There is an imbalance between when slab_pre_alloc_hook calls
memcg_kmem_get_cache and when slab_post_alloc_hook calls
memcg_kmem_put_cache.
This can cause a memcg kmem cache to be destroyed right as
an object from that cache is being allocated, which is probably
not good. It could lead to things like a memcg allocating new
kmalloc slabs instead of using freed space in old ones, maybe
memory leaks, and maybe oopses as a memcg kmalloc slab is getting
destroyed on one CPU while another CPU is trying to do an allocation
from that same memcg.
The obvious fix would be to use the same condition for calling
memcg_kmem_put_cache that we also use to decide whether to call
memcg_kmem_get_cache.
I am not sure how long this bug has been around, since the last
changeset to touch that code - 452647784b2f ("mm: memcontrol: cleanup
kmem charge functions") - merely moved the bug from one location to
another. I am still tagging that changeset, because the fix should
automatically apply that far back.
Signed-off-by: Rik van Riel <riel(a)surriel.com>
Fixes: 452647784b2f ("mm: memcontrol: cleanup kmem charge functions")
Cc: kernel-team(a)fb.com
Cc: linux-mm(a)kvack.org
Cc: stable(a)vger.kernel.org
Cc: Alexey Dobriyan <adobriyan(a)gmail.com>
Cc: Christoph Lameter <cl(a)linux.com>
Cc: Pekka Enberg <penberg(a)kernel.org>
Cc: Andrew Morton <akpm(a)linux-foundation.org>
Cc: David Rientjes <rientjes(a)google.com>
Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com>
Cc: Johannes Weiner <hannes(a)cmpxchg.org>
Cc: Tejun Heo <tj(a)kernel.org>
---
mm/slab.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/mm/slab.h b/mm/slab.h
index 4190c24ef0e9..ab3d95bef8a0 100644
--- a/mm/slab.h
+++ b/mm/slab.h
@@ -444,7 +444,8 @@ static inline void slab_post_alloc_hook(struct kmem_cache *s, gfp_t flags,
p[i] = kasan_slab_alloc(s, object, flags);
}
- if (memcg_kmem_enabled())
+ if (memcg_kmem_enabled() &&
+ ((flags & __GFP_ACCOUNT) || (s->flags & SLAB_ACCOUNT)))
memcg_kmem_put_cache(s);
}
--
2.17.1
Commit fb544d1ca65a89f7a3895f7531221ceeed74ada7 upstream.
We recently addressed a VMID generation race by introducing a read/write
lock around accesses and updates to the vmid generation values.
However, kvm_arch_vcpu_ioctl_run() also calls need_new_vmid_gen() but
does so without taking the read lock.
As far as I can tell, this can lead to the same kind of race:
VM 0, VCPU 0 VM 0, VCPU 1
------------ ------------
update_vttbr (vmid 254)
update_vttbr (vmid 1) // roll over
read_lock(kvm_vmid_lock);
force_vm_exit()
local_irq_disable
need_new_vmid_gen == false //because vmid gen matches
enter_guest (vmid 254)
kvm_arch.vttbr = <PGD>:<VMID 1>
read_unlock(kvm_vmid_lock);
enter_guest (vmid 1)
Which results in running two VCPUs in the same VM with different VMIDs
and (even worse) other VCPUs from other VMs could now allocate clashing
VMID 254 from the new generation as long as VCPU 0 is not exiting.
Attempt to solve this by making sure vttbr is updated before another CPU
can observe the updated VMID generation.
Change-Id: I40aae6e89a3c8a496e13fcd8ae6bb663d16b057c
Cc: stable(a)vger.kernel.org # v4.14
Fixes: f0cf47d939d0 "KVM: arm/arm64: Close VMID generation race"
Reviewed-by: Julien Thierry <julien.thierry(a)arm.com>
Signed-off-by: Christoffer Dall <christoffer.dall(a)arm.com>
Signed-off-by: Marc Zyngier <marc.zyngier(a)arm.com>
---
virt/kvm/arm/arm.c | 23 +++++++++++------------
1 file changed, 11 insertions(+), 12 deletions(-)
diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c
index ed42b8cf6f5b..32aa88c19b8d 100644
--- a/virt/kvm/arm/arm.c
+++ b/virt/kvm/arm/arm.c
@@ -61,7 +61,7 @@ static DEFINE_PER_CPU(struct kvm_vcpu *, kvm_arm_running_vcpu);
static atomic64_t kvm_vmid_gen = ATOMIC64_INIT(1);
static u32 kvm_next_vmid;
static unsigned int kvm_vmid_bits __read_mostly;
-static DEFINE_RWLOCK(kvm_vmid_lock);
+static DEFINE_SPINLOCK(kvm_vmid_lock);
static bool vgic_present;
@@ -447,7 +447,9 @@ void force_vm_exit(const cpumask_t *mask)
*/
static bool need_new_vmid_gen(struct kvm *kvm)
{
- return unlikely(kvm->arch.vmid_gen != atomic64_read(&kvm_vmid_gen));
+ u64 current_vmid_gen = atomic64_read(&kvm_vmid_gen);
+ smp_rmb(); /* Orders read of kvm_vmid_gen and kvm->arch.vmid */
+ return unlikely(READ_ONCE(kvm->arch.vmid_gen) != current_vmid_gen);
}
/**
@@ -462,16 +464,11 @@ static void update_vttbr(struct kvm *kvm)
{
phys_addr_t pgd_phys;
u64 vmid;
- bool new_gen;
- read_lock(&kvm_vmid_lock);
- new_gen = need_new_vmid_gen(kvm);
- read_unlock(&kvm_vmid_lock);
-
- if (!new_gen)
+ if (!need_new_vmid_gen(kvm))
return;
- write_lock(&kvm_vmid_lock);
+ spin_lock(&kvm_vmid_lock);
/*
* We need to re-check the vmid_gen here to ensure that if another vcpu
@@ -479,7 +476,7 @@ static void update_vttbr(struct kvm *kvm)
* use the same vmid.
*/
if (!need_new_vmid_gen(kvm)) {
- write_unlock(&kvm_vmid_lock);
+ spin_unlock(&kvm_vmid_lock);
return;
}
@@ -502,7 +499,6 @@ static void update_vttbr(struct kvm *kvm)
kvm_call_hyp(__kvm_flush_vm_context);
}
- kvm->arch.vmid_gen = atomic64_read(&kvm_vmid_gen);
kvm->arch.vmid = kvm_next_vmid;
kvm_next_vmid++;
kvm_next_vmid &= (1 << kvm_vmid_bits) - 1;
@@ -513,7 +509,10 @@ static void update_vttbr(struct kvm *kvm)
vmid = ((u64)(kvm->arch.vmid) << VTTBR_VMID_SHIFT) & VTTBR_VMID_MASK(kvm_vmid_bits);
kvm->arch.vttbr = pgd_phys | vmid;
- write_unlock(&kvm_vmid_lock);
+ smp_wmb();
+ WRITE_ONCE(kvm->arch.vmid_gen, atomic64_read(&kvm_vmid_gen));
+
+ spin_unlock(&kvm_vmid_lock);
}
static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu)
--
2.18.0
This is the start of the stable review cycle for the 4.9.149 release.
There are 71 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed Jan 9 10:53:04 UTC 2019.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.149-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.149-rc1
Tomas Winkler <tomas.winkler(a)intel.com>
tpm: tpm_i2c_nuvoton: use correct command duration for TPM 2.x
Maciej W. Rozycki <macro(a)linux-mips.org>
rtc: m41t80: Correct alarm month range with RTC reads
Will Deacon <will.deacon(a)arm.com>
arm64: KVM: Avoid setting the upper 32 bits of VTCR_EL2 to 1
Vitaly Kuznetsov <vkuznets(a)redhat.com>
x86/kvm/vmx: do not use vm-exit instruction length for fast MMIO when running nested
Georgy A Bystrenin <gkot(a)altlinux.org>
CIFS: Fix error mapping for SMB2_LOCK command which caused OFD lock problem
Aaro Koskinen <aaro.koskinen(a)iki.fi>
MIPS: OCTEON: mark RGMII interface disabled on OCTEON III
Huacai Chen <chenhc(a)lemote.com>
MIPS: Align kernel load address to 64KB
Huacai Chen <chenhc(a)lemote.com>
MIPS: Ensure pmd_present() returns false after pmd_mknotpresent()
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: v4l2-tpg: array index could become negative
Hans Verkuil <hverkuil-cisco(a)xs4all.nl>
media: vivid: free bitmap_cap when updating std/timings/etc.
Nava kishore Manne <nava.manne(a)xilinx.com>
serial: uartps: Fix interrupt mask issue to handle the RX interrupts properly
Martin Blumenstingl <martin.blumenstingl(a)googlemail.com>
f2fs: fix validation of the block count in sanity_check_raw_super
Breno Leitao <leitao(a)debian.org>
powerpc/tm: Set MSR[TS] just prior to recheckpoint
Josef Bacik <jbacik(a)fb.com>
btrfs: run delayed items before dropping the snapshot
Filipe Manana <fdmanana(a)suse.com>
Btrfs: fix fsync of files with multiple hard links in new directories
Macpaul Lin <macpaul.lin(a)mediatek.com>
cdc-acm: fix abnormal DATA RX issue for Mediatek Preloader.
Johan Jonker <jbx9999(a)hotmail.com>
clk: rockchip: fix typo in rk3188 spdif_frac parent
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Avoid finishing transfer prematurely in IRQ mode
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Fix book-keeping of DMA termination
Lukas Wunner <lukas(a)wunner.de>
spi: bcm2835: Fix race on DMA termination
Theodore Ts'o <tytso(a)mit.edu>
ext4: check for shutdown and r/o file system in ext4_write_inode()
Theodore Ts'o <tytso(a)mit.edu>
ext4: force inode writes when nfsd calls commit_metadata()
Theodore Ts'o <tytso(a)mit.edu>
ext4: include terminating u32 in size of xattr entries when expanding inodes
ruippan (潘睿) <ruippan(a)tencent.com>
ext4: fix EXT4_IOC_GROUP_ADD ioctl
Maurizio Lombardi <mlombard(a)redhat.com>
ext4: missing unlock/put_page() in ext4_try_to_write_inline_data()
Pan Bian <bianpan2016(a)163.com>
ext4: fix possible use after free in ext4_quota_enable
Ben Hutchings <ben(a)decadent.org.uk>
perf pmu: Suppress potential format-truncation warning
Miquel Raynal <miquel.raynal(a)bootlin.com>
platform-msi: Free descriptors in platform_msi_domain_free()
Sean Christopherson <sean.j.christopherson(a)intel.com>
KVM: x86: Use jmp to invoke kvm_spurious_fault() from .fixup
Patrick Dreyer <Patrick(a)Dreyer.name>
Input: elan_i2c - add ACPI ID for touchpad in ASUS Aspire F5-573G
Bjørn Mork <bjorn(a)mork.no>
qmi_wwan: apply SET_DTR quirk to the SIMCOM shared device ID
Colin Ian King <colin.king(a)canonical.com>
staging: wilc1000: fix missing read_write setting when reading data
Jia-Ju Bai <baijiaju1990(a)gmail.com>
usb: r8a66597: Fix a possible concurrency use-after-free bug in r8a66597_endpoint_disable()
Jörgen Storvist <jorgen.storvist(a)gmail.com>
USB: serial: option: add Fibocom NL678 series
Scott Chen <scott(a)labau.com.tw>
USB: serial: pl2303: add ids for Hewlett-Packard HP POS pole displays
Sameer Pujar <spujar(a)nvidia.com>
ALSA: hda/tegra: clear pending irq handlers
Mantas Mikulėnas <grawity(a)gmail.com>
ALSA: hda: add mute LED support for HP EliteBook 840 G4
Arnd Bergmann <arnd(a)arndb.de>
mtd: atmel-quadspi: disallow building on ebsa110
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: emux: Fix potential Spectre v1 vulnerabilities
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: pcm: Fix potential Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: emu10k1: Fix potential Spectre v1 vulnerabilities
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ALSA: rme9652: Fix potential Spectre v1 vulnerability
Cong Wang <xiyou.wangcong(a)gmail.com>
ptr_ring: wrap back ->producer in __ptr_ring_swap_queue()
Deepa Dinamani <deepa.kernel(a)gmail.com>
sock: Make sock->sk_stamp thread-safe
Yuval Avnery <yuvalav(a)mellanox.com>
net/mlx5: Typo fix in del_sw_hw_rule
Alaa Hleihel <alaa(a)mellanox.com>
net/mlx5e: Remove the false indication of software timestamping support
Lorenzo Bianconi <lorenzo.bianconi(a)redhat.com>
gro_cell: add napi_disable in gro_cells_destroy
Cong Wang <xiyou.wangcong(a)gmail.com>
tipc: compare remote and local protocols in tipc_udp_enable()
Cong Wang <xiyou.wangcong(a)gmail.com>
tipc: use lock_sock() in tipc_sk_reinit()
Juergen Gross <jgross(a)suse.com>
xen/netfront: tolerate frags with no data
Jorgen Hansen <jhansen(a)vmware.com>
VSOCK: Send reset control packet when socket is partially bound
Jason Wang <jasowang(a)redhat.com>
vhost: make sure used idx is seen before log in vhost_add_used_n()
Cong Wang <xiyou.wangcong(a)gmail.com>
tipc: fix a double kfree_skb()
Xin Long <lucien.xin(a)gmail.com>
sctp: initialize sin6_flowinfo for ipv6 addrs in sctp_inet6addr_event
Willem de Bruijn <willemb(a)google.com>
packet: validate address length if non-zero
Willem de Bruijn <willemb(a)google.com>
packet: validate address length
Cong Wang <xiyou.wangcong(a)gmail.com>
net/wan: fix a double free in x25_asy_open_tty()
Cong Wang <xiyou.wangcong(a)gmail.com>
netrom: fix locking in nr_find_socket()
Kunihiko Hayashi <hayashi.kunihiko(a)socionext.com>
net: phy: Fix the issue that netif always links up after resuming
Michal Kubecek <mkubecek(a)suse.cz>
net: ipv4: do not handle duplicate fragments as overlapping
Eric Dumazet <edumazet(a)google.com>
isdn: fix kernel-infoleak in capi_unlocked_ioctl
Eric Dumazet <edumazet(a)google.com>
ipv6: tunnels: fix two use-after-free
Cong Wang <xiyou.wangcong(a)gmail.com>
ipv6: explicitly initialize udp6_addr in udp_sock_create6()
Willem de Bruijn <willemb(a)google.com>
ieee802154: lowpan_header_create check must check daddr
Tyrel Datwyler <tyreld(a)linux.vnet.ibm.com>
ibmveth: fix DMA unmap error in ibmveth_xmit_start error path
Cong Wang <xiyou.wangcong(a)gmail.com>
ax25: fix a use-after-free in ax25_fillin_cb()
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
phonet: af_phonet: Fix Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
net: core: Fix Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ipv4: Fix potential Spectre v1 vulnerability
Gustavo A. R. Silva <gustavo(a)embeddedor.com>
ip6mr: Fix potential Spectre v1 vulnerability
Guenter Roeck <linux(a)roeck-us.net>
NFC: nxp-nci: Include unaligned.h instead of access_ok.h
-------------
Diffstat:
Makefile | 4 +-
arch/arm64/include/asm/kvm_arm.h | 2 +-
arch/mips/boot/compressed/calc_vmlinuz_load_addr.c | 7 ++-
arch/mips/cavium-octeon/executive/cvmx-helper.c | 3 +-
arch/mips/include/asm/pgtable-64.h | 5 ++
arch/powerpc/kernel/signal_32.c | 20 ++++++-
arch/powerpc/kernel/signal_64.c | 44 +++++++++-----
arch/x86/include/asm/kvm_host.h | 2 +-
arch/x86/kvm/vmx.c | 19 +++++-
arch/x86/kvm/x86.c | 3 +-
drivers/base/platform-msi.c | 6 +-
drivers/char/tpm/tpm_i2c_nuvoton.c | 11 ++--
drivers/clk/rockchip/clk-rk3188.c | 2 +-
drivers/input/mouse/elan_i2c_core.c | 1 +
drivers/isdn/capi/kcapi.c | 4 +-
drivers/media/common/v4l2-tpg/v4l2-tpg-core.c | 2 +-
drivers/media/platform/vivid/vivid-vid-cap.c | 2 +
drivers/mtd/spi-nor/Kconfig | 2 +-
drivers/net/ethernet/ibm/ibmveth.c | 6 +-
.../net/ethernet/mellanox/mlx5/core/en_ethtool.c | 11 +---
drivers/net/ethernet/mellanox/mlx5/core/fs_core.c | 2 +-
drivers/net/phy/phy_device.c | 7 +--
drivers/net/usb/qmi_wwan.c | 2 +-
drivers/net/wan/x25_asy.c | 2 +
drivers/net/xen-netfront.c | 2 +-
drivers/nfc/nxp-nci/firmware.c | 2 +-
drivers/nfc/nxp-nci/i2c.c | 2 +-
drivers/rtc/rtc-m41t80.c | 2 +-
drivers/spi/spi-bcm2835.c | 14 ++---
drivers/staging/wilc1000/wilc_sdio.c | 1 +
drivers/tty/serial/xilinx_uartps.c | 4 +-
drivers/usb/class/cdc-acm.c | 10 ++++
drivers/usb/class/cdc-acm.h | 1 +
drivers/usb/host/r8a66597-hcd.c | 5 +-
drivers/usb/serial/option.c | 4 ++
drivers/usb/serial/pl2303.c | 5 ++
drivers/usb/serial/pl2303.h | 5 ++
drivers/vhost/vhost.c | 2 +
fs/btrfs/btrfs_inode.h | 6 ++
fs/btrfs/extent-tree.c | 4 ++
fs/btrfs/inode.c | 17 ++++++
fs/btrfs/tree-log.c | 16 ++++++
fs/cifs/smb2maperror.c | 4 +-
fs/ext4/inline.c | 5 +-
fs/ext4/inode.c | 9 ++-
fs/ext4/resize.c | 2 +-
fs/ext4/super.c | 13 ++++-
fs/ext4/xattr.c | 2 +-
fs/f2fs/super.c | 6 +-
include/linux/msi.h | 2 +
include/linux/ptr_ring.h | 2 +
include/net/gro_cells.h | 1 +
include/net/sock.h | 36 +++++++++++-
include/trace/events/ext4.h | 20 +++++++
net/ax25/af_ax25.c | 11 +++-
net/ax25/ax25_dev.c | 2 +
net/compat.c | 15 +++--
net/core/filter.c | 2 +
net/core/sock.c | 3 +
net/ieee802154/6lowpan/tx.c | 3 +
net/ipv4/ip_fragment.c | 18 ++++--
net/ipv4/ipmr.c | 3 +
net/ipv6/ip6_tunnel.c | 1 +
net/ipv6/ip6_udp_tunnel.c | 3 +-
net/ipv6/ip6_vti.c | 1 +
net/ipv6/ip6mr.c | 4 ++
net/netrom/af_netrom.c | 15 +++--
net/packet/af_packet.c | 8 ++-
net/phonet/af_phonet.c | 3 +
net/sctp/ipv6.c | 1 +
net/sunrpc/svcsock.c | 2 +-
net/tipc/socket.c | 8 ++-
net/tipc/udp_media.c | 9 ++-
net/vmw_vsock/vmci_transport.c | 67 ++++++++++++++++------
sound/core/pcm.c | 2 +
sound/pci/emu10k1/emufx.c | 5 ++
sound/pci/hda/hda_tegra.c | 2 +
sound/pci/hda/patch_conexant.c | 1 +
sound/pci/rme9652/hdsp.c | 10 ++--
sound/synth/emux/emux_hwdep.c | 7 ++-
tools/perf/util/pmu.c | 8 +--
81 files changed, 451 insertions(+), 136 deletions(-)
Do you have photos for editing? We asked this because we see your photos on
your website.
We mainly supply service for photos cut out , clipping path, and
retouching.
You may just send us a photo, we can provide you test editing to check
quality.
Thanks,
Jane
Do you have photos for editing? We asked this because we see your photos on
your website.
We mainly supply service for photos cut out , clipping path, and
retouching.
You may just send us a photo, we can provide you test editing to check
quality.
Thanks,
Jane
Do you have photos for editing? We asked this because we see your photos on
your website.
We mainly supply service for photos cut out , clipping path, and
retouching.
You may just send us a photo, we can provide you test editing to check
quality.
Thanks,
Jane
Do you have photos for editing? We asked this because we see your photos on
your website.
We mainly supply service for photos cut out , clipping path, and
retouching.
You may just send us a photo, we can provide you test editing to check
quality.
Thanks,
Jane
We see your photos photos for editing.
Please send us the details of this task.
Do your photos need cut out? Or clipping path, and retouching?
You may give us 1 photo, we will do test for you to check the quality.
Thanks,
Helen