains\n  sched_init_smp\n  kernel_init_freeable\n  kernel_init\n  ret_from_kernel_thread\n\nWhich is safe because it's called early in boot when hotplug is not\nlive yet.\n\nAnd also this trace:\n\n  lockdep_assert_cpus_held\n  arch_update_cpu_topology\n  partition_sched_domains\n  cpuset_update_active_cpus\n  sched_cpu_deactivate\n  cpuhp_invoke_callback\n  cpuhp_down_callbacks\n  cpuhp_thread_fun\n  smpboot_thread_fn\n  kthread\n  ret_from_kernel_thread\n\nWhich is safe because it's called as part of CPU hotplug, so although\nwe don't hold the CPU hotplug lock, there is another thread driving\nthe CPU hotplug operation which does hold the lock, and there is no\nrace.\n\nThanks to tglx for deciphering it for us.\n\nFixes: 3e401f7a2e51 (\"powerpc: Only obtain cpu_hotplug_lock if called by rtasd\")\nSigned-off-by: Thiago Jung Bauermann <bauerman@linux.vnet.ibm.com>\nSigned-off-by: Michael Ellerman <mpe@ellerman.id.au>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/6b2c08f989250c54f31b53dba9ace863a1f3fff6"},{"sha":"62dd86ac01f9fb6386d7f8c6b389c3ea4582a50a","author":{"name":"Josh Poimboeuf","email":"e3c4f83d6dbbf85df94c8b24fb0cf20a5e953120@redhat.com"},"message":"x86/unwind: Fix dereference of untrusted pointer\n\nTetsuo Handa and Fengguang Wu reported a panic in the unwinder:\n\n  BUG: unable to handle kernel NULL pointer dereference at 000001f2\n  IP: update_stack_state+0xd4/0x340\n  *pde = 00000000\n\n  Oops: 0000 [#1] PREEMPT SMP\n  CPU: 0 PID: 18728 Comm: 01-cpu-hotplug Not tainted 4.13.0-rc4-00170-gb09be67 #592\n  Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.3-20161025_171302-gandalf 04/01/2014\n  task: bb0b53c0 task.stack: bb3ac000\n  EIP: update_stack_state+0xd4/0x340\n  EFLAGS: 00010002 CPU: 0\n  EAX: 0000a570 EBX: bb3adccb ECX: 0000f401 EDX: 0000a570\n  ESI: 00000001 EDI: 000001ba EBP: bb3adc6b ESP: bb3adc3f\n   DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068\n  CR0: 80050033 CR2: 000001f2 CR3: 0b3a7000 CR4: 00140690\n  DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000\n  DR6: fffe0ff0 DR7: 00000400\n  Call Trace:\n   ? unwind_next_frame+0xea/0x400\n   ? __unwind_start+0xf5/0x180\n   ? __save_stack_trace+0x81/0x160\n   ? save_stack_trace+0x20/0x30\n   ? __lock_acquire+0xfa5/0x12f0\n   ? lock_acquire+0x1c2/0x230\n   ? tick_periodic+0x3a/0xf0\n   ? _raw_spin_lock+0x42/0x50\n   ? tick_periodic+0x3a/0xf0\n   ? tick_periodic+0x3a/0xf0\n   ? debug_smp_processor_id+0x12/0x20\n   ? tick_handle_periodic+0x23/0xc0\n   ? local_apic_timer_interrupt+0x63/0x70\n   ? smp_trace_apic_timer_interrupt+0x235/0x6a0\n   ? trace_apic_timer_interrupt+0x37/0x3c\n   ? strrchr+0x23/0x50\n  Code: 0f 95 c1 89 c7 89 45 e4 0f b6 c1 89 c6 89 45 dc 8b 04 85 98 cb 74 bc 88 4d e3 89 45 f0 83 c0 01 84 c9 89 04 b5 98 cb 74 bc 74 3b <8b> 47 38 8b 57 34 c6 43 1d 01 25 00 00 02 00 83 e2 03 09 d0 83\n  EIP: update_stack_state+0xd4/0x340 SS:ESP: 0068:bb3adc3f\n  CR2: 00000000000001f2\n  ---[ end trace 0d147fd4aba8ff50 ]---\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nOn x86-32, after decoding a frame pointer to get a regs address,\nregs_size() dereferences the regs pointer when it checks regs->cs to see\nif the regs are user mode.  This is dangerous because it's possible that\nwhat looks like a decoded frame pointer is actually a corrupt value, and\nwe don't want the unwinder to make things worse.\n\nInstead of calling regs_size() on an unsafe pointer, just assume they're\nkernel regs to start with.  Later, once it's safe to access the regs, we\ncan do the user mode check and corresponding safety check for the\nremaining two regs.\n\nReported-and-tested-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>\nReported-and-tested-by: Fengguang Wu <fengguang.wu@intel.com>\nSigned-off-by: Josh Poimboeuf <jpoimboe@redhat.com>\nCc: Byungchul Park <byungchul.park@lge.com>\nCc: LKP <lkp@01.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nFixes: 5ed8d8bb38c5 (\"x86/unwind: Move common code into update_stack_state()\")\nLink: http://lkml.kernel.org/r/7f95b9a6993dec7674b3f3ab3dcd3294f7b9644d.1507597785.git.jpoimboe@redhat.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/62dd86ac01f9fb6386d7f8c6b389c3ea4582a50a"},{"sha":"5c99b692cfd62f6915ed7ee7ed3c38d65ba3feab","author":{"name":"Josh Poimboeuf","email":"e3c4f83d6dbbf85df94c8b24fb0cf20a5e953120@redhat.com"},"message":"x86/unwind: Use MSB for frame pointer encoding on 32-bit\n\nOn x86-32, Tetsuo Handa and Fengguang Wu reported unwinder warnings\nlike:\n\n  WARNING: kernel stack regs at f60bb9c8 in swapper:1 has bad 'bp' value 0ba00000\n\nAnd also there were some stack dumps with a bunch of unreliable '?'\nsymbols after an apic_timer_interrupt symbol, meaning the unwinder got\nconfused when it tried to read the regs.\n\nThe cause of those issues is that, with GCC 4.8 (and possibly older),\nthere are cases where GCC misaligns the stack pointer in a leaf function\nfor no apparent reason:\n\n  c124a388 <acpi_rs_move_data>:\n  c124a388:       55                      push   %ebp\n  c124a389:       89 e5                   mov    %esp,%ebp\n  c124a38b:       57                      push   %edi\n  c124a38c:       56                      push   %esi\n  c124a38d:       89 d6                   mov    %edx,%esi\n  c124a38f:       53                      push   %ebx\n  c124a390:       31 db                   xor    %ebx,%ebx\n  c124a392:       83 ec 03                sub    $0x3,%esp\n  ...\n  c124a3e3:       83 c4 03                add    $0x3,%esp\n  c124a3e6:       5b                      pop    %ebx\n  c124a3e7:       5e                      pop    %esi\n  c124a3e8:       5f                      pop    %edi\n  c124a3e9:       5d                      pop    %ebp\n  c124a3ea:       c3                      ret\n\nIf an interrupt occurs in such a function, the regs on the stack will be\nunaligned, which breaks the frame pointer encoding assumption.  So on\n32-bit, use the MSB instead of the LSB to encode the regs.\n\nThis isn't an issue on 64-bit, because interrupts align the stack before\nwriting to it.\n\nReported-and-tested-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>\nReported-and-tested-by: Fengguang Wu <fengguang.wu@intel.com>\nSigned-off-by: Josh Poimboeuf <jpoimboe@redhat.com>\nCc: Byungchul Park <byungchul.park@lge.com>\nCc: LKP <lkp@01.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nLink: http://lkml.kernel.org/r/279a26996a482ca716605c7dbc7f2db9d8d91e81.1507597785.git.jpoimboe@redhat.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/5c99b692cfd62f6915ed7ee7ed3c38d65ba3feab"},{"sha":"99bd28a49b150e4b938313a63b5532d95ba77885","author":{"name":"Josh Poimboeuf","email":"e3c4f83d6dbbf85df94c8b24fb0cf20a5e953120@redhat.com"},"message":"x86/unwind: Align stack pointer in unwinder dump\n\nWhen printing the unwinder dump, the stack pointer could be unaligned,\nfor one of two reasons:\n\n- stack corruption; or\n\n- GCC created an unaligned stack.\n\nThere's no way for the unwinder to tell the difference between the two,\nso we have to assume one or the other.  GCC unaligned stacks are very\nrare, and have only been spotted before GCC 5.  Presumably, if we're\ndoing an unwinder stack dump, stack corruption is more likely than a\nGCC unaligned stack.  So always align the stack before starting the\ndump.\n\nReported-and-tested-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>\nReported-and-tested-by: Fengguang Wu <fengguang.wu@intel.com>\nSigned-off-by: Josh Poimboeuf <jpoimboe@redhat.com>\nCc: Byungchul Park <byungchul.park@lge.com>\nCc: LKP <lkp@01.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nLink: http://lkml.kernel.org/r/2f540c515946ab09ed267e1a1d6421202a0cce08.1507597785.git.jpoimboe@redhat.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/99bd28a49b150e4b938313a63b5532d95ba77885"},{"sha":"d4a2d031dd42f9594107d317e2a9a0c6d73ad46b","author":{"name":"Josh Poimboeuf","email":"e3c4f83d6dbbf85df94c8b24fb0cf20a5e953120@redhat.com"},"message":"x86/unwind: Disable unwinder warnings on 32-bit\n\nx86-32 doesn't have stack validation, so in most cases it doesn't make\nsense to warn about bad frame pointers.\n\nReported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>\nSigned-off-by: Josh Poimboeuf <jpoimboe@redhat.com>\nCc: Byungchul Park <byungchul.park@lge.com>\nCc: Fengguang Wu <fengguang.wu@intel.com>\nCc: LKP <lkp@01.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nLink: http://lkml.kernel.org/r/a69658760800bf281e6353248c23e0fa0acf5230.1507597785.git.jpoimboe@redhat.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/d4a2d031dd42f9594107d317e2a9a0c6d73ad46b"},{"sha":"629eb703d3e46aa570c6c91235d38fd09ed8c58b","author":{"name":"Colin Ian King","email":"61b69653f478c16de27cbf2a77617b5a614a704a@canonical.com"},"message":"perf/x86/intel/uncore: Fix memory leaks on allocation failures\n\nCurrently if an allocation fails then the error return paths\ndon't free up any currently allocated pmus[].boxes and pmus causing\na memory leak.  Add an error clean up exit path that frees these\nobjects.\n\nDetected by CoverityScan, CID#711632 (\"Resource Leak\")\n\nSigned-off-by: Colin Ian King <colin.king@canonical.com>\nAcked-by: Peter Zijlstra <peterz@infradead.org>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: kernel-janitors@vger.kernel.org\nFixes: 087bfbb03269 (\"perf/x86: Add generic Intel uncore PMU support\")\nLink: http://lkml.kernel.org/r/20171009172655.6132-1-colin.king@canonical.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/629eb703d3e46aa570c6c91235d38fd09ed8c58b"},{"sha":"a3b7424392924e778b608e30ee321f7b10cc94b8","author":{"name":"Vitaly Kuznetsov","email":"697ca8eff99222fe467efcff4e74ccad85cd3236@redhat.com"},"message":"x86/hyperv: Clear vCPU banks between calls to avoid flushing unneeded vCPUs\n\nhv_flush_pcpu_ex structures are not cleared between calls for performance\nreasons (they're variable size up to PAGE_SIZE each) but we must clear\nhv_vp_set.bank_contents part of it to avoid flushing unneeded vCPUs. The\nrest of the structure is formed correctly.\n\nTo do the clearing in an efficient way stash the maximum possible vCPU\nnumber (this may differ from Linux CPU id).\n\nReported-by: Jork Loeser <Jork.Loeser@microsoft.com>\nSigned-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>\nCc: Dexuan Cui <decui@microsoft.com>\nCc: Haiyang Zhang <haiyangz@microsoft.com>\nCc: K. Y. Srinivasan <kys@microsoft.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Stephen Hemminger <sthemmin@microsoft.com>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: devel@linuxdriverproject.org\nLink: http://lkml.kernel.org/r/20171006154854.18092-1-vkuznets@redhat.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/a3b7424392924e778b608e30ee321f7b10cc94b8"},{"sha":"60d73a7c96601434dfdb56d5b9167ff3b850d8d7","author":{"name":"Vitaly Kuznetsov","email":"697ca8eff99222fe467efcff4e74ccad85cd3236@redhat.com"},"message":"x86/hyperv: Don't use percpu areas for pcpu_flush/pcpu_flush_ex structures\n\nhv_do_hypercall() does virt_to_phys() translation and with some configs\n(CONFIG_SLAB) this doesn't work for percpu areas, we pass wrong memory to\nhypervisor and get #GP. We could use working slow_virt_to_phys() instead\nbut doing so kills the performance.\n\nMove pcpu_flush/pcpu_flush_ex structures out of percpu areas and\nallocate memory on first call. The additional level of indirection gives\nus a small performance penalty, in future we may consider introducing\nhypercall functions which avoid virt_to_phys() conversion and cache\nphysical addresses of pcpu_flush/pcpu_flush_ex structures somewhere.\n\nReported-by: Simon Xiao <sixiao@microsoft.com>\nSigned-off-by: Vitaly Kuznetsov <vkuznets@redhat.com>\nCc: Dexuan Cui <decui@microsoft.com>\nCc: Haiyang Zhang <haiyangz@microsoft.com>\nCc: Jork Loeser <Jork.Loeser@microsoft.com>\nCc: K. Y. Srinivasan <kys@microsoft.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Stephen Hemminger <sthemmin@microsoft.com>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: devel@linuxdriverproject.org\nLink: http://lkml.kernel.org/r/20171005113924.28021-1-vkuznets@redhat.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/60d73a7c96601434dfdb56d5b9167ff3b850d8d7"},{"sha":"ab7ff471aa5db670197070760f022622793da7e5","author":{"name":"Marcelo Henrique Cerri","email":"307ad3d69eae3873e2ce817deae98a400effd572@canonical.com"},"message":"x86/hyperv: Fix hypercalls with extended CPU ranges for TLB flushing\n\nDo not consider the fixed size of hv_vp_set when passing the variable\nheader size to hv_do_rep_hypercall().\n\nThe Hyper-V hypervisor specification states that for a hypercall with a\nvariable header only the size of the variable portion should be supplied\nvia the input control.\n\nFor HVCALL_FLUSH_VIRTUAL_ADDRESS_SPACE_EX/LIST_EX calls that means the\nfixed portion of hv_vp_set should not be considered.\n\nThat fixes random failures of some applications that are unexpectedly\nkilled with SIGBUS or SIGSEGV.\n\nSigned-off-by: Marcelo Henrique Cerri <marcelo.cerri@canonical.com>\nCc: Dexuan Cui <decui@microsoft.com>\nCc: Haiyang Zhang <haiyangz@microsoft.com>\nCc: Jork Loeser <Jork.Loeser@microsoft.com>\nCc: Josh Poulson <jopoulso@microsoft.com>\nCc: K. Y. Srinivasan <kys@microsoft.com>\nCc: Linus Torvalds <torvalds@linux-foundation.org>\nCc: Peter Zijlstra <peterz@infradead.org>\nCc: Simon Xiao <sixiao@microsoft.com>\nCc: Stephen Hemminger <sthemmin@microsoft.com>\nCc: Thomas Gleixner <tglx@linutronix.de>\nCc: Vitaly Kuznetsov <vkuznets@redhat.com>\nCc: devel@linuxdriverproject.org\nFixes: 628f54cc6451 (\"x86/hyper-v: Support extended CPU ranges for TLB flush hypercalls\")\nLink: http://lkml.kernel.org/r/1507210469-29065-1-git-send-email-marcelo.cerri@canonical.com\nSigned-off-by: Ingo Molnar <mingo@kernel.org>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/ab7ff471aa5db670197070760f022622793da7e5"},{"sha":"124751d5e63c823092060074bd0abaae61aaa9c4","author":{"name":"Takashi Iwai","email":"dd0a9a4ae370c51e6d7099900a4bf6656524e055@suse.de"},"message":"ALSA: usb-audio: Kill stray URB at exiting\n\nUSB-audio driver may leave a stray URB for the mixer interrupt when it\nexits by some error during probe.  This leads to a use-after-free\nerror as spotted by syzkaller like:\n  ==================================================================\n  BUG: KASAN: use-after-free in snd_usb_mixer_interrupt+0x604/0x6f0\n  Call Trace:\n   <IRQ>\n   __dump_stack lib/dump_stack.c:16\n   dump_stack+0x292/0x395 lib/dump_stack.c:52\n   print_address_description+0x78/0x280 mm/kasan/report.c:252\n   kasan_report_error mm/kasan/report.c:351\n   kasan_report+0x23d/0x350 mm/kasan/report.c:409\n   __asan_report_load8_noabort+0x19/0x20 mm/kasan/report.c:430\n   snd_usb_mixer_interrupt+0x604/0x6f0 sound/usb/mixer.c:2490\n   __usb_hcd_giveback_urb+0x2e0/0x650 drivers/usb/core/hcd.c:1779\n   ....\n\n  Allocated by task 1484:\n   save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59\n   save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n   set_track mm/kasan/kasan.c:459\n   kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551\n   kmem_cache_alloc_trace+0x11e/0x2d0 mm/slub.c:2772\n   kmalloc ./include/linux/slab.h:493\n   kzalloc ./include/linux/slab.h:666\n   snd_usb_create_mixer+0x145/0x1010 sound/usb/mixer.c:2540\n   create_standard_mixer_quirk+0x58/0x80 sound/usb/quirks.c:516\n   snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560\n   create_composite_quirk+0x1c4/0x3e0 sound/usb/quirks.c:59\n   snd_usb_create_quirk+0x92/0x100 sound/usb/quirks.c:560\n   usb_audio_probe+0x1040/0x2c10 sound/usb/card.c:618\n   ....\n\n  Freed by task 1484:\n   save_stack_trace+0x1b/0x20 arch/x86/kernel/stacktrace.c:59\n   save_stack+0x43/0xd0 mm/kasan/kasan.c:447\n   set_track mm/kasan/kasan.c:459\n   kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:524\n   slab_free_hook mm/slub.c:1390\n   slab_free_freelist_hook mm/slub.c:1412\n   slab_free mm/slub.c:2988\n   kfree+0xf6/0x2f0 mm/slub.c:3919\n   snd_usb_mixer_free+0x11a/0x160 sound/usb/mixer.c:2244\n   snd_usb_mixer_dev_free+0x36/0x50 sound/usb/mixer.c:2250\n   __snd_device_free+0x1ff/0x380 sound/core/device.c:91\n   snd_device_free_all+0x8f/0xe0 sound/core/device.c:244\n   snd_card_do_free sound/core/init.c:461\n   release_card_device+0x47/0x170 sound/core/init.c:181\n   device_release+0x13f/0x210 drivers/base/core.c:814\n   ....\n\nActually such a URB is killed properly at disconnection when the\ndevice gets probed successfully, and what we need is to apply it for\nthe error-path, too.\n\nIn this patch, we apply snd_usb_mixer_disconnect() at releasing.\nAlso introduce a new flag, disconnected, to struct usb_mixer_interface\nfor not performing the disconnection procedure twice.\n\nReported-by: Andrey Konovalov <andreyknvl@google.com>\nTested-by: Andrey Konovalov <andreyknvl@google.com>\nCc: <stable@vger.kernel.org>\nSigned-off-by: Takashi Iwai <tiwai@suse.de>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/124751d5e63c823092060074bd0abaae61aaa9c4"},{"sha":"eac779aa509d453a55da0ea4302bdb79c4e0854f","author":{"name":"Zhenzhong Duan","email":"9a86f758d3fdefc76c7bf3674ae8b6e0b6ffafa7@oracle.com"},"message":"xen/vcpu: Use a unified name about cpu hotplug state for pv and pvhvm\n\nAs xen_cpuhp_setup is called by PV and PVHVM, the name of \"x86/xen/hvm_guest\"\nis confusing.\n\nSigned-off-by: Zhenzhong Duan <zhenzhong.duan@oracle.com>\nReviewed-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>\nSigned-off-by: Boris Ostrovsky <boris.ostrovsky@oracle.com>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/eac779aa509d453a55da0ea4302bdb79c4e0854f"},{"sha":"fd19d3b45164466a4adce7cbff448ba9189e1427","author":{"name":"Ladi Prosek","email":"ae06481863829f337b2194a53db4e73276e0bd63@redhat.com"},"message":"KVM: nVMX: update last_nonleaf_level when initializing nested EPT\n\nThe function updates context->root_level but didn't call\nupdate_last_nonleaf_level so the previous and potentially wrong value\nwas used for page walks.  For example, a zero value of last_nonleaf_level\nwould allow a potential out-of-bounds access in arch/x86/mmu/paging_tmpl.h's\nwalk_addr_generic function (CVE-2017-12188).\n\nFixes: 155a97a3d7c78b46cef6f1a973c831bc5a4f82bb\nSigned-off-by: Ladi Prosek <lprosek@redhat.com>\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/fd19d3b45164466a4adce7cbff448ba9189e1427"},{"sha":"829ee279aed43faa5cb1e4d65c0cad52f2426c53","author":{"name":"Ladi Prosek","email":"ae06481863829f337b2194a53db4e73276e0bd63@redhat.com"},"message":"KVM: MMU: always terminate page walks at level 1\n\nis_last_gpte() is not equivalent to the pseudo-code given in commit\n6bb69c9b69c31 (\"KVM: MMU: simplify last_pte_bitmap\") because an incorrect\nvalue of last_nonleaf_level may override the result even if level == 1.\n\nIt is critical for is_last_gpte() to return true on level == 1 to\nterminate page walks. Otherwise memory corruption may occur as level\nis used as an index to various data structures throughout the page\nwalking code.  Even though the actual bug would be wherever the MMU is\ninitialized (as in the previous patch), be defensive and ensure here\nthat is_last_gpte() returns the correct value.\n\nThis patch is also enough to fix CVE-2017-12188.\n\nFixes: 6bb69c9b69c315200ddc2bc79aee14c0184cf5b2\nCc: stable@vger.kernel.org\nCc: Andy Honig <ahonig@google.com>\nSigned-off-by: Ladi Prosek <lprosek@redhat.com>\n[Panic if walk_addr_generic gets an incorrect level; this is a serious\n bug and it's not worth a WARN_ON where the recovery path might hide\n further exploitable issues; suggested by Andrew Honig. - Paolo]\nSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>","distinct":true,"url":"https://api.github.com/repos/htot/linux/commits/829ee279aed43faa5cb1e4d65c0cad52f2426c53"}]}
{"actor":{"display_login":"htot"}}