June 2023 - Linux-stable-mirror

+ scripts-fix-the-gfp-flags-header-path-in-gfp-translate.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: scripts: fix the gfp flags header path in gfp-translate has been added to the -mm mm-hotfixes-unstable branch. Its filename is scripts-fix-the-gfp-flags-header-path-in-gfp-translate.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Prathu Baronia <prathubaronia2011(a)gmail.com> Subject: scripts: fix the gfp flags header path in gfp-translate Date: Thu, 8 Jun 2023 21:14:49 +0530 Since gfp flags have been shifted to gfp_types.h so update the path in the gfp-translate script. Link: https://lkml.kernel.org/r/20230608154450.21758-1-prathubaronia2011@gmail.com Fixes: cb5a065b4ea9c ("headers/deps: mm: Split <linux/gfp_types.h> out of <linux/gfp.h>") Signed-off-by: Prathu Baronia <prathubaronia2011(a)gmail.com> Cc: Masahiro Yamada <masahiroy(a)kernel.org> Cc: Nathan Chancellor <nathan(a)kernel.org> Cc: Nick Desaulniers <ndesaulniers(a)google.com> Cc: Nicolas Schier <nicolas(a)fjasle.eu> Cc: Ingo Molnar <mingo(a)kernel.org> Cc: Yury Norov <yury.norov(a)gmail.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- scripts/gfp-translate | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) --- a/scripts/gfp-translate~scripts-fix-the-gfp-flags-header-path-in-gfp-translate +++ a/scripts/gfp-translate @@ -63,11 +63,11 @@ fi # Extract GFP flags from the kernel source TMPFILE=`mktemp -t gfptranslate-XXXXXX` || exit 1 -grep -q ___GFP $SOURCE/include/linux/gfp.h +grep -q ___GFP $SOURCE/include/linux/gfp_types.h if [ $? -eq 0 ]; then - grep "^#define ___GFP" $SOURCE/include/linux/gfp.h | sed -e 's/u$//' | grep -v GFP_BITS > $TMPFILE + grep "^#define ___GFP" $SOURCE/include/linux/gfp_types.h | sed -e 's/u$//' | grep -v GFP_BITS > $TMPFILE else - grep "^#define __GFP" $SOURCE/include/linux/gfp.h | sed -e 's/(__force gfp_t)//' | sed -e 's/u)/)/' | grep -v GFP_BITS | sed -e 's/)\//) \//' > $TMPFILE + grep "^#define __GFP" $SOURCE/include/linux/gfp_types.h | sed -e 's/(__force gfp_t)//' | sed -e 's/u)/)/' | grep -v GFP_BITS | sed -e 's/)\//) \//' > $TMPFILE fi # Parse the flags _ Patches currently in -mm which might be from prathubaronia2011(a)gmail.com are scripts-fix-the-gfp-flags-header-path-in-gfp-translate.patch

1 year, 6 months

1
0
0 0

[PATCH 2/2] USB: dwc3: fix use-after-free on core driver unbind

by Johan Hovold

Some dwc3 glue drivers are currently accessing the driver data of the child core device directly, which is clearly a bad idea as the child may not have probed yet or may have been unbound from its driver. As a workaround until the glue drivers have been fixed, clear the driver data pointer before allowing the glue parent device to runtime suspend to prevent its driver from accessing data that has been freed during unbind. Fixes: 6dd2565989b4 ("usb: dwc3: add imx8mp dwc3 glue layer driver") Fixes: 6895ea55c385 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend") Cc: stable(a)vger.kernel.org # 5.12 Cc: Li Jun <jun.li(a)nxp.com> Cc: Sandeep Maheswaram <quic_c_sanm(a)quicinc.com> Cc: Krishna Kurapati <quic_kriskura(a)quicinc.com> Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org> --- drivers/usb/dwc3/core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c index 7b2ce013cc5b..d68958e151a7 100644 --- a/drivers/usb/dwc3/core.c +++ b/drivers/usb/dwc3/core.c @@ -1929,6 +1929,11 @@ static int dwc3_remove(struct platform_device *pdev) pm_runtime_disable(&pdev->dev); pm_runtime_dont_use_autosuspend(&pdev->dev); pm_runtime_put_noidle(&pdev->dev); + /* + * HACK: Clear the driver data, which is currently accessed by parent + * glue drivers, before allowing the parent to suspend. + */ + platform_set_drvdata(pdev, NULL); pm_runtime_set_suspended(&pdev->dev); dwc3_free_event_buffers(dwc); -- 2.39.3

1 year, 6 months

4
6
0 0

[PATCH 1/2] USB: dwc3: qcom: fix NULL-deref on suspend

by Johan Hovold

The Qualcomm dwc3 glue driver is currently accessing the driver data of the child core device during suspend and on wakeup interrupts. This is clearly a bad idea as the child may not have probed yet or could have been unbound from its driver. The first such layering violation was part of the initial version of the driver, but this was later made worse when the hack that accesses the driver data of the grand child xhci device to configure the wakeup interrupts was added. Fixing this properly is not that easily done, so add a sanity check to make sure that the child driver data is non-NULL before dereferencing it for now. Note that this relies on subtleties like the fact that driver core is making sure that the parent is not suspended while the child is probing. Reported-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Link: https://lore.kernel.org/all/20230325165217.31069-4-manivannan.sadhasivam@li… Fixes: d9152161b4bf ("usb: dwc3: Add Qualcomm DWC3 glue layer driver") Fixes: 6895ea55c385 ("usb: dwc3: qcom: Configure wakeup interrupts during suspend") Cc: stable(a)vger.kernel.org # 3.18: a872ab303d5d: "usb: dwc3: qcom: fix use-after-free on runtime-PM wakeup" Cc: Sandeep Maheswaram <quic_c_sanm(a)quicinc.com> Cc: Krishna Kurapati <quic_kriskura(a)quicinc.com> Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org> --- drivers/usb/dwc3/dwc3-qcom.c | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/drivers/usb/dwc3/dwc3-qcom.c b/drivers/usb/dwc3/dwc3-qcom.c index 959fc925ca7c..79b22abf9727 100644 --- a/drivers/usb/dwc3/dwc3-qcom.c +++ b/drivers/usb/dwc3/dwc3-qcom.c @@ -308,7 +308,16 @@ static void dwc3_qcom_interconnect_exit(struct dwc3_qcom *qcom) /* Only usable in contexts where the role can not change. */ static bool dwc3_qcom_is_host(struct dwc3_qcom *qcom) { - struct dwc3 *dwc = platform_get_drvdata(qcom->dwc3); + struct dwc3 *dwc; + + /* + * FIXME: Fix this layering violation. + */ + dwc = platform_get_drvdata(qcom->dwc3); + + /* Core driver may not have probed yet. */ + if (!dwc) + return false; return dwc->xhci; } -- 2.39.3

1 year, 6 months

3
2
0 0

[PATCH bpf v2 0/2] bpf: fix NULL dereference during extable search

by Krister Johansen

Hi, Enclosed are a pair of patches for an oops that can occur if an exception is generated while a bpf subprogram is running. One of the bpf_prog_aux entries for the subprograms are missing an extable. This can lead to an exception that would otherwise be handled turning into a NULL pointer bug. The bulk of the change here is simply adding a pair of programs for the selftest. The proposed fix in this iteration is a 1-line change. These changes were tested via the verifier and progs selftests and no regressions were observed. Changes from v1: - Add a selftest (Feedback From Alexei Starovoitov) - Move to a 1-line verifier change instead of searching multiple extables Krister Johansen (2): Add a selftest for subprogram extables bpf: ensure main program has an extable kernel/bpf/verifier.c | 1 + .../bpf/prog_tests/subprogs_extable.c | 35 +++++++++ .../bpf/progs/test_subprogs_extable.c | 71 +++++++++++++++++++ 3 files changed, 107 insertions(+) create mode 100644 tools/testing/selftests/bpf/prog_tests/subprogs_extable.c create mode 100644 tools/testing/selftests/bpf/progs/test_subprogs_extable.c -- 2.25.1

1 year, 6 months

4
10
0 0

+ udmabuf-revert-add-support-for-mapping-hugepages-v4.patch added to mm-hotfixes-unstable branch

by Andrew Morton

The patch titled Subject: udmabuf: revert 'Add support for mapping hugepages (v4)' has been added to the -mm mm-hotfixes-unstable branch. Its filename is udmabuf-revert-add-support-for-mapping-hugepages-v4.patch This patch will shortly appear at https://git.kernel.org/pub/scm/linux/kernel/git/akpm/25-new.git/tree/patche… This patch will later appear in the mm-hotfixes-unstable branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/process/submit-checklist.rst when testing your code *** The -mm tree is included into linux-next via the mm-everything branch at git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm and is updated there every 2-3 working days ------------------------------------------------------ From: Mike Kravetz <mike.kravetz(a)oracle.com> Subject: udmabuf: revert 'Add support for mapping hugepages (v4)' Date: Thu, 8 Jun 2023 13:49:27 -0700 This effectively reverts commit 16c243e99d33 ("udmabuf: Add support for mapping hugepages (v4)"). Recently, Junxiao Chang found a BUG with page map counting as described here [1]. This issue pointed out that the udmabuf driver was making direct use of subpages of hugetlb pages. This is not a good idea, and no other mm code attempts such use. In addition to the mapcount issue, this also causes issues with hugetlb vmemmap optimization and page poisoning. For now, remove hugetlb support. If udmabuf wants to be used on hugetlb mappings, it should be changed to only use complete hugetlb pages. This will require different alignment and size requirements on the UDMABUF_CREATE API. [1] https://lore.kernel.org/linux-mm/20230512072036.1027784-1-junxiao.chang@int… Link: https://lkml.kernel.org/r/20230608204927.88711-1-mike.kravetz@oracle.com Fixes: 16c243e99d33 ("udmabuf: Add support for mapping hugepages (v4)") Signed-off-by: Mike Kravetz <mike.kravetz(a)oracle.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Dongwon Kim <dongwon.kim(a)intel.com> Cc: Gerd Hoffmann <kraxel(a)redhat.com> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: James Houghton <jthoughton(a)google.com> Cc: Jerome Marchand <jmarchan(a)redhat.com> Cc: Junxiao Chang <junxiao.chang(a)intel.com> Cc: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Cc: Michal Hocko <mhocko(a)suse.com> Cc: Muchun Song <muchun.song(a)linux.dev> Cc: Vivek Kasireddy <vivek.kasireddy(a)intel.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- drivers/dma-buf/udmabuf.c | 47 ++++-------------------------------- 1 file changed, 6 insertions(+), 41 deletions(-) --- a/drivers/dma-buf/udmabuf.c~udmabuf-revert-add-support-for-mapping-hugepages-v4 +++ a/drivers/dma-buf/udmabuf.c @@ -12,7 +12,6 @@ #include <linux/shmem_fs.h> #include <linux/slab.h> #include <linux/udmabuf.h> -#include <linux/hugetlb.h> #include <linux/vmalloc.h> #include <linux/iosys-map.h> @@ -207,9 +206,7 @@ static long udmabuf_create(struct miscde struct udmabuf *ubuf; struct dma_buf *buf; pgoff_t pgoff, pgcnt, pgidx, pgbuf = 0, pglimit; - struct page *page, *hpage = NULL; - pgoff_t subpgoff, maxsubpgs; - struct hstate *hpstate; + struct page *page; int seals, ret = -EINVAL; u32 i, flags; @@ -245,7 +242,7 @@ static long udmabuf_create(struct miscde if (!memfd) goto err; mapping = memfd->f_mapping; - if (!shmem_mapping(mapping) && !is_file_hugepages(memfd)) + if (!shmem_mapping(mapping)) goto err; seals = memfd_fcntl(memfd, F_GET_SEALS, 0); if (seals == -EINVAL) @@ -256,48 +253,16 @@ static long udmabuf_create(struct miscde goto err; pgoff = list[i].offset >> PAGE_SHIFT; pgcnt = list[i].size >> PAGE_SHIFT; - if (is_file_hugepages(memfd)) { - hpstate = hstate_file(memfd); - pgoff = list[i].offset >> huge_page_shift(hpstate); - subpgoff = (list[i].offset & - ~huge_page_mask(hpstate)) >> PAGE_SHIFT; - maxsubpgs = huge_page_size(hpstate) >> PAGE_SHIFT; - } for (pgidx = 0; pgidx < pgcnt; pgidx++) { - if (is_file_hugepages(memfd)) { - if (!hpage) { - hpage = find_get_page_flags(mapping, pgoff, - FGP_ACCESSED); - if (!hpage) { - ret = -EINVAL; - goto err; - } - } - page = hpage + subpgoff; - get_page(page); - subpgoff++; - if (subpgoff == maxsubpgs) { - put_page(hpage); - hpage = NULL; - subpgoff = 0; - pgoff++; - } - } else { - page = shmem_read_mapping_page(mapping, - pgoff + pgidx); - if (IS_ERR(page)) { - ret = PTR_ERR(page); - goto err; - } + page = shmem_read_mapping_page(mapping, pgoff + pgidx); + if (IS_ERR(page)) { + ret = PTR_ERR(page); + goto err; } ubuf->pages[pgbuf++] = page; } fput(memfd); memfd = NULL; - if (hpage) { - put_page(hpage); - hpage = NULL; - } } exp_info.ops = &udmabuf_ops; _ Patches currently in -mm which might be from mike.kravetz(a)oracle.com are udmabuf-revert-add-support-for-mapping-hugepages-v4.patch

1 year, 6 months

1
0
0 0

stable-rc/linux-6.3.y baseline: 175 runs, 3 regressions (v6.3.5-332-g6f9b6a83bd08)

by kernelci.org bot

stable-rc/linux-6.3.y baseline: 175 runs, 3 regressions (v6.3.5-332-g6f9b6a83bd08) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions -----------------------------+-------+---------------+----------+----------------------------+------------ at91-sama5d4_xplained | arm | lab-baylibre | gcc-10 | multi_v7_defconfig | 1 beagle-xm | arm | lab-baylibre | gcc-10 | omap2plus_defconfig | 1 mt8183-kukui-...uniper-sku16 | arm64 | lab-collabora | gcc-10 | defconfig+arm64-chromebook | 1 Details: https://kernelci.org/test/job/stable-rc/branch/linux-6.3.y/kernel/v6.3.5-33… Test: baseline Tree: stable-rc Branch: linux-6.3.y Describe: v6.3.5-332-g6f9b6a83bd08 URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: 6f9b6a83bd08fb6abac41d5a521adec785ea0e68 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions -----------------------------+-------+---------------+----------+----------------------------+------------ at91-sama5d4_xplained | arm | lab-baylibre | gcc-10 | multi_v7_defconfig | 1 Details: https://kernelci.org/test/plan/id/64822b2201938bde35306163 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: multi_v7_defconfig Compiler: gcc-10 (arm-linux-gnueabihf-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/linux-6.3.y/v6.3.5-332-g6f9b6a83bd0… HTML log: https://storage.kernelci.org//stable-rc/linux-6.3.y/v6.3.5-332-g6f9b6a83bd0… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/64822b2201938bde35306164 new failure (last pass: v6.3.5-46-gb8c049753f7c) platform | arch | lab | compiler | defconfig | regressions -----------------------------+-------+---------------+----------+----------------------------+------------ beagle-xm | arm | lab-baylibre | gcc-10 | omap2plus_defconfig | 1 Details: https://kernelci.org/test/plan/id/64822f7b790380318f30616c Results: 0 PASS, 1 FAIL, 0 SKIP Full config: omap2plus_defconfig Compiler: gcc-10 (arm-linux-gnueabihf-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/linux-6.3.y/v6.3.5-332-g6f9b6a83bd0… HTML log: https://storage.kernelci.org//stable-rc/linux-6.3.y/v6.3.5-332-g6f9b6a83bd0… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/64822f7b790380318f30616d new failure (last pass: v6.3.5-46-gb8c049753f7c) platform | arch | lab | compiler | defconfig | regressions -----------------------------+-------+---------------+----------+----------------------------+------------ mt8183-kukui-...uniper-sku16 | arm64 | lab-collabora | gcc-10 | defconfig+arm64-chromebook | 1 Details: https://kernelci.org/test/plan/id/64822ba155e922f3ba30623b Results: 164 PASS, 8 FAIL, 0 SKIP Full config: defconfig+arm64-chromebook Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/linux-6.3.y/v6.3.5-332-g6f9b6a83bd0… HTML log: https://storage.kernelci.org//stable-rc/linux-6.3.y/v6.3.5-332-g6f9b6a83bd0… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.mtk-thermal-probed: https://kernelci.org/test/case/id/64822ba155e922f3ba30623f failing since 6 days (last pass: v6.3.5, first fail: v6.3.5-46-gb8c049753f7c) 2023-06-08T19:27:19.743399 <8>[ 27.465002] <LAVA_SIGNAL_TESTCASE TEST_CASE_ID=mtk-thermal-driver-present RESULT=pass> 2023-06-08T19:27:20.761095 /lava-10645957/1/../bin/lava-test-case 2023-06-08T19:27:20.771425 <8>[ 28.494995] <LAVA_SIGNAL_TESTCASE TEST_CASE_ID=mtk-thermal-probed RESULT=fail>

1 year, 6 months

1
0
0 0

[PATCH V3] blk-cgroup: Flush stats before releasing blkcg_gq

by Ming Lei

As noted by Michal, the blkg_iostat_set's in the lockless list hold reference to blkg's to protect against their removal. Those blkg's hold reference to blkcg. When a cgroup is being destroyed, cgroup_rstat_flush() is only called at css_release_work_fn() which is called when the blkcg reference count reaches 0. This circular dependency will prevent blkcg and some blkgs from being freed after they are made offline. It is less a problem if the cgroup to be destroyed also has other controllers like memory that will call cgroup_rstat_flush() which will clean up the reference count. If block is the only controller that uses rstat, these offline blkcg and blkgs may never be freed leaking more and more memory over time. To prevent this potential memory leak: - flush blkcg per-cpu stats list in __blkg_release(), when no new stat can be added - add global blkg_stat_lock for covering concurrent parent blkg stat update - don't grab bio->bi_blkg reference when adding the stats into blkcg's per-cpu stat list since all stats are guaranteed to be consumed before releasing blkg instance, and grabbing blkg reference for stats was the most fragile part of original patch Based on Waiman's patch: https://lore.kernel.org/linux-block/20221215033132.230023-3-longman@redhat.… Fixes: 3b8cc6298724 ("blk-cgroup: Optimize blkcg_rstat_flush()") Cc: stable(a)vger.kernel.org Reported-by: Jay Shin <jaeshin(a)redhat.com> Cc: Waiman Long <longman(a)redhat.com> Cc: Tejun Heo <tj(a)kernel.org> Cc: mkoutny(a)suse.com Cc: Yosry Ahmed <yosryahmed(a)google.com> Signed-off-by: Ming Lei <ming.lei(a)redhat.com> --- V3: - add one global blkg_stat_lock for avoiding concurrent update on blkg stat; this way is easier for backport, also won't cause contention; V2: - remove kernel/cgroup change, and call blkcg_rstat_flush() to flush stat directly block/blk-cgroup.c | 40 +++++++++++++++++++++++++++++++--------- 1 file changed, 31 insertions(+), 9 deletions(-) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index 0ce64dd73cfe..f0b5c9c41cde 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -34,6 +34,8 @@ #include "blk-ioprio.h" #include "blk-throttle.h" +static void __blkcg_rstat_flush(struct blkcg *blkcg, int cpu); + /* * blkcg_pol_mutex protects blkcg_policy[] and policy [de]activation. * blkcg_pol_register_mutex nests outside of it and synchronizes entire @@ -56,6 +58,8 @@ static LIST_HEAD(all_blkcgs); /* protected by blkcg_pol_mutex */ bool blkcg_debug_stats = false; +static DEFINE_RAW_SPINLOCK(blkg_stat_lock); + #define BLKG_DESTROY_BATCH_SIZE 64 /* @@ -163,10 +167,20 @@ static void blkg_free(struct blkcg_gq *blkg) static void __blkg_release(struct rcu_head *rcu) { struct blkcg_gq *blkg = container_of(rcu, struct blkcg_gq, rcu_head); + struct blkcg *blkcg = blkg->blkcg; + int cpu; #ifdef CONFIG_BLK_CGROUP_PUNT_BIO WARN_ON(!bio_list_empty(&blkg->async_bios)); #endif + /* + * Flush all the non-empty percpu lockless lists before releasing + * us, given these stat belongs to us. + * + * blkg_stat_lock is for serializing blkg stat update + */ + for_each_possible_cpu(cpu) + __blkcg_rstat_flush(blkcg, cpu); /* release the blkcg and parent blkg refs this blkg has been holding */ css_put(&blkg->blkcg->css); @@ -951,23 +965,26 @@ static void blkcg_iostat_update(struct blkcg_gq *blkg, struct blkg_iostat *cur, u64_stats_update_end_irqrestore(&blkg->iostat.sync, flags); } -static void blkcg_rstat_flush(struct cgroup_subsys_state *css, int cpu) +static void __blkcg_rstat_flush(struct blkcg *blkcg, int cpu) { - struct blkcg *blkcg = css_to_blkcg(css); struct llist_head *lhead = per_cpu_ptr(blkcg->lhead, cpu); struct llist_node *lnode; struct blkg_iostat_set *bisc, *next_bisc; - /* Root-level stats are sourced from system-wide IO stats */ - if (!cgroup_parent(css->cgroup)) - return; - rcu_read_lock(); lnode = llist_del_all(lhead); if (!lnode) goto out; + /* + * For covering concurrent parent blkg update from blkg_release(). + * + * When flushing from cgroup, cgroup_rstat_lock is always held, so + * this lock won't cause contention most of time. + */ + raw_spin_lock(&blkg_stat_lock); + /* * Iterate only the iostat_cpu's queued in the lockless list. */ @@ -991,13 +1008,19 @@ static void blkcg_rstat_flush(struct cgroup_subsys_state *css, int cpu) if (parent && parent->parent) blkcg_iostat_update(parent, &blkg->iostat.cur, &blkg->iostat.last); - percpu_ref_put(&blkg->refcnt); } - + raw_spin_unlock(&blkg_stat_lock); out: rcu_read_unlock(); } +static void blkcg_rstat_flush(struct cgroup_subsys_state *css, int cpu) +{ + /* Root-level stats are sourced from system-wide IO stats */ + if (cgroup_parent(css->cgroup)) + __blkcg_rstat_flush(css_to_blkcg(css), cpu); +} + /* * We source root cgroup stats from the system-wide stats to avoid * tracking the same information twice and incurring overhead when no @@ -2075,7 +2098,6 @@ void blk_cgroup_bio_start(struct bio *bio) llist_add(&bis->lnode, lhead); WRITE_ONCE(bis->lqueued, true); - percpu_ref_get(&bis->blkg->refcnt); } u64_stats_update_end_irqrestore(&bis->sync, flags); -- 2.40.1

1 year, 6 months

4
9
0 0

stable-rc/linux-6.1.y baseline: 171 runs, 11 regressions (v6.1.31-265-g621717027bee)

by kernelci.org bot

stable-rc/linux-6.1.y baseline: 171 runs, 11 regressions (v6.1.31-265-g621717027bee) Regressions Summary ------------------- platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ asus-C436FA-Flip-hatch | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 asus-CM1400CXA-dalboz | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 asus-cx9400-volteer | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 beagle-xm | arm | lab-baylibre | gcc-10 | omap2plus_defconfig | 1 hp-x360-12b-c...4020-octopus | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 hp-x360-14-G1-sona | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 hp-x360-14a-cb0001xx-zork | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 lenovo-TPad-C13-Yoga-zork | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 mt8183-kukui-...uniper-sku16 | arm64 | lab-collabora | gcc-10 | defconfig+arm64-chromebook | 2 qemu_x86_64-uefi | x86_64 | lab-collabora | gcc-10 | x86_64_defconfig | 1 Details: https://kernelci.org/test/job/stable-rc/branch/linux-6.1.y/kernel/v6.1.31-2… Test: baseline Tree: stable-rc Branch: linux-6.1.y Describe: v6.1.31-265-g621717027bee URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git SHA: 621717027bee62901033052db34271ebbc0123f1 Test Regressions ---------------- platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ asus-C436FA-Flip-hatch | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 Details: https://kernelci.org/test/plan/id/64822914af5a733b06306134 Results: 6 PASS, 1 FAIL, 0 SKIP Full config: x86_64_defconfig+x86-chromebook Compiler: gcc-10 (gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… HTML log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/64822914af5a733b06306139 failing since 70 days (last pass: v6.1.21, first fail: v6.1.22) 2023-06-08T19:16:24.413595 + set +x 2023-06-08T19:16:24.419950 <8>[ 10.447591] <LAVA_SIGNAL_ENDRUN 0_dmesg 10645825_1.4.2.3.1> 2023-06-08T19:16:24.522003 2023-06-08T19:16:24.622626 / # #export SHELL=/bin/sh 2023-06-08T19:16:24.622814 2023-06-08T19:16:24.723280 / # export SHELL=/bin/sh. /lava-10645825/environment 2023-06-08T19:16:24.723483 2023-06-08T19:16:24.823953 / # . /lava-10645825/environment/lava-10645825/bin/lava-test-runner /lava-10645825/1 2023-06-08T19:16:24.824215 2023-06-08T19:16:24.829243 / # /lava-10645825/bin/lava-test-runner /lava-10645825/1 ... (12 line(s) more) platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ asus-CM1400CXA-dalboz | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 Details: https://kernelci.org/test/plan/id/648228f435d00cbc063061ae Results: 6 PASS, 1 FAIL, 0 SKIP Full config: x86_64_defconfig+x86-chromebook Compiler: gcc-10 (gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… HTML log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/648228f435d00cbc063061b3 failing since 70 days (last pass: v6.1.21, first fail: v6.1.22) 2023-06-08T19:16:00.991762 + <8>[ 11.157624] <LAVA_SIGNAL_ENDRUN 0_dmesg 10645769_1.4.2.3.1> 2023-06-08T19:16:00.991848 set +x 2023-06-08T19:16:01.096330 / # # 2023-06-08T19:16:01.196999 export SHELL=/bin/sh 2023-06-08T19:16:01.197152 # 2023-06-08T19:16:01.297677 / # export SHELL=/bin/sh. /lava-10645769/environment 2023-06-08T19:16:01.297826 2023-06-08T19:16:01.398367 / # . /lava-10645769/environment/lava-10645769/bin/lava-test-runner /lava-10645769/1 2023-06-08T19:16:01.398692 2023-06-08T19:16:01.402985 / # /lava-10645769/bin/lava-test-runner /lava-10645769/1 ... (12 line(s) more) platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ asus-cx9400-volteer | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 Details: https://kernelci.org/test/plan/id/648228f4c73886632830616e Results: 6 PASS, 1 FAIL, 0 SKIP Full config: x86_64_defconfig+x86-chromebook Compiler: gcc-10 (gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… HTML log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/648228f4c738866328306173 failing since 70 days (last pass: v6.1.21, first fail: v6.1.22) 2023-06-08T19:15:57.962024 <8>[ 10.957181] <LAVA_SIGNAL_ENDRUN 0_dmesg 10645779_1.4.2.3.1> 2023-06-08T19:15:57.965735 + set +x 2023-06-08T19:15:58.070286 # 2023-06-08T19:15:58.171791 / # #export SHELL=/bin/sh 2023-06-08T19:15:58.172371 2023-06-08T19:15:58.273446 / # export SHELL=/bin/sh. /lava-10645779/environment 2023-06-08T19:15:58.274087 2023-06-08T19:15:58.375527 / # . /lava-10645779/environment/lava-10645779/bin/lava-test-runner /lava-10645779/1 2023-06-08T19:15:58.376626 2023-06-08T19:15:58.381889 / # /lava-10645779/bin/lava-test-runner /lava-10645779/1 ... (12 line(s) more) platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ beagle-xm | arm | lab-baylibre | gcc-10 | omap2plus_defconfig | 1 Details: https://kernelci.org/test/plan/id/64822a776124bf50af306182 Results: 0 PASS, 1 FAIL, 0 SKIP Full config: omap2plus_defconfig Compiler: gcc-10 (arm-linux-gnueabihf-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… HTML log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/64822a776124bf50af306183 failing since 0 day (last pass: v6.1.31-40-g7d0a9678d276, first fail: v6.1.31-266-g8f4f686e321c) platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ hp-x360-12b-c...4020-octopus | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 Details: https://kernelci.org/test/plan/id/648228f5a6e7adbe22306178 Results: 6 PASS, 1 FAIL, 0 SKIP Full config: x86_64_defconfig+x86-chromebook Compiler: gcc-10 (gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… HTML log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/648228f5a6e7adbe2230617d failing since 70 days (last pass: v6.1.21, first fail: v6.1.22) 2023-06-08T19:15:51.141972 + set +x 2023-06-08T19:15:51.148406 <8>[ 11.146531] <LAVA_SIGNAL_ENDRUN 0_dmesg 10645801_1.4.2.3.1> 2023-06-08T19:15:51.252984 / # # 2023-06-08T19:15:51.353634 export SHELL=/bin/sh 2023-06-08T19:15:51.353802 # 2023-06-08T19:15:51.454287 / # export SHELL=/bin/sh. /lava-10645801/environment 2023-06-08T19:15:51.454473 2023-06-08T19:15:51.554938 / # . /lava-10645801/environment/lava-10645801/bin/lava-test-runner /lava-10645801/1 2023-06-08T19:15:51.555222 2023-06-08T19:15:51.559565 / # /lava-10645801/bin/lava-test-runner /lava-10645801/1 ... (11 line(s) more) platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ hp-x360-14-G1-sona | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 Details: https://kernelci.org/test/plan/id/648228fe8fbb58325e30614a Results: 6 PASS, 1 FAIL, 0 SKIP Full config: x86_64_defconfig+x86-chromebook Compiler: gcc-10 (gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… HTML log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/648228fe8fbb58325e30614f failing since 70 days (last pass: v6.1.21, first fail: v6.1.22) 2023-06-08T19:15:52.740696 <8>[ 10.600428] <LAVA_SIGNAL_ENDRUN 0_dmesg 10645796_1.4.2.3.1> 2023-06-08T19:15:52.744234 + set +x 2023-06-08T19:15:52.849273 # 2023-06-08T19:15:52.850362 2023-06-08T19:15:52.952518 / # #export SHELL=/bin/sh 2023-06-08T19:15:52.953297 2023-06-08T19:15:53.054661 / # export SHELL=/bin/sh. /lava-10645796/environment 2023-06-08T19:15:53.055475 2023-06-08T19:15:53.157054 / # . /lava-10645796/environment/lava-10645796/bin/lava-test-runner /lava-10645796/1 2023-06-08T19:15:53.158175 ... (13 line(s) more) platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ hp-x360-14a-cb0001xx-zork | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 Details: https://kernelci.org/test/plan/id/64822919461986ba573061ae Results: 6 PASS, 1 FAIL, 0 SKIP Full config: x86_64_defconfig+x86-chromebook Compiler: gcc-10 (gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… HTML log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/64822919461986ba573061b3 failing since 70 days (last pass: v6.1.21, first fail: v6.1.22) 2023-06-08T19:16:15.796634 + set<8>[ 8.593668] <LAVA_SIGNAL_ENDRUN 0_dmesg 10645804_1.4.2.3.1> 2023-06-08T19:16:15.797211 +x 2023-06-08T19:16:15.904834 / # # 2023-06-08T19:16:16.007416 export SHELL=/bin/sh 2023-06-08T19:16:16.008206 # 2023-06-08T19:16:16.109756 / # export SHELL=/bin/sh. /lava-10645804/environment 2023-06-08T19:16:16.110551 2023-06-08T19:16:16.212233 / # . /lava-10645804/environment/lava-10645804/bin/lava-test-runner /lava-10645804/1 2023-06-08T19:16:16.213541 2023-06-08T19:16:16.219020 / # /lava-10645804/bin/lava-test-runner /lava-10645804/1 ... (12 line(s) more) platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ lenovo-TPad-C13-Yoga-zork | x86_64 | lab-collabora | gcc-10 | x86_64_defcon...6-chromebook | 1 Details: https://kernelci.org/test/plan/id/648228e09837b30777306145 Results: 6 PASS, 1 FAIL, 0 SKIP Full config: x86_64_defconfig+x86-chromebook Compiler: gcc-10 (gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… HTML log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/648228e09837b3077730614a failing since 70 days (last pass: v6.1.21, first fail: v6.1.22) 2023-06-08T19:15:37.491956 + set<8>[ 11.805794] <LAVA_SIGNAL_ENDRUN 0_dmesg 10645746_1.4.2.3.1> 2023-06-08T19:15:37.492040 +x 2023-06-08T19:15:37.596520 / # # 2023-06-08T19:15:37.697137 export SHELL=/bin/sh 2023-06-08T19:15:37.697321 # 2023-06-08T19:15:37.797864 / # export SHELL=/bin/sh. /lava-10645746/environment 2023-06-08T19:15:37.798086 2023-06-08T19:15:37.898637 / # . /lava-10645746/environment/lava-10645746/bin/lava-test-runner /lava-10645746/1 2023-06-08T19:15:37.898955 2023-06-08T19:15:37.903377 / # /lava-10645746/bin/lava-test-runner /lava-10645746/1 ... (12 line(s) more) platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ mt8183-kukui-...uniper-sku16 | arm64 | lab-collabora | gcc-10 | defconfig+arm64-chromebook | 2 Details: https://kernelci.org/test/plan/id/648225a112d5daa19b306160 Results: 166 PASS, 5 FAIL, 0 SKIP Full config: defconfig+arm64-chromebook Compiler: gcc-10 (aarch64-linux-gnu-gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… HTML log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.bootrr.mt6577-auxadc-probed: https://kernelci.org/test/case/id/648225a112d5daa19b30617c failing since 28 days (last pass: v6.1.27, first fail: v6.1.28) 2023-06-08T19:01:53.563218 /lava-10645635/1/../bin/lava-test-case 2023-06-08T19:01:53.573420 <8>[ 22.938460] <LAVA_SIGNAL_TESTCASE TEST_CASE_ID=mt6577-auxadc-probed RESULT=fail> * baseline.bootrr.deferred-probe-empty: https://kernelci.org/test/case/id/648225a212d5daa19b306208 failing since 28 days (last pass: v6.1.27, first fail: v6.1.28) 2023-06-08T19:01:48.152751 + <8>[ 17.521744] <LAVA_SIGNAL_ENDRUN 0_dmesg 10645635_1.5.2.3.1> 2023-06-08T19:01:48.155822 set +x 2023-06-08T19:01:48.261553 / # # 2023-06-08T19:01:48.363927 export SHELL=/bin/sh 2023-06-08T19:01:48.364437 # 2023-06-08T19:01:48.465629 / # export SHELL=/bin/sh. /lava-10645635/environment 2023-06-08T19:01:48.466499 2023-06-08T19:01:48.568020 / # . /lava-10645635/environment/lava-10645635/bin/lava-test-runner /lava-10645635/1 2023-06-08T19:01:48.568288 2023-06-08T19:01:48.573088 / # /lava-10645635/bin/lava-test-runner /lava-10645635/1 ... (13 line(s) more) platform | arch | lab | compiler | defconfig | regressions -----------------------------+--------+---------------+----------+------------------------------+------------ qemu_x86_64-uefi | x86_64 | lab-collabora | gcc-10 | x86_64_defconfig | 1 Details: https://kernelci.org/test/plan/id/64822463107a05620530614a Results: 0 PASS, 1 FAIL, 0 SKIP Full config: x86_64_defconfig Compiler: gcc-10 (gcc (Debian 10.2.1-6) 10.2.1 20210110) Plain log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… HTML log: https://storage.kernelci.org//stable-rc/linux-6.1.y/v6.1.31-265-g621717027b… Rootfs: http://storage.kernelci.org/images/rootfs/buildroot/buildroot-baseline/2023… * baseline.login: https://kernelci.org/test/case/id/64822463107a05620530614b new failure (last pass: v6.1.31-266-g8f4f686e321c)

1 year, 6 months

1
0
0 0

[PATCH 5.15] xfs: verify buffer contents when we skip log replay

by Leah Rumancik

From: "Darrick J. Wong" <djwong(a)kernel.org> [ Upstream commit 22ed903eee23a5b174e240f1cdfa9acf393a5210 ] syzbot detected a crash during log recovery: XFS (loop0): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 XFS (loop0): Torn write (CRC failure) detected at log block 0x180. Truncating head block from 0x200. XFS (loop0): Starting recovery (logdev: internal) ================================================================== BUG: KASAN: slab-out-of-bounds in xfs_btree_lookup_get_block+0x15c/0x6d0 fs/xfs/libxfs/xfs_btree.c:1813 Read of size 8 at addr ffff88807e89f258 by task syz-executor132/5074 CPU: 0 PID: 5074 Comm: syz-executor132 Not tainted 6.2.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106 print_address_description+0x74/0x340 mm/kasan/report.c:306 print_report+0x107/0x1f0 mm/kasan/report.c:417 kasan_report+0xcd/0x100 mm/kasan/report.c:517 xfs_btree_lookup_get_block+0x15c/0x6d0 fs/xfs/libxfs/xfs_btree.c:1813 xfs_btree_lookup+0x346/0x12c0 fs/xfs/libxfs/xfs_btree.c:1913 xfs_btree_simple_query_range+0xde/0x6a0 fs/xfs/libxfs/xfs_btree.c:4713 xfs_btree_query_range+0x2db/0x380 fs/xfs/libxfs/xfs_btree.c:4953 xfs_refcount_recover_cow_leftovers+0x2d1/0xa60 fs/xfs/libxfs/xfs_refcount.c:1946 xfs_reflink_recover_cow+0xab/0x1b0 fs/xfs/xfs_reflink.c:930 xlog_recover_finish+0x824/0x920 fs/xfs/xfs_log_recover.c:3493 xfs_log_mount_finish+0x1ec/0x3d0 fs/xfs/xfs_log.c:829 xfs_mountfs+0x146a/0x1ef0 fs/xfs/xfs_mount.c:933 xfs_fs_fill_super+0xf95/0x11f0 fs/xfs/xfs_super.c:1666 get_tree_bdev+0x400/0x620 fs/super.c:1282 vfs_get_tree+0x88/0x270 fs/super.c:1489 do_new_mount+0x289/0xad0 fs/namespace.c:3145 do_mount fs/namespace.c:3488 [inline] __do_sys_mount fs/namespace.c:3697 [inline] __se_sys_mount+0x2d3/0x3c0 fs/namespace.c:3674 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f89fa3f4aca Code: 83 c4 08 5b 5d c3 66 2e 0f 1f 84 00 00 00 00 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fffd5fb5ef8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00646975756f6e2c RCX: 00007f89fa3f4aca RDX: 0000000020000100 RSI: 0000000020009640 RDI: 00007fffd5fb5f10 RBP: 00007fffd5fb5f10 R08: 00007fffd5fb5f50 R09: 000000000000970d R10: 0000000000200800 R11: 0000000000000206 R12: 0000000000000004 R13: 0000555556c6b2c0 R14: 0000000000200800 R15: 00007fffd5fb5f50 </TASK> The fuzzed image contains an AGF with an obviously garbage agf_refcount_level value of 32, and a dirty log with a buffer log item for that AGF. The ondisk AGF has a higher LSN than the recovered log item. xlog_recover_buf_commit_pass2 reads the buffer, compares the LSNs, and decides to skip replay because the ondisk buffer appears to be newer. Unfortunately, the ondisk buffer is corrupt, but recovery just read the buffer with no buffer ops specified: error = xfs_buf_read(mp->m_ddev_targp, buf_f->blf_blkno, buf_f->blf_len, buf_flags, &bp, NULL); Skipping the buffer leaves its contents in memory unverified. This sets us up for a kernel crash because xfs_refcount_recover_cow_leftovers reads the buffer (which is still around in XBF_DONE state, so no read verification) and creates a refcountbt cursor of height 32. This is impossible so we run off the end of the cursor object and crash. Fix this by invoking the verifier on all skipped buffers and aborting log recovery if the ondisk buffer is corrupt. It might be smarter to force replay the log item atop the buffer and then see if it'll pass the write verifier (like ext4 does) but for now let's go with the conservative option where we stop immediately. Link: https://syzkaller.appspot.com/bug?extid=7e9494b8b399902e994e Signed-off-by: Darrick J. Wong <djwong(a)kernel.org> Reviewed-by: Dave Chinner <dchinner(a)redhat.com> Signed-off-by: Dave Chinner <david(a)fromorbit.com> Signed-off-by: Leah Rumancik <leah.rumancik(a)gmail.com> --- Hi, Tested and good to go for 5.15.y. Thanks, Leah fs/xfs/xfs_buf_item_recover.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/fs/xfs/xfs_buf_item_recover.c b/fs/xfs/xfs_buf_item_recover.c index 991fbf1eb564..e04e44ef14c6 100644 --- a/fs/xfs/xfs_buf_item_recover.c +++ b/fs/xfs/xfs_buf_item_recover.c @@ -934,6 +934,16 @@ xlog_recover_buf_commit_pass2( if (lsn && lsn != -1 && XFS_LSN_CMP(lsn, current_lsn) >= 0) { trace_xfs_log_recover_buf_skip(log, buf_f); xlog_recover_validate_buf_type(mp, bp, buf_f, NULLCOMMITLSN); + + /* + * We're skipping replay of this buffer log item due to the log + * item LSN being behind the ondisk buffer. Verify the buffer + * contents since we aren't going to run the write verifier. + */ + if (bp->b_ops) { + bp->b_ops->verify_read(bp); + error = bp->b_error; + } goto out_release; } -- 2.41.0.162.gfafddb0af9-goog

1 year, 6 months

1
0
0 0

[PATCH] shmem: Use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs

by Roberto Sassu

From: Roberto Sassu <roberto.sassu(a)huawei.com> As the ramfs-based tmpfs uses ramfs_init_fs_context() for the init_fs_context method, which allocates fc->s_fs_info, use ramfs_kill_sb() to free it and avoid a memory leak. Cc: stable(a)vger.kernel.org # v5.4.x Fixes: f32356261d44 ("vfs: Convert ramfs, shmem, tmpfs, devtmpfs, rootfs to use the new mount API") Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com> --- fs/ramfs/inode.c | 2 +- include/linux/ramfs.h | 1 + mm/shmem.c | 2 +- 3 files changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/ramfs/inode.c b/fs/ramfs/inode.c index 5ba580c7883..fef477c7810 100644 --- a/fs/ramfs/inode.c +++ b/fs/ramfs/inode.c @@ -278,7 +278,7 @@ int ramfs_init_fs_context(struct fs_context *fc) return 0; } -static void ramfs_kill_sb(struct super_block *sb) +void ramfs_kill_sb(struct super_block *sb) { kfree(sb->s_fs_info); kill_litter_super(sb); diff --git a/include/linux/ramfs.h b/include/linux/ramfs.h index 917528d102c..d506dc63dd4 100644 --- a/include/linux/ramfs.h +++ b/include/linux/ramfs.h @@ -7,6 +7,7 @@ struct inode *ramfs_get_inode(struct super_block *sb, const struct inode *dir, umode_t mode, dev_t dev); extern int ramfs_init_fs_context(struct fs_context *fc); +extern void ramfs_kill_sb(struct super_block *sb); #ifdef CONFIG_MMU static inline int diff --git a/mm/shmem.c b/mm/shmem.c index e40a08c5c6d..74abb97ea55 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -4196,7 +4196,7 @@ static struct file_system_type shmem_fs_type = { .name = "tmpfs", .init_fs_context = ramfs_init_fs_context, .parameters = ramfs_fs_parameters, - .kill_sb = kill_litter_super, + .kill_sb = ramfs_kill_sb, .fs_flags = FS_USERNS_MOUNT, }; -- 2.25.1

1 year, 6 months

2
2
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror June 2023