mirror of
https://github.com/torvalds/linux.git
synced 2026-07-27 09:36:22 +02:00
3ca4f4e3ae
1450137 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Yu Kuai
|
3ca4f4e3ae |
block, bfq: don't grab queue_lock to initialize bfq
The request_queue is frozen and quiesced while the elevator init_sched() method runs, so queue_lock is not needed for BFQ cgroup initialization. Signed-off-by: Yu Kuai <yukuai@fygo.io> Link: https://patch.msgid.link/1965073ea20f33114a8d903816b986e483b9bb34.1780621988.git.yukuai@fygo.io Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
|
Yu Kuai
|
f928145cbc |
mm/page_io: don't nest queue_lock under rcu in bio_associate_blkg_from_page()
Take a css reference under RCU, drop RCU, and then associate the bio with the blkg. This avoids nesting queue_lock under RCU and prepares to protect blkcg with blkcg_mutex instead of queue_lock. Use css_tryget() instead of css_tryget_online() so swap writeback for pages charged to a dying memcg still passes the dying css to bio_associate_blkg_from_css(). That preserves the existing closest-live ancestor fallback instead of charging those bios to the root blkg. Signed-off-by: Yu Kuai <yukuai@fygo.io> Link: https://patch.msgid.link/c910d2c39d3ec97f67de68af636a52394342d55f.1780621988.git.yukuai@fygo.io Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
|
Yu Kuai
|
4cfd7c1cff |
blk-cgroup: don't nest queue_lock under blkcg->lock in blkcg_destroy_blkgs()
The correct lock order is q->queue_lock before blkcg->lock, and in order to prevent deadlock from blkcg_destroy_blkgs(), trylock is used for q->queue_lock while blkcg->lock is already held, this is hacky. Refactor blkcg_destroy_blkgs() to hold blkcg->lock only long enough to get the first blkg and then release it. Then take q->queue_lock and blkcg->lock in the correct order to destroy the blkg. This is a very cold path, so the extra lock/unlock cycles are acceptable. Also prepare to convert protecting blkcg with blkcg_mutex instead of queue_lock. Signed-off-by: Yu Kuai <yukuai@fygo.io> Link: https://patch.msgid.link/00b03cf74a9937cb4d6dd67a189ddc00a3de0451.1780621988.git.yukuai@fygo.io Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
|
Yu Kuai
|
457d3c4f0f |
blk-cgroup: don't nest queue_lock under rcu in bio_associate_blkg()
If a bio is already associated with a blkg, the blkcg is already pinned until the bio is done, so there is no need for RCU protection. Otherwise, protect blkcg_css() with RCU independently. Prepare to protect blkcg with blkcg_mutex instead of queue_lock. Signed-off-by: Yu Kuai <yukuai@fygo.io> Link: https://patch.msgid.link/8496fa234b21d4b31b7f068766906d0bffcac8e6.1780621988.git.yukuai@fygo.io Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
|
Yu Kuai
|
9327a865e3 |
blk-cgroup: don't nest queue_lock under rcu in blkg_lookup_create()
Change this in two steps: 1) hold rcu lock and do blkg_lookup() from fast path; 2) hold queue_lock directly from slow path, and don't nest it under rcu lock; Prepare to convert protecting blkcg with blkcg_mutex instead of queue_lock. Signed-off-by: Yu Kuai <yukuai@fygo.io> Link: https://patch.msgid.link/93f33cc9e5a39dddb78dcd934d0c1d04b564fb00.1780621988.git.yukuai@fygo.io Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
|
Yu Kuai
|
56cc24f59c |
blk-cgroup: don't nest queue_lock under rcu in blkcg_print_blkgs()
With previous modification to delay freeing policy data after an RCU grace period, prfill() can run under RCU instead of taking queue_lock. However, policy teardown can still clear blkg->pd[plid] after blkcg_print_blkgs() observes the policy enabled bit. Load policy data once with READ_ONCE() and skip the blkg if teardown already cleared it. Do the same in recursive stat walks for descendant blkgs. Remove the stale BFQ debug queue_lock assertion because blkcg_print_blkgs() no longer calls prfill() with queue_lock held. This also lets ioc_qos_prfill() and ioc_cost_model_prfill() use IRQ-safe ioc->lock locking without re-enabling IRQs while queue_lock is still held. Signed-off-by: Yu Kuai <yukuai@fygo.io> Link: https://patch.msgid.link/db7633d5e263dd1c2bf9b901762545a84b7d714e.1780621988.git.yukuai@fygo.io Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
|
Yu Kuai
|
0af3fedb8c |
blk-cgroup: delay freeing policy data after rcu grace period
Currently blkcg_print_blkgs() must hold RCU to iterate blkgs from a blkcg, and prfill() must hold queue_lock to prevent policy data from being freed by policy deactivation. As a consequence, queue_lock has to be nested under RCU from blkcg_print_blkgs(). Delay freeing policy data until after an RCU grace period so prfill() can be protected by RCU alone. Signed-off-by: Yu Kuai <yukuai@fygo.io> Link: https://patch.msgid.link/e20e5d984b41a026d61851966bed35eb094c4bff.1780621988.git.yukuai@fygo.io Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
|
Yu Kuai
|
25656304da |
blk-cgroup: protect iterating blkgs with blkcg->lock in blkcg_print_stat()
blkcg_print_one_stat() will be called for each blkg: - access blkg->iostat, which is freed from rcu callback blkg_free_workfn(); - access policy data from pd_stat_fn(), which is freed from pd_free_fn(), while pd_free_fn() can be called by removing blkcg or deactivating policy; Take blkcg->lock while iterating so the blkgs stay online and both blkg->iostat and policy data for activated policies stay valid. Use irq-safe locking because blkcg->lock can be nested under q->queue_lock, which is used from IRQ completion paths. Prepare to convert protecting blkgs from request_queue with mutex. Signed-off-by: Yu Kuai <yukuai@fygo.io> Link: https://patch.msgid.link/05799877e720dcd300e2ddd4625e8e162959d7cc.1780621988.git.yukuai@fygo.io Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
|
Jens Axboe
|
8a901e629e |
Merge branch 'md-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux into block-7.2
Pull MD fixes from Yu Kuai: "Bug Fixes: - Fix raid1 writes_pending and barrier reference leaks on write failures. (Abd-Alrhman Masalkhi) - Fix raid10 writes_pending leak on write request failures. (Abd-Alrhman Masalkhi) - Fix raid10 writes_pending and barrier reference leaks on discard failures. (Abd-Alrhman Masalkhi) - Fix raid1 REQ_NOWAIT handling while waiting for behind writes. (Abd-Alrhman Masalkhi) - Fix raid1 r1_bio leak when a REQ_NOWAIT retry would block. (Abd-Alrhman Masalkhi) - Fix raid1 read-balance head_position data race. (Chen Cheng) - Fix raid5 stripe batch bm_seq wraparound comparison. (Chen Cheng) - Fix raid5 stripe batch state snapshot KCSAN noise. (Chen Cheng) - Fix raid5 R5_Overlap races while breaking stripe batches. (Chen Cheng) Improvements: - Add raid5 discard IO accounting. (Yu Kuai) - Always convert raid5 llbitmap bits for discard. (Yu Kuai) Cleanups: - Simplify raid1_write_request() error handling. (Abd-Alrhman Masalkhi)" * 'md-7.2' of https://git.kernel.org/pub/scm/linux/kernel/git/mdraid/linux: md/raid5: avoid R5_Overlap races while breaking stripe batches md/raid5: use stripe state snapshot in break_stripe_batch_list() md/raid5: let stripe batch bm_seq comparison wrap-safe md/raid1: protect head_position for read balance md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry md/raid1: honor REQ_NOWAIT when waiting for behind writes md/raid5: always convert llbitmap bits for discard md/raid5: validate discard support at request time md/raid5: account discard IO md/raid1: simplify raid1_write_request() error handling md/raid10: fix writes_pending and barrier reference leaks on discard failures md/raid10: fix writes_pending leak on write request failures md/raid1: fix writes_pending and barrier reference leaks on write failures |
||
|
Jens Axboe
|
29264400dd |
nvme fixes for Linux 7.2
- Apple A11 quirk for sharing tags across admin and IO queues (Nick)
- Target fix for short AUTH_RECEIVE buffers (Michael)
- Target fix for SQ refcount leak (Wentao)
- Target RDMA handling inline data with nonzero offset (Bryam)
- Target TCP fix handling the TCP_CLOSING state (Maurizio)
- FC abort fixes in early initialization (Mohamed)
- Controller device teardown fixes (Maurizio, John)
- Allocate the target ana_state with the port (Rosen)
- Quieten sparse and sysfs symbol warnings (John)
-----BEGIN PGP SIGNATURE-----
iQIzBAABCAAdFiEE3Fbyvv+648XNRdHTPe3zGtjzRgkFAmo6m3MACgkQPe3zGtjz
RgmySw/9FsJ9VJb6qII3+3e9Cse+fXT2OBQxpQQxW+togdgBSxHq5t8xc/wGhrqq
wXv4+Z6X4ZdZAkSEHleg55mb9ebceRF4tH/Ua3EQi+aQ0YSrSaEdU8oBDlRs6e68
f/F9L11wke3BK2D8ArHPgjph7hD11FXyI4RmfqNuPkqQdvV0paKWt/6SrLwwy1iz
zQd+fDUOT+LgRsWD0zXYLxowKQSX4yVoMmigSSVT+JOjsA/vQq+sXjXUAcFZ6xhn
cJ/FK0HzxDjF9iHyCv5K92zf3olaf4+Bs9Evh7JEJTp2opy0ETTKa2wGzmd9QDSu
Xkfd0B/2Ecc73CYo7rB7D4asZlVw9y0Auy8BO6RLv27PDKnTeSmfUIkvyiDL4LnJ
VEPCjLlXAxEGc6bM28UsSUflEe8HvALUgG58Zll3X6YTpwIFOX6PEBUmIzT9RA15
8GfWeq8ffepNWyBibNClJHQTe5L8QnWg6IOyceIADJUFdCPgTD8w/gysNpL1vYTb
ew4l+LUYWDiZRIXH1NjOs5ISLjvo8l38WQB+XfC48eKc1ipWC9OOgVsS/wBeXJXD
mI15wpV3/oFMNW34gcwlSOoOZfd0UAslYa/s3CNMUlUMsFEqJdlRFS3Ty0CC8dZi
GRqsVqJPJRSJMvrvMCZi8FT30+5azZkR8YB2Zr7PtYLyC52dCPU=
=M7aO
-----END PGP SIGNATURE-----
Merge tag 'nvme-7.2-2026-06-23' of git://git.infradead.org/nvme into block-7.2
Pull NVMe fixes from Keith:
"- Apple A11 quirk for sharing tags across admin and IO queues (Nick)
- Target fix for short AUTH_RECEIVE buffers (Michael)
- Target fix for SQ refcount leak (Wentao)
- Target RDMA handling inline data with nonzero offset (Bryam)
- Target TCP fix handling the TCP_CLOSING state (Maurizio)
- FC abort fixes in early initialization (Mohamed)
- Controller device teardown fixes (Maurizio, John)
- Allocate the target ana_state with the port (Rosen)
- Quieten sparse and sysfs symbol warnings (John)"
* tag 'nvme-7.2-2026-06-23' of git://git.infradead.org/nvme:
nvmet-tcp: handle TCP_CLOSING state in nvmet_tcp_state_change
nvmet-auth: reject short AUTH_RECEIVE buffers
nvme-fc: Do not cancel requests in io target before it is initialized
nvme: make nvme_add_ns{_head}_cdev return void
nvme: make some sysfs diagnostic structures static
nvmet-rdma: handle inline data with a nonzero offset
nvme: target: allocate ana_state with port
nvme: fix crash and memory leak during invalid cdev teardown
nvmet: fix refcount leak in nvmet_sq_create()
nvme: quieten sparse warning in valid LBA size check
nvme-apple: Prevent shared tags across queues on Apple A11
|
||
|
Chen Cheng
|
55b77337bd |
md/raid5: avoid R5_Overlap races while breaking stripe batches
KCSAN report a race in break_stripe_batch_list() vs. raid5_make_request()
on sh->dev[i].flags (plain word write vs. atomic bit op)..
and .. one possible scenario is:
CPU1 CPU2
break_stripe_batch_list(sh1)
-> handle sh2
-> lock(sh2)
-> sh2->batch_head = NULL
-> unlock(sh2)
-> test_and_clear_bit(R5_Overlap, sh2->dev[i].flags)
-> wake_up_bit(sh2->dev[i].flags)
raid5_make_request()
-> add_all_stripe_bios(sh2)
-> lock(sh2)
-> stripe_bio_overlaps(sh2) returns true
batch_head is NULL, so new bio overlap
exist bio on sh2 -> true
-> set_bit(R5_Overlap, sh2->dev[i].flags)
-> unlock(sh2)
-> wait_on_bit(sh2->dev[i].flags)
-> sh2->dev[i].flags = sh1->dev[i].flags & ~R5_Overlap
No wait_up_bit(), CPU2 could be wait_on_bit() forever...
Fix by :
- Expand the protect zone.
- Use batch_head's device flag's snaphot when no held head_sh->stripe_lock.
- Move sh/head_sh->batch_head = NULL to the end of protected zone , and ,
any concurrent add_all_stripe_bios() grabs sh->stripe_lock now either:
- see batch_head != null, and , is rejected by stripe_bio_overlaps()
under the lock (no R5_Overlap wait ) , or ,
- sees batch_head == NULL, only after dev[i].flags has already been
set and the prior R5_Overlap waiters worken.
KCSAN report:
================================================
BUG: KCSAN: data-race in break_stripe_batch_list / raid5_make_request
write (marked) to 0xffff8e89c8117548 of 8 bytes by task 4042 on cpu 0:
raid5_make_request+0xea0/0x2930
md_handle_request+0x4a2/0xa40
md_submit_bio+0x109/0x1a0
__submit_bio+0x2ec/0x390
submit_bio_noacct_nocheck+0x457/0x710
submit_bio_noacct+0x2a7/0xc20
submit_bio+0x56/0x250
blkdev_direct_IO+0x54c/0xda0
blkdev_write_iter+0x38f/0x570
aio_write+0x22b/0x490
io_submit_one+0xa51/0xf70
__x64_sys_io_submit+0xf7/0x220
x64_sys_call+0x1907/0x1c60
do_syscall_64+0x130/0x570
entry_SYSCALL_64_after_hwframe+0x76/0x7e
read to 0xffff8e89c8117548 of 8 bytes by task 4010 on cpu 5:
break_stripe_batch_list+0x249/0x480
handle_stripe_clean_event+0x720/0x9b0
handle_stripe+0x32fb/0x4500
handle_active_stripes.isra.0+0x6e0/0xa50
raid5d+0x7e0/0xba0
md_thread+0x15a/0x2d0
kthread+0x1e3/0x220
ret_from_fork+0x37a/0x410
ret_from_fork_asm+0x1a/0x30
value changed: 0x0000000000000019 -> 0x0000000000000099 --> R5_Overlap
Fixes:
|
||
|
Chen Cheng
|
9b249f5ffb |
md/raid5: use stripe state snapshot in break_stripe_batch_list()
The patch just suppress KCSAN noise. No functional change. RAID-5 can group multi full-stripe-write aka stripe_head into a batch aka batch_list, with one head_sh leading them. Call break_stripe_batch_list() when the batch is finished, or, a stripe has to be dropped out of the batch. break_stripe_batch_list() reads stripe state several times while request paths can update thost state words concurrently with lockless bitops, which reported by KCSAN. Use a snapshot to guarantees that the value used for warning, copying, and handle checks is internally consistent at current read moment. KCSAN report: ============================================== BUG: KCSAN: data-race in __add_stripe_bio / break_stripe_batch_list write (marked) to 0xffff8e89d4f0b988 of 8 bytes by task 4323 on cpu 3: __add_stripe_bio+0x35e/0x400 raid5_make_request+0x6ac/0x2930 md_handle_request+0x4a2/0xa40 md_submit_bio+0x109/0x1a0 __submit_bio+0x2ec/0x390 submit_bio_noacct_nocheck+0x457/0x710 submit_bio_noacct+0x2a7/0xc20 submit_bio+0x56/0x250 blkdev_direct_IO+0x54c/0xda0 blkdev_write_iter+0x38f/0x570 aio_write+0x22b/0x490 io_submit_one+0xa51/0xf70 read to 0xffff8e89d4f0b988 of 8 bytes by task 4290 on cpu 4: break_stripe_batch_list+0x3ce/0x480 handle_stripe_clean_event+0x720/0x9b0 handle_stripe+0x32fb/0x4500 handle_active_stripes.isra.0+0x6e0/0xa50 raid5d+0x7e0/0xba0 Signed-off-by: Chen Cheng <chencheng@fnnas.com> Link: https://patch.msgid.link/20260618134748.1168360-1-chencheng@fnnas.com Signed-off-by: Yu Kuai <yukuai@fygo.io> |
||
|
Zizhi Wo
|
3ed9b4779a |
blk-cgroup: defer blkcg css_put until blkg is unlinked from queue
[BUG]
Our fuzz testing triggered a blkcg use-after-free issue:
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x75/0xe0
Call Trace:
...
blkcg_deactivate_policy+0x244/0x4d0
ioc_rqos_exit+0x44/0xe0
rq_qos_exit+0xba/0x120
__del_gendisk+0x50b/0x800
del_gendisk+0xff/0x190
...
[CAUSE]
process1 process2
cgroup_rmdir
...
css_killed_work_fn
offline_css
...
blkcg_destroy_blkgs
...
__blkg_release
css_put(&blkg->blkcg->css)
blkg_free
INIT_WORK(xxx, blkg_free_workfn)
schedule_work
css_put
...
blkcg_css_free
kfree(blkcg)--------blkcg has been freed!!!
====================================schedule_work
blkg_free_workfn
__del_gendisk
rq_qos_exit
ioc_rqos_exit
blkcg_deactivate_policy
mutex_lock(&q->blkcg_mutex)
spin_lock_irq(&q->queue_lock)
list_for_each_entry(blkg, xxx)
blkcg = blkg->blkcg
spin_lock(&blkcg->lock)-------UAF!!!
mutex_lock(&q->blkcg_mutex)
spin_lock_irq(&q->queue_lock)
/* Only then is the blkg removed from the list */
list_del_init(&blkg->q_node)
As a result, a blkg can still be reachable through q->blkg_list while
its ->blkcg has already been freed.
[Fix]
Fix this by deferring the blkcg css_put() until after the blkg has been
unlinked from q->blkg_list in blkg_free_workfn(). This ensures that the
blkcg outlives every blkg still reachable through q->blkg_list, so any
iterator holding q->queue_lock is guaranteed to observe a valid
blkg->blkcg.
While at it, move css_tryget_online() from blkg_create() into blkg_alloc()
so that the css reference is owned by the alloc/free pair rather than
straddling layers:
blkg_alloc() <-> blkg_free()
blkg_create() <-> blkg_destroy()
Fixes:
|
||
|
Michal Koutný
|
0ab5ee5a1b |
blk-cgroup: fix UAF in __blkcg_rstat_flush()
When multiple blkgs in the same blkcg are released concurrently,
a use-after-free can occur. The race happens when one blkg's
__blkcg_rstat_flush() removes another blkg's iostat entries via
llist_del_all(). The second blkg sees an empty list and proceeds
to free itself while the first is still iterating over its entries.
Move the flush from __blkg_release() (RCU callback) to blkg_release()
(before call_rcu). This ensures the RCU grace period waits for any
concurrent flush's rcu_read_lock() section to complete before freeing.
Cc: stable@vger.kernel.org
Cc: Jay Shin <jaeshin@redhat.com>
Cc: Tejun Heo <tj@kernel.org>
Cc: Waiman Long <longman@redhat.com>
Fixes:
|
||
|
Cen Zhang
|
17b2d950a3 |
block, bfq: protect async queue reset with blkcg locks
Writing 0 to BFQ's low_latency attribute ends weight raising for active,
idle and async queues. The async cgroup path walks q->blkg_list, converts
each blkg to BFQ policy data and then reads bfqg->async_bfqq and
bfqg->async_idle_bfqq.
That walk was protected only by bfqd->lock. blkcg release work is
serialized by q->blkcg_mutex and q->queue_lock instead, and
blkg_free_workfn() can call BFQ's pd_free_fn before it removes
blkg->q_node from q->blkg_list. A low_latency reset can therefore still
find the blkg on the queue list after the BFQ policy data has been freed.
The buggy scenario involves two paths, with each column showing the order
within that path:
BFQ low_latency reset: blkcg blkg release work:
1. bfq_low_latency_store() 1. blkg_free_workfn() takes
calls bfq_end_wr(). q->blkcg_mutex.
2. bfq_end_wr_async() walks 2. BFQ pd_free_fn drops the
q->blkg_list. final bfq_group reference.
3. blkg_to_bfqg() returns 3. blkg->q_node remains on
the stale policy data. q->blkg_list until list_del_init().
4. bfq_end_wr_async_queues()
reads async queue fields.
Fix this by taking q->blkcg_mutex and q->queue_lock around the
q->blkg_list walk, then taking bfqd->lock before touching BFQ async
queues. The mutex serializes against policy-data free and queue_lock
stabilizes the list. Move the async reset out of bfq_end_wr()'s existing
bfqd->lock critical section so the lock order matches blkcg policy
callbacks.
Validation reproduced this kernel report:
BUG: KASAN: slab-use-after-free in bfq_end_wr_async_queues+0x246/0x340
Call Trace:
<TASK>
dump_stack_lvl+0x66/0xa0
print_report+0xce/0x630
? bfq_end_wr_async_queues+0x246/0x340
? srso_alias_return_thunk+0x5/0xfbef5
? __virt_addr_valid+0x20d/0x410
? bfq_end_wr_async_queues+0x246/0x340
kasan_report+0xe0/0x110
? bfq_end_wr_async_queues+0x246/0x340
bfq_end_wr_async_queues+0x246/0x340
bfq_end_wr_async+0xba/0x180
bfq_low_latency_store+0x4e5/0x690
? 0xffffffffc02150da
? __pfx_bfq_low_latency_store+0x10/0x10
? __pfx_bfq_low_latency_store+0x10/0x10
elv_attr_store+0xc4/0x110
kernfs_fop_write_iter+0x2f5/0x4a0
vfs_write+0x604/0x11f0
? __pfx_locks_remove_posix+0x10/0x10
? __pfx_vfs_write+0x10/0x10
ksys_write+0xf9/0x1d0
? __pfx_ksys_write+0x10/0x10
do_syscall_64+0x115/0x6a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Allocated by task 544:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
bfq_pd_alloc+0xc0/0x1b0
blkg_alloc+0x346/0x960
blkg_create+0x8c2/0x10d0
bio_associate_blkg_from_css+0x9f3/0xfa0
bio_associate_blkg+0xd9/0x200
bio_init+0x303/0x640
__blkdev_direct_IO_simple+0x56b/0x8a0
blkdev_direct_IO+0x8e7/0x2580
blkdev_read_iter+0x205/0x400
vfs_read+0x7b0/0xda0
ksys_read+0xf9/0x1d0
do_syscall_64+0x115/0x6a0
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 465:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x5f/0x80
kfree+0x307/0x580
blkg_free_workfn+0xef/0x460
process_one_work+0x8d0/0x1870
worker_thread+0x575/0xf80
kthread+0x2e7/0x3c0
ret_from_fork+0x576/0x810
ret_from_fork_asm+0x1a/0x30
Fixes:
|
||
|
Deepanshu Kartikey
|
9280e6edf6 |
nbd: don't warn when reclassifying a busy socket lock
nbd_reclassify_socket() warns via WARN_ON_ONCE() if the socket lock is
held at the point of reclassification. That assertion was copied from
nvme-tcp, where the socket is created internally by the kernel
(sock_create_kern()) and is never visible to user space, so the lock
is guaranteed to be free.
NBD is different: the socket is looked up from a user-supplied fd in
nbd_get_socket(), and user space retains that fd. A concurrent syscall
on the same socket (or softirq processing taking bh_lock_sock() on a
connected TCP socket) can legitimately hold the lock at the instant
NBD reclassifies it. sock_allow_reclassification() then returns false
and the WARN_ON_ONCE() fires, which turns into a crash under
panic_on_warn. This is reachable by simply racing NBD_CMD_CONNECT
against socket activity on the same fd, as reported by syzbot.
Hitting a held lock here is expected for an externally owned socket and
is not a kernel bug, so skip reclassification silently instead of
warning. Reclassification is a lockdep-only annotation, so skipping it
in the rare racing case is harmless.
Reported-by: syzbot+6b85d1e39a5b8ed9a954@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=6b85d1e39a5b8ed9a954
Fixes:
|
||
|
Christoph Hellwig
|
214cdae69d |
block: fix incorrect error injection static key decrement
Only decrement the static key when we had items and thus it was
incremented before.
Fixes:
|
||
|
Chen Cheng
|
00e93faf4c |
md/raid5: let stripe batch bm_seq comparison wrap-safe
Once the 32-bit seq wraps, a newer bm_seq can look smaller than old, so .. covert to wrap-safe calculate way. Signed-off-by: Chen Cheng <chencheng@fnnas.com> Link: https://patch.msgid.link/20260618025735.915113-1-chencheng@fnnas.com Signed-off-by: Yu Kuai <yukuai@fygo.io> |
||
|
Chen Cheng
|
601d3c21b2 |
md/raid1: protect head_position for read balance
KCSAN reports a data race between raid1_end_read_request() and
raid1_read_request().
The completion path updates conf->mirrors[disk].head_position in
update_head_pos() without a lock, while the read-balance heuristic reads
the same field locklessly in is_sequential() and choose_best_rdev().
KCSAN report:
=========================
BUG: KCSAN: data-race in raid1_end_read_request / raid1_read_request
write to 0xffff8f0306ba7868 of 8 bytes by interrupt on cpu 9:
raid1_end_read_request+0xb5/0x440
bio_endio+0x3c9/0x3e0
blk_update_request+0x257/0x770
scsi_end_request+0x4d/0x520
scsi_io_completion+0x6f/0x990
scsi_finish_command+0x188/0x280
scsi_complete+0xac/0x160
blk_complete_reqs+0x8e/0xb0
blk_done_softirq+0x1d/0x30
[...]
read to 0xffff8f0306ba7868 of 8 bytes by task 667002 on cpu 11:
raid1_read_request+0x497/0x1a10
raid1_make_request+0xdf/0x1950
md_handle_request+0x2c5/0x700
md_submit_bio+0x126/0x320
__submit_bio+0x2ec/0x3a0
submit_bio_noacct_nocheck+0x572/0x890
[...]
value changed: 0x0000000000000078 -> 0x00000000005fe448
Signed-off-by: Chen Cheng <chencheng@fnnas.com>
Link: https://patch.msgid.link/20260619044114.1208456-1-chencheng@fnnas.com
Signed-off-by: Yu Kuai <yukuai@fygo.io>
|
||
|
Abd-Alrhman Masalkhi
|
69ad6ce47f |
md/raid1: free r1_bio when REQ_NOWAIT is set and read would block on retry
When a read is retried, raid1_read_request() may be called with a
pre-allocated r1_bio. If wait_read_barrier() fails for a REQ_NOWAIT
read, the bio is completed and the function returns immediately. In this
case the existing r1_bio is leaked.
This fixes a leak of pre-allocated r1_bio structures for retried reads.
Fixes:
|
||
|
Abd-Alrhman Masalkhi
|
a286cb88dd |
md/raid1: honor REQ_NOWAIT when waiting for behind writes
raid1 supports REQ_NOWAIT reads by avoiding waits in the barrier path
through wait_read_barrier(). However, a read can still block on a
WriteMostly device when the array uses a bitmap and there are
outstanding behind writes.
In that case raid1 unconditionally calls wait_behind_writes(), which
may sleep until all behind writes complete. As a result, a REQ_NOWAIT
read can block despite the caller explicitly requesting non-blocking
behavior.
This ensures that raid1 consistently honors REQ_NOWAIT reads across all
paths that may otherwise wait for behind writes.
Fixes:
|
||
|
Yu Kuai
|
53528031e7 |
md/raid5: always convert llbitmap bits for discard
llbitmap discard is useful even when no underlying member device supports it. The discard still converts the llbitmap range to unwritten, so later reads and recovery do not rely on stale parity for that range. Let llbitmap discard bypass the raid5 lower discard support check. If lower discard is not safe or not supported, complete the accounted clone after md_account_bio() so the llbitmap conversion callbacks run without member discard bios. Link: https://patch.msgid.link/20260605072639.2434847-4-yukuai@kernel.org Signed-off-by: Yu Kuai <yukuai@fygo.io> |
||
|
Yu Kuai
|
9057309267 |
md/raid5: validate discard support at request time
Raid5 used to disable discard limits when devices_handle_discard_safely was not set or when stacked member limits could not support a full-stripe discard. That hides discard from userspace before raid5 can decide whether a request can be handled safely. Follow other virtual drivers and advertise a UINT_MAX discard limit for the md device. Cache lower discard support in r5conf when setting queue limits, and reject unsupported discard bios before queuing stripe work. Link: https://patch.msgid.link/20260605072639.2434847-3-yukuai@kernel.org Signed-off-by: Yu Kuai <yukuai@fygo.io> |
||
|
Yu Kuai
|
74ddbf98e2 |
md/raid5: account discard IO
Raid5 handles discard bios internally through make_discard_request() and never passes them through md_account_bio(). As a result, discard IO is missing the md-device iostat accounting that normal raid5 IO and discard IO in other raid levels get from md_account_bio(). Before accounting the bio, trim the request to the full data stripes that raid5 will actually discard. The first full stripe is the ceiling of the bio start divided by data-stripe sectors, and the last full stripe is the floor of the bio end divided by data-stripe sectors. Account that exact MD logical full-stripe range, then restore the original iterator so bio completion and iostat still cover the original request. Link: https://patch.msgid.link/20260605072639.2434847-2-yukuai@kernel.org Signed-off-by: Yu Kuai <yukuai@fygo.io> |
||
|
Abd-Alrhman Masalkhi
|
a4c55c9026 |
md/raid1: simplify raid1_write_request() error handling
raid1_write_request() increments rdev->nr_pending before checking the badblocks and then immediately decrements it again when a device is skipped. Move the increment until after the checks succeed so the reference accounting is easier to follow. Consolidate the failure paths so that each error label releases exactly the resources acquired up to that point. err_dec_pending drops pending references and frees the r1bio, while err_allow_barrier handles the barrier release before returning. When a REQ_ATOMIC write cannot be satisfied due to a badblock range, complete the bio with BLK_STS_NOTSUPP rather than reporting an I/O error, since the operation is unsupported rather than having failed during I/O. Rename max_write_sectors to max_sectors and remove the redundant local copy. Signed-off-by: Abd-Alrhman Masalkhi <abd.masalkhi@gmail.com> Link: https://patch.msgid.link/20260613182810.1317258-5-abd.masalkhi@gmail.com Signed-off-by: Yu Kuai <yukuai@fygo.io> |
||
|
Abd-Alrhman Masalkhi
|
393d687131 |
md/raid10: fix writes_pending and barrier reference leaks on discard failures
raid10_make_request() acquires a writes_pending reference with md_write_start() before calling raid10_handle_discard(). Several failure paths in raid10_handle_discard() complete the bio and return without releasing the corresponding reference, causing md_write_end() to be skipped. Call md_write_end() before returning from these failure paths to keep writes_pending accounting balanced. Additionally, discard split allocation failures can occur after wait_barrier() succeeds. Those paths return without calling allow_barrier(), leaking the associated barrier reference. Release the barrier before returning from those paths. Fixes: |
||
|
Abd-Alrhman Masalkhi
|
e045d6ed33 |
md/raid10: fix writes_pending leak on write request failures
raid10_make_request() acquires a writes_pending reference with md_write_start() before dispatching write requests. Several failure paths in raid10_write_request() complete the bio and return without reaching the normal write completion path, causing the corresponding md_write_end() to be skipped. Make raid10_write_request() return a status indicating whether the write request was successfully queued. This allows raid10_make_request() to release the writes_pending reference with md_write_end() when a write request fails. Fixes: |
||
|
Abd-Alrhman Masalkhi
|
8e065a1602 |
md/raid1: fix writes_pending and barrier reference leaks on write failures
raid1_make_request() acquires a writes_pending reference with md_write_start() before calling raid1_write_request(). Several failure paths in raid1_write_request() complete the bio and return without reaching the normal write completion path, causing the corresponding md_write_end() to be skipped. Make raid1_write_request() return a status indicating whether the write request was successfully queued. This allows raid1_make_request() to call md_write_end() when raid1_write_request() fails. Additionally, if wait_blocked_rdev() fails after wait_barrier() succeeds, the associated barrier reference is not released. Call allow_barrier() before returning from that path to keep the barrier accounting balanced. Fixes: |
||
|
Qu Wenruo
|
d5b58fbb2f |
block: respect iov_iter::nofault flag in bio_iov_iter_bounce_write()
For the incoming usage of IOMAP_DIO_BOUNCE in btrfs, btrfs has set iov_iter::nofault to prevent deadlock when a page fault is needed to read out the buffer. However bio_iov_iter_bounce_write() doesn't respect iov_iter::nofault flag, and just call a plain copy_from_iter() so it can still trigger page fault and cause deadlock in btrfs. Fix it by utilizing copy_folio_from_iter_atomic() if nofault flag is set, otherwise use copy_folio_from_iter(). Signed-off-by: Qu Wenruo <wqu@suse.com> Reviewed-by: Christoph Hellwig <hch@lst.de> Link: https://patch.msgid.link/9c165a314022b61566eb247852eb773ca6c70889.1781597506.git.wqu@suse.com Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
|
Qu Wenruo
|
b68d4979c8 |
block: revert the iov_iter after a short copy in bio_iov_iter_bounce_write()
For the incoming IOMAP_DIO_BOUNCE flag usage inside btrfs, it's pretty
easy to hit short copy inside bio_iov_iter_bounce_write().
This is because btrfs has disabled page fault to avoid certain deadlock
during direct writes, and instead btrfs manually fault in the pages then
retry.
And inside bio_iov_iter_bounce_write(), if we hit a short write, we
didn't revert the iov_iter, which can cause problems like unexpected
garbage for the next retry.
Revert the iov_iter after a short copy.
One thing to note is that, the folio is allocated then immediately
queued into the bio, so the proper revert size should be
(bi_size - this_len + copied).
Fixes:
|
||
|
Usama Arif
|
fad156c2af |
block: invalidate cached plug timestamp after task switch
blk_time_get_ns() caches ktime_get_ns() in current->plug->cur_ktime
and marks the task with PF_BLOCK_TS. That cache is only valid while the
task keeps running; if the task is switched out, wall-clock time
advances and the cached value must not be reused when the task runs again.
The existing invalidation covers explicit plug flushes through
__blk_flush_plug(), and the schedule() / rtmutex paths through
sched_update_worker(). It does not cover in-kernel preemption paths such
as preempt_schedule(), preempt_schedule_notrace(), and
preempt_schedule_irq(), which enter __schedule(SM_PREEMPT) directly and
return without calling sched_update_worker().
As a result, a task preempted while holding a plug with PF_BLOCK_TS set
can reuse a stale plug->cur_ktime after it is scheduled back in. blk-iocost
then consumes that stale timestamp through ioc_now(), producing stale vnow
values for throttle decisions, and through ioc_rqos_done(), inflating
on-queue time and feeding false missed-QoS samples into vrate
adjustment.
Move the schedule-side invalidation to finish_task_switch(), which runs
for the scheduled-in task after every actual context switch regardless
of which schedule entry point was used. Keep __blk_flush_plug() as the
explicit flush/finish-plug invalidation path, and remove only the
PF_BLOCK_TS handling from sched_update_worker().
Fixes:
|
||
|
Usama Arif
|
fd38b75c4b |
kernel/fork: clear PF_BLOCK_TS in copy_process()
PF_BLOCK_TS is only set in blk_time_get_ns() when current->plug is
non-NULL, and blk_finish_plug() clears it via __blk_flush_plug()
before NULLing the plug pointer. copy_process() breaks the
invariant by inheriting PF_BLOCK_TS from the parent while resetting
the child's plug to NULL.
Clear PF_BLOCK_TS alongside that assignment so callers can rely on
"PF_BLOCK_TS set implies current->plug != NULL" and dereference
current->plug unguarded.
Fixes:
|
||
|
Wen Xiong
|
9cbbac29d7 |
block: Remove redundant plug in __submit_bio()
The patch removes the automatic plug/unplug operations from __submit_bio()
that were added to cache nsecs time when no explicit plug is used.
The plug mechanism is most effective when batching multiple I/O
operations together. Creating a plug for every bio submission
provides minimal benefit while adding function call overhead and
stack usage for every I/O operation.
Below is performance comparison with the latest upstream kernel.
Iotype qd nj rmix mpstat busy mpstat busy without plug
Randrw 1 20 100 53% 24%
Randrw 1 40 100 70% 24%
Randrw 1 20 70 40% 24%
Randrw 1 40 70 60% 26%
Randrw 1 20 0 14% 6%
Randrw 1 40 0 20% 7%
Fixes:
|
||
|
Yitang Yang
|
4f919141be |
block: fix IORING_URING_CMD_REISSUE flags check in blkdev_uring_cmd
blkdev_uring_cmd() checks IORING_URING_CMD_REISSUE to determine whether
this is the first issue. However, this flag lives in cmd->flags instead
of issue_flags.
Coincidentally, IO_URING_F_NONBLOCK shares bit 31 with
IORING_URING_CMD_REISSUE. As a result, the SQE read was never performed,
bic->len remained zero, and every BLOCK_URING_CMD_DISCARD failed with
-EINVAL.
Fix it by checking cmd->flags as intended.
Cc: stable@vger.kernel.org
Fixes:
|
||
|
Linus Torvalds
|
6b5a2b7d9b |
RTLA patches for v7.2
- Fix discrepancy in --dump-tasks option Due to a mistake, rtla-timerlat-hist used the CLI syntax "--dump-task" instead of the documented "--dump-tasks". Change the option to match both documentation and the other timerlat tool, rtla-timerlat-top. - Extend coverage of runtime tests Cover both top and hist tools in all applicable test cases, add tests for a few uncovered options, and extend checks for some existing tests. - Add unit tests for actions rtla's actions feature is implemented in its source file and contains non-trivial parsing logic. Cover it with unit tests. - Stop record trace on interrupt Fix a bug where an interval exists after receiving a signal in which the main instance is stopped but the record instance is not, leading to discrepancies in reported results and sometimes rtla hanging. - Restore continue flag in actions_perform() Fix a bug where rtla always continues tracing after hitting a threshold even if the continue action was triggered just once, and add tests verifying that the flag is reset properly. - Migrate command line interface to libsubcmd Replace rtla's argument parsing using getopt_long() with libsubcmd, used by perf and objtool, to reuse existing code and auto-generate better help messages. Extensive unit tests are included to detect regressions. - Add -A/--aligned option to timerlat tools Add an option to align timerlat threads, based on the recently introduced TIMERLAT_ALIGN option of the timerlat tracer, together with unit tests and documentation. - Document tests in README Document how to run unit and runtime tests in rtla's README.txt, including the dependencies needed to run them. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCajBedhQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qoCyAQCdWOebZIJmDbuIPaJFXNlpF0JWg6ly /1fHtM/TXA9l3gD+P4RrfWqwNzk1B1/jOfTma6kpIVW3rIWE+Kts1X3Dswk= =4CXs -----END PGP SIGNATURE----- Merge tag 'trace-tools-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull RTLA tool updates from Steven Rostedt: - Fix discrepancy in --dump-tasks option Due to a mistake, rtla-timerlat-hist used the CLI syntax "--dump-task" instead of the documented "--dump-tasks". Change the option to match both documentation and the other timerlat tool, rtla-timerlat-top. - Extend coverage of runtime tests Cover both top and hist tools in all applicable test cases, add tests for a few uncovered options, and extend checks for some existing tests. - Add unit tests for actions rtla's actions feature is implemented in its source file and contains non-trivial parsing logic. Cover it with unit tests. - Stop record trace on interrupt Fix a bug where an interval exists after receiving a signal in which the main instance is stopped but the record instance is not, leading to discrepancies in reported results and sometimes rtla hanging. - Restore continue flag in actions_perform() Fix a bug where rtla always continues tracing after hitting a threshold even if the continue action was triggered just once, and add tests verifying that the flag is reset properly. - Migrate command line interface to libsubcmd Replace rtla's argument parsing using getopt_long() with libsubcmd, used by perf and objtool, to reuse existing code and auto-generate better help messages. Extensive unit tests are included to detect regressions. - Add -A/--aligned option to timerlat tools Add an option to align timerlat threads, based on the recently introduced TIMERLAT_ALIGN option of the timerlat tracer, together with unit tests and documentation. - Document tests in README Document how to run unit and runtime tests in rtla's README.txt, including the dependencies needed to run them. * tag 'trace-tools-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (26 commits) rtla: Document tests in README Documentation/rtla: Add -A/--aligned option rtla/tests: Add unit tests for -A/--aligned option rtla/timerlat: Add -A/--aligned CLI option rtla/tests: Add unit tests for CLI option callbacks rtla/tests: Add unit tests for _parse_args() functions rtla: Parse cmdline using libsubcmd tools subcmd: allow parsing distinct --opt and --no-opt tools subcmd: support optarg as separate argument rtla: Add libsubcmd dependency rtla/tests: Add runtime tests for restoring continue flag rtla/tests: Run runtime tests in temporary directory rtla/tests: Add unit test for restoring continue flag rtla/actions: Restore continue flag in actions_perform() rtla: Stop the record trace on interrupt rtla/tests: Add unit tests for actions module rtla/tests: Add runtime tests for -C/--cgroup rtla/tests: Add runtime test for -k and -u options rtla/tests: Add runtime test for -H/--house-keeping rtla/tests: Cover all hist options in runtime tests ... |
||
|
Linus Torvalds
|
c071a4fbb0 |
tracing latency updates for 7.2:
- Dump the stack to the buffer on timerlat uret threashold event Record the stack trace in the buffer for THREAD_URET as well as THREAD_CONTEXT when the threshold is hit. Otherwise, if the threshold was not hit at task wakeup, but was at task return, it will not produce a stack trace making it harder to debug. - Have osnoise trace prints print to all buffers The osnoise tracer is allowed to print to the main buffer. Add a osnoise_print() helper function and use trace_array_vprintk() to print osnoise output. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCajDrBBQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qgpwAQDmFBFP3dU6LiGp6U3UTYauAApah401 zXfmNxbGFO5rmwEAxIHCzoG3OZgrjrYhrkW9qBZDho7+1Frt7vphK71fYAE= =0ayh -----END PGP SIGNATURE----- Merge tag 'trace-latency-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing latency updates from Steven Rostedt: - Dump the stack to the buffer on timerlat uret threashold event Record the stack trace in the buffer for THREAD_URET as well as THREAD_CONTEXT when the threshold is hit. Otherwise, if the threshold was not hit at task wakeup, but was at task return, it will not produce a stack trace making it harder to debug. - Have osnoise trace prints print to all buffers The osnoise tracer is allowed to print to the main buffer. Add a osnoise_print() helper function and use trace_array_vprintk() to print osnoise output. * tag 'trace-latency-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing/osnoise: Array printk init and cleanup tracing/osnoise: Dump stack on timerlat uret threshold event |
||
|
Linus Torvalds
|
18ecdd4d0a |
Probes updates for v7.2
- eprobes: BTF support for dereferencing pointers
. tracing/eprobes: Allow use of BTF names to dereference pointers. Add syntax
to the parsing of eprobes to typecast structure pointer trace event fields,
enabling BTF-based dereferencing instead of relying on manual offsets.
- probes: Improvements and robustness enhancements
. tracing: Use flexible array for entry fetch code. Store probe entry fetch
instructions in the probe_entry_arg allocation via a flexible array
member to simplify memory allocation and lifetime management.
. tracing: Replace BUG_ON with lockdep_assert_held in uprobe_buffer functions.
Replace BUG_ON() calls with lockdep_assert_held() in uprobe buffer
enable/disable paths to prevent kernel crashes and better verify lock ownership.
. tracing/probes: Ensure the uprobe buffer size is bigger than event size.
Add a BUILD_BUG_ON() assertion to guarantee that the per-CPU uprobe
working buffer size is always larger than the maximum probe event size.
-----BEGIN PGP SIGNATURE-----
iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmowny4bHG1hc2FtaS5o
aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bLCAH/R4476TaJKhS6iAaMILz
6RaWmbbsrf4BjgMX3PnM3ROJo5oT3lZG3HQZIbrIdpAO8baB0uRLM8LXv3fteSkC
5C+tfAnTg7vGP1XbdGiDLKPcJUgVQo+SOjhT9f7VpTB/nhsNWC3aFVIxeLcbx89U
g3S9cMZ5ErBDnWsDiQ6v2mhNKJa+0f6egutSV7drN1yUkToPAnCfi9UrbMh/Tesh
zYhWcBCCcj3/JFUlPMcqamCWn12162jNp2dqZXTcsMYMOQpFUygeqIVdXlaH5wAp
niBpZrslP46hF84OBIdF8g8yP0xUnTToRMQmyFbeqTU1gmvBNeCV0VLoFB+02/OW
ujA=
=et3e
-----END PGP SIGNATURE-----
Merge tag 'probes-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull probes updates from Masami Hiramatsu:
- BTF support for dereferencing pointers
Add syntax to the parsing of eprobes to typecast structure pointer
trace event fields, enabling BTF-based dereferencing instead of
relying on manual offsets.
- Improvements and robustness enhancements
- Use flexible array for entry fetch code.
Store probe entry fetch instructions in the probe_entry_arg
allocation via a flexible array member to simplify memory
allocation and lifetime management.
- Replace BUG_ON with lockdep_assert_held in uprobe_buffer functions
Replace BUG_ON() calls with lockdep_assert_held() in uprobe buffer
enable/disable paths to prevent kernel crashes and better verify
lock ownership.
- Ensure the uprobe buffer size is bigger than event size.
Add a BUILD_BUG_ON() assertion to guarantee that the per-CPU
uprobe working buffer size is always larger than the maximum probe
event size.
* tag 'probes-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
tracing/eprobes: Allow use of BTF names to dereference pointers
tracing: Replace BUG_ON with lockdep_assert_held in uprobe_buffer functions
tracing: Use flexible array for entry fetch code
tracing/probes: Ensure the uprobe buffer size is bigger than event size
|
||
|
Linus Torvalds
|
4f7e89065e |
Bootconfig updates for v7.2
- bootconfig: Render kernel subtree as cmdline string at build time
. bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c. Move the
xbc_snprint_cmdline() function and its buffer from main.c to the shared
lib/bootconfig.c parser library so it can be reused by userspace tools.
. tools/bootconfig: render kernel.* subtree as cmdline string with -C. Add a
new -C option to print the kernel.* subtree as a flat command-line string
at build time, allowing early parameter injection without runtime parsing.
-----BEGIN PGP SIGNATURE-----
iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmown+YbHG1hc2FtaS5o
aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8blVEIAJpMmmEIjiiCIdAEfJKL
MTZo8C7V8sX+N3jmeaMmQNjkVfQuBbc4ORUtaZdxBs3E8BznN/zDs3ujSXfzbCe5
1Hc5A95g+ZXY+83ylCCAem6qTsWfYSN3j7oiyBx0CrRrXy7KupInE1BePMTg1DnZ
cAas3RLn5Qjyzg/yKMpkJNgCV/HxBCIAOXOF3F00S5THU5F1/W6VU3s8BpCU2mJK
nQXYGW7XfRkVhhQlkmBF5pfo5yPDeq7louxVCIw4AVJLHWIgxQ3v/d1wR24wu+kT
bZfDnsq0FVGeyjtRiX6iqFVc/zkQWhWrEFMbY3JNwW9lq4PT6nMH1ss1fNC3Ub1i
CJ8=
=apxi
-----END PGP SIGNATURE-----
Merge tag 'bootconfig-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace
Pull bootconfig updates from Masami Hiramatsu:
- bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
Move the xbc_snprint_cmdline() function and its buffer from
main.c to the shared lib/bootconfig.c parser library so it
can be reused by userspace tools.
- render kernel.* subtree as cmdline string with -C
Add a new -C option to print the kernel.* subtree as a flat
command-line string at build time, allowing early parameter
injection without runtime parsing.
* tag 'bootconfig-v7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
tools/bootconfig: render kernel.* subtree as cmdline string with -C
bootconfig: move xbc_snprint_cmdline() to lib/bootconfig.c
|
||
|
Linus Torvalds
|
8b308f9648 |
linux_kselftest-next-7.2-rc1
Several fixes and improvements to resctrl test and a change to kselftest document to clarify the use of FORCE_TARGETS build variable. -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEPZKym/RZuOCGeA/kCwJExA0NQxwFAmowRGcACgkQCwJExA0N QxwC7xAA5yoSyEiXOkeR/P5/NGzKTkEMnt8mQUQYRGkYCR8yt8dnD9n8OeF+vH8I bTu+6vc4YPUOnvEBvrZ/eUBlC7ZX/GZIxwlZ4dRkNeze/5CThtAJCUdVB4Mc76fU UNskE6mXeZERAeVN6WLm5hwGepJqItWc7UnGyABIzhby92TloyZQMrK84zo/H0Xj q4nIN8FNbNdaeHAlrFur/4xDbQRnHFKzyXdw8onkM0ApHrU2+paETo/vuiJCFe/3 89USFXFOGfJdVEbr0iTciIeoeRGd94WWaPSdzAF9xMAnOmKoFKkDewkPldoUT6oT S8PtFMZKWImUtjUWK3VLbDIPf/c+I6vI4w2RT58N3OXG0UwklYLV9qB6wcZCltjz HN9JGIaqwAEmilvtEO9KFNXz8G1zcX0XfDDBLMxeWvYZJURld2fBiUrI8PAwEiZe qIUjMbmRGDBs0QqG5hzuqm5CPwbVVeIi01eLSTlclGYGr3tWnXZ/L72nqFLMaPoJ afGaZxYs8NmpN701cSwLhNXliqk9rxcucrLb+jyysBJJD8BfcdybqjHd1NRw9dfn yevqdbkjPNhLYtPX54U298fb+UCFjxPBV2IwMoojTH3qfNg5Jr5OyY5ry/69nzIR O4p8OrJyIJXDqep2i3nsuCev6xKPAsy59yMMXl1yYl9sOMk7j+s= =FpFT -----END PGP SIGNATURE----- Merge tag 'linux_kselftest-next-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kselftest updates from Shuah Khan: "Several fixes and improvements to resctrl tests and a change to kselftest document to clarify the use of FORCE_TARGETS build variable" * tag 'linux_kselftest-next-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kselftest: fix doc for ksft_test_result_report() selftests/resctrl: Reduce L2 impact on CAT test selftests/resctrl: Simplify perf usage in CAT test selftests/resctrl: Remove requirement on cache miss rate selftests/resctrl: Raise threshold at which MBM and PMU values are compared selftests/resctrl: Increase size of buffer used in MBM and MBA tests selftests/resctrl: Support multiple events associated with iMC selftests/resctrl: Prepare for parsing multiple events per iMC selftests/resctrl: Do not store iMC counter value in counter config structure selftests/resctrl: Reduce interference from L2 occupancy during cache occupancy test selftests/resctrl: Improve accuracy of cache occupancy test docs: kselftest: Document the FORCE_TARGETS build variable |
||
|
Linus Torvalds
|
42eb3a5ef6 |
linux_kselftest-kunit-7.2-rc1
Fixes to tool and kunit core and new features to both to support JUnit XML (primitive) and backtrace suppression API: - bug/kunit: Core support for suppressing warning backtraces - kunit: tool: Parse and print the reason tests are skipped - kunit: tool: Add (primitive) support for outputting JUnit XML - kunit:tool: Don't write to stdout when it should be disabled - kunit: Add backtrace suppression self-tests - drm: Suppress intentional warning backtraces in scaling unit tests - kunit: Add documentation for warning backtrace suppression API - kunit: Fix spelling mistakes in comments and messages - gen_compile_commands: Ignore libgcc.a - kunit: qemu_configs: Add or1k / openrisc configuration -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEPZKym/RZuOCGeA/kCwJExA0NQxwFAmowHNQACgkQCwJExA0N QxxjdQ/+MibsF3MON3LIOPC2/p23zoAv+jDkw4gxYWC3L9Wh3gqsZLUuYwyGc8Xn hO9xN7PEXressO4kukveWYnNtt//aXL3gnZ6Zysbt/BCO73LPxy1IGITDFL58ZVT F12ym07VsbqQIHMXR+ANJfxCE8RuaPzdkSW635sLQAhpB5W1Fb51XXfStbLswrVN iX8XNnOYGjBES8nDiwFKPCtgwvp19XN4B51iSo3XWU8nhcrrBxrk0ToWfyQVwEA0 T87hRL81cHLH4WREw1lwEVQ+lRY5WGBwQsKB2JFmI3HaTwcHbNY8p1sa/YARspmY LFCRLZu/KLio0a4ZxaVq690JCeQ2osgBhCvF9B/sxtc90/kYM5QycpnmpdgyPBZq v0vEnFBG7nAj1epHvmt/S2z11oTpdDbkuTZIEDvW/wsI82wbB6kAkzMY30BRitSJ E+RLZxTtSIovI44BgFVFypVWRa2XMaCKL2+GGZoIJiGUwCeJZSTs1nKtnkhYuhel daHosU85uB6GFnKE1L8LVJ+Vii+iOZUXN9F4B+2vCJ+eXm/0t85yIm5zEmTpKvNu sS8c3KRIkK5kSRitKJtUpiuxUQtPaJCA/w2B9FdPx5+yHmHa+Em3JUn8ZuM1ZRem lNIy1b0gM+kJvGT8ZN1eNDSwrHrC+cJ3RI4AeBYPcJ2ECnFvTYI= =nc4g -----END PGP SIGNATURE----- Merge tag 'linux_kselftest-kunit-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest Pull kunit updates from Shuah Khan: "Fixes to tool and kunit core and new features to both to support JUnit XML (primitive) and backtrace suppression API: - Core support for suppressing warning backtraces - Parse and print the reason tests are skipped - Add (primitive) support for outputting JUnit XML - Don't write to stdout when it should be disabled - Add backtrace suppression self-tests - Suppress intentional warning backtraces in scaling unit tests - Add documentation for warning backtrace suppression API - Fix spelling mistakes in comments and messages - gen_compile_commands: Ignore libgcc.a - qemu_configs: Add or1k / openrisc configuration" * tag 'linux_kselftest-kunit-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest: kunit:tool: Don't write to stdout when it should be disabled kunit: tool: Add (primitive) support for outputting JUnit XML kunit: tool: Parse and print the reason tests are skipped kunit: Add documentation for warning backtrace suppression API drm: Suppress intentional warning backtraces in scaling unit tests kunit: Add backtrace suppression self-tests bug/kunit: Core support for suppressing warning backtraces kunit: Fix spelling mistakes in comments and messages kunit: qemu_configs: Add or1k / openrisc configuration gen_compile_commands: Ignore libgcc.a |
||
|
Linus Torvalds
|
b1cbabe84c |
- small cleanups in dm-vdo, dm-raid, dm-cache, dm-zoned-metadata
- rework of dm-ima - introduce dm-inlinecrypt - fix wrong return value in dm-ioctl - fix rcu stall when polling -----BEGIN PGP SIGNATURE----- iIoEABYIADIWIQRnH8MwLyZDhyYfesYTAyx9YGnhbQUCajAXChQcbXBhdG9ja2FA cmVkaGF0LmNvbQAKCRATAyx9YGnhbaiMAP9WzwyH3Y/cOdpdFoqqPi7IsXZisJPo rFiAVL4rOgF3kQD/RRp5dkn4iKSYovjZr3+i6a7srxIkpfDEf4kP2mOJBAk= =2jnV -----END PGP SIGNATURE----- Merge tag 'for-7.2/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm Pull device mapper updates from Mikulas Patocka: - small cleanups in dm-vdo, dm-raid, dm-cache, dm-zoned-metadata - rework of dm-ima - introduce dm-inlinecrypt - fix wrong return value in dm-ioctl - fix rcu stall when polling * tag 'for-7.2/dm-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm: dm-zoned-metadata: Use strscpy() to copy device name dm cache: make smq background work limit configurable dm-inlinecrypt: add support for hardware-wrapped keys dm: limit target bio polling to one shot dm-ioctl: report an error if a device has no table dm: add documentation for dm-inlinecrypt target dm-inlinecrypt: add target for inline block device encryption block: export blk-crypto symbols required by dm-inlinecrypt dm-ima: use active table's size if available dm-ima: Fail more gracefully in dm_ima_measure_on_* dm-ima: Handle race between rename and table swap dm-ima: Fix issues with dm_ima_measure_on_device_rename dm-ima: remove new_map from dm_ima_measure_on_device_clear dm-ima: Fix UAF errors and measuring incorrect context dm-ima: don't copy the active table to the inactive table dm-ima: Remove status_flags from dm_ima_measure_on_table_load() dm-ima: remove broken last_target_measured logic dm-ima: remove dm_ima_reset_data() dm-raid: only requeue bios when dm is suspending dm vdo: use get_random_u32() where appropriate |
||
|
Linus Torvalds
|
ba9c792c82 |
for-7.2/block-20260615
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmowCYEQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpjUvD/0YcIgniTL/BDQkEQk4+FBVOqLiyPFPhdEY
z/zxMfvRDcUx48E5t4uDHMFwytugTtymRpmkpLANUuUHHpigLPWhT1kCjzIc8OOU
534VJ2Ksay5f3i9gVBhpORmdcBokevdmt5KSqvc+it0k+DNUy1o8DJGcQqPSnRtA
C5Kk6e9QNHpOR30pNygaxtaAsx2rlyrBYw0zWUy7yeUQqI9X+0yZDLC8FUsVDVXW
fptHqQN4///4zm8DdNvTAGhGPGCAcyciXQbrJKBrH9DlZuD5XzrDBFieuhZ96H6M
jvr6eL6XlNx3qd/3x9PYsV4zyArTQZw++XLHakNMoP7Gd3ddSVutfKPLN4TZf5ij
TA4chrhMoIhrubU8LYmDHhTFFCXoRd5NCG5f6JKu7usEzBQVKNO4IJ4fJDA/efeG
iy3W1mdyAAefLS/DfH+i5foWUJbl5VXe4H/d1o8uIdgU2y8rM9d6NdSFWIHNbvc/
Dhq47AHExyWONtIpIPnRjgL9lMVqyG0KjmnPLq8hFhPRUzu5XxvxufyhEfCbWBEr
x6gWvnQlY35DmZYCLzn0FOJRIpYXy49hcJw+FS6fkMaBELhj+OQ7nbaKvCWTw91H
utTltXKvYjJwisMlzfH6/V2Gv7bE4ytRwRTU5GKQQjYIn572RUe4DPbPd3SGxm6T
mt9q2CMGbw==
=upvV
-----END PGP SIGNATURE-----
Merge tag 'for-7.2/block-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block updates from Jens Axboe:
- NVMe pull request via Keith:
- Per-controller admin and IO timeout sysfs attributes, and
letting the block layer set request timeouts (Maurizio,
Maximilian)
- Multipath passthrough iostats, and PCI P2PDMA enablement for
multipath devices (Keith, Kiran)
- A new diag sysfs attribute group exporting per-controller
counters (retries, multipath failover, error counters, requeue
and failure counts, reset and reconnect events) (Nilay)
- FDP configuration validation and bounds check fixes (liuxixin)
- Various nvmet fixes, including a pre-auth out-of-bounds read in
the Discovery Get Log Page handler, auth payload bounds
validation, and tcp error-path leak fixes (Bryam, Tianchu,
Geliang)
- nvme-tcp lockdep and workqueue fixes (Shin'ichiro, Kuniyuki,
Eric)
- Assorted other fixes and cleanups (John, Yao, Chao, Mateusz,
Achkinazi, Wentao)
- MD pull request via Yu Kuai:
- raid1/raid10 fixes for a deadlock in the read error recovery
path, error-path detection and bio accounting with cloned bios,
and an nr_pending leak in the REQ_ATOMIC bad-block error path
(Abd-Alrhman)
- PCI P2PDMA propagation from member devices to the RAID device
(Kiran)
- dm-raid bio requeue fix, and various smaller fixes and cleanups
(Benjamin, Chen, Li, Thorsten)
- Enable Clang lock context analysis for the block layer, with the
accompanying annotations across queue limits, the blk_holder_ops
callbacks, crypto, cgroup, iocost, kyber and mq-deadline (Bart)
- Block status code infrastructure work: a tagged status table, a
str_to_blk_op() helper, a bio_endio_status() helper, and on top of
that a new configurable block-layer error injection facility
(Christoph)
- DRBD netlink rework, replacing the genl_magic machinery with explicit
netlink serialization and moving the DRBD UAPI headers to
include/uapi/linux/ (Christoph Böhmwalder)
- bvec improvements: a bvec_folio() helper and making the bvec_iter
helpers proper inline functions (Willy, Christoph)
- ublk cleanups and a canceling-flag fix for the disk-not-allocated
case (Caleb, Ming)
- Partition handling fixes: bound the AIX pp_count scan, fix an of_node
refcount leak, and replace __get_free_page() with kmalloc() (Bryam,
Wentao, Mike)
- Convert numa_node to int in blk_mq_hw_ctx and ->init_request, and add
WQ_PERCPU to the block workqueue users (Mateusz, Marco)
- Block statistics and tracing: propagate in-flight to the whole disk
on partition IO, export passthrough stats, and a new
block_rq_tag_wait tracepoint (Tang, Keith, Aaron)
- A round of removals, unexports and cleanups across bio, direct-io and
the bvec helpers (Christoph)
- Various driver fixes (mtip32xx use-after-free, rbd snap_count
validation and strscpy conversion, nbd socket lockdep reclassify,
virtio-blk zone report clamp, floppy) and a batch of MAINTAINERS
email/list updates (Coly, Li, Yu, Christoph Böhmwalder)
- Other little fixes and cleanups all over
* tag 'for-7.2/block-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (117 commits)
MAINTAINERS: Update Coly Li's email address
block: check bio split for unaligned bvec
nbd: Reclassify sockets to avoid lockdep circular dependency
block: add configurable error injection
block: add a str_to_blk_op helper
block: add a "tag" for block status codes
block: add a macro to initialize the status table
floppy: Drop unused pnp driver data
block: propagate in_flight to whole disk on partition I/O
virtio-blk: clamp zone report to the report buffer capacity
block: optimize I/O merge hot path with unlikely() hints
drivers/block/rbd: Use strscpy() to copy strings into arrays
partitions: aix: bound the pp_count scan to the ppe array
block: Enable lock context analysis
block/mq-deadline: Make the lock context annotations compatible with Clang
block/Kyber: Make the lock context annotations compatible with Clang
block/blk-mq-debugfs: Improve lock context annotations
block/blk-iocost: Inline iocg_lock() and iocg_unlock()
block/blk-iocost: Split ioc_rqos_throttle()
block/crypto: Annotate the crypto functions
...
|
||
|
Linus Torvalds
|
9b40ba14ed |
for-7.2/io_uring-20260615
-----BEGIN PGP SIGNATURE----- iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmowCCYQHGF4Ym9lQGtl cm5lbC5kawAKCRD301j7KXHgprbuEACf4MxZZvzd1Be5Fneo4ghy0IjJ0s8j67yo hERtfO0TPCFPvFi+cWmSQo/YTIhi62Z1nFro3Cr9opTF38NypbN2kB642KOaQPse f1LVQDg1p5MIj2bMGgBQsYeLlGipRwm/vLN7qX+Dfv6jL4Yq7KuIEtxkBr2UJefY FUEhW5xm45DgRriyZSn+Gn39yLB4XGL8pEntqrSMlrTw3fI8ZzyIw5w6e8Kgn/ES upVo8oxnrUSlPrGrfH2Eu42sFixWko9QULwASNgXsIT3yBRZbYYyBjXmWAQGER6k D3Nn5Zt/UogyMg6BLb/S2dgCnFn2VPKPD8l//4IPQrAAhPdtWpxaTjQUXq0c2w4M IaGD1EQDYw/VBc6jjRPAuqwEmKZmTXZirfXamvF4Y2MtSz0b84LulaeqqwGvmtUT Z2pOaIZBffJ1E//B4FpiG1xuwHpchc3F6esP7FyhyRlWGP93WR3ADo2em7/jKxEi IOFjXHAOO70C1wpdOgAxToRggc4GV16RAx+v4/GFRUI1m6okuxiwTxle6Ig+H4eR zFXBvroz7PDDaiqbyGk5kIQfOVhwmPnp9EZUUJIf4h9lIPgwJAjb4yLwcF8ySXyg x8C+Vp4DP1r0xccZLkkElIzOmmeR4bUaBeyFY33pT83WchnU1NxusBpEVpRL1FPf YR8Icz8F1A== =pkmg -----END PGP SIGNATURE----- Merge tag 'for-7.2/io_uring-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux Pull io_uring updates from Jens Axboe: - Rework the task_work infrastructure. Both the local (DEFER_TASKRUN) and the normal (tctx) task_work lists were llist based, which is LIFO ordered, and hence each run had to do an O(n) list reversal pass first to restore queue order. Additionally, to cap the amount of task_work run, each method needed a retry list as well. Add a lockless MPCS FIFO queue (based on Dmitry Vyukov's intrusive MPSC algorithm) and switch both task_work lists to it. It performs better than llists and we can then also ditch the retry lists as well as entries are popped one-at-the-time. On top of those changes, run the tctx fallback task_work directly and remove the now-unused per-ctx fallback machinery entirely. - zcrx user notifications. Add a mechanism for zcrx to communicate conditions back to userspace via a dedicated CQE, with the initial users being notification on running out of buffers and on a frag copy fallback, plus shared-memory notification statistics. Alongside that, a series of zcrx reliability and cleanup fixes: more reliable scrubbing, poisoning pointers on unregistration, dropping an extra ifq close, adding a ctx back-pointer, reordering fd allocation in the export path, and killing a dead 'sock' member. - Allow using io_uring registered buffers for plain SEND and RECV, not just for the zero-copy send path. This enables targets like ublk's NBD backend to push/pull IO data directly to/from a registered buffer over a plain send/recv on a TCP socket. - Registered buffer improvements: account huge pages correctly, bump the io_mapped_ubuf length field to size_t, and raise the previous 1GB registered buffer size limit. - Restrict the ctx access exposed to io_uring BPF struct_ops programs by handing them an opaque type rather than the full io_ring_ctx, and add a separate MAINTAINERS entry for the bpf-ops code. - Allow opcode filtering on IORING_OP_CONNECT. - Validate ring-provided buffer addresses with access_ok(), and align the legacy buffer add limit with MAX_BIDS_PER_BGID. - Various other cleanups and minor fixes, including avoiding msghdr async data on connect/bind, dropping async_size for OP_LISTEN, making the POLL_FIRST receive side checks consistent, re-checking IO_WQ_BIT_EXIT for each linked work item, and using trace_call__##name() at guarded tracepoint call sites. * tag 'for-7.2/io_uring-20260615' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (31 commits) io_uring/bpf-ops: add a separate maintainer entry io_uring/net: make POLL_FIRST receive side checks consistent io_uring: remove the per-ctx fallback task_work machinery io_uring: run the tctx task_work fallback directly io_uring: switch normal task_work to a mpscq io_uring: switch local task_work to a mpscq io_uring/mpscq: add lockless multi-producer, single-consumer FIFO queue io_uring: grab RCU read lock marking task run io_uring/zcrx: kill dead 'sock' member in struct io_zcrx_args io_uring/kbuf: validate ring provided buffer addresses with access_ok() io_uring/net: support registered buffer for plain send and recv io_uring/nop: Drop a wrong comment in struct io_nop io_uring/net: Remove async_size for OP_LISTEN io_uring/net: Avoid msghdr on op_connect/op_bind async data io_uring/bpf-ops: restrict ctx access to BPF io_uring/io-wq: re-check IO_WQ_BIT_EXIT for each linked work item io_uring/kbuf: align legacy buffer add limit with MAX_BIDS_PER_BGID io_uring/zcrx: add shared-memory notification statistics io_uring/zcrx: notify user on frag copy fallback io_uring/zcrx: notify user when out of buffers ... |
||
|
Linus Torvalds
|
d29fd593e6 |
hfs/hfsplus updates for v7.2
- hfs: rework hfsplus_readdir() logic
- hfs: disable the updating of file access times (atime)
- hfs: fix incorrect inode ID assignment in hfs_new_inode()
- hfsplus: rework hfsplus_readdir() logic
- hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
- hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
- hfsplus: Add a sanity check for btree node size
- hfsplus: fix issue of direct writes beyond end-of-file
- hfs/hfxplus: use kzalloc_flex()
- hfsplus: Remove the duplicate attr inode dirty marking action
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQT4wVoLCG92poNnMFAhI4xTh21NnQUCai948AAKCRAhI4xTh21N
nRpsAP9w+yaRu3llG6VUMnKBtBOVkWkVO2SPVn4DGiNPIq+f3QEAzJguenZ6dn8N
/Yjznl4uwgZA1u86SM81mM8tLyICLwU=
=RwOP
-----END PGP SIGNATURE-----
Merge tag 'hfs-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs
Pull hfs/hfsplus updates from Viacheslav Dubeyko:
"Several fixes in HFS/HFS+ of syzbot reported issues and HFS//HFS+
fixes of xfstests failures.
- fix a null-ptr-deref issue reported by syzbot (Edward Adam Davis)
If the attributes file is not loaded during system mount
hfsplus_create_attributes_file can dereference a NULL pointer.
Also, add a b-tree node size check in hfs_btree_open() with the
goal to prevent an uninit-value bug reported by syzbot for the case
of corrupted HFS+ image.
- fix __hfs_bnode_create() by using kzalloc_flex() instead of
kzalloc() (Rosen Penev)
- fix early return in hfs_bnode_read() (Tristan Madani)
hfs_bnode_read() can return early without writing to the output
buffer when is_bnode_offset_valid() fails or when
check_and_correct_requested_ length() corrects the length to zero.
Callers such as hfs_bnode_read_ u16() and hfs_bnode_read_u8() pass
stack-allocated buffers and use the result unconditionally, leading
to KMSAN uninit-value reports.
The rest fix (1) generic/637, generic/729 issue for the case of HFS+
file system, (2) generic/003, generic/637 for the case of HFS file
system"
* tag 'hfs-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/hfs:
hfs: rework hfsplus_readdir() logic
hfs: disable the updating of file access times (atime)
hfs: fix incorrect inode ID assignment in hfs_new_inode()
hfsplus: rework hfsplus_readdir() logic
hfs/hfsplus: zero-initialize buffer in hfs_bnode_read
hfs/hfsplus: fix u32 overflow in check_and_correct_requested_length
hfsplus: Add a sanity check for btree node size
hfsplus: fix issue of direct writes beyond end-of-file
hfs/hfxplus: use kzalloc_flex()
hfsplus: Remove the duplicate attr inode dirty marking action
|
||
|
Linus Torvalds
|
6f60a6033c |
nilfs2 updates for v7.2
- nilfs2: Fix return in nilfs_mkdir
- nilfs2: fix backing_dev_info reference leak
- nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQT4wVoLCG92poNnMFAhI4xTh21NnQUCai99EgAKCRAhI4xTh21N
nbR2APwJtTMFdg9c4fdCcDauoP2uvDhG08/DfQBhMHBlqbWuBQEAw0f7gLJ6EJQG
7pZ7g2/SEdK/Obm3fzoemteACklYPgg=
=22JG
-----END PGP SIGNATURE-----
Merge tag 'nilfs2-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/nilfs2
Pull nilfs2 updates from Viacheslav Dubeyko:
"Fixes of syzbot reported issue and various small fixes in NILFS2
functionality.
- fix hung task in nilfs_transaction_begin() (Deepanshu Kartikey)
Reported by syzbot. The root cause is that user-supplied segment
numbers were not validated before nilfs_clean_segments() began
doing work; the range check on each segnum was performed deep
inside the call chain by nilfs_sufile_updatev(), which emits a
nilfs_warn() per invalid entry while still holding the segctor lock
and the sufile mi_sem.
Fix it by validating the contents of kbufs[4] in
nilfs_clean_segments() immediately after acquiring ns_segctor_sem
via nilfs_transaction_lock().
- fix a smatch warning in nilfs_mkdir() warn (Hongling Zeng)
This corrects a semantic issue related to the use of the
ERR_PTR macro that arose from a recent VFS change.
- fix a backing_dev_info reference leak (Shuangpeng Bai)
setup_bdev_super() initializes sb->s_bdev and takes a reference on
the block device backing_dev_info when assigning sb->s_bdi.
nilfs_fill_super() takes another reference to the same
backing_dev_info and stores it in sb->s_bdi again. The extra
reference is not paired with a matching bdi_put(), since
generic_shutdown_super() releases sb->s_bdi only once.
Drop the redundant bdi_get() in nilfs_fill_super(). The single
reference taken by setup_bdev_super() is enough and is released
during superblock shutdown"
* tag 'nilfs2-v7.2-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/vdubeyko/nilfs2:
nilfs2: Fix return in nilfs_mkdir
nilfs2: fix backing_dev_info reference leak
nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers
|
||
|
Linus Torvalds
|
31b706da2c |
for-7.2-tag
-----BEGIN PGP SIGNATURE-----
iQJPBAABCgA5FiEE8rQSAMVO+zA4DBdWxWXV+ddtWDsFAmowa8obFIAAAAAABAAO
bWFudTIsMi41KzEuMTIsMiwyAAoJEMVl1fnXbVg76+gP/3Cxtz9IrW3bQTSzU5sd
2j8sgl7+SWsEqWrVofVUe2QfiiLgmoWLgwWPUvnAsPxLP9nzXzrPdFgN/NcZI9Bn
nYWdkHFt8p+Tp9c5hevhZC8U+Sz0bPr8C9Q77SYpiG7dncB6WzeG9DzH0qSoiEkw
BROVM9/C2ICnZw913y+KIYJyB0vhLsms2hGsAp/a4Kln0oFjis1mUiQUFdg67mWQ
oBC3qz+LvGdt8L6qmNJWCiekps2hKVKfKW1I5qnPElQcr8YcOdvUqWJ4VnoRpc06
KRtEY8tNLsD1BlXLVZgdRAM9T4ySHePv0DTIO5CNkiP7/sibIqYYow0O5aWMjO6f
dbLaZPsElFvnwObw1BbSiSK235KxyPrVj0xswWN63bbYQ9jHE65slt84rroz/GWa
o9pahM9y0h3PALYe9HPBZFcVuXs6sN7feOMorCDAIcTboUpZIGfNeZK+RQZYcOga
AlsSZJ3gs+k03ZmLAqIH4eSK2TpKeOyLh3nkqvEofaeQxzkV+sYBxIMq1EUmleRm
luAMqYlFmchc1SAelQjtAtOfGLAu3drcZPyuY48uq4X2oUpVanvgbP2iANqp/iQN
ggHJUXMFGS6Y4Ikc6Uuf4m+mKFVKMaHDgeXOTp2tqo+CBCgKdLWhtWYIcjRhkj8K
5in3OwbhMpLqJBJD9PSyJo0h
=fX+v
-----END PGP SIGNATURE-----
Merge tag 'for-7.2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux
Pull btrfs updates from David Sterba:
"The most noticeable change is to enable large folios by default, it's
been in testing for a few releases. Related to that is huge folio
support (still under experimental config). Otherwise a few ioctl
updates, performance improvements and usual fixes and core changes.
User visible changes:
- enable large folios by default, added in 6.17 (under experimental
build), no feature limitations, a big change internally
- new ioctl to return raw checksums to userspace (a bit tricky given
compression and tail extents), can be used for mkfs and
deduplication optimizations
- provide stable UUID for e.g. overlayfs and temp_fsid, also
reflected in statvfs() field f_fsid, internal dev_t is hashed in to
allow cloning
- add 32bit compat version of GET_SUBVOL_INFO ioctl
- in experimental build, support huge folios (up to 2M)
Performance related improvements/changes:
- limit bio size to the estimated optimum derived from the queue,
this prevents build up of too much data for writeback, which could
cause latency spikes (reported improvement 15% on sequential
writes)
- don't force direct IO to be serialized, forgotten change during
mount API port, brings back +60% of throughput
- lockless calculation of number of shrinkable extent maps, improve
performance with many memcg allocated objects
Notable fixes:
- in zoned mode, fix a deadlock due to zone reclaim and relocation
when space needs to be flushed
- don't trim device which is internally not tracked as writeable
(e.g. when missing device is being rescanned)
- fix deadlock when cloning inline extent and mounted with
flushoncommit
- fix false IO failures after direct IO falls back to buffered write
in some cases
Core:
- remove COW fixup mechanism completely; detect and fix changes to
pages outside of filesystem tracking, guaranteed since 5.8, grace
period is over
- remove 2K block size support, experimental to test subpage code on
x86_64 but now it would block folio changes
- tree-checker improvements of:
- free-space cache and tree items
- root reference and backref items
- extent state exceptions in reloc tree
- subpage mode updates:
- code optimizations, simplify tracking bitmaps
- re-enable readahead of compressed extent
- extend bitmap size to cover huge folios
- add tracepoints related to sync, tree-log and transactions
- device stats item tracking unification, remove item if there are no
stats recorded, also don't leave stale stats on replaced device
- allow extent buffer pages to be allocated as movable, to help page
migration
- added checks for proper extent buffer release
- btrfs.ko code size reduction due to transaction abort call
simplifications
- several struct size reductions
- more auto free conversions
- more verbose assertions"
* tag 'for-7.2-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux: (130 commits)
btrfs: fix use-after-free after relocation failure with concurrent COW
btrfs: move WARN_ON on unexpected error in __add_tree_block()
btrfs: move locking into btrfs_get_reloc_bg_bytenr()
btrfs: lzo: reject compressed segment that overflows the compressed input
btrfs: retry faulting in the pages after a zero sized short direct write
btrfs: fix incorrect buffered IO fallback for append direct writes
btrfs: fix false IO failure after falling back to buffered write
btrfs: use verbose assertions in backref.c
btrfs: print a message when a missing device re-appears
btrfs: do not trim a device which is not writeable
btrfs: return real error after lookup failure in btrfs_ioctl_default_subvol()
btrfs: use mapping shared locking for reading super block
btrfs: use lockless read in nr_cached_objects shrinker callback
btrfs: switch local indicator variables to bools
btrfs: send: pass bool for pending_move and refs_processed parameters
btrfs: use shifts for sectorsize and nodesize
btrfs: fix deadlock cloning inline extent when using flushoncommit
btrfs: allocate eb-attached btree pages as movable
btrfs: add 32-bit compat ioctl for BTRFS_IOC_GET_SUBVOL_INFO
btrfs: derive f_fsid from on-disk fsid and dev_t
...
|
||
|
Linus Torvalds
|
477c122f8c |
dlm for 7.2
There are four fixes/cleanups in this series; none are likely to be issues in real usage: - improve debugfs error exit path - fix sequence number ordering in an artificial test case - fix usercopy_abort for lvb data - use hlist_for_each_entry_srcu for srcu lists -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEcGkeEvkvjdvlR90nOBtzx/yAaaoFAmowKlsACgkQOBtzx/yA aap6Kw//Zee3ZGEYREY6W71NdBd+P8cp86ej8kuL2maqGg74r57bXCbz9CZUm7wH pIZ7OhjYztYpgQjrtCqOgJ/KTkgpyA1OxNI5p1XeCIjiXsAVnBiW3Pay6ZDV6yQP ZPINZ4Ei3UOqQ90EMIbwO8J1ola+6qrd4Ojo4bzXaMN8c+Mf81ioclKPv76ldGaw H+rjTCL9o382ExF/3Xf4jPpMkq5z6FJj4nykv1UznweYEmFw3e1BeqtPBQArV9nh /aAEXuhDSJjBdmiAEzBbQLGnUZAeQ7+lIGHMLQ1+unVU7B5i1PnFw/A3nT9X/x3W tYdq95jo20nXBH8fAItiDYbLyd+RcOJvmaMoaqR/jnZaiZ9zSKrvPEjXD+Yg6xtx HH8AwQSqkdnBw8t2PcysrOXkQWpXaWJeNY+TkU0GlFnfJpj2RewnFRj9uzRFthGQ pxRV9rFtEX7dYuVqPiuUWtS4667XhFJRu2w1YEyJvgCRjhl5ADvKuRARh484RKu3 OlWEpgEmW00BHtpuZYhPS2oGvmhDGl9Q3+1lmeySOAhODAQw8QQEnnIVQcxaXvUI 747E+J6qHlYBV6SHHt/RjZSAi5ViUyx6rZx9vPJNpt7VQPZzKxjGoTnr1DB7lDij WzT29aWd2rZTPxYhBfwl918cscvV6cphgFh8Wvqvaf3q8hDUjEw= =E+94 -----END PGP SIGNATURE----- Merge tag 'dlm-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm Pull dlm updates from David Teigland: "There are four fixes/cleanups in this series; none are likely to be issues in real usage: - improve debugfs error exit path - fix sequence number ordering in an artificial test case - fix usercopy_abort for lvb data - use hlist_for_each_entry_srcu for srcu lists" * tag 'dlm-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/linux-dlm: dlm: init per node debugfs before add to node hash dlm: fix add msg handle in send_queue ordered dlm: add usercopy whitelist to dlm_cb cache dlm: use hlist_for_each_entry_srcu for SRCU protected lists |
||
|
Linus Torvalds
|
974b3dec2b |
\n
-----BEGIN PGP SIGNATURE----- iQEzBAABCAAdFiEEq1nRK9aeMoq1VSgcnJ2qBz9kQNkFAmowEJkACgkQnJ2qBz9k QNldRAgA43CA40WfTnE8vqivu1Uxsy/sJdbCWntxfBe3IRH3dEJoMjQokvHAe9Qy CZSAzZELN66kHRVEYFZfQqoxXJTw1dhVUSfYCtuy0TOz8+/je6yaqXa8a79q/v3X yw+x5WVRaDBHZrUKycEYZ6UxH0XaUpJxNBikPMR4ycza9LlEQ77WnH98JkYm7Zzu OtUn/CysvAu6ATJcuo3LBmmbad0qs6htJgw1NxZXBaiFdQSroYoCZBohAHnlFZb5 wKm7fHIC56s0lHUVsOhQQyDjRKwdWftIzxI1HaBls1Kwodb9IKqifkPE12NF0fVH ctSn2iu70CpcaLwRCnmng+QwEupH2g== =I+DW -----END PGP SIGNATURE----- Merge tag 'fs_for_v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull udf, isofs, ext2, and quota updates from Jan Kara: - Assorted udf & isofs fixes for maliciously formatted devices - Cleanups to use kmalloc() instead of __get_free_page() - Removal of deprecated DAX code from ext2 * tag 'fs_for_v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: udf: validate VAT inode size for old VAT format udf: validate VAT header length against the VAT inode size udf: validate sparing table length as an entry count, not a byte count isofs: bound Rock Ridge symlink components to the SL record ext2: fix ignored return value of generic_write_sync() ext2: Remove deprecated DAX support isofs: replace __get_free_page() with kmalloc() quota: allocate dquot_hash with kmalloc() udf: validate free block extents against the partition length |
||
|
Linus Torvalds
|
59b1c2aa06 |
\n
-----BEGIN PGP SIGNATURE----- iQEzBAABCAAdFiEEq1nRK9aeMoq1VSgcnJ2qBz9kQNkFAmowEBIACgkQnJ2qBz9k QNlnFgf/XRSbY/410/TVuhxeFr23A3OUKXkJBslflsa0tvS4W8by0z9z546cJFhi Lm1HXXIvHHtB5//WxH0EDGCpRctgdX8tdNOfEQ+8RLs0rjZjKJbvsPZBhVM6u3tf 53Rsgz0d8887DTxPJIsb9Ul++0YgjPU1KrsvLizQc7hmNS8zGeDjuw3lx5DcVlKt fIQjB33c6C79PyYJQrZqVswrz4VkThrDU0oP3RUNF3k/uZAiH0C+d8sABQ9A5eSw qhqSD9Af9VA+EK+Fvp4qIHPVBvuIGINTjlWgsqGKjTRXm1QysS2eKK7mKP6lWE5M +2gP6iqPxON8QVRVNq0YWuOgm8lORg== =vZm7 -----END PGP SIGNATURE----- Merge tag 'fsnotify_for_v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs Pull fsnotify updates from Jan Kara: - fanotify improvements for pidfd reporting - small cleanup in fanotify_error_event_equal * tag 'fsnotify_for_v7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs: fanotify: allow reporting pidfds for reaped tasks fanotify: report thread pidfds for FAN_REPORT_TID fanotify: simplify fanotify_error_event_equal |
||
|
Linus Torvalds
|
6271f6ea7f |
xfs: new code for Linux 7.2
Signed-off-by: Carlos Maiolino <cem@kernel.org> -----BEGIN PGP SIGNATURE----- iJUEABMJAB0WIQSmtYVZ/MfVMGUq1GNcsMJ8RxYuYwUCai/ATAAKCRBcsMJ8RxYu YwizAX9pr/FDF4FJEob18Juys/r+VvptqdJxx/e2igubyOzhz0MrDHSbzfF8Z1d2 lY4oa9EBgKrLjV/v+erpxxg9+i3Dqya/QvsHAzm/7k/fbA3udeiop71PlqRKF1SD clzkim/DSg== =qpVD -----END PGP SIGNATURE----- Merge tag 'xfs-merge-7.2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux Pull xfs updates from Carlos Maiolino: "The main highlight is the removal of experimental tag of the zone allocator feature. Besides that, this contains a collection of bug fixes and code refactoring but no new features have been added" * tag 'xfs-merge-7.2' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux: (29 commits) xfs: shut down the filesystem on a failed mount xfs: skip inode inactivation on a shut down mount xfs: move XFS_LSN_CMP to xfs_log_format.h xfs: shut down zoned file systems on writeback errors xfs: cleanup xfs_growfs_compute_deltas xfs: pass back updated nb from xfs_growfs_compute_deltas xfs: fix pointer arithmetic error on 32-bit systems xfs: initialize iomap->flags earlier in xfs_bmbt_to_iomap xfs: only log freed extents for the current RTG in zoned growfs xfs: add newly added RTGs to the free pool in growfs xfs: factor out a xfs_zone_mark_free helper xfs: mark struct xfs_imap as __packed xfs: store an agbno in struct xfs_imap xfs: massage xfs_imap_to_bp into xfs_read_icluster xfs: remove im_len field in struct xfs_imap xfs: cleanup xfs_imap xfs: remove the call to xfs_buf_reverify in xfs_trans_read_buf_map xfs: remove the i_ino field in struct xfs_inode xfs: remove xfs_setup_existing_inode xfs: convert xchk_inode_xref_set_corrupt to xchk_ip_xref_set_corrupt ... |