October 2019 - Linux-stable-mirror

[PATCH] panic: Ensure preemption is disabled during panic()

by Will Deacon

Calling 'panic()' on a kernel with CONFIG_PREEMPT=y can leave the calling CPU in an infinite loop, but with interrupts and preemption enabled. From this state, userspace can continue to be scheduled, despite the system being "dead" as far as the kernel is concerned. This is easily reproducible on arm64 when booting with "nosmp" on the command line; a couple of shell scripts print out a periodic "Ping" message whilst another triggers a crash by writing to /proc/sysrq-trigger: | sysrq: Trigger a crash | Kernel panic - not syncing: sysrq triggered crash | CPU: 0 PID: 1 Comm: init Not tainted 5.2.15 #1 | Hardware name: linux,dummy-virt (DT) | Call trace: | dump_backtrace+0x0/0x148 | show_stack+0x14/0x20 | dump_stack+0xa0/0xc4 | panic+0x140/0x32c | sysrq_handle_reboot+0x0/0x20 | __handle_sysrq+0x124/0x190 | write_sysrq_trigger+0x64/0x88 | proc_reg_write+0x60/0xa8 | __vfs_write+0x18/0x40 | vfs_write+0xa4/0x1b8 | ksys_write+0x64/0xf0 | __arm64_sys_write+0x14/0x20 | el0_svc_common.constprop.0+0xb0/0x168 | el0_svc_handler+0x28/0x78 | el0_svc+0x8/0xc | Kernel Offset: disabled | CPU features: 0x0002,24002004 | Memory Limit: none | ---[ end Kernel panic - not syncing: sysrq triggered crash ]--- | Ping 2! | Ping 1! | Ping 1! | Ping 2! The issue can also be triggered on x86 kernels if CONFIG_SMP=n, otherwise local interrupts are disabled in 'smp_send_stop()'. Disable preemption in 'panic()' before re-enabling interrupts. Cc: Russell King <linux(a)armlinux.org.uk> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Kees Cook <keescook(a)chromium.org> Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: <stable(a)vger.kernel.org> Link: https://lore.kernel.org/r/BX1W47JXPMR8.58IYW53H6M5N@dragonstone Reported-by: Xogium <contact(a)xogium.me> Signed-off-by: Will Deacon <will(a)kernel.org> --- kernel/panic.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/panic.c b/kernel/panic.c index 47e8ebccc22b..f470a038b05b 100644 --- a/kernel/panic.c +++ b/kernel/panic.c @@ -180,6 +180,7 @@ void panic(const char *fmt, ...) * after setting panic_cpu) from invoking panic() again. */ local_irq_disable(); + preempt_disable_notrace(); /* * It's possible to come here directly from a panic-assertion and -- 2.23.0.444.g18eeb5a265-goog

5 years

7
10
0 0

[PATCH v2] phy: renesas: rcar-gen3-usb2: Fix sysfs interface of "role"

by Yoshihiro Shimoda

Since the role_store() uses strncmp(), it's possible to refer out-of-memory if the sysfs data size is smaller than strlen("host"). This patch fixes it by using sysfs_streq() instead of strncmp(). Reported-by: Pavel Machek <pavel(a)denx.de> Fixes: 9bb86777fb71 ("phy: rcar-gen3-usb2: add sysfs for usb role swap") Cc: <stable(a)vger.kernel.org> # v4.10+ Signed-off-by: Yoshihiro Shimoda <yoshihiro.shimoda.uh(a)renesas.com> Reviewed-by: Geert Uytterhoeven <geert+renesas(a)glider.be> Acked-by: Pavel Machek <pavel(a)denx.de> --- Changes from v1: - Rebase on v5.4-rc2. - Add Reviewed-by and Acked-by tags. https://patchwork.kernel.org/patch/11067371/ drivers/phy/renesas/phy-rcar-gen3-usb2.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/phy/renesas/phy-rcar-gen3-usb2.c b/drivers/phy/renesas/phy-rcar-gen3-usb2.c index b7f6b13..6fd1390 100644 --- a/drivers/phy/renesas/phy-rcar-gen3-usb2.c +++ b/drivers/phy/renesas/phy-rcar-gen3-usb2.c @@ -21,6 +21,7 @@ #include <linux/platform_device.h> #include <linux/pm_runtime.h> #include <linux/regulator/consumer.h> +#include <linux/string.h> #include <linux/usb/of.h> #include <linux/workqueue.h> @@ -320,9 +321,9 @@ static ssize_t role_store(struct device *dev, struct device_attribute *attr, if (!ch->is_otg_channel || !rcar_gen3_is_any_rphy_initialized(ch)) return -EIO; - if (!strncmp(buf, "host", strlen("host"))) + if (sysfs_streq(buf, "host")) new_mode = PHY_MODE_USB_HOST; - else if (!strncmp(buf, "peripheral", strlen("peripheral"))) + else if (sysfs_streq(buf, "peripheral")) new_mode = PHY_MODE_USB_DEVICE; else return -EINVAL; -- 2.7.4

5 years

1
0
0 0

✅ PASS: Test report for kernel 5.3.5-rc1-de3c43f.cki (stable)

by CKI Project

Hello, We ran automated tests on a recent commit from this kernel tree: Kernel repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Commit: de3c43ffab53 - Linux 5.3.5-rc1 The results of these automated tests are provided below. Overall result: PASSED Merge: OK Compile: OK Tests: OK All kernel binaries, config files, and logs are available for download here: https://artifacts.cki-project.org/pipelines/209818 Please reply to this email if you have any questions about the tests that we ran or if you have any suggestions on how to make future tests more effective. ,-. ,-. ( C ) ( K ) Continuous `-',-.`-' Kernel ( I ) Integration `-' ______________________________________________________________________________ Compile testing --------------- We compiled the kernel for 3 architectures: aarch64: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg ppc64le: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg x86_64: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg Hardware testing ---------------- We booted each kernel and ran the following tests: aarch64: Host 1: ✅ Boot test ✅ xfstests: ext4 ✅ xfstests: xfs ✅ selinux-policy: serge-testsuite ✅ lvm thinp sanity ✅ storage: software RAID testing 🚧 ✅ Storage blktests Host 2: ⚡ Internal infrastructure issues prevented one or more tests (marked with ⚡⚡⚡) from running on this architecture. This is not the fault of the kernel that was tested. ✅ Boot test ✅ Podman system integration test (as root) ✅ Podman system integration test (as user) ✅ Loopdev Sanity ✅ jvm test suite ✅ Memory function: memfd_create ✅ AMTU (Abstract Machine Test Utility) ✅ Ethernet drivers sanity ✅ Networking socket: fuzz ✅ Networking sctp-auth: sockopts test ✅ Networking: igmp conformance test ✅ Networking TCP: keepalive test ✅ Networking UDP: socket ✅ Networking tunnel: gre basic ✅ Networking tunnel: vxlan basic ✅ audit: audit testsuite test ✅ httpd: mod_ssl smoke sanity ✅ iotop: sanity ✅ tuned: tune-processes-through-perf ✅ Usex - version 1.9-29 ✅ storage: SCSI VPD 🚧 ⚡⚡⚡ LTP lite 🚧 ⚡⚡⚡ CIFS Connectathon 🚧 ⚡⚡⚡ POSIX pjd-fstest suites 🚧 ⚡⚡⚡ Memory function: kaslr 🚧 ⚡⚡⚡ Networking bridge: sanity 🚧 ⚡⚡⚡ Networking MACsec: sanity 🚧 ⚡⚡⚡ Networking route: pmtu 🚧 ⚡⚡⚡ Networking tunnel: geneve basic test 🚧 ⚡⚡⚡ L2TP basic test 🚧 ⚡⚡⚡ Networking vnic: ipvlan/basic 🚧 ⚡⚡⚡ ALSA PCM loopback test 🚧 ⚡⚡⚡ ALSA Control (mixer) Userspace Element test 🚧 ⚡⚡⚡ storage: dm/common 🚧 ⚡⚡⚡ trace: ftrace/tracer 🚧 ⚡⚡⚡ Networking route_func: local 🚧 ⚡⚡⚡ Networking route_func: forward 🚧 ⚡⚡⚡ Networking ipsec: basic netns transport 🚧 ⚡⚡⚡ Networking ipsec: basic netns tunnel ppc64le: Host 1: ✅ Boot test ✅ Podman system integration test (as root) ✅ Podman system integration test (as user) ✅ Loopdev Sanity ✅ jvm test suite ✅ Memory function: memfd_create ✅ AMTU (Abstract Machine Test Utility) ✅ Ethernet drivers sanity ✅ Networking socket: fuzz ✅ Networking sctp-auth: sockopts test ✅ Networking TCP: keepalive test ✅ Networking UDP: socket ✅ Networking tunnel: gre basic ✅ Networking tunnel: vxlan basic ✅ audit: audit testsuite test ✅ httpd: mod_ssl smoke sanity ✅ iotop: sanity ✅ tuned: tune-processes-through-perf ✅ Usex - version 1.9-29 🚧 ✅ LTP lite 🚧 ✅ CIFS Connectathon 🚧 ✅ POSIX pjd-fstest suites 🚧 ✅ Memory function: kaslr 🚧 ✅ Networking bridge: sanity 🚧 ✅ Networking MACsec: sanity 🚧 ✅ Networking route: pmtu 🚧 ✅ Networking tunnel: geneve basic test 🚧 ✅ L2TP basic test 🚧 ✅ Networking ipsec: basic netns tunnel 🚧 ✅ Networking vnic: ipvlan/basic 🚧 ✅ ALSA PCM loopback test 🚧 ✅ ALSA Control (mixer) Userspace Element test 🚧 ✅ storage: dm/common 🚧 ✅ trace: ftrace/tracer 🚧 ✅ Networking route_func: local 🚧 ✅ Networking route_func: forward Host 2: ✅ Boot test ✅ xfstests: ext4 ✅ xfstests: xfs ✅ selinux-policy: serge-testsuite ✅ lvm thinp sanity ✅ storage: software RAID testing 🚧 ✅ Storage blktests x86_64: Host 1: ✅ Boot test 🚧 ✅ IPMI driver test 🚧 ✅ IPMItool loop stress test Host 2: ✅ Boot test ✅ Podman system integration test (as root) ✅ Podman system integration test (as user) ✅ Loopdev Sanity ✅ jvm test suite ✅ Memory function: memfd_create ✅ AMTU (Abstract Machine Test Utility) ✅ Ethernet drivers sanity ✅ Networking socket: fuzz ✅ Networking sctp-auth: sockopts test ✅ Networking: igmp conformance test ✅ Networking TCP: keepalive test ✅ Networking UDP: socket ✅ Networking tunnel: gre basic ✅ Networking tunnel: vxlan basic ✅ audit: audit testsuite test ✅ httpd: mod_ssl smoke sanity ✅ iotop: sanity ✅ tuned: tune-processes-through-perf ✅ pciutils: sanity smoke test ✅ Usex - version 1.9-29 ✅ storage: SCSI VPD ✅ stress: stress-ng 🚧 ✅ LTP lite 🚧 ✅ CIFS Connectathon 🚧 ✅ POSIX pjd-fstest suites 🚧 ❌ Memory function: kaslr 🚧 ✅ Networking bridge: sanity 🚧 ✅ Networking MACsec: sanity 🚧 ✅ Networking route: pmtu 🚧 ✅ Networking tunnel: geneve basic test 🚧 ✅ L2TP basic test 🚧 ✅ Networking vnic: ipvlan/basic 🚧 ✅ ALSA PCM loopback test 🚧 ✅ ALSA Control (mixer) Userspace Element test 🚧 ✅ storage: dm/common 🚧 ✅ trace: ftrace/tracer 🚧 ✅ Networking route_func: local 🚧 ✅ Networking route_func: forward 🚧 ✅ Networking ipsec: basic netns transport 🚧 ✅ Networking ipsec: basic netns tunnel Host 3: ✅ Boot test ✅ xfstests: ext4 ✅ xfstests: xfs ✅ selinux-policy: serge-testsuite ✅ lvm thinp sanity ✅ storage: software RAID testing 🚧 ✅ IOMMU boot test 🚧 ✅ Storage blktests Host 4: ✅ Boot test ✅ Storage SAN device stress - megaraid_sas Host 5: ✅ Boot test ✅ Storage SAN device stress - mpt3sas driver Test sources: https://github.com/CKI-project/tests-beaker 💚 Pull requests are welcome for new tests or improvements to existing tests! Waived tests ------------ If the test run included waived tests, they are marked with 🚧. Such tests are executed but their results are not taken into account. Tests are waived when their results are not reliable enough, e.g. when they're just introduced or are being fixed.

5 years

1
0
0 0

❌ FAIL: Test report for kernel 5.3.5-rc1-a2703e7.cki (stable)

by CKI Project

Hello, We ran automated tests on a recent commit from this kernel tree: Kernel repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git Commit: a2703e78c28a - Linux 5.3.5-rc1 The results of these automated tests are provided below. Overall result: FAILED (see details below) Merge: OK Compile: OK Tests: FAILED All kernel binaries, config files, and logs are available for download here: https://artifacts.cki-project.org/pipelines/209984 One or more kernel tests failed: ppc64le: ❌ xfstests: xfs We hope that these logs can help you find the problem quickly. For the full detail on our testing procedures, please scroll to the bottom of this message. Please reply to this email if you have any questions about the tests that we ran or if you have any suggestions on how to make future tests more effective. ,-. ,-. ( C ) ( K ) Continuous `-',-.`-' Kernel ( I ) Integration `-' ______________________________________________________________________________ Compile testing --------------- We compiled the kernel for 3 architectures: aarch64: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg ppc64le: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg x86_64: make options: -j30 INSTALL_MOD_STRIP=1 targz-pkg Hardware testing ---------------- We booted each kernel and ran the following tests: aarch64: Host 1: ✅ Boot test ✅ xfstests: ext4 ✅ xfstests: xfs ✅ selinux-policy: serge-testsuite ✅ lvm thinp sanity ✅ storage: software RAID testing 🚧 ✅ Storage blktests Host 2: ✅ Boot test ✅ Podman system integration test (as root) ✅ Podman system integration test (as user) ✅ Loopdev Sanity ✅ jvm test suite ✅ Memory function: memfd_create ✅ AMTU (Abstract Machine Test Utility) ✅ Ethernet drivers sanity ✅ Networking socket: fuzz ✅ Networking sctp-auth: sockopts test ✅ Networking: igmp conformance test ✅ Networking TCP: keepalive test ✅ Networking UDP: socket ✅ Networking tunnel: gre basic ✅ Networking tunnel: vxlan basic ✅ audit: audit testsuite test ✅ httpd: mod_ssl smoke sanity ✅ iotop: sanity ✅ tuned: tune-processes-through-perf ✅ Usex - version 1.9-29 ✅ storage: SCSI VPD ✅ stress: stress-ng 🚧 ✅ LTP lite 🚧 ✅ CIFS Connectathon 🚧 ✅ POSIX pjd-fstest suites 🚧 ✅ Memory function: kaslr 🚧 ✅ Networking bridge: sanity 🚧 ✅ Networking MACsec: sanity 🚧 ✅ Networking route: pmtu 🚧 ✅ Networking tunnel: geneve basic test 🚧 ✅ L2TP basic test 🚧 ✅ Networking vnic: ipvlan/basic 🚧 ✅ ALSA PCM loopback test 🚧 ✅ ALSA Control (mixer) Userspace Element test 🚧 ✅ storage: dm/common 🚧 ✅ trace: ftrace/tracer 🚧 ✅ Networking route_func: local 🚧 ✅ Networking route_func: forward 🚧 ✅ Networking ipsec: basic netns transport 🚧 ✅ Networking ipsec: basic netns tunnel ppc64le: Host 1: ✅ Boot test ✅ Podman system integration test (as root) ✅ Podman system integration test (as user) ✅ Loopdev Sanity ✅ jvm test suite ✅ Memory function: memfd_create ✅ AMTU (Abstract Machine Test Utility) ✅ Ethernet drivers sanity ✅ Networking socket: fuzz ✅ Networking sctp-auth: sockopts test ✅ Networking TCP: keepalive test ✅ Networking UDP: socket ✅ Networking tunnel: gre basic ✅ Networking tunnel: vxlan basic ✅ audit: audit testsuite test ✅ httpd: mod_ssl smoke sanity ✅ iotop: sanity ✅ tuned: tune-processes-through-perf ✅ Usex - version 1.9-29 🚧 ✅ LTP lite 🚧 ✅ CIFS Connectathon 🚧 ✅ POSIX pjd-fstest suites 🚧 ✅ Memory function: kaslr 🚧 ✅ Networking bridge: sanity 🚧 ✅ Networking MACsec: sanity 🚧 ✅ Networking route: pmtu 🚧 ✅ Networking tunnel: geneve basic test 🚧 ✅ L2TP basic test 🚧 ✅ Networking ipsec: basic netns tunnel 🚧 ✅ Networking vnic: ipvlan/basic 🚧 ✅ ALSA PCM loopback test 🚧 ✅ ALSA Control (mixer) Userspace Element test 🚧 ✅ storage: dm/common 🚧 ✅ trace: ftrace/tracer 🚧 ✅ Networking route_func: local 🚧 ✅ Networking route_func: forward Host 2: ✅ Boot test ✅ xfstests: ext4 ❌ xfstests: xfs ✅ selinux-policy: serge-testsuite ✅ lvm thinp sanity ✅ storage: software RAID testing 🚧 ✅ Storage blktests x86_64: Host 1: ✅ Boot test ✅ Storage SAN device stress - megaraid_sas Host 2: ✅ Boot test ✅ Storage SAN device stress - mpt3sas driver Host 3: ✅ Boot test 🚧 ✅ IPMI driver test 🚧 ✅ IPMItool loop stress test Host 4: ✅ Boot test ✅ Podman system integration test (as root) ✅ Podman system integration test (as user) ✅ Loopdev Sanity ✅ jvm test suite ✅ Memory function: memfd_create ✅ AMTU (Abstract Machine Test Utility) ✅ Ethernet drivers sanity ✅ Networking socket: fuzz ✅ Networking sctp-auth: sockopts test ✅ Networking: igmp conformance test ✅ Networking TCP: keepalive test ✅ Networking UDP: socket ✅ Networking tunnel: gre basic ✅ Networking tunnel: vxlan basic ✅ audit: audit testsuite test ✅ httpd: mod_ssl smoke sanity ✅ iotop: sanity ✅ tuned: tune-processes-through-perf ✅ pciutils: sanity smoke test ✅ Usex - version 1.9-29 ✅ storage: SCSI VPD ✅ stress: stress-ng 🚧 ✅ LTP lite 🚧 ✅ CIFS Connectathon 🚧 ✅ POSIX pjd-fstest suites 🚧 ✅ Memory function: kaslr 🚧 ✅ Networking bridge: sanity 🚧 ✅ Networking MACsec: sanity 🚧 ✅ Networking route: pmtu 🚧 ✅ Networking tunnel: geneve basic test 🚧 ✅ L2TP basic test 🚧 ✅ Networking vnic: ipvlan/basic 🚧 ✅ ALSA PCM loopback test 🚧 ✅ ALSA Control (mixer) Userspace Element test 🚧 ✅ storage: dm/common 🚧 ✅ trace: ftrace/tracer 🚧 ✅ Networking route_func: local 🚧 ✅ Networking route_func: forward 🚧 ✅ Networking ipsec: basic netns transport 🚧 ✅ Networking ipsec: basic netns tunnel Host 5: ✅ Boot test ✅ xfstests: ext4 ✅ xfstests: xfs ✅ selinux-policy: serge-testsuite ✅ lvm thinp sanity ✅ storage: software RAID testing 🚧 ✅ IOMMU boot test 🚧 ✅ Storage blktests Test sources: https://github.com/CKI-project/tests-beaker 💚 Pull requests are welcome for new tests or improvements to existing tests! Waived tests ------------ If the test run included waived tests, they are marked with 🚧. Such tests are executed but their results are not taken into account. Tests are waived when their results are not reliable enough, e.g. when they're just introduced or are being fixed.

5 years

1
0
0 0

[patch 12/18] mm/page_alloc.c: fix a crash in free_pages_prepare()

by akpm＠linux-foundation.org

From: Qian Cai <cai(a)lca.pw> Subject: mm/page_alloc.c: fix a crash in free_pages_prepare() On architectures like s390, arch_free_page() could mark the page unused (set_page_unused()) and any access later would trigger a kernel panic. Fix it by moving arch_free_page() after all possible accessing calls. Hardware name: IBM 2964 N96 400 (z/VM 6.4.0) Krnl PSW : 0404e00180000000 0000000026c2b96e (__free_pages_ok+0x34e/0x5d8) R:0 T:1 IO:0 EX:0 Key:0 M:1 W:0 P:0 AS:3 CC:2 PM:0 RI:0 EA:3 Krnl GPRS: 0000000088d43af7 0000000000484000 000000000000007c 000000000000000f 000003d080012100 000003d080013fc0 0000000000000000 0000000000100000 00000000275cca48 0000000000000100 0000000000000008 000003d080010000 00000000000001d0 000003d000000000 0000000026c2b78a 000000002717fdb0 Krnl Code: 0000000026c2b95c: ec1100b30659 risbgn %r1,%r1,0,179,6 0000000026c2b962: e32014000036 pfd 2,1024(%r1) #0000000026c2b968: d7ff10001000 xc 0(256,%r1),0(%r1) >0000000026c2b96e: 41101100 la %r1,256(%r1) 0000000026c2b972: a737fff8 brctg %r3,26c2b962 0000000026c2b976: d7ff10001000 xc 0(256,%r1),0(%r1) 0000000026c2b97c: e31003400004 lg %r1,832 0000000026c2b982: ebff1430016a asi 5168(%r1),-1 Call Trace: __free_pages_ok+0x16a/0x5d8) memblock_free_all+0x206/0x290 mem_init+0x58/0x120 start_kernel+0x2b0/0x570 startup_continue+0x6a/0xc0 INFO: lockdep is turned off. Last Breaking-Event-Address: __free_pages_ok+0x372/0x5d8 Kernel panic - not syncing: Fatal exception: panic_on_oops 00: HCPGIR450W CP entered; disabled wait PSW 00020001 80000000 00000000 26A2379C In the past, only kernel_poison_pages() would trigger this but it needs "page_poison=on" kernel cmdline, and I suspect nobody tested that on s390. Recently, kernel_init_free_pages() (commit 6471384af2a6 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options")) was added and could trigger this as well. [akpm(a)linux-foundation.org: add comment] Link: http://lkml.kernel.org/r/1569613623-16820-1-git-send-email-cai@lca.pw Fixes: 8823b1dbc05f ("mm/page_poison.c: enable PAGE_POISONING as a separate option") Fixes: 6471384af2a6 ("mm: security: introduce init_on_alloc=1 and init_on_free=1 boot options") Signed-off-by: Qian Cai <cai(a)lca.pw> Reviewed-by: Heiko Carstens <heiko.carstens(a)de.ibm.com> Acked-by: Christian Borntraeger <borntraeger(a)de.ibm.com> Acked-by: Michal Hocko <mhocko(a)suse.com> Cc: "Kirill A. Shutemov" <kirill(a)shutemov.name> Cc: Vasily Gorbik <gor(a)linux.ibm.com> Cc: Alexander Duyck <alexander.duyck(a)gmail.com> Cc: <stable(a)vger.kernel.org> [5.3+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/page_alloc.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) --- a/mm/page_alloc.c~mm-page_alloc-fix-a-crash-in-free_pages_prepare +++ a/mm/page_alloc.c @@ -1175,11 +1175,17 @@ static __always_inline bool free_pages_p debug_check_no_obj_freed(page_address(page), PAGE_SIZE << order); } - arch_free_page(page, order); if (want_init_on_free()) kernel_init_free_pages(page, 1 << order); kernel_poison_pages(page, 1 << order, 0); + /* + * arch_free_page() can make the page's contents inaccessible. s390 + * does this. So nothing which can access the page's contents should + * happen after this. + */ + arch_free_page(page, order); + if (debug_pagealloc_enabled()) kernel_map_pages(page, 1 << order, 0); _

5 years

1
0
0 0

[patch 11/18] mm/z3fold.c: claim page in the beginning of free

by akpm＠linux-foundation.org

From: Vitaly Wool <vitalywool(a)gmail.com> Subject: mm/z3fold.c: claim page in the beginning of free There's a really hard to reproduce race in z3fold between z3fold_free() and z3fold_reclaim_page(). z3fold_reclaim_page() can claim the page after z3fold_free() has checked if the page was claimed and z3fold_free() will then schedule this page for compaction which may in turn lead to random page faults (since that page would have been reclaimed by then). Fix that by claiming page in the beginning of z3fold_free() and not forgetting to clear the claim in the end. [vitalywool(a)gmail.com: v2] Link: http://lkml.kernel.org/r/20190928113456.152742cf@bigdell Link: http://lkml.kernel.org/r/20190926104844.4f0c6efa1366b8f5741eaba9@gmail.com Signed-off-by: Vitaly Wool <vitalywool(a)gmail.com> Reported-by: Markus Linnala <markus.linnala(a)gmail.com> Cc: Dan Streetman <ddstreet(a)ieee.org> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Henry Burns <henrywolfeburns(a)gmail.com> Cc: Shakeel Butt <shakeelb(a)google.com> Cc: Markus Linnala <markus.linnala(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/z3fold.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) --- a/mm/z3fold.c~z3fold-claim-page-in-the-beginning-of-free +++ a/mm/z3fold.c @@ -998,9 +998,11 @@ static void z3fold_free(struct z3fold_po struct z3fold_header *zhdr; struct page *page; enum buddy bud; + bool page_claimed; zhdr = handle_to_z3fold_header(handle); page = virt_to_page(zhdr); + page_claimed = test_and_set_bit(PAGE_CLAIMED, &page->private); if (test_bit(PAGE_HEADLESS, &page->private)) { /* if a headless page is under reclaim, just leave. @@ -1008,7 +1010,7 @@ static void z3fold_free(struct z3fold_po * has not been set before, we release this page * immediately so we don't care about its value any more. */ - if (!test_and_set_bit(PAGE_CLAIMED, &page->private)) { + if (!page_claimed) { spin_lock(&pool->lock); list_del(&page->lru); spin_unlock(&pool->lock); @@ -1044,13 +1046,15 @@ static void z3fold_free(struct z3fold_po atomic64_dec(&pool->pages_nr); return; } - if (test_bit(PAGE_CLAIMED, &page->private)) { + if (page_claimed) { + /* the page has not been claimed by us */ z3fold_page_unlock(zhdr); return; } if (unlikely(PageIsolated(page)) || test_and_set_bit(NEEDS_COMPACTING, &page->private)) { z3fold_page_unlock(zhdr); + clear_bit(PAGE_CLAIMED, &page->private); return; } if (zhdr->cpu < 0 || !cpu_online(zhdr->cpu)) { @@ -1060,10 +1064,12 @@ static void z3fold_free(struct z3fold_po zhdr->cpu = -1; kref_get(&zhdr->refcount); do_compact_page(zhdr, true); + clear_bit(PAGE_CLAIMED, &page->private); return; } kref_get(&zhdr->refcount); queue_work_on(zhdr->cpu, pool->compact_wq, &zhdr->work); + clear_bit(PAGE_CLAIMED, &page->private); z3fold_page_unlock(zhdr); } _

5 years

1
0
0 0

[patch 10/18] kernel/sysctl.c: do not override max_threads provided by userspace

by akpm＠linux-foundation.org

From: Michal Hocko <mhocko(a)suse.com> Subject: kernel/sysctl.c: do not override max_threads provided by userspace Partially revert 16db3d3f1170 ("kernel/sysctl.c: threads-max observe limits") because the patch is causing a regression to any workload which needs to override the auto-tuning of the limit provided by kernel. set_max_threads is implementing a boot time guesstimate to provide a sensible limit of the concurrently running threads so that runaways will not deplete all the memory. This is a good thing in general but there are workloads which might need to increase this limit for an application to run (reportedly WebSpher MQ is affected) and that is simply not possible after the mentioned change. It is also very dubious to override an admin decision by an estimation that doesn't have any direct relation to correctness of the kernel operation. Fix this by dropping set_max_threads from sysctl_max_threads so any value is accepted as long as it fits into MAX_THREADS which is important to check because allowing more threads could break internal robust futex restriction. While at it, do not use MIN_THREADS as the lower boundary because it is also only a heuristic for automatic estimation and admin might have a good reason to stop new threads to be created even when below this limit. This became more severe when we switched x86 from 4k to 8k kernel stacks. Starting since 6538b8ea886e ("x86_64: expand kernel stack to 16K") (3.16) we use THREAD_SIZE_ORDER = 2 and that halved the auto-tuned value. In the particular case 3.12 kernel.threads-max = 515561 4.4 kernel.threads-max = 200000 Neither of the two values is really insane on 32GB machine. I am not sure we want/need to tune the max_thread value further. If anything the tuning should be removed altogether if proven not useful in general. But we definitely need a way to override this auto-tuning. Link: http://lkml.kernel.org/r/20190922065801.GB18814@dhcp22.suse.cz Fixes: 16db3d3f1170 ("kernel/sysctl.c: threads-max observe limits") Signed-off-by: Michal Hocko <mhocko(a)suse.com> Reviewed-by: "Eric W. Biederman" <ebiederm(a)xmission.com> Cc: Heinrich Schuchardt <xypron.glpk(a)gmx.de> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- kernel/fork.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) --- a/kernel/fork.c~kernel-sysctlc-do-not-override-max_threads-provided-by-userspace +++ a/kernel/fork.c @@ -2925,7 +2925,7 @@ int sysctl_max_threads(struct ctl_table struct ctl_table t; int ret; int threads = max_threads; - int min = MIN_THREADS; + int min = 1; int max = MAX_THREADS; t = *table; @@ -2937,7 +2937,7 @@ int sysctl_max_threads(struct ctl_table if (ret || !write) return ret; - set_max_threads(threads); + max_threads = threads; return 0; } _

5 years

1
0
0 0

[patch 07/18] writeback: fix use-after-free in finish_writeback_work()

by akpm＠linux-foundation.org

From: Tejun Heo <tj(a)kernel.org> Subject: writeback: fix use-after-free in finish_writeback_work() finish_writeback_work() reads @done->waitq after decrementing @done->cnt. However, once @done->cnt reaches zero, @done may be freed (from stack) at any moment and @done->waitq can contain something unrelated by the time finish_writeback_work() tries to read it. This led to the following crash. "BUG: kernel NULL pointer dereference, address: 0000000000000002" #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] SMP DEBUG_PAGEALLOC CPU: 40 PID: 555153 Comm: kworker/u98:50 Kdump: loaded Not tainted ... Workqueue: writeback wb_workfn (flush-btrfs-1) RIP: 0010:_raw_spin_lock_irqsave+0x10/0x30 Code: 48 89 d8 5b c3 e8 50 db 6b ff eb f4 0f 1f 40 00 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 53 9c 5b fa 31 c0 ba 01 00 00 00 <f0> 0f b1 17 75 05 48 89 d8 5b c3 89 c6 e8 fe ca 6b ff eb f2 66 90 RSP: 0018:ffffc90049b27d98 EFLAGS: 00010046 RAX: 0000000000000000 RBX: 0000000000000246 RCX: 0000000000000000 RDX: 0000000000000001 RSI: 0000000000000003 RDI: 0000000000000002 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 R10: ffff889fff407600 R11: ffff88ba9395d740 R12: 000000000000e300 R13: 0000000000000003 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88bfdfa00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000002 CR3: 0000000002409005 CR4: 00000000001606e0 Call Trace: __wake_up_common_lock+0x63/0xc0 wb_workfn+0xd2/0x3e0 process_one_work+0x1f5/0x3f0 worker_thread+0x2d/0x3d0 kthread+0x111/0x130 ret_from_fork+0x1f/0x30 Fix it by reading and caching @done->waitq before decrementing @done->cnt. Link: http://lkml.kernel.org/r/20190924010631.GH2233839@devbig004.ftw2.facebook.c… Fixes: 5b9cce4c7eb069 ("writeback: Generalize and expose wb_completion") Signed-off-by: Tejun Heo <tj(a)kernel.org> Debugged-by: Chris Mason <clm(a)fb.com> Reviewed-by: Jens Axboe <axboe(a)kernel.dk> Cc: Jan Kara <jack(a)suse.cz> Cc: <stable(a)vger.kernel.org> [5.2+] Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- fs/fs-writeback.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) --- a/fs/fs-writeback.c~writeback-fix-use-after-free-in-finish_writeback_work +++ a/fs/fs-writeback.c @@ -164,8 +164,13 @@ static void finish_writeback_work(struct if (work->auto_free) kfree(work); - if (done && atomic_dec_and_test(&done->cnt)) - wake_up_all(done->waitq); + if (done) { + wait_queue_head_t *waitq = done->waitq; + + /* @done can't be accessed after the following dec */ + if (atomic_dec_and_test(&done->cnt)) + wake_up_all(waitq); + } } static void wb_queue_work(struct bdi_writeback *wb, _

5 years

1
0
0 0

[patch 05/18] panic: ensure preemption is disabled during panic()

by akpm＠linux-foundation.org

From: Will Deacon <will(a)kernel.org> Subject: panic: ensure preemption is disabled during panic() Calling 'panic()' on a kernel with CONFIG_PREEMPT=y can leave the calling CPU in an infinite loop, but with interrupts and preemption enabled. From this state, userspace can continue to be scheduled, despite the system being "dead" as far as the kernel is concerned. This is easily reproducible on arm64 when booting with "nosmp" on the command line; a couple of shell scripts print out a periodic "Ping" message whilst another triggers a crash by writing to /proc/sysrq-trigger: | sysrq: Trigger a crash | Kernel panic - not syncing: sysrq triggered crash | CPU: 0 PID: 1 Comm: init Not tainted 5.2.15 #1 | Hardware name: linux,dummy-virt (DT) | Call trace: | dump_backtrace+0x0/0x148 | show_stack+0x14/0x20 | dump_stack+0xa0/0xc4 | panic+0x140/0x32c | sysrq_handle_reboot+0x0/0x20 | __handle_sysrq+0x124/0x190 | write_sysrq_trigger+0x64/0x88 | proc_reg_write+0x60/0xa8 | __vfs_write+0x18/0x40 | vfs_write+0xa4/0x1b8 | ksys_write+0x64/0xf0 | __arm64_sys_write+0x14/0x20 | el0_svc_common.constprop.0+0xb0/0x168 | el0_svc_handler+0x28/0x78 | el0_svc+0x8/0xc | Kernel Offset: disabled | CPU features: 0x0002,24002004 | Memory Limit: none | ---[ end Kernel panic - not syncing: sysrq triggered crash ]--- | Ping 2! | Ping 1! | Ping 1! | Ping 2! The issue can also be triggered on x86 kernels if CONFIG_SMP=n, otherwise local interrupts are disabled in 'smp_send_stop()'. Disable preemption in 'panic()' before re-enabling interrupts. Link: http://lkml.kernel.org/r/20191002123538.22609-1-will@kernel.org Link: https://lore.kernel.org/r/BX1W47JXPMR8.58IYW53H6M5N@dragonstone Signed-off-by: Will Deacon <will(a)kernel.org> Reported-by: Xogium <contact(a)xogium.me> Reviewed-by: Kees Cook <keescook(a)chromium.org> Cc: Russell King <linux(a)armlinux.org.uk> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: Ingo Molnar <mingo(a)redhat.com> Cc: Petr Mladek <pmladek(a)suse.com> Cc: Feng Tang <feng.tang(a)intel.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- kernel/panic.c | 1 + 1 file changed, 1 insertion(+) --- a/kernel/panic.c~panic-ensure-preemption-is-disabled-during-panic +++ a/kernel/panic.c @@ -180,6 +180,7 @@ void panic(const char *fmt, ...) * after setting panic_cpu) from invoking panic() again. */ local_irq_disable(); + preempt_disable_notrace(); /* * It's possible to come here directly from a panic-assertion and _

5 years

1
0
0 0

[folded-merged] z3fold-claim-page-in-the-beginning-of-free-v2.patch removed from -mm tree

by akpm＠linux-foundation.org

The patch titled Subject: z3fold-claim-page-in-the-beginning-of-free-v2 has been removed from the -mm tree. Its filename was z3fold-claim-page-in-the-beginning-of-free-v2.patch This patch was dropped because it was folded into z3fold-claim-page-in-the-beginning-of-free.patch ------------------------------------------------------ From: Vitaly Wool <vitalywool(a)gmail.com> Subject: z3fold-claim-page-in-the-beginning-of-free-v2 Link: http://lkml.kernel.org/r/20190928113456.152742cf@bigdell Signed-off-by: Vitaly Wool <vitalywool(a)gmail.com> Reported-by: Markus Linnala <markus.linnala(a)gmail.com> Cc: Dan Streetman <ddstreet(a)ieee.org> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Henry Burns <henrywolfeburns(a)gmail.com> Cc: Shakeel Butt <shakeelb(a)google.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- mm/z3fold.c | 4 ++++ 1 file changed, 4 insertions(+) --- a/mm/z3fold.c~z3fold-claim-page-in-the-beginning-of-free-v2 +++ a/mm/z3fold.c @@ -1047,12 +1047,14 @@ static void z3fold_free(struct z3fold_po return; } if (page_claimed) { + /* the page has not been claimed by us */ z3fold_page_unlock(zhdr); return; } if (unlikely(PageIsolated(page)) || test_and_set_bit(NEEDS_COMPACTING, &page->private)) { z3fold_page_unlock(zhdr); + clear_bit(PAGE_CLAIMED, &page->private); return; } if (zhdr->cpu < 0 || !cpu_online(zhdr->cpu)) { @@ -1062,10 +1064,12 @@ static void z3fold_free(struct z3fold_po zhdr->cpu = -1; kref_get(&zhdr->refcount); do_compact_page(zhdr, true); + clear_bit(PAGE_CLAIMED, &page->private); return; } kref_get(&zhdr->refcount); queue_work_on(zhdr->cpu, pool->compact_wq, &zhdr->work); + clear_bit(PAGE_CLAIMED, &page->private); z3fold_page_unlock(zhdr); } _ Patches currently in -mm which might be from vitalywool(a)gmail.com are z3fold-claim-page-in-the-beginning-of-free.patch

5 years

1
0
0 0

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror October 2019