- Kernel - mailweb.openeuler.org

[PATCH openEuler-22.03-LTS-SP2] mm: add preferred_swap ability
by liubo 24 Aug '23

24 Aug '23

From: Ni Cunshu <nicunshu(a)huawei.com> euleros inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I7U78A CVE: NA ------------------------------------------------ add a new attribute preferred_swap for each process, which indicates the swapfile or swap device that can be used by the process. Each process can only have one preferred_swap. Signed-off-by: Ni Cunshu <nicunshu(a)huawei.com> --- fs/proc/base.c | 113 +++++++++++++++++++++++++++++++++++++++ include/linux/mm_types.h | 4 ++ include/linux/swap.h | 13 +++++ kernel/fork.c | 4 ++ mm/Kconfig | 7 +++ mm/swap_slots.c | 68 ++++++++++++++++++++++- mm/swapfile.c | 86 ++++++++++++++++++++++++++++- 7 files changed, 292 insertions(+), 3 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 24c70ff923b8..34537572db57 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -3330,6 +3330,116 @@ static const struct file_operations proc_preferred_cpuset_operations = { }; #endif +#ifdef CONFIG_PREFERRED_SWAP +static ssize_t proc_preferred_swap_read(struct file *file, char __user *buf, + size_t count, loff_t *ppos) +{ + struct task_struct *task = get_proc_task(file_inode(file)); + struct mm_struct *mm; + int ret; + int err = 0; + size_t len; + char *buffer; + char *path; + + if (!task) + return -ESRCH; + + ret = 0; + mm = get_task_mm(task); + if (!mm) + goto out_no_mm; + + if (mm->preferred_swap) { + buffer = (char *)kmalloc(PATH_MAX + 1, GFP_KERNEL); + if (buffer == NULL) { + err = -ENOMEM; + goto out; + } + + path = d_path(&mm->preferred_swap->swap_file->f_path, + buffer, PATH_MAX); + + if (IS_ERR(path)) { + err = PTR_ERR(path); + kfree(buffer); + goto out; + } + + len = snprintf(buffer, strlen(path) + 2, "%s\n", path); + ret = simple_read_from_buffer(buf, count, ppos, buffer, len); + kfree(buffer); + } +out: + mmput(mm); +out_no_mm: + put_task_struct(task); + if (err < 0) + return err; + return ret; +} + +static ssize_t proc_preferred_swap_write(struct file *file, + const char __user *buf, size_t count, loff_t *ppos) +{ + struct task_struct *task; + struct mm_struct *mm; + char *buffer; + int err = 0; + + if (count >= PATH_MAX) + return -EINVAL; + + buffer = (char *)kmalloc(PATH_MAX, GFP_KERNEL); + if (buffer == NULL) { + err = -ENOMEM; + goto out_no_buffer; + } + if (copy_from_user(buffer, buf, count)) { + err = -EFAULT; + goto out_no_task; + } + buffer[count] = '\0'; + strreplace(buffer, '\n', '\0'); + task = get_proc_task(file_inode(file)); + if (!task) { + err = -ESRCH; + goto out_no_task; + } + mm = get_task_mm(task); + if (!mm) { + err = -ESRCH; + goto out_no_mm; + } + if (strlen(buffer) == 0) { + mm->preferred_swap = NULL; + goto out; + } + err = find_swap_info(buffer, mm); + if (err) { + pr_info("%s failed to be found as swap\n", buffer); + goto out; + } + + preferred_swap_used = 1; +out: + mmput(mm); +out_no_mm: + put_task_struct(task); +out_no_task: + kfree(buffer); +out_no_buffer: + if (err < 0) + return err; + return count; +} +static const struct file_operations proc_preferred_swap_operations = { + .write = proc_preferred_swap_write, + .read = proc_preferred_swap_read, + .llseek = generic_file_llseek, +}; +#endif /* CONFIG_PREFERRED_SWAP */ + static int proc_pid_personality(struct seq_file *m, struct pid_namespace *ns, struct pid *pid, struct task_struct *task) { @@ -3526,6 +3636,9 @@ static const struct pid_entry tgid_base_stuff[] = { ONE("ksm_merging_pages", S_IRUSR, proc_pid_ksm_merging_pages), ONE("ksm_stat", S_IRUSR, proc_pid_ksm_stat), #endif +#ifdef CONFIG_PREFERRED_SWAP + REG("preferred_swap", S_IRUGO|S_IWUSR, proc_preferred_swap_operations), +#endif }; static int proc_tgid_base_readdir(struct file *file, struct dir_context *ctx) diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index e3eaf458787a..2edd816fba7f 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -638,7 +638,11 @@ struct mm_struct { KABI_RESERVE(2) KABI_RESERVE(3) #endif +#ifdef CONFIG_PREFERRED_SWAP + KABI_USE(4, struct swap_info_struct *preferred_swap) +#else KABI_RESERVE(4) +#endif KABI_RESERVE(5) KABI_RESERVE(6) KABI_RESERVE(7) diff --git a/include/linux/swap.h b/include/linux/swap.h index 7f49964f27d2..998f10e97601 100644 --- a/include/linux/swap.h +++ b/include/linux/swap.h @@ -389,6 +389,10 @@ extern int vm_swappiness; extern int remove_mapping(struct address_space *mapping, struct page *page); extern unsigned long reclaim_pages(struct list_head *page_list); +#ifdef CONFIG_PREFERRED_SWAP +extern int find_swap_info(char *filename, struct mm_struct *mm); +extern void clear_tasks_mm_preferred_swap(struct swap_info_struct *p); +#endif #ifdef CONFIG_ETMEM enum etmem_swapcache_watermark_en { ETMEM_SWAPCACHE_WMARK_LOW, @@ -496,6 +500,10 @@ extern long total_swap_pages; extern atomic_t nr_rotate_swap; extern bool has_usable_swap(void); +#ifdef CONFIG_PREFERRED_SWAP +extern int preferred_swap_used; +#endif + /* Swap 50% full? Release swapcache more aggressively.. */ static inline bool vm_swap_full(void) { @@ -511,7 +519,12 @@ extern void si_swapinfo(struct sysinfo *); extern swp_entry_t get_swap_page(struct page *page); extern void put_swap_page(struct page *page, swp_entry_t entry); extern swp_entry_t get_swap_page_of_type(int); +#ifdef CONFIG_PREFERRED_SWAP +extern int get_swap_pages(int n, swp_entry_t swp_entries[], int entry_size, + struct swap_info_struct *preferred_swap); +#else extern int get_swap_pages(int n, swp_entry_t swp_entries[], int entry_size); +#endif extern int add_swap_count_continuation(swp_entry_t, gfp_t); extern void swap_shmem_alloc(swp_entry_t); extern int swap_duplicate(swp_entry_t); diff --git a/kernel/fork.c b/kernel/fork.c index 2547c6a6e5b1..734882ed98c6 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1072,6 +1072,10 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, mm_init_uprobes_state(mm); hugetlb_count_init(mm); +#ifdef CONFIG_PREFERRED_SWAP + mm->preferred_swap = NULL; +#endif + if (current->mm) { mm->flags = current->mm->flags & MMF_INIT_MASK; mm->def_flags = current->mm->def_flags & VM_INIT_DEF_MASK; diff --git a/mm/Kconfig b/mm/Kconfig index f66457168de9..48c37c3bda8c 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -999,6 +999,13 @@ config EXTEND_HUGEPAGE_MAPPING help Introduce vmalloc/vmap/remap interfaces that handle only hugepages. +config PREFERRED_SWAP + bool "make task only swapping memory to assigned swap" + depends on SYSFS + default y + help + Say Y here to enable kernel to limit tasks only swapping memory to assigned swap. + source "mm/damon/Kconfig" endmenu diff --git a/mm/swap_slots.c b/mm/swap_slots.c index 0357fbe70645..79a3164bf393 100644 --- a/mm/swap_slots.c +++ b/mm/swap_slots.c @@ -33,6 +33,9 @@ #include <linux/vmalloc.h> #include <linux/mutex.h> #include <linux/mm.h> +#ifdef CONFIG_PREFERRED_SWAP +#include <linux/rmap.h> +#endif static DEFINE_PER_CPU(struct swap_slots_cache, swp_slots); static bool swap_slot_cache_active; @@ -265,8 +268,13 @@ static int refill_swap_slots_cache(struct swap_slots_cache *cache) cache->cur = 0; if (swap_slot_cache_active) +#ifdef CONFIG_PREFERRED_SWAP + cache->nr = get_swap_pages(SWAP_SLOTS_CACHE_SIZE, + cache->slots, 1, NULL); +#else cache->nr = get_swap_pages(SWAP_SLOTS_CACHE_SIZE, cache->slots, 1); +#endif return cache->nr; } @@ -303,16 +311,66 @@ int free_swap_slot(swp_entry_t entry) return 0; } +#ifdef CONFIG_PREFERRED_SWAP +static bool has_preferred_swap(struct page *page, struct vm_area_struct *vma, + unsigned long addr, void *arg) +{ + struct swap_info_struct **si = (struct swap_info_struct **)arg; + + if (*si) { + *si = ERR_PTR(-EPERM); + return false; + } + if (vma->vm_file) { + *si = ERR_PTR(-EPERM); + return false; + } + if (vma->vm_mm->preferred_swap) { + *si = vma->vm_mm->preferred_swap; + } else { + *si = ERR_PTR(-EPERM); + return false; + } + return true; +} + +static struct swap_info_struct *page_preferred_swap(struct page *page) +{ + struct swap_info_struct *preferred_swap = NULL; + struct rmap_walk_control rwc = { + .rmap_one = has_preferred_swap, + .arg = (void *)&preferred_swap, + .anon_lock = page_lock_anon_vma_read, + }; + rmap_walk(page, &rwc); + if (IS_ERR_OR_NULL(preferred_swap)) + preferred_swap = NULL; + + return preferred_swap; +} +#endif /* CONFIG_PREFERRED_SWAP */ + swp_entry_t get_swap_page(struct page *page) { swp_entry_t entry; struct swap_slots_cache *cache; +#ifdef CONFIG_PREFERRED_SWAP + struct swap_info_struct *preferred_swap = NULL; + + if (!page_mapping(page)) + preferred_swap = page_preferred_swap(page); +#endif + entry.val = 0; if (PageTransHuge(page)) { if (IS_ENABLED(CONFIG_THP_SWAP)) +#ifdef CONFIG_PREFERRED_SWAP + get_swap_pages(1, &entry, HPAGE_PMD_NR, preferred_swap); +#else get_swap_pages(1, &entry, HPAGE_PMD_NR); +#endif goto out; } @@ -327,7 +385,11 @@ swp_entry_t get_swap_page(struct page *page) */ cache = raw_cpu_ptr(&swp_slots); - if (likely(check_cache_active() && cache->slots)) { +#ifdef CONFIG_PREFERRED_SWAP + if (likely(check_cache_active() && cache->slots && !preferred_swap)) { +#else + if (likely(check_cache_active() && cache->slots &&)) { +#endif mutex_lock(&cache->alloc_lock); if (cache->slots) { repeat: @@ -344,7 +406,11 @@ swp_entry_t get_swap_page(struct page *page) goto out; } +#ifdef CONFIG_PREFERRED_SWAP + get_swap_pages(1, &entry, 1, preferred_swap); +#else get_swap_pages(1, &entry, 1); +#endif out: if (mem_cgroup_try_charge_swap(page, entry)) { put_swap_page(page, entry); diff --git a/mm/swapfile.c b/mm/swapfile.c index 14e2396fa8a3..c40037f29647 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -62,7 +62,10 @@ EXPORT_SYMBOL_GPL(nr_swap_pages); /* protected with swap_lock. reading in vm_swap_full() doesn't need lock */ long total_swap_pages; static int least_priority = -1; - +#ifdef CONFIG_EULEROS_PREFERRED_SWAP +DEFINE_SPINLOCK(preferred_swap_lock); +int preferred_swap_used; +#endif static const char Bad_file[] = "Bad swap file entry "; static const char Unused_file[] = "Unused swap file entry "; static const char Bad_offset[] = "Bad swap offset entry "; @@ -1056,7 +1059,13 @@ static unsigned long scan_swap_map(struct swap_info_struct *si, } -int get_swap_pages(int n_goal, swp_entry_t swp_entries[], int entry_size) +#ifdef CONFIG_EULEROS_PREFERRED_SWAP +int get_swap_pages(int n_goal, swp_entry_t swp_entries[], + int entry_size, struct swap_info_struct *preferred_swap) +#else +int get_swap_pages(int n_goal, swp_entry_t swp_entries[], + int entry_size) +#endif { unsigned long size = swap_entry_size(entry_size); struct swap_info_struct *si, *next; @@ -1082,6 +1091,10 @@ int get_swap_pages(int n_goal, swp_entry_t swp_entries[], int entry_size) start_over: node = numa_node_id(); plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { +#ifdef CONFIG_EULEROS_PREFERRED_SWAP + if (preferred_swap && preferred_swap != si) + goto nextsi; +#endif /* requeue si to after same-priority siblings */ plist_requeue(&si->avail_lists[node], &swap_avail_heads[node]); spin_unlock(&swap_avail_lock); @@ -2643,6 +2656,10 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile) p->flags &= ~SWP_WRITEOK; spin_unlock(&p->lock); spin_unlock(&swap_lock); +#ifdef CONFIG_EULEROS_PREFERRED_SWAP + if (preferred_swap_used) + clear_tasks_mm_preferred_swap(p); +#endif disable_swap_slots_cache_lock(); @@ -3878,6 +3895,71 @@ void cgroup_throttle_swaprate(struct page *page, gfp_t gfp_mask) } #endif +#ifdef CONFIG_EULEROS_PREFERRED_SWAP +int find_swap_info(char *filename, struct mm_struct *mm) +{ + struct file *chosen_file; + unsigned int type; + struct path path; + int err = 0; + struct swap_info_struct *found_swap = NULL; + + err = kern_path(filename, LOOKUP_FOLLOW, &path); + if (err) + goto out_no_path; + chosen_file = dentry_open(&path, O_RDWR|O_LARGEFILE, current_cred()); + if (IS_ERR(chosen_file)) { + err = PTR_ERR(chosen_file); + goto out_no_file; + } + spin_lock(&preferred_swap_lock); + spin_lock(&swap_lock); + for (type = 0; type < nr_swapfiles; type++) { + if ((swap_info[type]->flags & SWP_USED) && + (swap_info[type]->flags & SWP_WRITEOK)) { + if (swap_info[type]->swap_file->f_mapping == + chosen_file->f_mapping) { + found_swap = swap_info[type]; + break; + } + } + } + + spin_unlock(&swap_lock); + if (type >= nr_swapfiles) { + err = -EINVAL; + goto out; + } + + mm->preferred_swap = found_swap; +out: + spin_unlock(&preferred_swap_lock); + filp_close(chosen_file, NULL); +out_no_file: + path_put(&path); +out_no_path: + return err; +} + +void clear_tasks_mm_preferred_swap(struct swap_info_struct *p) +{ + struct task_struct *task; + struct mm_struct *mm; + + spin_lock(&preferred_swap_lock); + read_lock(&tasklist_lock); + for_each_process(task) { + mm = get_task_mm(task); + if (mm) { + if (mm->preferred_swap == p) + mm->preferred_swap = NULL; + mmput(mm); + } + } + read_unlock(&tasklist_lock); + spin_unlock(&preferred_swap_lock); +} +#endif static int __init swapfile_init(void) { int nid; -- 2.27.0

2 1

[PATCH OLK-5.10] mm: add preferred_swap ability
by liubo 24 Aug '23

24 Aug '23

From: Ni Cunshu <nicunshu(a)huawei.com> euleros inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I7VR4N CVE: NA ------------------------------------------------ add a new attribute preferred_swap for each process, which indicates the swapfile or swap device that can be used by the process. Each process can only have one preferred_swap. Signed-off-by: Ni Cunshu <nicunshu(a)huawei.com> --- fs/proc/base.c | 113 +++++++++++++++++++++++++++++++++++++++ include/linux/mm_types.h | 4 ++ include/linux/swap.h | 13 +++++ kernel/fork.c | 4 ++ mm/Kconfig | 7 +++ mm/swap_slots.c | 68 ++++++++++++++++++++++- mm/swapfile.c | 85 ++++++++++++++++++++++++++++- 7 files changed, 291 insertions(+), 3 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 24c70ff923b8..34537572db57 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -3330,6 +3330,116 @@ static const struct file_operations proc_preferred_cpuset_operations = { }; #endif +#ifdef CONFIG_PREFERRED_SWAP +static ssize_t proc_preferred_swap_read(struct file *file, char __user *buf, + size_t count, loff_t *ppos) +{ + struct task_struct *task = get_proc_task(file_inode(file)); + struct mm_struct *mm; + int ret; + int err = 0; + size_t len; + char *buffer; + char *path; + + if (!task) + return -ESRCH; + + ret = 0; + mm = get_task_mm(task); + if (!mm) + goto out_no_mm; + + if (mm->preferred_swap) { + buffer = (char *)kmalloc(PATH_MAX + 1, GFP_KERNEL); + if (buffer == NULL) { + err = -ENOMEM; + goto out; + } + + path = d_path(&mm->preferred_swap->swap_file->f_path, + buffer, PATH_MAX); + + if (IS_ERR(path)) { + err = PTR_ERR(path); + kfree(buffer); + goto out; + } + + len = snprintf(buffer, strlen(path) + 2, "%s\n", path); + ret = simple_read_from_buffer(buf, count, ppos, buffer, len); + kfree(buffer); + } +out: + mmput(mm); +out_no_mm: + put_task_struct(task); + if (err < 0) + return err; + return ret; +} + +static ssize_t proc_preferred_swap_write(struct file *file, + const char __user *buf, size_t count, loff_t *ppos) +{ + struct task_struct *task; + struct mm_struct *mm; + char *buffer; + int err = 0; + + if (count >= PATH_MAX) + return -EINVAL; + + buffer = (char *)kmalloc(PATH_MAX, GFP_KERNEL); + if (buffer == NULL) { + err = -ENOMEM; + goto out_no_buffer; + } + if (copy_from_user(buffer, buf, count)) { + err = -EFAULT; + goto out_no_task; + } + buffer[count] = '\0'; + strreplace(buffer, '\n', '\0'); + task = get_proc_task(file_inode(file)); + if (!task) { + err = -ESRCH; + goto out_no_task; + } + mm = get_task_mm(task); + if (!mm) { + err = -ESRCH; + goto out_no_mm; + } + if (strlen(buffer) == 0) { + mm->preferred_swap = NULL; + goto out; + } + err = find_swap_info(buffer, mm); + if (err) { + pr_info("%s failed to be found as swap\n", buffer); + goto out; + } + + preferred_swap_used = 1; +out: + mmput(mm); +out_no_mm: + put_task_struct(task); +out_no_task: + kfree(buffer); +out_no_buffer: + if (err < 0) + return err; + return count; +} +static const struct file_operations proc_preferred_swap_operations = { + .write = proc_preferred_swap_write, + .read = proc_preferred_swap_read, + .llseek = generic_file_llseek, +}; +#endif /* CONFIG_PREFERRED_SWAP */ + static int proc_pid_personality(struct seq_file *m, struct pid_namespace *ns, struct pid *pid, struct task_struct *task) { @@ -3526,6 +3636,9 @@ static const struct pid_entry tgid_base_stuff[] = { ONE("ksm_merging_pages", S_IRUSR, proc_pid_ksm_merging_pages), ONE("ksm_stat", S_IRUSR, proc_pid_ksm_stat), #endif +#ifdef CONFIG_PREFERRED_SWAP + REG("preferred_swap", S_IRUGO|S_IWUSR, proc_preferred_swap_operations), +#endif }; static int proc_tgid_base_readdir(struct file *file, struct dir_context *ctx) diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index d1be389c0468..07ccbcd4e65a 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -640,7 +640,11 @@ struct mm_struct { KABI_RESERVE(2) KABI_RESERVE(3) #endif +#ifdef CONFIG_PREFERRED_SWAP + KABI_USE(4, struct swap_info_struct *preferred_swap) +#else KABI_RESERVE(4) +#endif KABI_RESERVE(5) KABI_RESERVE(6) KABI_RESERVE(7) diff --git a/include/linux/swap.h b/include/linux/swap.h index 524e3ca9d0f5..403e37c5641c 100644 --- a/include/linux/swap.h +++ b/include/linux/swap.h @@ -393,6 +393,10 @@ extern int vm_swappiness; extern int remove_mapping(struct address_space *mapping, struct page *page); extern unsigned long reclaim_pages(struct list_head *page_list); +#ifdef CONFIG_PREFERRED_SWAP +extern int find_swap_info(char *filename, struct mm_struct *mm); +extern void clear_tasks_mm_preferred_swap(struct swap_info_struct *p); +#endif #ifdef CONFIG_ETMEM enum etmem_swapcache_watermark_en { ETMEM_SWAPCACHE_WMARK_LOW, @@ -500,6 +504,10 @@ extern long total_swap_pages; extern atomic_t nr_rotate_swap; extern bool has_usable_swap(void); +#ifdef CONFIG_PREFERRED_SWAP +extern int preferred_swap_used; +#endif + /* Swap 50% full? Release swapcache more aggressively.. */ static inline bool vm_swap_full(void) { @@ -517,8 +525,13 @@ extern void si_swapinfo(struct sysinfo *); extern swp_entry_t get_swap_page(struct page *page); extern void put_swap_page(struct page *page, swp_entry_t entry); extern swp_entry_t get_swap_page_of_type(int); +#ifdef CONFIG_PREFERRED_SWAP +extern int get_swap_pages(int n, swp_entry_t swp_entries[], int entry_size, + struct swap_info_struct *preferred_swap, int type); +#else extern int get_swap_pages(int n, swp_entry_t swp_entries[], int entry_size, int type); +#endif extern int add_swap_count_continuation(swp_entry_t, gfp_t); extern void swap_shmem_alloc(swp_entry_t); extern int swap_duplicate(swp_entry_t); diff --git a/kernel/fork.c b/kernel/fork.c index 2547c6a6e5b1..734882ed98c6 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1072,6 +1072,10 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, mm_init_uprobes_state(mm); hugetlb_count_init(mm); +#ifdef CONFIG_PREFERRED_SWAP + mm->preferred_swap = NULL; +#endif + if (current->mm) { mm->flags = current->mm->flags & MMF_INIT_MASK; mm->def_flags = current->mm->def_flags & VM_INIT_DEF_MASK; diff --git a/mm/Kconfig b/mm/Kconfig index 0fe459e79336..61fb6cbaab6b 100644 --- a/mm/Kconfig +++ b/mm/Kconfig @@ -1008,6 +1008,13 @@ config EXTEND_HUGEPAGE_MAPPING help Introduce vmalloc/vmap/remap interfaces that handle only hugepages. +config PREFERRED_SWAP + bool "make task only swapping memory to assigned swap" + depends on SYSFS + default y + help + Say Y here to enable kernel to limit tasks only swapping memory to assigned swap. + source "mm/damon/Kconfig" endmenu diff --git a/mm/swap_slots.c b/mm/swap_slots.c index b7958ca276c2..b77af28cdceb 100644 --- a/mm/swap_slots.c +++ b/mm/swap_slots.c @@ -33,6 +33,9 @@ #include <linux/vmalloc.h> #include <linux/mutex.h> #include <linux/mm.h> +#ifdef CONFIG_PREFERRED_SWAP +#include <linux/rmap.h> +#endif static DEFINE_PER_CPU(struct swap_slots_cache, swp_slots); #ifdef CONFIG_MEMCG_SWAP_QOS @@ -385,8 +388,13 @@ static int refill_swap_slots_cache(struct swap_slots_cache *cache, int type) cache->cur = 0; if (swap_slot_cache_active) +#ifdef CONFIG_PREFERRED_SWAP + cache->nr = get_swap_pages(SWAP_SLOTS_CACHE_SIZE, + cache->slots, 1, NULL, type); +#else cache->nr = get_swap_pages(SWAP_SLOTS_CACHE_SIZE, cache->slots, 1, type); +#endif return cache->nr; } @@ -423,12 +431,58 @@ int free_swap_slot(swp_entry_t entry) return 0; } +#ifdef CONFIG_PREFERRED_SWAP +static bool has_preferred_swap(struct page *page, struct vm_area_struct *vma, + unsigned long addr, void *arg) +{ + struct swap_info_struct **si = (struct swap_info_struct **)arg; + + if (*si) { + *si = ERR_PTR(-EPERM); + return false; + } + if (vma->vm_file) { + *si = ERR_PTR(-EPERM); + return false; + } + if (vma->vm_mm->preferred_swap) { + *si = vma->vm_mm->preferred_swap; + } else { + *si = ERR_PTR(-EPERM); + return false; + } + return true; +} + +static struct swap_info_struct *page_preferred_swap(struct page *page) +{ + struct swap_info_struct *preferred_swap = NULL; + struct rmap_walk_control rwc = { + .rmap_one = has_preferred_swap, + .arg = (void *)&preferred_swap, + .anon_lock = page_lock_anon_vma_read, + }; + rmap_walk(page, &rwc); + if (IS_ERR_OR_NULL(preferred_swap)) + preferred_swap = NULL; + + return preferred_swap; +} +#endif /* CONFIG_PREFERRED_SWAP */ + swp_entry_t get_swap_page(struct page *page) { swp_entry_t entry; struct swap_slots_cache *cache; int type; +#ifdef CONFIG_PREFERRED_SWAP + struct swap_info_struct *preferred_swap = NULL; + + if (!page_mapping(page)) + preferred_swap = page_preferred_swap(page); +#endif + entry.val = 0; type = memcg_get_swap_type(page); @@ -437,7 +491,11 @@ swp_entry_t get_swap_page(struct page *page) if (PageTransHuge(page)) { if (IS_ENABLED(CONFIG_THP_SWAP) && arch_thp_swp_supported()) +#ifdef CONFIG_PREFERRED_SWAP + get_swap_pages(1, &entry, HPAGE_PMD_NR, preferred_swap, type); +#else get_swap_pages(1, &entry, HPAGE_PMD_NR, type); +#endif goto out; } @@ -452,7 +510,11 @@ swp_entry_t get_swap_page(struct page *page) */ cache = get_slots_cache(type); - if (likely(check_cache_active() && cache->slots)) { +#ifdef CONFIG_PREFERRED_SWAP + if (likely(check_cache_active() && cache->slots && !preferred_swap)) { +#else + if (likely(check_cache_active() && cache->slots &&)) { +#endif mutex_lock(&cache->alloc_lock); if (cache->slots) { repeat: @@ -469,7 +531,11 @@ swp_entry_t get_swap_page(struct page *page) goto out; } +#ifdef CONFIG_PREFERRED_SWAP + get_swap_pages(1, &entry, 1, preferred_swap, type); +#else get_swap_pages(1, &entry, 1, type); +#endif out: if (mem_cgroup_try_charge_swap(page, entry)) { put_swap_page(page, entry); diff --git a/mm/swapfile.c b/mm/swapfile.c index f5a15511f45a..223af9c9fadb 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -62,7 +62,10 @@ EXPORT_SYMBOL_GPL(nr_swap_pages); /* protected with swap_lock. reading in vm_swap_full() doesn't need lock */ long total_swap_pages; static int least_priority = -1; - +#ifdef CONFIG_PREFERRED_SWAP +DEFINE_SPINLOCK(preferred_swap_lock); +int preferred_swap_used; +#endif static const char Bad_file[] = "Bad swap file entry "; static const char Unused_file[] = "Unused swap file entry "; static const char Bad_offset[] = "Bad swap offset entry "; @@ -1145,8 +1148,13 @@ static inline bool should_skip_swap_type(int swap_type, int type) } #endif +#ifdef CONFIG_PREFERRED_SWAP +int get_swap_pages(int n_goal, swp_entry_t swp_entries[], int entry_size, + struct swap_info_struct *preferred_swap, int type) +#else int get_swap_pages(int n_goal, swp_entry_t swp_entries[], int entry_size, int type) +#endif { unsigned long size = swap_entry_size(entry_size); struct swap_info_struct *si, *next; @@ -1172,11 +1180,15 @@ int get_swap_pages(int n_goal, swp_entry_t swp_entries[], int entry_size, start_over: node = numa_node_id(); plist_for_each_entry_safe(si, next, &swap_avail_heads[node], avail_lists[node]) { +#ifdef CONFIG_PREFERRED_SWAP + if (preferred_swap && preferred_swap != si) + goto nextsi; +#endif /* requeue si to after same-priority siblings */ plist_requeue(&si->avail_lists[node], &swap_avail_heads[node]); spin_unlock(&swap_avail_lock); spin_lock(&si->lock); - if (should_skip_swap_type(si->type, type)) { + if (!preferred_swap && should_skip_swap_type(si->type, type)) { spin_unlock(&si->lock); spin_lock(&swap_avail_lock); goto nextsi; @@ -2738,6 +2750,10 @@ SYSCALL_DEFINE1(swapoff, const char __user *, specialfile) p->flags &= ~SWP_WRITEOK; spin_unlock(&p->lock); spin_unlock(&swap_lock); +#ifdef CONFIG_PREFERRED_SWAP + if (preferred_swap_used) + clear_tasks_mm_preferred_swap(p); +#endif disable_swap_slots_cache_lock(); @@ -3974,6 +3990,71 @@ void cgroup_throttle_swaprate(struct page *page, gfp_t gfp_mask) } #endif +#ifdef CONFIG_PREFERRED_SWAP +int find_swap_info(char *filename, struct mm_struct *mm) +{ + struct file *chosen_file; + unsigned int type; + struct path path; + int err = 0; + struct swap_info_struct *found_swap = NULL; + + err = kern_path(filename, LOOKUP_FOLLOW, &path); + if (err) + goto out_no_path; + chosen_file = dentry_open(&path, O_RDWR|O_LARGEFILE, current_cred()); + if (IS_ERR(chosen_file)) { + err = PTR_ERR(chosen_file); + goto out_no_file; + } + spin_lock(&preferred_swap_lock); + spin_lock(&swap_lock); + for (type = 0; type < nr_swapfiles; type++) { + if ((swap_info[type]->flags & SWP_USED) && + (swap_info[type]->flags & SWP_WRITEOK)) { + if (swap_info[type]->swap_file->f_mapping == + chosen_file->f_mapping) { + found_swap = swap_info[type]; + break; + } + } + } + + spin_unlock(&swap_lock); + if (type >= nr_swapfiles) { + err = -EINVAL; + goto out; + } + + mm->preferred_swap = found_swap; +out: + spin_unlock(&preferred_swap_lock); + filp_close(chosen_file, NULL); +out_no_file: + path_put(&path); +out_no_path: + return err; +} + +void clear_tasks_mm_preferred_swap(struct swap_info_struct *p) +{ + struct task_struct *task; + struct mm_struct *mm; + + spin_lock(&preferred_swap_lock); + read_lock(&tasklist_lock); + for_each_process(task) { + mm = get_task_mm(task); + if (mm) { + if (mm->preferred_swap == p) + mm->preferred_swap = NULL; + mmput(mm); + } + } + read_unlock(&tasklist_lock); + spin_unlock(&preferred_swap_lock); +} +#endif static int __init swapfile_init(void) { int nid; -- 2.27.0

2 1

[PATCH openEuler-23.09 0/7] enable filescgroup and bugfix
by Lu Jialin 24 Aug '23

24 Aug '23

Binder Makin (1): cgroups: Resource controller for open files Hou Tao (1): cgroup/files: use task_get_css() to get a valid css during dup_fd() Lu Jialin (2): fs: fix files.usage bug when move tasks fs/filescontrol.c: fix warning:large integer implicitly truncated to unsigned type Yu Kuai (1): fs/filescontrol: add a switch to enable / disable accounting of open fds Zhang Xiaoxu (1): files_cgroup: fix error pointer when kvm_vm_worker_thread yangerkun (1): fs/dcache.c: avoid panic while lockref of dentry overflow fs/Makefile | 1 + fs/dcache.c | 32 +++- fs/file.c | 53 +++++- fs/filescontrol.c | 312 ++++++++++++++++++++++++++++++++++ include/linux/cgroup-defs.h | 8 +- include/linux/cgroup_subsys.h | 6 + include/linux/fdtable.h | 1 + include/linux/filescontrol.h | 34 ++++ include/linux/fs.h | 3 + init/Kconfig | 10 ++ 10 files changed, 451 insertions(+), 9 deletions(-) create mode 100644 fs/filescontrol.c create mode 100644 include/linux/filescontrol.h -- 2.34.1

2 8

[PATCH openEuler-1.0-LTS] nbd: pass nbd_sock to nbd_read_reply() instead of index
by Li Nan 24 Aug '23

24 Aug '23

hulk inclusion category: bugfix bugzilla: 189113, https://gitee.com/openeuler/kernel/issues/I7T755 CVE: NA -------------------------------- If a socket is processing ioctl 'NBD_SET_SOCK', config->socks might be krealloc in nbd_add_socket(), and a garbage request is received now, a UAF may occurs. T1 nbd_ioctl __nbd_ioctl nbd_add_socket blk_mq_freeze_queue T2 recv_work nbd_read_reply sock_xmit krealloc config->socks def config->socks Pass nbd_sock to nbd_read_reply(). And introduce a new function sock_xmit_recv(), which differs from sock_xmit only in the way it get socket. ================================================================== BUG: KASAN: use-after-free in sock_xmit+0x525/0x550 Read of size 8 at addr ffff8880188ec428 by task kworker/u12:1/18779 Workqueue: knbd4-recv recv_work Call Trace: __dump_stack dump_stack+0xbe/0xfd print_address_description.constprop.0+0x19/0x170 __kasan_report.cold+0x6c/0x84 kasan_report+0x3a/0x50 sock_xmit+0x525/0x550 nbd_read_reply+0xfe/0x2c0 recv_work+0x1c2/0x750 process_one_work+0x6b6/0xf10 worker_thread+0xdd/0xd80 kthread+0x30a/0x410 ret_from_fork+0x22/0x30 Allocated by task 18784: kasan_save_stack+0x1b/0x40 kasan_set_track set_alloc_info __kasan_kmalloc __kasan_kmalloc.constprop.0+0xf0/0x130 slab_post_alloc_hook slab_alloc_node slab_alloc __kmalloc_track_caller+0x157/0x550 __do_krealloc krealloc+0x37/0xb0 nbd_add_socket +0x2d3/0x880 __nbd_ioctl nbd_ioctl+0x584/0x8e0 __blkdev_driver_ioctl blkdev_ioctl+0x2a0/0x6e0 block_ioctl+0xee/0x130 vfs_ioctl __do_sys_ioctl __se_sys_ioctl+0x138/0x190 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x61/0xc6 Freed by task 18784: kasan_save_stack+0x1b/0x40 kasan_set_track+0x1c/0x30 kasan_set_free_info+0x20/0x40 __kasan_slab_free.part.0+0x13f/0x1b0 slab_free_hook slab_free_freelist_hook slab_free kfree+0xcb/0x6c0 krealloc+0x56/0xb0 nbd_add_socket+0x2d3/0x880 __nbd_ioctl nbd_ioctl+0x584/0x8e0 __blkdev_driver_ioctl blkdev_ioctl+0x2a0/0x6e0 block_ioctl+0xee/0x130 vfs_ioctl __do_sys_ioctl __se_sys_ioctl+0x138/0x190 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x61/0xc6 Signed-off-by: Li Nan <linan122(a)huawei.com> --- drivers/block/nbd.c | 35 ++++++++++++++++++++++------------- 1 file changed, 22 insertions(+), 13 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index fb4e9cb3d5d6..3b974988b0a9 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -62,6 +62,7 @@ struct nbd_sock { struct recv_thread_args { struct work_struct work; struct nbd_device *nbd; + struct nbd_sock *nsock; int index; }; @@ -453,15 +454,9 @@ static enum blk_eh_timer_return nbd_xmit_timeout(struct request *req, return BLK_EH_DONE; } -/* - * Send or receive packet. Return a positive value on success and - * negtive value on failue, and never return 0. - */ -static int sock_xmit(struct nbd_device *nbd, int index, int send, - struct iov_iter *iter, int msg_flags, int *sent) +static int __sock_xmit(struct nbd_device *nbd, struct socket *sock, int send, + struct iov_iter *iter, int msg_flags, int *sent) { - struct nbd_config *config = nbd->config; - struct socket *sock = config->socks[index]->sock; int result; struct msghdr msg; unsigned int noreclaim_flag; @@ -503,6 +498,19 @@ static int sock_xmit(struct nbd_device *nbd, int index, int send, return result; } +/* + * Send or receive packet. Return a positive value on success and + * negtive value on failure, and never return 0. + */ +static int sock_xmit(struct nbd_device *nbd, int index, int send, + struct iov_iter *iter, int msg_flags, int *sent) +{ + struct nbd_config *config = nbd->config; + struct socket *sock = config->socks[index]->sock; + + return __sock_xmit(nbd, sock, send, iter, msg_flags, sent); +} + /* * Different settings for sk->sk_sndtimeo can result in different return values * if there is a signal pending when we enter sendmsg, because reasons? @@ -664,7 +672,7 @@ static int nbd_send_cmd(struct nbd_device *nbd, struct nbd_cmd *cmd, int index) return 0; } -static int nbd_read_reply(struct nbd_device *nbd, int index, +static int nbd_read_reply(struct nbd_device *nbd, struct socket *sock, struct nbd_reply *reply) { struct kvec iov = {.iov_base = reply, .iov_len = sizeof(*reply)}; @@ -673,7 +681,7 @@ static int nbd_read_reply(struct nbd_device *nbd, int index, reply->magic = 0; iov_iter_kvec(&to, READ | ITER_KVEC, &iov, 1, sizeof(*reply)); - result = sock_xmit(nbd, index, 0, &to, MSG_WAITALL, NULL); + result = __sock_xmit(nbd, sock, 0, &to, MSG_WAITALL, NULL); if (result < 0) { if (!nbd_disconnected(nbd->config)) dev_err(disk_to_dev(nbd->disk), @@ -798,13 +806,13 @@ static void recv_work(struct work_struct *work) struct nbd_device *nbd = args->nbd; struct nbd_config *config = nbd->config; struct request_queue *q = nbd->disk->queue; - struct nbd_sock *nsock; + struct nbd_sock *nsock = args->nsock; struct nbd_cmd *cmd; while (1) { struct nbd_reply reply; - if (nbd_read_reply(nbd, args->index, &reply)) + if (nbd_read_reply(nbd, nsock->sock, &reply)) break; /* @@ -829,7 +837,6 @@ static void recv_work(struct work_struct *work) percpu_ref_put(&q->q_usage_counter); } - nsock = config->socks[args->index]; mutex_lock(&nsock->tx_lock); nbd_mark_nsock_dead(nbd, nsock, 1); mutex_unlock(&nsock->tx_lock); @@ -1164,6 +1171,7 @@ static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg) INIT_WORK(&args->work, recv_work); args->index = i; args->nbd = nbd; + args->nsock = nsock; nsock->cookie++; mutex_unlock(&nsock->tx_lock); sockfd_put(old); @@ -1354,6 +1362,7 @@ static int nbd_start_device(struct nbd_device *nbd) refcount_inc(&nbd->config_refs); INIT_WORK(&args->work, recv_work); args->nbd = nbd; + args->nsock = config->socks[i]; args->index = i; queue_work(nbd->recv_workq, &args->work); } -- 2.39.2

2 1

[PATCH OLK-5.10 0/4] Synchronizing mainline HiSilicon uncore PMU patches
by Junhao He 24 Aug '23

24 Aug '23

Synchronizing mainline HiSilicon uncore PMU patches The HISI uncore UC PMU and uncore H60PA/PAv3 PMU drivers have been integrated into the main line. Compared with OLK-5.10, some modifications are made. Add support for HiSilicon UC/H60PA/PAv3 PMU driver. PAv3 PMU: Compared with the PAv2 PMU, the PAv3 PMU has different event. The PAv3 PMU removed some events which are supported by PAv2 PMU. The older PA PMU driver will probe v3 as v2. Add the HISI0275 HID for PAv3 PMU to distinguish different. H60PA PMU: The H60PA PMU and PA are two different devices. The H60PA PMU supports higher bandwidth, and the PA PMU delay is relatively low. Different HIDs are used to distinguish the delay. UC PMU: Each cluster is integrated with a unified cache (UC) PMU, which provides consistency between NUMA and UMA domains. It sits between L2 and the memory system. Junhao He (4): Revert "drivers/perf: hisi: Add support for HiSilicon UC PMU driver" Revert "drivers/perf: hisi: Add support for HiSilicon H60PA and PAv3 PMU driver" drivers/perf: hisi: Add support for HiSilicon H60PA and PAv3 PMU driver drivers/perf: hisi: Add support for HiSilicon UC PMU driver drivers/perf/hisilicon/hisi_uncore_pa_pmu.c | 107 +++++++++----------- drivers/perf/hisilicon/hisi_uncore_pmu.c | 5 +- drivers/perf/hisilicon/hisi_uncore_pmu.h | 32 +----- drivers/perf/hisilicon/hisi_uncore_uc_pmu.c | 35 +++---- 4 files changed, 72 insertions(+), 107 deletions(-) -- 2.33.0

2 5

openEuler Kernel SIG 双周例会
by openEuler conference 24 Aug '23

24 Aug '23

您好！ Kernel SIG 邀请您参加 2023-08-25 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG 双周例会会议内容： 1. 进展update 2. 议题征集中（新增议题可直接回复邮件，或录入会议看板）会议链接：https://us06web.zoom.us/j/88618764013?pwd=aGc4UU9WL2FpNUxnUFphM24xZDBOZz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-08-25 14:00, The subject of the conference is openEuler Kernel SIG 双周例会, Summary: 1. 进展update 2. 议题征集中（新增议题可直接回复邮件，或录入会议看板） You can join the meeting at https://us06web.zoom.us/j/88618764013?pwd=aGc4UU9WL2FpNUxnUFphM24xZDBOZz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-23.09] ring-buffer: Fix deadloop issue on reading trace_pipe
by Zheng Yejian 23 Aug '23

23 Aug '23

mainline inclusion from mainline-v6.5-rc2 commit 7e42907f3a7b4ce3a2d1757f6d78336984daf8f5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7TKEB CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Soft lockup occurs when reading file 'trace_pipe': watchdog: BUG: soft lockup - CPU#6 stuck for 22s! [cat:4488] [...] RIP: 0010:ring_buffer_empty_cpu+0xed/0x170 RSP: 0018:ffff88810dd6fc48 EFLAGS: 00000246 RAX: 0000000000000000 RBX: 0000000000000246 RCX: ffffffff93d1aaeb RDX: ffff88810a280040 RSI: 0000000000000008 RDI: ffff88811164b218 RBP: ffff88811164b218 R08: 0000000000000000 R09: ffff88815156600f R10: ffffed102a2acc01 R11: 0000000000000001 R12: 0000000051651901 R13: 0000000000000000 R14: ffff888115e49500 R15: 0000000000000000 [...] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8d853c2000 CR3: 000000010dcd8000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __find_next_entry+0x1a8/0x4b0 ? peek_next_entry+0x250/0x250 ? down_write+0xa5/0x120 ? down_write_killable+0x130/0x130 trace_find_next_entry_inc+0x3b/0x1d0 tracing_read_pipe+0x423/0xae0 ? tracing_splice_read_pipe+0xcb0/0xcb0 vfs_read+0x16b/0x490 ksys_read+0x105/0x210 ? __ia32_sys_pwrite64+0x200/0x200 ? switch_fpu_return+0x108/0x220 do_syscall_64+0x33/0x40 entry_SYSCALL_64_after_hwframe+0x61/0xc6 Through the vmcore, I found it's because in tracing_read_pipe(), ring_buffer_empty_cpu() found some buffer is not empty but then it cannot read anything due to "rb_num_of_entries() == 0" always true, Then it infinitely loop the procedure due to user buffer not been filled, see following code path: tracing_read_pipe() { ... ... waitagain: tracing_wait_pipe() // 1. find non-empty buffer here trace_find_next_entry_inc() // 2. loop here try to find an entry __find_next_entry() ring_buffer_empty_cpu(); // 3. find non-empty buffer peek_next_entry() // 4. but peek always return NULL ring_buffer_peek() rb_buffer_peek() rb_get_reader_page() // 5. because rb_num_of_entries() == 0 always true here // then return NULL // 6. user buffer not been filled so goto 'waitgain' // and eventually leads to an deadloop in kernel!!! } By some analyzing, I found that when resetting ringbuffer, the 'entries' of its pages are not all cleared (see rb_reset_cpu()). Then when reducing the ringbuffer, and if some reduced pages exist dirty 'entries' data, they will be added into 'cpu_buffer->overrun' (see rb_remove_pages()), which cause wrong 'overrun' count and eventually cause the deadloop issue. To fix it, we need to clear every pages in rb_reset_cpu(). Link: https://lore.kernel.org/linux-trace-kernel/20230708225144.3785600-1-zhengye… Cc: stable(a)vger.kernel.org Fixes: a5fb833172eca ("ring-buffer: Fix uninitialized read_stamp") Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/trace/ring_buffer.c | 24 +++++++++++++++--------- 1 file changed, 15 insertions(+), 9 deletions(-) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 834b361a4a66..14d8001140c8 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -5242,28 +5242,34 @@ unsigned long ring_buffer_size(struct trace_buffer *buffer, int cpu) } EXPORT_SYMBOL_GPL(ring_buffer_size); +static void rb_clear_buffer_page(struct buffer_page *page) +{ + local_set(&page->write, 0); + local_set(&page->entries, 0); + rb_init_page(page->page); + page->read = 0; +} + static void rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer) { + struct buffer_page *page; + rb_head_page_deactivate(cpu_buffer); cpu_buffer->head_page = list_entry(cpu_buffer->pages, struct buffer_page, list); - local_set(&cpu_buffer->head_page->write, 0); - local_set(&cpu_buffer->head_page->entries, 0); - local_set(&cpu_buffer->head_page->page->commit, 0); - - cpu_buffer->head_page->read = 0; + rb_clear_buffer_page(cpu_buffer->head_page); + list_for_each_entry(page, cpu_buffer->pages, list) { + rb_clear_buffer_page(page); + } cpu_buffer->tail_page = cpu_buffer->head_page; cpu_buffer->commit_page = cpu_buffer->head_page; INIT_LIST_HEAD(&cpu_buffer->reader_page->list); INIT_LIST_HEAD(&cpu_buffer->new_pages); - local_set(&cpu_buffer->reader_page->write, 0); - local_set(&cpu_buffer->reader_page->entries, 0); - local_set(&cpu_buffer->reader_page->page->commit, 0); - cpu_buffer->reader_page->read = 0; + rb_clear_buffer_page(cpu_buffer->reader_page); local_set(&cpu_buffer->entries_bytes, 0); local_set(&cpu_buffer->overrun, 0); -- 2.25.1

2 1

[PATCH v6 OLK-5.10 0/5] arm64: support batched/deferred tlb shootdown during page reclamation/migration
by Jinjiang Tu 23 Aug '23

23 Aug '23

Support batched/deferred tlb shootdown during page reclamation/migration for arm64. Changelog: v6: - move kabi fix code into a separate patch. v5: - adjust tab num for macro DEFINE_TLB_UBC v4 - define macro DEFINE_TLB_UBC v3: - fix kabi breakage for task_struct->tlb_ubc v2: - fix kabi breakage for mm_struct->tlb_flush_batched Anshuman Khandual (1): mm/tlbbatch: introduce arch_tlbbatch_should_defer() Barry Song (2): mm/tlbbatch: rename and extend some functions arm64: support batched/deferred tlb shootdown during page reclamation/migration Jinjiang Tu (1): mm/tlbbatch: fix kabi change Yicong Yang (1): mm/tlbbatch: introduce arch_flush_tlb_batched_pending() .../features/vm/TLB/arch-support.txt | 2 +- arch/arm64/Kconfig | 1 + arch/arm64/include/asm/tlbbatch.h | 12 +++++ arch/arm64/include/asm/tlbflush.h | 44 +++++++++++++++++-- arch/x86/include/asm/tlbflush.h | 22 +++++++++- include/linux/mm_types.h | 4 +- include/linux/mm_types_task.h | 29 ++++++++++-- include/linux/sched.h | 3 ++ mm/rmap.c | 35 ++++++++------- 9 files changed, 126 insertions(+), 26 deletions(-) create mode 100644 arch/arm64/include/asm/tlbbatch.h -- 2.25.1

2 6

[PATCH OLK-5.10] net: bridge: multicast: notify switchdev driver whenever MC processing gets disabled
by Zhengchao Shao 23 Aug '23

23 Aug '23

From: Oleksandr Mazur <oleksandr.mazur(a)plvision.eu> mainline inclusion from mainline-v5.17-rc5 commit c832962ac972082b3a1f89775c9d4274c8cb5670 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7V9UB Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Whenever bridge driver hits the max capacity of MDBs, it disables the MC processing (by setting corresponding bridge option), but never notifies switchdev about such change (the notifiers are called only upon explicit setting of this option, through the registered netlink interface). This could lead to situation when Software MDB processing gets disabled, but this event never gets offloaded to the underlying Hardware. Fix this by adding a notify message in such case. Fixes: 147c1e9b902c ("switchdev: bridge: Offload multicast disabled") Signed-off-by: Oleksandr Mazur <oleksandr.mazur(a)plvision.eu> Acked-by: Nikolay Aleksandrov <nikolay(a)nvidia.com> Link: https://lore.kernel.org/r/20220215165303.31908-1-oleksandr.mazur@plvision.eu Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/bridge/br_multicast.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/bridge/br_multicast.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c index de79fbfe1611..e2b1bb3de4a1 100644 --- a/net/bridge/br_multicast.c +++ b/net/bridge/br_multicast.c @@ -48,6 +48,8 @@ static const struct rhashtable_params br_sg_port_rht_params = { .automatic_shrinking = true, }; +static void br_mc_disabled_update(struct net_device *dev, bool value); + static void br_multicast_start_querier(struct net_bridge *br, struct bridge_mcast_own_query *query); static void br_multicast_add_router(struct net_bridge *br, @@ -1040,6 +1042,7 @@ struct net_bridge_mdb_entry *br_multicast_new_group(struct net_bridge *br, return mp; if (atomic_read(&br->mdb_hash_tbl.nelems) >= br->hash_max) { + br_mc_disabled_update(br->dev, false); br_opt_toggle(br, BROPT_MULTICAST_ENABLED, false); return ERR_PTR(-E2BIG); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS v2] fs: jfs: fix possible NULL pointer dereference in dbFree()
by Li Nan 23 Aug '23

23 Aug '23

From: Zixuan Fu <r33s3n6(a)gmail.com> mainline inclusion from mainline-v5.19-rc1 commit 0d4837fdb796f99369cf7691d33de1b856bcaf1f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7TT9F CVE: CVE-2023-4385 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In our fault-injection testing, the variable "nblocks" in dbFree() can be zero when kmalloc_array() fails in dtSearch(). In this case, the variable "mp" in dbFree() would be NULL and then it is dereferenced in "write_metapage(mp)". The failure log is listed as follows: [ 13.824137] BUG: kernel NULL pointer dereference, address: 0000000000000020 ... [ 13.827416] RIP: 0010:dbFree+0x5f7/0x910 [jfs] [ 13.834341] Call Trace: [ 13.834540] <TASK> [ 13.834713] txFreeMap+0x7b4/0xb10 [jfs] [ 13.835038] txUpdateMap+0x311/0x650 [jfs] [ 13.835375] jfs_lazycommit+0x5f2/0xc70 [jfs] [ 13.835726] ? sched_dynamic_update+0x1b0/0x1b0 [ 13.836092] kthread+0x3c2/0x4a0 [ 13.836355] ? txLockFree+0x160/0x160 [jfs] [ 13.836763] ? kthread_unuse_mm+0x160/0x160 [ 13.837106] ret_from_fork+0x1f/0x30 [ 13.837402] </TASK> ... This patch adds a NULL check of "mp" before "write_metapage(mp)" is called. Reported-by: TOTE Robot <oslab(a)tsinghua.edu.cn> Signed-off-by: Zixuan Fu <r33s3n6(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: Li Nan <linan122(a)huawei.com> --- v1 modify the code of funtion dbAllocBottomUp(). It is wrong. Modified dbFree() now. fs/jfs/jfs_dmap.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/jfs/jfs_dmap.c b/fs/jfs/jfs_dmap.c index 49263e220dbc..a5b51c2c5e32 100644 --- a/fs/jfs/jfs_dmap.c +++ b/fs/jfs/jfs_dmap.c @@ -391,7 +391,8 @@ int dbFree(struct inode *ip, s64 blkno, s64 nblocks) } /* write the last buffer. */ - write_metapage(mp); + if (mp) + write_metapage(mp); IREAD_UNLOCK(ipbmap); -- 2.39.2

2 1