# git rev-parse -q --verify ad7b4e8022b9864c075fe71e1328b1d25cad82f6^{commit} ad7b4e8022b9864c075fe71e1328b1d25cad82f6 already have revision, skipping fetch # git checkout -q -f -B kisskb ad7b4e8022b9864c075fe71e1328b1d25cad82f6 # git clean -qxdf # < git log -1 # commit ad7b4e8022b9864c075fe71e1328b1d25cad82f6 # Author: Frederic Barrat # Date: Tue Apr 3 15:54:02 2018 +0200 # # cxl: Fix possible deadlock when processing page faults from cxllib # # cxllib_handle_fault() is called by an external driver when it needs to # have the host resolve page faults for a buffer. The buffer can cover # several pages and VMAs. The function iterates over all the pages used # by the buffer, based on the page size of the VMA. # # To ensure some stability while processing the faults, the thread T1 # grabs the mm->mmap_sem semaphore with read access (R1). However, when # processing a page fault for a single page, one of the underlying # functions, copro_handle_mm_fault(), also grabs the same semaphore with # read access (R2). So the thread T1 takes the semaphore twice. # # If another thread T2 tries to access the semaphore in write mode W1 # (say, because it wants to allocate memory and calls 'brk'), then that # thread T2 will have to wait because there's a reader (R1). If the # thread T1 is processing a new page at that time, it won't get an # automatic grant at R2, because there's now a writer thread # waiting (T2). And we have a deadlock. # # The timeline is: # 1. thread T1 owns the semaphore with read access R1 # 2. thread T2 requests write access W1 and waits # 3. thread T1 requests read access R2 and waits # # The fix is for the thread T1 to release the semaphore R1 once it got # the information it needs from the current VMA. The address space/VMAs # could evolve while T1 iterates over the full buffer, but in the # unlikely case where T1 misses a page, the external driver will raise a # new page fault when retrying the memory access. # # Fixes: 3ced8d730063 ("cxl: Export library to support IBM XSL") # Cc: stable@vger.kernel.org # 4.13+ # Signed-off-by: Frederic Barrat # Signed-off-by: Michael Ellerman # < /opt/cross/kisskb/gcc-5.3.0-nolibc/powerpc64-linux/bin/powerpc64-linux-gcc --version # < git log --format=%s --max-count=1 ad7b4e8022b9864c075fe71e1328b1d25cad82f6 # < make -s -j 80 ARCH=powerpc O=/kisskb/build/powerpc-next_allmodconfig+64K_PAGES_powerpc-5.3 CROSS_COMPILE=/opt/cross/kisskb/gcc-5.3.0-nolibc/powerpc64-linux/bin/powerpc64-linux- allmodconfig # Added to kconfig CONFIG_BUILD_DOCSRC=n # Added to kconfig CONFIG_MODULE_SIG=n # Added to kconfig CONFIG_SAMPLES=n # Added to kconfig CONFIG_PPC_4K_PAGES=n # Added to kconfig CONFIG_PPC_64K_PAGES=y # yes \n | make -s -j 80 ARCH=powerpc O=/kisskb/build/powerpc-next_allmodconfig+64K_PAGES_powerpc-5.3 CROSS_COMPILE=/opt/cross/kisskb/gcc-5.3.0-nolibc/powerpc64-linux/bin/powerpc64-linux- oldconfig yes: standard output: Broken pipe yes: write error # make -s -j 80 ARCH=powerpc O=/kisskb/build/powerpc-next_allmodconfig+64K_PAGES_powerpc-5.3 CROSS_COMPILE=/opt/cross/kisskb/gcc-5.3.0-nolibc/powerpc64-linux/bin/powerpc64-linux- /kisskb/src/sound/aoa/codecs/onyx.c: In function 'onyx_snd_single_bit_get': /kisskb/src/sound/aoa/codecs/onyx.c:380:37: warning: 'c' may be used uninitialized in this function [-Wmaybe-uninitialized] ucontrol->value.integer.value[0] = !!(c & mask) ^ polarity; ^ In file included from /kisskb/src/include/linux/io.h:25:0, from /kisskb/src/include/linux/of_address.h:7, from /kisskb/src/drivers/ata/ahci_qoriq.c:18: /kisskb/src/drivers/ata/ahci_qoriq.c: In function 'ahci_qoriq_hardreset': /kisskb/src/arch/powerpc/include/asm/io.h:625:3: warning: 'px_is' may be used uninitialized in this function [-Wmaybe-uninitialized] ppc_pci_io.name al; \ ^ /kisskb/src/drivers/ata/ahci_qoriq.c:86:14: note: 'px_is' was declared here u32 px_cmd, px_is, px_val; ^ In file included from /kisskb/src/include/linux/io.h:25:0, from /kisskb/src/include/linux/of_address.h:7, from /kisskb/src/drivers/ata/ahci_qoriq.c:18: /kisskb/src/arch/powerpc/include/asm/io.h:144:2: warning: 'px_cmd' may be used uninitialized in this function [-Wmaybe-uninitialized] __asm__ __volatile__("sync;"#insn" %1,%y0" \ ^ /kisskb/src/drivers/ata/ahci_qoriq.c:86:6: note: 'px_cmd' was declared here u32 px_cmd, px_is, px_val; ^ /kisskb/src/drivers/input/joystick/analog.c:176:2: warning: #warning Precise timer not defined for this architecture. [-Wcpp] #warning Precise timer not defined for this architecture. ^ WARNING: vmlinux.o(.text+0x27bc0): Section mismatch in reference from the function .setup_rfi_flush() to the function .init.text:.ppc64_bolted_size() The function .setup_rfi_flush() references the function __init .ppc64_bolted_size(). This is often because .setup_rfi_flush lacks a __init annotation or the annotation of .ppc64_bolted_size is wrong. WARNING: vmlinux.o(.text+0x27bf0): Section mismatch in reference from the function .setup_rfi_flush() to the function .init.text:.memblock_alloc_base() The function .setup_rfi_flush() references the function __init .memblock_alloc_base(). This is often because .setup_rfi_flush lacks a __init annotation or the annotation of .memblock_alloc_base is wrong. WARNING: vmlinux.o(.text+0x36d24c): Section mismatch in reference from the function .devm_memremap_pages() to the function .meminit.text:.arch_add_memory() The function .devm_memremap_pages() references the function __meminit .arch_add_memory(). This is often because .devm_memremap_pages lacks a __meminit annotation or the annotation of .arch_add_memory is wrong. WARNING: vmlinux.o(.text+0x36db48): Section mismatch in reference from the function .devm_memremap_pages_release() to the function .meminit.text:.arch_remove_memory() The function .devm_memremap_pages_release() references the function __meminit .arch_remove_memory(). This is often because .devm_memremap_pages_release lacks a __meminit annotation or the annotation of .arch_remove_memory is wrong. WARNING: vmlinux.o(.text+0x48e1bc): Section mismatch in reference from the function .hmm_devmem_release() to the function .meminit.text:.arch_remove_memory() The function .hmm_devmem_release() references the function __meminit .arch_remove_memory(). This is often because .hmm_devmem_release lacks a __meminit annotation or the annotation of .arch_remove_memory is wrong. WARNING: vmlinux.o(.text+0x48e698): Section mismatch in reference from the function .hmm_devmem_pages_create() to the function .meminit.text:.arch_add_memory() The function .hmm_devmem_pages_create() references the function __meminit .arch_add_memory(). This is often because .hmm_devmem_pages_create lacks a __meminit annotation or the annotation of .arch_add_memory is wrong. Completed OK # rm -rf /kisskb/build/powerpc-next_allmodconfig+64K_PAGES_powerpc-5.3 # Build took: 0:13:14.436724