- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 000/316] bugfix for 20.03
by Cheng Jian 22 Feb '21

22 Feb '21

bugfix for 20.03 @ 2021/02/22 Aichun Li (7): netpoll: remove dev argument from netpoll_send_skb_on_dev() netpoll: move netpoll_send_skb() out of line netpoll: netpoll_send_skb() returns transmit status netpoll: accept NULL np argument in netpoll_send_skb() bonding: add an option to specify a delay between peer notifications bonding: fix value exported by Netlink for peer_notif_delay bonding: add documentation for peer_notif_delay Akilesh Kailash (1): dm snapshot: flush merged data before committing metadata Al Viro (2): don't dump the threads that had been already exiting when zapped. dump_common_audit_data(): fix racy accesses to ->d_name Aleksandr Nogikh (1): netem: fix zero division in tabledist Alexander Duyck (1): tcp: Set INET_ECN_xmit configuration in tcp_reinit_congestion_control Alexander Lobakin (1): skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too Alexey Dobriyan (2): proc: change ->nlink under proc_subdir_lock proc: fix lookup in /proc/net subdirectories after setns(2) Alexey Kardashevskiy (1): serial_core: Check for port state when tty is in error state Amit Cohen (1): mlxsw: core: Fix use-after-free in mlxsw_emad_trans_finish() Andy Shevchenko (2): device property: Keep secondary firmware node secondary by type device property: Don't clear secondary pointer for shared primary firmware node Antoine Tenart (6): netfilter: bridge: reset skb->pkt_type after NF_INET_POST_ROUTING traversal net: ip6_gre: set dev->hard_header_len when using header_ops net-sysfs: take the rtnl lock when storing xps_cpus net-sysfs: take the rtnl lock when accessing xps_cpus_map and num_tc net-sysfs: take the rtnl lock when storing xps_rxqs net-sysfs: take the rtnl lock when accessing xps_rxqs_map and num_tc Ard Biesheuvel (3): efivarfs: revert "fix memory leak in efivarfs_create()" arm64, mm, efi: Account for GICv3 LPI tables in static memblock reserve table efi/arm: Revert "Defer persistent reservations until after paging_init()" Arjun Roy (1): tcp: Prevent low rmem stalls with SO_RCVLOWAT. Arnaldo Carvalho de Melo (1): perf scripting python: Avoid declaring function pointers with a visibility attribute Axel Lin (1): ASoC: msm8916-wcd-digital: Select REGMAP_MMIO to fix build error Aya Levin (1): net: ipv6: Validate GSO SKB before finish IPv6 processing Bart Van Assche (1): scsi: scsi_transport_spi: Set RQF_PM for domain validation commands Bharat Gooty (1): PCI: iproc: Fix out-of-bound array accesses Bixuan Cui (2): mmap: fix a compiling error for 'MAP_CHECKNODE' powerpc: fix a compiling error for 'access_ok' Bjorn Helgaas (1): PCI: Bounds-check command-line resource alignment requests Björn Töpel (1): ixgbe: avoid premature Rx buffer reuse Boqun Feng (1): fcntl: Fix potential deadlock in send_sig{io, urg}() Boris Protopopov (1): Convert trailing spaces and periods in path components Brian Foster (1): xfs: flush new eof page on truncate to avoid post-eof corruption Calum Mackay (1): lockd: don't use interval-based rebinding over TCP Chen Zhou (1): selinux: Fix error return code in sel_ib_pkey_sid_slow() Chenguangli (1): scsi/hifc:Fix the bug that the system may be oops during unintall hifc module. Cheng Lin (1): nfs_common: need lock during iterate through the list Christoph Hellwig (2): nbd: fix a block_device refcount leak in nbd_release xfs: fix a missing unlock on error in xfs_fs_map_blocks Chunguang Xu (1): ext4: fix a memory leak of ext4_free_data Chunyan Zhang (1): tick/common: Touch watchdog in tick_unfreeze() on all CPUs Colin Ian King (1): PCI: Fix overflow in command-line resource alignment requests Cong Wang (1): erspan: fix version 1 check in gre_parse_header() Damien Le Moal (1): null_blk: Fix zone size initialization Dan Carpenter (1): futex: Don't enable IRQs unconditionally in put_pi_state() Daniel Scally (1): Revert "ACPI / resources: Use AE_CTRL_TERMINATE to terminate resources walks" Darrick J. Wong (12): xfs: fix realtime bitmap/summary file truncation when growing rt volume xfs: don't free rt blocks when we're doing a REMAP bunmapi call xfs: set xefi_discard when creating a deferred agfl free log intent item xfs: fix scrub flagging rtinherit even if there is no rt device xfs: fix flags argument to rmap lookup when converting shared file rmaps xfs: set the unwritten bit in rmap lookup flags in xchk_bmap_get_rmapextents xfs: fix rmap key and record comparison functions xfs: fix brainos in the refcount scrubber's rmap fragment processor vfs: remove lockdep bogosity in __sb_start_write xfs: fix the minrecs logic when dealing with inode root child blocks xfs: strengthen rmap record flags checking xfs: revert "xfs: fix rmap key and record comparison functions" Dave Wysochanski (1): NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock Dexuan Cui (1): ACPI: scan: Harden acpi_device_add() against device ID overflows Dinghao Liu (4): ext4: fix error handling code in add_new_gdb net/mlx5e: Fix memleak in mlx5e_create_l2_table_groups net/mlx5e: Fix two double free cases netfilter: nf_nat: Fix memleak in nf_nat_init Dongdong Wang (1): lwt: Disable BH too in run_lwt_bpf() Dongli Zhang (1): page_frag: Recover from memory pressure Douglas Gilbert (1): sgl_alloc_order: fix memory leak Eddy Wu (1): fork: fix copy_process(CLONE_PARENT) race with the exiting ->real_parent Eran Ben Elisha (1): net/mlx5: Fix wrong address reclaim when command interface is down Eric Auger (1): vfio/pci: Move dummy_resources_list init in vfio_pci_probe() Eric Biggers (1): ext4: fix leaking sysfs kobject after failed mount Eric Dumazet (4): tcp: select sane initial rcvq_space.space for big MSS net: avoid 32 x truesize under-estimation for tiny skbs net_sched: avoid shift-out-of-bounds in tcindex_set_parms() net_sched: reject silly cell_log in qdisc_get_rtab() Fang Lijun (3): arm64/ascend: mm: Add MAP_CHECKNODE flag to check node hugetlb arm64/ascend: mm: Fix arm32 compile warnings arm64/ascend: mm: Fix hugetlb check node error Fangrui Song (1): arm64: Change .weak to SYM_FUNC_START_WEAK_PI for arch/arm64/lib/mem*.S Florian Fainelli (1): net: Have netpoll bring-up DSA management interface Florian Westphal (4): netfilter: nf_tables: avoid false-postive lockdep splat netfilter: xt_RATEEST: reject non-null terminated string from userspace net: ip: always refragment ip defragmented packets net: fix pmtu check in nopmtudisc mode Gabriel Krisman Bertazi (2): blk-cgroup: Fix memleak on error path blk-cgroup: Pre-allocate tree node on blkg_conf_prep George Spelvin (1): random32: make prandom_u32() output unpredictable Gerald Schaefer (1): mm/userfaultfd: do not access vma->vm_mm after calling handle_userfault() Guillaume Nault (4): ipv4: Fix tos mask in inet_rtm_getroute() ipv4: Ignore ECN bits for fib lookups in fib_compute_spec_dst() netfilter: rpfilter: mask ecn bits before fib lookup udp: mask TOS bits in udp_v4_early_demux() Hanjun Guo (1): clocksource/drivers/arch_timer: Fix vdso_fix compile error for arm32 Hannes Reinecke (1): dm: avoid filesystem lookup in dm_get_dev_t() Hans de Goede (1): ACPI: scan: Make acpi_bus_get_device() clear return pointer on error Heiner Kallweit (1): net: bridge: add missing counters to ndo_get_stats64 callback Hoang Le (1): tipc: fix NULL deref in tipc_link_xmit() Huang Shijie (1): lib/genalloc: fix the overflow when size is too big Huang Ying (1): mm: fix a race during THP splitting Hugh Dickins (2): mlock: fix unevictable_pgs event counts on THP mm: fix check_move_unevictable_pages() on THP Hui Wang (1): ACPI: PNP: compare the string length in the matching_id() Hyeongseok Kim (1): dm verity: skip verity work if I/O error when system is shutting down Ido Schimmel (2): mlxsw: core: Fix memory leak on module removal mlxsw: core: Use variable timeout for EMAD retries Ilya Dryomov (1): libceph: clear con->out_msg on Policy::stateful_server faults Jakub Kicinski (1): net: vlan: avoid leaks on register_vlan_dev() failures Jamie Iles (1): bonding: wait for sysfs kobject destruction before freeing struct slave Jan Kara (8): ext4: Detect already used quota file early ext4: fix bogus warning in ext4_update_dx_flag() ext4: Protect superblock modifications with a buffer lock ext4: fix deadlock with fs freezing and EA inodes ext4: don't remount read-only with errors=continue on reboot quota: Don't overflow quota file offsets bfq: Fix computation of shallow depth ext4: fix superblock checksum failure when setting password salt Jann Horn (1): mm, slub: consider rest of partial list if acquire_slab() fails Jason A. Donenfeld (3): netfilter: use actual socket sk rather than skb sk when routing harder net: introduce skb_list_walk_safe for skb segment walking net: skbuff: disambiguate argument and member for skb_list_walk_safe helper Jeff Dike (1): virtio_net: Fix recursive call to cpus_read_lock() Jens Axboe (1): proc: don't allow async path resolution of /proc/self components Jesper Dangaard Brouer (1): netfilter: conntrack: fix reading nf_conntrack_buckets Jessica Yu (1): module: delay kobject uevent until after module init call Jiri Olsa (2): perf python scripting: Fix printable strings in python3 scripts perf tools: Add missing swap for ino_generation Johannes Thumshirn (1): block: factor out requeue handling from dispatch code Jonathan Cameron (1): ACPI: Add out of bounds and numa_off protections to pxm_to_node() Joseph Qi (1): ext4: unlock xattr_sem properly in ext4_inline_data_truncate() Jubin Zhong (1): PCI: Fix pci_slot_release() NULL pointer dereference Kaixu Xia (1): ext4: correctly report "not supported" for {usr, grp}jquota when !CONFIG_QUOTA Keqian Zhu (1): clocksource/drivers/arm_arch_timer: Correct fault programming of CNTKCTL_EL1.EVNTI Kirill Tkhai (1): mm: move nr_deactivate accounting to shrink_active_list() Lang Dai (1): uio: free uio id after uio file node is freed Lecopzer Chen (2): kasan: fix unaligned address is unhandled in kasan_remove_zero_shadow kasan: fix incorrect arguments passing in kasan_add_zero_shadow Lee Duncan (1): scsi: libiscsi: Fix NOP race condition Lee Jones (1): Fonts: Replace discarded const qualifier Leo Yan (1): perf lock: Don't free "lock_seq_stat" if read_count isn't zero Leon Romanovsky (1): net/mlx5: Properly convey driver version to firmware Lijie (1): config: enable CONFIG_NVME_MULTIPATH by default Liu Shixin (3): config: set default value of CONFIG_TEST_FREE_PAGES mm: memcontrol: add struct mem_cgroup_extension mm: fix kabi broken Lorenzo Pieralisi (1): asm-generic/io.h: Fix !CONFIG_GENERIC_IOMAP pci_iounmap() implementation Lu Jialin (1): fs: fix files.usage bug when move tasks Luc Van Oostenryck (1): xsk: Fix xsk_poll()'s return type Luo Meng (2): ext4: fix invalid inode checksum fail_function: Remove a redundant mutex unlock Mao Wenan (1): net: Update window_clamp if SOCK_RCVBUF is set Marc Zyngier (2): arm64: Run ARCH_WORKAROUND_1 enabling code on all CPUs genirq/irqdomain: Don't try to free an interrupt that has no mapping Mark Rutland (3): arm64: syscall: exit userspace before unmasking exceptions arm64: module: rework special section handling arm64: module/ftrace: intialize PLT at load time Martin Wilck (1): scsi: core: Fix VPD LUN ID designator priorities Mateusz Nosek (1): futex: Fix incorrect should_fail_futex() handling Matteo Croce (4): Revert "kernel/reboot.c: convert simple_strtoul to kstrtoint" reboot: fix overflow parsing reboot cpu number ipv6: create multicast route with RTPROT_KERNEL ipv6: set multicast flag on the multicast route Matthew Wilcox (Oracle) (1): mm/page_alloc.c: fix freeing non-compound pages Maurizio Lombardi (2): scsi: target: remove boilerplate code scsi: target: fix hang when multiple threads try to destroy the same iscsi session Maxim Mikityanskiy (1): net/tls: Protect from calling tls_dev_del for TLS RX twice Miaohe Lin (1): mm/hugetlb: fix potential missing huge page size info Michael Schaller (1): efivarfs: Replace invalid slashes with exclamation marks in dentries. Mike Christie (1): scsi: target: iscsi: Fix cmd abort fabric stop race Mike Galbraith (1): futex: Handle transient "ownerless" rtmutex state correctly Miklos Szeredi (1): fuse: fix page dereference after free Mikulas Patocka (3): dm integrity: fix the maximum number of arguments dm integrity: fix flush with external metadata device dm integrity: fix a crash if "recalculate" used without "internal_hash" Ming Lei (2): scsi: core: Don't start concurrent async scan on same host block: fix use-after-free in disk_part_iter_next Minwoo Im (1): nvme: free sq/cq dbbuf pointers when dbbuf set fails Miroslav Benes (1): module: set MODULE_STATE_GOING state when a module fails to load Moshe Shemesh (2): net/mlx4_en: Avoid scheduling restart task if it is already running net/mlx4_en: Handle TX error CQE Naoya Horiguchi (1): mm, hwpoison: double-check page count in __get_any_page() Naveen N. Rao (1): ftrace: Fix updating FTRACE_FL_TRAMP Neal Cardwell (1): tcp: fix cwnd-limited bug for TSO deferral where we send nothing NeilBrown (1): NFS: switch nfsiod to be an UNBOUND workqueue. Nicholas Piggin (1): mm: fix exec activate_mm vs TLB shootdown and lazy tlb switching race Oleg Nesterov (1): ptrace: fix task_join_group_stop() for the case when current is traced Oliver Herms (1): IPv6: Set SIT tunnel hard_header_len to zero Paul Moore (1): selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling Paulo Alcantara (1): cifs: fix potential use-after-free in cifs_echo_request() Peng Liu (1): sched/deadline: Fix sched_dl_global_validate() Peter Zijlstra (2): serial: pl011: Fix lockdep splat when handling magic-sysrq interrupt perf: Fix get_recursion_context() Petr Malat (1): sctp: Fix COMM_LOST/CANT_STR_ASSOC err reporting on big-endian platforms Qian Cai (1): mm/swapfile: do not sleep with a spin lock held Qiujun Huang (2): ring-buffer: Return 0 on success from ring_buffer_resize() tracing: Fix out of bounds write in get_trace_buf Rafael J. Wysocki (1): driver core: Extend device_is_dependent() Randy Dunlap (1): net: sched: prevent invalid Scell_log shift count Ritika Srivastava (2): block: Return blk_status_t instead of errno codes block: better deal with the delayed not supported case in blk_cloned_rq_check_limits Ronnie Sahlberg (1): cifs: handle -EINTR in cifs_setattr Ryan Sharpelletti (1): tcp: only postpone PROBE_RTT if RTT is < current min_rtt estimate Sami Tolvanen (1): arm64: lse: fix LSE atomics with LLVM's integrated assembler Sean Tranchetti (1): net: ipv6: fib: flush exceptions when purging route Shakeel Butt (2): mm: swap: fix vmstats for huge pages mm: swap: memcg: fix memcg stats for huge pages Shijie Luo (1): mm: mempolicy: fix potential pte_unmap_unlock pte error Shin'ichiro Kawasaki (1): uio: Fix use-after-free in uio_unregister_device() Stefano Brivio (1): netfilter: ipset: Update byte and packet counters regardless of whether they match Steven Rostedt (VMware) (4): ring-buffer: Fix recursion protection transitions between interrupt context ftrace: Fix recursion check for NMI test ftrace: Handle tracing when switching between context tracing: Fix userstacktrace option for instances Subash Abhinov Kasiviswanathan (2): netfilter: x_tables: Switch synchronization to RCU netfilter: x_tables: Update remaining dereference to RCU Sven Eckelmann (2): vxlan: Add needed_headroom for lower device vxlan: Copy needed_tailroom from lowerdev Sylwester Dziedziuch (2): i40e: Fix removing driver while bare-metal VFs pass traffic i40e: Fix Error I40E_AQ_RC_EINVAL when removing VFs Takashi Iwai (1): libata: transport: Use scnprintf() for avoiding potential buffer overflow Tariq Toukan (1): net: Disable NETIF_F_HW_TLS_RX when RXCSUM is disabled Thomas Gleixner (12): sched: Reenable interrupts in do_sched_yield() futex: Move futex exit handling into futex code futex: Replace PF_EXITPIDONE with a state exit/exec: Seperate mm_release() futex: Split futex_mm_release() for exit/exec futex: Set task::futex_state to DEAD right after handling futex exit futex: Mark the begin of futex exit explicitly futex: Sanitize exit state handling futex: Provide state handling for exec() as well futex: Add mutex around futex exit futex: Provide distinct return value when owner is exiting futex: Prevent exit livelock Tianyue Ren (1): selinux: fix error initialization in inode_doinit_with_dentry() Trond Myklebust (5): SUNRPC: xprt_load_transport() needs to support the netid "rdma6" NFSv4: Fix a pNFS layout related use-after-free race when freeing the inode pNFS: Mark layout for return if return-on-close was not sent NFS/pNFS: Fix a leak of the layout 'plh_outstanding' counter NFS: nfs_igrab_and_active must first reference the superblock Tung Nguyen (1): tipc: fix memory leak caused by tipc_buf_append() Tyler Hicks (1): tpm: efi: Don't create binary_bios_measurements file for an empty log Uwe Kleine-König (1): spi: fix resource leak for drivers without .remove callback Vadim Fedorenko (1): net/tls: missing received data after fast remote close Valentin Schneider (1): arm64: topology: Stop using MPIDR for topology information Vamshi K Sthambamkadi (1): efivarfs: fix memory leak in efivarfs_create() Vasily Averin (2): netfilter: ipset: fix shift-out-of-bounds in htable_bits() net: drop bogus skb with CHECKSUM_PARTIAL and offset beyond end of trimmed packet Vincenzo Frascino (1): arm64: lse: Fix LSE atomics with LLVM Vladyslav Tarasiuk (1): net/mlx5: Disable QoS when min_rates on all VFs are zero Wang Hai (4): devlink: Add missing genlmsg_cancel() in devlink_nl_sb_port_pool_fill() inet_diag: Fix error path to cancel the meseage in inet_req_diag_fill() tipc: fix memory leak in tipc_topsrv_start() ipv6: addrlabel: fix possible memory leak in ip6addrlbl_net_init Wang Wensheng (1): sbsa_gwdt: Add WDIOF_PRETIMEOUT flag to watchdog_info at defination Wei Li (1): irqchip/gic-v3: Fix compiling error on ARM32 with GICv3 Wei Yang (1): mm: thp: don't need care deferred split queue in memcg charge move path Weilong Chen (1): hugetlbfs: Add dependency with ascend memory features Wengang Wang (1): ocfs2: initialize ip_next_orphan Will Deacon (3): arm64: psci: Avoid printing in cpu_psci_cpu_die() arm64: pgtable: Fix pte_accessible() arm64: pgtable: Ensure dirty bit is preserved across pte_wrprotect() Willem de Bruijn (1): sock: set sk_err to ee_errno on dequeue from errq Wu Bo (1): scsi: libiscsi: fix task hung when iscsid deamon exited Xie XiuQi (1): cputime: fix undefined reference to get_idle_time when CONFIG_PROC_FS disabled Xin Long (1): sctp: change to hold/put transport for proto_unreach_timer Xiongfeng Wang (1): arm64: fix compile error when CONFIG_HOTPLUG_CPU is disabled Xiubo Li (1): nbd: make the config put is called before the notifying the waiter Xu Qiang (4): NMI: Enable arm-pmu interrupt as NMI in Acensed. irqchip/gic-v3-its: Unconditionally save/restore the ITS state on suspend. irqchip/irq-gic-v3: Add workaround bindings in device tree to init ts core GICR. Document: In the binding document, add enable-init-all-GICR field description. Yang Shi (6): mm: list_lru: set shrinker map bit when child nr_items is not zero mm: thp: extract split_queue_* into a struct mm: move mem_cgroup_uncharge out of __page_cache_release() mm: shrinker: make shrinker not depend on memcg kmem mm: thp: make deferred split shrinker memcg aware mm: vmscan: protect shrinker idr replace with CONFIG_MEMCG Yang Yingliang (5): arm64: arch_timer: only do cntvct workaround on VDSO path on D05 armv7 fix compile error Kconfig: disable KTASK by default futex: sched: fix kabi broken in task_struct futex: sched: fix UAF when free futex_exit_mutex in free_task() Yi-Hung Wei (1): ip_tunnels: Set tunnel option flag when tunnel metadata is present Yicong Yang (1): libfs: fix error cast of negative value in simple_attr_write() Yu Kuai (2): blk-cgroup: prevent rcu_sched detected stalls warnings in blkg_destroy_all() blk-throttle: don't check whether or not lower limit is valid if CONFIG_BLK_DEV_THROTTLING_LOW is off Yufen Yu (2): bdi: fix compiler error in bdi_get_dev_name() scsi: do quiesce for enclosure driver Yunfeng Ye (1): workqueue: Kick a worker based on the actual activation of delayed works Yunjian Wang (2): net: hns: fix return value check in __lb_other_process() vhost_net: fix ubuf refcount incorrectly when sendmsg fails Yunsheng Lin (1): net: sch_generic: fix the missing new qdisc assignment bug Zeng Tao (1): time: Prevent undefined behaviour in timespec64_to_ns() Zhang Changzhong (2): ah6: fix error return code in ah6_input() net: bridge: vlan: fix error return code in __vlan_add() Zhao Heming (2): md/cluster: block reshape with remote resync job md/cluster: fix deadlock when node is doing resync job Zhengyuan Liu (3): arm64/mm: return cpu_all_mask when node is NUMA_NO_NODE hifc: remove unnecessary __init specifier mmap: fix a compiling error for 'MAP_PA32BIT' Zhou Guanghui (2): memcg/ascend: Check sysctl oom config for memcg oom memcg/ascend: enable kmem cgroup by default for ascend Zqiang (1): kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled chenmaodong (1): fix virtio_gpu use-after-free while creating dumb j.nixdorf(a)avm.de (1): net: sunrpc: interpret the return value of kstrtou32 correctly lijinlin (1): ext4: add ext3 report error to userspace by netlink miaoyubo (1): KVM: Enable PUD huge mappings only on 1620 yangerkun (1): ext4: fix bug for rename with RENAME_WHITEOUT zhuoliang zhang (1): net: xfrm: fix a race condition during allocing spi .../interrupt-controller/arm,gic-v3.txt | 4 + Documentation/networking/bonding.txt | 16 +- arch/Kconfig | 7 + arch/alpha/include/uapi/asm/mman.h | 2 + arch/arm/kernel/perf_event_v7.c | 16 +- arch/arm64/Kconfig | 2 + arch/arm64/configs/euleros_defconfig | 1 + arch/arm64/configs/hulk_defconfig | 1 + arch/arm64/configs/openeuler_defconfig | 3 +- arch/arm64/include/asm/atomic_lse.h | 76 ++- arch/arm64/include/asm/cpufeature.h | 4 + arch/arm64/include/asm/lse.h | 6 +- arch/arm64/include/asm/memory.h | 11 + arch/arm64/include/asm/numa.h | 3 + arch/arm64/include/asm/pgtable.h | 34 +- arch/arm64/kernel/cpu_errata.c | 8 + arch/arm64/kernel/cpufeature.c | 2 +- arch/arm64/kernel/ftrace.c | 50 +- arch/arm64/kernel/module.c | 47 +- arch/arm64/kernel/psci.c | 5 +- arch/arm64/kernel/setup.c | 5 +- arch/arm64/kernel/syscall.c | 2 +- arch/arm64/kernel/topology.c | 43 +- arch/arm64/lib/memcpy.S | 3 +- arch/arm64/lib/memmove.S | 3 +- arch/arm64/lib/memset.S | 3 +- arch/arm64/mm/init.c | 17 +- arch/arm64/mm/numa.c | 6 +- arch/mips/include/uapi/asm/mman.h | 2 + arch/parisc/include/uapi/asm/mman.h | 2 + arch/powerpc/include/asm/uaccess.h | 4 +- arch/powerpc/include/uapi/asm/mman.h | 2 + arch/sparc/include/uapi/asm/mman.h | 2 + arch/x86/configs/hulk_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + arch/xtensa/include/uapi/asm/mman.h | 2 + block/bfq-iosched.c | 8 +- block/blk-cgroup.c | 30 +- block/blk-core.c | 39 +- block/blk-mq.c | 29 +- block/blk-throttle.c | 6 + block/genhd.c | 9 +- drivers/acpi/acpi_pnp.c | 3 + drivers/acpi/internal.h | 2 +- drivers/acpi/numa.c | 2 +- drivers/acpi/resource.c | 2 +- drivers/acpi/scan.c | 17 +- drivers/ata/libata-transport.c | 10 +- drivers/base/core.c | 21 +- drivers/block/nbd.c | 3 +- drivers/block/null_blk_zoned.c | 20 +- drivers/char/Kconfig | 2 +- drivers/char/random.c | 1 - drivers/char/tpm/eventlog/efi.c | 5 + drivers/clocksource/arm_arch_timer.c | 36 +- drivers/firmware/efi/efi.c | 4 - drivers/firmware/efi/libstub/arm-stub.c | 3 - drivers/gpu/drm/virtio/virtgpu_gem.c | 4 +- drivers/irqchip/irq-gic-v3-its.c | 30 +- drivers/irqchip/irq-gic-v3.c | 18 +- drivers/md/dm-bufio.c | 6 + drivers/md/dm-integrity.c | 58 ++- drivers/md/dm-snap.c | 24 + drivers/md/dm-table.c | 15 +- drivers/md/dm-verity-target.c | 12 +- drivers/md/md-cluster.c | 67 +-- drivers/md/md.c | 14 +- drivers/mtd/hisilicon/sfc/hrd_sfc_driver.c | 4 +- drivers/net/bonding/bond_main.c | 92 ++-- drivers/net/bonding/bond_netlink.c | 14 + drivers/net/bonding/bond_options.c | 71 ++- drivers/net/bonding/bond_procfs.c | 2 + drivers/net/bonding/bond_sysfs.c | 13 + drivers/net/bonding/bond_sysfs_slave.c | 18 +- .../net/ethernet/hisilicon/hns/hns_ethtool.c | 4 + drivers/net/ethernet/intel/i40e/i40e.h | 4 + drivers/net/ethernet/intel/i40e/i40e_main.c | 32 +- .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 30 +- drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 24 +- .../net/ethernet/mellanox/mlx4/en_netdev.c | 21 +- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 40 +- drivers/net/ethernet/mellanox/mlx4/mlx4_en.h | 12 +- .../net/ethernet/mellanox/mlx5/core/en_fs.c | 3 + .../net/ethernet/mellanox/mlx5/core/eswitch.c | 15 +- .../net/ethernet/mellanox/mlx5/core/main.c | 6 +- .../ethernet/mellanox/mlx5/core/pagealloc.c | 21 +- drivers/net/ethernet/mellanox/mlxsw/core.c | 8 +- drivers/net/geneve.c | 3 +- drivers/net/macvlan.c | 5 +- drivers/net/virtio_net.c | 12 +- drivers/net/vxlan.c | 3 + drivers/nvme/host/pci.c | 15 + drivers/pci/controller/pcie-iproc.c | 10 +- drivers/pci/pci.c | 14 +- drivers/pci/slot.c | 6 +- drivers/scsi/huawei/hifc/unf_common.h | 2 +- drivers/scsi/huawei/hifc/unf_scsi.c | 23 + drivers/scsi/libiscsi.c | 33 +- drivers/scsi/scsi_lib.c | 126 +++-- drivers/scsi/scsi_scan.c | 11 +- drivers/scsi/scsi_transport_spi.c | 27 +- drivers/spi/spi.c | 19 +- drivers/target/iscsi/iscsi_target.c | 96 ++-- drivers/target/iscsi/iscsi_target.h | 1 - drivers/target/iscsi/iscsi_target_configfs.c | 5 +- drivers/target/iscsi/iscsi_target_login.c | 5 +- drivers/tty/serial/amba-pl011.c | 11 +- drivers/tty/serial/serial_core.c | 4 + drivers/uio/uio.c | 12 +- drivers/vfio/pci/vfio_pci.c | 3 +- drivers/vhost/net.c | 6 +- drivers/watchdog/sbsa_gwdt.c | 6 +- fs/cifs/cifs_unicode.c | 8 +- fs/cifs/connect.c | 2 + fs/cifs/inode.c | 13 +- fs/efivarfs/inode.c | 2 + fs/efivarfs/super.c | 3 + fs/exec.c | 17 +- fs/ext4/ext4.h | 6 +- fs/ext4/ext4_jbd2.c | 1 - fs/ext4/file.c | 1 + fs/ext4/inline.c | 1 + fs/ext4/inode.c | 31 +- fs/ext4/ioctl.c | 3 + fs/ext4/mballoc.c | 1 + fs/ext4/namei.c | 23 +- fs/ext4/resize.c | 8 +- fs/ext4/super.c | 32 +- fs/ext4/xattr.c | 1 + fs/fcntl.c | 10 +- fs/filescontrol.c | 73 +-- fs/fuse/dev.c | 28 +- fs/hugetlbfs/inode.c | 2 +- fs/libfs.c | 6 +- fs/lockd/host.c | 20 +- fs/nfs/inode.c | 2 +- fs/nfs/internal.h | 12 +- fs/nfs/nfs4proc.c | 2 +- fs/nfs/nfs4super.c | 2 +- fs/nfs/pnfs.c | 40 +- fs/nfs/pnfs.h | 5 + fs/nfs_common/grace.c | 6 +- fs/ocfs2/super.c | 1 + fs/proc/generic.c | 55 ++- fs/proc/internal.h | 7 + fs/proc/proc_net.c | 16 - fs/proc/self.c | 7 + fs/quota/quota_tree.c | 8 +- fs/super.c | 33 +- fs/xfs/libxfs/xfs_alloc.c | 1 + fs/xfs/libxfs/xfs_bmap.c | 19 +- fs/xfs/libxfs/xfs_bmap.h | 2 +- fs/xfs/libxfs/xfs_rmap.c | 2 +- fs/xfs/scrub/bmap.c | 10 +- fs/xfs/scrub/btree.c | 45 +- fs/xfs/scrub/inode.c | 3 +- fs/xfs/scrub/refcount.c | 8 +- fs/xfs/xfs_iops.c | 10 + fs/xfs/xfs_pnfs.c | 2 +- fs/xfs/xfs_rtalloc.c | 10 +- include/asm-generic/io.h | 39 +- include/linux/backing-dev.h | 1 + include/linux/blkdev.h | 1 + include/linux/compat.h | 2 - include/linux/dm-bufio.h | 1 + include/linux/efi.h | 7 - include/linux/futex.h | 39 +- include/linux/huge_mm.h | 9 + include/linux/hugetlb.h | 10 +- include/linux/if_team.h | 5 +- include/linux/memblock.h | 3 - include/linux/memcontrol.h | 32 +- include/linux/mm.h | 2 + include/linux/mm_types.h | 1 + include/linux/mman.h | 15 + include/linux/mmzone.h | 8 + include/linux/netfilter/x_tables.h | 5 +- include/linux/netfilter_ipv4.h | 2 +- include/linux/netfilter_ipv6.h | 2 +- include/linux/netpoll.h | 10 +- include/linux/prandom.h | 36 +- include/linux/proc_fs.h | 8 +- include/linux/sched.h | 5 +- include/linux/sched/cputime.h | 5 + include/linux/sched/mm.h | 6 +- include/linux/shrinker.h | 7 +- include/linux/skbuff.h | 5 + include/linux/sunrpc/xprt.h | 1 + include/linux/time64.h | 4 + include/net/bond_options.h | 1 + include/net/bonding.h | 14 +- include/net/ip_tunnels.h | 7 +- include/net/red.h | 4 +- include/net/tls.h | 6 + include/scsi/libiscsi.h | 3 + include/target/iscsi/iscsi_target_core.h | 2 +- include/uapi/asm-generic/mman.h | 1 + include/uapi/linux/if_link.h | 1 + init/Kconfig | 2 +- kernel/events/internal.h | 2 +- kernel/exit.c | 35 +- kernel/fail_function.c | 5 +- kernel/fork.c | 61 ++- kernel/futex.c | 291 +++++++++-- kernel/irq/irqdomain.c | 11 +- kernel/kthread.c | 3 +- kernel/module.c | 6 +- kernel/reboot.c | 28 +- kernel/sched/core.c | 6 +- kernel/sched/cputime.c | 6 + kernel/sched/deadline.c | 5 +- kernel/sched/sched.h | 42 +- kernel/signal.c | 19 +- kernel/time/itimer.c | 4 - kernel/time/tick-common.c | 2 + kernel/time/timer.c | 7 - kernel/trace/ftrace.c | 22 +- kernel/trace/ring_buffer.c | 66 ++- kernel/trace/trace.c | 9 +- kernel/trace/trace.h | 32 +- kernel/trace/trace_selftest.c | 9 +- kernel/workqueue.c | 13 +- lib/Kconfig.debug | 9 + lib/Makefile | 1 + lib/fonts/font_10x18.c | 2 +- lib/fonts/font_6x10.c | 2 +- lib/fonts/font_6x11.c | 2 +- lib/fonts/font_7x14.c | 2 +- lib/fonts/font_8x16.c | 2 +- lib/fonts/font_8x8.c | 2 +- lib/fonts/font_acorn_8x8.c | 2 +- lib/fonts/font_mini_4x6.c | 2 +- lib/fonts/font_pearl_8x8.c | 2 +- lib/fonts/font_sun12x22.c | 2 +- lib/fonts/font_sun8x16.c | 2 +- lib/genalloc.c | 25 +- lib/random32.c | 462 +++++++++++------- lib/scatterlist.c | 2 +- lib/test_free_pages.c | 42 ++ mm/huge_memory.c | 167 +++++-- mm/hugetlb.c | 5 +- mm/kasan/kasan_init.c | 23 +- mm/list_lru.c | 10 +- mm/memblock.c | 11 +- mm/memcontrol.c | 34 +- mm/memory-failure.c | 6 + mm/mempolicy.c | 6 +- mm/mlock.c | 25 +- mm/mmap.c | 27 +- mm/page_alloc.c | 9 + mm/slub.c | 2 +- mm/swap.c | 37 +- mm/swapfile.c | 4 +- mm/vmscan.c | 64 +-- net/8021q/vlan.c | 3 +- net/8021q/vlan_dev.c | 5 +- net/bridge/br_device.c | 1 + net/bridge/br_netfilter_hooks.c | 7 +- net/bridge/br_private.h | 5 +- net/bridge/br_vlan.c | 4 +- net/ceph/messenger.c | 5 + net/core/dev.c | 5 + net/core/devlink.c | 6 +- net/core/lwt_bpf.c | 8 +- net/core/net-sysfs.c | 65 ++- net/core/netpoll.c | 51 +- net/core/skbuff.c | 23 +- net/dsa/slave.c | 5 +- net/ipv4/fib_frontend.c | 2 +- net/ipv4/gre_demux.c | 2 +- net/ipv4/inet_diag.c | 4 +- net/ipv4/ip_output.c | 2 +- net/ipv4/ip_tunnel.c | 10 +- net/ipv4/netfilter.c | 12 +- net/ipv4/netfilter/arp_tables.c | 16 +- net/ipv4/netfilter/ip_tables.c | 16 +- net/ipv4/netfilter/ipt_SYNPROXY.c | 2 +- net/ipv4/netfilter/ipt_rpfilter.c | 2 +- net/ipv4/netfilter/iptable_mangle.c | 2 +- net/ipv4/netfilter/nf_nat_l3proto_ipv4.c | 2 +- net/ipv4/netfilter/nf_reject_ipv4.c | 2 +- net/ipv4/netfilter/nft_chain_route_ipv4.c | 2 +- net/ipv4/route.c | 7 +- net/ipv4/syncookies.c | 9 +- net/ipv4/tcp.c | 2 + net/ipv4/tcp_bbr.c | 2 +- net/ipv4/tcp_cong.c | 5 + net/ipv4/tcp_input.c | 6 +- net/ipv4/tcp_output.c | 9 +- net/ipv4/udp.c | 3 +- net/ipv6/addrconf.c | 3 +- net/ipv6/addrlabel.c | 26 +- net/ipv6/ah6.c | 3 +- net/ipv6/ip6_fib.c | 5 +- net/ipv6/ip6_gre.c | 16 +- net/ipv6/ip6_output.c | 40 +- net/ipv6/netfilter.c | 6 +- net/ipv6/netfilter/ip6_tables.c | 16 +- net/ipv6/netfilter/ip6table_mangle.c | 2 +- net/ipv6/netfilter/nf_nat_l3proto_ipv6.c | 2 +- net/ipv6/netfilter/nft_chain_route_ipv6.c | 2 +- net/ipv6/sit.c | 2 - net/ipv6/syncookies.c | 10 +- net/netfilter/ipset/ip_set_core.c | 3 +- net/netfilter/ipset/ip_set_hash_gen.h | 20 +- net/netfilter/ipvs/ip_vs_core.c | 4 +- net/netfilter/nf_conntrack_standalone.c | 3 + net/netfilter/nf_nat_core.c | 1 + net/netfilter/nf_tables_api.c | 3 +- net/netfilter/x_tables.c | 49 +- net/netfilter/xt_RATEEST.c | 3 + net/sched/cls_tcindex.c | 8 +- net/sched/sch_api.c | 3 +- net/sched/sch_choke.c | 2 +- net/sched/sch_generic.c | 3 + net/sched/sch_gred.c | 2 +- net/sched/sch_netem.c | 9 +- net/sched/sch_red.c | 2 +- net/sched/sch_sfq.c | 2 +- net/sctp/input.c | 4 +- net/sctp/sm_sideeffect.c | 8 +- net/sctp/transport.c | 2 +- net/sunrpc/addr.c | 2 +- net/sunrpc/xprt.c | 65 ++- net/sunrpc/xprtrdma/module.c | 1 + net/sunrpc/xprtrdma/transport.c | 1 + net/sunrpc/xprtsock.c | 4 + net/tipc/link.c | 9 +- net/tipc/msg.c | 5 +- net/tipc/topsrv.c | 10 +- net/tls/tls_device.c | 5 +- net/tls/tls_sw.c | 6 + net/xdp/xsk.c | 8 +- net/xfrm/xfrm_state.c | 8 +- security/lsm_audit.c | 7 +- security/selinux/hooks.c | 16 +- security/selinux/ibpkey.c | 4 +- sound/soc/codecs/Kconfig | 1 + tools/include/uapi/linux/if_link.h | 1 + tools/perf/builtin-lock.c | 2 +- tools/perf/util/print_binary.c | 2 +- .../scripting-engines/trace-event-python.c | 7 +- tools/perf/util/session.c | 1 + virt/kvm/arm/mmu.c | 7 + 344 files changed, 3424 insertions(+), 1701 deletions(-) create mode 100644 lib/test_free_pages.c -- 2.25.1

1 316

[PATCH 001/316] blk-cgroup: prevent rcu_sched detected stalls warnings in blkg_destroy_all()
by Cheng Jian 22 Feb '21

22 Feb '21

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 46357 CVE: NA --------------------------- test procedures: a. create 20000 cgroups, and echo "8:0 10000" to blkio.throttle.write_bps_device b. echo 1 > /sys/blocd/sda/device/delete test result: rcu: INFO: rcu_sched detected stalls on CPUs/tasks: [5/1143] rcu: 0-...0: (0 ticks this GP) idle=0f2/1/0x4000000000000000 softirq=15507/15507 fq rcu: (detected by 6, t=60012 jiffies, g=119977, q=27153) NMI backtrace for cpu 0 CPU: 0 PID: 443 Comm: bash Not tainted 4.19.95-00061-g0bcc83b30eec #63 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-p4 RIP: 0010:blk_throtl_update_limit_valid.isra.0+0x116/0x2a0 Code: 01 00 00 e8 7c dd 74 ff 48 83 bb 78 01 00 00 00 0f 85 54 01 00 00 48 8d bb 88 01 1 RSP: 0018:ffff8881030bf9f0 EFLAGS: 00000046 RAX: 0000000000000000 RBX: ffff8880b4f37080 RCX: ffffffff95da0afe RDX: dffffc0000000000 RSI: ffff888100373980 RDI: ffff8880b4f37208 RBP: ffff888100deca00 R08: ffffffff9528f951 R09: 0000000000000001 R10: ffffed10159dbf56 R11: ffff8880acedfab3 R12: ffff8880b9fda498 R13: ffff8880b9fda4f4 R14: 0000000000000050 R15: ffffffff98b622c0 FS: 00007feb51c51700(0000) GS:ffff888106200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561619547080 CR3: 0000000102bc9000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: throtl_pd_offline+0x98/0x100 blkg_destroy+0x133/0x630 ? blkcg_deactivate_policy+0x2c0/0x2c0 ? lock_timer_base+0x65/0x110 blkg_destroy_all+0x7f/0x100 blkcg_exit_queue+0x3f/0xa5 blk_exit_queue+0x69/0xa0 blk_cleanup_queue+0x226/0x360 __scsi_remove_device+0xb4/0x3c0 scsi_remove_device+0x38/0x60 sdev_store_delete+0x74/0x100 ? dev_driver_string+0xb0/0xb0 dev_attr_store+0x41/0x70 sysfs_kf_write+0x89/0xc0 kernfs_fop_write+0x1b6/0x2e0 ? sysfs_kf_bin_read+0x130/0x130 __vfs_write+0xca/0x420 ? kernel_read+0xc0/0xc0 ? __alloc_fd+0x16f/0x2d0 ? __fd_install+0x95/0x1a0 ? handle_mm_fault+0x3e0/0x560 vfs_write+0x11a/0x2f0 ksys_write+0xb9/0x1e0 ? __x64_sys_read+0x60/0x60 ? kasan_check_write+0x20/0x30 ? filp_close+0xb5/0xf0 __x64_sys_write+0x46/0x60 do_syscall_64+0xd9/0x1f0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The usage of so many blkg is very rare, however, such problem do exist in theory. In order to avoid such warnings, release 'q->queue_lock' for a while when a batch of blkg were destroyed. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Tao Hou <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- block/blk-cgroup.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index e592167449aa..c64f0afa27dc 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -364,16 +364,31 @@ static void blkg_destroy(struct blkcg_gq *blkg) */ static void blkg_destroy_all(struct request_queue *q) { +#define BLKG_DESTROY_BATCH 4096 struct blkcg_gq *blkg, *n; + int count; lockdep_assert_held(q->queue_lock); +again: + count = BLKG_DESTROY_BATCH; list_for_each_entry_safe(blkg, n, &q->blkg_list, q_node) { struct blkcg *blkcg = blkg->blkcg; spin_lock(&blkcg->lock); blkg_destroy(blkg); spin_unlock(&blkcg->lock); + /* + * If the list is too long, the loop can took a long time, + * thus relese the lock for a while when a batch of blkg + * were destroyed. + */ + if (!--count) { + spin_unlock_irq(q->queue_lock); + cond_resched(); + spin_lock_irq(q->queue_lock); + goto again; + } } q->root_blkg = NULL; -- 2.25.1

1 13

[PATCH 001/316] blk-cgroup: prevent rcu_sched detected stalls warnings in blkg_destroy_all()
by Cheng Jian 22 Feb '21

22 Feb '21

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 46357 CVE: NA --------------------------- test procedures: a. create 20000 cgroups, and echo "8:0 10000" to blkio.throttle.write_bps_device b. echo 1 > /sys/blocd/sda/device/delete test result: rcu: INFO: rcu_sched detected stalls on CPUs/tasks: [5/1143] rcu: 0-...0: (0 ticks this GP) idle=0f2/1/0x4000000000000000 softirq=15507/15507 fq rcu: (detected by 6, t=60012 jiffies, g=119977, q=27153) NMI backtrace for cpu 0 CPU: 0 PID: 443 Comm: bash Not tainted 4.19.95-00061-g0bcc83b30eec #63 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-p4 RIP: 0010:blk_throtl_update_limit_valid.isra.0+0x116/0x2a0 Code: 01 00 00 e8 7c dd 74 ff 48 83 bb 78 01 00 00 00 0f 85 54 01 00 00 48 8d bb 88 01 1 RSP: 0018:ffff8881030bf9f0 EFLAGS: 00000046 RAX: 0000000000000000 RBX: ffff8880b4f37080 RCX: ffffffff95da0afe RDX: dffffc0000000000 RSI: ffff888100373980 RDI: ffff8880b4f37208 RBP: ffff888100deca00 R08: ffffffff9528f951 R09: 0000000000000001 R10: ffffed10159dbf56 R11: ffff8880acedfab3 R12: ffff8880b9fda498 R13: ffff8880b9fda4f4 R14: 0000000000000050 R15: ffffffff98b622c0 FS: 00007feb51c51700(0000) GS:ffff888106200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561619547080 CR3: 0000000102bc9000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: throtl_pd_offline+0x98/0x100 blkg_destroy+0x133/0x630 ? blkcg_deactivate_policy+0x2c0/0x2c0 ? lock_timer_base+0x65/0x110 blkg_destroy_all+0x7f/0x100 blkcg_exit_queue+0x3f/0xa5 blk_exit_queue+0x69/0xa0 blk_cleanup_queue+0x226/0x360 __scsi_remove_device+0xb4/0x3c0 scsi_remove_device+0x38/0x60 sdev_store_delete+0x74/0x100 ? dev_driver_string+0xb0/0xb0 dev_attr_store+0x41/0x70 sysfs_kf_write+0x89/0xc0 kernfs_fop_write+0x1b6/0x2e0 ? sysfs_kf_bin_read+0x130/0x130 __vfs_write+0xca/0x420 ? kernel_read+0xc0/0xc0 ? __alloc_fd+0x16f/0x2d0 ? __fd_install+0x95/0x1a0 ? handle_mm_fault+0x3e0/0x560 vfs_write+0x11a/0x2f0 ksys_write+0xb9/0x1e0 ? __x64_sys_read+0x60/0x60 ? kasan_check_write+0x20/0x30 ? filp_close+0xb5/0xf0 __x64_sys_write+0x46/0x60 do_syscall_64+0xd9/0x1f0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The usage of so many blkg is very rare, however, such problem do exist in theory. In order to avoid such warnings, release 'q->queue_lock' for a while when a batch of blkg were destroyed. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Tao Hou <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- block/blk-cgroup.c | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c index e592167449aa..c64f0afa27dc 100644 --- a/block/blk-cgroup.c +++ b/block/blk-cgroup.c @@ -364,16 +364,31 @@ static void blkg_destroy(struct blkcg_gq *blkg) */ static void blkg_destroy_all(struct request_queue *q) { +#define BLKG_DESTROY_BATCH 4096 struct blkcg_gq *blkg, *n; + int count; lockdep_assert_held(q->queue_lock); +again: + count = BLKG_DESTROY_BATCH; list_for_each_entry_safe(blkg, n, &q->blkg_list, q_node) { struct blkcg *blkcg = blkg->blkcg; spin_lock(&blkcg->lock); blkg_destroy(blkg); spin_unlock(&blkcg->lock); + /* + * If the list is too long, the loop can took a long time, + * thus relese the lock for a while when a batch of blkg + * were destroyed. + */ + if (!--count) { + spin_unlock_irq(q->queue_lock); + cond_resched(); + spin_lock_irq(q->queue_lock); + goto again; + } } q->root_blkg = NULL; -- 2.25.1

1 4

openEuler kernel sig meeting
by openEuler conference 19 Feb '21

19 Feb '21

2 1

Re: [Dev] openEuler kernel sig meeting
by gwei3 19 Feb '21

19 Feb '21

申报议题： 2. 讨论设立sig安全联络员及如何缩短sig所属项目的CVE响应时间魏刚 ---Original--- From: "openEuler conference"<public(a)openeuler.io> Date: Thu, Feb 18, 2021 17:12 PM To: "dev"<dev(a)openeuler.org>;"kernel"<kernel(a)openeuler.org>; Subject: [Dev] openEuler kernel sig meeting 您好！ openEuler Kernel SIG 邀请您参加 2021-02-19 10:00 召开的ZOOM会议会议主题：openEuler kernel sig meeting 会议内容：1. 树莓派补丁合入openEuler 5.10 内核讨论会议链接：https://zoom.us/j/92887086207?pwd=emdmSVVFekh5eXRSczNNTngrcWYzUT09 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the ZOOM conference will be held at 2021-02-19 10:00, The subject of the conference is openEuler kernel sig meeting, Summary: 1. 树莓派补丁合入openEuler 5.10 内核讨论 You can join the meeting at https://zoom.us/j/92887086207?pwd=emdmSVVFekh5eXRSczNNTngrcWYzUT09. More information

1 0

[PATCH kernel-4.19 00/18] backport stable-4.19-174
by Yang Yingliang 09 Feb '21

09 Feb '21

Arnold Gozum (1): platform/x86: intel-vbtn: Support for tablet mode on Dell Inspiron 7352 Brian King (1): scsi: ibmvfc: Set default timeout to avoid crash during migration Christian Brauner (1): sysctl: handle overflow in proc_get_long Eric Dumazet (1): net_sched: gen_estimator: support large ewma log Felix Fietkau (1): mac80211: fix fast-rx encryption check Greg Kroah-Hartman (1): Linux 4.19.174 Hans de Goede (1): platform/x86: touchscreen_dmi: Add swap-x-y quirk for Goodix touchscreen on Estar Beauty HD tablet Javed Hasan (1): scsi: libfc: Avoid invoking response handler twice if ep is already completed Josh Poimboeuf (1): objtool: Don't fail on missing symbol table Lijun Pan (1): ibmvnic: Ensure that CRQ entry read are correctly ordered Martin Wilck (1): scsi: scsi_transport_srp: Don't block target in failfast state Michael Ellerman (1): selftests/powerpc: Only test lwm/stmw on big endian Pan Bian (1): net: dsa: bcm_sf2: put device node before return Peter Zijlstra (3): x86: __always_inline __{rd,wr}msr() kthread: Extract KTHREAD_IS_PER_CPU workqueue: Restrict affinity change to rescuer Rafael J. Wysocki (1): ACPI: thermal: Do not call acpi_thermal_check() directly Tony Lindgren (1): phy: cpcap-usb: Fix warning for missing regulator_disable Makefile | 2 +- arch/x86/include/asm/msr.h | 4 +- drivers/acpi/thermal.c | 55 +++++++++++++------ drivers/net/dsa/bcm_sf2.c | 8 ++- drivers/net/ethernet/ibm/ibmvnic.c | 6 ++ drivers/phy/motorola/phy-cpcap-usb.c | 19 +++++-- drivers/platform/x86/intel-vbtn.c | 6 ++ drivers/platform/x86/touchscreen_dmi.c | 18 ++++++ drivers/scsi/ibmvscsi/ibmvfc.c | 4 +- drivers/scsi/libfc/fc_exch.c | 16 +++++- drivers/scsi/scsi_transport_srp.c | 9 ++- include/linux/kthread.h | 3 + kernel/kthread.c | 27 ++++++++- kernel/smpboot.c | 1 + kernel/sysctl.c | 2 + kernel/workqueue.c | 9 +-- net/core/gen_estimator.c | 11 ++-- net/mac80211/rx.c | 2 + tools/objtool/elf.c | 7 ++- .../powerpc/alignment/alignment_handler.c | 5 +- 20 files changed, 168 insertions(+), 46 deletions(-) -- 2.25.1

1 18

[PATCH kernel-4.19 1/3] mmap: fix a compiling error for 'MAP_CHECKNODE'
by Yang Yingliang 09 Feb '21

09 Feb '21

From: Bixuan Cui <cuibixuan(a)huawei.com> hulk inclusion category: bugfix bugzilla: NA CVE: NA MAP_CHECKNODE was defined in uapi/asm-generic/mman.h, that was not automatically included by mm/mmap.c when building on platforms such as mips, and result in following compiling error: mm/mmap.c: In function ‘__do_mmap’: mm/mmap.c:1581:14: error: ‘MAP_CHECKNODE’ undeclared (first use in this function) if (flags & MAP_CHECKNODE) ^ mm/mmap.c:1581:14: note: each undeclared identifier is reported only once for each function it appears in scripts/Makefile.build:303: recipe for target 'mm/mmap.o' failed Fixes: 56a22a261008 ("arm64/ascend: mm: Add MAP_CHECKNODE flag to check node hugetlb") Signed-off-by: Bixuan Cui <cuibixuan(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/alpha/include/uapi/asm/mman.h | 1 + arch/mips/include/uapi/asm/mman.h | 1 + arch/parisc/include/uapi/asm/mman.h | 1 + arch/powerpc/include/uapi/asm/mman.h | 1 + arch/sparc/include/uapi/asm/mman.h | 1 + arch/xtensa/include/uapi/asm/mman.h | 1 + 6 files changed, 6 insertions(+) diff --git a/arch/alpha/include/uapi/asm/mman.h b/arch/alpha/include/uapi/asm/mman.h index b3acfc00c8ec5..1c7ce2716ad37 100644 --- a/arch/alpha/include/uapi/asm/mman.h +++ b/arch/alpha/include/uapi/asm/mman.h @@ -34,6 +34,7 @@ #define MAP_HUGETLB 0x100000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x200000/* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #define MS_ASYNC 1 /* sync memory asynchronously */ #define MS_SYNC 2 /* synchronous memory sync */ diff --git a/arch/mips/include/uapi/asm/mman.h b/arch/mips/include/uapi/asm/mman.h index 72a00c746e781..4570a54ac1d90 100644 --- a/arch/mips/include/uapi/asm/mman.h +++ b/arch/mips/include/uapi/asm/mman.h @@ -52,6 +52,7 @@ #define MAP_HUGETLB 0x80000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x100000 /* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ /* * Flags for msync diff --git a/arch/parisc/include/uapi/asm/mman.h b/arch/parisc/include/uapi/asm/mman.h index 9e989d649e854..06857eb1bee8f 100644 --- a/arch/parisc/include/uapi/asm/mman.h +++ b/arch/parisc/include/uapi/asm/mman.h @@ -28,6 +28,7 @@ #define MAP_HUGETLB 0x80000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x100000 /* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #define MS_SYNC 1 /* synchronous memory sync */ #define MS_ASYNC 2 /* sync memory asynchronously */ diff --git a/arch/powerpc/include/uapi/asm/mman.h b/arch/powerpc/include/uapi/asm/mman.h index 95f884ada96f1..24354f792b00d 100644 --- a/arch/powerpc/include/uapi/asm/mman.h +++ b/arch/powerpc/include/uapi/asm/mman.h @@ -30,6 +30,7 @@ #define MAP_STACK 0x20000 /* give out an address that is best suited for process/thread stacks */ #define MAP_HUGETLB 0x40000 /* create a huge page mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ /* Override any generic PKEY permission defines */ #define PKEY_DISABLE_EXECUTE 0x4 diff --git a/arch/sparc/include/uapi/asm/mman.h b/arch/sparc/include/uapi/asm/mman.h index 0d1881b8f30d1..214abe17f44a0 100644 --- a/arch/sparc/include/uapi/asm/mman.h +++ b/arch/sparc/include/uapi/asm/mman.h @@ -27,6 +27,7 @@ #define MAP_STACK 0x20000 /* give out an address that is best suited for process/thread stacks */ #define MAP_HUGETLB 0x40000 /* create a huge page mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #endif /* _UAPI__SPARC_MMAN_H__ */ diff --git a/arch/xtensa/include/uapi/asm/mman.h b/arch/xtensa/include/uapi/asm/mman.h index f584a590bb001..2c9d705602382 100644 --- a/arch/xtensa/include/uapi/asm/mman.h +++ b/arch/xtensa/include/uapi/asm/mman.h @@ -59,6 +59,7 @@ #define MAP_HUGETLB 0x80000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x100000 /* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #ifdef CONFIG_MMAP_ALLOW_UNINITIALIZED # define MAP_UNINITIALIZED 0x4000000 /* For anonymous mmap, memory could be * uninitialized */ -- 2.25.1

1 2

[PATCH kernel-4.19 00/38] backport stable-4.19.173
by Yang Yingliang 09 Feb '21

09 Feb '21

Andrea Righi (1): leds: trigger: fix potential deadlock with libata Baoquan He (1): kernel: kexec: remove the lock operation of system_transition_mutex Bartosz Golaszewski (1): iommu/vt-d: Don't dereference iommu_device if IOMMU_API is not built Claudiu Beznea (1): drivers: soc: atmel: add null entry at the end of at91_soc_allowed_list[] Dan Carpenter (1): can: dev: prevent potential information leak in can_fill_info() David Woodhouse (2): xen: Fix XenStore initialisation for XS_LOCAL iommu/vt-d: Gracefully handle DMAR units with no supported address widths Eyal Birger (1): xfrm: fix disable_xfrm sysctl when used on xfrm interfaces Giacinto Cifelli (1): net: usb: qmi_wwan: added support for Thales Cinterion PLSx3 modem family Greg Kroah-Hartman (1): Linux 4.19.173 Ivan Vecera (1): team: protect features update by RCU to avoid deadlock Jay Zhou (1): KVM: x86: get smi pending status correctly Johannes Berg (4): wext: fix NULL-ptr-dereference with cfg80211's lack of commit() iwlwifi: pcie: use jiffies for memory read spin time limit iwlwifi: pcie: reschedule in long-running memory reads mac80211: pause TX while changing interface type Josef Bacik (1): nbd: freeze the queue while we're adding connections Kai-Heng Feng (1): ACPI: sysfs: Prefer "compatible" modalias Kamal Heib (1): RDMA/cxgb4: Fix the reported max_recv_sge value Koen Vandeputte (1): ARM: dts: imx6qdl-gw52xx: fix duplicate regulator naming Laurent Badel (1): PM: hibernate: flush swap writer after marking Like Xu (1): KVM: x86/pmu: Fix HW_REF_CPU_CYCLES event pseudo-encoding in intel_arch_events[] Lorenzo Bianconi (2): mt7601u: fix kernel crash unplugging the device mt7601u: fix rx buffer refcounting Max Krummenacher (1): ARM: imx: build suspend-imx6.S with arm instruction set Pablo Neira Ayuso (1): netfilter: nft_dynset: add timeout extension to template Pan Bian (2): NFC: fix resource leak when target index is invalid NFC: fix possible resource leak Pengcheng Yang (1): tcp: fix TLP timer not set when CA_STATE changes from DISORDER to OPEN Roger Pau Monne (2): xen/privcmd: allow fetching resource sizes xen-blkfront: allow discard-* nodes to be optional Roi Dayan (1): net/mlx5: Fix memory leak on flow table creation error flow Sean Young (1): media: rc: ensure that uevent can be read directly after rc device register Shmulik Ladkani (1): xfrm: Fix oops in xfrm_replay_advance_bmp Sudeep Holla (1): drivers: soc: atmel: Avoid calling at91_soc_init on non AT91 SoCs Takashi Iwai (1): ALSA: hda/via: Apply the workaround generically for Clevo machines Takeshi Misawa (1): rxrpc: Fix memory leak in rxrpc_lookup_local Trond Myklebust (1): pNFS/NFSv4: Fix a layout segment leak in pnfs_layout_process() Makefile | 2 +- arch/arm/boot/dts/imx6qdl-gw52xx.dtsi | 2 +- arch/arm/mach-imx/suspend-imx6.S | 1 + arch/x86/kvm/pmu_intel.c | 2 +- arch/x86/kvm/x86.c | 5 +++ drivers/acpi/device_sysfs.c | 20 +++------ drivers/block/nbd.c | 8 ++++ drivers/block/xen-blkfront.c | 20 +++------ drivers/infiniband/hw/cxgb4/qp.c | 2 +- drivers/iommu/dmar.c | 45 +++++++++++++------ drivers/leds/led-triggers.c | 10 +++-- drivers/media/rc/rc-main.c | 4 +- drivers/net/can/dev.c | 2 +- .../net/ethernet/mellanox/mlx5/core/fs_core.c | 1 + drivers/net/team/team.c | 6 +-- drivers/net/usb/qmi_wwan.c | 1 + .../net/wireless/intel/iwlwifi/pcie/trans.c | 14 +++--- drivers/net/wireless/mediatek/mt7601u/dma.c | 5 +-- drivers/soc/atmel/soc.c | 13 ++++++ drivers/xen/privcmd.c | 25 ++++++++--- drivers/xen/xenbus/xenbus_probe.c | 31 +++++++++++++ fs/nfs/pnfs.c | 1 + include/linux/intel-iommu.h | 2 + include/net/tcp.h | 2 +- kernel/kexec_core.c | 2 - kernel/power/swap.c | 2 +- net/ipv4/tcp_input.c | 10 +++-- net/ipv4/tcp_recovery.c | 5 ++- net/mac80211/ieee80211_i.h | 1 + net/mac80211/iface.c | 6 +++ net/netfilter/nft_dynset.c | 4 +- net/nfc/netlink.c | 1 + net/nfc/rawsock.c | 2 +- net/rxrpc/call_accept.c | 1 + net/wireless/wext-core.c | 5 ++- net/xfrm/xfrm_input.c | 2 +- net/xfrm/xfrm_policy.c | 4 +- sound/pci/hda/patch_via.c | 2 +- 38 files changed, 183 insertions(+), 88 deletions(-) -- 2.25.1

1 38

[PATCH openEuler-1.0-LTS 1/2] nbd: Fix memory leak in nbd_add_socket
by Yang Yingliang 07 Feb '21

07 Feb '21

From: Zheng Bin <zhengbin13(a)huawei.com> stable inclusion from linux-4.19.133 commit 306290bad932950adccfbf99c27b70c105c2c183 -------------------------------- [ Upstream commit 579dd91ab3a5446b148e7f179b6596b270dace46 ] When adding first socket to nbd, if nsock's allocation failed, the data structure member "config->socks" was reallocated, but the data structure member "config->num_connections" was not updated. A memory leak will occur then because the function "nbd_config_put" will free "config->socks" only when "config->num_connections" is not zero. Fixes: 03bf73c315ed ("nbd: prevent memory leak") Reported-by: syzbot+934037347002901b8d2a(a)syzkaller.appspotmail.com Signed-off-by: Zheng Bin <zhengbin13(a)huawei.com> Reviewed-by: Eric Biggers <ebiggers(a)google.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/block/nbd.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 49f98b9b2777..97fcb040056c 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -993,25 +993,26 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, test_bit(NBD_RT_BOUND, &config->runtime_flags))) { dev_err(disk_to_dev(nbd->disk), "Device being setup by another task"); - sockfd_put(sock); - return -EBUSY; + err = -EBUSY; + goto put_socket; + } + + nsock = kzalloc(sizeof(*nsock), GFP_KERNEL); + if (!nsock) { + err = -ENOMEM; + goto put_socket; } socks = krealloc(config->socks, (config->num_connections + 1) * sizeof(struct nbd_sock *), GFP_KERNEL); if (!socks) { - sockfd_put(sock); - return -ENOMEM; + kfree(nsock); + err = -ENOMEM; + goto put_socket; } config->socks = socks; - nsock = kzalloc(sizeof(struct nbd_sock), GFP_KERNEL); - if (!nsock) { - sockfd_put(sock); - return -ENOMEM; - } - nsock->fallback_index = -1; nsock->dead = false; mutex_init(&nsock->tx_lock); @@ -1023,6 +1024,10 @@ static int nbd_add_socket(struct nbd_device *nbd, unsigned long arg, atomic_inc(&config->live_connections); return 0; + +put_socket: + sockfd_put(sock); + return err; } static int nbd_reconnect_socket(struct nbd_device *nbd, unsigned long arg) -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/7] futex: Ensure the correct return value from futex_lock_pi()
by Yang Yingliang 04 Feb '21

04 Feb '21

From: Thomas Gleixner <tglx(a)linutronix.de> stable inclusion from linux-4.19.172 commit 72f38fffa4758b878f819f8a47761b3f03443f36 CVE: CVE-2021-3347 -------------------------------- commit 12bb3f7f1b03d5913b3f9d4236a488aa7774dfe9 upstream In case that futex_lock_pi() was aborted by a signal or a timeout and the task returned without acquiring the rtmutex, but is the designated owner of the futex due to a concurrent futex_unlock_pi() fixup_owner() is invoked to establish consistent state. In that case it invokes fixup_pi_state_owner() which in turn tries to acquire the rtmutex again. If that succeeds then it does not propagate this success to fixup_owner() and futex_lock_pi() returns -EINTR or -ETIMEOUT despite having the futex locked. Return success from fixup_pi_state_owner() in all cases where the current task owns the rtmutex and therefore the futex and propagate it correctly through fixup_owner(). Fixup the other callsite which does not expect a positive return value. Fixes: c1e2f0eaf015 ("futex: Avoid violating the 10th rule of futex") Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Acked-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/futex.c | 32 ++++++++++++++++---------------- 1 file changed, 16 insertions(+), 16 deletions(-) diff --git a/kernel/futex.c b/kernel/futex.c index 28b321e23053..ca9389bd110f 100644 --- a/kernel/futex.c +++ b/kernel/futex.c @@ -2414,8 +2414,8 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, } if (__rt_mutex_futex_trylock(&pi_state->pi_mutex)) { - /* We got the lock after all, nothing to fix. */ - ret = 0; + /* We got the lock. pi_state is correct. Tell caller. */ + ret = 1; goto out_unlock; } @@ -2431,7 +2431,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, * We raced against a concurrent self; things are * already fixed up. Nothing to do. */ - ret = 0; + ret = 1; goto out_unlock; } newowner = argowner; @@ -2477,7 +2477,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, raw_spin_unlock(&newowner->pi_lock); raw_spin_unlock_irq(&pi_state->pi_mutex.wait_lock); - return 0; + return argowner == current; /* * In order to reschedule or handle a page fault, we need to drop the @@ -2519,7 +2519,7 @@ static int fixup_pi_state_owner(u32 __user *uaddr, struct futex_q *q, * Check if someone else fixed it for us: */ if (pi_state->owner != oldowner) { - ret = 0; + ret = argowner == current; goto out_unlock; } @@ -2552,8 +2552,6 @@ static long futex_wait_restart(struct restart_block *restart); */ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked) { - int ret = 0; - if (locked) { /* * Got the lock. We might not be the anticipated owner if we @@ -2564,8 +2562,8 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked) * stable state, anything else needs more attention. */ if (q->pi_state->owner != current) - ret = fixup_pi_state_owner(uaddr, q, current); - goto out; + return fixup_pi_state_owner(uaddr, q, current); + return 1; } /* @@ -2576,10 +2574,8 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked) * Another speculative read; pi_state->owner == current is unstable * but needs our attention. */ - if (q->pi_state->owner == current) { - ret = fixup_pi_state_owner(uaddr, q, NULL); - goto out; - } + if (q->pi_state->owner == current) + return fixup_pi_state_owner(uaddr, q, NULL); /* * Paranoia check. If we did not take the lock, then we should not be @@ -2592,8 +2588,7 @@ static int fixup_owner(u32 __user *uaddr, struct futex_q *q, int locked) q->pi_state->owner); } -out: - return ret ? ret : locked; + return 0; } /** @@ -3315,7 +3310,7 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, if (q.pi_state && (q.pi_state->owner != current)) { spin_lock(q.lock_ptr); ret = fixup_pi_state_owner(uaddr2, &q, current); - if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current) { + if (ret < 0 && rt_mutex_owner(&q.pi_state->pi_mutex) == current) { pi_state = q.pi_state; get_pi_state(pi_state); } @@ -3325,6 +3320,11 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, */ put_pi_state(q.pi_state); spin_unlock(q.lock_ptr); + /* + * Adjust the return value. It's either -EFAULT or + * success (1) but the caller expects 0 for success. + */ + ret = ret < 0 ? ret : 0; } } else { struct rt_mutex *pi_mutex; -- 2.25.1

1 6