I'm announcing the release of the 5.10.125 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git%3Ba=summa...
thanks,
greg k-h
------------
Makefile | 2 arch/arm64/mm/cache.S | 2 arch/s390/mm/pgtable.c | 2 drivers/tty/serial/serial_core.c | 34 ++++-------- drivers/usb/gadget/function/u_ether.c | 11 +++- fs/io_uring.c | 23 +++++--- fs/zonefs/super.c | 92 ++++++++++++++++++++++------------ net/ipv4/inet_hashtables.c | 31 ++++++++--- 8 files changed, 122 insertions(+), 75 deletions(-)
Christian Borntraeger (1): s390/mm: use non-quiescing sske for KVM switch to keyed guest
Damien Le Moal (1): zonefs: fix zonefs_iomap_begin() for reads
Eric Dumazet (1): tcp: add some entropy in __inet_hash_connect()
Greg Kroah-Hartman (1): Linux 5.10.125
Jens Axboe (1): io_uring: add missing item types for various requests
Lukas Wunner (1): serial: core: Initialize rs485 RTS polarity already on probe
Marian Postevca (1): usb: gadget: u_ether: fix regression in setting fixed MAC address
Will Deacon (1): arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
Willy Tarreau (5): tcp: use different parts of the port_offset for index and offset tcp: add small random increments to the source port tcp: dynamically allocate the perturb table used by source ports tcp: increase source port perturb table to 2^16 tcp: drop the hash_32() part from the index calculation
diff --git a/Makefile b/Makefile index 9ed79a05a972..da5b28931e5c 100644 --- a/Makefile +++ b/Makefile @@ -1,7 +1,7 @@ # SPDX-License-Identifier: GPL-2.0 VERSION = 5 PATCHLEVEL = 10 -SUBLEVEL = 124 +SUBLEVEL = 125 EXTRAVERSION = NAME = Dare mighty things
diff --git a/arch/arm64/mm/cache.S b/arch/arm64/mm/cache.S index 2d881f34dd9d..7b8158ae36ec 100644 --- a/arch/arm64/mm/cache.S +++ b/arch/arm64/mm/cache.S @@ -228,8 +228,6 @@ SYM_FUNC_END_PI(__dma_flush_area) * - dir - DMA direction */ SYM_FUNC_START_PI(__dma_map_area) - cmp w2, #DMA_FROM_DEVICE - b.eq __dma_inv_area b __dma_clean_area SYM_FUNC_END_PI(__dma_map_area)
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c index fabaedddc90c..1c05caf68e7d 100644 --- a/arch/s390/mm/pgtable.c +++ b/arch/s390/mm/pgtable.c @@ -734,7 +734,7 @@ void ptep_zap_key(struct mm_struct *mm, unsigned long addr, pte_t *ptep) pgste_val(pgste) |= PGSTE_GR_BIT | PGSTE_GC_BIT; ptev = pte_val(*ptep); if (!(ptev & _PAGE_INVALID) && (ptev & _PAGE_WRITE)) - page_set_storage_key(ptev & PAGE_MASK, PAGE_DEFAULT_KEY, 1); + page_set_storage_key(ptev & PAGE_MASK, PAGE_DEFAULT_KEY, 0); pgste_set_unlock(ptep, pgste); preempt_enable(); } diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c index 19f0c5db11e3..32d09d024f6c 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -144,6 +144,11 @@ uart_update_mctrl(struct uart_port *port, unsigned int set, unsigned int clear) unsigned long flags; unsigned int old;
+ if (port->rs485.flags & SER_RS485_ENABLED) { + set &= ~TIOCM_RTS; + clear &= ~TIOCM_RTS; + } + spin_lock_irqsave(&port->lock, flags); old = port->mctrl; port->mctrl = (old & ~clear) | set; @@ -157,23 +162,10 @@ uart_update_mctrl(struct uart_port *port, unsigned int set, unsigned int clear)
static void uart_port_dtr_rts(struct uart_port *uport, int raise) { - int rs485_on = uport->rs485_config && - (uport->rs485.flags & SER_RS485_ENABLED); - int RTS_after_send = !!(uport->rs485.flags & SER_RS485_RTS_AFTER_SEND); - - if (raise) { - if (rs485_on && RTS_after_send) { - uart_set_mctrl(uport, TIOCM_DTR); - uart_clear_mctrl(uport, TIOCM_RTS); - } else { - uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS); - } - } else { - unsigned int clear = TIOCM_DTR; - - clear |= (!rs485_on || RTS_after_send) ? TIOCM_RTS : 0; - uart_clear_mctrl(uport, clear); - } + if (raise) + uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS); + else + uart_clear_mctrl(uport, TIOCM_DTR | TIOCM_RTS); }
/* @@ -1116,11 +1108,6 @@ uart_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear) goto out;
if (!tty_io_error(tty)) { - if (uport->rs485.flags & SER_RS485_ENABLED) { - set &= ~TIOCM_RTS; - clear &= ~TIOCM_RTS; - } - uart_update_mctrl(uport, set, clear); ret = 0; } @@ -2429,6 +2416,9 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state, */ spin_lock_irqsave(&port->lock, flags); port->mctrl &= TIOCM_DTR; + if (port->rs485.flags & SER_RS485_ENABLED && + !(port->rs485.flags & SER_RS485_RTS_AFTER_SEND)) + port->mctrl |= TIOCM_RTS; port->ops->set_mctrl(port, port->mctrl); spin_unlock_irqrestore(&port->lock, flags);
diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c index a40be8b448c2..64ef97ab9274 100644 --- a/drivers/usb/gadget/function/u_ether.c +++ b/drivers/usb/gadget/function/u_ether.c @@ -772,9 +772,13 @@ struct eth_dev *gether_setup_name(struct usb_gadget *g, dev->qmult = qmult; snprintf(net->name, sizeof(net->name), "%s%%d", netname);
- if (get_ether_addr(dev_addr, net->dev_addr)) + if (get_ether_addr(dev_addr, net->dev_addr)) { + net->addr_assign_type = NET_ADDR_RANDOM; dev_warn(&g->dev, "using random %s ethernet address\n", "self"); + } else { + net->addr_assign_type = NET_ADDR_SET; + } if (get_ether_addr(host_addr, dev->host_mac)) dev_warn(&g->dev, "using random %s ethernet address\n", "host"); @@ -831,6 +835,9 @@ struct net_device *gether_setup_name_default(const char *netname) INIT_LIST_HEAD(&dev->tx_reqs); INIT_LIST_HEAD(&dev->rx_reqs);
+ /* by default we always have a random MAC address */ + net->addr_assign_type = NET_ADDR_RANDOM; + skb_queue_head_init(&dev->rx_frames);
/* network device setup */ @@ -868,7 +875,6 @@ int gether_register_netdev(struct net_device *net) g = dev->gadget;
memcpy(net->dev_addr, dev->dev_mac, ETH_ALEN); - net->addr_assign_type = NET_ADDR_RANDOM;
status = register_netdev(net); if (status < 0) { @@ -908,6 +914,7 @@ int gether_set_dev_addr(struct net_device *net, const char *dev_addr) if (get_ether_addr(dev_addr, new_addr)) return -EINVAL; memcpy(dev->dev_mac, new_addr, ETH_ALEN); + net->addr_assign_type = NET_ADDR_SET; return 0; } EXPORT_SYMBOL_GPL(gether_set_dev_addr); diff --git a/fs/io_uring.c b/fs/io_uring.c index 871475d3fca2..40ac37beca47 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -773,7 +773,8 @@ static const struct io_op_def io_op_defs[] = { .buffer_select = 1, .needs_async_data = 1, .async_size = sizeof(struct io_async_rw), - .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG, + .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG | + IO_WQ_WORK_FILES, }, [IORING_OP_WRITEV] = { .needs_file = 1, @@ -783,7 +784,7 @@ static const struct io_op_def io_op_defs[] = { .needs_async_data = 1, .async_size = sizeof(struct io_async_rw), .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG | - IO_WQ_WORK_FSIZE, + IO_WQ_WORK_FSIZE | IO_WQ_WORK_FILES, }, [IORING_OP_FSYNC] = { .needs_file = 1, @@ -794,7 +795,8 @@ static const struct io_op_def io_op_defs[] = { .unbound_nonreg_file = 1, .pollin = 1, .async_size = sizeof(struct io_async_rw), - .work_flags = IO_WQ_WORK_BLKCG | IO_WQ_WORK_MM, + .work_flags = IO_WQ_WORK_BLKCG | IO_WQ_WORK_MM | + IO_WQ_WORK_FILES, }, [IORING_OP_WRITE_FIXED] = { .needs_file = 1, @@ -803,7 +805,7 @@ static const struct io_op_def io_op_defs[] = { .pollout = 1, .async_size = sizeof(struct io_async_rw), .work_flags = IO_WQ_WORK_BLKCG | IO_WQ_WORK_FSIZE | - IO_WQ_WORK_MM, + IO_WQ_WORK_MM | IO_WQ_WORK_FILES, }, [IORING_OP_POLL_ADD] = { .needs_file = 1, @@ -857,7 +859,7 @@ static const struct io_op_def io_op_defs[] = { .pollout = 1, .needs_async_data = 1, .async_size = sizeof(struct io_async_connect), - .work_flags = IO_WQ_WORK_MM, + .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_FS, }, [IORING_OP_FALLOCATE] = { .needs_file = 1, @@ -885,7 +887,8 @@ static const struct io_op_def io_op_defs[] = { .pollin = 1, .buffer_select = 1, .async_size = sizeof(struct io_async_rw), - .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG, + .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG | + IO_WQ_WORK_FILES, }, [IORING_OP_WRITE] = { .needs_file = 1, @@ -894,7 +897,7 @@ static const struct io_op_def io_op_defs[] = { .pollout = 1, .async_size = sizeof(struct io_async_rw), .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG | - IO_WQ_WORK_FSIZE, + IO_WQ_WORK_FSIZE | IO_WQ_WORK_FILES, }, [IORING_OP_FADVISE] = { .needs_file = 1, @@ -907,14 +910,16 @@ static const struct io_op_def io_op_defs[] = { .needs_file = 1, .unbound_nonreg_file = 1, .pollout = 1, - .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG, + .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG | + IO_WQ_WORK_FS, }, [IORING_OP_RECV] = { .needs_file = 1, .unbound_nonreg_file = 1, .pollin = 1, .buffer_select = 1, - .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG, + .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG | + IO_WQ_WORK_FS, }, [IORING_OP_OPENAT2] = { .work_flags = IO_WQ_WORK_FILES | IO_WQ_WORK_FS | diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c index 8c7d01e907a3..bf5cb6efb8c0 100644 --- a/fs/zonefs/super.c +++ b/fs/zonefs/super.c @@ -68,15 +68,49 @@ static inline void zonefs_i_size_write(struct inode *inode, loff_t isize) zi->i_flags &= ~ZONEFS_ZONE_OPEN; }
-static int zonefs_iomap_begin(struct inode *inode, loff_t offset, loff_t length, - unsigned int flags, struct iomap *iomap, - struct iomap *srcmap) +static int zonefs_read_iomap_begin(struct inode *inode, loff_t offset, + loff_t length, unsigned int flags, + struct iomap *iomap, struct iomap *srcmap) { struct zonefs_inode_info *zi = ZONEFS_I(inode); struct super_block *sb = inode->i_sb; loff_t isize;
- /* All I/Os should always be within the file maximum size */ + /* + * All blocks are always mapped below EOF. If reading past EOF, + * act as if there is a hole up to the file maximum size. + */ + mutex_lock(&zi->i_truncate_mutex); + iomap->bdev = inode->i_sb->s_bdev; + iomap->offset = ALIGN_DOWN(offset, sb->s_blocksize); + isize = i_size_read(inode); + if (iomap->offset >= isize) { + iomap->type = IOMAP_HOLE; + iomap->addr = IOMAP_NULL_ADDR; + iomap->length = length; + } else { + iomap->type = IOMAP_MAPPED; + iomap->addr = (zi->i_zsector << SECTOR_SHIFT) + iomap->offset; + iomap->length = isize - iomap->offset; + } + mutex_unlock(&zi->i_truncate_mutex); + + return 0; +} + +static const struct iomap_ops zonefs_read_iomap_ops = { + .iomap_begin = zonefs_read_iomap_begin, +}; + +static int zonefs_write_iomap_begin(struct inode *inode, loff_t offset, + loff_t length, unsigned int flags, + struct iomap *iomap, struct iomap *srcmap) +{ + struct zonefs_inode_info *zi = ZONEFS_I(inode); + struct super_block *sb = inode->i_sb; + loff_t isize; + + /* All write I/Os should always be within the file maximum size */ if (WARN_ON_ONCE(offset + length > zi->i_max_size)) return -EIO;
@@ -86,7 +120,7 @@ static int zonefs_iomap_begin(struct inode *inode, loff_t offset, loff_t length, * operation. */ if (WARN_ON_ONCE(zi->i_ztype == ZONEFS_ZTYPE_SEQ && - (flags & IOMAP_WRITE) && !(flags & IOMAP_DIRECT))) + !(flags & IOMAP_DIRECT))) return -EIO;
/* @@ -95,45 +129,42 @@ static int zonefs_iomap_begin(struct inode *inode, loff_t offset, loff_t length, * write pointer) and unwriten beyond. */ mutex_lock(&zi->i_truncate_mutex); + iomap->bdev = inode->i_sb->s_bdev; + iomap->offset = ALIGN_DOWN(offset, sb->s_blocksize); + iomap->addr = (zi->i_zsector << SECTOR_SHIFT) + iomap->offset; isize = i_size_read(inode); - if (offset >= isize) + if (iomap->offset >= isize) { iomap->type = IOMAP_UNWRITTEN; - else + iomap->length = zi->i_max_size - iomap->offset; + } else { iomap->type = IOMAP_MAPPED; - if (flags & IOMAP_WRITE) - length = zi->i_max_size - offset; - else - length = min(length, isize - offset); + iomap->length = isize - iomap->offset; + } mutex_unlock(&zi->i_truncate_mutex);
- iomap->offset = ALIGN_DOWN(offset, sb->s_blocksize); - iomap->length = ALIGN(offset + length, sb->s_blocksize) - iomap->offset; - iomap->bdev = inode->i_sb->s_bdev; - iomap->addr = (zi->i_zsector << SECTOR_SHIFT) + iomap->offset; - return 0; }
-static const struct iomap_ops zonefs_iomap_ops = { - .iomap_begin = zonefs_iomap_begin, +static const struct iomap_ops zonefs_write_iomap_ops = { + .iomap_begin = zonefs_write_iomap_begin, };
static int zonefs_readpage(struct file *unused, struct page *page) { - return iomap_readpage(page, &zonefs_iomap_ops); + return iomap_readpage(page, &zonefs_read_iomap_ops); }
static void zonefs_readahead(struct readahead_control *rac) { - iomap_readahead(rac, &zonefs_iomap_ops); + iomap_readahead(rac, &zonefs_read_iomap_ops); }
/* * Map blocks for page writeback. This is used only on conventional zone files, * which implies that the page range can only be within the fixed inode size. */ -static int zonefs_map_blocks(struct iomap_writepage_ctx *wpc, - struct inode *inode, loff_t offset) +static int zonefs_write_map_blocks(struct iomap_writepage_ctx *wpc, + struct inode *inode, loff_t offset) { struct zonefs_inode_info *zi = ZONEFS_I(inode);
@@ -147,12 +178,12 @@ static int zonefs_map_blocks(struct iomap_writepage_ctx *wpc, offset < wpc->iomap.offset + wpc->iomap.length) return 0;
- return zonefs_iomap_begin(inode, offset, zi->i_max_size - offset, - IOMAP_WRITE, &wpc->iomap, NULL); + return zonefs_write_iomap_begin(inode, offset, zi->i_max_size - offset, + IOMAP_WRITE, &wpc->iomap, NULL); }
static const struct iomap_writeback_ops zonefs_writeback_ops = { - .map_blocks = zonefs_map_blocks, + .map_blocks = zonefs_write_map_blocks, };
static int zonefs_writepage(struct page *page, struct writeback_control *wbc) @@ -182,7 +213,8 @@ static int zonefs_swap_activate(struct swap_info_struct *sis, return -EINVAL; }
- return iomap_swapfile_activate(sis, swap_file, span, &zonefs_iomap_ops); + return iomap_swapfile_activate(sis, swap_file, span, + &zonefs_read_iomap_ops); }
static const struct address_space_operations zonefs_file_aops = { @@ -612,7 +644,7 @@ static vm_fault_t zonefs_filemap_page_mkwrite(struct vm_fault *vmf)
/* Serialize against truncates */ down_read(&zi->i_mmap_sem); - ret = iomap_page_mkwrite(vmf, &zonefs_iomap_ops); + ret = iomap_page_mkwrite(vmf, &zonefs_write_iomap_ops); up_read(&zi->i_mmap_sem);
sb_end_pagefault(inode->i_sb); @@ -869,7 +901,7 @@ static ssize_t zonefs_file_dio_write(struct kiocb *iocb, struct iov_iter *from) if (append) ret = zonefs_file_dio_append(iocb, from); else - ret = iomap_dio_rw(iocb, from, &zonefs_iomap_ops, + ret = iomap_dio_rw(iocb, from, &zonefs_write_iomap_ops, &zonefs_write_dio_ops, sync); if (zi->i_ztype == ZONEFS_ZTYPE_SEQ && (ret > 0 || ret == -EIOCBQUEUED)) { @@ -911,7 +943,7 @@ static ssize_t zonefs_file_buffered_write(struct kiocb *iocb, if (ret <= 0) goto inode_unlock;
- ret = iomap_file_buffered_write(iocb, from, &zonefs_iomap_ops); + ret = iomap_file_buffered_write(iocb, from, &zonefs_write_iomap_ops); if (ret > 0) iocb->ki_pos += ret; else if (ret == -EIO) @@ -1004,7 +1036,7 @@ static ssize_t zonefs_file_read_iter(struct kiocb *iocb, struct iov_iter *to) goto inode_unlock; } file_accessed(iocb->ki_filp); - ret = iomap_dio_rw(iocb, to, &zonefs_iomap_ops, + ret = iomap_dio_rw(iocb, to, &zonefs_read_iomap_ops, &zonefs_read_dio_ops, is_sync_kiocb(iocb)); } else { ret = generic_file_read_iter(iocb, to); diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c index 44b524136f95..f38b71cc3edb 100644 --- a/net/ipv4/inet_hashtables.c +++ b/net/ipv4/inet_hashtables.c @@ -726,12 +726,14 @@ EXPORT_SYMBOL_GPL(inet_unhash); * Note that we use 32bit integers (vs RFC 'short integers') * because 2^16 is not a multiple of num_ephemeral and this * property might be used by clever attacker. - * RFC claims using TABLE_LENGTH=10 buckets gives an improvement, - * we use 256 instead to really give more isolation and - * privacy, this only consumes 1 KB of kernel memory. + * RFC claims using TABLE_LENGTH=10 buckets gives an improvement, though + * attacks were since demonstrated, thus we use 65536 instead to really + * give more isolation and privacy, at the expense of 256kB of kernel + * memory. */ -#define INET_TABLE_PERTURB_SHIFT 8 -static u32 table_perturb[1 << INET_TABLE_PERTURB_SHIFT]; +#define INET_TABLE_PERTURB_SHIFT 16 +#define INET_TABLE_PERTURB_SIZE (1 << INET_TABLE_PERTURB_SHIFT) +static u32 *table_perturb;
int __inet_hash_connect(struct inet_timewait_death_row *death_row, struct sock *sk, u64 port_offset, @@ -774,10 +776,11 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, if (likely(remaining > 1)) remaining &= ~1U;
- net_get_random_once(table_perturb, sizeof(table_perturb)); - index = hash_32(port_offset, INET_TABLE_PERTURB_SHIFT); + net_get_random_once(table_perturb, + INET_TABLE_PERTURB_SIZE * sizeof(*table_perturb)); + index = port_offset & (INET_TABLE_PERTURB_SIZE - 1);
- offset = READ_ONCE(table_perturb[index]) + port_offset; + offset = READ_ONCE(table_perturb[index]) + (port_offset >> 32); offset %= remaining;
/* In first pass we try ports of @low parity. @@ -833,6 +836,12 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row, return -EADDRNOTAVAIL;
ok: + /* Here we want to add a little bit of randomness to the next source + * port that will be chosen. We use a max() with a random here so that + * on low contention the randomness is maximal and on high contention + * it may be inexistent. + */ + i = max_t(int, i, (prandom_u32() & 7) * 2); WRITE_ONCE(table_perturb[index], READ_ONCE(table_perturb[index]) + i + 2);
/* Head lock still held and bh's disabled */ @@ -906,6 +915,12 @@ void __init inet_hashinfo2_init(struct inet_hashinfo *h, const char *name, low_limit, high_limit); init_hashinfo_lhash2(h); + + /* this one is used for source ports of outgoing connections */ + table_perturb = kmalloc_array(INET_TABLE_PERTURB_SIZE, + sizeof(*table_perturb), GFP_KERNEL); + if (!table_perturb) + panic("TCP: failed to alloc table_perturb"); }
int inet_hashinfo2_init_mod(struct inet_hashinfo *h)
Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
I'm announcing the release of the 5.10.125 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git%3Ba=summa...
thanks,
greg k-h
Makefile | 2 arch/arm64/mm/cache.S | 2 arch/s390/mm/pgtable.c | 2 drivers/tty/serial/serial_core.c | 34 ++++-------- drivers/usb/gadget/function/u_ether.c | 11 +++- fs/io_uring.c | 23 +++++--- fs/zonefs/super.c | 92 ++++++++++++++++++++++------------ net/ipv4/inet_hashtables.c | 31 ++++++++--- 8 files changed, 122 insertions(+), 75 deletions(-)
Christian Borntraeger (1): s390/mm: use non-quiescing sske for KVM switch to keyed guest
Damien Le Moal (1): zonefs: fix zonefs_iomap_begin() for reads
Eric Dumazet (1): tcp: add some entropy in __inet_hash_connect()
Greg Kroah-Hartman (1): Linux 5.10.125
Jens Axboe (1): io_uring: add missing item types for various requests
Lukas Wunner (1): serial: core: Initialize rs485 RTS polarity already on probe
Marian Postevca (1): usb: gadget: u_ether: fix regression in setting fixed MAC address
Will Deacon (1): arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
Willy Tarreau (5): tcp: use different parts of the port_offset for index and offset tcp: add small random increments to the source port tcp: dynamically allocate the perturb table used by source ports tcp: increase source port perturb table to 2^16 tcp: drop the hash_32() part from the index calculation
5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
Here's a manually annotated panic message: [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100) [ 359.055393] kernel BUG at lib/list_debug.c:47! [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1 [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80 [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69 [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046 [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400 [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48 [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540 [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282 [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20 [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000 [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0 [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 359.180647] Call Trace: [ 359.183064] io_dismantle_req+0x1da/0x2b0 __list_del_entry [include/linux/list.h:132] list_del [include/linux/list.h:146] io_req_drop_files [fs/io_uring.c:5934] io_req_clean_work [fs/io_uring.c:1315] io_dismantle_req [fs/io_uring.c:1911] [ 359.187023] io_do_iopoll+0x4e5/0x790 [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0 [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30 [ 359.212793] do_syscall_64+0x31/0x40 [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
On 6/26/22 4:56 PM, Greg Thelen wrote:
Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
I'm announcing the release of the 5.10.125 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git%3Ba=summa...
thanks,
greg k-h
Makefile | 2 arch/arm64/mm/cache.S | 2 arch/s390/mm/pgtable.c | 2 drivers/tty/serial/serial_core.c | 34 ++++-------- drivers/usb/gadget/function/u_ether.c | 11 +++- fs/io_uring.c | 23 +++++--- fs/zonefs/super.c | 92 ++++++++++++++++++++++------------ net/ipv4/inet_hashtables.c | 31 ++++++++--- 8 files changed, 122 insertions(+), 75 deletions(-)
Christian Borntraeger (1): s390/mm: use non-quiescing sske for KVM switch to keyed guest
Damien Le Moal (1): zonefs: fix zonefs_iomap_begin() for reads
Eric Dumazet (1): tcp: add some entropy in __inet_hash_connect()
Greg Kroah-Hartman (1): Linux 5.10.125
Jens Axboe (1): io_uring: add missing item types for various requests
Lukas Wunner (1): serial: core: Initialize rs485 RTS polarity already on probe
Marian Postevca (1): usb: gadget: u_ether: fix regression in setting fixed MAC address
Will Deacon (1): arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
Willy Tarreau (5): tcp: use different parts of the port_offset for index and offset tcp: add small random increments to the source port tcp: dynamically allocate the perturb table used by source ports tcp: increase source port perturb table to 2^16 tcp: drop the hash_32() part from the index calculation
5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
Here's a manually annotated panic message: [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100) [ 359.055393] kernel BUG at lib/list_debug.c:47! [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1 [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80 [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69 [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046 [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400 [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48 [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540 [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282 [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20 [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000 [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0 [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 359.180647] Call Trace: [ 359.183064] io_dismantle_req+0x1da/0x2b0 __list_del_entry [include/linux/list.h:132] list_del [include/linux/list.h:146] io_req_drop_files [fs/io_uring.c:5934] io_req_clean_work [fs/io_uring.c:1315] io_dismantle_req [fs/io_uring.c:1911] [ 359.187023] io_do_iopoll+0x4e5/0x790 [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0 [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30 [ 359.212793] do_syscall_64+0x31/0x40 [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Well that sucks, I wonder why mine didn't fail like that. I'll see if I can hit this and send a fix. Thanks for reporting!
On 6/26/22 6:04 PM, Jens Axboe wrote:
On 6/26/22 4:56 PM, Greg Thelen wrote:
Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
I'm announcing the release of the 5.10.125 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git%3Ba=summa...
thanks,
greg k-h
Makefile | 2 arch/arm64/mm/cache.S | 2 arch/s390/mm/pgtable.c | 2 drivers/tty/serial/serial_core.c | 34 ++++-------- drivers/usb/gadget/function/u_ether.c | 11 +++- fs/io_uring.c | 23 +++++--- fs/zonefs/super.c | 92 ++++++++++++++++++++++------------ net/ipv4/inet_hashtables.c | 31 ++++++++--- 8 files changed, 122 insertions(+), 75 deletions(-)
Christian Borntraeger (1): s390/mm: use non-quiescing sske for KVM switch to keyed guest
Damien Le Moal (1): zonefs: fix zonefs_iomap_begin() for reads
Eric Dumazet (1): tcp: add some entropy in __inet_hash_connect()
Greg Kroah-Hartman (1): Linux 5.10.125
Jens Axboe (1): io_uring: add missing item types for various requests
Lukas Wunner (1): serial: core: Initialize rs485 RTS polarity already on probe
Marian Postevca (1): usb: gadget: u_ether: fix regression in setting fixed MAC address
Will Deacon (1): arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
Willy Tarreau (5): tcp: use different parts of the port_offset for index and offset tcp: add small random increments to the source port tcp: dynamically allocate the perturb table used by source ports tcp: increase source port perturb table to 2^16 tcp: drop the hash_32() part from the index calculation
5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
Here's a manually annotated panic message: [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100) [ 359.055393] kernel BUG at lib/list_debug.c:47! [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1 [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80 [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69 [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046 [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400 [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48 [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540 [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282 [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20 [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000 [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0 [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 359.180647] Call Trace: [ 359.183064] io_dismantle_req+0x1da/0x2b0 __list_del_entry [include/linux/list.h:132] list_del [include/linux/list.h:146] io_req_drop_files [fs/io_uring.c:5934] io_req_clean_work [fs/io_uring.c:1315] io_dismantle_req [fs/io_uring.c:1911] [ 359.187023] io_do_iopoll+0x4e5/0x790 [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0 [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30 [ 359.212793] do_syscall_64+0x31/0x40 [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Well that sucks, I wonder why mine didn't fail like that. I'll see if I can hit this and send a fix. Thanks for reporting!
Below should do it, I apologize for that. I think my test box booted the previous kernel which is why it didn't hit it in my regression tests :-(
Greg, can you add this to 5.10-stable? Verified it ran tests with the right kernel now...
commit d2aaf8fdc544a3edf44820a07294d693dedd12e3 Author: Jens Axboe axboe@kernel.dk Date: Sun Jun 26 18:16:17 2022 -0600
io_uring: use separate list entry for iopoll requests
A previous commit ended up enabling file tracking for iopoll requests, which conflicts with both of them using the same list entry for tracking. Add a separate list entry just for iopoll requests, avoid this issue.
No upstream commit exists for this issue.
Reported-by: Greg Thelen gthelen@google.com Fixes: df3f3bb5059d ("io_uring: add missing item types for various requests") Signed-off-by: Jens Axboe axboe@kernel.dk
diff --git a/fs/io_uring.c b/fs/io_uring.c index 40ac37beca47..2e12dcbc7b0f 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -696,6 +696,8 @@ struct io_kiocb { */ struct list_head inflight_entry;
+ struct list_head iopoll_entry; + struct percpu_ref *fixed_file_refs; struct callback_head task_work; /* for polled requests, i.e. IORING_OP_POLL_ADD and async armed poll */ @@ -2350,8 +2352,8 @@ static void io_iopoll_queue(struct list_head *again) struct io_kiocb *req;
do { - req = list_first_entry(again, struct io_kiocb, inflight_entry); - list_del(&req->inflight_entry); + req = list_first_entry(again, struct io_kiocb, iopoll_entry); + list_del(&req->iopoll_entry); __io_complete_rw(req, -EAGAIN, 0, NULL); } while (!list_empty(again)); } @@ -2373,14 +2375,14 @@ static void io_iopoll_complete(struct io_ring_ctx *ctx, unsigned int *nr_events, while (!list_empty(done)) { int cflags = 0;
- req = list_first_entry(done, struct io_kiocb, inflight_entry); + req = list_first_entry(done, struct io_kiocb, iopoll_entry); if (READ_ONCE(req->result) == -EAGAIN) { req->result = 0; req->iopoll_completed = 0; - list_move_tail(&req->inflight_entry, &again); + list_move_tail(&req->iopoll_entry, &again); continue; } - list_del(&req->inflight_entry); + list_del(&req->iopoll_entry);
if (req->flags & REQ_F_BUFFER_SELECTED) cflags = io_put_rw_kbuf(req); @@ -2416,7 +2418,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events, spin = !ctx->poll_multi_file && *nr_events < min;
ret = 0; - list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, inflight_entry) { + list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, iopoll_entry) { struct kiocb *kiocb = &req->rw.kiocb;
/* @@ -2425,7 +2427,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events, * and complete those lists first, if we have entries there. */ if (READ_ONCE(req->iopoll_completed)) { - list_move_tail(&req->inflight_entry, &done); + list_move_tail(&req->iopoll_entry, &done); continue; } if (!list_empty(&done)) @@ -2437,7 +2439,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
/* iopoll may have completed current req */ if (READ_ONCE(req->iopoll_completed)) - list_move_tail(&req->inflight_entry, &done); + list_move_tail(&req->iopoll_entry, &done);
if (ret && spin) spin = false; @@ -2670,7 +2672,7 @@ static void io_iopoll_req_issued(struct io_kiocb *req) struct io_kiocb *list_req;
list_req = list_first_entry(&ctx->iopoll_list, struct io_kiocb, - inflight_entry); + iopoll_entry); if (list_req->file != req->file) ctx->poll_multi_file = true; } @@ -2680,9 +2682,9 @@ static void io_iopoll_req_issued(struct io_kiocb *req) * it to the front so we find it first. */ if (READ_ONCE(req->iopoll_completed)) - list_add(&req->inflight_entry, &ctx->iopoll_list); + list_add(&req->iopoll_entry, &ctx->iopoll_list); else - list_add_tail(&req->inflight_entry, &ctx->iopoll_list); + list_add_tail(&req->iopoll_entry, &ctx->iopoll_list);
if ((ctx->flags & IORING_SETUP_SQPOLL) && wq_has_sleeper(&ctx->sq_data->wait))
Jens Axboe axboe@kernel.dk wrote:
On 6/26/22 6:04 PM, Jens Axboe wrote:
On 6/26/22 4:56 PM, Greg Thelen wrote:
Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
I'm announcing the release of the 5.10.125 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git%3Ba=summa...
thanks,
greg k-h
Makefile | 2 arch/arm64/mm/cache.S | 2 arch/s390/mm/pgtable.c | 2 drivers/tty/serial/serial_core.c | 34 ++++-------- drivers/usb/gadget/function/u_ether.c | 11 +++- fs/io_uring.c | 23 +++++--- fs/zonefs/super.c | 92 ++++++++++++++++++++++------------ net/ipv4/inet_hashtables.c | 31 ++++++++--- 8 files changed, 122 insertions(+), 75 deletions(-)
Christian Borntraeger (1): s390/mm: use non-quiescing sske for KVM switch to keyed guest
Damien Le Moal (1): zonefs: fix zonefs_iomap_begin() for reads
Eric Dumazet (1): tcp: add some entropy in __inet_hash_connect()
Greg Kroah-Hartman (1): Linux 5.10.125
Jens Axboe (1): io_uring: add missing item types for various requests
Lukas Wunner (1): serial: core: Initialize rs485 RTS polarity already on probe
Marian Postevca (1): usb: gadget: u_ether: fix regression in setting fixed MAC address
Will Deacon (1): arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
Willy Tarreau (5): tcp: use different parts of the port_offset for index and offset tcp: add small random increments to the source port tcp: dynamically allocate the perturb table used by source ports tcp: increase source port perturb table to 2^16 tcp: drop the hash_32() part from the index calculation
5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
Here's a manually annotated panic message: [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100) [ 359.055393] kernel BUG at lib/list_debug.c:47! [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1 [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80 [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69 [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046 [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400 [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48 [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540 [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282 [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20 [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000 [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0 [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 359.180647] Call Trace: [ 359.183064] io_dismantle_req+0x1da/0x2b0 __list_del_entry [include/linux/list.h:132] list_del [include/linux/list.h:146] io_req_drop_files [fs/io_uring.c:5934] io_req_clean_work [fs/io_uring.c:1315] io_dismantle_req [fs/io_uring.c:1911] [ 359.187023] io_do_iopoll+0x4e5/0x790 [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0 [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30 [ 359.212793] do_syscall_64+0x31/0x40 [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Well that sucks, I wonder why mine didn't fail like that. I'll see if I can hit this and send a fix. Thanks for reporting!
Below should do it, I apologize for that. I think my test box booted the previous kernel which is why it didn't hit it in my regression tests :-(
Greg, can you add this to 5.10-stable? Verified it ran tests with the right kernel now...
commit d2aaf8fdc544a3edf44820a07294d693dedd12e3 Author: Jens Axboe axboe@kernel.dk Date: Sun Jun 26 18:16:17 2022 -0600
io_uring: use separate list entry for iopoll requestsA previous commit ended up enabling file tracking for iopoll requests, which conflicts with both of them using the same list entry for tracking. Add a separate list entry just for iopoll requests, avoid this issue. No upstream commit exists for this issue. Reported-by: Greg Thelen gthelen@google.com Fixes: df3f3bb5059d ("io_uring: add missing item types for various requests") Signed-off-by: Jens Axboe axboe@kernel.dk
Confirmed. This patch fixes the error I saw.
Tested-by: Greg Thelen gthelen@google.com
diff --git a/fs/io_uring.c b/fs/io_uring.c index 40ac37beca47..2e12dcbc7b0f 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -696,6 +696,8 @@ struct io_kiocb { */ struct list_head inflight_entry;
- struct list_head iopoll_entry;
- struct percpu_ref *fixed_file_refs; struct callback_head task_work; /* for polled requests, i.e. IORING_OP_POLL_ADD and async armed poll */
@@ -2350,8 +2352,8 @@ static void io_iopoll_queue(struct list_head *again) struct io_kiocb *req; do {
req = list_first_entry(again, struct io_kiocb, inflight_entry);list_del(&req->inflight_entry);
req = list_first_entry(again, struct io_kiocb, iopoll_entry);list_del(&req->iopoll_entry);} @@ -2373,14 +2375,14 @@ static void io_iopoll_complete(struct io_ring_ctx *ctx, unsigned int *nr_events, while (!list_empty(done)) { int cflags = 0;
req = list_first_entry(done, struct io_kiocb, inflight_entry);
req = list_first_entry(done, struct io_kiocb, iopoll_entry);
list_move_tail(&req->inflight_entry, &again);
list_move_tail(&req->iopoll_entry, &again); continue;
list_del(&req->inflight_entry);
list_del(&req->iopoll_entry);if (req->flags & REQ_F_BUFFER_SELECTED) cflags = io_put_rw_kbuf(req); @@ -2416,7 +2418,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events, spin = !ctx->poll_multi_file && *nr_events < min; ret = 0;
- list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, inflight_entry) {
- list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, iopoll_entry) { struct kiocb *kiocb = &req->rw.kiocb;
/* @@ -2425,7 +2427,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events, * and complete those lists first, if we have entries there. */ if (READ_ONCE(req->iopoll_completed)) {
list_move_tail(&req->inflight_entry, &done);
list_move_tail(&req->iopoll_entry, &done); continue;@@ -2437,7 +2439,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events, /* iopoll may have completed current req */ if (READ_ONCE(req->iopoll_completed))
list_move_tail(&req->inflight_entry, &done);
list_move_tail(&req->iopoll_entry, &done);if (ret && spin) spin = false; @@ -2670,7 +2672,7 @@ static void io_iopoll_req_issued(struct io_kiocb *req) struct io_kiocb *list_req; list_req = list_first_entry(&ctx->iopoll_list, struct io_kiocb,
inflight_entry);
iopoll_entry);@@ -2680,9 +2682,9 @@ static void io_iopoll_req_issued(struct io_kiocb *req) * it to the front so we find it first. */ if (READ_ONCE(req->iopoll_completed))
list_add(&req->inflight_entry, &ctx->iopoll_list);
list_add(&req->iopoll_entry, &ctx->iopoll_list);
list_add_tail(&req->inflight_entry, &ctx->iopoll_list);
list_add_tail(&req->iopoll_entry, &ctx->iopoll_list);if ((ctx->flags & IORING_SETUP_SQPOLL) && wq_has_sleeper(&ctx->sq_data->wait))
On Sun, Jun 26, 2022 at 10:42:06PM -0700, Greg Thelen wrote:
Jens Axboe axboe@kernel.dk wrote:
On 6/26/22 6:04 PM, Jens Axboe wrote:
On 6/26/22 4:56 PM, Greg Thelen wrote:
Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
I'm announcing the release of the 5.10.125 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git%3Ba=summa...
thanks,
greg k-h
Makefile | 2 arch/arm64/mm/cache.S | 2 arch/s390/mm/pgtable.c | 2 drivers/tty/serial/serial_core.c | 34 ++++-------- drivers/usb/gadget/function/u_ether.c | 11 +++- fs/io_uring.c | 23 +++++--- fs/zonefs/super.c | 92 ++++++++++++++++++++++------------ net/ipv4/inet_hashtables.c | 31 ++++++++--- 8 files changed, 122 insertions(+), 75 deletions(-)
Christian Borntraeger (1): s390/mm: use non-quiescing sske for KVM switch to keyed guest
Damien Le Moal (1): zonefs: fix zonefs_iomap_begin() for reads
Eric Dumazet (1): tcp: add some entropy in __inet_hash_connect()
Greg Kroah-Hartman (1): Linux 5.10.125
Jens Axboe (1): io_uring: add missing item types for various requests
Lukas Wunner (1): serial: core: Initialize rs485 RTS polarity already on probe
Marian Postevca (1): usb: gadget: u_ether: fix regression in setting fixed MAC address
Will Deacon (1): arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
Willy Tarreau (5): tcp: use different parts of the port_offset for index and offset tcp: add small random increments to the source port tcp: dynamically allocate the perturb table used by source ports tcp: increase source port perturb table to 2^16 tcp: drop the hash_32() part from the index calculation
5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
Here's a manually annotated panic message: [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100) [ 359.055393] kernel BUG at lib/list_debug.c:47! [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1 [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80 [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69 [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046 [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400 [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48 [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540 [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282 [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20 [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000 [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0 [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 359.180647] Call Trace: [ 359.183064] io_dismantle_req+0x1da/0x2b0 __list_del_entry [include/linux/list.h:132] list_del [include/linux/list.h:146] io_req_drop_files [fs/io_uring.c:5934] io_req_clean_work [fs/io_uring.c:1315] io_dismantle_req [fs/io_uring.c:1911] [ 359.187023] io_do_iopoll+0x4e5/0x790 [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0 [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30 [ 359.212793] do_syscall_64+0x31/0x40 [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Well that sucks, I wonder why mine didn't fail like that. I'll see if I can hit this and send a fix. Thanks for reporting!
Below should do it, I apologize for that. I think my test box booted the previous kernel which is why it didn't hit it in my regression tests :-(
Greg, can you add this to 5.10-stable? Verified it ran tests with the right kernel now...
Great, I'll go just do a release with this in it right now to help others out.
greg k-h
On Mon, Jun 27, 2022 at 07:54:23AM +0200, Greg Kroah-Hartman wrote:
On Sun, Jun 26, 2022 at 10:42:06PM -0700, Greg Thelen wrote:
Jens Axboe axboe@kernel.dk wrote:
On 6/26/22 6:04 PM, Jens Axboe wrote:
On 6/26/22 4:56 PM, Greg Thelen wrote:
Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
I'm announcing the release of the 5.10.125 kernel.
All users of the 5.10 kernel series must upgrade.
The updated 5.10.y git tree can be found at: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y and can be browsed at the normal kernel.org git web browser: https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git%3Ba=summa...
thanks,
greg k-h
Makefile | 2 arch/arm64/mm/cache.S | 2 arch/s390/mm/pgtable.c | 2 drivers/tty/serial/serial_core.c | 34 ++++-------- drivers/usb/gadget/function/u_ether.c | 11 +++- fs/io_uring.c | 23 +++++--- fs/zonefs/super.c | 92 ++++++++++++++++++++++------------ net/ipv4/inet_hashtables.c | 31 ++++++++--- 8 files changed, 122 insertions(+), 75 deletions(-)
Christian Borntraeger (1): s390/mm: use non-quiescing sske for KVM switch to keyed guest
Damien Le Moal (1): zonefs: fix zonefs_iomap_begin() for reads
Eric Dumazet (1): tcp: add some entropy in __inet_hash_connect()
Greg Kroah-Hartman (1): Linux 5.10.125
Jens Axboe (1): io_uring: add missing item types for various requests
Lukas Wunner (1): serial: core: Initialize rs485 RTS polarity already on probe
Marian Postevca (1): usb: gadget: u_ether: fix regression in setting fixed MAC address
Will Deacon (1): arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
Willy Tarreau (5): tcp: use different parts of the port_offset for index and offset tcp: add small random increments to the source port tcp: dynamically allocate the perturb table used by source ports tcp: increase source port perturb table to 2^16 tcp: drop the hash_32() part from the index calculation
5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
Here's a manually annotated panic message: [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100) [ 359.055393] kernel BUG at lib/list_debug.c:47! [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1 [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80 [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69 [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046 [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400 [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48 [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540 [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282 [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20 [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000 [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0 [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 359.180647] Call Trace: [ 359.183064] io_dismantle_req+0x1da/0x2b0 __list_del_entry [include/linux/list.h:132] list_del [include/linux/list.h:146] io_req_drop_files [fs/io_uring.c:5934] io_req_clean_work [fs/io_uring.c:1315] io_dismantle_req [fs/io_uring.c:1911] [ 359.187023] io_do_iopoll+0x4e5/0x790 [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0 [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30 [ 359.212793] do_syscall_64+0x31/0x40 [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Well that sucks, I wonder why mine didn't fail like that. I'll see if I can hit this and send a fix. Thanks for reporting!
Below should do it, I apologize for that. I think my test box booted the previous kernel which is why it didn't hit it in my regression tests :-(
Greg, can you add this to 5.10-stable? Verified it ran tests with the right kernel now...
Great, I'll go just do a release with this in it right now to help others out.
5.10.126 is now released with this fix.
On 6/27/22 2:05 AM, Greg Kroah-Hartman wrote:
On Mon, Jun 27, 2022 at 07:54:23AM +0200, Greg Kroah-Hartman wrote:
On Sun, Jun 26, 2022 at 10:42:06PM -0700, Greg Thelen wrote:
Jens Axboe axboe@kernel.dk wrote:
On 6/26/22 6:04 PM, Jens Axboe wrote:
On 6/26/22 4:56 PM, Greg Thelen wrote:
Greg Kroah-Hartman gregkh@linuxfoundation.org wrote:
> I'm announcing the release of the 5.10.125 kernel. > > All users of the 5.10 kernel series must upgrade. > > The updated 5.10.y git tree can be found at: > git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y > and can be browsed at the normal kernel.org git web browser: > https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git%3Ba=summa... > > thanks, > > greg k-h > > ------------ > > Makefile | 2 > arch/arm64/mm/cache.S | 2 > arch/s390/mm/pgtable.c | 2 > drivers/tty/serial/serial_core.c | 34 ++++-------- > drivers/usb/gadget/function/u_ether.c | 11 +++- > fs/io_uring.c | 23 +++++--- > fs/zonefs/super.c | 92 ++++++++++++++++++++++------------ > net/ipv4/inet_hashtables.c | 31 ++++++++--- > 8 files changed, 122 insertions(+), 75 deletions(-) > > Christian Borntraeger (1): > s390/mm: use non-quiescing sske for KVM switch to keyed guest > > Damien Le Moal (1): > zonefs: fix zonefs_iomap_begin() for reads > > Eric Dumazet (1): > tcp: add some entropy in __inet_hash_connect() > > Greg Kroah-Hartman (1): > Linux 5.10.125 > > Jens Axboe (1): > io_uring: add missing item types for various requests > > Lukas Wunner (1): > serial: core: Initialize rs485 RTS polarity already on probe > > Marian Postevca (1): > usb: gadget: u_ether: fix regression in setting fixed MAC address > > Will Deacon (1): > arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer > > Willy Tarreau (5): > tcp: use different parts of the port_offset for index and offset > tcp: add small random increments to the source port > tcp: dynamically allocate the perturb table used by source ports > tcp: increase source port perturb table to 2^16 > tcp: drop the hash_32() part from the index calculation
5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
Here's a manually annotated panic message: [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100) [ 359.055393] kernel BUG at lib/list_debug.c:47! [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1 [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80 [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69 [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046 [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400 [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48 [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540 [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282 [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20 [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000 [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0 [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 359.180647] Call Trace: [ 359.183064] io_dismantle_req+0x1da/0x2b0 __list_del_entry [include/linux/list.h:132] list_del [include/linux/list.h:146] io_req_drop_files [fs/io_uring.c:5934] io_req_clean_work [fs/io_uring.c:1315] io_dismantle_req [fs/io_uring.c:1911] [ 359.187023] io_do_iopoll+0x4e5/0x790 [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0 [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30 [ 359.212793] do_syscall_64+0x31/0x40 [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
Well that sucks, I wonder why mine didn't fail like that. I'll see if I can hit this and send a fix. Thanks for reporting!
Below should do it, I apologize for that. I think my test box booted the previous kernel which is why it didn't hit it in my regression tests :-(
Greg, can you add this to 5.10-stable? Verified it ran tests with the right kernel now...
Great, I'll go just do a release with this in it right now to help others out.
5.10.126 is now released with this fix.
Thanks - to both Gregs!
linux-stable-mirror@lists.linaro.org
-
Greg Kroah-Hartman -
Greg Thelen -
Jens Axboe