- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] arm64: Enable hardware NMI for perf events NMI
by Jinjie Ruan 29 Mar '24

29 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9CQGL -------------------------------- Like pseudo NMI, also select HAVE_PERF_EVENTS_NMI for hardware NMI, and update the comment for arch_perf_nmi_is_available(). Signed-off-by: Jinjie Ruan <ruanjinjie(a)huawei.com> --- arch/arm64/Kconfig | 2 +- arch/arm64/kernel/watchdog_hld.c | 7 ++++--- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 2651809e7f38..a873696d72b3 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -220,7 +220,7 @@ config ARM64 select HAVE_MOD_ARCH_SPECIFIC select HAVE_NMI select HAVE_PERF_EVENTS - select HAVE_PERF_EVENTS_NMI if ARM64_PSEUDO_NMI + select HAVE_PERF_EVENTS_NMI if ARM64_PSEUDO_NMI || ARM64_NMI select HAVE_PERF_REGS select HAVE_PERF_USER_STACK_DUMP select HAVE_PREEMPT_DYNAMIC_KEY diff --git a/arch/arm64/kernel/watchdog_hld.c b/arch/arm64/kernel/watchdog_hld.c index dcd25322127c..817f0b7f6f92 100644 --- a/arch/arm64/kernel/watchdog_hld.c +++ b/arch/arm64/kernel/watchdog_hld.c @@ -28,9 +28,10 @@ u64 hw_nmi_get_sample_period(int watchdog_thresh) bool __init arch_perf_nmi_is_available(void) { /* - * hardlockup_detector_perf_init() will success even if Pseudo-NMI turns off, - * however, the pmu interrupts will act like a normal interrupt instead of - * NMI and the hardlockup detector would be broken. + * hardlockup_detector_perf_init() will success even if Pseudo-NMI or + * Hardware NMI turns off. However, the pmu interrupts will act like + * a normal interrupt instead of NMI and the hardlockup detector would + * be broken. */ return arm_pmu_irq_is_nmi(); } -- 2.34.1

2 1

[PATCH OLK-6.6 v2 00/36] mm: backport fork/unmap/zap optimize
by Kefeng Wang 29 Mar '24

29 Mar '24

This is to optimize fork/unmap/zap() with PTE-mapped THP. Catalin Marinas (1): arm64: Mark the 'addr' argument to set_ptes() and __set_pte_at() as unused David Hildenbrand (24): arm/pgtable: define PFN_PTE_SHIFT nios2/pgtable: define PFN_PTE_SHIFT powerpc/pgtable: define PFN_PTE_SHIFT riscv/pgtable: define PFN_PTE_SHIFT s390/pgtable: define PFN_PTE_SHIFT sparc/pgtable: define PFN_PTE_SHIFT mm/pgtable: make pte_next_pfn() independent of set_ptes() arm/mm: use pte_next_pfn() in set_ptes() powerpc/mm: use pte_next_pfn() in set_ptes() mm/memory: factor out copying the actual PTE in copy_present_pte() mm/memory: pass PTE to copy_present_pte() mm/memory: optimize fork() with PTE-mapped THP mm/memory: ignore dirty/accessed/soft-dirty bits in folio_pte_batch() mm/memory: ignore writable bit in folio_pte_batch() mm/memory: factor out zapping of present pte into zap_present_pte() mm/memory: handle !page case in zap_present_pte() separately mm/memory: further separate anon and pagecache folio handling in zap_present_pte() mm/memory: factor out zapping folio pte into zap_present_folio_pte() mm/mmu_gather: pass "delay_rmap" instead of encoded page to __tlb_remove_page_size() mm/mmu_gather: define ENCODED_PAGE_FLAG_DELAY_RMAP mm/mmu_gather: add tlb_remove_tlb_entries() mm/mmu_gather: add __tlb_remove_folio_pages() mm/mmu_gather: improve cond_resched() handling with large folios and expensive page freeing mm/memory: optimize unmap/zap with PTE-mapped THP Kefeng Wang (7): s390: use pfn_swap_entry_folio() in ptep_zap_swap_entry() mm: use pfn_swap_entry_folio() in __split_huge_pmd_locked() mm: use pfn_swap_entry_to_folio() in zap_huge_pmd() mm: use pfn_swap_entry_folio() in copy_nonpresent_pte() mm: convert to should_zap_page() to should_zap_folio() mm: convert mm_counter() to take a folio mm: convert mm_counter_file() to take a folio Matthew Wilcox (Oracle) (2): mm: add pfn_swap_entry_folio() mprotect: use pfn_swap_entry_folio Ryan Roberts (2): arm64/mm: Hoist synchronization out of set_ptes() loop arm64/mm: make set_ptes() robust when OAs cross 48-bit boundary arch/arm/include/asm/pgtable.h | 2 + arch/arm/mm/mmu.c | 2 +- arch/arm64/include/asm/mte.h | 4 +- arch/arm64/include/asm/pgtable.h | 58 ++-- arch/arm64/kernel/mte.c | 4 +- arch/nios2/include/asm/pgtable.h | 2 + arch/powerpc/include/asm/pgtable.h | 2 + arch/powerpc/include/asm/tlb.h | 2 + arch/powerpc/mm/pgtable.c | 5 +- arch/riscv/include/asm/pgtable.h | 2 + arch/s390/include/asm/pgtable.h | 2 + arch/s390/include/asm/tlb.h | 30 +- arch/s390/mm/pgtable.c | 4 +- arch/sparc/include/asm/pgtable_64.h | 2 + include/asm-generic/tlb.h | 44 ++- include/linux/mm.h | 12 +- include/linux/mm_types.h | 37 ++- include/linux/pgtable.h | 103 ++++++- include/linux/swapops.h | 13 + kernel/events/uprobes.c | 2 +- mm/filemap.c | 2 +- mm/huge_memory.c | 23 +- mm/khugepaged.c | 4 +- mm/memory.c | 419 ++++++++++++++++++++-------- mm/mmu_gather.c | 111 ++++++-- mm/mprotect.c | 4 +- mm/rmap.c | 10 +- mm/swap.c | 12 +- mm/swap_state.c | 15 +- mm/userfaultfd.c | 2 +- 30 files changed, 716 insertions(+), 218 deletions(-) -- 2.27.0

2 37

[PATCH OLK-6.6 00/36] mm: backport fork/unmap/zap optimize
by Kefeng Wang 29 Mar '24

29 Mar '24

This is to optimize fork/unmap/zap() with PTE-mapped THP. Catalin Marinas (1): arm64: Mark the 'addr' argument to set_ptes() and __set_pte_at() as unused David Hildenbrand (24): arm/pgtable: define PFN_PTE_SHIFT nios2/pgtable: define PFN_PTE_SHIFT powerpc/pgtable: define PFN_PTE_SHIFT riscv/pgtable: define PFN_PTE_SHIFT s390/pgtable: define PFN_PTE_SHIFT sparc/pgtable: define PFN_PTE_SHIFT mm/pgtable: make pte_next_pfn() independent of set_ptes() arm/mm: use pte_next_pfn() in set_ptes() powerpc/mm: use pte_next_pfn() in set_ptes() mm/memory: factor out copying the actual PTE in copy_present_pte() mm/memory: pass PTE to copy_present_pte() mm/memory: optimize fork() with PTE-mapped THP mm/memory: ignore dirty/accessed/soft-dirty bits in folio_pte_batch() mm/memory: ignore writable bit in folio_pte_batch() mm/memory: factor out zapping of present pte into zap_present_pte() mm/memory: handle !page case in zap_present_pte() separately mm/memory: further separate anon and pagecache folio handling in zap_present_pte() mm/memory: factor out zapping folio pte into zap_present_folio_pte() mm/mmu_gather: pass "delay_rmap" instead of encoded page to __tlb_remove_page_size() mm/mmu_gather: define ENCODED_PAGE_FLAG_DELAY_RMAP mm/mmu_gather: add tlb_remove_tlb_entries() mm/mmu_gather: add __tlb_remove_folio_pages() mm/mmu_gather: improve cond_resched() handling with large folios and expensive page freeing mm/memory: optimize unmap/zap with PTE-mapped THP Kefeng Wang (7): s390: use pfn_swap_entry_folio() in ptep_zap_swap_entry() mm: use pfn_swap_entry_folio() in __split_huge_pmd_locked() mm: use pfn_swap_entry_to_folio() in zap_huge_pmd() mm: use pfn_swap_entry_folio() in copy_nonpresent_pte() mm: convert to should_zap_page() to should_zap_folio() mm: convert mm_counter() to take a folio mm: convert mm_counter_file() to take a folio Matthew Wilcox (Oracle) (2): mm: add pfn_swap_entry_folio() mprotect: use pfn_swap_entry_folio Ryan Roberts (2): arm64/mm: Hoist synchronization out of set_ptes() loop arm64/mm: make set_ptes() robust when OAs cross 48-bit boundary arch/arm/include/asm/pgtable.h | 2 + arch/arm/mm/mmu.c | 2 +- arch/arm64/include/asm/mte.h | 4 +- arch/arm64/include/asm/pgtable.h | 58 ++-- arch/arm64/kernel/mte.c | 4 +- arch/nios2/include/asm/pgtable.h | 2 + arch/powerpc/include/asm/pgtable.h | 2 + arch/powerpc/include/asm/tlb.h | 2 + arch/powerpc/mm/pgtable.c | 5 +- arch/riscv/include/asm/pgtable.h | 2 + arch/s390/include/asm/pgtable.h | 2 + arch/s390/include/asm/tlb.h | 30 +- arch/s390/mm/pgtable.c | 4 +- arch/sparc/include/asm/pgtable_64.h | 2 + include/asm-generic/tlb.h | 44 ++- include/linux/mm.h | 12 +- include/linux/mm_types.h | 37 ++- include/linux/pgtable.h | 103 ++++++- include/linux/swapops.h | 13 + kernel/events/uprobes.c | 2 +- mm/filemap.c | 2 +- mm/huge_memory.c | 23 +- mm/khugepaged.c | 4 +- mm/memory.c | 419 ++++++++++++++++++++-------- mm/mmu_gather.c | 111 ++++++-- mm/mprotect.c | 4 +- mm/rmap.c | 10 +- mm/swap.c | 12 +- mm/swap_state.c | 15 +- mm/userfaultfd.c | 2 +- 30 files changed, 716 insertions(+), 218 deletions(-) -- 2.27.0

2 37

[PATCH OLK-6.6 00/33] mm: backport fork/unmap/zap optimize
by Kefeng Wang 29 Mar '24

29 Mar '24

This is to optimize fork/unmap/zap() with PTE-mapped THP. David Hildenbrand (24): arm/pgtable: define PFN_PTE_SHIFT nios2/pgtable: define PFN_PTE_SHIFT powerpc/pgtable: define PFN_PTE_SHIFT riscv/pgtable: define PFN_PTE_SHIFT s390/pgtable: define PFN_PTE_SHIFT sparc/pgtable: define PFN_PTE_SHIFT mm/pgtable: make pte_next_pfn() independent of set_ptes() arm/mm: use pte_next_pfn() in set_ptes() powerpc/mm: use pte_next_pfn() in set_ptes() mm/memory: factor out copying the actual PTE in copy_present_pte() mm/memory: pass PTE to copy_present_pte() mm/memory: optimize fork() with PTE-mapped THP mm/memory: ignore dirty/accessed/soft-dirty bits in folio_pte_batch() mm/memory: ignore writable bit in folio_pte_batch() mm/memory: factor out zapping of present pte into zap_present_pte() mm/memory: handle !page case in zap_present_pte() separately mm/memory: further separate anon and pagecache folio handling in zap_present_pte() mm/memory: factor out zapping folio pte into zap_present_folio_pte() mm/mmu_gather: pass "delay_rmap" instead of encoded page to __tlb_remove_page_size() mm/mmu_gather: define ENCODED_PAGE_FLAG_DELAY_RMAP mm/mmu_gather: add tlb_remove_tlb_entries() mm/mmu_gather: add __tlb_remove_folio_pages() mm/mmu_gather: improve cond_resched() handling with large folios and expensive page freeing mm/memory: optimize unmap/zap with PTE-mapped THP Kefeng Wang (7): s390: use pfn_swap_entry_folio() in ptep_zap_swap_entry() mm: use pfn_swap_entry_folio() in __split_huge_pmd_locked() mm: use pfn_swap_entry_to_folio() in zap_huge_pmd() mm: use pfn_swap_entry_folio() in copy_nonpresent_pte() mm: convert to should_zap_page() to should_zap_folio() mm: convert mm_counter() to take a folio mm: convert mm_counter_file() to take a folio Matthew Wilcox (Oracle) (2): mm: add pfn_swap_entry_folio() mprotect: use pfn_swap_entry_folio arch/arm/include/asm/pgtable.h | 2 + arch/arm/mm/mmu.c | 2 +- arch/nios2/include/asm/pgtable.h | 2 + arch/powerpc/include/asm/pgtable.h | 2 + arch/powerpc/include/asm/tlb.h | 2 + arch/powerpc/mm/pgtable.c | 5 +- arch/riscv/include/asm/pgtable.h | 2 + arch/s390/include/asm/pgtable.h | 2 + arch/s390/include/asm/tlb.h | 30 +- arch/s390/mm/pgtable.c | 4 +- arch/sparc/include/asm/pgtable_64.h | 2 + include/asm-generic/tlb.h | 44 ++- include/linux/mm.h | 12 +- include/linux/mm_types.h | 37 ++- include/linux/pgtable.h | 103 ++++++- include/linux/swapops.h | 13 + kernel/events/uprobes.c | 2 +- mm/filemap.c | 2 +- mm/huge_memory.c | 23 +- mm/khugepaged.c | 4 +- mm/memory.c | 419 ++++++++++++++++++++-------- mm/mmu_gather.c | 111 ++++++-- mm/mprotect.c | 4 +- mm/rmap.c | 10 +- mm/swap.c | 12 +- mm/swap_state.c | 15 +- mm/userfaultfd.c | 2 +- 27 files changed, 676 insertions(+), 192 deletions(-) -- 2.27.0

2 34

[PATCH OLK-6.6 v2 0/6] Introduce dynamic pool feature part 2
by Liu Shixin 29 Mar '24

29 Mar '24

v1->v2: Fix compile error. This part include: 1. Compatible with memory reliable feature[1-3]. 2. Compatible with memory migration[4] 3. Fix an incorrect set of subpool[5]. 4. Make the lock in dynamic pool irq safe[6]. Liu Shixin (6): mm/dynamic_pool: Stop alloc reliable page from dynamic pool mm/mem_reliable: Treat page from dhugetlb pool as unreliable page mm/mem_reliable: Fallback to dpool if reliable memory is not enough mm/dynamic_pool: skip unexpected migration mm/dynamic_pool: don't set subpool for page from dynamic pool mm/dynamic_pool: disable irq for dynamic_pool lock include/linux/dynamic_pool.h | 6 ++ include/linux/mem_reliable.h | 3 + mm/compaction.c | 4 ++ mm/dynamic_pool.c | 112 +++++++++++++++++++---------------- mm/hugetlb.c | 3 +- mm/migrate.c | 7 +++ mm/page_alloc.c | 27 +++++++++ mm/page_isolation.c | 9 ++- 8 files changed, 118 insertions(+), 53 deletions(-) -- 2.25.1

2 7

[PATCH openEuler-1.0-LTS] btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
by Long Li 29 Mar '24

29 Mar '24

From: Omar Sandoval <osandov(a)fb.com> mainline inclusion from mainline-v6.7-rc5 commit 7081929ab2572920e94d70be3d332e5c9f97095a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV23 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the source file descriptor to the snapshot ioctl refers to a deleted subvolume, we get the following abort: BTRFS: Transaction aborted (error -2) WARNING: CPU: 0 PID: 833 at fs/btrfs/transaction.c:1875 create_pending_snapshot+0x1040/0x1190 [btrfs] Modules linked in: pata_acpi btrfs ata_piix libata scsi_mod virtio_net blake2b_generic xor net_failover virtio_rng failover scsi_common rng_core raid6_pq libcrc32c CPU: 0 PID: 833 Comm: t_snapshot_dele Not tainted 6.7.0-rc6 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 RIP: 0010:create_pending_snapshot+0x1040/0x1190 [btrfs] RSP: 0018:ffffa09c01337af8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9982053e7c78 RCX: 0000000000000027 RDX: ffff99827dc20848 RSI: 0000000000000001 RDI: ffff99827dc20840 RBP: ffffa09c01337c00 R08: 0000000000000000 R09: ffffa09c01337998 R10: 0000000000000003 R11: ffffffffb96da248 R12: fffffffffffffffe R13: ffff99820535bb28 R14: ffff99820b7bd000 R15: ffff99820381ea80 FS: 00007fe20aadabc0(0000) GS:ffff99827dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000559a120b502f CR3: 00000000055b6000 CR4: 00000000000006f0 Call Trace: <TASK> ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? __warn+0x81/0x130 ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? report_bug+0x171/0x1a0 ? handle_bug+0x3a/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? create_pending_snapshot+0x1040/0x1190 [btrfs] create_pending_snapshots+0x92/0xc0 [btrfs] btrfs_commit_transaction+0x66b/0xf40 [btrfs] btrfs_mksubvol+0x301/0x4d0 [btrfs] btrfs_mksnapshot+0x80/0xb0 [btrfs] __btrfs_ioctl_snap_create+0x1c2/0x1d0 [btrfs] btrfs_ioctl_snap_create_v2+0xc4/0x150 [btrfs] btrfs_ioctl+0x8a6/0x2650 [btrfs] ? kmem_cache_free+0x22/0x340 ? do_sys_openat2+0x97/0xe0 __x64_sys_ioctl+0x97/0xd0 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7fe20abe83af RSP: 002b:00007ffe6eff1360 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fe20abe83af RDX: 00007ffe6eff23c0 RSI: 0000000050009417 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 00007fe20ad16cd0 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe6eff13c0 R14: 00007fe20ad45000 R15: 0000559a120b6d58 </TASK> ---[ end trace 0000000000000000 ]--- BTRFS: error (device vdc: state A) in create_pending_snapshot:1875: errno=-2 No such entry BTRFS info (device vdc: state EA): forced readonly BTRFS warning (device vdc: state EA): Skipping commit of aborted transaction. BTRFS: error (device vdc: state EA) in cleanup_transaction:2055: errno=-2 No such entry This happens because create_pending_snapshot() initializes the new root item as a copy of the source root item. This includes the refs field, which is 0 for a deleted subvolume. The call to btrfs_insert_root() therefore inserts a root with refs == 0. btrfs_get_new_fs_root() then finds the root and returns -ENOENT if refs == 0, which causes create_pending_snapshot() to abort. Fix it by checking the source root's refs before attempting the snapshot, but after locking subvol_sem to avoid racing with deletion. CC: stable(a)vger.kernel.org # 4.14+ Reviewed-by: Sweet Tea Dorminy <sweettea-kernel(a)dorminy.me> Reviewed-by: Anand Jain <anand.jain(a)oracle.com> Signed-off-by: Omar Sandoval <osandov(a)fb.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflict: fs/btrfs/ioctl.c Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/ioctl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index 00424d3f3464..178e49bd0060 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -768,6 +768,9 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir, int ret; bool snapshot_force_cow = false; + if (btrfs_root_refs(&root->root_item) == 0) + return -ENOENT; + if (!test_bit(BTRFS_ROOT_REF_COWS, &root->state)) return -EINVAL; -- 2.31.1

2 1

[PATCH OLK-5.10] btrfs: don't abort filesystem when attempting to snapshot deleted subvolume
by Long Li 29 Mar '24

29 Mar '24

From: Omar Sandoval <osandov(a)fb.com> mainline inclusion from mainline-v6.7-rc5 commit 7081929ab2572920e94d70be3d332e5c9f97095a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9BV23 CVE: CVE-2024-26644 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- If the source file descriptor to the snapshot ioctl refers to a deleted subvolume, we get the following abort: BTRFS: Transaction aborted (error -2) WARNING: CPU: 0 PID: 833 at fs/btrfs/transaction.c:1875 create_pending_snapshot+0x1040/0x1190 [btrfs] Modules linked in: pata_acpi btrfs ata_piix libata scsi_mod virtio_net blake2b_generic xor net_failover virtio_rng failover scsi_common rng_core raid6_pq libcrc32c CPU: 0 PID: 833 Comm: t_snapshot_dele Not tainted 6.7.0-rc6 #2 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-1.fc39 04/01/2014 RIP: 0010:create_pending_snapshot+0x1040/0x1190 [btrfs] RSP: 0018:ffffa09c01337af8 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffff9982053e7c78 RCX: 0000000000000027 RDX: ffff99827dc20848 RSI: 0000000000000001 RDI: ffff99827dc20840 RBP: ffffa09c01337c00 R08: 0000000000000000 R09: ffffa09c01337998 R10: 0000000000000003 R11: ffffffffb96da248 R12: fffffffffffffffe R13: ffff99820535bb28 R14: ffff99820b7bd000 R15: ffff99820381ea80 FS: 00007fe20aadabc0(0000) GS:ffff99827dc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000559a120b502f CR3: 00000000055b6000 CR4: 00000000000006f0 Call Trace: <TASK> ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? __warn+0x81/0x130 ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? report_bug+0x171/0x1a0 ? handle_bug+0x3a/0x70 ? exc_invalid_op+0x17/0x70 ? asm_exc_invalid_op+0x1a/0x20 ? create_pending_snapshot+0x1040/0x1190 [btrfs] ? create_pending_snapshot+0x1040/0x1190 [btrfs] create_pending_snapshots+0x92/0xc0 [btrfs] btrfs_commit_transaction+0x66b/0xf40 [btrfs] btrfs_mksubvol+0x301/0x4d0 [btrfs] btrfs_mksnapshot+0x80/0xb0 [btrfs] __btrfs_ioctl_snap_create+0x1c2/0x1d0 [btrfs] btrfs_ioctl_snap_create_v2+0xc4/0x150 [btrfs] btrfs_ioctl+0x8a6/0x2650 [btrfs] ? kmem_cache_free+0x22/0x340 ? do_sys_openat2+0x97/0xe0 __x64_sys_ioctl+0x97/0xd0 do_syscall_64+0x46/0xf0 entry_SYSCALL_64_after_hwframe+0x6e/0x76 RIP: 0033:0x7fe20abe83af RSP: 002b:00007ffe6eff1360 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fe20abe83af RDX: 00007ffe6eff23c0 RSI: 0000000050009417 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 00007fe20ad16cd0 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe6eff13c0 R14: 00007fe20ad45000 R15: 0000559a120b6d58 </TASK> ---[ end trace 0000000000000000 ]--- BTRFS: error (device vdc: state A) in create_pending_snapshot:1875: errno=-2 No such entry BTRFS info (device vdc: state EA): forced readonly BTRFS warning (device vdc: state EA): Skipping commit of aborted transaction. BTRFS: error (device vdc: state EA) in cleanup_transaction:2055: errno=-2 No such entry This happens because create_pending_snapshot() initializes the new root item as a copy of the source root item. This includes the refs field, which is 0 for a deleted subvolume. The call to btrfs_insert_root() therefore inserts a root with refs == 0. btrfs_get_new_fs_root() then finds the root and returns -ENOENT if refs == 0, which causes create_pending_snapshot() to abort. Fix it by checking the source root's refs before attempting the snapshot, but after locking subvol_sem to avoid racing with deletion. CC: stable(a)vger.kernel.org # 4.14+ Reviewed-by: Sweet Tea Dorminy <sweettea-kernel(a)dorminy.me> Reviewed-by: Anand Jain <anand.jain(a)oracle.com> Signed-off-by: Omar Sandoval <osandov(a)fb.com> Reviewed-by: David Sterba <dsterba(a)suse.com> Signed-off-by: David Sterba <dsterba(a)suse.com> Conflict: fs/btrfs/ioctl.c Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/btrfs/ioctl.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c index 155ce045fabc..28337ebb061c 100644 --- a/fs/btrfs/ioctl.c +++ b/fs/btrfs/ioctl.c @@ -798,6 +798,9 @@ static int create_snapshot(struct btrfs_root *root, struct inode *dir, struct btrfs_trans_handle *trans; int ret; + if (btrfs_root_refs(&root->root_item) == 0) + return -ENOENT; + if (!test_bit(BTRFS_ROOT_SHAREABLE, &root->state)) return -EINVAL; -- 2.31.1

2 1

[PATCH OLK-6.6] userfaultfd: early return in dup_userfaultfd()
by Peng Zhang 29 Mar '24

29 Mar '24

From: ZhangPeng <zhangpeng362(a)huawei.com> maillist inclusion category: performance bugzilla: https://gitee.com/openeuler/kernel/issues/I9CKXN CVE: NA Reference: https://lore.kernel.org/all/20240327090835.3232629-1-zhangpeng362@huawei.co… -------------------------------- When vma->vm_userfaultfd_ctx.ctx is NULL, vma->vm_flags should have cleared __VM_UFFD_FLAGS. Therefore, there is no need to down_write or clear the flag, which will affect fork performance. Fix this by returning early if octx is NULL in dup_userfaultfd(). By applying this patch we can get a 1.3% performance improvement for lmbench fork_prot. Results are as follows: base early return Process fork+exit: 419.1106 413.4804 Link: https://lkml.kernel.org/r/20240327090835.3232629-1-zhangpeng362@huawei.com Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> Reviewed-by: Peter Xu <peterx(a)redhat.com> Cc: Axel Rasmussen <axelrasmussen(a)google.com> Cc: David Hildenbrand <david(a)redhat.com> Cc: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Liam R. Howlett <Liam.Howlett(a)oracle.com> Cc: Lokesh Gidra <lokeshgidra(a)google.com> Cc: Nanyong Sun <sunnanyong(a)huawei.com> Cc: Suren Baghdasaryan <surenb(a)google.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- fs/userfaultfd.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c index 4db4a6b8a4a3..789c8328b24a 100644 --- a/fs/userfaultfd.c +++ b/fs/userfaultfd.c @@ -707,7 +707,10 @@ int dup_userfaultfd(struct vm_area_struct *vma, struct list_head *fcs) struct userfaultfd_fork_ctx *fctx; octx = vma->vm_userfaultfd_ctx.ctx; - if (!octx || !(octx->features & UFFD_FEATURE_EVENT_FORK)) { + if (!octx) + return 0; + + if (!(octx->features & UFFD_FEATURE_EVENT_FORK)) { vma_start_write(vma); vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX; userfaultfd_set_vm_flags(vma, vma->vm_flags & ~__VM_UFFD_FLAGS); -- 2.25.1

2 1

[PATCH OLK-6.6 00/16] crypto: hisilicon - some bugfix and
by Weili Qian 29 Mar '24

29 Mar '24

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Longfang Liu (4): vfio/migration: added map length page alignment vfio/migration: bugfix some driver code vfio/migration: add eq and aeq interruption restore vfio/migration: bugfix cache write-back issue Weili Qian (12): crypto: hisilicon/qm - reset device before enabling it crypto: hisilicon/qm - modify interrupt processing resource application crypto: hisilicon/qm - disable same error report before resetting crypto: hisilicon/hpre - mask cluster timeout error crypto: hisilicon/qm - obtain the mailbox configuration at one time crypto: hisilicon/qm - fix the pf2vf timeout when global reset crypto: hisilicon/qm - mask error bit before flr crypto: hisilicon/qm - check device status before sending mailbox crypto: hisilicon/qm - hardware error does not reset during binding/unbinding crypto: hisilicon/sec2: fix memory use-after-free issue vfio/migration: remove unused local variable hisi_acc_vfio_pci: obtain the mailbox configuration at one time drivers/crypto/hisilicon/hpre/hpre_main.c | 85 ++- drivers/crypto/hisilicon/qm.c | 679 +++++++++++------- drivers/crypto/hisilicon/sec2/sec.h | 2 - drivers/crypto/hisilicon/sec2/sec_crypto.c | 49 +- drivers/crypto/hisilicon/sec2/sec_main.c | 49 +- drivers/crypto/hisilicon/zip/zip_main.c | 51 +- .../vfio/pci/hisilicon/hisi_acc_vfio_pci.c | 140 ++-- .../vfio/pci/hisilicon/hisi_acc_vfio_pci.h | 3 + include/linux/hisi_acc_qm.h | 18 +- 9 files changed, 646 insertions(+), 430 deletions(-) -- 2.33.0

2 17

[openeuler:OLK-6.6 4065/7000] drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.c:995: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst
by kernel test robot 29 Mar '24

29 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 704605877ce9913071214d2515a4c2b9077f5078 commit: dcb286ce50a35a77e51b61db72c7cc001647b598 [4065/7000] net/hinic3: add huawei/hinic3 driver config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20240329/202403290935.d2CD8fUI-lkp@…) compiler: clang version 19.0.0git (https://github.com/llvm/llvm-project 23de3862dce582ce91c1aa914467d982cb1a73b4) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240329/202403290935.d2CD8fUI-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403290935.d2CD8fUI-lkp@intel.com/ All warnings (new ones prefixed by >>): In file included from drivers/net/ethernet/huawei/hinic3/hw/hinic3_devlink.c:6: In file included from include/linux/netlink.h:7: In file included from include/linux/skbuff.h:17: In file included from include/linux/bvec.h:10: In file included from include/linux/highmem.h:8: In file included from include/linux/cacheflush.h:5: In file included from arch/arm64/include/asm/cacheflush.h:11: In file included from include/linux/kgdb.h:19: In file included from include/linux/kprobes.h:28: In file included from include/linux/ftrace.h:13: In file included from include/linux/kallsyms.h:13: In file included from include/linux/mm.h:2193: include/linux/vmstat.h:508:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 508 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 509 | item]; | ~~~~ include/linux/vmstat.h:515:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 515 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 516 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:522:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion] 522 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_" | ~~~~~~~~~~~ ^ ~~~ include/linux/vmstat.h:527:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 527 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 528 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ include/linux/vmstat.h:536:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion] 536 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~ ^ 537 | NR_VM_NUMA_EVENT_ITEMS + | ~~~~~~~~~~~~~~~~~~~~~~ >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_devlink.c:350:18: warning: variable 'pdev' set but not used [-Wunused-but-set-variable] 350 | struct pci_dev *pdev = NULL; | ^ 6 warnings generated. -- drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:445: warning: Function parameter or member 'ctxt' not described in 'wait_for_resp_polling' >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:445: warning: expecting prototype for prepare_cell(). Prototype was for wait_for_resp_polling() instead drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:459: warning: Function parameter or member 'ctxt' not described in 'wait_for_api_cmd_completion' drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:459: warning: Function parameter or member 'ack' not described in 'wait_for_api_cmd_completion' drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:459: warning: Function parameter or member 'ack_size' not described in 'wait_for_api_cmd_completion' drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:519: warning: Function parameter or member 'cmd_size' not described in 'api_cmd' drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:519: warning: Function parameter or member 'ack' not described in 'api_cmd' drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:519: warning: Function parameter or member 'ack_size' not described in 'api_cmd' drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:519: warning: Excess function parameter 'size' description in 'api_cmd' drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:580: warning: Function parameter or member 'ack' not described in 'hinic3_api_cmd_read' drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:580: warning: Function parameter or member 'ack_size' not described in 'hinic3_api_cmd_read' drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:605: warning: Function parameter or member 'cmd_chain' not described in 'api_cmd_hw_restart' drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:605: warning: Excess function parameter 'chain' description in 'api_cmd_hw_restart' >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:825: warning: expecting prototype for alloc_cmd_buf(). Prototype was for alloc_resp_buf() instead drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:1095: warning: Function parameter or member 'cmd_chain' not described in 'api_cmd_create_chain' drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:1095: warning: Excess function parameter 'chain' description in 'api_cmd_create_chain' drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:1159: warning: Function parameter or member 'hwdev' not described in 'hinic3_api_cmd_init' drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:1159: warning: Excess function parameter 'hwif' description in 'hinic3_api_cmd_init' drivers/net/ethernet/huawei/hinic3/hw/hinic3_api_cmd.c:1199: warning: Function parameter or member 'hwdev' not described in 'hinic3_api_cmd_free' -- drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.c:167: warning: Function parameter or member 'ack_type' not described in 'prepare_header' drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.c:167: warning: Function parameter or member 'cmd' not described in 'prepare_header' drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.c:246: warning: Function parameter or member 'ack_type' not described in 'send_msg_to_mgmt_sync' drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.c:765: warning: Function parameter or member 'hwdev' not described in 'hinic3_mgmt_msg_aeqe_handler' drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.c:765: warning: Excess function parameter 'handle' description in 'hinic3_mgmt_msg_aeqe_handler' >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.c:892: warning: expecting prototype for hinic_pf_to_mgmt_init(). Prototype was for hinic3_pf_to_mgmt_init() instead >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.c:947: warning: expecting prototype for hinic_pf_to_mgmt_free(). Prototype was for hinic3_pf_to_mgmt_free() instead >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.c:995: warning: This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst * api cmd write or read bypass default use poll, if want to use aeq interrupt, -- drivers/net/ethernet/huawei/hinic3/hw/hinic3_mbox.c:176: warning: Function parameter or member 'pri_handle' not described in 'hinic3_register_ppf_mbox_cb' drivers/net/ethernet/huawei/hinic3/hw/hinic3_mbox.c:203: warning: Function parameter or member 'pri_handle' not described in 'hinic3_register_pf_mbox_cb' drivers/net/ethernet/huawei/hinic3/hw/hinic3_mbox.c:230: warning: Function parameter or member 'pri_handle' not described in 'hinic3_register_vf_mbox_cb' >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_mbox.c:279: warning: expecting prototype for hinic3_unregister_ppf_mbox_cb(). Prototype was for hinic3_unregister_pf_mbox_cb() instead >> drivers/net/ethernet/huawei/hinic3/hw/hinic3_mbox.c:327: warning: expecting prototype for hinic3_unregister_ppf_mbox_cb(). Prototype was for hinic3_unregister_ppf_to_pf_mbox_cb() instead vim +995 drivers/net/ethernet/huawei/hinic3/hw/hinic3_mgmt.c 885 886 /** 887 * hinic_pf_to_mgmt_init - initialize PF to MGMT channel 888 * @hwdev: the pointer to hw device 889 * Return: 0 - success, negative - failure 890 **/ 891 int hinic3_pf_to_mgmt_init(struct hinic3_hwdev *hwdev) > 892 { 893 struct hinic3_msg_pf_to_mgmt *pf_to_mgmt; 894 void *dev = hwdev->dev_hdl; 895 int err; 896 897 pf_to_mgmt = kzalloc(sizeof(*pf_to_mgmt), GFP_KERNEL); 898 if (!pf_to_mgmt) 899 return -ENOMEM; 900 901 hwdev->pf_to_mgmt = pf_to_mgmt; 902 pf_to_mgmt->hwdev = hwdev; 903 spin_lock_init(&pf_to_mgmt->async_msg_lock); 904 spin_lock_init(&pf_to_mgmt->sync_event_lock); 905 sema_init(&pf_to_mgmt->sync_msg_lock, 1); 906 pf_to_mgmt->workq = create_singlethread_workqueue(HINIC3_MGMT_WQ_NAME); 907 if (!pf_to_mgmt->workq) { 908 sdk_err(dev, "Failed to initialize MGMT workqueue\n"); 909 err = -ENOMEM; 910 goto create_mgmt_workq_err; 911 } 912 913 err = alloc_msg_buf(pf_to_mgmt); 914 if (err) { 915 sdk_err(dev, "Failed to allocate msg buffers\n"); 916 goto alloc_msg_buf_err; 917 } 918 919 err = hinic3_api_cmd_init(hwdev, pf_to_mgmt->cmd_chain); 920 if (err) { 921 sdk_err(dev, "Failed to init the api cmd chains\n"); 922 goto api_cmd_init_err; 923 } 924 925 return 0; 926 927 api_cmd_init_err: 928 free_msg_buf(pf_to_mgmt); 929 930 alloc_msg_buf_err: 931 destroy_workqueue(pf_to_mgmt->workq); 932 933 create_mgmt_workq_err: 934 spin_lock_deinit(&pf_to_mgmt->sync_event_lock); 935 spin_lock_deinit(&pf_to_mgmt->async_msg_lock); 936 sema_deinit(&pf_to_mgmt->sync_msg_lock); 937 kfree(pf_to_mgmt); 938 939 return err; 940 } 941 942 /** 943 * hinic_pf_to_mgmt_free - free PF to MGMT channel 944 * @hwdev: the pointer to hw device 945 **/ 946 void hinic3_pf_to_mgmt_free(struct hinic3_hwdev *hwdev) > 947 { 948 struct hinic3_msg_pf_to_mgmt *pf_to_mgmt = hwdev->pf_to_mgmt; 949 950 /* destroy workqueue before free related pf_to_mgmt resources in case of 951 * illegal resource access 952 */ 953 destroy_workqueue(pf_to_mgmt->workq); 954 hinic3_api_cmd_free(hwdev, pf_to_mgmt->cmd_chain); 955 956 free_msg_buf(pf_to_mgmt); 957 spin_lock_deinit(&pf_to_mgmt->sync_event_lock); 958 spin_lock_deinit(&pf_to_mgmt->async_msg_lock); 959 sema_deinit(&pf_to_mgmt->sync_msg_lock); 960 kfree(pf_to_mgmt); 961 } 962 963 void hinic3_flush_mgmt_workq(void *hwdev) 964 { 965 struct hinic3_hwdev *dev = (struct hinic3_hwdev *)hwdev; 966 967 flush_workqueue(dev->aeqs->workq); 968 969 if (hinic3_func_type(dev) != TYPE_VF) 970 flush_workqueue(dev->pf_to_mgmt->workq); 971 } 972 973 int hinic3_api_cmd_read_ack(void *hwdev, u8 dest, const void *cmd, 974 u16 size, void *ack, u16 ack_size) 975 { 976 struct hinic3_msg_pf_to_mgmt *pf_to_mgmt = NULL; 977 struct hinic3_api_cmd_chain *chain = NULL; 978 979 if (!hwdev || !cmd || (ack_size && !ack) || size > MAX_PF_MGMT_BUF_SIZE) 980 return -EINVAL; 981 982 if (!COMM_SUPPORT_API_CHAIN((struct hinic3_hwdev *)hwdev)) 983 return -EPERM; 984 985 pf_to_mgmt = ((struct hinic3_hwdev *)hwdev)->pf_to_mgmt; 986 chain = pf_to_mgmt->cmd_chain[HINIC3_API_CMD_POLL_READ]; 987 988 if (!(((struct hinic3_hwdev *)hwdev)->chip_present_flag)) 989 return -EPERM; 990 991 return hinic3_api_cmd_read(chain, dest, cmd, size, ack, ack_size); 992 } 993 994 /** > 995 * api cmd write or read bypass default use poll, if want to use aeq interrupt, 996 * please set wb_trigger_aeqe to 1 997 **/ 998 int hinic3_api_cmd_write_nack(void *hwdev, u8 dest, const void *cmd, u16 size) 999 { 1000 struct hinic3_msg_pf_to_mgmt *pf_to_mgmt = NULL; 1001 struct hinic3_api_cmd_chain *chain = NULL; 1002 1003 if (!hwdev || !size || !cmd || size > MAX_PF_MGMT_BUF_SIZE) 1004 return -EINVAL; 1005 1006 if (!COMM_SUPPORT_API_CHAIN((struct hinic3_hwdev *)hwdev)) 1007 return -EPERM; 1008 1009 pf_to_mgmt = ((struct hinic3_hwdev *)hwdev)->pf_to_mgmt; 1010 chain = pf_to_mgmt->cmd_chain[HINIC3_API_CMD_POLL_WRITE]; 1011 1012 if (!(((struct hinic3_hwdev *)hwdev)->chip_present_flag)) 1013 return -EPERM; 1014 1015 return hinic3_api_cmd_write(chain, dest, cmd, size); 1016 } 1017 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0