<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux-toradex.git/fs, branch v4.9.42</title>
<subtitle>Linux kernel for Apalis and Colibri modules</subtitle>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/'/>
<entry>
<title>Btrfs: fix early ENOSPC due to delalloc</title>
<updated>2017-08-11T15:49:31+00:00</updated>
<author>
<name>Omar Sandoval</name>
<email>osandov@fb.com</email>
</author>
<published>2017-07-20T22:10:35+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=3a63729427acd0ee9f6265d20cf3b9890e8d7a96'/>
<id>3a63729427acd0ee9f6265d20cf3b9890e8d7a96</id>
<content type='text'>
commit 17024ad0a0fdfcfe53043afb969b813d3e020c21 upstream.

If a lot of metadata is reserved for outstanding delayed allocations, we
rely on shrink_delalloc() to reclaim metadata space in order to fulfill
reservation tickets. However, shrink_delalloc() has a shortcut where if
it determines that space can be overcommitted, it will stop early. This
made sense before the ticketed enospc system, but now it means that
shrink_delalloc() will often not reclaim enough space to fulfill any
tickets, leading to an early ENOSPC. (Reservation tickets don't care
about being able to overcommit, they need every byte accounted for.)

Fix it by getting rid of the shortcut so that shrink_delalloc() reclaims
all of the metadata it is supposed to. This fixes early ENOSPCs we were
seeing when doing a btrfs receive to populate a new filesystem, as well
as early ENOSPCs Christoph saw when doing a big cp -r onto Btrfs.

Fixes: 957780eb2788 ("Btrfs: introduce ticketed enospc infrastructure")
Tested-by: Christoph Anton Mitterer &lt;mail@christoph.anton.mitterer.name&gt;
Reviewed-by: Josef Bacik &lt;jbacik@fb.com&gt;
Signed-off-by: Omar Sandoval &lt;osandov@fb.com&gt;
Signed-off-by: David Sterba &lt;dsterba@suse.com&gt;
Signed-off-by: Nikolay Borisov &lt;nborisov@suse.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 17024ad0a0fdfcfe53043afb969b813d3e020c21 upstream.

If a lot of metadata is reserved for outstanding delayed allocations, we
rely on shrink_delalloc() to reclaim metadata space in order to fulfill
reservation tickets. However, shrink_delalloc() has a shortcut where if
it determines that space can be overcommitted, it will stop early. This
made sense before the ticketed enospc system, but now it means that
shrink_delalloc() will often not reclaim enough space to fulfill any
tickets, leading to an early ENOSPC. (Reservation tickets don't care
about being able to overcommit, they need every byte accounted for.)

Fix it by getting rid of the shortcut so that shrink_delalloc() reclaims
all of the metadata it is supposed to. This fixes early ENOSPCs we were
seeing when doing a btrfs receive to populate a new filesystem, as well
as early ENOSPCs Christoph saw when doing a big cp -r onto Btrfs.

Fixes: 957780eb2788 ("Btrfs: introduce ticketed enospc infrastructure")
Tested-by: Christoph Anton Mitterer &lt;mail@christoph.anton.mitterer.name&gt;
Reviewed-by: Josef Bacik &lt;jbacik@fb.com&gt;
Signed-off-by: Omar Sandoval &lt;osandov@fb.com&gt;
Signed-off-by: David Sterba &lt;dsterba@suse.com&gt;
Signed-off-by: Nikolay Borisov &lt;nborisov@suse.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>f2fs: sanity check checkpoint segno and blkoff</title>
<updated>2017-08-11T15:49:31+00:00</updated>
<author>
<name>Jin Qian</name>
<email>jinqian@google.com</email>
</author>
<published>2017-05-15T17:45:08+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=0f442c5b2e4ac0b65027ed3374462f1c38675f7e'/>
<id>0f442c5b2e4ac0b65027ed3374462f1c38675f7e</id>
<content type='text'>
commit 15d3042a937c13f5d9244241c7a9c8416ff6e82a upstream.

Make sure segno and blkoff read from raw image are valid.

Cc: stable@vger.kernel.org
Signed-off-by: Jin Qian &lt;jinqian@google.com&gt;
[Jaegeuk Kim: adjust minor coding style]
Signed-off-by: Jaegeuk Kim &lt;jaegeuk@kernel.org&gt;
[AmitP: Found in Android Security bulletin for Aug'17, fixes CVE-2017-10663]
Signed-off-by: Amit Pundir &lt;amit.pundir@linaro.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 15d3042a937c13f5d9244241c7a9c8416ff6e82a upstream.

Make sure segno and blkoff read from raw image are valid.

Cc: stable@vger.kernel.org
Signed-off-by: Jin Qian &lt;jinqian@google.com&gt;
[Jaegeuk Kim: adjust minor coding style]
Signed-off-by: Jaegeuk Kim &lt;jaegeuk@kernel.org&gt;
[AmitP: Found in Android Security bulletin for Aug'17, fixes CVE-2017-10663]
Signed-off-by: Amit Pundir &lt;amit.pundir@linaro.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>ext4: fix overflow caused by missing cast in ext4_resize_fs()</title>
<updated>2017-08-11T15:49:30+00:00</updated>
<author>
<name>Jerry Lee</name>
<email>jerrylee@qnap.com</email>
</author>
<published>2017-08-06T05:18:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=12353a00df25d5c8da8de8c60b705e5ccc436cfe'/>
<id>12353a00df25d5c8da8de8c60b705e5ccc436cfe</id>
<content type='text'>
commit aec51758ce10a9c847a62a48a168f8c804c6e053 upstream.

On a 32-bit platform, the value of n_blcoks_count may be wrong during
the file system is resized to size larger than 2^32 blocks.  This may
caused the superblock being corrupted with zero blocks count.

Fixes: 1c6bd7173d66
Signed-off-by: Jerry Lee &lt;jerrylee@qnap.com&gt;
Signed-off-by: Theodore Ts'o &lt;tytso@mit.edu&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit aec51758ce10a9c847a62a48a168f8c804c6e053 upstream.

On a 32-bit platform, the value of n_blcoks_count may be wrong during
the file system is resized to size larger than 2^32 blocks.  This may
caused the superblock being corrupted with zero blocks count.

Fixes: 1c6bd7173d66
Signed-off-by: Jerry Lee &lt;jerrylee@qnap.com&gt;
Signed-off-by: Theodore Ts'o &lt;tytso@mit.edu&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>ext4: fix SEEK_HOLE/SEEK_DATA for blocksize &lt; pagesize</title>
<updated>2017-08-11T15:49:30+00:00</updated>
<author>
<name>Jan Kara</name>
<email>jack@suse.cz</email>
</author>
<published>2017-08-05T21:43:24+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=0814c3a9447ba284ef91b2d27755bf5a4514ca64'/>
<id>0814c3a9447ba284ef91b2d27755bf5a4514ca64</id>
<content type='text'>
commit fcf5ea10992fbac3c7473a1db33d56a139333cd1 upstream.

ext4_find_unwritten_pgoff() does not properly handle a situation when
starting index is in the middle of a page and blocksize &lt; pagesize. The
following command shows the bug on filesystem with 1k blocksize:

  xfs_io -f -c "falloc 0 4k" \
            -c "pwrite 1k 1k" \
            -c "pwrite 3k 1k" \
            -c "seek -a -r 0" foo

In this example, neither lseek(fd, 1024, SEEK_HOLE) nor lseek(fd, 2048,
SEEK_DATA) will return the correct result.

Fix the problem by neglecting buffers in a page before starting offset.

Reported-by: Andreas Gruenbacher &lt;agruenba@redhat.com&gt;
Signed-off-by: Theodore Ts'o &lt;tytso@mit.edu&gt;
Signed-off-by: Jan Kara &lt;jack@suse.cz&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit fcf5ea10992fbac3c7473a1db33d56a139333cd1 upstream.

ext4_find_unwritten_pgoff() does not properly handle a situation when
starting index is in the middle of a page and blocksize &lt; pagesize. The
following command shows the bug on filesystem with 1k blocksize:

  xfs_io -f -c "falloc 0 4k" \
            -c "pwrite 1k 1k" \
            -c "pwrite 3k 1k" \
            -c "seek -a -r 0" foo

In this example, neither lseek(fd, 1024, SEEK_HOLE) nor lseek(fd, 2048,
SEEK_DATA) will return the correct result.

Fix the problem by neglecting buffers in a page before starting offset.

Reported-by: Andreas Gruenbacher &lt;agruenba@redhat.com&gt;
Signed-off-by: Theodore Ts'o &lt;tytso@mit.edu&gt;
Signed-off-by: Jan Kara &lt;jack@suse.cz&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>NFSv4: Fix EXCHANGE_ID corrupt verifier issue</title>
<updated>2017-08-11T15:49:28+00:00</updated>
<author>
<name>Trond Myklebust</name>
<email>trond.myklebust@primarydata.com</email>
</author>
<published>2017-08-01T20:02:47+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=f7d3e54fb40cfc6f829b8f8ad3aab026714f2ffc'/>
<id>f7d3e54fb40cfc6f829b8f8ad3aab026714f2ffc</id>
<content type='text'>
commit fd40559c8657418385e42f797e0b04bfc0add748 upstream.

The verifier is allocated on the stack, but the EXCHANGE_ID RPC call was
changed to be asynchronous by commit 8d89bd70bc939. If we interrrupt
the call to rpc_wait_for_completion_task(), we can therefore end up
transmitting random stack contents in lieu of the verifier.

Fixes: 8d89bd70bc939 ("NFS setup async exchange_id")
Signed-off-by: Trond Myklebust &lt;trond.myklebust@primarydata.com&gt;
Signed-off-by: Anna Schumaker &lt;Anna.Schumaker@Netapp.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit fd40559c8657418385e42f797e0b04bfc0add748 upstream.

The verifier is allocated on the stack, but the EXCHANGE_ID RPC call was
changed to be asynchronous by commit 8d89bd70bc939. If we interrrupt
the call to rpc_wait_for_completion_task(), we can therefore end up
transmitting random stack contents in lieu of the verifier.

Fixes: 8d89bd70bc939 ("NFS setup async exchange_id")
Signed-off-by: Trond Myklebust &lt;trond.myklebust@primarydata.com&gt;
Signed-off-by: Anna Schumaker &lt;Anna.Schumaker@Netapp.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>Btrfs: adjust outstanding_extents counter properly when dio write is split</title>
<updated>2017-08-07T01:59:47+00:00</updated>
<author>
<name>Liu Bo</name>
<email>bo.li.liu@oracle.com</email>
</author>
<published>2016-12-23T01:13:54+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=f76ddff6c5215131483efed20acc896e021abb9f'/>
<id>f76ddff6c5215131483efed20acc896e021abb9f</id>
<content type='text'>
[ Upstream commit c2931667c83ded6504b3857e99cc45b21fa496fb ]

Currently how btrfs dio deals with split dio write is not good
enough if dio write is split into several segments due to the
lack of contiguous space, a large dio write like 'dd bs=1G count=1'
can end up with incorrect outstanding_extents counter and endio
would complain loudly with an assertion.

This fixes the problem by compensating the outstanding_extents
counter in inode if a large dio write gets split.

Reported-by: Anand Jain &lt;anand.jain@oracle.com&gt;
Tested-by: Anand Jain &lt;anand.jain@oracle.com&gt;
Signed-off-by: Liu Bo &lt;bo.li.liu@oracle.com&gt;
Signed-off-by: David Sterba &lt;dsterba@suse.com&gt;
Signed-off-by: Sasha Levin &lt;alexander.levin@verizon.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit c2931667c83ded6504b3857e99cc45b21fa496fb ]

Currently how btrfs dio deals with split dio write is not good
enough if dio write is split into several segments due to the
lack of contiguous space, a large dio write like 'dd bs=1G count=1'
can end up with incorrect outstanding_extents counter and endio
would complain loudly with an assertion.

This fixes the problem by compensating the outstanding_extents
counter in inode if a large dio write gets split.

Reported-by: Anand Jain &lt;anand.jain@oracle.com&gt;
Tested-by: Anand Jain &lt;anand.jain@oracle.com&gt;
Signed-off-by: Liu Bo &lt;bo.li.liu@oracle.com&gt;
Signed-off-by: David Sterba &lt;dsterba@suse.com&gt;
Signed-off-by: Sasha Levin &lt;alexander.levin@verizon.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Btrfs: fix lockdep warning about log_mutex</title>
<updated>2017-08-07T01:59:47+00:00</updated>
<author>
<name>Liu Bo</name>
<email>bo.li.liu@oracle.com</email>
</author>
<published>2016-12-01T00:20:25+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=6731212836059c7ac3575e21c499380e795516a9'/>
<id>6731212836059c7ac3575e21c499380e795516a9</id>
<content type='text'>
[ Upstream commit 781feef7e6befafd4d9787d1f7ada1f9ccd504e4 ]

While checking INODE_REF/INODE_EXTREF for a corner case, we may acquire a
different inode's log_mutex with holding the current inode's log_mutex, and
lockdep has complained this with a possilble deadlock warning.

Fix this by using mutex_lock_nested() when processing the other inode's
log_mutex.

Reviewed-by: Filipe Manana &lt;fdmanana@suse.com&gt;
Signed-off-by: Liu Bo &lt;bo.li.liu@oracle.com&gt;
Signed-off-by: David Sterba &lt;dsterba@suse.com&gt;
Signed-off-by: Sasha Levin &lt;alexander.levin@verizon.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit 781feef7e6befafd4d9787d1f7ada1f9ccd504e4 ]

While checking INODE_REF/INODE_EXTREF for a corner case, we may acquire a
different inode's log_mutex with holding the current inode's log_mutex, and
lockdep has complained this with a possilble deadlock warning.

Fix this by using mutex_lock_nested() when processing the other inode's
log_mutex.

Reviewed-by: Filipe Manana &lt;fdmanana@suse.com&gt;
Signed-off-by: Liu Bo &lt;bo.li.liu@oracle.com&gt;
Signed-off-by: David Sterba &lt;dsterba@suse.com&gt;
Signed-off-by: Sasha Levin &lt;alexander.levin@verizon.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Btrfs: use down_read_nested to make lockdep silent</title>
<updated>2017-08-07T01:59:47+00:00</updated>
<author>
<name>Liu Bo</name>
<email>bo.li.liu@oracle.com</email>
</author>
<published>2016-12-01T00:11:04+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=78418b86733462c913aea82e081594b1005751ba'/>
<id>78418b86733462c913aea82e081594b1005751ba</id>
<content type='text'>
[ Upstream commit e321f8a801d7b4c40da8005257b05b9c2b51b072 ]

If @block_group is not @used_bg, it'll try to get @used_bg's lock without
droping @block_group 's lock and lockdep has throwed a scary deadlock warning
about it.
Fix it by using down_read_nested.

Signed-off-by: Liu Bo &lt;bo.li.liu@oracle.com&gt;
Reviewed-by: David Sterba &lt;dsterba@suse.com&gt;
Signed-off-by: David Sterba &lt;dsterba@suse.com&gt;
Signed-off-by: Sasha Levin &lt;alexander.levin@verizon.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
[ Upstream commit e321f8a801d7b4c40da8005257b05b9c2b51b072 ]

If @block_group is not @used_bg, it'll try to get @used_bg's lock without
droping @block_group 's lock and lockdep has throwed a scary deadlock warning
about it.
Fix it by using down_read_nested.

Signed-off-by: Liu Bo &lt;bo.li.liu@oracle.com&gt;
Reviewed-by: David Sterba &lt;dsterba@suse.com&gt;
Signed-off-by: David Sterba &lt;dsterba@suse.com&gt;
Signed-off-by: Sasha Levin &lt;alexander.levin@verizon.com&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>pstore: Use dynamic spinlock initializer</title>
<updated>2017-08-07T01:59:43+00:00</updated>
<author>
<name>Kees Cook</name>
<email>keescook@chromium.org</email>
</author>
<published>2017-03-06T06:08:58+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=e10f7bd6a6b8484ebe140a793d30b0cc56603620'/>
<id>e10f7bd6a6b8484ebe140a793d30b0cc56603620</id>
<content type='text'>
commit e9a330c4289f2ba1ca4bf98c2b430ab165a8931b upstream.

The per-prz spinlock should be using the dynamic initializer so that
lockdep can correctly track it. Without this, under lockdep, we get a
warning at boot that the lock is in non-static memory.

Fixes: 109704492ef6 ("pstore: Make spinlock per zone instead of global")
Fixes: 76d5692a5803 ("pstore: Correctly initialize spinlock and flags")
Signed-off-by: Kees Cook &lt;keescook@chromium.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit e9a330c4289f2ba1ca4bf98c2b430ab165a8931b upstream.

The per-prz spinlock should be using the dynamic initializer so that
lockdep can correctly track it. Without this, under lockdep, we get a
warning at boot that the lock is in non-static memory.

Fixes: 109704492ef6 ("pstore: Make spinlock per zone instead of global")
Fixes: 76d5692a5803 ("pstore: Correctly initialize spinlock and flags")
Signed-off-by: Kees Cook &lt;keescook@chromium.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
<entry>
<title>pstore: Correctly initialize spinlock and flags</title>
<updated>2017-08-07T01:59:43+00:00</updated>
<author>
<name>Kees Cook</name>
<email>keescook@chromium.org</email>
</author>
<published>2017-02-09T23:43:44+00:00</published>
<link rel='alternate' type='text/html' href='https://git.toradex.cn/cgit/linux-toradex.git/commit/?id=a0840275e3ebddd5d1349cd4908777e11ba50311'/>
<id>a0840275e3ebddd5d1349cd4908777e11ba50311</id>
<content type='text'>
commit 76d5692a58031696e282384cbd893832bc92bd76 upstream.

The ram backend wasn't always initializing its spinlock correctly. Since
it was coming from kzalloc memory, though, it was harmless on
architectures that initialize unlocked spinlocks to 0 (at least x86 and
ARM). This also fixes a possibly ignored flag setting too.

When running under CONFIG_DEBUG_SPINLOCK, the following Oops was visible:

[    0.760836] persistent_ram: found existing buffer, size 29988, start 29988
[    0.765112] persistent_ram: found existing buffer, size 30105, start 30105
[    0.769435] persistent_ram: found existing buffer, size 118542, start 118542
[    0.785960] persistent_ram: found existing buffer, size 0, start 0
[    0.786098] persistent_ram: found existing buffer, size 0, start 0
[    0.786131] pstore: using zlib compression
[    0.790716] BUG: spinlock bad magic on CPU#0, swapper/0/1
[    0.790729]  lock: 0xffffffc0d1ca9bb0, .magic: 00000000, .owner: &lt;none&gt;/-1, .owner_cpu: 0
[    0.790742] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.10.0-rc2+ #913
[    0.790747] Hardware name: Google Kevin (DT)
[    0.790750] Call trace:
[    0.790768] [&lt;ffffff900808ae88&gt;] dump_backtrace+0x0/0x2bc
[    0.790780] [&lt;ffffff900808b164&gt;] show_stack+0x20/0x28
[    0.790794] [&lt;ffffff9008460ee0&gt;] dump_stack+0xa4/0xcc
[    0.790809] [&lt;ffffff9008113cfc&gt;] spin_dump+0xe0/0xf0
[    0.790821] [&lt;ffffff9008113d3c&gt;] spin_bug+0x30/0x3c
[    0.790834] [&lt;ffffff9008113e28&gt;] do_raw_spin_lock+0x50/0x1b8
[    0.790846] [&lt;ffffff9008a2d2ec&gt;] _raw_spin_lock_irqsave+0x54/0x6c
[    0.790862] [&lt;ffffff90083ac3b4&gt;] buffer_size_add+0x48/0xcc
[    0.790875] [&lt;ffffff90083acb34&gt;] persistent_ram_write+0x60/0x11c
[    0.790888] [&lt;ffffff90083aab1c&gt;] ramoops_pstore_write_buf+0xd4/0x2a4
[    0.790900] [&lt;ffffff90083a9d3c&gt;] pstore_console_write+0xf0/0x134
[    0.790912] [&lt;ffffff900811c304&gt;] console_unlock+0x48c/0x5e8
[    0.790923] [&lt;ffffff900811da18&gt;] register_console+0x3b0/0x4d4
[    0.790935] [&lt;ffffff90083aa7d0&gt;] pstore_register+0x1a8/0x234
[    0.790947] [&lt;ffffff90083ac250&gt;] ramoops_probe+0x6b8/0x7d4
[    0.790961] [&lt;ffffff90085ca548&gt;] platform_drv_probe+0x7c/0xd0
[    0.790972] [&lt;ffffff90085c76ac&gt;] driver_probe_device+0x1b4/0x3bc
[    0.790982] [&lt;ffffff90085c7ac8&gt;] __device_attach_driver+0xc8/0xf4
[    0.790996] [&lt;ffffff90085c4bfc&gt;] bus_for_each_drv+0xb4/0xe4
[    0.791006] [&lt;ffffff90085c7414&gt;] __device_attach+0xd0/0x158
[    0.791016] [&lt;ffffff90085c7b18&gt;] device_initial_probe+0x24/0x30
[    0.791026] [&lt;ffffff90085c648c&gt;] bus_probe_device+0x50/0xe4
[    0.791038] [&lt;ffffff90085c35b8&gt;] device_add+0x3a4/0x76c
[    0.791051] [&lt;ffffff90087d0e84&gt;] of_device_add+0x74/0x84
[    0.791062] [&lt;ffffff90087d19b8&gt;] of_platform_device_create_pdata+0xc0/0x100
[    0.791073] [&lt;ffffff90087d1a2c&gt;] of_platform_device_create+0x34/0x40
[    0.791086] [&lt;ffffff900903c910&gt;] of_platform_default_populate_init+0x58/0x78
[    0.791097] [&lt;ffffff90080831fc&gt;] do_one_initcall+0x88/0x160
[    0.791109] [&lt;ffffff90090010ac&gt;] kernel_init_freeable+0x264/0x31c
[    0.791123] [&lt;ffffff9008a25bd0&gt;] kernel_init+0x18/0x11c
[    0.791133] [&lt;ffffff9008082ec0&gt;] ret_from_fork+0x10/0x50
[    0.793717] console [pstore-1] enabled
[    0.797845] pstore: Registered ramoops as persistent store backend
[    0.804647] ramoops: attached 0x100000@0xf7edc000, ecc: 0/0

Fixes: 663deb47880f ("pstore: Allow prz to control need for locking")
Fixes: 109704492ef6 ("pstore: Make spinlock per zone instead of global")
Reported-by: Brian Norris &lt;briannorris@chromium.org&gt;
Signed-off-by: Kees Cook &lt;keescook@chromium.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
commit 76d5692a58031696e282384cbd893832bc92bd76 upstream.

The ram backend wasn't always initializing its spinlock correctly. Since
it was coming from kzalloc memory, though, it was harmless on
architectures that initialize unlocked spinlocks to 0 (at least x86 and
ARM). This also fixes a possibly ignored flag setting too.

When running under CONFIG_DEBUG_SPINLOCK, the following Oops was visible:

[    0.760836] persistent_ram: found existing buffer, size 29988, start 29988
[    0.765112] persistent_ram: found existing buffer, size 30105, start 30105
[    0.769435] persistent_ram: found existing buffer, size 118542, start 118542
[    0.785960] persistent_ram: found existing buffer, size 0, start 0
[    0.786098] persistent_ram: found existing buffer, size 0, start 0
[    0.786131] pstore: using zlib compression
[    0.790716] BUG: spinlock bad magic on CPU#0, swapper/0/1
[    0.790729]  lock: 0xffffffc0d1ca9bb0, .magic: 00000000, .owner: &lt;none&gt;/-1, .owner_cpu: 0
[    0.790742] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.10.0-rc2+ #913
[    0.790747] Hardware name: Google Kevin (DT)
[    0.790750] Call trace:
[    0.790768] [&lt;ffffff900808ae88&gt;] dump_backtrace+0x0/0x2bc
[    0.790780] [&lt;ffffff900808b164&gt;] show_stack+0x20/0x28
[    0.790794] [&lt;ffffff9008460ee0&gt;] dump_stack+0xa4/0xcc
[    0.790809] [&lt;ffffff9008113cfc&gt;] spin_dump+0xe0/0xf0
[    0.790821] [&lt;ffffff9008113d3c&gt;] spin_bug+0x30/0x3c
[    0.790834] [&lt;ffffff9008113e28&gt;] do_raw_spin_lock+0x50/0x1b8
[    0.790846] [&lt;ffffff9008a2d2ec&gt;] _raw_spin_lock_irqsave+0x54/0x6c
[    0.790862] [&lt;ffffff90083ac3b4&gt;] buffer_size_add+0x48/0xcc
[    0.790875] [&lt;ffffff90083acb34&gt;] persistent_ram_write+0x60/0x11c
[    0.790888] [&lt;ffffff90083aab1c&gt;] ramoops_pstore_write_buf+0xd4/0x2a4
[    0.790900] [&lt;ffffff90083a9d3c&gt;] pstore_console_write+0xf0/0x134
[    0.790912] [&lt;ffffff900811c304&gt;] console_unlock+0x48c/0x5e8
[    0.790923] [&lt;ffffff900811da18&gt;] register_console+0x3b0/0x4d4
[    0.790935] [&lt;ffffff90083aa7d0&gt;] pstore_register+0x1a8/0x234
[    0.790947] [&lt;ffffff90083ac250&gt;] ramoops_probe+0x6b8/0x7d4
[    0.790961] [&lt;ffffff90085ca548&gt;] platform_drv_probe+0x7c/0xd0
[    0.790972] [&lt;ffffff90085c76ac&gt;] driver_probe_device+0x1b4/0x3bc
[    0.790982] [&lt;ffffff90085c7ac8&gt;] __device_attach_driver+0xc8/0xf4
[    0.790996] [&lt;ffffff90085c4bfc&gt;] bus_for_each_drv+0xb4/0xe4
[    0.791006] [&lt;ffffff90085c7414&gt;] __device_attach+0xd0/0x158
[    0.791016] [&lt;ffffff90085c7b18&gt;] device_initial_probe+0x24/0x30
[    0.791026] [&lt;ffffff90085c648c&gt;] bus_probe_device+0x50/0xe4
[    0.791038] [&lt;ffffff90085c35b8&gt;] device_add+0x3a4/0x76c
[    0.791051] [&lt;ffffff90087d0e84&gt;] of_device_add+0x74/0x84
[    0.791062] [&lt;ffffff90087d19b8&gt;] of_platform_device_create_pdata+0xc0/0x100
[    0.791073] [&lt;ffffff90087d1a2c&gt;] of_platform_device_create+0x34/0x40
[    0.791086] [&lt;ffffff900903c910&gt;] of_platform_default_populate_init+0x58/0x78
[    0.791097] [&lt;ffffff90080831fc&gt;] do_one_initcall+0x88/0x160
[    0.791109] [&lt;ffffff90090010ac&gt;] kernel_init_freeable+0x264/0x31c
[    0.791123] [&lt;ffffff9008a25bd0&gt;] kernel_init+0x18/0x11c
[    0.791133] [&lt;ffffff9008082ec0&gt;] ret_from_fork+0x10/0x50
[    0.793717] console [pstore-1] enabled
[    0.797845] pstore: Registered ramoops as persistent store backend
[    0.804647] ramoops: attached 0x100000@0xf7edc000, ecc: 0/0

Fixes: 663deb47880f ("pstore: Allow prz to control need for locking")
Fixes: 109704492ef6 ("pstore: Make spinlock per zone instead of global")
Reported-by: Brian Norris &lt;briannorris@chromium.org&gt;
Signed-off-by: Kees Cook &lt;keescook@chromium.org&gt;
Signed-off-by: Greg Kroah-Hartman &lt;gregkh@linuxfoundation.org&gt;

</pre>
</div>
</content>
</entry>
</feed>
