- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 1/3] kexec: Add quick kexec support for kernel
by sangyan＠huawei.com 22 Feb '21

22 Feb '21

From: Sang Yan <sangyan(a)huawei.com> hulk inclusion category: feature bugzilla: 48159 CVE: N/A In normal kexec, relocating kernel may cost 5 ~ 10 seconds, to copy all segments from vmalloced memory to kernel boot memory, because of disabled mmu. We introduce quick kexec to save time of copying memory as above, just like kdump(kexec on crash), by using reserved memory "Quick Kexec". Constructing quick kimage as the same as crash kernel, then simply copy all segments of kimage to reserved memroy. We also add this support in syscall kexec_load using flags of KEXEC_QUICK. Signed-off-by: Sang Yan <sangyan(a)huawei.com> --- arch/Kconfig | 10 ++++++++++ include/linux/ioport.h | 1 + include/linux/kexec.h | 11 ++++++++++- include/uapi/linux/kexec.h | 1 + kernel/kexec.c | 10 ++++++++++ kernel/kexec_core.c | 42 +++++++++++++++++++++++++++++++++--------- 6 files changed, 65 insertions(+), 10 deletions(-) diff --git a/arch/Kconfig b/arch/Kconfig index 2592b4b..7811eee 100644 --- a/arch/Kconfig +++ b/arch/Kconfig @@ -18,6 +18,16 @@ config KEXEC_CORE select CRASH_CORE bool +config QUICK_KEXEC + bool "Support for quick kexec" + depends on KEXEC_CORE + help + It uses pre-reserved memory to accelerate kexec, just like + crash kexec, loads new kernel and initrd to reserved memory, + and boots new kernel on that memory. It will save the time + of relocating kernel. + + config KEXEC_ELF bool diff --git a/include/linux/ioport.h b/include/linux/ioport.h index 5135d4b..84a716f 100644 --- a/include/linux/ioport.h +++ b/include/linux/ioport.h @@ -139,6 +139,7 @@ enum { IORES_DESC_DEVICE_PRIVATE_MEMORY = 6, IORES_DESC_RESERVED = 7, IORES_DESC_SOFT_RESERVED = 8, + IORES_DESC_QUICK_KEXEC = 9, }; /* diff --git a/include/linux/kexec.h b/include/linux/kexec.h index f301f2f..7fff410 100644 --- a/include/linux/kexec.h +++ b/include/linux/kexec.h @@ -269,9 +269,10 @@ struct kimage { unsigned long control_page; /* Flags to indicate special processing */ - unsigned int type : 1; + unsigned int type : 2; #define KEXEC_TYPE_DEFAULT 0 #define KEXEC_TYPE_CRASH 1 +#define KEXEC_TYPE_QUICK 2 unsigned int preserve_context : 1; /* If set, we are using file mode kexec syscall */ unsigned int file_mode:1; @@ -331,6 +332,11 @@ extern int kexec_load_disabled; #define KEXEC_FLAGS (KEXEC_ON_CRASH | KEXEC_PRESERVE_CONTEXT) #endif +#ifdef CONFIG_QUICK_KEXEC +#undef KEXEC_FLAGS +#define KEXEC_FLAGS (KEXEC_ON_CRASH | KEXEC_QUICK) +#endif + /* List of defined/legal kexec file flags */ #define KEXEC_FILE_FLAGS (KEXEC_FILE_UNLOAD | KEXEC_FILE_ON_CRASH | \ KEXEC_FILE_NO_INITRAMFS) @@ -338,6 +344,9 @@ extern int kexec_load_disabled; /* Location of a reserved region to hold the crash kernel. */ extern note_buf_t __percpu *crash_notes; +#ifdef CONFIG_QUICK_KEXEC +extern struct resource quick_kexec_res; +#endif /* flag to track if kexec reboot is in progress */ extern bool kexec_in_progress; diff --git a/include/uapi/linux/kexec.h b/include/uapi/linux/kexec.h index 05669c8..d891d80 100644 --- a/include/uapi/linux/kexec.h +++ b/include/uapi/linux/kexec.h @@ -12,6 +12,7 @@ /* kexec flags for different usage scenarios */ #define KEXEC_ON_CRASH 0x00000001 #define KEXEC_PRESERVE_CONTEXT 0x00000002 +#define KEXEC_QUICK 0x00000004 #define KEXEC_ARCH_MASK 0xffff0000 /* diff --git a/kernel/kexec.c b/kernel/kexec.c index c82c6c0..4acc909 100644 --- a/kernel/kexec.c +++ b/kernel/kexec.c @@ -44,6 +44,9 @@ static int kimage_alloc_init(struct kimage **rimage, unsigned long entry, int ret; struct kimage *image; bool kexec_on_panic = flags & KEXEC_ON_CRASH; +#ifdef CONFIG_QUICK_KEXEC + bool kexec_on_quick = flags & KEXEC_QUICK; +#endif if (kexec_on_panic) { /* Verify we have a valid entry point */ @@ -69,6 +72,13 @@ static int kimage_alloc_init(struct kimage **rimage, unsigned long entry, image->type = KEXEC_TYPE_CRASH; } +#ifdef CONFIG_QUICK_KEXEC + if (kexec_on_quick) { + image->control_page = quick_kexec_res.start; + image->type = KEXEC_TYPE_QUICK; + } +#endif + ret = sanity_check_segment_list(image); if (ret) goto out_free_image; diff --git a/kernel/kexec_core.c b/kernel/kexec_core.c index 2ca8875..c7e2aa2 100644 --- a/kernel/kexec_core.c +++ b/kernel/kexec_core.c @@ -53,6 +53,17 @@ note_buf_t __percpu *crash_notes; /* Flag to indicate we are going to kexec a new kernel */ bool kexec_in_progress = false; +/* Resource for quick kexec */ +#ifdef CONFIG_QUICK_KEXEC +struct resource quick_kexec_res = { + .name = "Quick kexec", + .start = 0, + .end = 0, + .flags = IORESOURCE_BUSY | IORESOURCE_SYSTEM_RAM, + .desc = IORES_DESC_QUICK_KEXEC +}; +#endif + int kexec_should_crash(struct task_struct *p) { /* @@ -396,8 +407,9 @@ static struct page *kimage_alloc_normal_control_pages(struct kimage *image, return pages; } -static struct page *kimage_alloc_crash_control_pages(struct kimage *image, - unsigned int order) +static struct page *kimage_alloc_special_control_pages(struct kimage *image, + unsigned int order, + unsigned long end) { /* Control pages are special, they are the intermediaries * that are needed while we copy the rest of the pages @@ -427,7 +439,7 @@ static struct page *kimage_alloc_crash_control_pages(struct kimage *image, size = (1 << order) << PAGE_SHIFT; hole_start = (image->control_page + (size - 1)) & ~(size - 1); hole_end = hole_start + size - 1; - while (hole_end <= crashk_res.end) { + while (hole_end <= end) { unsigned long i; cond_resched(); @@ -462,7 +474,6 @@ static struct page *kimage_alloc_crash_control_pages(struct kimage *image, return pages; } - struct page *kimage_alloc_control_pages(struct kimage *image, unsigned int order) { @@ -473,8 +484,15 @@ struct page *kimage_alloc_control_pages(struct kimage *image, pages = kimage_alloc_normal_control_pages(image, order); break; case KEXEC_TYPE_CRASH: - pages = kimage_alloc_crash_control_pages(image, order); + pages = kimage_alloc_special_control_pages(image, order, + crashk_res.end); + break; +#ifdef CONFIG_QUICK_KEXEC + case KEXEC_TYPE_QUICK: + pages = kimage_alloc_special_control_pages(image, order, + quick_kexec_res.end); break; +#endif } return pages; @@ -830,11 +848,12 @@ static int kimage_load_normal_segment(struct kimage *image, return result; } -static int kimage_load_crash_segment(struct kimage *image, +static int kimage_load_special_segment(struct kimage *image, struct kexec_segment *segment) { - /* For crash dumps kernels we simply copy the data from - * user space to it's destination. + /* + * For crash dumps kernels and quick kexec kernels + * we simply copy the data from user space to it's destination. * We do things a page at a time for the sake of kmap. */ unsigned long maddr; @@ -908,8 +927,13 @@ int kimage_load_segment(struct kimage *image, result = kimage_load_normal_segment(image, segment); break; case KEXEC_TYPE_CRASH: - result = kimage_load_crash_segment(image, segment); + result = kimage_load_special_segment(image, segment); break; +#ifdef CONFIG_QUICK_KEXEC + case KEXEC_TYPE_QUICK: + result = kimage_load_special_segment(image, segment); + break; +#endif } return result; -- 2.9.5

2 3

[PATCH openEuler-1.0-LTS 000/316] bugfix for 20.03
by Cheng Jian 22 Feb '21

22 Feb '21

bugfix for 20.03 @ 2021/02/22 Aichun Li (7): netpoll: remove dev argument from netpoll_send_skb_on_dev() netpoll: move netpoll_send_skb() out of line netpoll: netpoll_send_skb() returns transmit status netpoll: accept NULL np argument in netpoll_send_skb() bonding: add an option to specify a delay between peer notifications bonding: fix value exported by Netlink for peer_notif_delay bonding: add documentation for peer_notif_delay Akilesh Kailash (1): dm snapshot: flush merged data before committing metadata Al Viro (2): don't dump the threads that had been already exiting when zapped. dump_common_audit_data(): fix racy accesses to ->d_name Aleksandr Nogikh (1): netem: fix zero division in tabledist Alexander Duyck (1): tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control Alexander Lobakin (1): skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too Alexey Dobriyan (2): proc: change ->nlink under proc_subdir_lock proc: fix lookup in /proc/net subdirectories after setns(2) Alexey Kardashevskiy (1): serial_core: Check for port state when tty is in error state Amit Cohen (1): mlxsw: core: Fix use-after-free in mlxsw_emad_trans_finish() Andy Shevchenko (2): device property: Keep secondary firmware node secondary by type device property: Don't clear secondary pointer for shared primary firmware node Antoine Tenart (6): netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal net: ip6_gre: set dev->hard_header_len when using header_ops net-sysfs: take the rtnl lock when storing xps_cpus net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc net-sysfs: take the rtnl lock when storing xps_rxqs net-sysfs: take the rtnl lock when accessing xps_rxqs_map and num_tc Ard Biesheuvel (3): efivarfs: revert "fix memory leak in efivarfs_create()" arm64, mm, efi: Account for GICv3 LPI tables in static memblock reserve table efi/arm: Revert "Defer persistent reservations until after paging_init()" Arjun Roy (1): tcp: Prevent low rmem stalls with SO_RCVLOWAT. Arnaldo Carvalho de Melo (1): perf scripting python: Avoid declaring function pointers with a visibility attribute Axel Lin (1): ASoC: msm8916-wcd-digital: Select REGMAP_MMIO to fix build error Aya Levin (1): net: ipv6: Validate GSO SKB before finish IPv6 processing Bart Van Assche (1): scsi: scsi_transport_spi: Set RQF_PM for domain validation commands Bharat Gooty (1): PCI: iproc: Fix out-of-bound array accesses Bixuan Cui (2): mmap: fix a compiling error for 'MAP_CHECKNODE' powerpc: fix a compiling error for 'access_ok' Bjorn Helgaas (1): PCI: Bounds-check command-line resource alignment requests Björn Töpel (1): ixgbe: avoid premature Rx buffer reuse Boqun Feng (1): fcntl: Fix potential deadlock in send_sig{io, urg}() Boris Protopopov (1): Convert trailing spaces and periods in path components Brian Foster (1): xfs: flush new eof page on truncate to avoid post-eof corruption Calum Mackay (1): lockd: don't use interval-based rebinding over TCP Chen Zhou (1): selinux: Fix error return code in sel_ib_pkey_sid_slow() Chenguangli (1): scsi/hifc:Fix the bug that the system may be oops during unintall hifc module. Cheng Lin (1): nfs_common: need lock during iterate through the list Christoph Hellwig (2): nbd: fix a block_device refcount leak in nbd_release xfs: fix a missing unlock on error in xfs_fs_map_blocks Chunguang Xu (1): ext4: fix a memory leak of ext4_free_data Chunyan Zhang (1): tick/common: Touch watchdog in tick_unfreeze() on all CPUs Colin Ian King (1): PCI: Fix overflow in command-line resource alignment requests Cong Wang (1): erspan: fix version 1 check in gre_parse_header() Damien Le Moal (1): null_blk: Fix zone size initialization Dan Carpenter (1): futex: Don't enable IRQs unconditionally in put_pi_state() Daniel Scally (1): Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks" Darrick J. Wong (12): xfs: fix realtime bitmap/summary file truncation when growing rt volume xfs: don't free rt blocks when we're doing a REMAP bunmapi call xfs: set xefi_discard when creating a deferred agfl free log intent item xfs: fix scrub flagging rtinherit even if there is no rt device xfs: fix flags argument to rmap lookup when converting shared file rmaps xfs: set the unwritten bit in rmap lookup flags in xchk_bmap_get_rmapextents xfs: fix rmap key and record comparison functions xfs: fix brainos in the refcount scrubber's rmap fragment processor vfs: remove lockdep bogosity in __sb_start_write xfs: fix the minrecs logic when dealing with inode root child blocks xfs: strengthen rmap record flags checking xfs: revert "xfs: fix rmap key and record comparison functions" Dave Wysochanski (1): NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock Dexuan Cui (1): ACPI: scan: Harden acpi_device_add() against device ID overflows Dinghao Liu (4): ext4: fix error handling code in add_new_gdb net/mlx5e: Fix memleak in mlx5e_create_l2_table_groups net/mlx5e: Fix two double free cases netfilter: nf_nat: Fix memleak in nf_nat_init Dongdong Wang (1): lwt: Disable BH too in run_lwt_bpf() Dongli Zhang (1): page_frag: Recover from memory pressure Douglas Gilbert (1): sgl_alloc_order: fix memory leak Eddy Wu (1): fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent Eran Ben Elisha (1): net/mlx5: Fix wrong address reclaim when command interface is down Eric Auger (1): vfio/pci: Move dummy_resources_list init in vfio_pci_probe() Eric Biggers (1): ext4: fix leaking sysfs kobject after failed mount Eric Dumazet (4): tcp: select sane initial rcvq_space.space for big MSS net: avoid 32 x truesize under-estimation for tiny skbs net_sched: avoid shift-out-of-bounds in tcindex_set_parms() net_sched: reject silly cell_log in qdisc_get_rtab() Fang Lijun (3): arm64/ascend: mm: Add MAP_CHECKNODE flag to check node hugetlb arm64/ascend: mm: Fix arm32 compile warnings arm64/ascend: mm: Fix hugetlb check node error Fangrui Song (1): arm64: Change .weak to SYM_FUNC_START_WEAK_PI for arch/arm64/lib/mem*.S Florian Fainelli (1): net: Have netpoll bring-up DSA management interface Florian Westphal (4): netfilter: nf_tables: avoid false-postive lockdep splat netfilter: xt_RATEEST: reject non-null terminated string from userspace net: ip: always refragment ip defragmented packets net: fix pmtu check in nopmtudisc mode Gabriel Krisman Bertazi (2): blk-cgroup: Fix memleak on error path blk-cgroup: Pre-allocate tree node on blkg_conf_prep George Spelvin (1): random32: make prandom_u32() output unpredictable Gerald Schaefer (1): mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() Guillaume Nault (4): ipv4: Fix tos mask in inet_rtm_getroute() ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst() netfilter: rpfilter: mask ecn bits before fib lookup udp: mask TOS bits in udp_v4_early_demux() Hanjun Guo (1): clocksource/drivers/arch_timer: Fix vdso_fix compile error for arm32 Hannes Reinecke (1): dm: avoid filesystem lookup in dm_get_dev_t() Hans de Goede (1): ACPI: scan: Make acpi_bus_get_device() clear return pointer on error Heiner Kallweit (1): net: bridge: add missing counters to ndo_get_stats64 callback Hoang Le (1): tipc: fix NULL deref in tipc_link_xmit() Huang Shijie (1): lib/genalloc: fix the overflow when size is too big Huang Ying (1): mm: fix a race during THP splitting Hugh Dickins (2): mlock: fix unevictable_pgs event counts on THP mm: fix check_move_unevictable_pages() on THP Hui Wang (1): ACPI: PNP: compare the string length in the matching_id() Hyeongseok Kim (1): dm verity: skip verity work if I/O error when system is shutting down Ido Schimmel (2): mlxsw: core: Fix memory leak on module removal mlxsw: core: Use variable timeout for EMAD retries Ilya Dryomov (1): libceph: clear con->out_msg on Policy::stateful_server faults Jakub Kicinski (1): net: vlan: avoid leaks on register_vlan_dev() failures Jamie Iles (1): bonding: wait for sysfs kobject destruction before freeing struct slave Jan Kara (8): ext4: Detect already used quota file early ext4: fix bogus warning in ext4_update_dx_flag() ext4: Protect superblock modifications with a buffer lock ext4: fix deadlock with fs freezing and EA inodes ext4: don't remount read-only with errors=continue on reboot quota: Don't overflow quota file offsets bfq: Fix computation of shallow depth ext4: fix superblock checksum failure when setting password salt Jann Horn (1): mm, slub: consider rest of partial list if acquire_slab() fails Jason A. Donenfeld (3): netfilter: use actual socket sk rather than skb sk when routing harder net: introduce skb_list_walk_safe for skb segment walking net: skbuff: disambiguate argument and member for skb_list_walk_safe helper Jeff Dike (1): virtio_net: Fix recursive call to cpus_read_lock() Jens Axboe (1): proc: don't allow async path resolution of /proc/self components Jesper Dangaard Brouer (1): netfilter: conntrack: fix reading nf_conntrack_buckets Jessica Yu (1): module: delay kobject uevent until after module init call Jiri Olsa (2): perf python scripting: Fix printable strings in python3 scripts perf tools: Add missing swap for ino_generation Johannes Thumshirn (1): block: factor out requeue handling from dispatch code Jonathan Cameron (1): ACPI: Add out of bounds and numa_off protections to pxm_to_node() Joseph Qi (1): ext4: unlock xattr_sem properly in ext4_inline_data_truncate() Jubin Zhong (1): PCI: Fix pci_slot_release() NULL pointer dereference Kaixu Xia (1): ext4: correctly report "not supported" for {usr, grp}jquota when !CONFIG_QUOTA Keqian Zhu (1): clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI Kirill Tkhai (1): mm: move nr_deactivate accounting to shrink_active_list() Lang Dai (1): uio: free uio id after uio file node is freed Lecopzer Chen (2): kasan: fix unaligned address is unhandled in kasan_remove_zero_shadow kasan: fix incorrect arguments passing in kasan_add_zero_shadow Lee Duncan (1): scsi: libiscsi: Fix NOP race condition Lee Jones (1): Fonts: Replace discarded const qualifier Leo Yan (1): perf lock: Don't free "lock_seq_stat" if read_count isn't zero Leon Romanovsky (1): net/mlx5: Properly convey driver version to firmware Lijie (1): config: enable CONFIG_NVME_MULTIPATH by default Liu Shixin (3): config: set default value of CONFIG_TEST_FREE_PAGES mm: memcontrol: add struct mem_cgroup_extension mm: fix kabi broken Lorenzo Pieralisi (1): asm-generic/io.h: Fix !CONFIG_GENERIC_IOMAP pci_iounmap() implementation Lu Jialin (1): fs: fix files.usage bug when move tasks Luc Van Oostenryck (1): xsk: Fix xsk_poll()'s return type Luo Meng (2): ext4: fix invalid inode checksum fail_function: Remove a redundant mutex unlock Mao Wenan (1): net: Update window_clamp if SOCK_RCVBUF is set Marc Zyngier (2): arm64: Run ARCH_WORKAROUND_1 enabling code on all CPUs genirq/irqdomain: Don't try to free an interrupt that has no mapping Mark Rutland (3): arm64: syscall: exit userspace before unmasking exceptions arm64: module: rework special section handling arm64: module/ftrace: intialize PLT at load time Martin Wilck (1): scsi: core: Fix VPD LUN ID designator priorities Mateusz Nosek (1): futex: Fix incorrect should_fail_futex() handling Matteo Croce (4): Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint" reboot: fix overflow parsing reboot cpu number ipv6: create multicast route with RTPROT_KERNEL ipv6: set multicast flag on the multicast route Matthew Wilcox (Oracle) (1): mm/page_alloc.c: fix freeing non-compound pages Maurizio Lombardi (2): scsi: target: remove boilerplate code scsi: target: fix hang when multiple threads try to destroy the same iscsi session Maxim Mikityanskiy (1): net/tls: Protect from calling tls_dev_del for TLS RX twice Miaohe Lin (1): mm/hugetlb: fix potential missing huge page size info Michael Schaller (1): efivarfs: Replace invalid slashes with exclamation marks in dentries. Mike Christie (1): scsi: target: iscsi: Fix cmd abort fabric stop race Mike Galbraith (1): futex: Handle transient "ownerless" rtmutex state correctly Miklos Szeredi (1): fuse: fix page dereference after free Mikulas Patocka (3): dm integrity: fix the maximum number of arguments dm integrity: fix flush with external metadata device dm integrity: fix a crash if "recalculate" used without "internal_hash" Ming Lei (2): scsi: core: Don't start concurrent async scan on same host block: fix use-after-free in disk_part_iter_next Minwoo Im (1): nvme: free sq/cq dbbuf pointers when dbbuf set fails Miroslav Benes (1): module: set MODULE_STATE_GOING state when a module fails to load Moshe Shemesh (2): net/mlx4_en: Avoid scheduling restart task if it is already running net/mlx4_en: Handle TX error CQE Naoya Horiguchi (1): mm, hwpoison: double-check page count in __get_any_page() Naveen N. Rao (1): ftrace: Fix updating FTRACE_FL_TRAMP Neal Cardwell (1): tcp: fix cwnd-limited bug for TSO deferral where we send nothing NeilBrown (1): NFS: switch nfsiod to be an UNBOUND workqueue. Nicholas Piggin (1): mm: fix exec activate_mm vs TLB shootdown and lazy tlb switching race Oleg Nesterov (1): ptrace: fix task_join_group_stop() for the case when current is traced Oliver Herms (1): IPv6: Set SIT tunnel hard_header_len to zero Paul Moore (1): selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling Paulo Alcantara (1): cifs: fix potential use-after-free in cifs_echo_request() Peng Liu (1): sched/deadline: Fix sched_dl_global_validate() Peter Zijlstra (2): serial: pl011: Fix lockdep splat when handling magic-sysrq interrupt perf: Fix get_recursion_context() Petr Malat (1): sctp: Fix COMM_LOST/CANT_STR_ASSOC err reporting on big-endian platforms Qian Cai (1): mm/swapfile: do not sleep with a spin lock held Qiujun Huang (2): ring-buffer: Return 0 on success from ring_buffer_resize() tracing: Fix out of bounds write in get_trace_buf Rafael J. Wysocki (1): driver core: Extend device_is_dependent() Randy Dunlap (1): net: sched: prevent invalid Scell_log shift count Ritika Srivastava (2): block: Return blk_status_t instead of errno codes block: better deal with the delayed not supported case in blk_cloned_rq_check_limits Ronnie Sahlberg (1): cifs: handle -EINTR in cifs_setattr Ryan Sharpelletti (1): tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate Sami Tolvanen (1): arm64: lse: fix LSE atomics with LLVM's integrated assembler Sean Tranchetti (1): net: ipv6: fib: flush exceptions when purging route Shakeel Butt (2): mm: swap: fix vmstats for huge pages mm: swap: memcg: fix memcg stats for huge pages Shijie Luo (1): mm: mempolicy: fix potential pte_unmap_unlock pte error Shin'ichiro Kawasaki (1): uio: Fix use-after-free in uio_unregister_device() Stefano Brivio (1): netfilter: ipset: Update byte and packet counters regardless of whether they match Steven Rostedt (VMware) (4): ring-buffer: Fix recursion protection transitions between interrupt context ftrace: Fix recursion check for NMI test ftrace: Handle tracing when switching between context tracing: Fix userstacktrace option for instances Subash Abhinov Kasiviswanathan (2): netfilter: x_tables: Switch synchronization to RCU netfilter: x_tables: Update remaining dereference to RCU Sven Eckelmann (2): vxlan: Add needed_headroom for lower device vxlan: Copy needed_tailroom from lowerdev Sylwester Dziedziuch (2): i40e: Fix removing driver while bare-metal VFs pass traffic i40e: Fix Error I40E_AQ_RC_EINVAL when removing VFs Takashi Iwai (1): libata: transport: Use scnprintf() for avoiding potential buffer overflow Tariq Toukan (1): net: Disable NETIF_F_HW_TLS_RX when RXCSUM is disabled Thomas Gleixner (12): sched: Reenable interrupts in do_sched_yield() futex: Move futex exit handling into futex code futex: Replace PF_EXITPIDONE with a state exit/exec: Seperate mm_release() futex: Split futex_mm_release() for exit/exec futex: Set task::futex_state to DEAD right after handling futex exit futex: Mark the begin of futex exit explicitly futex: Sanitize exit state handling futex: Provide state handling for exec() as well futex: Add mutex around futex exit futex: Provide distinct return value when owner is exiting futex: Prevent exit livelock Tianyue Ren (1): selinux: fix error initialization in inode_doinit_with_dentry() Trond Myklebust (5): SUNRPC: xprt_load_transport() needs to support the netid "rdma6" NFSv4: Fix a pNFS layout related use-after-free race when freeing the inode pNFS: Mark layout for return if return-on-close was not sent NFS/pNFS: Fix a leak of the layout 'plh_outstanding' counter NFS: nfs_igrab_and_active must first reference the superblock Tung Nguyen (1): tipc: fix memory leak caused by tipc_buf_append() Tyler Hicks (1): tpm: efi: Don't create binary_bios_measurements file for an empty log Uwe Kleine-König (1): spi: fix resource leak for drivers without .remove callback Vadim Fedorenko (1): net/tls: missing received data after fast remote close Valentin Schneider (1): arm64: topology: Stop using MPIDR for topology information Vamshi K Sthambamkadi (1): efivarfs: fix memory leak in efivarfs_create() Vasily Averin (2): netfilter: ipset: fix shift-out-of-bounds in htable_bits() net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of trimmed packet Vincenzo Frascino (1): arm64: lse: Fix LSE atomics with LLVM Vladyslav Tarasiuk (1): net/mlx5: Disable QoS when min_rates on all VFs are zero Wang Hai (4): devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() tipc: fix memory leak in tipc_topsrv_start() ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init Wang Wensheng (1): sbsa_gwdt: Add WDIOF_PRETIMEOUT flag to watchdog_info at defination Wei Li (1): irqchip/gic-v3: Fix compiling error on ARM32 with GICv3 Wei Yang (1): mm: thp: don't need care deferred split queue in memcg charge move path Weilong Chen (1): hugetlbfs: Add dependency with ascend memory features Wengang Wang (1): ocfs2: initialize ip_next_orphan Will Deacon (3): arm64: psci: Avoid printing in cpu_psci_cpu_die() arm64: pgtable: Fix pte_accessible() arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect() Willem de Bruijn (1): sock: set sk_err to ee_errno on dequeue from errq Wu Bo (1): scsi: libiscsi: fix task hung when iscsid deamon exited Xie XiuQi (1): cputime: fix undefined reference to get_idle_time when CONFIG_PROC_FS disabled Xin Long (1): sctp: change to hold/put transport for proto_unreach_timer Xiongfeng Wang (1): arm64: fix compile error when CONFIG_HOTPLUG_CPU is disabled Xiubo Li (1): nbd: make the config put is called before the notifying the waiter Xu Qiang (4): NMI: Enable arm-pmu interrupt as NMI in Acensed. irqchip/gic-v3-its: Unconditionally save/restore the ITS state on suspend. irqchip/irq-gic-v3: Add workaround bindings in device tree to init ts core GICR. Document: In the binding document, add enable-init-all-GICR field description. Yang Shi (6): mm: list_lru: set shrinker map bit when child nr_items is not zero mm: thp: extract split_queue_* into a struct mm: move mem_cgroup_uncharge out of __page_cache_release() mm: shrinker: make shrinker not depend on memcg kmem mm: thp: make deferred split shrinker memcg aware mm: vmscan: protect shrinker idr replace with CONFIG_MEMCG Yang Yingliang (5): arm64: arch_timer: only do cntvct workaround on VDSO path on D05 armv7 fix compile error Kconfig: disable KTASK by default futex: sched: fix kabi broken in task_struct futex: sched: fix UAF when free futex_exit_mutex in free_task() Yi-Hung Wei (1): ip_tunnels: Set tunnel option flag when tunnel metadata is present Yicong Yang (1): libfs: fix error cast of negative value in simple_attr_write() Yu Kuai (2): blk-cgroup: prevent rcu_sched detected stalls warnings in blkg_destroy_all() blk-throttle: don't check whether or not lower limit is valid if CONFIG_BLK_DEV_THROTTLING_LOW is off Yufen Yu (2): bdi: fix compiler error in bdi_get_dev_name() scsi: do quiesce for enclosure driver Yunfeng Ye (1): workqueue: Kick a worker based on the actual activation of delayed works Yunjian Wang (2): net: hns: fix return value check in __lb_other_process() vhost_net: fix ubuf refcount incorrectly when sendmsg fails Yunsheng Lin (1): net: sch_generic: fix the missing new qdisc assignment bug Zeng Tao (1): time: Prevent undefined behaviour in timespec64_to_ns() Zhang Changzhong (2): ah6: fix error return code in ah6_input() net: bridge: vlan: fix error return code in __vlan_add() Zhao Heming (2): md/cluster: block reshape with remote resync job md/cluster: fix deadlock when node is doing resync job Zhengyuan Liu (3): arm64/mm: return cpu_all_mask when node is NUMA_NO_NODE hifc: remove unnecessary __init specifier mmap: fix a compiling error for 'MAP_PA32BIT' Zhou Guanghui (2): memcg/ascend: Check sysctl oom config for memcg oom memcg/ascend: enable kmem cgroup by default for ascend Zqiang (1): kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled chenmaodong (1): fix virtio_gpu use-after-free while creating dumb j.nixdorf(a)avm.de (1): net: sunrpc: interpret the return value of kstrtou32 correctly lijinlin (1): ext4: add ext3 report error to userspace by netlink miaoyubo (1): KVM: Enable PUD huge mappings only on 1620 yangerkun (1): ext4: fix bug for rename with RENAME_WHITEOUT zhuoliang zhang (1): net: xfrm: fix a race condition during allocing spi .../interrupt-controller/arm,gic-v3.txt | 4 + Documentation/networking/bonding.txt | 16 +- arch/Kconfig | 7 + arch/alpha/include/uapi/asm/mman.h | 2 + arch/arm/kernel/perf_event_v7.c | 16 +- arch/arm64/Kconfig | 2 + arch/arm64/configs/euleros_defconfig | 1 + arch/arm64/configs/hulk_defconfig | 1 + arch/arm64/configs/openeuler_defconfig | 3 +- arch/arm64/include/asm/atomic_lse.h | 76 ++- arch/arm64/include/asm/cpufeature.h | 4 + arch/arm64/include/asm/lse.h | 6 +- arch/arm64/include/asm/memory.h | 11 + arch/arm64/include/asm/numa.h | 3 + arch/arm64/include/asm/pgtable.h | 34 +- arch/arm64/kernel/cpu_errata.c | 8 + arch/arm64/kernel/cpufeature.c | 2 +- arch/arm64/kernel/ftrace.c | 50 +- arch/arm64/kernel/module.c | 47 +- arch/arm64/kernel/psci.c | 5 +- arch/arm64/kernel/setup.c | 5 +- arch/arm64/kernel/syscall.c | 2 +- arch/arm64/kernel/topology.c | 43 +- arch/arm64/lib/memcpy.S | 3 +- arch/arm64/lib/memmove.S | 3 +- arch/arm64/lib/memset.S | 3 +- arch/arm64/mm/init.c | 17 +- arch/arm64/mm/numa.c | 6 +- arch/mips/include/uapi/asm/mman.h | 2 + arch/parisc/include/uapi/asm/mman.h | 2 + arch/powerpc/include/asm/uaccess.h | 4 +- arch/powerpc/include/uapi/asm/mman.h | 2 + arch/sparc/include/uapi/asm/mman.h | 2 + arch/x86/configs/hulk_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + arch/xtensa/include/uapi/asm/mman.h | 2 + block/bfq-iosched.c | 8 +- block/blk-cgroup.c | 30 +- block/blk-core.c | 39 +- block/blk-mq.c | 29 +- block/blk-throttle.c | 6 + block/genhd.c | 9 +- drivers/acpi/acpi_pnp.c | 3 + drivers/acpi/internal.h | 2 +- drivers/acpi/numa.c | 2 +- drivers/acpi/resource.c | 2 +- drivers/acpi/scan.c | 17 +- drivers/ata/libata-transport.c | 10 +- drivers/base/core.c | 21 +- drivers/block/nbd.c | 3 +- drivers/block/null_blk_zoned.c | 20 +- drivers/char/Kconfig | 2 +- drivers/char/random.c | 1 - drivers/char/tpm/eventlog/efi.c | 5 + drivers/clocksource/arm_arch_timer.c | 36 +- drivers/firmware/efi/efi.c | 4 - drivers/firmware/efi/libstub/arm-stub.c | 3 - drivers/gpu/drm/virtio/virtgpu_gem.c | 4 +- drivers/irqchip/irq-gic-v3-its.c | 30 +- drivers/irqchip/irq-gic-v3.c | 18 +- drivers/md/dm-bufio.c | 6 + drivers/md/dm-integrity.c | 58 ++- drivers/md/dm-snap.c | 24 + drivers/md/dm-table.c | 15 +- drivers/md/dm-verity-target.c | 12 +- drivers/md/md-cluster.c | 67 +-- drivers/md/md.c | 14 +- drivers/mtd/hisilicon/sfc/hrd_sfc_driver.c | 4 +- drivers/net/bonding/bond_main.c | 92 ++-- drivers/net/bonding/bond_netlink.c | 14 + drivers/net/bonding/bond_options.c | 71 ++- drivers/net/bonding/bond_procfs.c | 2 + drivers/net/bonding/bond_sysfs.c | 13 + drivers/net/bonding/bond_sysfs_slave.c | 18 +- .../net/ethernet/hisilicon/hns/hns_ethtool.c | 4 + drivers/net/ethernet/intel/i40e/i40e.h | 4 + drivers/net/ethernet/intel/i40e/i40e_main.c | 32 +- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 30 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 24 +- .../net/ethernet/mellanox/mlx4/en_netdev.c | 21 +- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 40 +- drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 12 +- .../net/ethernet/mellanox/mlx5/core/en_fs.c | 3 + .../net/ethernet/mellanox/mlx5/core/eswitch.c | 15 +- .../net/ethernet/mellanox/mlx5/core/main.c | 6 +- .../ethernet/mellanox/mlx5/core/pagealloc.c | 21 +- drivers/net/ethernet/mellanox/mlxsw/core.c | 8 +- drivers/net/geneve.c | 3 +- drivers/net/macvlan.c | 5 +- drivers/net/virtio_net.c | 12 +- drivers/net/vxlan.c | 3 + drivers/nvme/host/pci.c | 15 + drivers/pci/controller/pcie-iproc.c | 10 +- drivers/pci/pci.c | 14 +- drivers/pci/slot.c | 6 +- drivers/scsi/huawei/hifc/unf_common.h | 2 +- drivers/scsi/huawei/hifc/unf_scsi.c | 23 + drivers/scsi/libiscsi.c | 33 +- drivers/scsi/scsi_lib.c | 126 +++-- drivers/scsi/scsi_scan.c | 11 +- drivers/scsi/scsi_transport_spi.c | 27 +- drivers/spi/spi.c | 19 +- drivers/target/iscsi/iscsi_target.c | 96 ++-- drivers/target/iscsi/iscsi_target.h | 1 - drivers/target/iscsi/iscsi_target_configfs.c | 5 +- drivers/target/iscsi/iscsi_target_login.c | 5 +- drivers/tty/serial/amba-pl011.c | 11 +- drivers/tty/serial/serial_core.c | 4 + drivers/uio/uio.c | 12 +- drivers/vfio/pci/vfio_pci.c | 3 +- drivers/vhost/net.c | 6 +- drivers/watchdog/sbsa_gwdt.c | 6 +- fs/cifs/cifs_unicode.c | 8 +- fs/cifs/connect.c | 2 + fs/cifs/inode.c | 13 +- fs/efivarfs/inode.c | 2 + fs/efivarfs/super.c | 3 + fs/exec.c | 17 +- fs/ext4/ext4.h | 6 +- fs/ext4/ext4_jbd2.c | 1 - fs/ext4/file.c | 1 + fs/ext4/inline.c | 1 + fs/ext4/inode.c | 31 +- fs/ext4/ioctl.c | 3 + fs/ext4/mballoc.c | 1 + fs/ext4/namei.c | 23 +- fs/ext4/resize.c | 8 +- fs/ext4/super.c | 32 +- fs/ext4/xattr.c | 1 + fs/fcntl.c | 10 +- fs/filescontrol.c | 73 +-- fs/fuse/dev.c | 28 +- fs/hugetlbfs/inode.c | 2 +- fs/libfs.c | 6 +- fs/lockd/host.c | 20 +- fs/nfs/inode.c | 2 +- fs/nfs/internal.h | 12 +- fs/nfs/nfs4proc.c | 2 +- fs/nfs/nfs4super.c | 2 +- fs/nfs/pnfs.c | 40 +- fs/nfs/pnfs.h | 5 + fs/nfs_common/grace.c | 6 +- fs/ocfs2/super.c | 1 + fs/proc/generic.c | 55 ++- fs/proc/internal.h | 7 + fs/proc/proc_net.c | 16 - fs/proc/self.c | 7 + fs/quota/quota_tree.c | 8 +- fs/super.c | 33 +- fs/xfs/libxfs/xfs_alloc.c | 1 + fs/xfs/libxfs/xfs_bmap.c | 19 +- fs/xfs/libxfs/xfs_bmap.h | 2 +- fs/xfs/libxfs/xfs_rmap.c | 2 +- fs/xfs/scrub/bmap.c | 10 +- fs/xfs/scrub/btree.c | 45 +- fs/xfs/scrub/inode.c | 3 +- fs/xfs/scrub/refcount.c | 8 +- fs/xfs/xfs_iops.c | 10 + fs/xfs/xfs_pnfs.c | 2 +- fs/xfs/xfs_rtalloc.c | 10 +- include/asm-generic/io.h | 39 +- include/linux/backing-dev.h | 1 + include/linux/blkdev.h | 1 + include/linux/compat.h | 2 - include/linux/dm-bufio.h | 1 + include/linux/efi.h | 7 - include/linux/futex.h | 39 +- include/linux/huge_mm.h | 9 + include/linux/hugetlb.h | 10 +- include/linux/if_team.h | 5 +- include/linux/memblock.h | 3 - include/linux/memcontrol.h | 32 +- include/linux/mm.h | 2 + include/linux/mm_types.h | 1 + include/linux/mman.h | 15 + include/linux/mmzone.h | 8 + include/linux/netfilter/x_tables.h | 5 +- include/linux/netfilter_ipv4.h | 2 +- include/linux/netfilter_ipv6.h | 2 +- include/linux/netpoll.h | 10 +- include/linux/prandom.h | 36 +- include/linux/proc_fs.h | 8 +- include/linux/sched.h | 5 +- include/linux/sched/cputime.h | 5 + include/linux/sched/mm.h | 6 +- include/linux/shrinker.h | 7 +- include/linux/skbuff.h | 5 + include/linux/sunrpc/xprt.h | 1 + include/linux/time64.h | 4 + include/net/bond_options.h | 1 + include/net/bonding.h | 14 +- include/net/ip_tunnels.h | 7 +- include/net/red.h | 4 +- include/net/tls.h | 6 + include/scsi/libiscsi.h | 3 + include/target/iscsi/iscsi_target_core.h | 2 +- include/uapi/asm-generic/mman.h | 1 + include/uapi/linux/if_link.h | 1 + init/Kconfig | 2 +- kernel/events/internal.h | 2 +- kernel/exit.c | 35 +- kernel/fail_function.c | 5 +- kernel/fork.c | 61 ++- kernel/futex.c | 291 +++++++++-- kernel/irq/irqdomain.c | 11 +- kernel/kthread.c | 3 +- kernel/module.c | 6 +- kernel/reboot.c | 28 +- kernel/sched/core.c | 6 +- kernel/sched/cputime.c | 6 + kernel/sched/deadline.c | 5 +- kernel/sched/sched.h | 42 +- kernel/signal.c | 19 +- kernel/time/itimer.c | 4 - kernel/time/tick-common.c | 2 + kernel/time/timer.c | 7 - kernel/trace/ftrace.c | 22 +- kernel/trace/ring_buffer.c | 66 ++- kernel/trace/trace.c | 9 +- kernel/trace/trace.h | 32 +- kernel/trace/trace_selftest.c | 9 +- kernel/workqueue.c | 13 +- lib/Kconfig.debug | 9 + lib/Makefile | 1 + lib/fonts/font_10x18.c | 2 +- lib/fonts/font_6x10.c | 2 +- lib/fonts/font_6x11.c | 2 +- lib/fonts/font_7x14.c | 2 +- lib/fonts/font_8x16.c | 2 +- lib/fonts/font_8x8.c | 2 +- lib/fonts/font_acorn_8x8.c | 2 +- lib/fonts/font_mini_4x6.c | 2 +- lib/fonts/font_pearl_8x8.c | 2 +- lib/fonts/font_sun12x22.c | 2 +- lib/fonts/font_sun8x16.c | 2 +- lib/genalloc.c | 25 +- lib/random32.c | 462 +++++++++++------- lib/scatterlist.c | 2 +- lib/test_free_pages.c | 42 ++ mm/huge_memory.c | 167 +++++-- mm/hugetlb.c | 5 +- mm/kasan/kasan_init.c | 23 +- mm/list_lru.c | 10 +- mm/memblock.c | 11 +- mm/memcontrol.c | 34 +- mm/memory-failure.c | 6 + mm/mempolicy.c | 6 +- mm/mlock.c | 25 +- mm/mmap.c | 27 +- mm/page_alloc.c | 9 + mm/slub.c | 2 +- mm/swap.c | 37 +- mm/swapfile.c | 4 +- mm/vmscan.c | 64 +-- net/8021q/vlan.c | 3 +- net/8021q/vlan_dev.c | 5 +- net/bridge/br_device.c | 1 + net/bridge/br_netfilter_hooks.c | 7 +- net/bridge/br_private.h | 5 +- net/bridge/br_vlan.c | 4 +- net/ceph/messenger.c | 5 + net/core/dev.c | 5 + net/core/devlink.c | 6 +- net/core/lwt_bpf.c | 8 +- net/core/net-sysfs.c | 65 ++- net/core/netpoll.c | 51 +- net/core/skbuff.c | 23 +- net/dsa/slave.c | 5 +- net/ipv4/fib_frontend.c | 2 +- net/ipv4/gre_demux.c | 2 +- net/ipv4/inet_diag.c | 4 +- net/ipv4/ip_output.c | 2 +- net/ipv4/ip_tunnel.c | 10 +- net/ipv4/netfilter.c | 12 +- net/ipv4/netfilter/arp_tables.c | 16 +- net/ipv4/netfilter/ip_tables.c | 16 +- net/ipv4/netfilter/ipt_SYNPROXY.c | 2 +- net/ipv4/netfilter/ipt_rpfilter.c | 2 +- net/ipv4/netfilter/iptable_mangle.c | 2 +- net/ipv4/netfilter/nf_nat_l3proto_ipv4.c | 2 +- net/ipv4/netfilter/nf_reject_ipv4.c | 2 +- net/ipv4/netfilter/nft_chain_route_ipv4.c | 2 +- net/ipv4/route.c | 7 +- net/ipv4/syncookies.c | 9 +- net/ipv4/tcp.c | 2 + net/ipv4/tcp_bbr.c | 2 +- net/ipv4/tcp_cong.c | 5 + net/ipv4/tcp_input.c | 6 +- net/ipv4/tcp_output.c | 9 +- net/ipv4/udp.c | 3 +- net/ipv6/addrconf.c | 3 +- net/ipv6/addrlabel.c | 26 +- net/ipv6/ah6.c | 3 +- net/ipv6/ip6_fib.c | 5 +- net/ipv6/ip6_gre.c | 16 +- net/ipv6/ip6_output.c | 40 +- net/ipv6/netfilter.c | 6 +- net/ipv6/netfilter/ip6_tables.c | 16 +- net/ipv6/netfilter/ip6table_mangle.c | 2 +- net/ipv6/netfilter/nf_nat_l3proto_ipv6.c | 2 +- net/ipv6/netfilter/nft_chain_route_ipv6.c | 2 +- net/ipv6/sit.c | 2 - net/ipv6/syncookies.c | 10 +- net/netfilter/ipset/ip_set_core.c | 3 +- net/netfilter/ipset/ip_set_hash_gen.h | 20 +- net/netfilter/ipvs/ip_vs_core.c | 4 +- net/netfilter/nf_conntrack_standalone.c | 3 + net/netfilter/nf_nat_core.c | 1 + net/netfilter/nf_tables_api.c | 3 +- net/netfilter/x_tables.c | 49 +- net/netfilter/xt_RATEEST.c | 3 + net/sched/cls_tcindex.c | 8 +- net/sched/sch_api.c | 3 +- net/sched/sch_choke.c | 2 +- net/sched/sch_generic.c | 3 + net/sched/sch_gred.c | 2 +- net/sched/sch_netem.c | 9 +- net/sched/sch_red.c | 2 +- net/sched/sch_sfq.c | 2 +- net/sctp/input.c | 4 +- net/sctp/sm_sideeffect.c | 8 +- net/sctp/transport.c | 2 +- net/sunrpc/addr.c | 2 +- net/sunrpc/xprt.c | 65 ++- net/sunrpc/xprtrdma/module.c | 1 + net/sunrpc/xprtrdma/transport.c | 1 + net/sunrpc/xprtsock.c | 4 + net/tipc/link.c | 9 +- net/tipc/msg.c | 5 +- net/tipc/topsrv.c | 10 +- net/tls/tls_device.c | 5 +- net/tls/tls_sw.c | 6 + net/xdp/xsk.c | 8 +- net/xfrm/xfrm_state.c | 8 +- security/lsm_audit.c | 7 +- security/selinux/hooks.c | 16 +- security/selinux/ibpkey.c | 4 +- sound/soc/codecs/Kconfig | 1 + tools/include/uapi/linux/if_link.h | 1 + tools/perf/builtin-lock.c | 2 +- tools/perf/util/print_binary.c | 2 +- .../scripting-engines/trace-event-python.c | 7 +- tools/perf/util/session.c | 1 + virt/kvm/arm/mmu.c | 7 + 344 files changed, 3424 insertions(+), 1701 deletions(-) create mode 100644 lib/test_free_pages.c -- 2.25.1

1 316

[PATCH 001/316] blk-cgroup: prevent rcu_sched detected stalls warnings in blkg_destroy_all()
by Cheng Jian 22 Feb '21

22 Feb '21

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 46357 CVE: NA --------------------------- test procedures: a. create 20000 cgroups, and echo "8:0 10000" to blkio.throttle.write_bps_device b. echo 1 > /sys/blocd/sda/device/delete test result: rcu: INFO: rcu_sched detected stalls on CPUs/tasks: [5/1143] rcu: 0-...0: (0 ticks this GP) idle=0f2/1/0x4000000000000000 softirq=15507/15507 fq rcu: (detected by 6, t=60012 jiffies, g=119977, q=27153) NMI backtrace for cpu 0 CPU: 0 PID: 443 Comm: bash Not tainted 4.19.95-00061-g0bcc83b30eec #63 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-p4 RIP: 0010:blk_throtl_update_limit_valid.isra.0+0x116/0x2a0 Code: 01 00 00 e8 7c dd 74 ff 48 83 bb 78 01 00 00 00 0f 85 54 01 00 00 48 8d bb 88 01 1 RSP: 0018:ffff8881030bf9f0 EFLAGS: 00000046 RAX: 0000000000000000 RBX: ffff8880b4f37080 RCX: ffffffff95da0afe RDX: dffffc0000000000 RSI: ffff888100373980 RDI: ffff8880b4f37208 RBP: ffff888100deca00 R08: ffffffff9528f951 R09: 0000000000000001 R10: ffffed10159dbf56 R11: ffff8880acedfab3 R12: ffff8880b9fda498 R13: ffff8880b9fda4f4 R14: 0000000000000050 R15: ffffffff98b622c0 FS: 00007feb51c51700(0000) GS:ffff888106200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561619547080 CR3: 0000000102bc9000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: throtl_pd_offline+0x98/0x100 blkg_destroy+0x133/0x630 ? blkcg_deactivate_policy+0x2c0/0x2c0 ? lock_timer_base+0x65/0x110 blkg_destroy_all+0x7f/0x100 blkcg_exit_queue+0x3f/0xa5 blk_exit_queue+0x69/0xa0 blk_cleanup_queue+0x226/0x360 __scsi_remove_device+0xb4/0x3c0 scsi_remove_device+0x38/0x60 sdev_store_delete+0x74/0x100 ? dev_driver_string+0xb0/0xb0 dev_attr_store+0x41/0x70 sysfs_kf_write+0x89/0xc0 kernfs_fop_write+0x1b6/0x2e0 ? sysfs_kf_bin_read+0x130/0x130 __vfs_write+0xca/0x420 ? kernel_read+0xc0/0xc0 ? __alloc_fd+0x16f/0x2d0 ? __fd_install+0x95/0x1a0 ? handle_mm_fault+0x3e0/0x560 vfs_write+0x11a/0x2f0 ksys_write+0xb9/0x1e0 ? __x64_sys_read+0x60/0x60 ? kasan_check_write+0x20/0x30 ? filp_close+0xb5/0xf0 __x64_sys_write+0x46/0x60 do_syscall_64+0xd9/0x1f0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The usage of so many blkg is very rare, however, such problem do exist in theory. In order to avoid such warnings, release 'q->queue_lock' for a while when a batch of blkg were destroyed. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Tao Hou <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- block/blk-cgroup.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index e592167449aa..c64f0afa27dc 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -364,16 +364,31 @@ static void blkg_destroy(struct blkcg_gq *blkg) */ static void blkg_destroy_all(struct request_queue *q) { +#define BLKG_DESTROY_BATCH 4096 struct blkcg_gq *blkg, *n; + int count; lockdep_assert_held(q->queue_lock); +again: + count = BLKG_DESTROY_BATCH; list_for_each_entry_safe(blkg, n, &q->blkg_list, q_node) { struct blkcg *blkcg = blkg->blkcg; spin_lock(&blkcg->lock); blkg_destroy(blkg); spin_unlock(&blkcg->lock); + /* + * If the list is too long, the loop can took a long time, + * thus relese the lock for a while when a batch of blkg + * were destroyed. + */ + if (!--count) { + spin_unlock_irq(q->queue_lock); + cond_resched(); + spin_lock_irq(q->queue_lock); + goto again; + } } q->root_blkg = NULL; -- 2.25.1

1 13

[PATCH 001/316] blk-cgroup: prevent rcu_sched detected stalls warnings in blkg_destroy_all()
by Cheng Jian 22 Feb '21

22 Feb '21

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 46357 CVE: NA --------------------------- test procedures: a. create 20000 cgroups, and echo "8:0 10000" to blkio.throttle.write_bps_device b. echo 1 > /sys/blocd/sda/device/delete test result: rcu: INFO: rcu_sched detected stalls on CPUs/tasks: [5/1143] rcu: 0-...0: (0 ticks this GP) idle=0f2/1/0x4000000000000000 softirq=15507/15507 fq rcu: (detected by 6, t=60012 jiffies, g=119977, q=27153) NMI backtrace for cpu 0 CPU: 0 PID: 443 Comm: bash Not tainted 4.19.95-00061-g0bcc83b30eec #63 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-p4 RIP: 0010:blk_throtl_update_limit_valid.isra.0+0x116/0x2a0 Code: 01 00 00 e8 7c dd 74 ff 48 83 bb 78 01 00 00 00 0f 85 54 01 00 00 48 8d bb 88 01 1 RSP: 0018:ffff8881030bf9f0 EFLAGS: 00000046 RAX: 0000000000000000 RBX: ffff8880b4f37080 RCX: ffffffff95da0afe RDX: dffffc0000000000 RSI: ffff888100373980 RDI: ffff8880b4f37208 RBP: ffff888100deca00 R08: ffffffff9528f951 R09: 0000000000000001 R10: ffffed10159dbf56 R11: ffff8880acedfab3 R12: ffff8880b9fda498 R13: ffff8880b9fda4f4 R14: 0000000000000050 R15: ffffffff98b622c0 FS: 00007feb51c51700(0000) GS:ffff888106200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561619547080 CR3: 0000000102bc9000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: throtl_pd_offline+0x98/0x100 blkg_destroy+0x133/0x630 ? blkcg_deactivate_policy+0x2c0/0x2c0 ? lock_timer_base+0x65/0x110 blkg_destroy_all+0x7f/0x100 blkcg_exit_queue+0x3f/0xa5 blk_exit_queue+0x69/0xa0 blk_cleanup_queue+0x226/0x360 __scsi_remove_device+0xb4/0x3c0 scsi_remove_device+0x38/0x60 sdev_store_delete+0x74/0x100 ? dev_driver_string+0xb0/0xb0 dev_attr_store+0x41/0x70 sysfs_kf_write+0x89/0xc0 kernfs_fop_write+0x1b6/0x2e0 ? sysfs_kf_bin_read+0x130/0x130 __vfs_write+0xca/0x420 ? kernel_read+0xc0/0xc0 ? __alloc_fd+0x16f/0x2d0 ? __fd_install+0x95/0x1a0 ? handle_mm_fault+0x3e0/0x560 vfs_write+0x11a/0x2f0 ksys_write+0xb9/0x1e0 ? __x64_sys_read+0x60/0x60 ? kasan_check_write+0x20/0x30 ? filp_close+0xb5/0xf0 __x64_sys_write+0x46/0x60 do_syscall_64+0xd9/0x1f0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The usage of so many blkg is very rare, however, such problem do exist in theory. In order to avoid such warnings, release 'q->queue_lock' for a while when a batch of blkg were destroyed. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Tao Hou <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- block/blk-cgroup.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index e592167449aa..c64f0afa27dc 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -364,16 +364,31 @@ static void blkg_destroy(struct blkcg_gq *blkg) */ static void blkg_destroy_all(struct request_queue *q) { +#define BLKG_DESTROY_BATCH 4096 struct blkcg_gq *blkg, *n; + int count; lockdep_assert_held(q->queue_lock); +again: + count = BLKG_DESTROY_BATCH; list_for_each_entry_safe(blkg, n, &q->blkg_list, q_node) { struct blkcg *blkcg = blkg->blkcg; spin_lock(&blkcg->lock); blkg_destroy(blkg); spin_unlock(&blkcg->lock); + /* + * If the list is too long, the loop can took a long time, + * thus relese the lock for a while when a batch of blkg + * were destroyed. + */ + if (!--count) { + spin_unlock_irq(q->queue_lock); + cond_resched(); + spin_lock_irq(q->queue_lock); + goto again; + } } q->root_blkg = NULL; -- 2.25.1

1 4

openEuler kernel sig meeting
by openEuler conference 19 Feb '21

19 Feb '21

2 1

Re: [Dev] openEuler kernel sig meeting
by gwei3 19 Feb '21

19 Feb '21

申报议题： 2. 讨论设立sig安全联络员及如何缩短sig所属项目的CVE响应时间魏刚 ---Original--- From: "openEuler conference"<public(a)openeuler.io> Date: Thu, Feb 18, 2021 17:12 PM To: "dev"<dev(a)openeuler.org>;"kernel"<kernel(a)openeuler.org>; Subject: [Dev] openEuler kernel sig meeting 您好！ openEuler Kernel SIG 邀请您参加 2021-02-19 10:00 召开的ZOOM会议会议主题：openEuler kernel sig meeting 会议内容：1. 树莓派补丁合入openEuler 5.10 内核讨论会议链接：https://zoom.us/j/92887086207?pwd=emdmSVVFekh5eXRSczNNTngrcWYzUT09 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the ZOOM conference will be held at 2021-02-19 10:00, The subject of the conference is openEuler kernel sig meeting, Summary: 1. 树莓派补丁合入openEuler 5.10 内核讨论 You can join the meeting at https://zoom.us/j/92887086207?pwd=emdmSVVFekh5eXRSczNNTngrcWYzUT09. More information

1 0

[PATCH kernel-4.19 00/18] backport stable-4.19-174
by Yang Yingliang 09 Feb '21

09 Feb '21

Arnold Gozum (1): platform/x86: intel-vbtn: Support for tablet mode on Dell Inspiron 7352 Brian King (1): scsi: ibmvfc: Set default timeout to avoid crash during migration Christian Brauner (1): sysctl: handle overflow in proc_get_long Eric Dumazet (1): net_sched: gen_estimator: support large ewma log Felix Fietkau (1): mac80211: fix fast-rx encryption check Greg Kroah-Hartman (1): Linux 4.19.174 Hans de Goede (1): platform/x86: touchscreen_dmi: Add swap-x-y quirk for Goodix touchscreen on Estar Beauty HD tablet Javed Hasan (1): scsi: libfc: Avoid invoking response handler twice if ep is already completed Josh Poimboeuf (1): objtool: Don't fail on missing symbol table Lijun Pan (1): ibmvnic: Ensure that CRQ entry read are correctly ordered Martin Wilck (1): scsi: scsi_transport_srp: Don't block target in failfast state Michael Ellerman (1): selftests/powerpc: Only test lwm/stmw on big endian Pan Bian (1): net: dsa: bcm_sf2: put device node before return Peter Zijlstra (3): x86: __always_inline __{rd,wr}msr() kthread: Extract KTHREAD_IS_PER_CPU workqueue: Restrict affinity change to rescuer Rafael J. Wysocki (1): ACPI: thermal: Do not call acpi_thermal_check() directly Tony Lindgren (1): phy: cpcap-usb: Fix warning for missing regulator_disable Makefile | 2 +- arch/x86/include/asm/msr.h | 4 +- drivers/acpi/thermal.c | 55 +++++++++++++------ drivers/net/dsa/bcm_sf2.c | 8 ++- drivers/net/ethernet/ibm/ibmvnic.c | 6 ++ drivers/phy/motorola/phy-cpcap-usb.c | 19 +++++-- drivers/platform/x86/intel-vbtn.c | 6 ++ drivers/platform/x86/touchscreen_dmi.c | 18 ++++++ drivers/scsi/ibmvscsi/ibmvfc.c | 4 +- drivers/scsi/libfc/fc_exch.c | 16 +++++- drivers/scsi/scsi_transport_srp.c | 9 ++- include/linux/kthread.h | 3 + kernel/kthread.c | 27 ++++++++- kernel/smpboot.c | 1 + kernel/sysctl.c | 2 + kernel/workqueue.c | 9 +-- net/core/gen_estimator.c | 11 ++-- net/mac80211/rx.c | 2 + tools/objtool/elf.c | 7 ++- .../powerpc/alignment/alignment_handler.c | 5 +- 20 files changed, 168 insertions(+), 46 deletions(-) -- 2.25.1

1 18

[PATCH kernel-4.19 1/3] mmap: fix a compiling error for 'MAP_CHECKNODE'
by Yang Yingliang 09 Feb '21

09 Feb '21

From: Bixuan Cui <cuibixuan(a)huawei.com> hulk inclusion category: bugfix bugzilla: NA CVE: NA MAP_CHECKNODE was defined in uapi/asm-generic/mman.h, that was not automatically included by mm/mmap.c when building on platforms such as mips, and result in following compiling error: mm/mmap.c: In function ‘__do_mmap’: mm/mmap.c:1581:14: error: ‘MAP_CHECKNODE’ undeclared (first use in this function) if (flags & MAP_CHECKNODE) ^ mm/mmap.c:1581:14: note: each undeclared identifier is reported only once for each function it appears in scripts/Makefile.build:303: recipe for target 'mm/mmap.o' failed Fixes: 56a22a261008 ("arm64/ascend: mm: Add MAP_CHECKNODE flag to check node hugetlb") Signed-off-by: Bixuan Cui <cuibixuan(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/alpha/include/uapi/asm/mman.h | 1 + arch/mips/include/uapi/asm/mman.h | 1 + arch/parisc/include/uapi/asm/mman.h | 1 + arch/powerpc/include/uapi/asm/mman.h | 1 + arch/sparc/include/uapi/asm/mman.h | 1 + arch/xtensa/include/uapi/asm/mman.h | 1 + 6 files changed, 6 insertions(+) diff --git a/arch/alpha/include/uapi/asm/mman.h b/arch/alpha/include/uapi/asm/mman.h index b3acfc00c8ec5..1c7ce2716ad37 100644 --- a/arch/alpha/include/uapi/asm/mman.h +++ b/arch/alpha/include/uapi/asm/mman.h @@ -34,6 +34,7 @@ #define MAP_HUGETLB 0x100000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x200000/* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #define MS_ASYNC 1 /* sync memory asynchronously */ #define MS_SYNC 2 /* synchronous memory sync */ diff --git a/arch/mips/include/uapi/asm/mman.h b/arch/mips/include/uapi/asm/mman.h index 72a00c746e781..4570a54ac1d90 100644 --- a/arch/mips/include/uapi/asm/mman.h +++ b/arch/mips/include/uapi/asm/mman.h @@ -52,6 +52,7 @@ #define MAP_HUGETLB 0x80000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x100000 /* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ /* * Flags for msync diff --git a/arch/parisc/include/uapi/asm/mman.h b/arch/parisc/include/uapi/asm/mman.h index 9e989d649e854..06857eb1bee8f 100644 --- a/arch/parisc/include/uapi/asm/mman.h +++ b/arch/parisc/include/uapi/asm/mman.h @@ -28,6 +28,7 @@ #define MAP_HUGETLB 0x80000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x100000 /* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #define MS_SYNC 1 /* synchronous memory sync */ #define MS_ASYNC 2 /* sync memory asynchronously */ diff --git a/arch/powerpc/include/uapi/asm/mman.h b/arch/powerpc/include/uapi/asm/mman.h index 95f884ada96f1..24354f792b00d 100644 --- a/arch/powerpc/include/uapi/asm/mman.h +++ b/arch/powerpc/include/uapi/asm/mman.h @@ -30,6 +30,7 @@ #define MAP_STACK 0x20000 /* give out an address that is best suited for process/thread stacks */ #define MAP_HUGETLB 0x40000 /* create a huge page mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ /* Override any generic PKEY permission defines */ #define PKEY_DISABLE_EXECUTE 0x4 diff --git a/arch/sparc/include/uapi/asm/mman.h b/arch/sparc/include/uapi/asm/mman.h index 0d1881b8f30d1..214abe17f44a0 100644 --- a/arch/sparc/include/uapi/asm/mman.h +++ b/arch/sparc/include/uapi/asm/mman.h @@ -27,6 +27,7 @@ #define MAP_STACK 0x20000 /* give out an address that is best suited for process/thread stacks */ #define MAP_HUGETLB 0x40000 /* create a huge page mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #endif /* _UAPI__SPARC_MMAN_H__ */ diff --git a/arch/xtensa/include/uapi/asm/mman.h b/arch/xtensa/include/uapi/asm/mman.h index f584a590bb001..2c9d705602382 100644 --- a/arch/xtensa/include/uapi/asm/mman.h +++ b/arch/xtensa/include/uapi/asm/mman.h @@ -59,6 +59,7 @@ #define MAP_HUGETLB 0x80000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x100000 /* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #ifdef CONFIG_MMAP_ALLOW_UNINITIALIZED # define MAP_UNINITIALIZED 0x4000000 /* For anonymous mmap, memory could be * uninitialized */ -- 2.25.1

1 2

[PATCH kernel-4.19 00/38] backport stable-4.19.173
by Yang Yingliang 09 Feb '21

09 Feb '21

Andrea Righi (1): leds: trigger: fix potential deadlock with libata Baoquan He (1): kernel: kexec: remove the lock operation of system_transition_mutex Bartosz Golaszewski (1): iommu/vt-d: Don't dereference iommu_device if IOMMU_API is not built Claudiu Beznea (1): drivers: soc: atmel: add null entry at the end of at91_soc_allowed_list[] Dan Carpenter (1): can: dev: prevent potential information leak in can_fill_info() David Woodhouse (2): xen: Fix XenStore initialisation for XS_LOCAL iommu/vt-d: Gracefully handle DMAR units with no supported address widths Eyal Birger (1): xfrm: fix disable_xfrm sysctl when used on xfrm interfaces Giacinto Cifelli (1): net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family Greg Kroah-Hartman (1): Linux 4.19.173 Ivan Vecera (1): team: protect features update by RCU to avoid deadlock Jay Zhou (1): KVM: x86: get smi pending status correctly Johannes Berg (4): wext: fix NULL-ptr-dereference with cfg80211's lack of commit() iwlwifi: pcie: use jiffies for memory read spin time limit iwlwifi: pcie: reschedule in long-running memory reads mac80211: pause TX while changing interface type Josef Bacik (1): nbd: freeze the queue while we're adding connections Kai-Heng Feng (1): ACPI: sysfs: Prefer "compatible" modalias Kamal Heib (1): RDMA/cxgb4: Fix the reported max_recv_sge value Koen Vandeputte (1): ARM: dts: imx6qdl-gw52xx: fix duplicate regulator naming Laurent Badel (1): PM: hibernate: flush swap writer after marking Like Xu (1): KVM: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in intel_arch_events[] Lorenzo Bianconi (2): mt7601u: fix kernel crash unplugging the device mt7601u: fix rx buffer refcounting Max Krummenacher (1): ARM: imx: build suspend-imx6.S with arm instruction set Pablo Neira Ayuso (1): netfilter: nft_dynset: add timeout extension to template Pan Bian (2): NFC: fix resource leak when target index is invalid NFC: fix possible resource leak Pengcheng Yang (1): tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN Roger Pau Monne (2): xen/privcmd: allow fetching resource sizes xen-blkfront: allow discard-* nodes to be optional Roi Dayan (1): net/mlx5: Fix memory leak on flow table creation error flow Sean Young (1): media: rc: ensure that uevent can be read directly after rc device register Shmulik Ladkani (1): xfrm: Fix oops in xfrm_replay_advance_bmp Sudeep Holla (1): drivers: soc: atmel: Avoid calling at91_soc_init on non AT91 SoCs Takashi Iwai (1): ALSA: hda/via: Apply the workaround generically for Clevo machines Takeshi Misawa (1): rxrpc: Fix memory leak in rxrpc_lookup_local Trond Myklebust (1): pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process() Makefile | 2 +- arch/arm/boot/dts/imx6qdl-gw52xx.dtsi | 2 +- arch/arm/mach-imx/suspend-imx6.S | 1 + arch/x86/kvm/pmu_intel.c | 2 +- arch/x86/kvm/x86.c | 5 +++ drivers/acpi/device_sysfs.c | 20 +++------ drivers/block/nbd.c | 8 ++++ drivers/block/xen-blkfront.c | 20 +++------ drivers/infiniband/hw/cxgb4/qp.c | 2 +- drivers/iommu/dmar.c | 45 +++++++++++++------ drivers/leds/led-triggers.c | 10 +++-- drivers/media/rc/rc-main.c | 4 +- drivers/net/can/dev.c | 2 +- .../net/ethernet/mellanox/mlx5/core/fs_core.c | 1 + drivers/net/team/team.c | 6 +-- drivers/net/usb/qmi_wwan.c | 1 + .../net/wireless/intel/iwlwifi/pcie/trans.c | 14 +++--- drivers/net/wireless/mediatek/mt7601u/dma.c | 5 +-- drivers/soc/atmel/soc.c | 13 ++++++ drivers/xen/privcmd.c | 25 ++++++++--- drivers/xen/xenbus/xenbus_probe.c | 31 +++++++++++++ fs/nfs/pnfs.c | 1 + include/linux/intel-iommu.h | 2 + include/net/tcp.h | 2 +- kernel/kexec_core.c | 2 - kernel/power/swap.c | 2 +- net/ipv4/tcp_input.c | 10 +++-- net/ipv4/tcp_recovery.c | 5 ++- net/mac80211/ieee80211_i.h | 1 + net/mac80211/iface.c | 6 +++ net/netfilter/nft_dynset.c | 4 +- net/nfc/netlink.c | 1 + net/nfc/rawsock.c | 2 +- net/rxrpc/call_accept.c | 1 + net/wireless/wext-core.c | 5 ++- net/xfrm/xfrm_input.c | 2 +- net/xfrm/xfrm_policy.c | 4 +- sound/pci/hda/patch_via.c | 2 +- 38 files changed, 183 insertions(+), 88 deletions(-) -- 2.25.1

1 38

[PATCH openEuler-1.0-LTS 1/2] nbd: Fix memory leak in nbd_add_socket
by Yang Yingliang 07 Feb '21

07 Feb '21

From: Zheng Bin <zhengbin13(a)huawei.com> stable inclusion from linux-4.19.133 commit 306290bad932950adccfbf99c27b70c105c2c183 -------------------------------- [ Upstream commit 579dd91ab3a5446b148e7f179b6596b270dace46 ] When adding first socket to nbd, if nsock's allocation failed, the data structure member "config->socks" was reallocated, but the data structure member "config->num_connections" was not updated. A memory leak will occur then because the function "nbd_config_put" will free "config->socks" only when "config->num_connections" is not zero. Fixes: 03bf73c315ed ("nbd: prevent memory leak") Reported-by: syzbot+934037347002901b8d2a(a)syzkaller.appspotmail.com Signed-off-by: Zheng Bin <zhengbin13(a)huawei.com> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/block/nbd.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 49f98b9b2777..97fcb040056c 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -993,25 +993,26 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, test_bit(NBD_RT_BOUND, &config->runtime_flags))) { dev_err(disk_to_dev(nbd->disk), "Device being setup by another task"); - sockfd_put(sock); - return -EBUSY; + err = -EBUSY; + goto put_socket; + } + + nsock = kzalloc(sizeof(*nsock), GFP_KERNEL); + if (!nsock) { + err = -ENOMEM; + goto put_socket; } socks = krealloc(config->socks, (config->num_connections + 1) * sizeof(struct nbd_sock *), GFP_KERNEL); if (!socks) { - sockfd_put(sock); - return -ENOMEM; + kfree(nsock); + err = -ENOMEM; + goto put_socket; } config->socks = socks; - nsock = kzalloc(sizeof(struct nbd_sock), GFP_KERNEL); - if (!nsock) { - sockfd_put(sock); - return -ENOMEM; - } - nsock->fallback_index = -1; nsock->dead = false; mutex_init(&nsock->tx_lock); @@ -1023,6 +1024,10 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, atomic_inc(&config->live_connections); return 0; + +put_socket: + sockfd_put(sock); + return err; } static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg) -- 2.25.1

1 1