July 2024 - Linux-stable-mirror

WARNING&Oops in v6.6.37 on ppc64lea - Trying to vfree() bad address (00000000453be747)

by Vitaly Chikunov

Hi, There is new WARNING and Oops on ppc64le in v6.6.37 when running LTP tests: bpf_prog01, bpf_prog02, bpf_prog04, bpf_prog05, prctl04. Logs excerpt below. I see there is 1 commit in v6.6.36..v6.6.37 with call to bpf_jit_binary_pack_finalize, backported from 5 patch mainline patchset: f99feda5684a powerpc/bpf: use bpf_jit_binary_pack_[alloc|finalize|free] Log: [ 8.822079] LTP: starting bpf_prog01 [ 8.841853] ------------[ cut here ]------------ [ 8.841946] Trying to vfree() bad address (00000000453be747) [ 8.842024] WARNING: CPU: 6 PID: 689 at mm/vmalloc.c:2700 remove_vm_area+0xb4/0xf0 [ 8.842103] Modules linked in: virtio_rng rng_core virtio_net net_failover failover sd_mod ata_generic ata_piix libata scsi_mod scsi_common virtio_blk virtio_pci virtio_pci_legacy_dev virtio_pci_modern_dev 9pnet_virtio virtio_ring virtio 9p 9pnet netfs [ 8.842323] CPU: 6 PID: 689 Comm: bpf_prog01 Not tainted 6.6.37-un-def-alt1 #1 [ 8.842396] Hardware name: IBM pSeries (emulated by qemu) POWER8 (raw) 0x4d0200 0xf000004 of:SLOF,git-3a259d hv:linux,kvm pSeries [ 8.842519] NIP: c0000000004faf04 LR: c0000000004faf00 CTR: 0000000000000000 [ 8.842598] REGS: c000000009b6f250 TRAP: 0700 Not tainted (6.6.37-un-def-alt1) [ 8.842669] MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 28002822 XER: 00000000 [ 8.842748] CFAR: c00000000015df94 IRQMASK: 0 [ 8.842748] GPR00: 0000000000000000 c000000009b6f4f0 c000000001ac7f00 0000000000000000 [ 8.842748] GPR04: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 8.842748] GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 8.842748] GPR12: 0000000000000000 c00000003fff7a00 0000000000000000 0000000000000000 [ 8.842748] GPR16: 0000000000000012 0000000000000000 000000000000008c 0000000000000000 [ 8.842748] GPR20: c008000000040a40 0000000000000002 c0000000022a7560 c008000000040a4c [ 8.842748] GPR24: c000000005716480 0000000000000000 c000000002155698 c0000000022a7680 [ 8.842748] GPR28: c000000002155688 c008000000040a40 c008000000040a40 c008000000040a40 [ 8.843347] NIP [c0000000004faf04] remove_vm_area+0xb4/0xf0 [ 8.843398] LR [c0000000004faf00] remove_vm_area+0xb0/0xf0 [ 8.843448] Call Trace: [ 8.843484] [c000000009b6f4f0] [c0000000004faf00] remove_vm_area+0xb0/0xf0 (unreliable) [ 8.843559] [c000000009b6f560] [c0000000004fb360] vfree+0x60/0x2a0 [ 8.843621] [c000000009b6f5e0] [c000000000269c6c] module_memfree+0x3c/0x60 [ 8.843685] [c000000009b6f600] [c00000000038cf60] bpf_jit_free_exec+0x20/0x40 [ 8.843759] [c000000009b6f620] [c00000000038f518] bpf_prog_pack_free+0x2f8/0x390 [ 8.843832] [c000000009b6f6b0] [c00000000038f878] bpf_jit_binary_pack_finalize+0x98/0xd0 [ 8.843906] [c000000009b6f6e0] [c000000000118240] bpf_int_jit_compile+0x2c0/0x710 [ 8.843979] [c000000009b6f830] [c00000000038ef64] bpf_prog_select_runtime+0x154/0x1b0 [ 8.844053] [c000000009b6f880] [c000000000398edc] bpf_prog_load+0x94c/0xe90 [ 8.844114] [c000000009b6f990] [c00000000039c878] __sys_bpf+0x418/0x2970 [ 8.844176] [c000000009b6fac0] [c00000000039f1a0] sys_bpf+0x30/0x50 [ 8.844237] [c000000009b6fae0] [c000000000030230] system_call_exception+0x190/0x390 [ 8.844312] [c000000009b6fe50] [c00000000000c7d4] system_call_common+0xf4/0x258 [ 8.844386] --- interrupt: c00 at 0x7fffb0839ad4 [ 8.844437] NIP: 00007fffb0839ad4 LR: 000000012a027fb4 CTR: 0000000000000000 [ 8.844524] REGS: c000000009b6fe80 TRAP: 0c00 Not tainted (6.6.37-un-def-alt1) [ 8.844596] MSR: 800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 22002240 XER: 00000000 [ 8.844690] IRQMASK: 0 [ 8.844690] GPR00: 0000000000000169 00007fffd8534200 00007fffb0936d00 0000000000000005 [ 8.844690] GPR04: 00007fffb06aff90 0000000000000070 000000012a0538a0 0000000000000001 [ 8.844690] GPR08: 000000012a0801f4 0000000000000000 0000000000000000 0000000000000000 [ 8.844690] GPR12: 0000000000000000 00007fffb09ea540 0000000000000000 0000000000000000 [ 8.844690] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 8.844690] GPR20: 00007fffd85344b0 0000000000000000 0000000000000001 0000000000000000 [ 8.844690] GPR24: 000000012a0801f4 00007fffb06ce000 0000000000000000 00000000000f4240 [ 8.844690] GPR28: 00007fffb06aff90 00007fffb09e3550 0000000000000001 0000000000001118 [ 8.845267] NIP [00007fffb0839ad4] 0x7fffb0839ad4 [ 8.845315] LR [000000012a027fb4] 0x12a027fb4 [ 8.845363] --- interrupt: c00 [ 8.845399] Code: 38000000 38800000 39200000 4e800020 60000000 60000000 60420000 3c62ffa2 7fe4fb78 3863e698 4bc62f8d 60000000 <0fe00000> 38210070 3bc00000 e8010010 [ 8.845550] ---[ end trace 0000000000000000 ]--- [ 8.845603] ------------[ cut here ]------------ [ 8.845651] Trying to vfree() nonexistent vm area (00000000453be747) [ 8.845714] WARNING: CPU: 6 PID: 689 at mm/vmalloc.c:2835 vfree+0x1d8/0x2a0 [ 8.845776] Modules linked in: virtio_rng rng_core virtio_net net_failover failover sd_mod ata_generic ata_piix libata scsi_mod scsi_common virtio_blk virtio_pci virtio_pci_legacy_dev virtio_pci_modern_dev 9pnet_virtio virtio_ring virtio 9p 9pnet netfs [ 8.845989] CPU: 6 PID: 689 Comm: bpf_prog01 Tainted: G W 6.6.37-un-def-alt1 #1 [ 8.846072] Hardware name: IBM pSeries (emulated by qemu) POWER8 (raw) 0x4d0200 0xf000004 of:SLOF,git-3a259d hv:linux,kvm pSeries [ 8.846177] NIP: c0000000004fb4d8 LR: c0000000004fb4d4 CTR: 0000000000000000 [ 8.846248] REGS: c000000009b6f2c0 TRAP: 0700 Tainted: G W (6.6.37-un-def-alt1) [ 8.846330] MSR: 8000000000029033 <SF,EE,ME,IR,DR,RI,LE> CR: 28002222 XER: 00000000 [ 8.846408] CFAR: c00000000015df94 IRQMASK: 0 [ 8.846408] GPR00: 0000000000000000 c000000009b6f560 c000000001ac7f00 0000000000000000 [ 8.846408] GPR04: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 8.846408] GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 8.846408] GPR12: 0000000000000000 c00000003fff7a00 0000000000000000 0000000000000000 [ 8.846408] GPR16: 0000000000000012 0000000000000000 000000000000008c 0000000000000000 [ 8.846408] GPR20: c008000000040a40 0000000000000002 c0000000022a7560 c008000000040a4c [ 8.846408] GPR24: c000000005716480 0000000000000000 c000000002155698 c0000000022a7680 [ 8.846408] GPR28: c000000002155688 0000000000000000 c008000000040a40 0000000000000000 [ 8.851030] NIP [c0000000004fb4d8] vfree+0x1d8/0x2a0 [ 8.851085] LR [c0000000004fb4d4] vfree+0x1d4/0x2a0 [ 8.851135] Call Trace: [ 8.851160] [c000000009b6f560] [c0000000004fb4d4] vfree+0x1d4/0x2a0 (unreliable) [ 8.851234] [c000000009b6f5e0] [c000000000269c6c] module_memfree+0x3c/0x60 [ 8.851297] [c000000009b6f600] [c00000000038cf60] bpf_jit_free_exec+0x20/0x40 [ 8.851371] [c000000009b6f620] [c00000000038f518] bpf_prog_pack_free+0x2f8/0x390 [ 8.851445] [c000000009b6f6b0] [c00000000038f878] bpf_jit_binary_pack_finalize+0x98/0xd0 [ 8.851529] [c000000009b6f6e0] [c000000000118240] bpf_int_jit_compile+0x2c0/0x710 [ 8.851602] [c000000009b6f830] [c00000000038ef64] bpf_prog_select_runtime+0x154/0x1b0 [ 8.851675] [c000000009b6f880] [c000000000398edc] bpf_prog_load+0x94c/0xe90 [ 8.851737] [c000000009b6f990] [c00000000039c878] __sys_bpf+0x418/0x2970 [ 8.851798] [c000000009b6fac0] [c00000000039f1a0] sys_bpf+0x30/0x50 [ 8.851860] [c000000009b6fae0] [c000000000030230] system_call_exception+0x190/0x390 [ 8.851934] [c000000009b6fe50] [c00000000000c7d4] system_call_common+0xf4/0x258 [ 8.852007] --- interrupt: c00 at 0x7fffb0839ad4 [ 8.852057] NIP: 00007fffb0839ad4 LR: 000000012a027fb4 CTR: 0000000000000000 [ 8.852128] REGS: c000000009b6fe80 TRAP: 0c00 Tainted: G W (6.6.37-un-def-alt1) [ 8.852212] MSR: 800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 22002240 XER: 00000000 [ 8.852307] IRQMASK: 0 [ 8.852307] GPR00: 0000000000000169 00007fffd8534200 00007fffb0936d00 0000000000000005 [ 8.852307] GPR04: 00007fffb06aff90 0000000000000070 000000012a0538a0 0000000000000001 [ 8.852307] GPR08: 000000012a0801f4 0000000000000000 0000000000000000 0000000000000000 [ 8.852307] GPR12: 0000000000000000 00007fffb09ea540 0000000000000000 0000000000000000 [ 8.852307] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 8.852307] GPR20: 00007fffd85344b0 0000000000000000 0000000000000001 0000000000000000 [ 8.852307] GPR24: 000000012a0801f4 00007fffb06ce000 0000000000000000 00000000000f4240 [ 8.852307] GPR28: 00007fffb06aff90 00007fffb09e3550 0000000000000001 0000000000001118 [ 8.852889] NIP [00007fffb0839ad4] 0x7fffb0839ad4 [ 8.852938] LR [000000012a027fb4] 0x12a027fb4 [ 8.852986] --- interrupt: c00 [ 8.853022] Code: 4e800020 60420000 3949ffff 4bffff0c 38210080 ebe1fff8 4bfffd68 3c62ffa2 7fc4f378 3863e6f0 4bc629b9 60000000 <0fe00000> eba10068 4bffff8c 2c080000 [ 8.853164] ---[ end trace 0000000000000000 ]--- [ 8.856619] kernel tried to execute exec-protected page (c008000000040a4c) - exploit attempt? (uid: 0) [ 8.856717] BUG: Unable to handle kernel instruction fetch [ 8.856763] Faulting instruction address: 0xc008000000040a4c [ 8.856825] Oops: Kernel access of bad area, sig: 11 [#1] [ 8.856875] LE PAGE_SIZE=64K MMU=Hash SMP NR_CPUS=2048 NUMA pSeries [ 8.856937] Modules linked in: virtio_rng rng_core virtio_net net_failover failover sd_mod ata_generic ata_piix libata scsi_mod scsi_common virtio_blk virtio_pci virtio_pci_legacy_dev virtio_pci_modern_dev 9pnet_virtio virtio_ring virtio 9p 9pnet netfs [ 8.857154] CPU: 6 PID: 689 Comm: bpf_prog01 Tainted: G W 6.6.37-un-def-alt1 #1 [ 8.857236] Hardware name: IBM pSeries (emulated by qemu) POWER8 (raw) 0x4d0200 0xf000004 of:SLOF,git-3a259d hv:linux,kvm pSeries [ 8.857342] NIP: c008000000040a4c LR: c000000000ed25d0 CTR: c008000000040a4c [ 8.857413] REGS: c000000009b6f6f0 TRAP: 0400 Tainted: G W (6.6.37-un-def-alt1) [ 8.857510] MSR: 8000000010009033 <SF,EE,ME,IR,DR,RI,LE> CR: 28008286 XER: 00000000 [ 8.857588] CFAR: c000000000ed25cc IRQMASK: 0 [ 8.857588] GPR00: c000000000ed25a8 c000000009b6f990 c000000001ac7f00 c000000006130400 [ 8.857588] GPR04: c008000000920048 0000000000000001 0000000000000000 0000000000000000 [ 8.857588] GPR08: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 8.857588] GPR12: c008000000040a4c c00000003fff7a00 0000000000000000 0000000000000000 [ 8.857588] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 8.857588] GPR20: 7fffffffffffffff 0000000000000000 0000000000000001 0000000000000000 [ 8.857588] GPR24: c000000006130400 c000000006510a00 c000000006510f00 c0000000041a9000 [ 8.857588] GPR28: 0000000000000001 c000000006130400 0000000000000000 c008000000920000 [ 8.858184] NIP [c008000000040a4c] bpf_prog_2fb4fda3a3499517+0x0/0x8c [ 8.858245] LR [c000000000ed25d0] sk_filter_trim_cap+0xc0/0x370 [ 8.858308] Call Trace: [ 8.858333] [c000000009b6f990] [c000000000ed2574] sk_filter_trim_cap+0x64/0x370 (unreliable) [ 8.858421] [c000000009b6fa10] [c000000001068b64] unix_dgram_sendmsg+0x214/0xb10 [ 8.858511] [c000000009b6fad0] [c000000000e4c59c] sock_write_iter+0x19c/0x1e0 [ 8.858586] [c000000009b6fb80] [c0000000005b1b58] vfs_write+0x258/0x4e0 [ 8.858648] [c000000009b6fc40] [c0000000005b21d4] ksys_write+0x114/0x170 [ 8.858711] [c000000009b6fc90] [c000000000030230] system_call_exception+0x190/0x390 [ 8.858785] [c000000009b6fe50] [c00000000000c7d4] system_call_common+0xf4/0x258 [ 8.858859] --- interrupt: c00 at 0x7fffb082b884 [ 8.858908] NIP: 00007fffb082b884 LR: 000000012a02ab70 CTR: 0000000000000000 [ 8.858979] REGS: c000000009b6fe80 TRAP: 0c00 Tainted: G W (6.6.37-un-def-alt1) [ 8.859060] MSR: 800000000280f033 <SF,VEC,VSX,EE,PR,FP,ME,IR,DR,RI,LE> CR: 28002281 XER: 00000000 [ 8.859153] IRQMASK: 0 [ 8.859153] GPR00: 0000000000000004 00007fffd85341f0 00007fffb0936d00 0000000000000005 [ 8.859153] GPR04: 00007fffb068fffa 0000000000000006 0000000000000001 0000000000000005 [ 8.859153] GPR08: 00007fffb068fffa 0000000000000000 0000000000000000 0000000000000000 [ 8.859153] GPR12: 0000000000000000 00007fffb09ea540 0000000000000000 0000000000000000 [ 8.859153] GPR16: 0000000000000000 0000000000000000 0000000000000000 0000000000000000 [ 8.859153] GPR20: 00007fffd85344b0 0000000000000000 0000000000000001 0000000000000000 [ 8.859153] GPR24: 000000012a053698 000000000000008b 0000000000000000 0000000000000001 [ 8.859153] GPR28: 00007fffb068fffa 0000000000000005 0000000000000006 000000012a053698 [ 8.859738] NIP [00007fffb082b884] 0x7fffb082b884 [ 8.859786] LR [000000012a02ab70] 0x12a02ab70 [ 8.859836] --- interrupt: c00 [ 8.859872] Code: 7fe00008 7fe00008 7fe00008 7fe00008 7fe00008 7fe00008 7fe00008 7fe00008 7fe00008 7fe00008 7fe00008 7fe00008 <7fe00008> 7fe00008 7fe00008 7fe00008 [ 8.860013] ---[ end trace 0000000000000000 ]--- [ 8.863088] pstore: backend (nvram) writing error (-1) [ 8.863141] [ 8.863166] note: bpf_prog01[689] exited with irqs disabled And so on. Temporary build/test log is at https://git.altlinux.org/tasks/352218/build/100/ppc64le/log Other stable/longterm branches or other architectures does not exhibit this. Thanks,

7 months, 4 weeks

5
6
0 0

Re: Patch "igc: fix a log entry using uninitialized netdev" has been added to the 6.9-stable tree

by Corinna Vinschen

Hi Sasha, my patch should not go into the stable branches. Under certain circumstances it triggered kernel crashes. Consequentially this patch has been reverted in the main development branch: 8eef5c3cea65 Revert "igc: fix a log entry using uninitialized netdev" So I suggest to remove my patch 86167183a17e from the stable branches or apply 8eef5c3cea65 as well. Sorry and thanks, Corinna On Jul 5 15:29, Sasha Levin wrote: > This is a note to let you know that I've just added the patch titled > > igc: fix a log entry using uninitialized netdev > > to the 6.9-stable tree which can be found at: > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=sum… > > The filename of the patch is: > igc-fix-a-log-entry-using-uninitialized-netdev.patch > and it can be found in the queue-6.9 subdirectory. > > If you, or anyone else, feels it should not be added to the stable tree, > please let <stable(a)vger.kernel.org> know about it. > > > > commit ee112b3c8929ec718b444134db87e1c585eb7d70 > Author: Corinna Vinschen <vinschen(a)redhat.com> > Date: Tue Apr 23 12:24:54 2024 +0200 > > igc: fix a log entry using uninitialized netdev > > [ Upstream commit 86167183a17e03ec77198897975e9fdfbd53cb0b ] > > During successful probe, igc logs this: > > [ 5.133667] igc 0000:01:00.0 (unnamed net_device) (uninitialized): PHC added > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > The reason is that igc_ptp_init() is called very early, even before > register_netdev() has been called. So the netdev_info() call works > on a partially uninitialized netdev. > > Fix this by calling igc_ptp_init() after register_netdev(), right > after the media autosense check, just as in igb. Add a comment, > just as in igb. > > Now the log message is fine: > > [ 5.200987] igc 0000:01:00.0 eth0: PHC added > > Signed-off-by: Corinna Vinschen <vinschen(a)redhat.com> > Reviewed-by: Hariprasad Kelam <hkelam(a)marvell.com> > Acked-by: Vinicius Costa Gomes <vinicius.gomes(a)intel.com> > Tested-by: Naama Meir <naamax.meir(a)linux.intel.com> > Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> > Signed-off-by: Sasha Levin <sashal(a)kernel.org> > > diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c > index 58bc96021bb4c..07feb951be749 100644 > --- a/drivers/net/ethernet/intel/igc/igc_main.c > +++ b/drivers/net/ethernet/intel/igc/igc_main.c > @@ -6932,8 +6932,6 @@ static int igc_probe(struct pci_dev *pdev, > device_set_wakeup_enable(&adapter->pdev->dev, > adapter->flags & IGC_FLAG_WOL_SUPPORTED); > > - igc_ptp_init(adapter); > - > igc_tsn_clear_schedule(adapter); > > /* reset the hardware with the new settings */ > @@ -6955,6 +6953,9 @@ static int igc_probe(struct pci_dev *pdev, > /* Check if Media Autosense is enabled */ > adapter->ei = *ei; > > + /* do hw tstamp init after resetting */ > + igc_ptp_init(adapter); > + > /* print pcie link status and MAC address */ > pcie_print_link_status(pdev); > netdev_info(netdev, "MAC: %pM\n", netdev->dev_addr);

7 months, 4 weeks

2
2
0 0

[tip: perf/core] task_work: s/task_work_cancel()/task_work_cancel_func()/

by tip-bot2 for Frederic Weisbecker

The following commit has been merged into the perf/core branch of tip: Commit-ID: 68cbd415dd4b9c5b9df69f0f091879e56bf5907a Gitweb: https://git.kernel.org/tip/68cbd415dd4b9c5b9df69f0f091879e56bf5907a Author: Frederic Weisbecker <frederic(a)kernel.org> AuthorDate: Fri, 21 Jun 2024 11:15:58 +02:00 Committer: Peter Zijlstra <peterz(a)infradead.org> CommitterDate: Tue, 09 Jul 2024 13:26:31 +02:00 task_work: s/task_work_cancel()/task_work_cancel_func()/ A proper task_work_cancel() API that actually cancels a callback and not *any* callback pointing to a given function is going to be needed for perf events event freeing. Do the appropriate rename to prepare for that. Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240621091601.18227-2-frederic@kernel.org --- include/linux/task_work.h | 2 +- kernel/irq/manage.c | 2 +- kernel/task_work.c | 10 +++++----- security/keys/keyctl.c | 2 +- 4 files changed, 8 insertions(+), 8 deletions(-) diff --git a/include/linux/task_work.h b/include/linux/task_work.h index 795ef5a..23ab01a 100644 --- a/include/linux/task_work.h +++ b/include/linux/task_work.h @@ -30,7 +30,7 @@ int task_work_add(struct task_struct *task, struct callback_head *twork, struct callback_head *task_work_cancel_match(struct task_struct *task, bool (*match)(struct callback_head *, void *data), void *data); -struct callback_head *task_work_cancel(struct task_struct *, task_work_func_t); +struct callback_head *task_work_cancel_func(struct task_struct *, task_work_func_t); void task_work_run(void); static inline void exit_task_work(struct task_struct *task) diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c index 71b0fc2..dd53298 100644 --- a/kernel/irq/manage.c +++ b/kernel/irq/manage.c @@ -1337,7 +1337,7 @@ static int irq_thread(void *data) * synchronize_hardirq(). So neither IRQTF_RUNTHREAD nor the * oneshot mask bit can be set. */ - task_work_cancel(current, irq_thread_dtor); + task_work_cancel_func(current, irq_thread_dtor); return 0; } diff --git a/kernel/task_work.c b/kernel/task_work.c index 95a7e1b..54ac240 100644 --- a/kernel/task_work.c +++ b/kernel/task_work.c @@ -120,9 +120,9 @@ static bool task_work_func_match(struct callback_head *cb, void *data) } /** - * task_work_cancel - cancel a pending work added by task_work_add() - * @task: the task which should execute the work - * @func: identifies the work to remove + * task_work_cancel_func - cancel a pending work matching a function added by task_work_add() + * @task: the task which should execute the func's work + * @func: identifies the func to match with a work to remove * * Find the last queued pending work with ->func == @func and remove * it from queue. @@ -131,7 +131,7 @@ static bool task_work_func_match(struct callback_head *cb, void *data) * The found work or NULL if not found. */ struct callback_head * -task_work_cancel(struct task_struct *task, task_work_func_t func) +task_work_cancel_func(struct task_struct *task, task_work_func_t func) { return task_work_cancel_match(task, task_work_func_match, func); } @@ -168,7 +168,7 @@ void task_work_run(void) if (!work) break; /* - * Synchronize with task_work_cancel(). It can not remove + * Synchronize with task_work_cancel_match(). It can not remove * the first entry == work, cmpxchg(task_works) must fail. * But it can remove another entry from the ->next list. */ diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c index 4bc3e93..ab927a1 100644 --- a/security/keys/keyctl.c +++ b/security/keys/keyctl.c @@ -1694,7 +1694,7 @@ long keyctl_session_to_parent(void) goto unlock; /* cancel an already pending keyring replacement */ - oldwork = task_work_cancel(parent, key_change_session_keyring); + oldwork = task_work_cancel_func(parent, key_change_session_keyring); /* the replacement session keyring is applied just prior to userspace * restarting */

7 months, 4 weeks

1
0
0 0

[tip: perf/core] task_work: Introduce task_work_cancel() again

by tip-bot2 for Frederic Weisbecker

The following commit has been merged into the perf/core branch of tip: Commit-ID: f409530e4db9dd11b88cb7703c97c8f326ff6566 Gitweb: https://git.kernel.org/tip/f409530e4db9dd11b88cb7703c97c8f326ff6566 Author: Frederic Weisbecker <frederic(a)kernel.org> AuthorDate: Fri, 21 Jun 2024 11:15:59 +02:00 Committer: Peter Zijlstra <peterz(a)infradead.org> CommitterDate: Tue, 09 Jul 2024 13:26:32 +02:00 task_work: Introduce task_work_cancel() again Re-introduce task_work_cancel(), this time to cancel an actual callback and not *any* callback pointing to a given function. This is going to be needed for perf events event freeing. Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240621091601.18227-3-frederic@kernel.org --- include/linux/task_work.h | 1 + kernel/task_work.c | 24 ++++++++++++++++++++++++ 2 files changed, 25 insertions(+) diff --git a/include/linux/task_work.h b/include/linux/task_work.h index 23ab01a..26b8a47 100644 --- a/include/linux/task_work.h +++ b/include/linux/task_work.h @@ -31,6 +31,7 @@ int task_work_add(struct task_struct *task, struct callback_head *twork, struct callback_head *task_work_cancel_match(struct task_struct *task, bool (*match)(struct callback_head *, void *data), void *data); struct callback_head *task_work_cancel_func(struct task_struct *, task_work_func_t); +bool task_work_cancel(struct task_struct *task, struct callback_head *cb); void task_work_run(void); static inline void exit_task_work(struct task_struct *task) diff --git a/kernel/task_work.c b/kernel/task_work.c index 54ac240..2134ac8 100644 --- a/kernel/task_work.c +++ b/kernel/task_work.c @@ -136,6 +136,30 @@ task_work_cancel_func(struct task_struct *task, task_work_func_t func) return task_work_cancel_match(task, task_work_func_match, func); } +static bool task_work_match(struct callback_head *cb, void *data) +{ + return cb == data; +} + +/** + * task_work_cancel - cancel a pending work added by task_work_add() + * @task: the task which should execute the work + * @cb: the callback to remove if queued + * + * Remove a callback from a task's queue if queued. + * + * RETURNS: + * True if the callback was queued and got cancelled, false otherwise. + */ +bool task_work_cancel(struct task_struct *task, struct callback_head *cb) +{ + struct callback_head *ret; + + ret = task_work_cancel_match(task, task_work_match, cb); + + return ret == cb; +} + /** * task_work_run - execute the works added by task_work_add() *

7 months, 4 weeks

1
0
0 0

[tip: perf/core] perf: Fix event leak upon exit

by tip-bot2 for Frederic Weisbecker

The following commit has been merged into the perf/core branch of tip: Commit-ID: 2fd5ad3f310de22836cdacae919dd99d758a1f1b Gitweb: https://git.kernel.org/tip/2fd5ad3f310de22836cdacae919dd99d758a1f1b Author: Frederic Weisbecker <frederic(a)kernel.org> AuthorDate: Fri, 21 Jun 2024 11:16:00 +02:00 Committer: Peter Zijlstra <peterz(a)infradead.org> CommitterDate: Tue, 09 Jul 2024 13:26:33 +02:00 perf: Fix event leak upon exit When a task is scheduled out, pending sigtrap deliveries are deferred to the target task upon resume to userspace via task_work. However failures while adding an event's callback to the task_work engine are ignored. And since the last call for events exit happen after task work is eventually closed, there is a small window during which pending sigtrap can be queued though ignored, leaking the event refcount addition such as in the following scenario: TASK A ----- do_exit() exit_task_work(tsk); <IRQ> perf_event_overflow() event->pending_sigtrap = pending_id; irq_work_queue(&event->pending_irq); </IRQ> =========> PREEMPTION: TASK A -> TASK B event_sched_out() event->pending_sigtrap = 0; atomic_long_inc_not_zero(&event->refcount) // FAILS: task work has exited task_work_add(&event->pending_task) [...] <IRQ WORK> perf_pending_irq() // early return: event->oncpu = -1 </IRQ WORK> [...] =========> TASK B -> TASK A perf_event_exit_task(tsk) perf_event_exit_event() free_event() WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1) // leak event due to unexpected refcount == 2 As a result the event is never released while the task exits. Fix this with appropriate task_work_add()'s error handling. Fixes: 517e6a301f34 ("perf: Fix perf_pending_task() UaF") Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240621091601.18227-4-frederic@kernel.org --- kernel/events/core.c | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 51ce436..576400d 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -2284,18 +2284,15 @@ event_sched_out(struct perf_event *event, struct perf_event_context *ctx) } if (event->pending_sigtrap) { - bool dec = true; - event->pending_sigtrap = 0; if (state != PERF_EVENT_STATE_OFF && - !event->pending_work) { - event->pending_work = 1; - dec = false; + !event->pending_work && + !task_work_add(current, &event->pending_task, TWA_RESUME)) { WARN_ON_ONCE(!atomic_long_inc_not_zero(&event->refcount)); - task_work_add(current, &event->pending_task, TWA_RESUME); - } - if (dec) + event->pending_work = 1; + } else { local_dec(&event->ctx->nr_pending); + } } perf_event_set_state(event, state);

7 months, 4 weeks

1
0
0 0

[tip: perf/core] perf: Fix event leak upon exec and file release

by tip-bot2 for Frederic Weisbecker

The following commit has been merged into the perf/core branch of tip: Commit-ID: 3a5465418f5fd970e86a86c7f4075be262682840 Gitweb: https://git.kernel.org/tip/3a5465418f5fd970e86a86c7f4075be262682840 Author: Frederic Weisbecker <frederic(a)kernel.org> AuthorDate: Fri, 21 Jun 2024 11:16:01 +02:00 Committer: Peter Zijlstra <peterz(a)infradead.org> CommitterDate: Tue, 09 Jul 2024 13:26:33 +02:00 perf: Fix event leak upon exec and file release The perf pending task work is never waited upon the matching event release. In the case of a child event, released via free_event() directly, this can potentially result in a leaked event, such as in the following scenario that doesn't even require a weak IRQ work implementation to trigger: schedule() prepare_task_switch() =======> <NMI> perf_event_overflow() event->pending_sigtrap = ... irq_work_queue(&event->pending_irq) <======= </NMI> perf_event_task_sched_out() event_sched_out() event->pending_sigtrap = 0; atomic_long_inc_not_zero(&event->refcount) task_work_add(&event->pending_task) finish_lock_switch() =======> <IRQ> perf_pending_irq() //do nothing, rely on pending task work <======= </IRQ> begin_new_exec() perf_event_exit_task() perf_event_exit_event() // If is child event free_event() WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1) // event is leaked Similar scenarios can also happen with perf_event_remove_on_exec() or simply against concurrent perf_event_release(). Fix this with synchonizing against the possibly remaining pending task work while freeing the event, just like is done with remaining pending IRQ work. This means that the pending task callback neither need nor should hold a reference to the event, preventing it from ever beeing freed. Fixes: 517e6a301f34 ("perf: Fix perf_pending_task() UaF") Signed-off-by: Frederic Weisbecker <frederic(a)kernel.org> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20240621091601.18227-5-frederic@kernel.org --- include/linux/perf_event.h | 1 +- kernel/events/core.c | 38 +++++++++++++++++++++++++++++++++---- 2 files changed, 35 insertions(+), 4 deletions(-) diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h index a5304ae..393fb13 100644 --- a/include/linux/perf_event.h +++ b/include/linux/perf_event.h @@ -786,6 +786,7 @@ struct perf_event { struct irq_work pending_irq; struct callback_head pending_task; unsigned int pending_work; + struct rcuwait pending_work_wait; atomic_t event_limit; diff --git a/kernel/events/core.c b/kernel/events/core.c index 576400d..32c7996 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -2288,7 +2288,6 @@ event_sched_out(struct perf_event *event, struct perf_event_context *ctx) if (state != PERF_EVENT_STATE_OFF && !event->pending_work && !task_work_add(current, &event->pending_task, TWA_RESUME)) { - WARN_ON_ONCE(!atomic_long_inc_not_zero(&event->refcount)); event->pending_work = 1; } else { local_dec(&event->ctx->nr_pending); @@ -5203,9 +5202,35 @@ static bool exclusive_event_installable(struct perf_event *event, static void perf_addr_filters_splice(struct perf_event *event, struct list_head *head); +static void perf_pending_task_sync(struct perf_event *event) +{ + struct callback_head *head = &event->pending_task; + + if (!event->pending_work) + return; + /* + * If the task is queued to the current task's queue, we + * obviously can't wait for it to complete. Simply cancel it. + */ + if (task_work_cancel(current, head)) { + event->pending_work = 0; + local_dec(&event->ctx->nr_pending); + return; + } + + /* + * All accesses related to the event are within the same + * non-preemptible section in perf_pending_task(). The RCU + * grace period before the event is freed will make sure all + * those accesses are complete by then. + */ + rcuwait_wait_event(&event->pending_work_wait, !event->pending_work, TASK_UNINTERRUPTIBLE); +} + static void _free_event(struct perf_event *event) { irq_work_sync(&event->pending_irq); + perf_pending_task_sync(event); unaccount_event(event); @@ -6818,23 +6843,27 @@ static void perf_pending_task(struct callback_head *head) int rctx; /* + * All accesses to the event must belong to the same implicit RCU read-side + * critical section as the ->pending_work reset. See comment in + * perf_pending_task_sync(). + */ + preempt_disable_notrace(); + /* * If we 'fail' here, that's OK, it means recursion is already disabled * and we won't recurse 'further'. */ - preempt_disable_notrace(); rctx = perf_swevent_get_recursion_context(); if (event->pending_work) { event->pending_work = 0; perf_sigtrap(event); local_dec(&event->ctx->nr_pending); + rcuwait_wake_up(&event->pending_work_wait); } if (rctx >= 0) perf_swevent_put_recursion_context(rctx); preempt_enable_notrace(); - - put_event(event); } #ifdef CONFIG_GUEST_PERF_EVENTS @@ -11948,6 +11977,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, init_waitqueue_head(&event->waitq); init_irq_work(&event->pending_irq, perf_pending_irq); init_task_work(&event->pending_task, perf_pending_task); + rcuwait_init(&event->pending_work_wait); mutex_init(&event->mmap_mutex); raw_spin_lock_init(&event->addr_filters.lock);

7 months, 4 weeks

1
0
0 0

[RESEND PATCH] perf/x86/intel/uncore: Fix the bits of the CHA extended umask for SPR

by kan.liang＠linux.intel.com

From: Kan Liang <kan.liang(a)linux.intel.com> The perf stat errors out with UNC_CHA_TOR_INSERTS.IA_HIT_CXL_ACC_LOCAL event. $perf stat -e uncore_cha_55/event=0x35,umask=0x10c0008101/ -a -- ls event syntax error: '..0x35,umask=0x10c0008101/' \___ Bad event or PMU The definition of the CHA umask is config:8-15,32-55, which is 32bit. However, the umask of the event is bigger than 32bit. This is an error in the original uncore spec. Add a new umask_ext5 for the new CHA umask range. Fixes: 949b11381f81 ("perf/x86/intel/uncore: Add Sapphire Rapids server CHA support") Closes: https://lore.kernel.org/linux-perf-users/alpine.LRH.2.20.2401300733310.1135… Reviewed-by: Ian Rogers <irogers(a)google.com> Signed-off-by: Kan Liang <kan.liang(a)linux.intel.com> Cc: stable(a)vger.kernel.org --- arch/x86/events/intel/uncore_snbep.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c index a96496bef678..7924f315269a 100644 --- a/arch/x86/events/intel/uncore_snbep.c +++ b/arch/x86/events/intel/uncore_snbep.c @@ -461,6 +461,7 @@ #define SPR_UBOX_DID 0x3250 /* SPR CHA */ +#define SPR_CHA_EVENT_MASK_EXT 0xffffffff #define SPR_CHA_PMON_CTL_TID_EN (1 << 16) #define SPR_CHA_PMON_EVENT_MASK (SNBEP_PMON_RAW_EVENT_MASK | \ SPR_CHA_PMON_CTL_TID_EN) @@ -477,6 +478,7 @@ DEFINE_UNCORE_FORMAT_ATTR(umask_ext, umask, "config:8-15,32-43,45-55"); DEFINE_UNCORE_FORMAT_ATTR(umask_ext2, umask, "config:8-15,32-57"); DEFINE_UNCORE_FORMAT_ATTR(umask_ext3, umask, "config:8-15,32-39"); DEFINE_UNCORE_FORMAT_ATTR(umask_ext4, umask, "config:8-15,32-55"); +DEFINE_UNCORE_FORMAT_ATTR(umask_ext5, umask, "config:8-15,32-63"); DEFINE_UNCORE_FORMAT_ATTR(qor, qor, "config:16"); DEFINE_UNCORE_FORMAT_ATTR(edge, edge, "config:18"); DEFINE_UNCORE_FORMAT_ATTR(tid_en, tid_en, "config:19"); @@ -5957,7 +5959,7 @@ static struct intel_uncore_ops spr_uncore_chabox_ops = { static struct attribute *spr_uncore_cha_formats_attr[] = { &format_attr_event.attr, - &format_attr_umask_ext4.attr, + &format_attr_umask_ext5.attr, &format_attr_tid_en2.attr, &format_attr_edge.attr, &format_attr_inv.attr, @@ -5993,7 +5995,7 @@ ATTRIBUTE_GROUPS(uncore_alias); static struct intel_uncore_type spr_uncore_chabox = { .name = "cha", .event_mask = SPR_CHA_PMON_EVENT_MASK, - .event_mask_ext = SPR_RAW_EVENT_MASK_EXT, + .event_mask_ext = SPR_CHA_EVENT_MASK_EXT, .num_shared_regs = 1, .constraints = skx_uncore_chabox_constraints, .ops = &spr_uncore_chabox_ops, -- 2.35.1

7 months, 4 weeks

2
1
0 0

[PATCH 3/3] perf/x86/intel/ds: Fix non 0 retire latency on Raptorlake

by kan.liang＠linux.intel.com

From: Kan Liang <kan.liang(a)linux.intel.com> A non-0 retire latency can be observed on a Raptorlake which doesn't support the retire latency feature. By design, the retire latency shares the PERF_SAMPLE_WEIGHT_STRUCT sample type with other types of latency. That could avoid adding too many different sample types to support all kinds of latency. For the machine which doesn't support some kind of latency, 0 should be returned. Perf doesn’t clear/init all the fields of a sample data for the sake of performance. It expects the later perf_{prepare,output}_sample() to update the uninitialized field. However, the current implementation doesn't touch the field of the retire latency if the feature is not supported. The memory garbage is dumped into the perf data. Clear the retire latency if the feature is not supported. Fixes: c87a31093c70 ("perf/x86: Support Retire Latency") Reported-by: "Bayduraev, Alexey V" <alexey.v.bayduraev(a)intel.com> Tested-by: "Bayduraev, Alexey V" <alexey.v.bayduraev(a)intel.com> Signed-off-by: Kan Liang <kan.liang(a)linux.intel.com> Cc: stable(a)vger.kernel.org --- arch/x86/events/intel/ds.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c index b9cc520b2942..fa5ea65de0d0 100644 --- a/arch/x86/events/intel/ds.c +++ b/arch/x86/events/intel/ds.c @@ -1944,8 +1944,12 @@ static void setup_pebs_adaptive_sample_data(struct perf_event *event, set_linear_ip(regs, basic->ip); regs->flags = PERF_EFLAGS_EXACT; - if ((sample_type & PERF_SAMPLE_WEIGHT_STRUCT) && (x86_pmu.flags & PMU_FL_RETIRE_LATENCY)) - data->weight.var3_w = format_size >> PEBS_RETIRE_LATENCY_OFFSET & PEBS_LATENCY_MASK; + if (sample_type & PERF_SAMPLE_WEIGHT_STRUCT) { + if (x86_pmu.flags & PMU_FL_RETIRE_LATENCY) + data->weight.var3_w = format_size >> PEBS_RETIRE_LATENCY_OFFSET & PEBS_LATENCY_MASK; + else + data->weight.var3_w = 0; + } /* * The record for MEMINFO is in front of GP -- 2.38.1

7 months, 4 weeks

2
1
0 0

[PATCH v2] pmdomain: qcom: rpmhpd: Skip retention level for Power Domains

by Taniya Das

In the cases where the power domain connected to logics is allowed to transition from a level(L)-->power collapse(0)-->retention(1) or vice versa retention(1)-->power collapse(0)-->level(L) will cause the logic to lose the configurations. The ARC does not support retention to collapse transition on MxC rails. The targets from SM8450 onwards the PLL logics of clock controllers are connected to MxC rails and the recommended configurations are carried out during the clock controller probes. The MxC transition as mentioned above should be skipped to ensure the PLL settings are intact across clock controller power on & off. On older targets that do not split MX into MxA and MxC does not collapse the logic and it is parked always at RETENTION, thus this issue is never observed on those targets. Cc: stable(a)vger.kernel.org # v5.17 Reviewed-by: Bjorn Andersson <andersson(a)kernel.org> Signed-off-by: Taniya Das <quic_tdas(a)quicinc.com> --- [Changes in v2]: Incorporate the comments in the commit text. --- drivers/pmdomain/qcom/rpmhpd.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/pmdomain/qcom/rpmhpd.c b/drivers/pmdomain/qcom/rpmhpd.c index de9121ef4216..d2cb4271a1ca 100644 --- a/drivers/pmdomain/qcom/rpmhpd.c +++ b/drivers/pmdomain/qcom/rpmhpd.c @@ -40,6 +40,7 @@ * @addr: Resource address as looped up using resource name from * cmd-db * @state_synced: Indicator that sync_state has been invoked for the rpmhpd resource + * @skip_retention_level: Indicate that retention level should not be used for the power domain */ struct rpmhpd { struct device *dev; @@ -56,6 +57,7 @@ struct rpmhpd { const char *res_name; u32 addr; bool state_synced; + bool skip_retention_level; }; struct rpmhpd_desc { @@ -173,6 +175,7 @@ static struct rpmhpd mxc = { .pd = { .name = "mxc", }, .peer = &mxc_ao, .res_name = "mxc.lvl", + .skip_retention_level = true, }; static struct rpmhpd mxc_ao = { @@ -180,6 +183,7 @@ static struct rpmhpd mxc_ao = { .active_only = true, .peer = &mxc, .res_name = "mxc.lvl", + .skip_retention_level = true, }; static struct rpmhpd nsp = { @@ -819,6 +823,9 @@ static int rpmhpd_update_level_mapping(struct rpmhpd *rpmhpd) return -EINVAL; for (i = 0; i < rpmhpd->level_count; i++) { + if (rpmhpd->skip_retention_level && buf[i] == RPMH_REGULATOR_LEVEL_RETENTION) + continue; + rpmhpd->level[i] = buf[i]; /* Remember the first corner with non-zero level */ --- base-commit: 62c97045b8f720c2eac807a5f38e26c9ed512371 change-id: 20240625-avoid_mxc_retention-b095a761d981 Best regards, -- Taniya Das <quic_tdas(a)quicinc.com>

7 months, 4 weeks

2
1
0 0

[PATCH 4.19 5.4 5.10 5.15 6.1 6.6] nilfs2: fix incorrect inode allocation from reserved inodes

by Ryusuke Konishi

commit 93aef9eda1cea9e84ab2453fcceb8addad0e46f1 upstream. If the bitmap block that manages the inode allocation status is corrupted, nilfs_ifile_create_inode() may allocate a new inode from the reserved inode area where it should not be allocated. Previous fix commit d325dc6eb763 ("nilfs2: fix use-after-free bug of struct nilfs_root"), fixed the problem that reserved inodes with inode numbers less than NILFS_USER_INO (=11) were incorrectly reallocated due to bitmap corruption, but since the start number of non-reserved inodes is read from the super block and may change, in which case inode allocation may occur from the extended reserved inode area. If that happens, access to that inode will cause an IO error, causing the file system to degrade to an error state. Fix this potential issue by adding a wraparound option to the common metadata object allocation routine and by modifying nilfs_ifile_create_inode() to disable the option so that it only allocates inodes with inode numbers greater than or equal to the inode number read in "nilfs->ns_first_ino", regardless of the bitmap status of reserved inodes. Link: https://lkml.kernel.org/r/20240623051135.4180-4-konishi.ryusuke@gmail.com Signed-off-by: Ryusuke Konishi <konishi.ryusuke(a)gmail.com> Cc: Hillf Danton <hdanton(a)sina.com> Cc: Jan Kara <jack(a)suse.cz> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> --- Please apply this patch to the stable trees indicated by the subject prefix instead of the patch that failed. This patch is tailored to avoid conflicts with a series involving extensive conversions and can be applied from v4.8 to v6.8. Also, all the builds and tests I did on each stable tree passed. Thanks, Ryusuke Konishi fs/nilfs2/alloc.c | 18 ++++++++++++++---- fs/nilfs2/alloc.h | 4 ++-- fs/nilfs2/dat.c | 2 +- fs/nilfs2/ifile.c | 7 ++----- 4 files changed, 19 insertions(+), 12 deletions(-) diff --git a/fs/nilfs2/alloc.c b/fs/nilfs2/alloc.c index 7342de296ec3..25881bdd212b 100644 --- a/fs/nilfs2/alloc.c +++ b/fs/nilfs2/alloc.c @@ -377,11 +377,12 @@ void *nilfs_palloc_block_get_entry(const struct inode *inode, __u64 nr, * @target: offset number of an entry in the group (start point) * @bsize: size in bits * @lock: spin lock protecting @bitmap + * @wrap: whether to wrap around */ static int nilfs_palloc_find_available_slot(unsigned char *bitmap, unsigned long target, unsigned int bsize, - spinlock_t *lock) + spinlock_t *lock, bool wrap) { int pos, end = bsize; @@ -397,6 +398,8 @@ static int nilfs_palloc_find_available_slot(unsigned char *bitmap, end = target; } + if (!wrap) + return -ENOSPC; /* wrap around */ for (pos = 0; pos < end; pos++) { @@ -495,9 +498,10 @@ int nilfs_palloc_count_max_entries(struct inode *inode, u64 nused, u64 *nmaxp) * nilfs_palloc_prepare_alloc_entry - prepare to allocate a persistent object * @inode: inode of metadata file using this allocator * @req: nilfs_palloc_req structure exchanged for the allocation + * @wrap: whether to wrap around */ int nilfs_palloc_prepare_alloc_entry(struct inode *inode, - struct nilfs_palloc_req *req) + struct nilfs_palloc_req *req, bool wrap) { struct buffer_head *desc_bh, *bitmap_bh; struct nilfs_palloc_group_desc *desc; @@ -516,7 +520,7 @@ int nilfs_palloc_prepare_alloc_entry(struct inode *inode, entries_per_group = nilfs_palloc_entries_per_group(inode); for (i = 0; i < ngroups; i += n) { - if (group >= ngroups) { + if (group >= ngroups && wrap) { /* wrap around */ group = 0; maxgroup = nilfs_palloc_group(inode, req->pr_entry_nr, @@ -541,7 +545,13 @@ int nilfs_palloc_prepare_alloc_entry(struct inode *inode, bitmap = bitmap_kaddr + bh_offset(bitmap_bh); pos = nilfs_palloc_find_available_slot( bitmap, group_offset, - entries_per_group, lock); + entries_per_group, lock, wrap); + /* + * Since the search for a free slot in the + * second and subsequent bitmap blocks always + * starts from the beginning, the wrap flag + * only has an effect on the first search. + */ if (pos >= 0) { /* found a free entry */ nilfs_palloc_group_desc_add_entries( diff --git a/fs/nilfs2/alloc.h b/fs/nilfs2/alloc.h index b667e869ac07..d825a9faca6d 100644 --- a/fs/nilfs2/alloc.h +++ b/fs/nilfs2/alloc.h @@ -50,8 +50,8 @@ struct nilfs_palloc_req { struct buffer_head *pr_entry_bh; }; -int nilfs_palloc_prepare_alloc_entry(struct inode *, - struct nilfs_palloc_req *); +int nilfs_palloc_prepare_alloc_entry(struct inode *inode, + struct nilfs_palloc_req *req, bool wrap); void nilfs_palloc_commit_alloc_entry(struct inode *, struct nilfs_palloc_req *); void nilfs_palloc_abort_alloc_entry(struct inode *, struct nilfs_palloc_req *); diff --git a/fs/nilfs2/dat.c b/fs/nilfs2/dat.c index 9cf6ba58f585..351010828d88 100644 --- a/fs/nilfs2/dat.c +++ b/fs/nilfs2/dat.c @@ -75,7 +75,7 @@ int nilfs_dat_prepare_alloc(struct inode *dat, struct nilfs_palloc_req *req) { int ret; - ret = nilfs_palloc_prepare_alloc_entry(dat, req); + ret = nilfs_palloc_prepare_alloc_entry(dat, req, true); if (ret < 0) return ret; diff --git a/fs/nilfs2/ifile.c b/fs/nilfs2/ifile.c index a8a4bc8490b4..ac10a62a41e9 100644 --- a/fs/nilfs2/ifile.c +++ b/fs/nilfs2/ifile.c @@ -55,13 +55,10 @@ int nilfs_ifile_create_inode(struct inode *ifile, ino_t *out_ino, struct nilfs_palloc_req req; int ret; - req.pr_entry_nr = 0; /* - * 0 says find free inode from beginning - * of a group. dull code!! - */ + req.pr_entry_nr = NILFS_FIRST_INO(ifile->i_sb); req.pr_entry_bh = NULL; - ret = nilfs_palloc_prepare_alloc_entry(ifile, &req); + ret = nilfs_palloc_prepare_alloc_entry(ifile, &req, false); if (!ret) { ret = nilfs_palloc_get_entry_block(ifile, req.pr_entry_nr, 1, &req.pr_entry_bh); -- 2.43.5

7 months, 4 weeks

2
1
0 0

2025

2024

2023

2022

2021

2020

2019

2018

2017

Linux-stable-mirror July 2024