From: Roman Penyaev <rpenyaev(a)suse.de>
Subject: epoll: call final ep_events_available() check under the lock
There is a possible race when ep_scan_ready_list() leaves ->rdllist and
->obflist empty for a short period of time although some events are
pending. It is quite likely that ep_events_available() observes empty
lists and goes to sleep. Since 339ddb53d373 ("fs/epoll: remove
unnecessary wakeups of nested epoll") we are conservative in wakeups
(there is only one place for wakeup and this is ep_poll_callback()), thus
ep_events_available() must always observe correct state of two lists. The
easiest and correct way is to do the final check under the lock. This
does not impact the performance, since lock is taken anyway for adding a
wait entry to the wait queue.
The discussion of the problem can be found here:
https://lore.kernel.org/linux-fsdevel/a2f22c3c-c25a-4bda-8339-a7bdaf17849e@…
In this patch barrierless __set_current_state() is used. This is safe
since waitqueue_active() is called under the same lock on wakeup side.
Short-circuit for fatal signals (i.e. fatal_signal_pending() check) is
moved to the line just before actual events harvesting routine. This is
fully compliant to what is said in the comment of the patch where the
actual fatal_signal_pending() check was added: c257a340ede0 ("fs, epoll:
short circuit fetching events if thread has been killed").
Link: http://lkml.kernel.org/r/20200505145609.1865152-1-rpenyaev@suse.de
Fixes: 339ddb53d373 ("fs/epoll: remove unnecessary wakeups of nested epoll")
Signed-off-by: Roman Penyaev <rpenyaev(a)suse.de>
Reported-by: Jason Baron <jbaron(a)akamai.com>
Reviewed-by: Jason Baron <jbaron(a)akamai.com>
Cc: Khazhismel Kumykov <khazhy(a)google.com>
Cc: Alexander Viro <viro(a)zeniv.linux.org.uk>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
fs/eventpoll.c | 48 +++++++++++++++++++++++++++--------------------
1 file changed, 28 insertions(+), 20 deletions(-)
--- a/fs/eventpoll.c~epoll-call-final-ep_events_available-check-under-the-lock
+++ a/fs/eventpoll.c
@@ -1879,34 +1879,33 @@ fetch_events:
* event delivery.
*/
init_wait(&wait);
- write_lock_irq(&ep->lock);
- __add_wait_queue_exclusive(&ep->wq, &wait);
- write_unlock_irq(&ep->lock);
+ write_lock_irq(&ep->lock);
/*
- * We don't want to sleep if the ep_poll_callback() sends us
- * a wakeup in between. That's why we set the task state
- * to TASK_INTERRUPTIBLE before doing the checks.
+ * Barrierless variant, waitqueue_active() is called under
+ * the same lock on wakeup ep_poll_callback() side, so it
+ * is safe to avoid an explicit barrier.
*/
- set_current_state(TASK_INTERRUPTIBLE);
+ __set_current_state(TASK_INTERRUPTIBLE);
+
/*
- * Always short-circuit for fatal signals to allow
- * threads to make a timely exit without the chance of
- * finding more events available and fetching
- * repeatedly.
+ * Do the final check under the lock. ep_scan_ready_list()
+ * plays with two lists (->rdllist and ->ovflist) and there
+ * is always a race when both lists are empty for short
+ * period of time although events are pending, so lock is
+ * important.
*/
- if (fatal_signal_pending(current)) {
- res = -EINTR;
- break;
+ eavail = ep_events_available(ep);
+ if (!eavail) {
+ if (signal_pending(current))
+ res = -EINTR;
+ else
+ __add_wait_queue_exclusive(&ep->wq, &wait);
}
+ write_unlock_irq(&ep->lock);
- eavail = ep_events_available(ep);
- if (eavail)
- break;
- if (signal_pending(current)) {
- res = -EINTR;
+ if (eavail || res)
break;
- }
if (!schedule_hrtimeout_range(to, slack, HRTIMER_MODE_ABS)) {
timed_out = 1;
@@ -1927,6 +1926,15 @@ fetch_events:
}
send_events:
+ if (fatal_signal_pending(current)) {
+ /*
+ * Always short-circuit for fatal signals to allow
+ * threads to make a timely exit without the chance of
+ * finding more events available and fetching
+ * repeatedly.
+ */
+ res = -EINTR;
+ }
/*
* Try to transfer events to user space. In case we get 0 events and
* there's still timeout left over, we go trying again in search of
_
From: Yafang Shao <laoar.shao(a)gmail.com>
Subject: mm, memcg: fix inconsistent oom event behavior
A recent commit 9852ae3fe529 ("mm, memcg: consider subtrees in
memory.events") changes the behavior of memcg events, which will consider
subtrees in memory.events. But oom_kill event is a special one as it is
used in both cgroup1 and cgroup2. In cgroup1, it is displayed in
memory.oom_control. The file memory.oom_control is in both root memcg and
non root memcg, that is different with memory.event as it only in non-root
memcg. That commit is okay for cgroup2, but it is not okay for cgroup1 as
it will cause inconsistent behavior between root memcg and non-root memcg.
Here's an example on why this behavior is inconsistent in cgroup1.
root memcg
/
memcg foo
/
memcg bar
Suppose there's an oom_kill in memcg bar, then the oon_kill will be
root memcg : memory.oom_control(oom_kill) 0
/
memcg foo : memory.oom_control(oom_kill) 1
/
memcg bar : memory.oom_control(oom_kill) 1
For the non-root memcg, its memory.oom_control(oom_kill) includes its
descendants' oom_kill, but for root memcg, it doesn't include its
descendants' oom_kill. That means, memory.oom_control(oom_kill) has
different meanings in different memcgs. That is inconsistent. Then the
user has to know whether the memcg is root or not.
If we can't fully support it in cgroup1, for example by adding
memory.events.local into cgroup1 as well, then let's don't touch its
original behavior.
Link: http://lkml.kernel.org/r/20200502141055.7378-1-laoar.shao@gmail.com
Fixes: 9852ae3fe529 ("mm, memcg: consider subtrees in memory.events")
Signed-off-by: Yafang Shao <laoar.shao(a)gmail.com>
Reviewed-by: Shakeel Butt <shakeelb(a)google.com>
Acked-by: Johannes Weiner <hannes(a)cmpxchg.org>
Acked-by: Chris Down <chris(a)chrisdown.name>
Acked-by: Michal Hocko <mhocko(a)suse.com>
Cc: <stable(a)vger.kernel.org>
Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org>
---
include/linux/memcontrol.h | 2 ++
1 file changed, 2 insertions(+)
--- a/include/linux/memcontrol.h~mm-memcg-fix-inconsistent-oom-event-behavior
+++ a/include/linux/memcontrol.h
@@ -783,6 +783,8 @@ static inline void memcg_memory_event(st
atomic_long_inc(&memcg->memory_events[event]);
cgroup_file_notify(&memcg->events_file);
+ if (!cgroup_subsys_on_dfl(memory_cgrp_subsys))
+ break;
if (cgrp_dfl_root.flags & CGRP_ROOT_MEMORY_LOCAL_EVENTS)
break;
} while ((memcg = parent_mem_cgroup(memcg)) &&
_
This is the start of the stable review cycle for the 5.4.41 release.
There are 90 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Fri, 15 May 2020 09:41:20 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v5.x/stable-review/patch-5.4.41-rc1…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-5.4.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 5.4.41-rc1
Amir Goldstein <amir73il(a)gmail.com>
fanotify: merge duplicate events on parent and child
Amir Goldstein <amir73il(a)gmail.com>
fsnotify: replace inode pointer with an object id
Christoph Hellwig <hch(a)lst.de>
bdi: add a ->dev_name field to struct backing_dev_info
Christoph Hellwig <hch(a)lst.de>
bdi: move bdi_dev_name out of line
Yafang Shao <laoar.shao(a)gmail.com>
mm, memcg: fix error return value of mem_cgroup_css_alloc()
Ivan Delalande <colona(a)arista.com>
scripts/decodecode: fix trapping instruction formatting
Julia Lawall <Julia.Lawall(a)inria.fr>
iommu/virtio: Reverse arguments to list_add
Josh Poimboeuf <jpoimboe(a)redhat.com>
objtool: Fix stack offset tracking for indirect CFAs
Arnd Bergmann <arnd(a)arndb.de>
netfilter: nf_osf: avoid passing pointer to local var
Guillaume Nault <gnault(a)redhat.com>
netfilter: nat: never update the UDP checksum when it's 0
Janakarajan Natarajan <Janakarajan.Natarajan(a)amd.com>
arch/x86/kvm/svm/sev.c: change flag passed to GUP fast in sev_pin_memory()
Suravee Suthikulpanit <suravee.suthikulpanit(a)amd.com>
KVM: x86: Fixes posted interrupt check for IRQs delivery modes
Josh Poimboeuf <jpoimboe(a)redhat.com>
x86/unwind/orc: Fix premature unwind stoppage due to IRET frames
Josh Poimboeuf <jpoimboe(a)redhat.com>
x86/unwind/orc: Fix error path for bad ORC entry type
Josh Poimboeuf <jpoimboe(a)redhat.com>
x86/unwind/orc: Prevent unwinding before ORC initialization
Miroslav Benes <mbenes(a)suse.cz>
x86/unwind/orc: Don't skip the first frame for inactive tasks
Jann Horn <jannh(a)google.com>
x86/entry/64: Fix unwind hints in rewind_stack_do_exit()
Josh Poimboeuf <jpoimboe(a)redhat.com>
x86/entry/64: Fix unwind hints in kernel exit path
Josh Poimboeuf <jpoimboe(a)redhat.com>
x86/entry/64: Fix unwind hints in register clearing code
Xiyu Yang <xiyuyang19(a)fudan.edu.cn>
batman-adv: Fix refcnt leak in batadv_v_ogm_process
Xiyu Yang <xiyuyang19(a)fudan.edu.cn>
batman-adv: Fix refcnt leak in batadv_store_throughput_override
Xiyu Yang <xiyuyang19(a)fudan.edu.cn>
batman-adv: Fix refcnt leak in batadv_show_throughput_override
George Spelvin <lkml(a)sdf.org>
batman-adv: fix batadv_nc_random_weight_tq
Tejun Heo <tj(a)kernel.org>
iocost: protect iocg->abs_vdebt with iocg->waitq.lock
Vincent Chen <vincent.chen(a)sifive.com>
riscv: set max_pfn to the PFN of the last page
Luis Chamberlain <mcgrof(a)kernel.org>
coredump: fix crash when umh is disabled
Oscar Carter <oscar.carter(a)gmx.com>
staging: gasket: Check the return value of gasket_get_bar_index()
Luis Henriques <lhenriques(a)suse.com>
ceph: demote quotarealm lookup warning to a debug message
Jeff Layton <jlayton(a)kernel.org>
ceph: fix endianness bug when handling MDS session feature bits
Henry Willard <henry.willard(a)oracle.com>
mm: limit boost_watermark on small zones
David Hildenbrand <david(a)redhat.com>
mm/page_alloc: fix watchdog soft lockups during set_zone_contiguous()
Khazhismel Kumykov <khazhy(a)google.com>
eventpoll: fix missing wakeup for ovflist in ep_poll_callback
Roman Penyaev <rpenyaev(a)suse.de>
epoll: atomically remove wait entry on wake up
Oleg Nesterov <oleg(a)redhat.com>
ipc/mqueue.c: change __do_notify() to bypass check_kill_permission()
H. Nikolaus Schaller <hns(a)goldelico.com>
drm: ingenic-drm: add MODULE_DEVICE_TABLE
Mark Rutland <mark.rutland(a)arm.com>
arm64: hugetlb: avoid potential NULL dereference
Marc Zyngier <maz(a)kernel.org>
KVM: arm64: Fix 32bit PC wrap-around
Marc Zyngier <maz(a)kernel.org>
KVM: arm: vgic: Fix limit condition when writing to GICD_I[CS]ACTIVER
Sean Christopherson <sean.j.christopherson(a)intel.com>
KVM: VMX: Explicitly clear RFLAGS.CF and RFLAGS.ZF in VM-Exit RSB path
Christian Borntraeger <borntraeger(a)de.ibm.com>
KVM: s390: Remove false WARN_ON_ONCE for the PQAP instruction
Jason A. Donenfeld <Jason(a)zx2c4.com>
crypto: arch/nhpoly1305 - process in explicit 4k chunks
Steven Rostedt (VMware) <rostedt(a)goodmis.org>
tracing: Add a vmalloc_sync_mappings() for safe measure
Oliver Neukum <oneukum(a)suse.com>
USB: serial: garmin_gps: add sanity checking for data length
Bryan O'Donoghue <bryan.odonoghue(a)linaro.org>
usb: chipidea: msm: Ensure proper controller reset using role switch API
Oliver Neukum <oneukum(a)suse.com>
USB: uas: add quirk for LaCie 2Big Quadra
Jason Gerecke <killertofu(a)gmail.com>
HID: wacom: Report 2nd-gen Intuos Pro S center button status over BT
Alan Stern <stern(a)rowland.harvard.edu>
HID: usbhid: Fix race between usbhid_close() and usbhid_stop()
Jason Gerecke <killertofu(a)gmail.com>
Revert "HID: wacom: generic: read the number of expected touches on a per collection basis"
Jere Leppänen <jere.leppanen(a)nokia.com>
sctp: Fix bundling of SHUTDOWN with COOKIE-ACK
Jason Gerecke <jason.gerecke(a)wacom.com>
HID: wacom: Read HID_DG_CONTACTMAX directly for non-generic devices
Dan Carpenter <dan.carpenter(a)oracle.com>
net: mvpp2: cls: Prevent buffer overflow in mvpp2_ethtool_cls_rule_del()
Dan Carpenter <dan.carpenter(a)oracle.com>
net: mvpp2: prevent buffer overflow in mvpp22_rss_ctx()
Moshe Shemesh <moshe(a)mellanox.com>
net/mlx5: Fix command entry leak in Internal Error State
Moshe Shemesh <moshe(a)mellanox.com>
net/mlx5: Fix forced completion access non initialized command entry
Erez Shitrit <erezsh(a)mellanox.com>
net/mlx5: DR, On creation set CQ's arm_db member to right value
Michael Chan <michael.chan(a)broadcom.com>
bnxt_en: Fix VLAN acceleration handling in bnxt_fix_features().
Michael Chan <michael.chan(a)broadcom.com>
bnxt_en: Return error when allocating zero size context memory.
Michael Chan <michael.chan(a)broadcom.com>
bnxt_en: Improve AER slot reset.
Vasundhara Volam <vasundhara-v.volam(a)broadcom.com>
bnxt_en: Reduce BNXT_MSIX_VEC_MAX value to supported CQs per PF.
Michael Chan <michael.chan(a)broadcom.com>
bnxt_en: Fix VF anti-spoof filter setup.
Toke Høiland-Jørgensen <toke(a)redhat.com>
tunnel: Propagate ECT(1) when decapsulating as recommended by RFC6040
Tuong Lien <tuong.t.lien(a)dektech.com.au>
tipc: fix partial topology connection closure
Eric Dumazet <edumazet(a)google.com>
sch_sfq: validate silly quantum values
Eric Dumazet <edumazet(a)google.com>
sch_choke: avoid potential panic in choke_reset()
Qiushi Wu <wu000273(a)umn.edu>
nfp: abm: fix a memory leak bug
Matt Jolly <Kangie(a)footclan.ninja>
net: usb: qmi_wwan: add support for DW5816e
Xiyu Yang <xiyuyang19(a)fudan.edu.cn>
net/tls: Fix sk_psock refcnt leak when in tls_data_ready()
Xiyu Yang <xiyuyang19(a)fudan.edu.cn>
net/tls: Fix sk_psock refcnt leak in bpf_exec_tx_verdict()
Anthony Felice <tony.felice(a)timesys.com>
net: tc35815: Fix phydev supported/advertising mask
Willem de Bruijn <willemb(a)google.com>
net: stricter validation of untrusted gso packets
Eric Dumazet <edumazet(a)google.com>
net_sched: sch_skbprio: add message validation to skbprio_change()
Tariq Toukan <tariqt(a)mellanox.com>
net/mlx4_core: Fix use of ENOSPC around mlx4_counter_alloc()
Scott Dial <scott(a)scottdial.com>
net: macsec: preserve ingress frame ordering
Dejin Zheng <zhengdejin5(a)gmail.com>
net: macb: fix an issue about leak related system resources
Florian Fainelli <f.fainelli(a)gmail.com>
net: dsa: Do not leave DSA master with NULL netdev_ops
Roman Mashak <mrv(a)mojatatu.com>
neigh: send protocol value in neighbor create notification
Jiri Pirko <jiri(a)mellanox.com>
mlxsw: spectrum_acl_tcam: Position vchunk in a vregion list properly
David Ahern <dsahern(a)kernel.org>
ipv6: Use global sernum for dst validation with nexthop objects
Eric Dumazet <edumazet(a)google.com>
fq_codel: fix TCA_FQ_CODEL_DROP_BATCH_SIZE sanity checks
Julia Lawall <Julia.Lawall(a)inria.fr>
dp83640: reverse arguments to list_add_tail
Jakub Kicinski <kuba(a)kernel.org>
devlink: fix return value after hitting end in region read
Shubhrajyoti Datta <shubhrajyoti.datta(a)xilinx.com>
tty: xilinx_uartps: Fix missing id assignment to the console
Nicolas Pitre <nico(a)fluxnic.net>
vt: fix unicode console freeing with a common interface
Evan Quan <evan.quan(a)amd.com>
drm/amdgpu: drop redundant cg/pg ungate on runpm enter
Evan Quan <evan.quan(a)amd.com>
drm/amdgpu: move kfd suspend after ip_suspend_phase1
Andy Shevchenko <andriy.shevchenko(a)linux.intel.com>
net: macb: Fix runtime PM refcounting
Masami Hiramatsu <mhiramat(a)kernel.org>
tracing/kprobes: Fix a double initialization typo
Sagi Grimberg <sagi(a)grimberg.me>
nvme: fix possible hang when ns scanning fails during error recovery
Christoph Hellwig <hch(a)lst.de>
nvme: refactor nvme_identify_ns_descs error handling
Matt Jolly <Kangie(a)footclan.ninja>
USB: serial: qcserial: Add DW5816e support
-------------
Diffstat:
Makefile | 4 +-
arch/arm/crypto/nhpoly1305-neon-glue.c | 2 +-
arch/arm64/crypto/nhpoly1305-neon-glue.c | 2 +-
arch/arm64/kvm/guest.c | 7 ++
arch/arm64/mm/hugetlbpage.c | 2 +
arch/riscv/mm/init.c | 3 +-
arch/s390/kvm/priv.c | 4 +-
arch/x86/crypto/nhpoly1305-avx2-glue.c | 2 +-
arch/x86/crypto/nhpoly1305-sse2-glue.c | 2 +-
arch/x86/entry/calling.h | 40 +++----
arch/x86/entry/entry_64.S | 9 +-
arch/x86/include/asm/kvm_host.h | 4 +-
arch/x86/include/asm/unwind.h | 2 +-
arch/x86/kernel/unwind_orc.c | 61 ++++++++---
arch/x86/kvm/svm.c | 2 +-
arch/x86/kvm/vmx/vmenter.S | 3 +
block/blk-iocost.c | 117 +++++++++++++--------
drivers/gpu/drm/amd/amdgpu/amdgpu_device.c | 7 +-
drivers/gpu/drm/ingenic/ingenic-drm.c | 1 +
drivers/hid/usbhid/hid-core.c | 37 +++++--
drivers/hid/usbhid/usbhid.h | 1 +
drivers/hid/wacom_sys.c | 4 +-
drivers/hid/wacom_wac.c | 88 ++++------------
drivers/iommu/virtio-iommu.c | 2 +-
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 20 ++--
drivers/net/ethernet/broadcom/bnxt/bnxt.h | 1 -
drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.h | 2 +-
drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c | 10 +-
drivers/net/ethernet/cadence/macb_main.c | 24 ++---
drivers/net/ethernet/marvell/mvpp2/mvpp2_cls.c | 3 +
drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 +
drivers/net/ethernet/mellanox/mlx4/main.c | 4 +-
drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 6 +-
.../ethernet/mellanox/mlx5/core/steering/dr_send.c | 14 ++-
.../ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 12 ++-
drivers/net/ethernet/netronome/nfp/abm/main.c | 1 +
drivers/net/ethernet/toshiba/tc35815.c | 2 +-
drivers/net/macsec.c | 3 +-
drivers/net/phy/dp83640.c | 2 +-
drivers/net/usb/qmi_wwan.c | 1 +
drivers/nvme/host/core.c | 28 +++--
drivers/staging/gasket/gasket_core.c | 4 +
drivers/tty/serial/xilinx_uartps.c | 1 +
drivers/tty/vt/vt.c | 9 +-
drivers/usb/chipidea/ci_hdrc_msm.c | 2 +-
drivers/usb/serial/garmin_gps.c | 4 +-
drivers/usb/serial/qcserial.c | 1 +
drivers/usb/storage/unusual_uas.h | 7 ++
fs/ceph/mds_client.c | 8 +-
fs/ceph/quota.c | 4 +-
fs/coredump.c | 8 ++
fs/eventpoll.c | 61 ++++++-----
fs/notify/fanotify/fanotify.c | 9 +-
fs/notify/inotify/inotify_fsnotify.c | 4 +-
fs/notify/inotify/inotify_user.c | 2 +-
include/linux/backing-dev-defs.h | 1 +
include/linux/backing-dev.h | 9 +-
include/linux/fsnotify_backend.h | 7 +-
include/linux/virtio_net.h | 26 ++++-
include/net/inet_ecn.h | 57 +++++++++-
include/net/ip6_fib.h | 4 +
include/net/net_namespace.h | 7 ++
ipc/mqueue.c | 34 ++++--
kernel/trace/trace.c | 13 +++
kernel/trace/trace_kprobe.c | 2 +-
kernel/umh.c | 5 +
mm/backing-dev.c | 13 ++-
mm/memcontrol.c | 15 +--
mm/page_alloc.c | 9 ++
net/batman-adv/bat_v_ogm.c | 2 +-
net/batman-adv/network-coding.c | 9 +-
net/batman-adv/sysfs.c | 3 +-
net/core/devlink.c | 5 +
net/core/neighbour.c | 6 +-
net/dsa/master.c | 3 +-
net/ipv6/route.c | 25 +++++
net/netfilter/nf_nat_proto.c | 4 +-
net/netfilter/nfnetlink_osf.c | 12 ++-
net/sched/sch_choke.c | 3 +-
net/sched/sch_fq_codel.c | 2 +-
net/sched/sch_sfq.c | 9 ++
net/sched/sch_skbprio.c | 3 +
net/sctp/sm_statefuns.c | 6 +-
net/tipc/topsrv.c | 5 +-
net/tls/tls_sw.c | 7 +-
scripts/decodecode | 2 +-
tools/cgroup/iocost_monitor.py | 7 +-
tools/objtool/check.c | 2 +-
virt/kvm/arm/hyp/aarch32.c | 8 +-
virt/kvm/arm/vgic/vgic-mmio.c | 4 +-
90 files changed, 648 insertions(+), 346 deletions(-)