- Kernel - mailweb.openeuler.org

[PATCH master] scsi: csiostor: Fix memory leak in csio_wr_eq_destroy()
by Jianglei Nie 12 Dec '21

12 Dec '21

openEuler inclusion category: bugfix bugzilla: NA CVE: NA Line 715 (#1) calls mempool_alloc() to allocate an element from a specific memory pool. When some errors occur, line 727 (#2) frees this memory pool but line 731 (#3) does not free it, which will lead to a memory leak. We can fix it by calling mempool_free() when the cbfn is not equal to NULL and before the function returns 0 in line 732 (#3). 705 static int 706 csio_wr_eq_destroy(struct csio_hw *hw, void *priv, int eq_idx, 707 void (*cbfn) (struct csio_hw *, struct csio_mb *)) 708 { 710 struct csio_mb *mbp; 715 mbp = mempool_alloc(hw->mb_mempool, GFP_ATOMIC); // #1: allocate memory pool 716 if (!mbp) 717 return -ENOMEM; 725 rv = csio_mb_issue(hw, mbp); 726 if (rv != 0) { 727 mempool_free(mbp, hw->mb_mempool); // #2: free memory pool 728 return rv; 729 } 731 if (cbfn != NULL) 732 return 0; // #3: missing free 734 return csio_wr_eq_destroy_rsp(hw, mbp, eq_idx); 735 } Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> --- drivers/scsi/csiostor/csio_wr.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/scsi/csiostor/csio_wr.c b/drivers/scsi/csiostor/csio_wr.c index fe0355c964bc..7dcc4fda0483 100644 --- a/drivers/scsi/csiostor/csio_wr.c +++ b/drivers/scsi/csiostor/csio_wr.c @@ -728,8 +728,10 @@ csio_wr_eq_destroy(struct csio_hw *hw, void *priv, int eq_idx, return rv; } - if (cbfn != NULL) + if (cbfn != NULL) { + mempool_free(mbp, hw->mb_mempool); return 0; + } return csio_wr_eq_destroy_rsp(hw, mbp, eq_idx); } -- 2.25.1

1 0

[PATCH master] drm/amdgpu: Fix reference leak in psp_xgmi_reflect_topology_info()
by Jianglei Nie 12 Dec '21

12 Dec '21

openEuler inclusion category: bugfix bugzilla: NA CVE: NA In line 1138 (#1), amdgpu_get_xgmi_hive() increases the kobject reference counter of the hive it returned. The hive returned by amdgpu_get_xgmi_hive() should be released with the help of amdgpu_put_xgmi_hive() to balance its kobject reference counter properly. Forgetting the amdgpu_put_xgmi_hive() operation will result in reference leak. We can fix it by calling amdgpu_put_xgmi_hive() before the end of the function (#2). 1128 static void psp_xgmi_reflect_topology_info(struct psp_context *psp, 1129 struct psp_xgmi_node_info node_info) 1130 { 1138 hive = amdgpu_get_xgmi_hive(psp->adev); // #1: kzalloc space reference increment 1139 list_for_each_entry(mirror_adev, &hive->device_list, gmc.xgmi.head) { 1140 struct psp_xgmi_topology_info *mirror_top_info; 1141 int j; 1143 if (mirror_adev->gmc.xgmi.node_id != dst_node_id) 1144 continue; 1146 mirror_top_info = &mirror_adev->psp.xgmi_context.top_info; 1147 for (j = 0; j < mirror_top_info->num_nodes; j++) { 1148 if (mirror_top_info->nodes[j].node_id != src_node_id) 1149 continue; 1151 mirror_top_info->nodes[j].num_hops = dst_num_hops; 1157 if (dst_num_links) 1158 mirror_top_info->nodes[j].num_links = dst_num_links; 1160 break; 1161 } 1163 break; 1164 } // #2: missing reference decrement 1165 } Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> --- drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c index c641f84649d6..f6362047ed71 100644 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_psp.c @@ -1162,6 +1162,7 @@ static void psp_xgmi_reflect_topology_info(struct psp_context *psp, break; } + amdgpu_put_xgmi_hive(hive); } int psp_xgmi_get_topology_info(struct psp_context *psp, -- 2.25.1

1 0

[PATCH master] nfp: Fix memory leak in nfp_cpp_area_cache_add()
by Jianglei Nie 12 Dec '21

12 Dec '21

mainline inclusion from mainline-v5.16-rc7 category: bugfix commit: c56c96303e9289cc34716b1179597b6f470833de bugzilla: NA CVE: NA ------------------------ In line 800 (#1), nfp_cpp_area_alloc() allocates and initializes a CPP area structure. But in line 807 (#2), when the cache is allocated failed, this CPP area structure is not freed, which will result in memory leak. We can fix it by freeing the CPP area when the cache is allocated failed (#2). 792 int nfp_cpp_area_cache_add(struct nfp_cpp *cpp, size_t size) 793 { 794 struct nfp_cpp_area_cache *cache; 795 struct nfp_cpp_area *area; 800 area = nfp_cpp_area_alloc(cpp, NFP_CPP_ID(7, NFP_CPP_ACTION_RW, 0), 801 0, size); // #1: allocates and initializes 802 if (!area) 803 return -ENOMEM; 805 cache = kzalloc(sizeof(*cache), GFP_KERNEL); 806 if (!cache) 807 return -ENOMEM; // #2: missing free 817 return 0; 818 } Fixes: 4cb584e0ee7d ("nfp: add CPP access core") Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> Acked-by: Simon Horman <simon.horman(a)corigine.com> Link: https://lore.kernel.org/r/20211209061511.122535-1-niejianglei2021@163.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> --- drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c index d7ac0307797f..34c0d2ddf9ef 100644 --- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c +++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c @@ -803,8 +803,10 @@ int nfp_cpp_area_cache_add(struct nfp_cpp *cpp, size_t size) return -ENOMEM; cache = kzalloc(sizeof(*cache), GFP_KERNEL); - if (!cache) + if (!cache) { + nfp_cpp_area_free(area); return -ENOMEM; + } cache->id = 0; cache->addr = 0; -- 2.25.1

1 0

Re: [PATCH] btrfs: Fix memory leak in __add_inode_ref()
by Xie XiuQi 10 Dec '21

10 Dec '21

Hi, Thanks for your patchset. Please subscribe the kernel(a)openeuler.org and kernel-discuss(a)openeuler.org mailing list before sending patchs, or your patchs would be blocked. Welcome to start a topic at openEuler kernel sig meeting via seeding mail to kernel-discuss(a)openeuler.org. --- 可以通过openEuler kernel 小助手，参加openEuler kernel SIG 微信群。 https://openeuler.gitee.io/kernel-portal/img/wechat/openEuler_kernel_helper… On 2021/12/10 16:09, Jianglei Nie wrote: > Line 1169 (#3) allocates a memory chunk for victim_name by kmalloc(), > but when the function returns in line 1184 (#4) victim_name allcoated > by line 1169 (#3) is not freed, which will lead to a memory leak. > There is a similar snippet of code in this function as allocating a memory > chunk for victim_name in line 1104 (#1) as well as releasing the memory > in line 1116 (#2). > > We should kfree() victim_name when the return value of backref_in_log() > is less than zero and before the function returns in line 1184 (#4). > > 1057 static inline int __add_inode_ref(struct btrfs_trans_handle *trans, > 1058 struct btrfs_root *root, > 1059 struct btrfs_path *path, > 1060 struct btrfs_root *log_root, > 1061 struct btrfs_inode *dir, > 1062 struct btrfs_inode *inode, > 1063 u64 inode_objectid, u64 parent_objectid, > 1064 u64 ref_index, char *name, int namelen, > 1065 int *search_done) > 1066 { > > 1104 victim_name = kmalloc(victim_name_len, GFP_NOFS); > // #1: kmalloc (victim_name-1) > 1105 if (!victim_name) > 1106 return -ENOMEM; > > 1112 ret = backref_in_log(log_root, &search_key, > 1113 parent_objectid, victim_name, > 1114 victim_name_len); > 1115 if (ret < 0) { > 1116 kfree(victim_name); // #2: kfree (victim_name-1) > 1117 return ret; > 1118 } else if (!ret) { > > 1169 victim_name = kmalloc(victim_name_len, GFP_NOFS); > // #3: kmalloc (victim_name-2) > 1170 if (!victim_name) > 1171 return -ENOMEM; > > 1180 ret = backref_in_log(log_root, &search_key, > 1181 parent_objectid, victim_name, > 1182 victim_name_len); > 1183 if (ret < 0) { > 1184 return ret; // #4: missing kfree (victim_name-2) > 1185 } else if (!ret) { > > 1241 return 0; > 1242 } > > Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> > --- > fs/btrfs/tree-log.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c > index 8ab33caf016f..d373fec55521 100644 > --- a/fs/btrfs/tree-log.c > +++ b/fs/btrfs/tree-log.c > @@ -1181,6 +1181,7 @@ static inline int __add_inode_ref(struct btrfs_trans_handle *trans, > parent_objectid, victim_name, > victim_name_len); > if (ret < 0) { > + kfree(victim_name); > return ret; > } else if (!ret) { > ret = -ENOENT; >

1 0

[PATCH openEuler-5.10 1/7] bfq: Remove merged request already in bfq_requests_merged()
by Zheng Zengkai 10 Dec '21

10 Dec '21

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-v5.14-rc1 commit a921c655f2033dd1ce1379128efe881dda23ea37 category: bugfix bugzilla: 185777 https://gitee.com/openeuler/kernel/issues/I4LM14 CVE: NA --------------------------- Currently, bfq does very little in bfq_requests_merged() and handles all the request cleanup in bfq_finish_requeue_request() called from blk_mq_free_request(). That is currently safe only because blk_mq_free_request() is called shortly after bfq_requests_merged() while bfqd->lock is still held. However to fix a lock inversion between bfqd->lock and ioc->lock, we need to call blk_mq_free_request() after dropping bfqd->lock. That would mean that already merged request could be seen by other processes inside bfq queues and possibly dispatched to the device which is wrong. So move cleanup of the request from bfq_finish_requeue_request() to bfq_requests_merged(). Acked-by: Paolo Valente <paolo.valente(a)linaro.org> Signed-off-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20210623093634.27879-2-jack@suse.cz Signed-off-by: Jens Axboe <axboe(a)kernel.dk> conflict: in bfq_finish_requeue_request, code in hulk have the line atomic_dec(&rq->mq_hctx->elevator_queued); that is conflicted; Signed-off-by: zhangwensheng <zhangwensheng5(a)huawei.com> Reviewed-by: qiulaibin <qiulaibin(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/bfq-iosched.c | 41 +++++++++++++---------------------------- 1 file changed, 13 insertions(+), 28 deletions(-) diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c index fd3c23d516b8..27e01b4cd528 100644 --- a/block/bfq-iosched.c +++ b/block/bfq-iosched.c @@ -2326,7 +2326,7 @@ static void bfq_requests_merged(struct request_queue *q, struct request *rq, *next_bfqq = bfq_init_rq(next); if (!bfqq) - return; + goto remove; /* * If next and rq belong to the same bfq_queue and next is older @@ -2349,6 +2349,14 @@ static void bfq_requests_merged(struct request_queue *q, struct request *rq, bfqq->next_rq = rq; bfqg_stats_update_io_merged(bfqq_group(bfqq), next->cmd_flags); +remove: + /* Merged request may be in the IO scheduler. Remove it. */ + if (!RB_EMPTY_NODE(&next->rb_node)) { + bfq_remove_request(next->q, next); + if (next_bfqq) + bfqg_stats_update_io_remove(bfqq_group(next_bfqq), + next->cmd_flags); + } } /* Must be called with bfqq != NULL */ @@ -5901,6 +5909,7 @@ static void bfq_finish_requeue_request(struct request *rq) { struct bfq_queue *bfqq = RQ_BFQQ(rq); struct bfq_data *bfqd; + unsigned long flags; /* * rq either is not associated with any icq, or is an already @@ -5918,40 +5927,16 @@ static void bfq_finish_requeue_request(struct request *rq) rq->io_start_time_ns, rq->cmd_flags); + spin_lock_irqsave(&bfqd->lock, flags); if (likely(rq->rq_flags & RQF_STARTED)) { - unsigned long flags; - - spin_lock_irqsave(&bfqd->lock, flags); - if (rq == bfqd->waited_rq) bfq_update_inject_limit(bfqd, bfqq); bfq_completed_request(bfqq, bfqd); - bfq_finish_requeue_request_body(bfqq); atomic_dec(&rq->mq_hctx->elevator_queued); - - spin_unlock_irqrestore(&bfqd->lock, flags); - } else { - /* - * Request rq may be still/already in the scheduler, - * in which case we need to remove it (this should - * never happen in case of requeue). And we cannot - * defer such a check and removal, to avoid - * inconsistencies in the time interval from the end - * of this function to the start of the deferred work. - * This situation seems to occur only in process - * context, as a consequence of a merge. In the - * current version of the code, this implies that the - * lock is held. - */ - - if (!RB_EMPTY_NODE(&rq->rb_node)) { - bfq_remove_request(rq->q, rq); - bfqg_stats_update_io_remove(bfqq_group(bfqq), - rq->cmd_flags); - } - bfq_finish_requeue_request_body(bfqq); } + bfq_finish_requeue_request_body(bfqq); + spin_unlock_irqrestore(&bfqd->lock, flags); /* * Reset private fields. In case of a requeue, this allows -- 2.20.1

1 6

[PATCH openEuler-1.0-LTS v2 0/6] Add the no_hash_pointers startup parameter
by He Jinjin 10 Dec '21

10 Dec '21

The address printed by %p in the kernel will expose the kernel address information, which is extremely unsafe. So Linux v4.15 limited the information printed by %p which will print a hashed value. This patchset add no_hash_pointers startup parameter which can disable the restriction that %P only prints hashed values, so that %P can print the actual address in the kernel. I patched this function and the test modules associated with this and passed these tests after recompiling. Tobin C. Harding (3): lib/test_printf: Add empty module_exit function kselftest: Add test module framework header lib: Use new kselftest header Timur Tabi(3): kselftest: add support for skipped tests lib/vsprintf: no_hash_pointers prints all addresses as unhashed lib: use KSTM_MODULE_GLOBALS macro in kselftest drivers .../admin-guide/kernel-parameters.txt | 15 +++ Documentation/dev-tools/kselftest.rst | 94 +++++++++++++++++- lib/test_bitmap.c | 23 +---- lib/test_printf.c | 29 +++--- lib/vsprintf.c | 36 ++++++- tools/testing/selftests/kselftest_module.h | 54 ++++++++++ 6 files changed, 215 insertions(+), 36 deletions(-) create mode 100644 tools/testing/selftests/kselftest_module.h -- 2.30.0

1 6

[PATCH openEuler-1.0-LTS] block, bfq: move bfqq to root_group if parent group is offlined
by Yang Yingliang 10 Dec '21

10 Dec '21

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 185863 CVE: NA --------------------------- Our test report a uaf problem: [ 154.237639] ================================================================== [ 154.239896] BUG: KASAN: use-after-free in __bfq_deactivate_entity+0x25/0x290 [ 154.241910] Read of size 1 at addr ffff88824501f7b8 by task rmmod/2447 [ 154.244248] CPU: 7 PID: 2447 Comm: rmmod Not tainted 4.19.90+ #1 [ 154.245962] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 [ 154.248184] Call Trace: [ 154.248532] dump_stack+0x7a/0xac [ 154.248995] print_address_description+0x6c/0x237 [ 154.249649] ? __bfq_deactivate_entity+0x25/0x290 [ 154.250297] kasan_report.cold+0x88/0x29c [ 154.250853] __bfq_deactivate_entity+0x25/0x290 [ 154.251483] bfq_pd_offline+0x13e/0x790 [ 154.252017] ? blk_mq_freeze_queue_wait+0x165/0x180 [ 154.252687] ? bfq_reparent_leaf_entity+0xa0/0xa0 [ 154.253333] ? bfq_put_queue+0x12c/0x1e0 [ 154.253877] ? kmem_cache_free+0x8e/0x1e0 [ 154.254433] ? hrtimer_active+0x53/0xa0 [ 154.254966] ? hrtimer_try_to_cancel+0x6d/0x1c0 [ 154.255576] ? __hrtimer_get_remaining+0xf0/0xf0 [ 154.256197] ? __bfq_deactivate_entity+0x11b/0x290 [ 154.256843] blkcg_deactivate_policy+0x106/0x1f0 [ 154.257464] bfq_exit_queue+0xf1/0x110 [ 154.257975] blk_mq_exit_sched+0x114/0x140 [ 154.258530] elevator_exit+0x9a/0xa0 [ 154.259023] blk_exit_queue+0x3d/0x70 [ 154.259523] blk_cleanup_queue+0x160/0x1e0 [ 154.260099] null_del_dev+0xda/0x1f0 [null_blk] [ 154.260723] null_exit+0x5f/0xab [null_blk] [ 154.261298] __x64_sys_delete_module+0x20e/0x2f0 [ 154.261931] ? __ia32_sys_delete_module+0x2f0/0x2f0 [ 154.262597] ? exit_to_usermode_loop+0x45/0xe0 [ 154.263219] do_syscall_64+0x73/0x280 [ 154.263731] ? page_fault+0x8/0x30 [ 154.264197] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 154.264882] RIP: 0033:0x7f033bf63acb [ 154.265370] Code: 73 01 c3 48 8b 0d bd 33 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 b0 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8d 33 0c 00 f7 d8 64 89 01 48 [ 154.267880] RSP: 002b:00007ffc7fe52548 EFLAGS: 00000206 ORIG_RAX: 00000000000000b0 [ 154.268900] RAX: ffffffffffffffda RBX: 00005583e2b8e530 RCX: 00007f033bf63acb [ 154.269865] RDX: 000000000000000a RSI: 0000000000000800 RDI: 00005583e2b8e598 [ 154.270837] RBP: 00007ffc7fe525a8 R08: 0000000000000000 R09: 0000000000000000 [ 154.271802] R10: 00007f033bfd7ac0 R11: 0000000000000206 R12: 00007ffc7fe52770 [ 154.272763] R13: 00007ffc7fe536f8 R14: 00005583e2b8d2a0 R15: 00005583e2b8e530 [ 154.273939] Allocated by task 2350: [ 154.274419] kasan_kmalloc+0xc6/0xe0 [ 154.274916] kmem_cache_alloc_node_trace+0x119/0x240 [ 154.275594] bfq_pd_alloc+0x50/0x510 [ 154.276081] blkg_alloc+0x237/0x310 [ 154.276557] blkg_create+0x48a/0x5e0 [ 154.277044] blkg_lookup_create+0x144/0x1c0 [ 154.277614] generic_make_request_checks+0x5cf/0xad0 [ 154.278290] generic_make_request+0xdd/0x6c0 [ 154.278877] submit_bio+0xaa/0x250 [ 154.279342] mpage_readpages+0x2a2/0x3b0 [ 154.279878] read_pages+0xdf/0x3a0 [ 154.280343] __do_page_cache_readahead+0x27c/0x2a0 [ 154.280989] ondemand_readahead+0x275/0x460 [ 154.281556] generic_file_read_iter+0xc4e/0x1790 [ 154.282182] aio_read+0x174/0x260 [ 154.282635] io_submit_one+0x7d4/0x14b0 [ 154.283164] __x64_sys_io_submit+0x102/0x230 [ 154.283749] do_syscall_64+0x73/0x280 [ 154.284250] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 154.285159] Freed by task 2315: [ 154.285588] __kasan_slab_free+0x12f/0x180 [ 154.286150] kfree+0xab/0x1d0 [ 154.286561] blkg_free.part.0+0x4a/0xe0 [ 154.287089] rcu_process_callbacks+0x424/0x6d0 [ 154.287689] __do_softirq+0x10d/0x370 [ 154.288395] The buggy address belongs to the object at ffff88824501f700 which belongs to the cache kmalloc-2048 of size 2048 [ 154.290083] The buggy address is located 184 bytes inside of 2048-byte region [ffff88824501f700, ffff88824501ff00) [ 154.291661] The buggy address belongs to the page: [ 154.292306] page:ffffea0009140600 count:1 mapcount:0 mapping:ffff88824bc0e800 index:0x0 compound_mapcount: 0 [ 154.293610] flags: 0x17ffffc0008100(slab|head) [ 154.294211] raw: 0017ffffc0008100 ffffea000896da00 0000000200000002 ffff88824bc0e800 [ 154.295247] raw: 0000000000000000 00000000800f000f 00000001ffffffff 0000000000000000 [ 154.296294] page dumped because: kasan: bad access detected [ 154.297261] Memory state around the buggy address: [ 154.297913] ffff88824501f680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 154.298884] ffff88824501f700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 154.299858] >ffff88824501f780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 154.300824] ^ [ 154.301505] ffff88824501f800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 154.302479] ffff88824501f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 154.303459] ================================================================== This is because when bfq_group is offlined, if the bfq_queues are not in active tree, their parents(bfqq->entity.partent) are still point to the offlined bfq_group. And after some ios are issued to such bfq_queues, the offlined bfq_group is reinserted to service tree. Fix the problem by move bfq_queue to root_group if we found it's parent is offlined. Fixes: e21b7a0b9887 ("block, bfq: add full hierarchical scheduling and cgroups support") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/bfq-cgroup.c | 14 ++++++++++---- block/bfq-wf2q.c | 9 +++++++++ 2 files changed, 19 insertions(+), 4 deletions(-) diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c index 78cfd008b89d7..73b82a5c03717 100644 --- a/block/bfq-cgroup.c +++ b/block/bfq-cgroup.c @@ -556,6 +556,7 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq, struct bfq_group *bfqg) { struct bfq_entity *entity = &bfqq->entity; + struct bfq_group *old_parent = bfqq_group(bfqq); /* * Get extra reference to prevent bfqq from being freed in @@ -577,17 +578,21 @@ void bfq_bfqq_move(struct bfq_data *bfqd, struct bfq_queue *bfqq, bfq_deactivate_bfqq(bfqd, bfqq, false, false); else if (entity->on_st) bfq_put_idle_entity(bfq_entity_service_tree(entity), entity); - bfqg_and_blkg_put(bfqq_group(bfqq)); entity->parent = bfqg->my_entity; entity->sched_data = &bfqg->sched_data; /* pin down bfqg and its associated blkg */ bfqg_and_blkg_get(bfqg); - if (bfq_bfqq_busy(bfqq)) { - bfq_pos_tree_add_move(bfqd, bfqq); + /* + * Don't leave the bfqq->pos_root to old bfqg, since the ref to old + * bfqg will be released and the bfqg might be freed. + */ + bfq_pos_tree_add_move(bfqd, bfqq); + bfqg_and_blkg_put(old_parent); + + if (bfq_bfqq_busy(bfqq)) bfq_activate_bfqq(bfqd, bfqq); - } if (!bfqd->in_service_queue && !bfqd->rq_in_driver) bfq_schedule_dispatch(bfqd); @@ -860,6 +865,7 @@ static void bfq_pd_offline(struct blkg_policy_data *pd) put_async_queues: bfq_put_async_queues(bfqd, bfqg); + pd->plid = BLKCG_MAX_POLS; spin_unlock_irqrestore(&bfqd->lock, flags); /* diff --git a/block/bfq-wf2q.c b/block/bfq-wf2q.c index 316a1c2d1b610..e830715fe15d6 100644 --- a/block/bfq-wf2q.c +++ b/block/bfq-wf2q.c @@ -1684,6 +1684,15 @@ void bfq_del_bfqq_busy(struct bfq_data *bfqd, struct bfq_queue *bfqq, */ void bfq_add_bfqq_busy(struct bfq_data *bfqd, struct bfq_queue *bfqq) { +#ifdef CONFIG_BFQ_GROUP_IOSCHED + /* If parent group is offlined, move the bfqq to root group */ + if (bfqq->entity.parent) { + struct bfq_group *bfqg = bfq_bfqq_to_bfqg(bfqq); + + if (bfqg->pd.plid >= BLKCG_MAX_POLS) + bfq_bfqq_move(bfqd, bfqq, bfqd->root_group); + } +#endif bfq_log_bfqq(bfqd, bfqq, "add to busy"); bfq_activate_bfqq(bfqd, bfqq); -- 2.25.1

1 0

openEuler kernel技术分享第十六期 & 双周例会
by openEuler conference 10 Dec '21

10 Dec '21

您好！ Kernel SIG 邀请您参加 2021-12-17 14:00 召开的ZOOM会议(自动录制) 会议主题：openEuler kernel技术分享第十六期 & 双周例会会议内容： 14:10-15:30 openEuler kernel 技术分享第16期-openEuler内核热补丁介绍会议链接：https://us06web.zoom.us/j/88618073121?pwd=V3JyZG5IOWRVWENieDJhNndpV2x5UT09 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the ZOOM conference(auto recording) will be held at 2021-12-17 14:00, The subject of the conference is openEuler kernel技术分享第十六期 & 双周例会, Summary: 14:10-15:30 openEuler kernel 技术分享第16期-openEuler内核热补丁介绍 You can join the meeting at https://us06web.zoom.us/j/88618073121?pwd=V3JyZG5IOWRVWENieDJhNndpV2x5UT09. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS 1/2] io_uring: fix soft lockup when call __io_remove_buffers
by Yang Yingliang 09 Dec '21

09 Dec '21

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v5.16-rc3 commit 1d0254e6b47e73222fd3d6ae95cccbaafe5b3ecf category: bugfix bugzilla: 185746 CVE: NA ----------------------------------------------- I got issue as follows: [ 567.094140] __io_remove_buffers: [1]start ctx=0xffff8881067bf000 bgid=65533 buf=0xffff8881fefe1680 [ 594.360799] watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [kworker/u32:5:108] [ 594.364987] Modules linked in: [ 594.365405] irq event stamp: 604180238 [ 594.365906] hardirqs last enabled at (604180237): [<ffffffff93fec9bd>] _raw_spin_unlock_irqrestore+0x2d/0x50 [ 594.367181] hardirqs last disabled at (604180238): [<ffffffff93fbbadb>] sysvec_apic_timer_interrupt+0xb/0xc0 [ 594.368420] softirqs last enabled at (569080666): [<ffffffff94200654>] __do_softirq+0x654/0xa9e [ 594.369551] softirqs last disabled at (569080575): [<ffffffff913e1d6a>] irq_exit_rcu+0x1ca/0x250 [ 594.370692] CPU: 2 PID: 108 Comm: kworker/u32:5 Tainted: G L 5.15.0-next-20211112+ #88 [ 594.371891] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20190727_073836-buildvm-ppc64le-16.ppc.fedoraproject.org-3.fc31 04/01/2014 [ 594.373604] Workqueue: events_unbound io_ring_exit_work [ 594.374303] RIP: 0010:_raw_spin_unlock_irqrestore+0x33/0x50 [ 594.375037] Code: 48 83 c7 18 53 48 89 f3 48 8b 74 24 10 e8 55 f5 55 fd 48 89 ef e8 ed a7 56 fd 80 e7 02 74 06 e8 43 13 7b fd fb bf 01 00 00 00 <e8> f8 78 474 [ 594.377433] RSP: 0018:ffff888101587a70 EFLAGS: 00000202 [ 594.378120] RAX: 0000000024030f0d RBX: 0000000000000246 RCX: 1ffffffff2f09106 [ 594.379053] RDX: 0000000000000000 RSI: ffffffff9449f0e0 RDI: 0000000000000001 [ 594.379991] RBP: ffffffff9586cdc0 R08: 0000000000000001 R09: fffffbfff2effcab [ 594.380923] R10: ffffffff977fe557 R11: fffffbfff2effcaa R12: ffff8881b8f3def0 [ 594.381858] R13: 0000000000000246 R14: ffff888153a8b070 R15: 0000000000000000 [ 594.382787] FS: 0000000000000000(0000) GS:ffff888399c00000(0000) knlGS:0000000000000000 [ 594.383851] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 594.384602] CR2: 00007fcbe71d2000 CR3: 00000000b4216000 CR4: 00000000000006e0 [ 594.385540] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 594.386474] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 594.387403] Call Trace: [ 594.387738] <TASK> [ 594.388042] find_and_remove_object+0x118/0x160 [ 594.389321] delete_object_full+0xc/0x20 [ 594.389852] kfree+0x193/0x470 [ 594.390275] __io_remove_buffers.part.0+0xed/0x147 [ 594.390931] io_ring_ctx_free+0x342/0x6a2 [ 594.392159] io_ring_exit_work+0x41e/0x486 [ 594.396419] process_one_work+0x906/0x15a0 [ 594.399185] worker_thread+0x8b/0xd80 [ 594.400259] kthread+0x3bf/0x4a0 [ 594.401847] ret_from_fork+0x22/0x30 [ 594.402343] </TASK> Message from syslogd@localhost at Nov 13 09:09:54 ... kernel:watchdog: BUG: soft lockup - CPU#2 stuck for 26s! [kworker/u32:5:108] [ 596.793660] __io_remove_buffers: [2099199]start ctx=0xffff8881067bf000 bgid=65533 buf=0xffff8881fefe1680 We can reproduce this issue by follow syzkaller log: r0 = syz_io_uring_setup(0x401, &(0x7f0000000300), &(0x7f0000003000/0x2000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000000280)=<r1=>0x0, &(0x7f0000000380)=<r2=>0x0) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, &(0x7f0000003080)={0x0, 0x0, &(0x7f0000003040)={&(0x7f0000000040)=ANY=[], 0x18}}, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000240)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x5, 0x0, 0x401, 0x1, 0x0, 0x100, 0x0, 0x1, {0xfffd}}, 0x0) io_uring_enter(r0, 0x3a2d, 0x0, 0x0, 0x0, 0x0) The reason above issue is 'buf->list' has 2,100,000 nodes, occupied cpu lead to soft lockup. To solve this issue, we need add schedule point when do while loop in '__io_remove_buffers'. After add schedule point we do regression, get follow data. [ 240.141864] __io_remove_buffers: [1]start ctx=0xffff888170603000 bgid=65533 buf=0xffff8881116fcb00 [ 268.408260] __io_remove_buffers: [1]start ctx=0xffff8881b92d2000 bgid=65533 buf=0xffff888130c83180 [ 275.899234] __io_remove_buffers: [2099199]start ctx=0xffff888170603000 bgid=65533 buf=0xffff8881116fcb00 [ 296.741404] __io_remove_buffers: [1]start ctx=0xffff8881b659c000 bgid=65533 buf=0xffff8881010fe380 [ 305.090059] __io_remove_buffers: [2099199]start ctx=0xffff8881b92d2000 bgid=65533 buf=0xffff888130c83180 [ 325.415746] __io_remove_buffers: [1]start ctx=0xffff8881b92d1000 bgid=65533 buf=0xffff8881a17d8f00 [ 333.160318] __io_remove_buffers: [2099199]start ctx=0xffff8881b659c000 bgid=65533 buf=0xffff8881010fe380 ... Fixes:8bab4c09f24e("io_uring: allow conditional reschedule for intensive iterators") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Link: https://lore.kernel.org/r/20211122024737.2198530-1-yebin10@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> conflicts: fs/io_uring.c Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/io_uring.c | 1 + 1 file changed, 1 insertion(+) diff --git a/fs/io_uring.c b/fs/io_uring.c index d07388600bbed..f3b5f9d670df3 100644 --- a/fs/io_uring.c +++ b/fs/io_uring.c @@ -3462,6 +3462,7 @@ static int __io_remove_buffers(struct io_ring_ctx *ctx, struct io_buffer *buf, kfree(nxt); if (++i == nbufs) return i; + cond_resched(); } i++; kfree(buf); -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] block: Fix fsync always failed if once failed
by Yang Yingliang 09 Dec '21

09 Dec '21

From: Ye Bin <yebin10(a)huawei.com> mainline inclusion from mainline-v5.17 commit 8a7518931baa8ea023700987f3db31cb0a80610b category: bugfix bugzilla: 185819 CVE: NA ----------------------------------------------- We do test with inject error fault base on v4.19, after test some time we found sync /dev/sda always failed. [root@localhost] sync /dev/sda sync: error syncing '/dev/sda': Input/output error scsi log as follows: [19069.812296] sd 0:0:0:0: [sda] tag#64 Send: scmd 0x00000000d03a0b6b [19069.812302] sd 0:0:0:0: [sda] tag#64 CDB: Synchronize Cache(10) 35 00 00 00 00 00 00 00 00 00 [19069.812533] sd 0:0:0:0: [sda] tag#64 Done: SUCCESS Result: hostbyte=DID_OK driverbyte=DRIVER_OK [19069.812536] sd 0:0:0:0: [sda] tag#64 CDB: Synchronize Cache(10) 35 00 00 00 00 00 00 00 00 00 [19069.812539] sd 0:0:0:0: [sda] tag#64 scsi host busy 1 failed 0 [19069.812542] sd 0:0:0:0: Notifying upper driver of completion (result 0) [19069.812546] sd 0:0:0:0: [sda] tag#64 sd_done: completed 0 of 0 bytes [19069.812549] sd 0:0:0:0: [sda] tag#64 0 sectors total, 0 bytes done. [19069.812564] print_req_error: I/O error, dev sda, sector 0 ftrace log as follows: rep-306069 [007] .... 19654.923315: block_bio_queue: 8,0 FWS 0 + 0 [rep] rep-306069 [007] .... 19654.923333: block_getrq: 8,0 FWS 0 + 0 [rep] kworker/7:1H-250 [007] .... 19654.923352: block_rq_issue: 8,0 FF 0 () 0 + 0 [kworker/7:1H] <idle>-0 [007] ..s. 19654.923562: block_rq_complete: 8,0 FF () 18446744073709551615 + 0 [0] <idle>-0 [007] d.s. 19654.923576: block_rq_complete: 8,0 WS () 0 + 0 [-5] As 8d6996630c03 introduce 'fq->rq_status', this data only update when 'flush_rq' reference count isn't zero. If flush request once failed and record error code in 'fq->rq_status'. If there is no chance to update 'fq->rq_status',then do fsync will always failed. To address this issue reset 'fq->rq_status' after return error code to upper layer. Fixes: 8d6996630c03("block: fix null pointer dereference in blk_mq_rq_timed_out()") Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Link: https://lore.kernel.org/r/20211129012659.1553733-1-yebin10@huawei.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> conflicts: block/blk-flush.c Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/blk-flush.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/block/blk-flush.c b/block/blk-flush.c index 022a2bbb012d7..c1bfcde165af5 100644 --- a/block/blk-flush.c +++ b/block/blk-flush.c @@ -245,8 +245,10 @@ static void flush_end_io(struct request *flush_rq, blk_status_t error) * avoiding use-after-free. */ WRITE_ONCE(flush_rq->state, MQ_RQ_IDLE); - if (fq->rq_status != BLK_STS_OK) + if (fq->rq_status != BLK_STS_OK) { error = fq->rq_status; + fq->rq_status = BLK_STS_OK; + } hctx = blk_mq_map_queue(q, flush_rq->mq_ctx->cpu); if (!q->elevator) { -- 2.25.1

1 0

2024

2023

2022

2021

2020

2019

Kernel