I'm announcing the release of the 5.10.125 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git%3Ba=summa...
thanks,
greg k-h
------------
Makefile | 2 arch/arm64/mm/cache.S | 2 arch/s390/mm/pgtable.c | 2 drivers/tty/serial/serial_core.c | 34 ++++-------- drivers/usb/gadget/function/u_ether.c | 11 +++- fs/io_uring.c | 23 +++++--- fs/zonefs/super.c | 92 ++++++++++++++++++++++------------ net/ipv4/inet_hashtables.c | 31 ++++++++--- 8 files changed, 122 insertions(+), 75 deletions(-)
Christian Borntraeger (1): s390/mm: use non-quiescing sske for KVM switch to keyed guest
Damien Le Moal (1): zonefs: fix zonefs_iomap_begin() for reads
Eric Dumazet (1): tcp: add some entropy in __inet_hash_connect()
Greg Kroah-Hartman (1): Linux 5.10.125
Jens Axboe (1): io_uring: add missing item types for various requests
Lukas Wunner (1): serial: core: Initialize rs485 RTS polarity already on probe
Marian Postevca (1): usb: gadget: u_ether: fix regression in setting fixed MAC address
Will Deacon (1): arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
Willy Tarreau (5): tcp: use different parts of the port_offset for index and offset tcp: add small random increments to the source port tcp: dynamically allocate the perturb table used by source ports tcp: increase source port perturb table to 2^16 tcp: drop the hash_32() part from the index calculation
diff --git a/Makefile b/Makefile index 9ed79a05a972..da5b28931e5c 100644 --- a/Makefile +++ b/Makefile @@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 5 PATCHLEVEL = 10 -SUBLEVEL = 124 +SUBLEVEL = 125 EXTRAVERSION = NAME = Dare mighty things
diff --git a/arch/arm64/mm/cache.S b/arch/arm64/mm/cache.S index 2d881f34dd9d..7b8158ae36ec 100644 --- a/arch/arm64/mm/cache.S +++ b/arch/arm64/mm/cache.S @@ -228,8 +228,6 @@ SYM_FUNC_END_PI(__dma_flush_area) * - dir - DMA direction */ SYM_FUNC_START_PI(__dma_map_area) - cmp w2, #DMA_FROM_DEVICE - b.eq __dma_inv_area b __dma_clean_area SYM_FUNC_END_PI(__dma_map_area)
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c index fabaedddc90c..1c05caf68e7d 100644 --- a/arch/s390/mm/pgtable.c +++ b/arch/s390/mm/pgtable.c @@ -734,7 +734,7 @@ void ptep_zap_key(struct mm_struct *mm, unsigned long addr, pte_t *ptep) pgste_val(pgste) |= PGSTE_GR_BIT | PGSTE_GC_BIT; ptev = pte_val(*ptep); if (!(ptev & _PAGE_INVALID) && (ptev & _PAGE_WRITE)) - page_set_storage_key(ptev & PAGE_MASK, PAGE_DEFAULT_KEY, 1); + page_set_storage_key(ptev & PAGE_MASK, PAGE_DEFAULT_KEY, 0); pgste_set_unlock(ptep, pgste); preempt_enable(); } diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c index 19f0c5db11e3..32d09d024f6c 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -144,6 +144,11 @@ uart_update_mctrl(struct uart_port *port, unsigned int set, unsigned int clear) unsigned long flags; unsigned int old;
+ if (port->rs485.flags & SER_RS485_ENABLED) { + set &= ~TIOCM_RTS; + clear &= ~TIOCM_RTS; + } + spin_lock_irqsave(&port->lock, flags); old = port->mctrl; port->mctrl = (old & ~clear) | set; @@ -157,23 +162,10 @@ uart_update_mctrl(struct uart_port *port, unsigned int set, unsigned int clear)
static void uart_port_dtr_rts(struct uart_port *uport, int raise) { - int rs485_on = uport->rs485_config && - (uport->rs485.flags & SER_RS485_ENABLED); - int RTS_after_send = !!(uport->rs485.flags & SER_RS485_RTS_AFTER_SEND); - - if (raise) { - if (rs485_on && RTS_after_send) { - uart_set_mctrl(uport, TIOCM_DTR); - uart_clear_mctrl(uport, TIOCM_RTS); - } else { - uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS); - } - } else { - unsigned int clear = TIOCM_DTR; - - clear |= (!rs485_on || RTS_after_send) ? TIOCM_RTS : 0; - uart_clear_mctrl(uport, clear); - } + if (raise) + uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS); + else + uart_clear_mctrl(uport, TIOCM_DTR | TIOCM_RTS); }
/* @@ -1116,11 +1108,6 @@ uart_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear) goto out;
if (!tty_io_error(tty)) { - if (uport->rs485.flags & SER_RS485_ENABLED) { - set &= ~TIOCM_RTS; - clear &= ~TIOCM_RTS; - } - uart_update_mctrl(uport, set, clear); ret = 0; } @@ -2429,6 +2416,9 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state, */ spin_lock_irqsave(&port->lock, flags); port->mctrl &= TIOCM_DTR; + if (port->rs485.flags & SER_RS485_ENABLED && + !(port->rs485.flags & SER_RS485_RTS_AFTER_SEND)) + port->mctrl |= TIOCM_RTS; port->ops->set_mctrl(port, port->mctrl); spin_unlock_irqrestore(&port->lock, flags);
diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c index a40be8b448c2..64ef97ab9274 100644 --- a/drivers/usb/gadget/function/u_ether.c +++ b/drivers/usb/gadget/function/u_ether.c @@ -772,9 +772,13 @@ struct eth_dev *gether_setup_name(struct usb_gadget *g, dev->qmult = qmult; snprintf(net->name, sizeof(net->name), "%s%%d", netname);
- if (get_ether_addr(dev_addr, net->dev_addr)) + if (get_ether_addr(dev_addr, net->dev_addr)) { + net->addr_assign_type = NET_ADDR_RANDOM; dev_warn(&g->dev, "using random %s ethernet address\n", "self"); + } else { + net->addr_assign_type = NET_ADDR_SET; + } if (get_ether_addr(host_addr, dev->host_mac)) dev_warn(&g->dev, "using random %s ethernet address\n", "host"); @@ -831,6 +835,9 @@ struct net_device *gether_setup_name_default(const char *netname) INIT_LIST_HEAD(&dev->tx_reqs); INIT_LIST_HEAD(&dev->rx_reqs);
+ /* by default we always have a random MAC address */ + net->addr_assign_type = NET_ADDR_RANDOM; + skb_queue_head_init(&dev->rx_frames);
/* network device setup */ @@ -868,7 +875,6 @@ int gether_register_netdev(struct net_device *net) g = dev->gadget;
memcpy(net->dev_addr, dev->dev_mac, ETH_ALEN); - net->addr_assign_type = NET_ADDR_RANDOM;
status = register_netdev(net); if (status < 0) { @@ -908,6 +914,7 @@ int gether_set_dev_addr(struct net_device *net, const char *dev_addr) if (get_ether_addr(dev_addr, new_addr)) return -EINVAL; memcpy(dev->dev_mac, new_addr, ETH_ALEN); + net->addr_assign_type = NET_ADDR_SET; return 0; } EXPORT_SYMBOL_GPL(gether_set_dev_addr); diff --git a/fs/io_uring.c b/fs/io_uring.c index 871475d3fca2..40ac37beca47 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -773,7 +773,8 @@ static const struct io_op_def io_op_defs[] = { .buffer_select = 1, .needs_async_data = 1, .async_size = sizeof(struct io_async_rw), - .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG, + .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG | + IO_WQ_WORK_FILES, }, [IORING_OP_WRITEV] = { .needs_file = 1, @@ -783,7 +784,7 @@ static const struct io_op_def io_op_defs[] = { .needs_async_data = 1, .async_size = sizeof(struct io_async_rw), .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG | - IO_WQ_WORK_FSIZE, + IO_WQ_WORK_FSIZE | IO_WQ_WORK_FILES, }, [IORING_OP_FSYNC] = { .needs_file = 1, @@ -794,7 +795,8 @@ static const struct io_op_def io_op_defs[] = { .unbound_nonreg_file = 1, .pollin = 1, .async_size = sizeof(struct io_async_rw), - .work_flags = IO_WQ_WORK_BLKCG | IO_WQ_WORK_MM, + .work_flags = IO_WQ_WORK_BLKCG | IO_WQ_WORK_MM | + IO_WQ_WORK_FILES, }, [IORING_OP_WRITE_FIXED] = { .needs_file = 1, @@ -803,7 +805,7 @@ static const struct io_op_def io_op_defs[] = { .pollout = 1, .async_size = sizeof(struct io_async_rw), .work_flags = IO_WQ_WORK_BLKCG | IO_WQ_WORK_FSIZE | - IO_WQ_WORK_MM, + IO_WQ_WORK_MM | IO_WQ_WORK_FILES, }, [IORING_OP_POLL_ADD] = { .needs_file = 1, @@ -857,7 +859,7 @@ static const struct io_op_def io_op_defs[] = { .pollout = 1, .needs_async_data = 1, .async_size = sizeof(struct io_async_connect), - .work_flags = IO_WQ_WORK_MM, + .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_FS, }, [IORING_OP_FALLOCATE] = { .needs_file = 1, @@ -885,7 +887,8 @@ static const struct io_op_def io_op_defs[] = { .pollin = 1, .buffer_select = 1, .async_size = sizeof(struct io_async_rw), - .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG, + .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG | + IO_WQ_WORK_FILES, }, [IORING_OP_WRITE] = { .needs_file = 1, @@ -894,7 +897,7 @@ static const struct io_op_def io_op_defs[] = { .pollout = 1, .async_size = sizeof(struct io_async_rw), .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG | - IO_WQ_WORK_FSIZE, + IO_WQ_WORK_FSIZE | IO_WQ_WORK_FILES, }, [IORING_OP_FADVISE] = { .needs_file = 1, @@ -907,14 +910,16 @@ static const struct io_op_def io_op_defs[] = { .needs_file = 1, .unbound_nonreg_file = 1, .pollout = 1, - .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG, + .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG | + IO_WQ_WORK_FS, }, [IORING_OP_RECV] = { .needs_file = 1, .unbound_nonreg_file = 1, .pollin = 1, .buffer_select = 1, - .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG, + .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG | + IO_WQ_WORK_FS, }, [IORING_OP_OPENAT2] = { .work_flags = IO_WQ_WORK_FILES | IO_WQ_WORK_FS | diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c index 8c7d01e907a3..bf5cb6efb8c0 100644 --- a/fs/zonefs/super.c +++ b/fs/zonefs/super.c @@ -68,15 +68,49 @@ static inline void zonefs_i_size_write(struct inode *inode, loff_t isize) zi->i_flags &= ~ZONEFS_ZONE_OPEN; }
-static int zonefs_iomap_begin(struct inode *inode, loff_t offset, loff_t length, - unsigned int flags, struct iomap *iomap, - struct iomap *srcmap) +static int zonefs_read_iomap_begin(struct inode *inode, loff_t offset, + loff_t length, unsigned int flags, + struct iomap *iomap, struct iomap *srcmap) { struct zonefs_inode_info *zi = ZONEFS_I(inode); struct super_block *sb = inode->i_sb; loff_t isize;
- /* All I/Os should always be within the file maximum size */ + /* + * All blocks are always mapped below EOF. If reading past EOF, + * act as if there is a hole up to the file maximum size. + */ + mutex_lock(&zi->i_truncate_mutex); + iomap->bdev = inode->i_sb->s_bdev; + iomap->offset = ALIGN_DOWN(offset, sb->s_blocksize); + isize = i_size_read(inode); + if (iomap->offset >= isize) { + iomap->type = IOMAP_HOLE; + iomap->addr = IOMAP_NULL_ADDR; + iomap->length = length; + } else { + iomap->type = IOMAP_MAPPED; + iomap->addr = (zi->i_zsector << SECTOR_SHIFT) + iomap->offset; + iomap->length = isize - iomap->offset; + } + mutex_unlock(&zi->i_truncate_mutex); + + return 0; +} + +static const struct iomap_ops zonefs_read_iomap_ops = { + .iomap_begin = zonefs_read_iomap_begin, +}; + +static int zonefs_write_iomap_begin(struct inode *inode, loff_t offset, + loff_t length, unsigned int flags, + struct iomap *iomap, struct iomap *srcmap) +{ + struct zonefs_inode_info *zi = ZONEFS_I(inode); + struct super_block *sb = inode->i_sb; + loff_t isize; + + /* All write I/Os should always be within the file maximum size */ if (WARN_ON_ONCE(offset + length > zi->i_max_size)) return -EIO;
@@ -86,7 +120,7 @@ static int zonefs_iomap_begin(struct inode *inode, loff_t offset, loff_t length, * operation. */ if (WARN_ON_ONCE(zi->i_ztype == ZONEFS_ZTYPE_SEQ && - (flags & IOMAP_WRITE) && !(flags & IOMAP_DIRECT))) + !(flags & IOMAP_DIRECT))) return -EIO;
/* @@ -95,45 +129,42 @@ static int zonefs_iomap_begin(struct inode *inode, loff_t offset, loff_t length, * write pointer) and unwriten beyond. */ mutex_lock(&zi->i_truncate_mutex); + iomap->bdev = inode->i_sb->s_bdev; + iomap->offset = ALIGN_DOWN(offset, sb->s_blocksize); + iomap->addr = (zi->i_zsector << SECTOR_SHIFT) + iomap->offset; isize = i_size_read(inode); - if (offset >= isize) + if (iomap->offset >= isize) { iomap->type = IOMAP_UNWRITTEN; - else + iomap->length = zi->i_max_size - iomap->offset; + } else { iomap->type = IOMAP_MAPPED; - if (flags & IOMAP_WRITE) - length = zi->i_max_size - offset; - else - length = min(length, isize - offset); + iomap->length = isize - iomap->offset; + } mutex_unlock(&zi->i_truncate_mutex);
- iomap->offset = ALIGN_DOWN(offset, sb->s_blocksize); - iomap->length = ALIGN(offset + length, sb->s_blocksize) - iomap->offset; - iomap->bdev = inode->i_sb->s_bdev; - iomap->addr = (zi->i_zsector << SECTOR_SHIFT) + iomap->offset; - return 0; }
-static const struct iomap_ops zonefs_iomap_ops = { - .iomap_begin = zonefs_iomap_begin, +static const struct iomap_ops zonefs_write_iomap_ops = { + .iomap_begin = zonefs_write_iomap_begin, };
static int zonefs_readpage(struct file *unused, struct page *page) { - return iomap_readpage(page, &zonefs_iomap_ops); + return iomap_readpage(page, &zonefs_read_iomap_ops); }
static void zonefs_readahead(struct readahead_control *rac) { - iomap_readahead(rac, &zonefs_iomap_ops); + iomap_readahead(rac, &zonefs_read_iomap_ops); }
/* * Map blocks for page writeback. This is used only on conventional zone files, * which implies that the page range can only be within the fixed inode size. */ -static int zonefs_map_blocks(struct iomap_writepage_ctx *wpc, - struct inode *inode, loff_t offset) +static int zonefs_write_map_blocks(struct iomap_writepage_ctx *wpc, + struct inode *inode, loff_t offset) { struct zonefs_inode_info *zi = ZONEFS_I(inode);
@@ -147,12 +178,12 @@ static int zonefs_map_blocks(struct iomap_writepage_ctx *wpc, offset < wpc->iomap.offset + wpc->iomap.length) return 0;
- return zonefs_iomap_begin(inode, offset, zi->i_max_size - offset, - IOMAP_WRITE, &wpc->iomap, NULL); + return zonefs_write_iomap_begin(inode, offset, zi->i_max_size - offset, + IOMAP_WRITE, &wpc->iomap, NULL); }
static const struct iomap_writeback_ops zonefs_writeback_ops = { - .map_blocks = zonefs_map_blocks, + .map_blocks = zonefs_write_map_blocks, };
static int zonefs_writepage(struct page *page, struct writeback_control *wbc) @@ -182,7 +213,8 @@ static int zonefs_swap_activate(struct swap_info_struct *sis, return -EINVAL; }
- return iomap_swapfile_activate(sis, swap_file, span, &zonefs_iomap_ops); + return iomap_swapfile_activate(sis, swap_file, span, + &zonefs_read_iomap_ops); }
static const struct address_space_operations zonefs_file_aops = { @@ -612,7 +644,7 @@ static vm_fault_t zonefs_filemap_page_mkwrite(struct vm_fault *vmf)
/* Serialize against truncates */ down_read(&zi->i_mmap_sem); - ret = iomap_page_mkwrite(vmf, &zonefs_iomap_ops); + ret = iomap_page_mkwrite(vmf, &zonefs_write_iomap_ops); up_read(&zi->i_mmap_sem);
sb_end_pagefault(inode->i_sb); @@ -869,7 +901,7 @@ static ssize_t zonefs_file_dio_write(struct kiocb *iocb, struct iov_iter *from) if (append) ret = zonefs_file_dio_append(iocb, from); else - ret = iomap_dio_rw(iocb, from, &zonefs_iomap_ops, + ret = iomap_dio_rw(iocb, from, &zonefs_write_iomap_ops, &zonefs_write_dio_ops, sync); if (zi->i_ztype == ZONEFS_ZTYPE_SEQ && (ret > 0 || ret == -EIOCBQUEUED)) { @@ -911,7 +943,7 @@ static ssize_t zonefs_file_buffered_write(struct kiocb *iocb, if (ret <= 0) goto inode_unlock;
- ret = iomap_file_buffered_write(iocb, from, &zonefs_iomap_ops); + ret = iomap_file_buffered_write(iocb, from, &zonefs_write_iomap_ops); if (ret > 0) iocb->ki_pos += ret; else if (ret == -EIO) @@ -1004,7 +1036,7 @@ static ssize_t zonefs_file_read_iter(struct kiocb *iocb, struct iov_iter *to) goto inode_unlock; } file_accessed(iocb->ki_filp); - ret = iomap_dio_rw(iocb, to, &zonefs_iomap_ops, + ret = iomap_dio_rw(iocb, to, &zonefs_read_iomap_ops, &zonefs_read_dio_ops, is_sync_kiocb(iocb)); } else { ret = generic_file_read_iter(iocb, to); diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c index 44b524136f95..f38b71cc3edb 100644 --- a/net/ipv4/inet_hashtables.c +++ b/net/ipv4/inet_hashtables.c @@ -726,12 +726,14 @@ EXPORT_SYMBOL_GPL(inet_unhash); * Note that we use 32bit integers (vs RFC 'short integers') * because 2^16 is not a multiple of num_ephemeral and this * property might be used by clever attacker. - * RFC claims using TABLE_LENGTH=10 buckets gives an improvement, - * we use 256 instead to really give more isolation and - * privacy, this only consumes 1 KB of kernel memory. + * RFC claims using TABLE_LENGTH=10 buckets gives an improvement, though + * attacks were since demonstrated, thus we use 65536 instead to really + * give more isolation and privacy, at the expense of 256kB of kernel + * memory. */ -#define INET_TABLE_PERTURB_SHIFT 8 -static u32 table_perturb[1 << INET_TABLE_PERTURB_SHIFT]; +#define INET_TABLE_PERTURB_SHIFT 16 +#define INET_TABLE_PERTURB_SIZE (1 << INET_TABLE_PERTURB_SHIFT) +static u32 *table_perturb;
int __inet_hash_connect(struct inet_timewait_death_row *death_row, struct sock *sk, u64 port_offset, @@ -774,10 +776,11 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, if (likely(remaining > 1)) remaining &= ~1U;
- net_get_random_once(table_perturb, sizeof(table_perturb)); - index = hash_32(port_offset, INET_TABLE_PERTURB_SHIFT); + net_get_random_once(table_perturb, + INET_TABLE_PERTURB_SIZE * sizeof(*table_perturb)); + index = port_offset & (INET_TABLE_PERTURB_SIZE - 1);
- offset = READ_ONCE(table_perturb[index]) + port_offset; + offset = READ_ONCE(table_perturb[index]) + (port_offset >> 32); offset %= remaining;
/* In first pass we try ports of @low parity. @@ -833,6 +836,12 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, return -EADDRNOTAVAIL;
ok: + /* Here we want to add a little bit of randomness to the next source + * port that will be chosen. We use a max() with a random here so that + * on low contention the randomness is maximal and on high contention + * it may be inexistent. + */ + i = max_t(int, i, (prandom_u32() & 7) * 2); WRITE_ONCE(table_perturb[index], READ_ONCE(table_perturb[index]) + i + 2);
/* Head lock still held and bh's disabled */ @@ -906,6 +915,12 @@ void __init inet_hashinfo2_init(struct inet_hashinfo *h, const char *name, low_limit, high_limit); init_hashinfo_lhash2(h); + + /* this one is used for source ports of outgoing connections */ + table_perturb = kmalloc_array(INET_TABLE_PERTURB_SIZE, + sizeof(*table_perturb), GFP_KERNEL); + if (!table_perturb) + panic("TCP: failed to alloc table_perturb"); }
int inet_hashinfo2_init_mod(struct inet_hashinfo *h)
Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
I'm announcing the release of the 5.10.125 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git%3Ba=summa...
thanks,
greg k-h
Makefile | 2 arch/arm64/mm/cache.S | 2 arch/s390/mm/pgtable.c | 2 drivers/tty/serial/serial_core.c | 34 ++++-------- drivers/usb/gadget/function/u_ether.c | 11 +++- fs/io_uring.c | 23 +++++--- fs/zonefs/super.c | 92 ++++++++++++++++++++++------------ net/ipv4/inet_hashtables.c | 31 ++++++++--- 8 files changed, 122 insertions(+), 75 deletions(-)
Christian Borntraeger (1): s390/mm: use non-quiescing sske for KVM switch to keyed guest
Damien Le Moal (1): zonefs: fix zonefs_iomap_begin() for reads
Eric Dumazet (1): tcp: add some entropy in __inet_hash_connect()
Greg Kroah-Hartman (1): Linux 5.10.125
Jens Axboe (1): io_uring: add missing item types for various requests
Lukas Wunner (1): serial: core: Initialize rs485 RTS polarity already on probe
Marian Postevca (1): usb: gadget: u_ether: fix regression in setting fixed MAC address
Will Deacon (1): arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
Willy Tarreau (5): tcp: use different parts of the port_offset for index and offset tcp: add small random increments to the source port tcp: dynamically allocate the perturb table used by source ports tcp: increase source port perturb table to 2^16 tcp: drop the hash_32() part from the index calculation
5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
Here's a manually annotated panic message: [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100) [ 359.055393] kernel BUG at lib/list_debug.c:47! [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1 [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80 [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69 [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046 [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400 [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48 [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540 [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282 [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20 [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000 [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0 [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 359.180647] Call Trace: [ 359.183064] io_dismantle_req+0x1da/0x2b0 __list_del_entry [include/linux/list.h:132] list_del [include/linux/list.h:146] io_req_drop_files [fs/io_uring.c:5934] io_req_clean_work [fs/io_uring.c:1315] io_dismantle_req [fs/io_uring.c:1911] [ 359.187023] io_do_iopoll+0x4e5/0x790 [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0 [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30 [ 359.212793] do_syscall_64+0x31/0x40 [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
On 6/26/22 4:56 PM, Greg Thelen wrote:
Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
I'm announcing the release of the 5.10.125 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git%3Ba=summa...
thanks,
greg k-h
Makefile | 2 arch/arm64/mm/cache.S | 2 arch/s390/mm/pgtable.c | 2 drivers/tty/serial/serial_core.c | 34 ++++-------- drivers/usb/gadget/function/u_ether.c | 11 +++- fs/io_uring.c | 23 +++++--- fs/zonefs/super.c | 92 ++++++++++++++++++++++------------ net/ipv4/inet_hashtables.c | 31 ++++++++--- 8 files changed, 122 insertions(+), 75 deletions(-)
Christian Borntraeger (1): s390/mm: use non-quiescing sske for KVM switch to keyed guest
Damien Le Moal (1): zonefs: fix zonefs_iomap_begin() for reads
Eric Dumazet (1): tcp: add some entropy in __inet_hash_connect()
Greg Kroah-Hartman (1): Linux 5.10.125
Jens Axboe (1): io_uring: add missing item types for various requests
Lukas Wunner (1): serial: core: Initialize rs485 RTS polarity already on probe
Marian Postevca (1): usb: gadget: u_ether: fix regression in setting fixed MAC address
Will Deacon (1): arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
Willy Tarreau (5): tcp: use different parts of the port_offset for index and offset tcp: add small random increments to the source port tcp: dynamically allocate the perturb table used by source ports tcp: increase source port perturb table to 2^16 tcp: drop the hash_32() part from the index calculation
5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
Here's a manually annotated panic message: [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100) [ 359.055393] kernel BUG at lib/list_debug.c:47! [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1 [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80 [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69 [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046 [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400 [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48 [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540 [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282 [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20 [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000 [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0 [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 359.180647] Call Trace: [ 359.183064] io_dismantle_req+0x1da/0x2b0 __list_del_entry [include/linux/list.h:132] list_del [include/linux/list.h:146] io_req_drop_files [fs/io_uring.c:5934] io_req_clean_work [fs/io_uring.c:1315] io_dismantle_req [fs/io_uring.c:1911] [ 359.187023] io_do_iopoll+0x4e5/0x790 [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0 [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30 [ 359.212793] do_syscall_64+0x31/0x40 [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Well that sucks, I wonder why mine didn't fail like that. I'll see if I can hit this and send a fix. Thanks for reporting!
On 6/26/22 6:04 PM, Jens Axboe wrote:
On 6/26/22 4:56 PM, Greg Thelen wrote:
Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
I'm announcing the release of the 5.10.125 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git%3Ba=summa...
thanks,
greg k-h
Makefile | 2 arch/arm64/mm/cache.S | 2 arch/s390/mm/pgtable.c | 2 drivers/tty/serial/serial_core.c | 34 ++++-------- drivers/usb/gadget/function/u_ether.c | 11 +++- fs/io_uring.c | 23 +++++--- fs/zonefs/super.c | 92 ++++++++++++++++++++++------------ net/ipv4/inet_hashtables.c | 31 ++++++++--- 8 files changed, 122 insertions(+), 75 deletions(-)
Christian Borntraeger (1): s390/mm: use non-quiescing sske for KVM switch to keyed guest
Damien Le Moal (1): zonefs: fix zonefs_iomap_begin() for reads
Eric Dumazet (1): tcp: add some entropy in __inet_hash_connect()
Greg Kroah-Hartman (1): Linux 5.10.125
Jens Axboe (1): io_uring: add missing item types for various requests
Lukas Wunner (1): serial: core: Initialize rs485 RTS polarity already on probe
Marian Postevca (1): usb: gadget: u_ether: fix regression in setting fixed MAC address
Will Deacon (1): arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
Willy Tarreau (5): tcp: use different parts of the port_offset for index and offset tcp: add small random increments to the source port tcp: dynamically allocate the perturb table used by source ports tcp: increase source port perturb table to 2^16 tcp: drop the hash_32() part from the index calculation
5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
Here's a manually annotated panic message: [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100) [ 359.055393] kernel BUG at lib/list_debug.c:47! [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1 [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80 [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69 [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046 [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400 [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48 [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540 [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282 [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20 [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000 [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0 [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 359.180647] Call Trace: [ 359.183064] io_dismantle_req+0x1da/0x2b0 __list_del_entry [include/linux/list.h:132] list_del [include/linux/list.h:146] io_req_drop_files [fs/io_uring.c:5934] io_req_clean_work [fs/io_uring.c:1315] io_dismantle_req [fs/io_uring.c:1911] [ 359.187023] io_do_iopoll+0x4e5/0x790 [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0 [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30 [ 359.212793] do_syscall_64+0x31/0x40 [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Well that sucks, I wonder why mine didn't fail like that. I'll see if I can hit this and send a fix. Thanks for reporting!
Below should do it, I apologize for that. I think my test box booted the previous kernel which is why it didn't hit it in my regression tests :-(
Greg, can you add this to 5.10-stable? Verified it ran tests with the right kernel now...
commit d2aaf8fdc544a3edf44820a07294d693dedd12e3 Author: Jens Axboe axboe@kernel.dk Date: Sun Jun 26 18:16:17 2022 -0600
io_uring: use separate list entry for iopoll requests
A previous commit ended up enabling file tracking for iopoll requests, which conflicts with both of them using the same list entry for tracking. Add a separate list entry just for iopoll requests, avoid this issue.
No upstream commit exists for this issue.
Reported-by: Greg Thelen gthelen@google.com Fixes: df3f3bb5059d ("io_uring: add missing item types for various requests") Signed-off-by: Jens Axboe axboe@kernel.dk
diff --git a/fs/io_uring.c b/fs/io_uring.c index 40ac37beca47..2e12dcbc7b0f 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -696,6 +696,8 @@ struct io_kiocb { */ struct list_head inflight_entry;
+ struct list_head iopoll_entry; + struct percpu_ref *fixed_file_refs; struct callback_head task_work; /* for polled requests, i.e. IORING_OP_POLL_ADD and async armed poll */ @@ -2350,8 +2352,8 @@ static void io_iopoll_queue(struct list_head *again) struct io_kiocb *req;
do { - req = list_first_entry(again, struct io_kiocb, inflight_entry); - list_del(&req->inflight_entry); + req = list_first_entry(again, struct io_kiocb, iopoll_entry); + list_del(&req->iopoll_entry); __io_complete_rw(req, -EAGAIN, 0, NULL); } while (!list_empty(again)); } @@ -2373,14 +2375,14 @@ static void io_iopoll_complete(struct io_ring_ctx *ctx, unsigned int *nr_events, while (!list_empty(done)) { int cflags = 0;
- req = list_first_entry(done, struct io_kiocb, inflight_entry); + req = list_first_entry(done, struct io_kiocb, iopoll_entry); if (READ_ONCE(req->result) == -EAGAIN) { req->result = 0; req->iopoll_completed = 0; - list_move_tail(&req->inflight_entry, &again); + list_move_tail(&req->iopoll_entry, &again); continue; } - list_del(&req->inflight_entry); + list_del(&req->iopoll_entry);
if (req->flags & REQ_F_BUFFER_SELECTED) cflags = io_put_rw_kbuf(req); @@ -2416,7 +2418,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events, spin = !ctx->poll_multi_file && *nr_events < min;
ret = 0; - list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, inflight_entry) { + list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, iopoll_entry) { struct kiocb *kiocb = &req->rw.kiocb;
/* @@ -2425,7 +2427,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events, * and complete those lists first, if we have entries there. */ if (READ_ONCE(req->iopoll_completed)) { - list_move_tail(&req->inflight_entry, &done); + list_move_tail(&req->iopoll_entry, &done); continue; } if (!list_empty(&done)) @@ -2437,7 +2439,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
/* iopoll may have completed current req */ if (READ_ONCE(req->iopoll_completed)) - list_move_tail(&req->inflight_entry, &done); + list_move_tail(&req->iopoll_entry, &done);
if (ret && spin) spin = false; @@ -2670,7 +2672,7 @@ static void io_iopoll_req_issued(struct io_kiocb *req) struct io_kiocb *list_req;
list_req = list_first_entry(&ctx->iopoll_list, struct io_kiocb, - inflight_entry); + iopoll_entry); if (list_req->file != req->file) ctx->poll_multi_file = true; } @@ -2680,9 +2682,9 @@ static void io_iopoll_req_issued(struct io_kiocb *req) * it to the front so we find it first. */ if (READ_ONCE(req->iopoll_completed)) - list_add(&req->inflight_entry, &ctx->iopoll_list); + list_add(&req->iopoll_entry, &ctx->iopoll_list); else - list_add_tail(&req->inflight_entry, &ctx->iopoll_list); + list_add_tail(&req->iopoll_entry, &ctx->iopoll_list);
if ((ctx->flags & IORING_SETUP_SQPOLL) && wq_has_sleeper(&ctx->sq_data->wait))
Jens Axboe axboe@kernel.dk wrote:
On 6/26/22 6:04 PM, Jens Axboe wrote:
On 6/26/22 4:56 PM, Greg Thelen wrote:
Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
I'm announcing the release of the 5.10.125 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git%3Ba=summa...
thanks,
greg k-h
Makefile | 2 arch/arm64/mm/cache.S | 2 arch/s390/mm/pgtable.c | 2 drivers/tty/serial/serial_core.c | 34 ++++-------- drivers/usb/gadget/function/u_ether.c | 11 +++- fs/io_uring.c | 23 +++++--- fs/zonefs/super.c | 92 ++++++++++++++++++++++------------ net/ipv4/inet_hashtables.c | 31 ++++++++--- 8 files changed, 122 insertions(+), 75 deletions(-)
Christian Borntraeger (1): s390/mm: use non-quiescing sske for KVM switch to keyed guest
Damien Le Moal (1): zonefs: fix zonefs_iomap_begin() for reads
Eric Dumazet (1): tcp: add some entropy in __inet_hash_connect()
Greg Kroah-Hartman (1): Linux 5.10.125
Jens Axboe (1): io_uring: add missing item types for various requests
Lukas Wunner (1): serial: core: Initialize rs485 RTS polarity already on probe
Marian Postevca (1): usb: gadget: u_ether: fix regression in setting fixed MAC address
Will Deacon (1): arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
Willy Tarreau (5): tcp: use different parts of the port_offset for index and offset tcp: add small random increments to the source port tcp: dynamically allocate the perturb table used by source ports tcp: increase source port perturb table to 2^16 tcp: drop the hash_32() part from the index calculation
5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
Here's a manually annotated panic message: [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100) [ 359.055393] kernel BUG at lib/list_debug.c:47! [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1 [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80 [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69 [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046 [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400 [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48 [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540 [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282 [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20 [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000 [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0 [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 359.180647] Call Trace: [ 359.183064] io_dismantle_req+0x1da/0x2b0 __list_del_entry [include/linux/list.h:132] list_del [include/linux/list.h:146] io_req_drop_files [fs/io_uring.c:5934] io_req_clean_work [fs/io_uring.c:1315] io_dismantle_req [fs/io_uring.c:1911] [ 359.187023] io_do_iopoll+0x4e5/0x790 [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0 [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30 [ 359.212793] do_syscall_64+0x31/0x40 [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Well that sucks, I wonder why mine didn't fail like that. I'll see if I can hit this and send a fix. Thanks for reporting!
Below should do it, I apologize for that. I think my test box booted the previous kernel which is why it didn't hit it in my regression tests :-(
Greg, can you add this to 5.10-stable? Verified it ran tests with the right kernel now...
commit d2aaf8fdc544a3edf44820a07294d693dedd12e3 Author: Jens Axboe axboe@kernel.dk Date: Sun Jun 26 18:16:17 2022 -0600
io_uring: use separate list entry for iopoll requests
A previous commit ended up enabling file tracking for iopoll requests, which conflicts with both of them using the same list entry for tracking. Add a separate list entry just for iopoll requests, avoid this issue. No upstream commit exists for this issue. Reported-by: Greg Thelen gthelen@google.com Fixes: df3f3bb5059d ("io_uring: add missing item types for various requests") Signed-off-by: Jens Axboe axboe@kernel.dk
Confirmed. This patch fixes the error I saw.
Tested-by: Greg Thelen gthelen@google.com
diff --git a/fs/io_uring.c b/fs/io_uring.c index 40ac37beca47..2e12dcbc7b0f 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -696,6 +696,8 @@ struct io_kiocb { */ struct list_head inflight_entry;
- struct list_head iopoll_entry;
- struct percpu_ref *fixed_file_refs; struct callback_head task_work; /* for polled requests, i.e. IORING_OP_POLL_ADD and async armed poll */
@@ -2350,8 +2352,8 @@ static void io_iopoll_queue(struct list_head *again) struct io_kiocb *req; do {
req = list_first_entry(again, struct io_kiocb, inflight_entry);
list_del(&req->inflight_entry);
req = list_first_entry(again, struct io_kiocb, iopoll_entry);
__io_complete_rw(req, -EAGAIN, 0, NULL); } while (!list_empty(again));list_del(&req->iopoll_entry);
} @@ -2373,14 +2375,14 @@ static void io_iopoll_complete(struct io_ring_ctx *ctx, unsigned int *nr_events, while (!list_empty(done)) { int cflags = 0;
req = list_first_entry(done, struct io_kiocb, inflight_entry);
if (READ_ONCE(req->result) == -EAGAIN) { req->result = 0; req->iopoll_completed = 0;req = list_first_entry(done, struct io_kiocb, iopoll_entry);
list_move_tail(&req->inflight_entry, &again);
}list_move_tail(&req->iopoll_entry, &again); continue;
list_del(&req->inflight_entry);
list_del(&req->iopoll_entry);
if (req->flags & REQ_F_BUFFER_SELECTED) cflags = io_put_rw_kbuf(req); @@ -2416,7 +2418,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events, spin = !ctx->poll_multi_file && *nr_events < min; ret = 0;
- list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, inflight_entry) {
- list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, iopoll_entry) { struct kiocb *kiocb = &req->rw.kiocb;
/* @@ -2425,7 +2427,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events, * and complete those lists first, if we have entries there. */ if (READ_ONCE(req->iopoll_completed)) {
list_move_tail(&req->inflight_entry, &done);
} if (!list_empty(&done))list_move_tail(&req->iopoll_entry, &done); continue;
@@ -2437,7 +2439,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events, /* iopoll may have completed current req */ if (READ_ONCE(req->iopoll_completed))
list_move_tail(&req->inflight_entry, &done);
list_move_tail(&req->iopoll_entry, &done);
if (ret && spin) spin = false; @@ -2670,7 +2672,7 @@ static void io_iopoll_req_issued(struct io_kiocb *req) struct io_kiocb *list_req; list_req = list_first_entry(&ctx->iopoll_list, struct io_kiocb,
inflight_entry);
if (list_req->file != req->file) ctx->poll_multi_file = true; }iopoll_entry);
@@ -2680,9 +2682,9 @@ static void io_iopoll_req_issued(struct io_kiocb *req) * it to the front so we find it first. */ if (READ_ONCE(req->iopoll_completed))
list_add(&req->inflight_entry, &ctx->iopoll_list);
elselist_add(&req->iopoll_entry, &ctx->iopoll_list);
list_add_tail(&req->inflight_entry, &ctx->iopoll_list);
list_add_tail(&req->iopoll_entry, &ctx->iopoll_list);
if ((ctx->flags & IORING_SETUP_SQPOLL) && wq_has_sleeper(&ctx->sq_data->wait))
On Sun, Jun 26, 2022 at 10:42:06PM -0700, Greg Thelen wrote:
Jens Axboe axboe@kernel.dk wrote:
On 6/26/22 6:04 PM, Jens Axboe wrote:
On 6/26/22 4:56 PM, Greg Thelen wrote:
Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
I'm announcing the release of the 5.10.125 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git%3Ba=summa...
thanks,
greg k-h
Makefile | 2 arch/arm64/mm/cache.S | 2 arch/s390/mm/pgtable.c | 2 drivers/tty/serial/serial_core.c | 34 ++++-------- drivers/usb/gadget/function/u_ether.c | 11 +++- fs/io_uring.c | 23 +++++--- fs/zonefs/super.c | 92 ++++++++++++++++++++++------------ net/ipv4/inet_hashtables.c | 31 ++++++++--- 8 files changed, 122 insertions(+), 75 deletions(-)
Christian Borntraeger (1): s390/mm: use non-quiescing sske for KVM switch to keyed guest
Damien Le Moal (1): zonefs: fix zonefs_iomap_begin() for reads
Eric Dumazet (1): tcp: add some entropy in __inet_hash_connect()
Greg Kroah-Hartman (1): Linux 5.10.125
Jens Axboe (1): io_uring: add missing item types for various requests
Lukas Wunner (1): serial: core: Initialize rs485 RTS polarity already on probe
Marian Postevca (1): usb: gadget: u_ether: fix regression in setting fixed MAC address
Will Deacon (1): arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
Willy Tarreau (5): tcp: use different parts of the port_offset for index and offset tcp: add small random increments to the source port tcp: dynamically allocate the perturb table used by source ports tcp: increase source port perturb table to 2^16 tcp: drop the hash_32() part from the index calculation
5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
Here's a manually annotated panic message: [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100) [ 359.055393] kernel BUG at lib/list_debug.c:47! [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1 [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80 [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69 [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046 [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400 [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48 [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540 [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282 [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20 [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000 [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0 [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 359.180647] Call Trace: [ 359.183064] io_dismantle_req+0x1da/0x2b0 __list_del_entry [include/linux/list.h:132] list_del [include/linux/list.h:146] io_req_drop_files [fs/io_uring.c:5934] io_req_clean_work [fs/io_uring.c:1315] io_dismantle_req [fs/io_uring.c:1911] [ 359.187023] io_do_iopoll+0x4e5/0x790 [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0 [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30 [ 359.212793] do_syscall_64+0x31/0x40 [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Well that sucks, I wonder why mine didn't fail like that. I'll see if I can hit this and send a fix. Thanks for reporting!
Below should do it, I apologize for that. I think my test box booted the previous kernel which is why it didn't hit it in my regression tests :-(
Greg, can you add this to 5.10-stable? Verified it ran tests with the right kernel now...
Great, I'll go just do a release with this in it right now to help others out.
greg k-h
On Mon, Jun 27, 2022 at 07:54:23AM +0200, Greg Kroah-Hartman wrote:
On Sun, Jun 26, 2022 at 10:42:06PM -0700, Greg Thelen wrote:
Jens Axboe axboe@kernel.dk wrote:
On 6/26/22 6:04 PM, Jens Axboe wrote:
On 6/26/22 4:56 PM, Greg Thelen wrote:
Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
I'm announcing the release of the 5.10.125 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git%3Ba=summa...
thanks,
greg k-h
Makefile | 2 arch/arm64/mm/cache.S | 2 arch/s390/mm/pgtable.c | 2 drivers/tty/serial/serial_core.c | 34 ++++-------- drivers/usb/gadget/function/u_ether.c | 11 +++- fs/io_uring.c | 23 +++++--- fs/zonefs/super.c | 92 ++++++++++++++++++++++------------ net/ipv4/inet_hashtables.c | 31 ++++++++--- 8 files changed, 122 insertions(+), 75 deletions(-)
Christian Borntraeger (1): s390/mm: use non-quiescing sske for KVM switch to keyed guest
Damien Le Moal (1): zonefs: fix zonefs_iomap_begin() for reads
Eric Dumazet (1): tcp: add some entropy in __inet_hash_connect()
Greg Kroah-Hartman (1): Linux 5.10.125
Jens Axboe (1): io_uring: add missing item types for various requests
Lukas Wunner (1): serial: core: Initialize rs485 RTS polarity already on probe
Marian Postevca (1): usb: gadget: u_ether: fix regression in setting fixed MAC address
Will Deacon (1): arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
Willy Tarreau (5): tcp: use different parts of the port_offset for index and offset tcp: add small random increments to the source port tcp: dynamically allocate the perturb table used by source ports tcp: increase source port perturb table to 2^16 tcp: drop the hash_32() part from the index calculation
5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
Here's a manually annotated panic message: [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100) [ 359.055393] kernel BUG at lib/list_debug.c:47! [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1 [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80 [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69 [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046 [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400 [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48 [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540 [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282 [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20 [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000 [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0 [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 359.180647] Call Trace: [ 359.183064] io_dismantle_req+0x1da/0x2b0 __list_del_entry [include/linux/list.h:132] list_del [include/linux/list.h:146] io_req_drop_files [fs/io_uring.c:5934] io_req_clean_work [fs/io_uring.c:1315] io_dismantle_req [fs/io_uring.c:1911] [ 359.187023] io_do_iopoll+0x4e5/0x790 [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0 [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30 [ 359.212793] do_syscall_64+0x31/0x40 [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Well that sucks, I wonder why mine didn't fail like that. I'll see if I can hit this and send a fix. Thanks for reporting!
Below should do it, I apologize for that. I think my test box booted the previous kernel which is why it didn't hit it in my regression tests :-(
Greg, can you add this to 5.10-stable? Verified it ran tests with the right kernel now...
Great, I'll go just do a release with this in it right now to help others out.
5.10.126 is now released with this fix.
On 6/27/22 2:05 AM, Greg Kroah-Hartman wrote:
On Mon, Jun 27, 2022 at 07:54:23AM +0200, Greg Kroah-Hartman wrote:
On Sun, Jun 26, 2022 at 10:42:06PM -0700, Greg Thelen wrote:
Jens Axboe axboe@kernel.dk wrote:
On 6/26/22 6:04 PM, Jens Axboe wrote:
On 6/26/22 4:56 PM, Greg Thelen wrote:
Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
> I'm announcing the release of the 5.10.125 kernel. > > All users of the 5.10 kernel series must upgrade. > > The updated 5.10.y git tree can be found at: > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y > and can be browsed at the normal kernel.org git web browser: > https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git%3Ba=summa... > > thanks, > > greg k-h > > ------------ > > Makefile | 2 > arch/arm64/mm/cache.S | 2 > arch/s390/mm/pgtable.c | 2 > drivers/tty/serial/serial_core.c | 34 ++++-------- > drivers/usb/gadget/function/u_ether.c | 11 +++- > fs/io_uring.c | 23 +++++--- > fs/zonefs/super.c | 92 ++++++++++++++++++++++------------ > net/ipv4/inet_hashtables.c | 31 ++++++++--- > 8 files changed, 122 insertions(+), 75 deletions(-) > > Christian Borntraeger (1): > s390/mm: use non-quiescing sske for KVM switch to keyed guest > > Damien Le Moal (1): > zonefs: fix zonefs_iomap_begin() for reads > > Eric Dumazet (1): > tcp: add some entropy in __inet_hash_connect() > > Greg Kroah-Hartman (1): > Linux 5.10.125 > > Jens Axboe (1): > io_uring: add missing item types for various requests > > Lukas Wunner (1): > serial: core: Initialize rs485 RTS polarity already on probe > > Marian Postevca (1): > usb: gadget: u_ether: fix regression in setting fixed MAC address > > Will Deacon (1): > arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer > > Willy Tarreau (5): > tcp: use different parts of the port_offset for index and offset > tcp: add small random increments to the source port > tcp: dynamically allocate the perturb table used by source ports > tcp: increase source port perturb table to 2^16 > tcp: drop the hash_32() part from the index calculation
5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
Here's a manually annotated panic message: [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100) [ 359.055393] kernel BUG at lib/list_debug.c:47! [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1 [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80 [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69 [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046 [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400 [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48 [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540 [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282 [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20 [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000 [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0 [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 359.180647] Call Trace: [ 359.183064] io_dismantle_req+0x1da/0x2b0 __list_del_entry [include/linux/list.h:132] list_del [include/linux/list.h:146] io_req_drop_files [fs/io_uring.c:5934] io_req_clean_work [fs/io_uring.c:1315] io_dismantle_req [fs/io_uring.c:1911] [ 359.187023] io_do_iopoll+0x4e5/0x790 [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0 [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30 [ 359.212793] do_syscall_64+0x31/0x40 [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Well that sucks, I wonder why mine didn't fail like that. I'll see if I can hit this and send a fix. Thanks for reporting!
Below should do it, I apologize for that. I think my test box booted the previous kernel which is why it didn't hit it in my regression tests :-(
Greg, can you add this to 5.10-stable? Verified it ran tests with the right kernel now...
Great, I'll go just do a release with this in it right now to help others out.
5.10.126 is now released with this fix.
Thanks - to both Gregs!
linux-stable-mirror@lists.linaro.org