- Kernel - mailweb.openeuler.org

Re: openEuler-1.0是否完整支持mpam功能
by Xie XiuQi 23 Mar '20

23 Mar '20

On 2020/3/23 9:56, haoxin wrote: > 非常感谢您的回复，谢谢，我还想问下，intel rdt resctrl挂载后下有很多配置文件，例如mon_data下的llc_occupancy、mbm_local_bytes、mbm_total_bytes等，这些是在后续会实现还是不再提供类似文件？ > 近期暂时还没有改动，后续支持鲲鹏930的版本可以考虑。当前如果有场景确实需要，以及有效果的话，也可以考虑提供。 > > > > > > 在 2020-03-23 09:38:58，"Xie XiuQi via Kernel" <kernel(a)openeuler.org> 写道： >> >> >>On 2020/3/23 9:15, haoxin wrote: >>> 您好： >>> 请问目前欧拉这块有关于mpam功能验证的测试方法或者手册吗？ >> >>有一个简单的操作说明，你可以针对场景做一下测试。有问题可以反馈。 >> >>----- >>1 背景 >>MPAM 特性是 ARM v8.4 引入的 Cache QoS, 和内存带宽 QoS 特性. 目前业界与之最接近的是 intel 的 RDT 特性. >>Intel RDT 在 Linux 内核中的使用接口是 resctrl。这是一个基于 kernfs 实现的操作接口。为支持 MPAM 特性, >>我们的目标也是实现类似 intel rdt 的 resctrl 用户接口。 >>社区当前还没有 ARM64 resctrl 接口的实现(arm公司在做, 还没有发开源社区). >> >>2 Quick Start >>Hi620 2P 为例, 其基本情况: >> >>2.1 linux kernel 使能 mpam 特性 >>openEuler 中 mpam 是 preview 特性, 当前版本暂没有商用, 默认没有使能. 如果想在鲲鹏920 2P 板子上验证 mpam 特性, 需要在启动参数中加 mpam 使能. >>openEuler 上使能 mpam, 需要在 /boot/grub2/grub.cfg 或 /boot/efi/EFI/euleros/grub.cfg 中添加 mpam 启动参数. >> >>2.2 挂载 resctrl >>系统启动后, 需要手动 mount resctrl 才能使用. >> >>mount -t resctrl resctrl /sys/fs/resctrl >>cd /sys/fs/resctrl >> >>2.3 配置和使用资源组 >>2.3.1 为 L3 Cache 的 PARTID 1 分配 4 个 Cache way >># 每个目录表示对于的 L3T >>cd /sys/fs/resctrl >> >># 先选择某个 PARTID, 在为其设定 mask, mask 就是对应的 cache way >># 这里选 partid=1, mask=f, 即为 partid 1 分了 0-3 计4条way (共15条way) >>mkdir p1 >>cd p1 >>echo "L3:0=f;1=f;2=f;3=f" > schemata >>cat schemata # 查看设置情况 >>cd .. # 返回上次目录 >> >># 更多的例子 >># partid = 2, N0 (way 5,6), N1 (way 5-8), N2 (way 5,6), N3 (way 5-15) >># mask 16进制 >>mkdir p2 >>cd p2 >>echo "L3:0=30;1=f0;2=30;3=f0" > schemata >>cat schemata # 查看设置情况 >>cd .. # 返回上次目录 >> >>Cache 和内存带宽的 partid 数量不同, 但是 resctrl 接口当前又是Cache和partid同时操作的, 所以当前实现时已最小的为准； >> >>2.3.2 为 Cache/memory bandwidth 设置 monitor, 并观察期使用情况 >>由于 monitor 数量较少, 所以在创建分组的时候没有默认开启, 需要手动开启. >> >># p1 分组已存在, 开启 monitor >>echo 1 > /sys/fs/resctrl/p1/ctrlmon >># 观察该组资源的使用情况 >># L3 Cache 的单位是 Bytes, 表明当前 Cache 被占用这么多; >># Memory Bandwidth 单位是MB/s (架构要求的是 MB/s, 鲲鹏920 看具体实现) >>grep . /sys/fs/resctrl/p1/mon_data/* >> >>2.3.3 为进程/线程分配分组(让进程/线程只使用某个 part 的资源) >># task 19 将使用 partid 1 限定的资源 (pmg 在监控的时候用, pmg 和 partid 都匹配, 才进行统计监控使用情况) >># 将 task 19 move 到 p1 资源组中 >># 新创建的子进程, 将继承父进程的 partid 和 pmg 信息 >># move 进程时, 已创建的子进程不影响 >>echo 19 > /sys/fs/resctrl/p1/tasks >> >># 设置当前 shell 使用那个组的Cache资源 ($$ 表示当前 shell 的 PID) >>echo $$ > /sys/fs/resctrl/p1/tasks >> >># 查看 task 的设置情况 >>cat /sys/fs/resctrl/p1/tasks >> >>2.3.4 为 cpu 分配分组(让指定的 cpu 只使用某个 part 的资源) >>即, 该 cpu 上发出的所有请求都是要改资源组限定的资源(cache, memory bandwidth) >> >># task 1 将使用 partid 2 限定的资源 (pmg 在监控的时候用, pmg 和 partid 都匹配, 才进行统计监控使用情况) >># 将 cpu 1 move 到 p2 资源组中 >>echo 1 > /sys/fs/resctrl/p2/cpus_list >> >># 查看 task 的设置情况 >>cat /sys/fs/resctrl/p2/cpus # 掩码方式显示 >>cat /sys/fs/resctrl/p2/cpus_list # 列表方式显示 >> >>2.4 内存带宽资源划分 >> >>2.4.1 为 PART 1 设置内存带宽的上限 >># PART 1, 最多使用约 50% 的带宽; >># 0,1,2,3 分别表示 4 个 numa node >># 带宽按照百分比进行设置, 最小粒度是 5% 对齐. >> >>echo "MB:0=50;1=50;2=50;3=50" > /sys/fs/resctrl/p1/schemata >> >>2.4.3 分配进程(pid)到资源分组 >>挂载 resctrl >>cache 资源划分 >>设置 monitor >>起测试程序 (假设 lat_mem_rd 程序在 /root 目录下面, 其他随便什么程序都一样) >># 挂载 mpamctrl >>mount -t resctrl resctrl /sys/fs/resctrl >>cd /sys/fs/resctrl >> >># 使用 part 1, 为其分配 4 个way (4 个 node 采用相同的设置) >># partid=1, mask=f >>mkdir p1 >>echo "L3:0=f;1=f;2=f;3=f" > schemata >> >># 使用 monitor 1 来监控 part 1 的 cache 使用情况 >># monitor=1, pmg=1, partid=1 >>echo 1 > p1/ctrlmon >> >># 设置当前 shell 进程使用 partid 1 (task 使用哪个 part, 在子进程创建时会继承父进程的) >># 两个 $$ 代表当前 shell 的pid >>echo $$ > p1/tasks >> >># 在后台跑测试程序, 测试结果记录到 result.log 中 >>cd /root >>/root/lat_mem_rd -P 1 -N 1 512M 64 > result.log 2 > &1 & >> >># lat_mem_rd 测试完成后查看结果. >>如果想再测 8 way 的情况, 则只需改 CPBM 的 mask 即可: >> >>echo "L3:0=ff;1=ff;2=ff;3=ff" > schemata >>测试过程中如果想观察 Cache 的使用情况 >> >>grep . /sys/fs/resctrl/p1/mon_data/L3* >> >>3.2 限制内存带宽的例子 >>步骤: >> >>挂载 resctrl >>限制资源划分 >>设置 monitor >>起测试程序 >>mount -t resctrl resctrl /sys/fs/resctrl >>cd /sys/fs/resctrl >> >># 0/100 表示不限制 >># 其他数值表示最大带宽设置的百分比(硬件限制的粒度是 1/64, 软件上近似对应成百分比, 最小按5%对齐). >>mkdir p1 >>echo "MB:0=30;1=30;2=30;3=30" > p1/schemata >>echo 1 > p1/ctrlmon >> >># 设置当前 shell 进程使用 partid 1 (task 使用哪个 part, 在子进程创建时会继承父进程的) >># 两个 $$ 代表当前 shell 的pid >>echo $$ > /sys/fs/resctrl/p1/tasks >># 在后台跑测试程序, 测试结果记录到 result.log 中 >>cd /root >>/root/bw_mem -P 1 -N 1 512M rd > result.log 2 > &1 & >> >># 观察monitor情况 >>cd /sys/fs/resctrl >># monitor=1 >>grep . /sys/fs/resctrl/p1/mon_data/MB* >> >> >>> >>> 此外目前resctrl挂载后和intel rdt进行了对比，发现很多文件都不存在，例如请问是代码还未完成还是做了简化？ >>> >>> 例如我在info目录下有L3_MON目录，按照intel rdt的处理，应该有下面一些子文件：但是在mpam下面就没有 >>> >>> “num_rmids”: >>> The number of RMIDs available. This is the upper bound for how many “CTRL_MON” + “MON” groups can be created. >>> “mon_features”: >>> Lists the monitoring events if monitoring is enabled for the resource. >>> “max_threshold_occupancy”: >>> Read/write file provides the largest value (in bytes) at which a previously used LLC_occupancy counter can be considered for re-use. >>> >>> >>> >>> >>> >>_______________________________________________ >>Kernel mailing list -- kernel(a)openeuler.org >>To unsubscribe send an email to kernel-leave(a)openeuler.org > > > > >

1 0

Re: openEuler-1.0是否完整支持mpam功能
by Xie XiuQi 23 Mar '20

23 Mar '20

On 2020/3/23 9:15, haoxin wrote: > 您好： > 请问目前欧拉这块有关于mpam功能验证的测试方法或者手册吗？有一个简单的操作说明，你可以针对场景做一下测试。有问题可以反馈。 ----- 1 背景 MPAM 特性是 ARM v8.4 引入的 Cache QoS, 和内存带宽 QoS 特性. 目前业界与之最接近的是 intel 的 RDT 特性. Intel RDT 在 Linux 内核中的使用接口是 resctrl。这是一个基于 kernfs 实现的操作接口。为支持 MPAM 特性, 我们的目标也是实现类似 intel rdt 的 resctrl 用户接口。社区当前还没有 ARM64 resctrl 接口的实现(arm公司在做, 还没有发开源社区). 2 Quick Start Hi620 2P 为例, 其基本情况: 2.1 linux kernel 使能 mpam 特性 openEuler 中 mpam 是 preview 特性, 当前版本暂没有商用, 默认没有使能. 如果想在鲲鹏920 2P 板子上验证 mpam 特性, 需要在启动参数中加 mpam 使能. openEuler 上使能 mpam, 需要在 /boot/grub2/grub.cfg 或 /boot/efi/EFI/euleros/grub.cfg 中添加 mpam 启动参数. 2.2 挂载 resctrl 系统启动后, 需要手动 mount resctrl 才能使用. mount -t resctrl resctrl /sys/fs/resctrl cd /sys/fs/resctrl 2.3 配置和使用资源组 2.3.1 为 L3 Cache 的 PARTID 1 分配 4 个 Cache way # 每个目录表示对于的 L3T cd /sys/fs/resctrl # 先选择某个 PARTID, 在为其设定 mask, mask 就是对应的 cache way # 这里选 partid=1, mask=f, 即为 partid 1 分了 0-3 计4条way (共15条way) mkdir p1 cd p1 echo "L3:0=f;1=f;2=f;3=f" > schemata cat schemata # 查看设置情况 cd .. # 返回上次目录 # 更多的例子 # partid = 2, N0 (way 5,6), N1 (way 5-8), N2 (way 5,6), N3 (way 5-15) # mask 16进制 mkdir p2 cd p2 echo "L3:0=30;1=f0;2=30;3=f0" > schemata cat schemata # 查看设置情况 cd .. # 返回上次目录 Cache 和内存带宽的 partid 数量不同, 但是 resctrl 接口当前又是Cache和partid同时操作的, 所以当前实现时已最小的为准； 2.3.2 为 Cache/memory bandwidth 设置 monitor, 并观察期使用情况由于 monitor 数量较少, 所以在创建分组的时候没有默认开启, 需要手动开启. # p1 分组已存在, 开启 monitor echo 1 > /sys/fs/resctrl/p1/ctrlmon # 观察该组资源的使用情况 # L3 Cache 的单位是 Bytes, 表明当前 Cache 被占用这么多; # Memory Bandwidth 单位是MB/s (架构要求的是 MB/s, 鲲鹏920 看具体实现) grep . /sys/fs/resctrl/p1/mon_data/* 2.3.3 为进程/线程分配分组(让进程/线程只使用某个 part 的资源) # task 19 将使用 partid 1 限定的资源 (pmg 在监控的时候用, pmg 和 partid 都匹配, 才进行统计监控使用情况) # 将 task 19 move 到 p1 资源组中 # 新创建的子进程, 将继承父进程的 partid 和 pmg 信息 # move 进程时, 已创建的子进程不影响 echo 19 > /sys/fs/resctrl/p1/tasks # 设置当前 shell 使用那个组的Cache资源 ($$ 表示当前 shell 的 PID) echo $$ > /sys/fs/resctrl/p1/tasks # 查看 task 的设置情况 cat /sys/fs/resctrl/p1/tasks 2.3.4 为 cpu 分配分组(让指定的 cpu 只使用某个 part 的资源) 即, 该 cpu 上发出的所有请求都是要改资源组限定的资源(cache, memory bandwidth) # task 1 将使用 partid 2 限定的资源 (pmg 在监控的时候用, pmg 和 partid 都匹配, 才进行统计监控使用情况) # 将 cpu 1 move 到 p2 资源组中 echo 1 > /sys/fs/resctrl/p2/cpus_list # 查看 task 的设置情况 cat /sys/fs/resctrl/p2/cpus # 掩码方式显示 cat /sys/fs/resctrl/p2/cpus_list # 列表方式显示 2.4 内存带宽资源划分 2.4.1 为 PART 1 设置内存带宽的上限 # PART 1, 最多使用约 50% 的带宽; # 0,1,2,3 分别表示 4 个 numa node # 带宽按照百分比进行设置, 最小粒度是 5% 对齐. echo "MB:0=50;1=50;2=50;3=50" > /sys/fs/resctrl/p1/schemata 2.4.3 分配进程(pid)到资源分组挂载 resctrl cache 资源划分设置 monitor 起测试程序 (假设 lat_mem_rd 程序在 /root 目录下面, 其他随便什么程序都一样) # 挂载 mpamctrl mount -t resctrl resctrl /sys/fs/resctrl cd /sys/fs/resctrl # 使用 part 1, 为其分配 4 个way (4 个 node 采用相同的设置) # partid=1, mask=f mkdir p1 echo "L3:0=f;1=f;2=f;3=f" > schemata # 使用 monitor 1 来监控 part 1 的 cache 使用情况 # monitor=1, pmg=1, partid=1 echo 1 > p1/ctrlmon # 设置当前 shell 进程使用 partid 1 (task 使用哪个 part, 在子进程创建时会继承父进程的) # 两个 $$ 代表当前 shell 的pid echo $$ > p1/tasks # 在后台跑测试程序, 测试结果记录到 result.log 中 cd /root /root/lat_mem_rd -P 1 -N 1 512M 64 > result.log 2 > &1 & # lat_mem_rd 测试完成后查看结果. 如果想再测 8 way 的情况, 则只需改 CPBM 的 mask 即可: echo "L3:0=ff;1=ff;2=ff;3=ff" > schemata 测试过程中如果想观察 Cache 的使用情况 grep . /sys/fs/resctrl/p1/mon_data/L3* 3.2 限制内存带宽的例子步骤: 挂载 resctrl 限制资源划分设置 monitor 起测试程序 mount -t resctrl resctrl /sys/fs/resctrl cd /sys/fs/resctrl # 0/100 表示不限制 # 其他数值表示最大带宽设置的百分比(硬件限制的粒度是 1/64, 软件上近似对应成百分比, 最小按5%对齐). mkdir p1 echo "MB:0=30;1=30;2=30;3=30" > p1/schemata echo 1 > p1/ctrlmon # 设置当前 shell 进程使用 partid 1 (task 使用哪个 part, 在子进程创建时会继承父进程的) # 两个 $$ 代表当前 shell 的pid echo $$ > /sys/fs/resctrl/p1/tasks # 在后台跑测试程序, 测试结果记录到 result.log 中 cd /root /root/bw_mem -P 1 -N 1 512M rd > result.log 2 > &1 & # 观察monitor情况 cd /sys/fs/resctrl # monitor=1 grep . /sys/fs/resctrl/p1/mon_data/MB* > > 此外目前resctrl挂载后和intel rdt进行了对比，发现很多文件都不存在，例如请问是代码还未完成还是做了简化？ > > 例如我在info目录下有L3_MON目录，按照intel rdt的处理，应该有下面一些子文件：但是在mpam下面就没有 > > “num_rmids”: > The number of RMIDs available. This is the upper bound for how many “CTRL_MON” + “MON” groups can be created. > “mon_features”: > Lists the monitoring events if monitoring is enabled for the resource. > “max_threshold_occupancy”: > Read/write file provides the largest value (in bytes) at which a previously used LLC_occupancy counter can be considered for re-use. > > > > >

1 0

[PATCH 0/2] update openeuler_defconfig
by Yang Yingliang 21 Mar '20

21 Mar '20

Xie XiuQi (1): x86/config: enable CONFIG_CFQ_GROUP_IOSCHED Xiongfeng Wang (1): x86/openeuler_config: disable CONFIG_EFI_VARS arch/x86/configs/openeuler_defconfig | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) -- 1.8.3

1 2

[PATCH] btrfs: don't use WARN_ON when ret is -ENOTENT in __btrfs_free_extent()
by Yang Yingliang 20 Mar '20

20 Mar '20

hulk inclusion category: bugfix bugzilla: 13690 CVE: CVE-2019-19039 ------------------------------------------------- Avoid register messages when ret is -ENOTENT. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/btrfs/extent-tree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 47ca1eb..4bf9318 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -6793,7 +6793,7 @@ static int __btrfs_free_extent(struct btrfs_trans_handle *trans, } extent_slot = path->slots[0]; } - } else if (WARN_ON(ret == -ENOENT)) { + } else if (ret == -ENOENT) { btrfs_print_leaf(path->nodes[0]); btrfs_err(info, "unable to find ref byte nr %llu parent %llu root %llu owner %llu offset %llu", -- 1.8.3

1 0

[PATCH v2] cifs: fix panic in smb2_reconnect
by Yang Yingliang 20 Mar '20

20 Mar '20

From: Ronnie Sahlberg <lsahlber(a)redhat.com> mainline inclusion from mainline-5.2-rc6 commit 0ff2b018b02f category: bugfix bugzilla: 16811 CVE: NA https://gitee.com/src-openeuler/cifs-utils/issues/I1C1QY?from=project-issue ------------------------------------------------- RH Bugzilla: 1702264 We need to protect so that the call to smb2_reconnect() in smb2_reconnect_server() does not end up freeing the session because it can lead to a use after free and crash. Reviewed-by: Aurelien Aptel <aaptel(a)suse.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Ronnie Sahlberg <lsahlber(a)redhat.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Reviewed-by: Pavel Shilovsky <pshilov(a)microsoft.com> Conflicts: fs/cifs/cifsproto.h fs/cifs/connect.c [yyl: make cifs_put_smb_ses() extern] --- fs/cifs/cifsproto.h | 2 ++ fs/cifs/connect.c | 3 +-- fs/cifs/smb2pdu.c | 10 +++++++++- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h index d7ac75e..bd97f2a 100644 --- a/fs/cifs/cifsproto.h +++ b/fs/cifs/cifsproto.h @@ -526,6 +526,8 @@ extern int E_md4hash(const unsigned char *passwd, unsigned char *p16, extern int SMBencrypt(unsigned char *passwd, const unsigned char *c8, unsigned char *p24); +extern void cifs_put_smb_ses(struct cifs_ses *ses); + void cifs_readdata_release(struct kref *refcount); int cifs_async_readv(struct cifs_readdata *rdata); int cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid); diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 975f800..f031420 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -2733,8 +2733,7 @@ static int match_session(struct cifs_ses *ses, struct smb_vol *vol) return NULL; } -static void -cifs_put_smb_ses(struct cifs_ses *ses) +void cifs_put_smb_ses(struct cifs_ses *ses) { unsigned int rc, xid; struct TCP_Server_Info *server = ses->server; diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 99efb2b..76dfb4f 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -2920,9 +2920,14 @@ void smb2_reconnect_server(struct work_struct *work) tcon_exist = true; } } + /* + * IPC has the same lifetime as its session and uses its + * refcount. + */ if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) { list_add_tail(&ses->tcon_ipc->rlist, &tmp_list); tcon_exist = true; + ses->ses_count++; } } /* @@ -2941,7 +2946,10 @@ void smb2_reconnect_server(struct work_struct *work) else resched = true; list_del_init(&tcon->rlist); - cifs_put_tcon(tcon); + if (tcon->ipc) + cifs_put_smb_ses(tcon->ses); + else + cifs_put_tcon(tcon); } cifs_dbg(FYI, "Reconnecting tcons finished\n"); -- 1.8.3

1 0

[PATCH] fs/cifs: cifs fix panic in smb2_reconnect
by linfeilong 19 Mar '20

19 Mar '20

From: Ronnie Sahlberg <lsahlber(a)redhat.com> mainline inclusion from mainline-v5.1-rc1 commit 0ff2b018b02f89da26a616e0148582321a00fd99 category: bugfix bugzilla: 1702264 CVE: NA ------------------------------------------------- We need to protect so that the call to smb2_reconnect() in smb2_reconnect_server() does not end up freeing the session because it can lead to a use after free and crash. [ 397.787693] CIFS VFS: cifs_mount failed w/return code = -2 [ 403.671998] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 [ 403.672065] PGD 0 P4D 0 [ 403.672087] Oops: 0000 [#1] SMP PTI [ 403.672114] CPU: 3 PID: 47 Comm: kworker/3:1 Kdump: loaded Not tainted 4.19.90-2003.1.1.0033.oe1.x86_64 #1 [ 403.672173] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.2-0-g5f4c7b1-20181220_000000-szxrtosci10000 04/01/2014 [ 403.673038] Workqueue: cifsiod smb2_reconnect_server [cifs] [ 403.673746] RIP: 0010:__list_del_entry_valid+0x25/0x90 [ 403.674448] Code: c3 0f 1f 40 00 48 8b 07 48 b9 00 01 00 00 00 00 ad de 48 8b 57 08 48 39 c8 74 26 48 b9 00 02 00 00 00 00 ad de 48 39 ca 74 2e <48> 8b 32 48 39 fe 75 3a 48 8b 50 08 48 39 f2 75 48 b8 01 00 00 00 [ 403.675955] RSP: 0018:ffffbd48007c3e18 EFLAGS: 00010207 [ 403.676696] RAX: 0000000000000000 RBX: ffffbd48007c3e50 RCX: dead000000000200 [ 403.677447] RDX: 0000000000000000 RSI: 0000000000000206 RDI: ffff9bee27f65818 [ 403.678214] RBP: ffffbd48007c3e38 R08: ffff9bee3bba3038 R09: 00000000000002c2 [ 403.679001] R10: ffffbd48006a3d90 R11: 0000000000000000 R12: ffff9bee27f66818 [ 403.679811] R13: 0000000000000001 R14: ffff9bee27f65800 R15: ffff9bee27f65818 [ 403.680639] FS: 0000000000000000(0000) GS:ffff9bee3bb80000(0000) knlGS:0000000000000000 [ 403.681505] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 403.682391] CR2: 0000000000000000 CR3: 000000003040a005 CR4: 00000000003606e0 [ 403.683315] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 403.684247] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 403.685181] Call Trace: [ 403.686141] smb2_reconnect_server+0x17a/0x340 [cifs] [ 403.687118] process_one_work+0x195/0x3d0 [ 403.688102] worker_thread+0x30/0x390 [ 403.689096] ? process_one_work+0x3d0/0x3d0 [ 403.690111] kthread+0x113/0x130 [ 403.691132] ? kthread_create_worker_on_cpu+0x70/0x70 [ 403.692181] ret_from_fork+0x35/0x40 Reviewed-by: Aurelien Aptel <aaptel(a)suse.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Ronnie Sahlberg <lsahlber(a)redhat.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Reviewed-by: Pavel Shilovsky <pshilov(a)microsoft.com> Signed-off-by: Feilong Lin <linfeilong(a)huawei.com> --- fs/cifs/cifsproto.h | 2 ++ fs/cifs/connect.c | 3 +-- fs/cifs/smb2pdu.c | 10 +++++++++- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h index d7ac75e..bd97f2a 100644 --- a/fs/cifs/cifsproto.h +++ b/fs/cifs/cifsproto.h @@ -526,6 +526,8 @@ extern int E_md4hash(const unsigned char *passwd, unsigned char *p16, extern int SMBencrypt(unsigned char *passwd, const unsigned char *c8, unsigned char *p24); +extern void cifs_put_smb_ses(struct cifs_ses *ses); + void cifs_readdata_release(struct kref *refcount); int cifs_async_readv(struct cifs_readdata *rdata); int cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid); diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 7e85070..2e46a8a 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -2732,8 +2732,7 @@ cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb_vol *vol) return NULL; } -static void -cifs_put_smb_ses(struct cifs_ses *ses) +void cifs_put_smb_ses(struct cifs_ses *ses) { unsigned int rc, xid; struct TCP_Server_Info *server = ses->server; diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 30417d4..97995b2 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -2914,9 +2914,14 @@ void smb2_reconnect_server(struct work_struct *work) tcon_exist = true; } } + /* + * IPC has the same lifetime as its session and uses its + * refcount. + */ if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) { list_add_tail(&ses->tcon_ipc->rlist, &tmp_list); tcon_exist = true; + ses->ses_count++; } } /* @@ -2935,7 +2940,10 @@ void smb2_reconnect_server(struct work_struct *work) else resched = true; list_del_init(&tcon->rlist); - cifs_put_tcon(tcon); + if (tcon->ipc) + cifs_put_smb_ses(tcon->ses); + else + cifs_put_tcon(tcon); } cifs_dbg(FYI, "Reconnecting tcons finished\n"); -- 1.8.3.1

1 0

[PATCH 1/2] xfs: always init fdblocks in mount
by Yang Yingliang 18 Mar '20

18 Mar '20

From: Zheng Bin <zhengbin13(a)huawei.com> hulk inclusion category: bugfix bugzilla: 31088 CVE: NA --------------------------- Use fuzz(hydra) to test XFS and automatically generate tmp.img(XFS v5 format, but some metadata is wrong) xfs_repair information(just one AG): agf_freeblks 0, counted 3224 in ag 0 agf_longest 0, counted 3224 in ag 0 sb_fdblocks 3228, counted 3224 Test as follows: mount tmp.img tmpdir cp file1M tmpdir sync In 4.19-stable, sync will stuck, while in linux-next, sync not stuck. The reason is same to commit d0c7feaf8767 ("xfs: add agf freeblocks verify in xfs_agf_verify"), cause agf_longest is 0, we can not block this in xfs_agf_verify. Make sure fdblocks is always inited in mount(also init ifree, icount). xfs_mountfs xfs_check_summary_counts xfs_initialize_perag_data Signed-off-by: Zheng Bin <zhengbin13(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/xfs/libxfs/xfs_ag_resv.c | 11 +++++++---- fs/xfs/xfs_mount.c | 33 --------------------------------- 2 files changed, 7 insertions(+), 37 deletions(-) diff --git a/fs/xfs/libxfs/xfs_ag_resv.c b/fs/xfs/libxfs/xfs_ag_resv.c index e2ba2a3..4f099fc 100644 --- a/fs/xfs/libxfs/xfs_ag_resv.c +++ b/fs/xfs/libxfs/xfs_ag_resv.c @@ -309,10 +309,13 @@ } #ifdef DEBUG - /* need to read in the AGF for the ASSERT below to work */ - error = xfs_alloc_pagf_init(pag->pag_mount, tp, pag->pag_agno, 0); - if (error) - return error; + if (!pag->pagf_init) { + /* need to read in the AGF for the ASSERT below to work */ + error = xfs_alloc_pagf_init(pag->pag_mount, tp, + pag->pag_agno, 0); + if (error) + return error; + } ASSERT(xfs_perag_resv(pag, XFS_AG_RESV_METADATA)->ar_reserved + xfs_perag_resv(pag, XFS_AG_RESV_RMAPBT)->ar_reserved <= diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c index 02d1509..3af91e2 100644 --- a/fs/xfs/xfs_mount.c +++ b/fs/xfs/xfs_mount.c @@ -624,39 +624,6 @@ return -EFSCORRUPTED; } - /* - * Now the log is mounted, we know if it was an unclean shutdown or - * not. If it was, with the first phase of recovery has completed, we - * have consistent AG blocks on disk. We have not recovered EFIs yet, - * but they are recovered transactionally in the second recovery phase - * later. - * - * If the log was clean when we mounted, we can check the summary - * counters. If any of them are obviously incorrect, we can recompute - * them from the AGF headers in the next step. - */ - if (XFS_LAST_UNMOUNT_WAS_CLEAN(mp) && - (mp->m_sb.sb_fdblocks > mp->m_sb.sb_dblocks || - !xfs_verify_icount(mp, mp->m_sb.sb_icount) || - mp->m_sb.sb_ifree > mp->m_sb.sb_icount)) - mp->m_flags |= XFS_MOUNT_BAD_SUMMARY; - - /* - * We can safely re-initialise incore superblock counters from the - * per-ag data. These may not be correct if the filesystem was not - * cleanly unmounted, so we waited for recovery to finish before doing - * this. - * - * If the filesystem was cleanly unmounted or the previous check did - * not flag anything weird, then we can trust the values in the - * superblock to be correct and we don't need to do anything here. - * Otherwise, recalculate the summary counters. - */ - if ((!xfs_sb_version_haslazysbcount(&mp->m_sb) || - XFS_LAST_UNMOUNT_WAS_CLEAN(mp)) && - !(mp->m_flags & XFS_MOUNT_BAD_SUMMARY)) - return 0; - return xfs_initialize_perag_data(mp, mp->m_sb.sb_agcount); } -- 1.8.3

1 1

[PATCH] xfs: devirtualize ->sf_entsize and ->sf_nextentry
by Yang Yingliang 18 Mar '20

18 Mar '20

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-5.5-rc1 commit 50f6bb6b7aea8177110e55355c455f18912a7a73 category: bugfix bugzilla: 31596 CVE: NA --------------------------- Just check for file-type enabled directories directly. Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Darrick J. Wong <darrick.wong(a)oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong(a)oracle.com> Conflicts: fs/xfs/libxfs/xfs_dir2_priv.h fs/xfs/libxfs/xfs_dir2_sf.c fs/xfs/xfs_dir2_readdir.c [zb: since patch 84915e1bdddf, 707e0ddaf67e, e91ec882af21, 04df34ac6494 not merged, adjust code] Signed-off-by: Zheng Bin <zhengbin13(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/xfs/libxfs/xfs_da_format.c | 48 --------------------- fs/xfs/libxfs/xfs_dir2.h | 4 -- fs/xfs/libxfs/xfs_dir2_block.c | 2 +- fs/xfs/libxfs/xfs_dir2_priv.h | 2 + fs/xfs/libxfs/xfs_dir2_sf.c | 96 +++++++++++++++++++++++++----------------- fs/xfs/xfs_dir2_readdir.c | 7 +-- 6 files changed, 64 insertions(+), 95 deletions(-) diff --git a/fs/xfs/libxfs/xfs_da_format.c b/fs/xfs/libxfs/xfs_da_format.c index b39053d..39c2610 100644 --- a/fs/xfs/libxfs/xfs_da_format.c +++ b/fs/xfs/libxfs/xfs_da_format.c @@ -18,48 +18,6 @@ #include "xfs_dir2_priv.h" /* - * Shortform directory ops - */ -static int -xfs_dir2_sf_entsize( - struct xfs_dir2_sf_hdr *hdr, - int len) -{ - int count = sizeof(struct xfs_dir2_sf_entry); /* namelen + offset */ - - count += len; /* name */ - count += hdr->i8count ? XFS_INO64_SIZE : XFS_INO32_SIZE; /* ino # */ - return count; -} - -static int -xfs_dir3_sf_entsize( - struct xfs_dir2_sf_hdr *hdr, - int len) -{ - return xfs_dir2_sf_entsize(hdr, len) + sizeof(uint8_t); -} - -static struct xfs_dir2_sf_entry * -xfs_dir2_sf_nextentry( - struct xfs_dir2_sf_hdr *hdr, - struct xfs_dir2_sf_entry *sfep) -{ - return (struct xfs_dir2_sf_entry *) - ((char *)sfep + xfs_dir2_sf_entsize(hdr, sfep->namelen)); -} - -static struct xfs_dir2_sf_entry * -xfs_dir3_sf_nextentry( - struct xfs_dir2_sf_hdr *hdr, - struct xfs_dir2_sf_entry *sfep) -{ - return (struct xfs_dir2_sf_entry *) - ((char *)sfep + xfs_dir3_sf_entsize(hdr, sfep->namelen)); -} - - -/* * For filetype enabled shortform directories, the file type field is stored at * the end of the name. Because it's only a single byte, endian conversion is * not necessary. For non-filetype enable directories, the type is always @@ -692,8 +650,6 @@ } static const struct xfs_dir_ops xfs_dir2_ops = { - .sf_entsize = xfs_dir2_sf_entsize, - .sf_nextentry = xfs_dir2_sf_nextentry, .sf_get_ftype = xfs_dir2_sfe_get_ftype, .sf_put_ftype = xfs_dir2_sfe_put_ftype, .sf_get_ino = xfs_dir2_sfe_get_ino, @@ -742,8 +698,6 @@ }; static const struct xfs_dir_ops xfs_dir2_ftype_ops = { - .sf_entsize = xfs_dir3_sf_entsize, - .sf_nextentry = xfs_dir3_sf_nextentry, .sf_get_ftype = xfs_dir3_sfe_get_ftype, .sf_put_ftype = xfs_dir3_sfe_put_ftype, .sf_get_ino = xfs_dir3_sfe_get_ino, @@ -792,8 +746,6 @@ }; static const struct xfs_dir_ops xfs_dir3_ops = { - .sf_entsize = xfs_dir3_sf_entsize, - .sf_nextentry = xfs_dir3_sf_nextentry, .sf_get_ftype = xfs_dir3_sfe_get_ftype, .sf_put_ftype = xfs_dir3_sfe_put_ftype, .sf_get_ino = xfs_dir3_sfe_get_ino, diff --git a/fs/xfs/libxfs/xfs_dir2.h b/fs/xfs/libxfs/xfs_dir2.h index c3e3f6b..155bae5 100644 --- a/fs/xfs/libxfs/xfs_dir2.h +++ b/fs/xfs/libxfs/xfs_dir2.h @@ -30,10 +30,6 @@ * directory operations vector for encode/decode routines */ struct xfs_dir_ops { - int (*sf_entsize)(struct xfs_dir2_sf_hdr *hdr, int len); - struct xfs_dir2_sf_entry * - (*sf_nextentry)(struct xfs_dir2_sf_hdr *hdr, - struct xfs_dir2_sf_entry *sfep); uint8_t (*sf_get_ftype)(struct xfs_dir2_sf_entry *sfep); void (*sf_put_ftype)(struct xfs_dir2_sf_entry *sfep, uint8_t ftype); diff --git a/fs/xfs/libxfs/xfs_dir2_block.c b/fs/xfs/libxfs/xfs_dir2_block.c index 30ed591..fdcf6aa 100644 --- a/fs/xfs/libxfs/xfs_dir2_block.c +++ b/fs/xfs/libxfs/xfs_dir2_block.c @@ -1235,7 +1235,7 @@ static int xfs_dir2_block_lookup_int(xfs_da_args_t *args, struct xfs_buf **bpp, if (++i == sfp->count) sfep = NULL; else - sfep = dp->d_ops->sf_nextentry(sfp, sfep); + sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep); } /* Done with the temporary buffer */ kmem_free(sfp); diff --git a/fs/xfs/libxfs/xfs_dir2_priv.h b/fs/xfs/libxfs/xfs_dir2_priv.h index 59f9fb2..655fb33 100644 --- a/fs/xfs/libxfs/xfs_dir2_priv.h +++ b/fs/xfs/libxfs/xfs_dir2_priv.h @@ -108,6 +108,8 @@ extern int xfs_dir2_free_read(struct xfs_trans *tp, struct xfs_inode *dp, xfs_dablk_t fbno, struct xfs_buf **bpp); /* xfs_dir2_sf.c */ +struct xfs_dir2_sf_entry *xfs_dir2_sf_nextentry(struct xfs_mount *mp, + struct xfs_dir2_sf_hdr *hdr, struct xfs_dir2_sf_entry *sfep); extern int xfs_dir2_block_sfsize(struct xfs_inode *dp, struct xfs_dir2_data_hdr *block, struct xfs_dir2_sf_hdr *sfhp); extern int xfs_dir2_block_to_sf(struct xfs_da_args *args, struct xfs_buf *bp, diff --git a/fs/xfs/libxfs/xfs_dir2_sf.c b/fs/xfs/libxfs/xfs_dir2_sf.c index 585dfdb..716c8c5 100644 --- a/fs/xfs/libxfs/xfs_dir2_sf.c +++ b/fs/xfs/libxfs/xfs_dir2_sf.c @@ -40,6 +40,31 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, static void xfs_dir2_sf_toino4(xfs_da_args_t *args); static void xfs_dir2_sf_toino8(xfs_da_args_t *args); +static int +xfs_dir2_sf_entsize( + struct xfs_mount *mp, + struct xfs_dir2_sf_hdr *hdr, + int len) +{ + int count = len; + + count += sizeof(struct xfs_dir2_sf_entry); /* namelen + offset */ + count += hdr->i8count ? XFS_INO64_SIZE : XFS_INO32_SIZE; /* ino # */ + + if (xfs_sb_version_hasftype(&mp->m_sb)) + count += sizeof(uint8_t); + return count; +} + +struct xfs_dir2_sf_entry * +xfs_dir2_sf_nextentry( + struct xfs_mount *mp, + struct xfs_dir2_sf_hdr *hdr, + struct xfs_dir2_sf_entry *sfep) +{ + return (void *)sfep + xfs_dir2_sf_entsize(mp, hdr, sfep->namelen); +} + /* * Given a block directory (dp/block), calculate its size as a shortform (sf) * directory and a header for the sf directory, if it will fit it the @@ -222,7 +247,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, dp->d_ops->sf_put_ftype(sfep, dp->d_ops->data_get_ftype(dep)); - sfep = dp->d_ops->sf_nextentry(sfp, sfep); + sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep); } ptr += dp->d_ops->data_entsize(dep->namelen); } @@ -294,7 +319,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, /* * Compute entry (and change in) size. */ - incr_isize = dp->d_ops->sf_entsize(sfp, args->namelen); + incr_isize = xfs_dir2_sf_entsize(dp->i_mount, sfp, args->namelen); objchange = 0; /* @@ -367,18 +392,17 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, xfs_dir2_data_aoff_t offset, /* offset to use for new ent */ int new_isize) /* new directory size */ { + struct xfs_inode *dp = args->dp; + struct xfs_mount *mp = dp->i_mount; int byteoff; /* byte offset in sf dir */ - xfs_inode_t *dp; /* incore directory inode */ xfs_dir2_sf_hdr_t *sfp; /* shortform structure */ - dp = args->dp; - sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data; byteoff = (int)((char *)sfep - (char *)sfp); /* * Grow the in-inode space. */ - xfs_idata_realloc(dp, dp->d_ops->sf_entsize(sfp, args->namelen), + xfs_idata_realloc(dp, xfs_dir2_sf_entsize(mp, sfp, args->namelen), XFS_DATA_FORK); /* * Need to set up again due to realloc of the inode data. @@ -419,9 +443,10 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, int objchange, /* changing inode number size */ int new_isize) /* new directory size */ { + struct xfs_inode *dp = args->dp; + struct xfs_mount *mp = dp->i_mount; int add_datasize; /* data size need for new ent */ char *buf; /* buffer for old */ - xfs_inode_t *dp; /* incore directory inode */ int eof; /* reached end of old dir */ int nbytes; /* temp for byte copies */ xfs_dir2_data_aoff_t new_offset; /* next offset value */ @@ -435,8 +460,6 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, /* * Copy the old directory to the stack buffer. */ - dp = args->dp; - sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data; old_isize = (int)dp->i_d.di_size; buf = kmem_alloc(old_isize, KM_SLEEP); @@ -453,7 +476,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, eof = (char *)oldsfep == &buf[old_isize]; !eof; offset = new_offset + dp->d_ops->data_entsize(oldsfep->namelen), - oldsfep = dp->d_ops->sf_nextentry(oldsfp, oldsfep), + oldsfep = xfs_dir2_sf_nextentry(mp, oldsfp, oldsfep), eof = (char *)oldsfep == &buf[old_isize]) { new_offset = xfs_dir2_sf_get_offset(oldsfep); if (offset + add_datasize <= new_offset) @@ -491,7 +514,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, * If there's more left to copy, do that. */ if (!eof) { - sfep = dp->d_ops->sf_nextentry(sfp, sfep); + sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep); memcpy(sfep, oldsfep, old_isize - nbytes); } kmem_free(buf); @@ -513,7 +536,8 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, xfs_dir2_sf_entry_t **sfepp, /* out(1): new entry ptr */ xfs_dir2_data_aoff_t *offsetp) /* out(1): new offset */ { - xfs_inode_t *dp; /* incore directory inode */ + struct xfs_inode *dp = args->dp; + struct xfs_mount *mp = dp->i_mount; int holefit; /* found hole it will fit in */ int i; /* entry number */ xfs_dir2_data_aoff_t offset; /* data block offset */ @@ -522,8 +546,6 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, int size; /* entry's data size */ int used; /* data bytes used */ - dp = args->dp; - sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data; size = dp->d_ops->data_entsize(args->namelen); offset = dp->d_ops->data_first_offset; @@ -539,7 +561,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, holefit = offset + size <= xfs_dir2_sf_get_offset(sfep); offset = xfs_dir2_sf_get_offset(sfep) + dp->d_ops->data_entsize(sfep->namelen); - sfep = dp->d_ops->sf_nextentry(sfp, sfep); + sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep); } /* * Calculate data bytes used excluding the new entry, if this @@ -598,7 +620,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, for (i = 0, sfep = xfs_dir2_sf_firstentry(sfp); i < sfp->count; - i++, sfep = dp->d_ops->sf_nextentry(sfp, sfep)) { + i++, sfep = xfs_dir2_sf_nextentry(dp->i_mount, sfp, sfep)) { ASSERT(xfs_dir2_sf_get_offset(sfep) >= offset); ino = dp->d_ops->sf_get_ino(sfp, sfep); i8count += ino > XFS_DIR2_MAX_SHORT_INUM; @@ -683,7 +705,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, * within the data buffer. The next entry starts after the * name component, so nextentry is an acceptable test. */ - next_sfep = dops->sf_nextentry(sfp, sfep); + next_sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep); if (endp < (char *)next_sfep) return __this_address; @@ -782,7 +804,8 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, xfs_dir2_sf_lookup( xfs_da_args_t *args) /* operation arguments */ { - xfs_inode_t *dp; /* incore directory inode */ + struct xfs_inode *dp = args->dp; + struct xfs_mount *mp = dp->i_mount; int i; /* entry index */ int error; xfs_dir2_sf_entry_t *sfep; /* shortform directory entry */ @@ -793,7 +816,6 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, trace_xfs_dir2_sf_lookup(args); xfs_dir2_sf_check(args); - dp = args->dp; ASSERT(dp->i_df.if_flags & XFS_IFINLINE); /* @@ -831,7 +853,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, */ ci_sfep = NULL; for (i = 0, sfep = xfs_dir2_sf_firstentry(sfp); i < sfp->count; - i++, sfep = dp->d_ops->sf_nextentry(sfp, sfep)) { + i++, sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep)) { /* * Compare name and if it's an exact match, return the inode * number. If it's the first case-insensitive match, store the @@ -867,8 +889,9 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, xfs_dir2_sf_removename( xfs_da_args_t *args) { + struct xfs_inode *dp = args->dp; + struct xfs_mount *mp = dp->i_mount; int byteoff; /* offset of removed entry */ - xfs_inode_t *dp; /* incore directory inode */ int entsize; /* this entry's size */ int i; /* shortform entry index */ int newsize; /* new inode size */ @@ -878,8 +901,6 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, trace_xfs_dir2_sf_removename(args); - dp = args->dp; - ASSERT(dp->i_df.if_flags & XFS_IFINLINE); oldsize = (int)dp->i_d.di_size; /* @@ -898,7 +919,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, * Find the one we're deleting. */ for (i = 0, sfep = xfs_dir2_sf_firstentry(sfp); i < sfp->count; - i++, sfep = dp->d_ops->sf_nextentry(sfp, sfep)) { + i++, sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep)) { if (xfs_da_compname(args, sfep->name, sfep->namelen) == XFS_CMP_EXACT) { ASSERT(dp->d_ops->sf_get_ino(sfp, sfep) == @@ -915,7 +936,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, * Calculate sizes. */ byteoff = (int)((char *)sfep - (char *)sfp); - entsize = dp->d_ops->sf_entsize(sfp, args->namelen); + entsize = xfs_dir2_sf_entsize(mp, sfp, args->namelen); newsize = oldsize - entsize; /* * Copy the part if any after the removed entry, sliding it down. @@ -954,7 +975,8 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, xfs_dir2_sf_replace( xfs_da_args_t *args) /* operation arguments */ { - xfs_inode_t *dp; /* incore directory inode */ + struct xfs_inode *dp = args->dp; + struct xfs_mount *mp = dp->i_mount; int i; /* entry index */ xfs_ino_t ino=0; /* entry old inode number */ int i8elevated; /* sf_toino8 set i8count=1 */ @@ -963,8 +985,6 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, trace_xfs_dir2_sf_replace(args); - dp = args->dp; - ASSERT(dp->i_df.if_flags & XFS_IFINLINE); /* * Bail out if the shortform directory is way too small. @@ -1020,7 +1040,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, */ else { for (i = 0, sfep = xfs_dir2_sf_firstentry(sfp); i < sfp->count; - i++, sfep = dp->d_ops->sf_nextentry(sfp, sfep)) { + i++, sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep)) { if (xfs_da_compname(args, sfep->name, sfep->namelen) == XFS_CMP_EXACT) { ino = dp->d_ops->sf_get_ino(sfp, sfep); @@ -1079,8 +1099,9 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, xfs_dir2_sf_toino4( xfs_da_args_t *args) /* operation arguments */ { + struct xfs_inode *dp = args->dp; + struct xfs_mount *mp = dp->i_mount; char *buf; /* old dir's buffer */ - xfs_inode_t *dp; /* incore directory inode */ int i; /* entry index */ int newsize; /* new inode size */ xfs_dir2_sf_entry_t *oldsfep; /* old sf entry */ @@ -1091,8 +1112,6 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, trace_xfs_dir2_sf_toino4(args); - dp = args->dp; - /* * Copy the old directory to the buffer. * Then nuke it from the inode, and add the new buffer to the inode. @@ -1126,8 +1145,8 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, for (i = 0, sfep = xfs_dir2_sf_firstentry(sfp), oldsfep = xfs_dir2_sf_firstentry(oldsfp); i < sfp->count; - i++, sfep = dp->d_ops->sf_nextentry(sfp, sfep), - oldsfep = dp->d_ops->sf_nextentry(oldsfp, oldsfep)) { + i++, sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep), + oldsfep = xfs_dir2_sf_nextentry(mp, oldsfp, oldsfep)) { sfep->namelen = oldsfep->namelen; memcpy(sfep->offset, oldsfep->offset, sizeof(sfep->offset)); memcpy(sfep->name, oldsfep->name, sfep->namelen); @@ -1152,8 +1171,9 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, xfs_dir2_sf_toino8( xfs_da_args_t *args) /* operation arguments */ { + struct xfs_inode *dp = args->dp; + struct xfs_mount *mp = dp->i_mount; char *buf; /* old dir's buffer */ - xfs_inode_t *dp; /* incore directory inode */ int i; /* entry index */ int newsize; /* new inode size */ xfs_dir2_sf_entry_t *oldsfep; /* old sf entry */ @@ -1164,8 +1184,6 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, trace_xfs_dir2_sf_toino8(args); - dp = args->dp; - /* * Copy the old directory to the buffer. * Then nuke it from the inode, and add the new buffer to the inode. @@ -1199,8 +1217,8 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, for (i = 0, sfep = xfs_dir2_sf_firstentry(sfp), oldsfep = xfs_dir2_sf_firstentry(oldsfp); i < sfp->count; - i++, sfep = dp->d_ops->sf_nextentry(sfp, sfep), - oldsfep = dp->d_ops->sf_nextentry(oldsfp, oldsfep)) { + i++, sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep), + oldsfep = xfs_dir2_sf_nextentry(mp, oldsfp, oldsfep)) { sfep->namelen = oldsfep->namelen; memcpy(sfep->offset, oldsfep->offset, sizeof(sfep->offset)); memcpy(sfep->name, oldsfep->name, sfep->namelen); diff --git a/fs/xfs/xfs_dir2_readdir.c b/fs/xfs/xfs_dir2_readdir.c index 5142e64..2ae98c2 100644 --- a/fs/xfs/xfs_dir2_readdir.c +++ b/fs/xfs/xfs_dir2_readdir.c @@ -50,6 +50,7 @@ { int i; /* shortform entry number */ struct xfs_inode *dp = args->dp; /* incore directory inode */ + struct xfs_mount *mp = dp->i_mount; xfs_dir2_dataptr_t off; /* current entry's offset */ xfs_dir2_sf_entry_t *sfep; /* shortform directory entry */ xfs_dir2_sf_hdr_t *sfp; /* shortform structure */ @@ -111,7 +112,7 @@ xfs_dir2_sf_get_offset(sfep)); if (ctx->pos > off) { - sfep = dp->d_ops->sf_nextentry(sfp, sfep); + sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep); continue; } @@ -119,9 +120,9 @@ filetype = dp->d_ops->sf_get_ftype(sfep); ctx->pos = off & 0x7fffffff; if (!dir_emit(ctx, (char *)sfep->name, sfep->namelen, ino, - xfs_dir3_get_dtype(dp->i_mount, filetype))) + xfs_dir3_get_dtype(mp, filetype))) return 0; - sfep = dp->d_ops->sf_nextentry(sfp, sfep); + sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep); } ctx->pos = xfs_dir2_db_off_to_dataptr(geo, geo->datablk + 1, 0) & -- 1.8.3

1 0

[PATCH 1/2] block: delete part_round_stats and switch to less precise counting
by Yang Yingliang 18 Mar '20

18 Mar '20

From: Mikulas Patocka <mpatocka(a)redhat.com> mainline inclusion from mainline-5.0-rc1 commit 5b18b5a737600fd20ba2045f320d5926ebbf341a category: bugfix bugzilla: 31388 CVE: NA --------------------------- We want to convert to per-cpu in_flight counters. The function part_round_stats needs the in_flight counter every jiffy, it would be too costly to sum all the percpu variables every jiffy, so it must be deleted. part_round_stats is used to calculate two counters - time_in_queue and io_ticks. time_in_queue can be calculated without part_round_stats, by adding the duration of the I/O when the I/O ends (the value is almost as exact as the previously calculated value, except that time for in-progress I/Os is not counted). io_ticks can be approximated by increasing the value when I/O is started or ended and the jiffies value has changed. If the I/Os take less than a jiffy, the value is as exact as the previously calculated value. If the I/Os take more than a jiffy, io_ticks can drift behind the previously calculated value. Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)redhat.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflict: block/bio.c block/blk-core.c block/blk-merge.c block/genhd.c include/linux/genhd.h Signed-off-by: Yufen Yu <yuyufen(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/bio.c | 23 ++++++++++++++++++++--- block/blk-core.c | 6 ++++-- block/blk-merge.c | 1 - block/genhd.c | 4 ---- block/partition-generic.c | 4 ---- include/linux/genhd.h | 1 + 6 files changed, 25 insertions(+), 14 deletions(-) diff --git a/block/bio.c b/block/bio.c index 3d7570553..48a8cf5 100644 --- a/block/bio.c +++ b/block/bio.c @@ -1668,13 +1668,28 @@ void bio_check_pages_dirty(struct bio *bio) } EXPORT_SYMBOL_GPL(bio_check_pages_dirty); +void update_io_ticks(int cpu, struct hd_struct *part, unsigned long now) +{ + unsigned long stamp; +again: + stamp = READ_ONCE(part->stamp); + if (unlikely(stamp != now)) { + if (likely(cmpxchg(&part->stamp, stamp, now) == stamp)) + __part_stat_add(cpu, part, io_ticks, 1); + } + if (part->partno) { + part = &part_to_disk(part)->part0; + goto again; + } +} + void generic_start_io_acct(struct request_queue *q, int op, unsigned long sectors, struct hd_struct *part) { const int sgrp = op_stat_group(op); int cpu = part_stat_lock(); - part_round_stats(q, cpu, part); + update_io_ticks(cpu, part, jiffies); part_stat_inc(cpu, part, ios[sgrp]); part_stat_add(cpu, part, sectors[sgrp], sectors); part_inc_in_flight(q, part, op_is_write(op)); @@ -1686,12 +1701,14 @@ void generic_start_io_acct(struct request_queue *q, int op, void generic_end_io_acct(struct request_queue *q, int req_op, struct hd_struct *part, unsigned long start_time) { - unsigned long duration = jiffies - start_time; + unsigned long now = jiffies; + unsigned long duration = now - start_time; const int sgrp = op_stat_group(req_op); int cpu = part_stat_lock(); + update_io_ticks(cpu, part, now); part_stat_add(cpu, part, nsecs[sgrp], jiffies_to_nsecs(duration)); - part_round_stats(q, cpu, part); + part_stat_add(cpu, part, time_in_queue, duration); part_dec_in_flight(q, part, op_is_write(req_op)); part_stat_unlock(); diff --git a/block/blk-core.c b/block/blk-core.c index b64dec2..d9e3ee6 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -2740,9 +2740,10 @@ void blk_account_io_done(struct request *req, u64 now) cpu = part_stat_lock(); part = req->part; + update_io_ticks(cpu, part, jiffies); part_stat_inc(cpu, part, ios[sgrp]); part_stat_add(cpu, part, nsecs[sgrp], now - req->start_time_ns); - part_round_stats(req->q, cpu, part); + part_stat_add(cpu, part, time_in_queue, nsecs_to_jiffies64(now - req->start_time_ns)); part_dec_in_flight(req->q, part, rq_data_dir(req)); hd_struct_put(part); @@ -2790,11 +2791,12 @@ void blk_account_io_start(struct request *rq, bool new_io) part_stat_inc(cpu, part, merges[rw]); } else { part = disk_map_sector_rcu(rq->rq_disk, blk_rq_pos(rq)); - part_round_stats(rq->q, cpu, part); part_inc_in_flight(rq->q, part, rw); rq->part = part; } + update_io_ticks(cpu, part, jiffies); + part_stat_unlock(); } diff --git a/block/blk-merge.c b/block/blk-merge.c index 7efa8c3..044bff9 100644 --- a/block/blk-merge.c +++ b/block/blk-merge.c @@ -656,7 +656,6 @@ static void blk_account_io_merge(struct request *req) cpu = part_stat_lock(); part = req->part; - part_round_stats(req->q, cpu, part); part_dec_in_flight(req->q, part, rq_data_dir(req)); hd_struct_put(part); diff --git a/block/genhd.c b/block/genhd.c index ff9d46d..862a2f3 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -1342,7 +1342,6 @@ static int diskstats_show(struct seq_file *seqf, void *v) struct hd_struct *hd; char buf[BDEVNAME_SIZE]; unsigned int inflight[2]; - int cpu; /* if (&disk_to_dev(gp)->kobj.entry == block_class.devices.next) @@ -1354,9 +1353,6 @@ static int diskstats_show(struct seq_file *seqf, void *v) disk_part_iter_init(&piter, gp, DISK_PITER_INCL_EMPTY_PART0); while ((hd = disk_part_iter_next(&piter))) { - cpu = part_stat_lock(); - part_round_stats(gp->queue, cpu, hd); - part_stat_unlock(); part_in_flight(gp->queue, hd, inflight); seq_printf(seqf, "%4d %7d %s " "%lu %lu %lu %u " diff --git a/block/partition-generic.c b/block/partition-generic.c index 8ad6dca..d86d794 100644 --- a/block/partition-generic.c +++ b/block/partition-generic.c @@ -121,11 +121,7 @@ ssize_t part_stat_show(struct device *dev, struct hd_struct *p = dev_to_part(dev); struct request_queue *q = part_to_disk(p)->queue; unsigned int inflight[2]; - int cpu; - cpu = part_stat_lock(); - part_round_stats(q, cpu, p); - part_stat_unlock(); part_in_flight(q, p, inflight); return sprintf(buf, "%8lu %8lu %8llu %8u " diff --git a/include/linux/genhd.h b/include/linux/genhd.h index df0d01d..666b23a 100644 --- a/include/linux/genhd.h +++ b/include/linux/genhd.h @@ -422,6 +422,7 @@ static inline void free_part_info(struct hd_struct *part) /* block/blk-core.c */ extern void part_round_stats(struct request_queue *q, int cpu, struct hd_struct *part); +void update_io_ticks(int cpu, struct hd_struct *part, unsigned long now); /* block/genhd.c */ extern void device_add_disk(struct device *parent, struct gendisk *disk); -- 1.8.3

1 1

[PATCH] CIFS: Fix bug which the return value by asynchronous read is error
by Yang Yingliang 18 Mar '20

18 Mar '20

From: Yilu Lin <linyilu(a)huawei.com> hulk inclusion category: bugfix bugzilla: 31384 CVE: NA ------------------------------------------------- This patch is used to fix the bug in collect_uncached_read_data() that rc is automatically converted from a signed number to an unsigned number when the CIFS asynchronous read fails. It will cause ctx->rc is error. Example: Share a directory and create a file on the Windows OS. Mount the directory to the Linux OS using CIFS. On the CIFS client of the Linux OS, invoke the pread interface to deliver the read request. The size of the read length plus offset of the read request is greater than the maximum file size. In this case, the CIFS server on the Windows OS returns a failure message (for example, the return value of smb2.nt_status is STATUS_INVALID_PARAMETER). After receiving the response message, the CIFS client parses smb2.nt_status to STATUS_INVALID_PARAMETER and converts it to the Linux error code (rdata->result=-22). Then the CIFS client invokes the collect_uncached_read_data function to assign the value of rdata->result to rc, that is, rc=rdata->result=-22. The type of the ctx->total_len variable is unsigned integer, the type of the rc variable is integer, and the type of the ctx->rc variable is ssize_t. Therefore, during the ternary operation, the value of rc is automatically converted to an unsigned number. The final result is ctx->rc=4294967274. However, the expected result is ctx->rc=-22. https://patchwork.kernel.org/patch/11444477/ Signed-off-by: Yilu Lin <linyilu(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/cifs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/cifs/file.c b/fs/cifs/file.c index e92513e..23b1098 100644 --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -3347,7 +3347,7 @@ ssize_t cifs_user_writev(struct kiocb *iocb, struct iov_iter *from) if (rc == -ENODATA) rc = 0; - ctx->rc = (rc == 0) ? ctx->total_len : rc; + ctx->rc = (rc == 0) ? (ssize_t)ctx->total_len : rc; mutex_unlock(&ctx->aio_mutex); -- 1.8.3

1 0

2024

2023

2022

2021

2020

2019

Kernel