mirror of
https://github.com/torvalds/linux.git
synced 2026-11-07 06:17:02 +01:00
v7.4-rc1
8468 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
Linus Torvalds
|
0c8bf38058 |
vfs-7.4-rc1.fixes
Please consider pulling these changes from the signed vfs-7.4-rc1.fixes tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCauTJqQAKCRCRxhvAZXjc
okLyAP0bHWHQ8CIbegVzZbMVssaMJl1KiqxfkGbS6Nk/j1StkwEA5+UGbFnQ2qG6
uxDILfnlsd834jlOlOauzaSpbAJgwQk=
=uPnP
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.4-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull vfs fixes from Christian Brauner:
- writeback:
- Update dirtied_when instead of dirtied_time_when when a wb switch
puts an inode at the newest end of the target b_dirty list. The
list was left out of order so move_expired_inodes() could stop
before older inodes, and the lazytime expiration timestamp was
reset
- Clear the old wb's dirty-I/O state and bandwidth contribution when
a batch of inode switches leaves its dirty lists empty. An empty
wb stayed scheduled for periodic writeback and inflated
bdi->tot_write_bandwidth
- Take wb_switch_rwsem across the inode scan of
cleanup_offline_cgwb(). The v7.3-rc5 fix that rotates scanned
inodes let a scan racing a sync()'s queue_io() move lazytime
inodes past the sync's cutoff, so sync() returned without
persisting their timestamps
- Don't kick writeback for an IOCB_DONTCACHE write on an inode that
has no wb yet. With cgroup writeback an O_DIRECT RWF_DONTCACHE
write to a block device dereferenced NULL
- statmount/listmount/listns:
- Refuse statmount() string requests with a buffer that isn't larger
than struct statmount
- Don't wrap around with a U64_MAX cursor in listmount() and
listns()
- Don't end listns() at an inactive namespace
- Only add init_ipc_ns and init_net to the namespace trees if
CONFIG_IPC_NS and CONFIG_NET_NS are enabled
- iomap:
- Only mark blocks uptodate in __iomap_write_begin() after reading
them and let __iomap_write_end() mark the zeroed blocks uptodate
once the copy from userspace succeeded
- Check a chunk against max_integrity_io_size() on its own before
the bio size check
- Only enforce block alignment for direct I/O into holes and
unwritten extents if IOMAP_DIO_FSBLOCK_ALIGNED is set
- backing-file:
- Check S_APPEND and S_IMMUTABLE on the backing inode. FUSE
passthrough opens the backing file with vfs_open() which skips
may_open(), so anyone who may open the FUSE file for writing could
overwrite an append-only backing file anywhere or write to an
immutable one. Open, mmap and writes now check the backing inode
the way may_open() and do_mmap() do
- Always call kiocb_end_write() for a queued write
- Let backing files inherit FMODE_NONOTIFY from the user file. The
event fds fanotify creates for permission events on a stacked
filesystem raised FS_OPEN_PERM on the real path from inside the
listener's read() and deadlocked listeners with marks on both
layers
- pidfs:
- Look the task up before checking for exit information in
PIDFD_GET_INFO and start over if the task no longer owns the pid
once all fields have been read. A caller racing release_task() got
neither PIDFD_INFO_PID nor PIDFD_INFO_EXIT or ESRCH although the
exit information was available, and a caller racing a sub-thread's
exec reported that thread's tid as the pid
- Clear the mask bits of fields that lie beyond the struct size the
caller passed. The uapi header promises that the mask names no
such field but a caller passing PIDFD_INFO_SIZE_VER0 got the
coredump and supported mask bits set for fields that were never
written
- aio:
- Give the aio ring a ->read_folio that fails with EIO so a fault on
a ring whose file was truncated gets SIGBUS instead of jumping to
NULL
- Check nr_events against the ring size before doubling it in
ioctx_alloc()
- splice:
- Only write back an implicit file position in do_splice() when the
splice helper succeeded. splice doesn't take f_pos_lock so a
failed splice restored a stale snapshot over a position that a
concurrent getdents() had moved. On ext2 the next readdir then
trusted an offset inside a directory entry
- Retry tee() when the input pipe was emptied or the output pipe
filled between the prep steps and link_pipe() instead of returning
0 while the input pipe still has writers, as splice_pipe_to_pipe()
does
- ucount:
- Take the reference that pins a ucounts level on the 0 -> 1
transition before checking the rlimit
- Read the parent ucounts before dropping the rlimit count in
do_dec_rlimit_put_ucounts()
- inode:
- Rotate inodes whose page cache couldn't be dropped to the tail of
the LRU
- Skip inodes that another LRU walker is isolating
- setns:
- Set nsset->flags before anything in prepare_nsset() can fail so
the error path drops the cred prepared for CLONE_NEWUSER. A
failing setns() with CLONE_NEWUSER and CLONE_NEWNS leaked it
together with its user namespace
- Refuse setns(CLONE_NEWNS) for a task that shares its fs_struct
again when more namespaces are requested
- minix:
- Restore uptodate on the pinned bitmap buffers before redirtying
them after a failed writeback instead of tripping the warning in
mark_buffer_dirty(), as ext2 and ext4 do for their superblock
buffers
- Reject rmdir() of a directory with a corrupted link count with
EFSCORRUPTED instead of hitting the drop_nlink() warning
- userns: Keep the exec securebits and their locks when creating or
joining a user namespace. set_cred_user_ns() reset all securebits to
SECUREBITS_DEFAULT so anyone who may create a user namespace could
shed SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE with
a single unshare(CLONE_NEWUSER)
- fs: Honor FOP_UNSIGNED_OFFSET in sys_llseek() and in the pread64(),
pwrite64(), preadv() and pwritev() wrappers
- proc/kcore: Advance the vmalloc retry in read_kcore_iter() by the
last vread_iter() copy instead of the running total
- eventpoll: Return the error when the wakeup source for EPOLLWAKEUP
can't be created in EPOLL_CTL_MOD instead of reporting success
without suspend protection
- coredump: Mark do_coredump() noinline_for_stack
- nsfs: Check the trailing bytes of a namespace file handle in bytes
instead of words
- netfs: Restore the per-level and per-point decoding of the debug mask
- exportfs: Release the directory file get_name() opened with
__fput_sync(). From nfsd's kernel threads the deferred fputs arrived
faster than delayed_fput retired them and each pinned the directory's
readdir state, growing unreclaimable slab by about 90 MB per second
under a parallel tree walk
- fs: Call ramfs_kill_sb() for a ramfs rootfs. Since rootfs can be
unmounted as of v7.0 its struct ramfs_fs_info was leaked
- signal: Check the blocked mask for every entry
dequeue_synchronous_signal() looks at. The scan could select a
blocked synchronous signal and deliver it while blocked
- super: Convert the superblock device table from an rhltable to a
plain hashtable under a spinlock. This fixes a bug from v7.3 where
fs_bdev_freeze() froze a btrfs filesystem through a stale member that
open_ctree() had already released while the freeze was waiting for
SB_BORN
- fork: Leave rcu_users at zero until copy_process() can't fail
anymore. bpf_task_acquire() handed out trusted references to the new
task from the task_alloc LSM hook and sched_ext's ops.init_task() and
a failing fork freed the task behind them
- xattr: Always run cap_convert_nscap() for a security.capability
write. A zero-length setxattr() skipped it and let an unprivileged
caller without CAP_SETFCAP or write permission on the file plant an
empty security.capability xattr that made every execve() of the
binary fail with EINVAL
- namei: Skip the S_ISDIR assertion in
- proc: Refuse to mount on entries below /proc/<pid>/net like fd/,
fdinfo/ and map_files/. proc_net_d_revalidate() always fails so the
first lookup by anyone with search permission ran d_invalidate() on
the dentry and detached every mount on it, locked mounts included
- libfs: Hold one mount reference for all pins instead of one per pin.
The pin count is what keeps the mount alive, so the per-pin reference
only cost a mntget() and a mntput() through
mntput_no_expire_slowpath() for every debugfs, tracefs, securityfs or
configfs file that comes and goes
- iov_iter: Return 0 from iov_iter_alignment() for an empty iterator of
any type
- watch_queue: Give info_id its own storage instead of overlaying it
with rcu_head
- filelock: Take an active superblock reference while waiting for a
delegation break. After a lazy umount closing the delegation holder
could shut down the superblock under the waiter whose final iput()
then ran shmem_evict_inode() on freed state
- fs: Skip the copy_file_range() write limit checks when there is no
data to copy
- bpf: Allow bpf_d_path() from fentry on filp_close_sync(). Since
close_range() became synchronous this cycle close(), close_range()
and the closes on exec and exit no longer go through filp_close().
fexit stays rejected since the file may be gone by then
- fs_pin: Dequeue the wait entry unconditionally in pin_kill(). A
spuriously woken waiter kept its on-stack entry queued, took that as
proof that the pin was alive and used the freed acct structure when
umount() of the accounting file raced acct(2)
- dcache: Don't fail __d_obtain_alias() for an inode without links and
aliases. The ESTALE check added this cycle broke open_by_handle_at()
and nfsd file handle decoding on NFS and FUSE where i_nlink is just
what the server last reported and the handle may well still be valid
- selftests/ovl: Fix the mountinfo expectations of the detached layer
test which has failed since it was added
* tag 'vfs-7.4-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (60 commits)
fs: don't fail __d_obtain_alias() for unlinked inodes
ns: don't add init_ipc_ns and init_net without namespace support
aio: avoid request count overflow in ioctx_alloc()
selftests/ovl: fix detached layer mountinfo expectations
bpf: Allow bpf_d_path() from filp_close_sync()
fs: skip copy_file_range write limits when there is no data
minix: reject rmdir of a directory with a corrupted link count
fs_pin: do not trust the pin after a spurious wakeup in pin_kill()
ucount: read the parent ucounts before dropping the rlimit count
splice: retry tee() instead of returning 0 when it races
selftests/pidfd: test that fields beyond the struct size are not reported
pidfs: do not report fields that do not fit into the caller's struct
fs: let backing files inherit FMODE_NONOTIFY from the user file
splice: avoid stale f_pos writeback on error
backing-file: always end a queued write
filelock: keep superblock active through delegation wait
watch_queue: keep info_id separate from rcu_head
iomap: only follow dio alignment requirement if specified
iov_iter: fix NULL deref in iov_iter_alignment()
backing-file: enforce append-only and immutable backing inodes
...
|
||
|
Linus Torvalds
|
bd5c762ac0 |
SCSI misc on 20261030
A couple of late arriving driver updates (lpfc, ufs) with the main addition being the lock context analysis update where clang static analysis coupled with annotations are used to verify driver guarantees about locks and warn on compile if they're inconsistent; this is mostly annotations with only a few code changes (except in scsi_debug which needed a fairly big rework to validate with locking context analysis). Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com> -----BEGIN PGP SIGNATURE----- iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCauSsWRsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy c2hpcC5jb20ACgkQ50LJTO6YrIXIiQEA+T3Z1h+iPnPIubkkTA3xkQFjg1NRu/y4 uFYUyGuU3xIA/2e+Ab//YshYrEAwfea8Ft5NDyYTUqoRZMnpuc1qlxqF =Nulr -----END PGP SIGNATURE----- Merge tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull more SCSI updates from James Bottomley: "A couple of late arriving driver updates (lpfc, ufs) with the main addition being the lock context analysis update where clang static analysis coupled with annotations are used to verify driver guarantees about locks and warn on compile if they're inconsistent. This is mostly annotations with only a few code changes (except in scsi_debug which needed a fairly big rework to validate with locking context analysis)" * tag 'scsi-misc' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: (103 commits) scsi: ufs: core: Do not release a reserved request in ufshcd_abort() scsi: ufs: core: Remove completed-without-interrupt path in ufshcd_abort() scsi: ufs: core: Fix double release in ufshcd_eh_timed_out() scsi: ufs: core: Fix double completion in ufshcd_clear_lu_cmds() scsi: ufs: core: Add a helper for clearing hba->outstanding_reqs scsi: ufs: core: Remove an always-false WARN_ONCE() scsi: fnic: Update module authors scsi: ufs: qcom: Power down UFS during system suspend on Milos scsi: MAINTAINERS: Update Marvell Ethernet storage maintainers scsi: handle out-of-range SG_SET_TIMEOUT values scsi: core: Update cdrom.h coments scsi: st: MAINTAINERS: Add Laurence Oberman and John Meneghini scsi: sd: Mark the disk dead if runtime resume fails in sd_remove() scsi: libiscsi_tcp: Prevent R2T range check overflow scsi: ufs: core: Fix stale comment in ufshcd_mcq_config_nr_queues() scsi: fnic: Annotate fnic_nvme functions with __must_hold() scsi: ufs: core: Fix a deadlock between clock scaling and device commands scsi: ufs: core: Clear stale UIC result byte before peer DME retries scsi: ufs: bsg: Reject UIC commands with a non-zero result byte scsi: ufs: bsg: Validate request_len before accessing request ... |
||
|
Linus Torvalds
|
8ebbaf8835 |
block-7.4-20261029
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmrjrZ0QHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpl3xEACV0gok/rxtzKB/z2gedIdA1NjY488cNdH3
UP+YpoTNm4GE/A9bfmTLWjGaQlxmDSdlM8cmQzAKTjHNiGNFK/Pv+fqWzaz38Aet
tUrxby2748CC3oin4BVxdTLqgSg35Yaw2S/zM/Zsxt3eMHtOdWZZYo8FKkvdf7fp
DR166vphOGQFu598Allrd4OTXj+TLd6EFlZ7WSN7fq2a8193XuIvfH5HRkDEUbVB
GA1wlltke/zildACho1MldBDkQYeGGGVk/J/1V5P8sB7TRrzyiRbO8RyfvwSR6OH
ChNeVXA/iLjwJA9HVX7+q+VnVQRK/EgIVZZoum+BG9WO9ZcUaelxgF3ZIdYc0Pj0
MDwg6iL4oWZKAqdb1jCYpjOqT3avp+oSQSD9sGpnzSmta2sMtQyulo00UGMBDuBP
xx8zzeggbuJymFXrCTAZ7Ek1EUNZh3qcWgdUOhxHV+R0s9ovyZszOdGV4dLNm0wX
aBO375d4O9FutZRzUA5vxEHbBue+S3maPkW2txn4WlnJNGRDIN/GyKoY6c5oyogy
ApYQ2Gqlbvf7VOPiYVADhycVNUzcolf8EBOXu8zFvMTA8aXLwXalrIaEurnhpE51
EQaPIZFXH4/dj6noHpgvYaAGFAFXpSSSXVIkG8a0CuhkDjrf6vU+dbt4PVhWP3xT
BSFU97FGbw==
=i457
-----END PGP SIGNATURE-----
Merge tag 'block-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull more block updates from Jens Axboe:
"Bigger than usual for an end-of-merge-window pull request, main reason
being that the MD side I had missed a pull on, and both NVMe and block
got a good pile of LLM driven fixes where some of them may as well
just go in now rather than wait a full cycle. This contains:
- NVMe fixes via Keith:
- nvme-tcp fallout from the parallel queue allocation: initialize
pf_cache_lock and the header digest before requests are set up,
and don't dereference a NULL queue->ctrl on reconnect
- nvme-fabrics queue mapping fixes: reset io_queues on reconnect,
limit each queue type to the online CPUs, and clear a poll map
with no poll queues
- nvme-tcp io_work priority inversion with send_mutex held
(Seiji), error recovery on read_sock failure and skipping TLS
control records while waiting for the ICResp (Martin B), TLS
handshake timeout validation, and an address attribute race
- nvme-rdma NULL metadata_sgl dereference with T10-PI
- nvme-pci early boot hang with the quirks parameter
- nvme-multipath ANA log bounds underflow, and an nvme-fc
discovery reference leak
- nvmet hardening: rdma inline SGL out-of-bounds write and short
connect requests, fc use-after-free in LS create connection and
teardown on admin queue failure, pci-epf transport error
reporting and SGL length checks, zns NUMD wrap, fc stale read
data, auth state and status fixes, ports list and qid_max
locking, rdma double puts and irq-safe locking, and a double
free on metadata SGL allocation failure
- nvmet fixes from Josef: big discard length truncation, NULL
derefs for PCI endpoint targets and debugfs host_traddr, stop
listening when a tcp port is removed, and don't BUG() in
nvme-loop when a scan runs beside a reset
- MD fixes via Yu Kuai:
- raid5 validation: reject too few disks, invalid reshape disks, a
per-device size below one chunk, and an inconsistent reshape
state from the superblock instead of BUG(), plus journal payload
size checks
- raid5 error path and lifetime fixes: extra_page leak and NULL
derefs in free_conf/setup_conf, draining released_stripes before
destroying the cache, RCU for the big_stripe_tree lookup, and
per-array io_unit slab names
- md core: reject v0.90 arrays with too many devices, validate
bblog_size, take reconfig_mutex when enabling PPL, fix the
mddev->private NULL deref when stopping an array under IO, and
don't hand out the array before mddev->kobj is added
- raid10 missing barrier wakeup, raid0 device count validation, a
bogus mddev_unlock() in lbs_store(), and shared helpers
- blk-mq fixes from Josef:
- don't trust the bio cookie in blk_mq_poll()
- keep tag sharing fair after a queue update
- don't bring back flags of a completed request from the timeout
handler
- honor a restarted timer
- initialize the dma state for P2P
- quiesce a queue joining a quiesced tag set
- set up and exit hctxs under tag_list_lock
- free the tag bitmaps in the SRCU callback
- blk-cgroup and friends from Josef:
- keep the old blkg while reassociating a bio
- free struct ioc after a grace period
- don't truncate v1 iops limits
- fix root io.stat on 32-bit
- don't free a blkg with its punt work queued
- flush iolatency enable_work after going offline
- pass dead group I/O counts on and make reset_stats reset them
- don't enter reclaim under rq_qos_mutex
- Other core fixes from Josef:
- a disk use-after-free in sync_bdevs()
- don't losing the status of a failed flush request
- 64-bit sector math for mac partitions
- apply the segment size to the integrity buffer
- blk-iocost: abort a weight transfer on invalid donation weights,
and publish hweights as one atomic value
- Fix a NULL deref and use-after-free in __blk_crypto_evict_key(),
reachable via dm-inlinecrypt
- Fix recursive i_rwsem locking in blkdev_write_iter(), from two
fixes for the same race landing in the window
- Advance the iterator after copy-in for SG_DXFER_TO_FROM_DEV, fixing
an infinite loop in blk_rq_map_user_iov()
- Check the open mode for LOOP_SET_STATUS in the compat ioctl
- rnbd-srv use-after-free and kobject fixes
- drbd timer and req_lock fixes
- zloop cleanups and error path fixes
- cdrom header and kernel-doc cleanups"
* tag 'block-7.4-20261029' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (109 commits)
blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()
zloop: check that the zone backing file support ->{read,write}_iter
zloop: fput file after failed zone init
zloop: share more code for opening a zone backing file
zloop: remove a duplicate call to zloop_get_block_size
block: fix kernel-doc warnings in blk-map.c and blk-mq-dma.c
blk-iocost: publish hweights as one atomic value
blk-iocost: abort weight transfer on invalid donation weights
rnbd-srv: publish the sess_dev at the end of OPEN
rnbd-srv: fix use-after-free on two CLOSE messages
block/rnbd-srv: drop the sess_dev kobject unlocked
block/rnbd-srv: don't free the device on a sysfs error
drbd: take req_lock to skip the initial sync as peer
drbd: stop the start_resync timer of a dying device
block: apply the segment size to the integrity buffer
blk-mq: free the bitmaps of tags in the SRCU callback
block: partitions/mac: compute the sectors in 64 bits
blk-mq: set up a queue under tag_list_lock
blk-mq: exit the hctxs of a queue under tag_list_lock
blk-mq: quiesce a queue that joins a quiesced tag set
...
|
||
|
Baokun Li
|
c8c53d669d |
blk-crypto: fix NULL deref and UAF in __blk_crypto_evict_key()
Sashiko reported a possible NULL pointer dereference, triggered by the
following flow:
dm-inlinecrypt ctor # first use of the fallback
├─ blk_crypto_init_key() # succeeds, ctx->key.size != 0
├─ blk_crypto_start_using_key()
│ ├─ hw-wrapped key: -EOPNOTSUPP
│ │ # profile never allocated (NULL)
│ └─ raw key: fallback_start_using_mode()
│ └─ blk_crypto_fallback_init() fails
│ └─ kfree(profile) # not NULLed
├─ goto bad
└─ inlinecrypt_dtr() # evicts whenever key.size is set
└─ blk_crypto_evict_key()
└─ blk_crypto_config_supported_natively() = false
└─ blk_crypto_fallback_evict_key()
└─ __blk_crypto_evict_key(blk_crypto_fallback_profile)
└─ profile->num_slots # BOOM!!!
This issue can be reproduced using the following commands:
dd if=/dev/zero of=/tmp/backing bs=1M count=64
LOOP=$(losetup -f --show /tmp/backing)
SZ=$(blockdev --getsz $LOOP)
KEY=$(head -c 64 /dev/urandom | od -An -tx1 | tr -d ' \n')
dmsetup create ic --table "0 $SZ inlinecrypt aes-xts-plain64 \
$KEY 0 $LOOP 0 1 keytype:hw-wrapped"
And the following oops is triggered:
==================================================================
blk-crypto: loop0: no support for wrapped keys
Oops: general protection fault, probably for non-canonical address
0xdffffc000000000b: 0000 [#1] SMP KASAN PTI
KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f]
CPU: 5 UID: 0 PID: 901 Comm: dmsetup 7.3.0-rc3 #1 PREEMPT(lazy)
RIP: 0010:__blk_crypto_evict_key+0x2e/0x3b0
Call Trace:
blk_crypto_evict_key+0x24c/0x320
inlinecrypt_dtr+0xf6/0x160
inlinecrypt_ctr+0x2d3/0xbd0
dm_table_add_target+0x661/0xf40
table_load+0x1c4/0x490
ctl_ioctl+0x32f/0x5f0
dm_ctl_ioctl+0xe/0x20
==================================================================
dm-inlinecrypt is the only caller that can evict a key that was never
started, as fscrypt frees such a key without evicting it.
Fix this by returning early from blk_crypto_fallback_evict_key() when
tfms_inited[] is not set for the key's mode. tfms_inited[] is only set
after blk_crypto_fallback_init() has successfully initialized the
profile, so the crash above is no longer reachable.
The bug has been latent since commit
|
||
|
Yuehong Wu
|
aa977f5d96 |
block: fix kernel-doc warnings in blk-map.c and blk-mq-dma.c
make W=1 reports excess kernel-doc parameters for bio_copy_kern()
and blk_rq_integrity_dma_map_iter_next():
block/blk-map.c:366: warning: Excess function parameter 'op' description in 'bio_copy_kern'
block/blk-mq-dma.c:379: warning: Excess function parameter 'state' description in 'blk_rq_integrity_dma_map_iter_next'
bio_copy_kern() derives the operation from @rq and has no @op argument,
and blk_rq_integrity_dma_map_iter_next() lost its @state argument in
commit
|
||
|
Kunhai Dai
|
0150554a3f |
blk-iocost: publish hweights as one atomic value
current_hweight() publishes the cache generation and both weights with
separate stores. Refreshers running on different CPUs can interleave
their stores and leave a new generation paired with weights from an older
calculation. The compiler can also reorder the generation store before
the weight stores, so a reader that sees the new generation can accept
stale weights.
A stale weight is not only a reporting artifact. It feeds the cost
calculation and the donation logic, where an inconsistent combination can
lead to a zero divisor in transfer_surpluses().
In addition, the slow path rereads iocg->hweight_active/inuse after
publishing them, so the value it returns can be the one written by another
refresher instead of the locally computed one.
Pack the generation and both weights into a single atomic64_t and publish
them with one atomic write. Readers take one atomic snapshot and return
the local values. Weights are in [1, WEIGHT_ONE]; storing each minus one
preserves the full range in 16 bits and leaves 32 bits for the generation.
The two weight fields remain as the donation workspace used under
ioc->lock. Tracepoints decode the packed cache without refreshing it and
iocost_monitor.py is updated accordingly.
Developed with assistance from Claude Code (Anthropic): the assistant
drafted the packed representation, the helpers and the tracepoint/monitor
changes, and ran the checks listed below. The author reviewed the result
and remains responsible for it.
Fixes:
|
||
|
Kunhai Dai
|
c810ee88cd |
blk-iocost: abort weight transfer on invalid donation weights
transfer_surpluses() warns and then keeps going when the donation
calculation produced invalid weights. The following propagation can then
divide by a zero hweight_inuse, so the warning is immediately followed by a
divide error.
When the check trips, abandon this period's donation transfer and release
the walk lists. This trades one period without donation for not crashing;
the invalid state is not expected on the normal path.
Developed with assistance from Claude Code (Anthropic): the assistant
analysed the failure path, drafted the change and ran the checks listed
below. The author reviewed the result and remains responsible for it.
Fixes:
|
||
|
Josef Bacik
|
10b249e9b0 |
blk-mq: free the bitmaps of tags in the SRCU callback
Commit |
||
|
Josef Bacik
|
6c55f94317 |
block: partitions/mac: compute the sectors in 64 bits
start_block and block_count are converted to 512 byte sectors in 32-bit
arithmetic, although put_partition() takes a sector_t. With a block size
above 512 bytes anything beyond 2TiB wraps and the partition lands on
top of another one.
Fixes:
|
||
|
Josef Bacik
|
4fcc499ea9 |
blk-mq: set up a queue under tag_list_lock
blk_mq_init_allocated_queue() only takes tag_list_lock at the end, when
it adds the queue to the set. Before that it sizes the queue by
set->nr_hw_queues, hands out set->tags[], maps by set->map[], and
blk_mq_map_swqueue() frees tags of the set. An update clearing the maps
at that time makes the new queue free tags that all the other queues
share. An NVMe controller reset during a namespace scan does exactly
that.
Take the lock before the first look at the set. An update can be part of
error handling, so the allocations under the lock must not wait for IO:
memalloc_noio_save(), as in add_disk_fwnode().
Fixes:
|
||
|
Josef Bacik
|
89a2381482 |
blk-mq: exit the hctxs of a queue under tag_list_lock
blk_mq_update_nr_hw_queues() exits and replaces the hctxs of every queue
on set->tag_list under tag_list_lock. blk_mq_exit_queue() exits its
hctxs without the lock and only then takes the queue off the list, so an
update running at the same time exits them again and sets up new ones
that nobody exits. del_gendisk() is kept away by update_nr_hwq_lock,
disk_release() of a never added disk and blk_mq_destroy_queue() are not,
and nvme_alloc_ns() drops such a disk when it finds the queues frozen by
a reset.
Hold tag_list_lock for both steps.
Fixes:
|
||
|
Josef Bacik
|
71ec3c7d6d |
blk-mq: quiesce a queue that joins a quiesced tag set
blk_mq_quiesce_tagset() only quiesces the queues on the list at that moment. A queue added before blk_mq_unquiesce_tagset() runs unquiesced, and then gets unquiesced without ever having been quiesced, which trips the warning in blk_mq_unquiesce_queue(). NVMe gets there when a controller fails while its namespaces are being scanned. Count the quiesce calls in the tag set and quiesce a joining queue that many times, under a spinlock that also serializes the two functions. It can't be tag_list_lock, see commit |
||
|
Josef Bacik
|
035236c9e1 |
blk-mq-dma: initialize the dma state for P2P, too
blk_rq_dma_map_iter_start() promises that the caller need not initialize
the dma_iova_state, but the P2P bus address path returns before it does
so. The state then holds what the last request with that tag left, and
blk_rq_dma_map_coalesce() describes a transfer as one IOVA range that it
isn't. Clear it on that path too.
Fixes:
|
||
|
Josef Bacik
|
0db9f8968a |
blk-mq: don't forget a timer the driver has restarted
If ->timeout() returns BLK_EH_RESET_TIMER, blk_add_timer() gives the
request a new deadline that blk_mq_timeout_work() doesn't know about
when it picks the next expiry. A 2s nbd read next to a 60s one expires
once and then not again for a minute. Let the new deadline take part.
Fixes:
|
||
|
Josef Bacik
|
9531230ee1 |
blk-mq: don't bring back flags of a completed request
The timeout handler sets and clears RQF_TIMED_OUT in a request it only
holds a reference to, with a plain read-modify-write, while the
completion clears flags in rq_flags the same way. If the two interleave,
blk_mq_finish_request() runs twice with the flags back: the zone write
plug reference is dropped twice and the scheduler's ->finish_request()
is called again.
Change RQF_TIMED_OUT with cmpxchg, so the handler never writes back a
flag that changed under it.
Fixes:
|
||
|
Josef Bacik
|
620cfc7a66 |
blk-mq: keep sharing tags fairly after a queue update
A hctx only gets BLK_MQ_F_TAG_QUEUE_SHARED from
blk_mq_add_queue_tag_set(). The hctxs blk_mq_update_nr_hw_queues()
allocates for queues that joined long ago never get it, so they aren't
counted in active_queues and hctx_may_queue() lets them take all the
tags. One NVMe namespace can starve the others after the first update.
Set the flag on the new hctxs.
Fixes:
|
||
|
Josef Bacik
|
2497418599 |
blk-mq: don't trust the cookie in blk_mq_poll()
blk_mq_poll() indexes queue_hw_ctx[] with bio->bi_cookie unchecked. Zone write plugging keeps the segment count of a plugged write in __bi_nr_segments, which shares a union with the cookie, and clears REQ_POLLED, but bio_poll() only looks at the cookie. A plugged polled write with more segments than there are hardware queues reads past the array. The bio is also SLAB_TYPESAFE_BY_RCU, so a cookie from a bio reused for another device can meet the wrong array as well. Ignore a cookie that is out of range or doesn't name a poll queue. Fixes: |
||
|
Josef Bacik
|
67c43ceaa2 |
block: don't lose the status of a failed flush request
flush_end_io() stores the status in fq->rq_status for whoever drops the
last reference to finish the flush sequence. blk_mq_put_rq_ref() calls
it with BLK_STS_OK from tag iterators and the timeout handler and
overwrites an error the real completion stored. With two extra
references, reading /sys/block/<disk>/inflight is enough for that, a
failed flush completes everything waiting on it with success and fsync()
lies to the application.
Only store a status that is an error.
Fixes:
|
||
|
Josef Bacik
|
cebb1c2331 |
block: fix use-after-free of the disk in sync_bdevs()
sync_bdevs() holds a reference to the bdev inode while it takes
bd_disk->open_mutex. For a partition the inode doesn't keep the gendisk
alive, the device reference does: part_release() drops the disk as soon
as the last reference to the partition device is gone. A sync(2) racing
with the last close of a partition of an already deleted disk locks a
freed open_mutex.
Take a device reference before touching the disk, like
blkdev_get_no_open() does, and skip the bdev if it's on its way out.
Fixes:
|
||
|
Josef Bacik
|
045cbfc369 |
block: don't enter reclaim under rq_qos_mutex
ioc_qos_write() and the wbt_lat_usec writers take rq_qos_mutex with the queue frozen, blkcg_deactivate_policy() does the same with blkcg_mutex, so nothing holding either may wait for IO. blkg_conf_prep() got GFP_NOIO for the blkg in commit |
||
|
Josef Bacik
|
ac81a07a0b |
blk-throttle: make blkio.reset_stats reset I/O counts
blkio.throttle.io_service_bytes and io_serviced were reset by
blkcg_reset_stats() while the counters were part of the blkg. Now that
they live in the throtl_grp, add a pd_reset_stats_fn for them.
Fixes:
|
||
|
Josef Bacik
|
587edb931f |
blk-throttle: pass the I/O counts of a dead group on
The recursive io_service_bytes and io_serviced files sum up the online groups plus what dead descendants left in aux_cnt. That worked while the counters lived in the blkg. Since commit |
||
|
Josef Bacik
|
020f61242d |
blk-iolatency: flush enable_work after going offline
blkcg_iolatency_exit() flushes enable_work before it deactivates the
policy, but iolatency_pd_offline() schedules it again for the last group
with a target, so the blk_iolatency is freed with the work queued. Flush
it after the deactivation.
Fixes:
|
||
|
Josef Bacik
|
4def096314 |
blk-cgroup: don't free a blkg with its punt work queued
blkg_async_bio_workfn() relies on the bios on the list pinning the blkg.
But blkcg_punt_bio_submit() can call queue_work() after a running
instance already took and completed the bio, and queue_work() succeeds
on an empty list for the same reason. Nothing holds the blkg then, and
free_work shares its memory with async_bio_work on top of that.
Hold a reference across blkcg_punt_bio_submit(), give the two works
memory of their own, and cancel async_bio_work in blkg_free_workfn().
Fixes:
|
||
|
Josef Bacik
|
e335b853d9 |
blk-cgroup: fix root io.stat byte counts on 32-bit
blkcg_fill_root_iostats() shifts the unsigned long sector counts by 9
before adding them to the u64 byte counts, so on 32-bit the contribution
of a CPU wraps every 4GB. Widen before the shift.
Fixes:
|
||
|
Josef Bacik
|
7d96874ba8 |
blk-throttle: don't truncate the cgroup v1 iops limits
tg_set_conf() parses the limit into a u64 and stores the iops ones
through an unsigned int, so anything above UINT_MAX is truncated and a
multiple of 2^32 becomes a limit of 0. The next IO of the group then
divides by it in tg_within_iops_limit().
Clamp to UINT_MAX, which means no limit, like tg_set_limit() does on the
default hierarchy.
Fixes:
|
||
|
Josef Bacik
|
05ce1df375 |
blk-iocost: free struct ioc after a grace period
ioc_qos_prfill() and ioc_cost_model_prfill() take ioc->lock from blkcg_print_blkgs(), which since commit |
||
|
Josef Bacik
|
0e1daaf9b2 |
blk-cgroup: keep the old blkg while reassociating a bio
bio_associate_blkg_from_css() drops the bio's old blkg before it looks up the new one through the css. The css is pinned by the blkg, not by the bio, so if the cgroup is gone the bio may hold the last reference and the blkcg can be freed under blkg_tryget_closest(). The rcu_read_lock() around the whole thing used to cover that, until commit |
||
|
Linus Torvalds
|
ed02f4f7ad |
for-7.4/io_uring-dmabuf-20261023
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmrbkFsQHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgpiHpD/9MdThoGJTZ3mKgaZPd7lOgkxWL51CY/ULB
X9zzyfHP9hpXxwXqpSGm8XhN7cmSDXGaCYvhVPS2YQQv0458s1UGMWDi8PJNulFS
6M8ng6Hex2z/Uq+u6vMkruz+hH76c3ajo6kGOhJnWye+/Rq1bqqFcYBWMpLBE/yj
lp8JGG92HyMnsIo5gzBHbUoNEc+X0+jz88mk0JRZoONJD4cNb1S1bW5v+uAk0Nvc
/qPE9AXU2DnngvbzhfKGza/4Lkx9WKBXFmxJSiG9ZH6GJn3yndBNBi7RAODku+/E
i+SiukHPDhn3M5cWZuJ8ilTpVWRCnnsbhavM1PN2tvcW6IfZrAz+m321+JVkzKu0
cLUDvmz2WS0+PcodXGn3KcGVYt7vAjtQVZwZLbq2012u5xSvZN/VaeiVDIRr1uC/
hQPiD51ZpsTt/2lAyrFGmLBsskNWc0Xhd6ePX7euNCdhfHj5UuWKcXUiQeeGiUvT
X2JyQAJSY9VZ6eO02w77bta0II+3SSnZlA6xVmE3+Nwv2z6qr3b31gcfMIiap3Tu
jUkKvDuB9Dw9hhgLr1t6BCuaPS3ktyd1F3dBvbs8YXyyeworU2KGtSF7mraJxts8
GCH+DOAR1j29qMi4/bjhxOKQYAKzhWbptCiJgyReL6V+uFO6JxAeWn3qn36mjezp
BuHNTX1A5g==
=hlkK
-----END PGP SIGNATURE-----
Merge tag 'for-7.4/io_uring-dmabuf-20261023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull io_uring dma-buf support from Jens Axboe:
"This adds native dma-buf support to the I/O path, exposed through
io_uring. It's been in development for a while and should be ready to
go now.
- dma-buf file I/O infrastructure: a dma_buf_io_ctx created through a
new ->init_dma_buf_io_ctx file operation, and a dma_buf_io_map
holding the device DMA mapping. The two are split so a mapping can
be invalidated and re-established underneath a live context, with
the map counting in-flight requests so it can be torn down safely.
- A new iov_iter type for dmabuf maps, and a dma map backed bio type
for the block layer, with raw block device support on top.
- nvme-pci backend implementing dma-buf backed requests, including
SGL support.
- io_uring dmabuf backed registered buffers, built on a reworked
buffer registration structure with an extended update path, regbuf
import flags, an uncloneable flag for buffer types that can't be
cloned, and cloning support for registered dma-bufs"
* tag 'for-7.4/io_uring-dmabuf-20261023' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux:
io_uring/dma-buf: don't fail fixed buffers without dma-buf support
nvme-pci: detach dma-bufs only on removal
block: reject dma-bufs larger than 4GiB
io_uring/dma-buf: allow cloning registered dma-bufs
dma-buf-io: document dma_buf_io_init_map
dma-buf-io: fix typos in kernel docs
block: fix indention for dma-buf checks
io_uring/rsrc: add dmabuf backed registered buffers
io_uring/rsrc: add regbuf import flags
io_uring/rsrc: add uncloneable regbuf flag
io_uring/rsrc: extend buffer update
io_uring/rsrc: introduce buf registration structure
nvme-pci: add SGL support for the dmabuf path
nvme-pci: implement dma-buf backed requests
nvme-pci: rename nvme_pci_sgl_set_data to nvme_pci_dma_iter_set_sgl
block: add dma-buf support for raw bdev
block: introduce dma map backed bio type
block: always adjust bi_offset on bio_advance_iter
iov_iter: add iterator type for dmabuf maps
dma-buf: introduce initial file I/O infrastructure
|
||
|
Zhenxian Ma
|
21b88cc8ba |
block: fix recursive i_rwsem locking in blkdev_write_iter()
Commit |
||
|
TJ Adams
|
82e72ea18d |
block: advance iterator after copy-in for SG_DXFER_TO_FROM_DEV
When a passthrough request uses transfer direction SG_DXFER_TO_FROM_DEV,
bio_copy_user_iov() sets up a temporary iterator iter2 with
data_source = ITER_SOURCE to copy user data into the bio pages before
execution.
bio_copy_from_iter(bio, &iter2) copies the data and advances iter2, but
the original iter is never advanced. Consequently, iov_iter_count(&i)
remains non-zero in the caller loop in blk_rq_map_user_iov():
i = *iter;
do {
if (copy)
ret = bio_copy_user_iov(rq, map_data, &i, gfp_mask);
...
} while (iov_iter_count(&i));
Because i is never advanced, blk_rq_map_user_iov() loops indefinitely,
continually allocating bios and consuming map_data pages until it
exhausts pages and fails with -EINVAL.
Fix this by calling iov_iter_advance(iter, bio->bi_iter.bi_size) in the
map_data && map_data->from_user branch after bio_copy_from_iter().
Fixes:
|
||
|
Linus Torvalds
|
b23545529c |
for-7.4/block-20261021
-----BEGIN PGP SIGNATURE-----
iQJEBAABCAAuFiEEwPw5LcreJtl1+l5K99NY+ylx4KYFAmrYsn8QHGF4Ym9lQGtl
cm5lbC5kawAKCRD301j7KXHgppmpEACRjRrpwbzCY47zpMyXICIFsUTqzs9MHKLh
VZERo2w1Xdpu0GGLZAnNwbBB96pCsob5/Ipq4EaleSObkhHDYjLcev0vnLITf7Hm
Ky5ogvofLmcpklYGP04TewoYko7tV8+KtcP3RyHpQvyTZs63dSvUeJsnZiHacc51
Un9gB9GwbJE9EWOmF8JaHl58+qZVJXKnSnAJH/C17KYn5F9OcGsrbyDXODmE0DMT
F44A0ZTMzDV3IJfPXg9rjc8rD5eTX+/xdbFBVFCXUofi3D3DgWHk6qVTVh6mmACp
l8BfmfjohpJmz9rsT7FqXq5Mey4WxEhepjvat/uE97SR6WDPszruKVHfT4E47jNW
r/hP2ogtOJAP04hklaHYeJy3gaOA90YmhZU7Idu6iOVCUuZgqFgHbKfHRp1zmMMx
PPaenKrAQA0oBb46IsgZA9rAbF6xd8E5/B36dGDe33JYXwQGnJH046IIE28Ytq1R
740vmq+4EJ2mCrhB8SR/7GnndTTWL/RAmhw8PkugWl9YB9uxrcOIppiyjvorKTrD
yEKuLJW9hYNkiCz/tsE/ZOfwLaBP03JPSvx4si4g1nyKUgEF3jxnD55vkXb2kQll
Xxa0YcQP0Bfn0oQWljzS6gmiTIcbwy2jPCu08esbo/rig5tfLjdTZmTH0oZmy4LH
9kq45JFKhA==
=8Czt
-----END PGP SIGNATURE-----
Merge tag 'for-7.4/block-20261021' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux
Pull block updates from Jens Axboe:
- NVMe updates via Keith:
- Apple M4 (t8132) ANS2 NVMe support
- nvme-multipath sysfs attributes for path_state, iopolicies, and
fail_on_ctrl_loss, plus path state evaluation fixes
- nvme-tcp parallelized I/O queue allocation and startup, and using
the caller's network namespace
- nvmet passthru UAF fix and rework, PR preempt use-after-free
fixes, auth hardening, and traffic based keep alive support
- DH-HMAC-CHAP secret attributes readable by root only
- Various other fixes and cleanups
- swim driver overhaul and fixes, plus floppy fixes, via a pull from
Denis
- Block device buffered and direct I/O rework from Tal: use
iomap_dirty_folio, take i_rwsem for the write fallback and splice
read, honor IOCB_NOWAIT in the buffered read path, and reject atomic
write fallback to buffered I/O
- Large zone revalidation rework: serialize revalidation, handle
capacity changes by dropping and retrying zone write plugs, propagate
read-only and offline conditions, and treat offline and read-only
zones as dead
- ublk robustness work around canceled FETCH rounds and going live over
canceled io commands, dropping the default I/O scheduler, and a batch
of selftest additions
- blk-iocost flush cost support and zone append accounting
- rust block fixes for Send/Sync bounds on GenDisk and TagSet, and
import style cleanups
- Atomic write fixes capping size by the PI buffer constraints and
failing short atomic pins
- Skip the redundant flush for O_DSYNC direct writes, and only use
REQ_FUA when the device supports it
- Store GPT attributes as a raw value
- Remove support for swapping loop fds
- Various other fixes and cleanups all over
* tag 'for-7.4/block-20261021' of git://git.kernel.org/pub/scm/linux/kernel/git/axboe/linux: (144 commits)
block: restore the iterator when rejecting a misaligned bio
blk-mq: clear stale inactive flag on hctx reuse
block, bfq: initialize active lists for all actuators
zloop: print device that had errors
ublk: pin module while release work is pending
blk-mq: drop the tag_set argument from blk_mq_free_rq_map/tags
blk-mq: share one tags_srcu instance across all tag sets
blk-iocost: fix stale comment in ioc_rqos_throttle()
blk-iocost: account zone append completions in latency stats
blk-iocost: charge zone appends as writes
blk-iocost: add flush cost support with the flushiops model parameter
ublk: use global index for reported zones
selftests: ublk: add test for going live over canceled io commands
selftests: ublk: stop a batch thread when PREP_IO_CMDS fails
selftests: ublk: move the control command helpers into ctrl.c
ublk: refuse to go live after an io command was canceled
ublk: let STOP_DEV cancel the server's commands before its release
ublk: allow a NULL io->cmd in the cancel callback
ublk: reset the FETCH round under ub->mutex
ublk: reset the FETCH round in release also without a disk
...
|
||
|
Yingjie Wang
|
9a6cb1da4f |
scsi: handle out-of-range SG_SET_TIMEOUT values
SG_SET_TIMEOUT accepts a signed int in USER_HZ units. The sg character device rejects negative values and limits positive values so the converted timeout fits its destination field. The block SCSI and BSG paths instead pass the value to clock_t_to_jiffies(), which accepts an unsigned long, and store the result in an unsigned int. Negative values are converted into large unsigned timeouts. On 64-bit systems, large positive values can also exceed UINT_MAX after conversion and are truncated on assignment. With HZ=1000 and USER_HZ=100, for example, 429496730 clock ticks become 4294967300 jiffies and are stored as 4 jiffies. On 32-bit systems, an overflowing conversion becomes ULONG_MAX, which is an unsafe relative interval for the block timer comparisons. Reject negative values with -EIO, matching drivers/scsi/sg.c. Saturate the converted value at the smaller of the destination field limit and MAX_JIFFY_OFFSET. This preserves successful ioctl behavior while avoiding both narrowing wraparound and an unsafe 32-bit timer interval. The block SCSI behavior predates Git history. BSG has exposed the same behavior since it was introduced. Fixes: |
||
|
Martin K. Petersen (Oracle)
|
306158e878 |
Merge branch '7.3/scsi-fixes' into 7.4/scsi-staging
Pull in scsi-fixes to resolve a merge conflict in libiscsi.c. Signed-off-by: Martin K. Petersen (Oracle) <mkp@kernel.org> |
||
|
Linus Torvalds
|
c0e8d30137 |
Modules changes for 7.4-rc1
- Ignore local labels and mapping symbols during module load These symbols were already ignored during kallsyms address-to-symbol lookups. Filter them out earlier during module loading to reduce lookup overhead and prevent them from appearing in /proc/kallsyms. - Fix potentially incorrect access of SetOnce<T> when setting Rust module parameters. - Fix a potential read of an uninitialized count when printing taint information for unloaded modules. - Allocate the kmod argument array using kmalloc_array() in preparation for conversion to type-aware allocators. - Clean up includes in linux/kmod.h Add explicit includes of linux/umh.h to files that use usermode helpers. Then clean up the #include list in linux/kmod.h, notably removing the compatibility linux/umh.h include. - Remove the error-injection.h include from linux/module.h Add explicit includes of linux/error-injection.h to files that use the ALLOW_ERROR_INJECTION() macro and currently rely on it being provided indirectly via linux/module.h. Then remove the unnecessary linux/error-injection.h include from linux/module.h. - Replace __MODULE_STRING() with __stringify() in various drivers in preparation for removing the former macro. The changes to several #include lists have been reported to cause trivial conflicts in linux-next with the drm, drm-xe, and usb trees. -----BEGIN PGP SIGNATURE----- iQFkBAABCABOFiEEIduBR9MnFA82q/jtumpXJwqY6poFAmrWJvAbFIAAAAAABAAO bWFudTIsMi41KzEuMTIsMiwyFBxwZXRyLnBhdmx1QHN1c2UuY29tAAoJELpqVycK mOqalOYH/RpwszqX+OuRhf3G9IDokSZFZyiAJLZan3H7jZNb9VBVLYmTTRYF/UE4 uXKeGAUXZOaUdhVjQi/1LqX3NbDO1NfUCM9sbk3EPal0L6ILbcmkBecXu9JXHxvB 6sfEAdTMdAn28613wcnbjmdGfEkgHuDZqZeld4dIAtZ+GvLzFz0D+o0zkigCnT4I faKU9GLIHJe2Cn5FB40b1+M+IGY9t6bl2+WxVc1rd9oSZXfr8ptE7NPllhiOmOhD /aMVpeSlXzo8DYxIhvtZGwDh5NrJglPFdFRXYuHUDLxkWCCFtXRt//LtWv3EpKqp dgQUH5QAO5E/+OuycHFLaXOUiKVS0P4= =bCLk -----END PGP SIGNATURE----- Merge tag 'modules-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux Pull module updates from Petr Pavlu: - Ignore local labels and mapping symbols during module load These symbols were already ignored during kallsyms address-to-symbol lookups. Filter them out earlier during module loading to reduce lookup overhead and prevent them from appearing in /proc/kallsyms. - Fix potentially incorrect access of SetOnce<T> when setting Rust module parameters. - Fix a potential read of an uninitialized count when printing taint information for unloaded modules. - Allocate the kmod argument array using kmalloc_array() in preparation for conversion to type-aware allocators. - Clean up includes in linux/kmod.h Add explicit includes of linux/umh.h to files that use usermode helpers. Then clean up the #include list in linux/kmod.h, notably removing the compatibility linux/umh.h include. - Remove the error-injection.h include from linux/module.h Add explicit includes of linux/error-injection.h to files that use the ALLOW_ERROR_INJECTION() macro and currently rely on it being provided indirectly via linux/module.h. Then remove the unnecessary linux/error-injection.h include from linux/module.h. - Replace __MODULE_STRING() with __stringify() in various drivers in preparation for removing the former macro. * tag 'modules-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux: drivers: Replace __MODULE_STRING() with __stringify() module: Fix uninitialized count read of unloaded taint tracking record rust: module_param: Fix potentially incorrect access of `SetOnce<T>` module: Remove the error-injection.h include from linux/module.h drm/xe: Include error-injection.h for ALLOW_ERROR_INJECTION() drm/i915: Include error-injection.h for ALLOW_ERROR_INJECTION() syscalls: Include error-injection.h for ALLOW_ERROR_INJECTION() net: Include error-injection.h for ALLOW_ERROR_INJECTION() block: Include error-injection.h for ALLOW_ERROR_INJECTION() module: Bring includes in linux/kmod.h up to date time/jiffies: Include linux/sysctl.h for proc_int_u2k_conv_uop(), ... umh, treewide: Explicitly include linux/umh.h where needed modules/kmod: Allocate argv with kmalloc_array() module/kallsyms: Ignore local labels and mapping symbols during module load module/kallsyms: Refactor current symbol filtering into is_core_symbol() module/kallsyms: Rename is_mapping_symbol() to is_ignored_kernel_symbol() |
||
|
Linus Torvalds
|
77f77fb792 |
cgroup: Changes for v7.4
- A write to cgroup.subtree_control or cgroup.type could hang in D state for as long as a task pinning a dying controller took to exit, as syzbot reported. The wait is now interruptible. - cpuset: the deadline bandwidth check ran on cpusets that weren't valid partition roots, failing cpuset writes with -EBUSY while deadline tasks existed. The CPU count the fair class takes from cpuset assumed a shared hierarchy that cgroup1 may not have. - Finding a cgroup's effective controller state no longer walks up the hierarchy, for per-I/O users such as nvmet. io.stat reads of cgroups without block devices skip the stat flush. - cpuset v1-only code moved to the v1 file and the exclusive flag dropped from v2, with documentation corrections for partition roots and boot-isolated CPUs. - Dead cgroups fail writes with -ENODEV consistently, plus small cleanups. - Selftest fixes, most visibly for tests that skipped on machines with many mounts, and a new pids.events notification test. -----BEGIN PGP SIGNATURE----- iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCatZDuA4cdGpAa2VybmVs Lm9yZwAKCRCxYfJx3gVYGb/vAP90zPW9Bhiy6Ej8rTfyzAinDakdRhJ9+Vf4vbYb 6LrWHwEAuk2YMFICVvqVOBF+W6RwuEMeb1tTYfPVmlVF3wqMdAg= =oGx/ -----END PGP SIGNATURE----- Merge tag 'cgroup-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup Pull cgroup updates from Tejun Heo: - A write to cgroup.subtree_control or cgroup.type could hang in D state for as long as a task pinning a dying controller took to exit, as syzbot reported. The wait is now interruptible. - cpuset: the deadline bandwidth check ran on cpusets that weren't valid partition roots, failing cpuset writes with -EBUSY while deadline tasks existed. The CPU count the fair class takes from cpuset assumed a shared hierarchy that cgroup1 may not have. - Finding a cgroup's effective controller state no longer walks up the hierarchy, for per-I/O users such as nvmet. io.stat reads of cgroups without block devices skip the stat flush. - cpuset v1-only code moved to the v1 file and the exclusive flag dropped from v2, with documentation corrections for partition roots and boot-isolated CPUs. - Dead cgroups fail writes with -ENODEV consistently, plus small cleanups. - Selftest fixes, most visibly for tests that skipped on machines with many mounts, and a new pids.events notification test. * tag 'cgroup-for-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (27 commits) selftests/cgroup: test pids.events notification selftests: cgroup: make test_memcg_sock check flushed sock stats selftests: cgroup: skip test_memcg_sock under cgroup.memory=nosocket selftests/cgroup: Free the paths returned by cg_control() selftests: memcg: Don't close an uninitialized fd cgroup: Track the effective css in each cgroup cgroup/cpuset: Move cpuset_update_flag() to cpuset-v1.c selftests: cgroup: Preserve command arguments in with_stress.sh selftests: cgroup: Enable the cpu controller in test_cpu cgroup/cpuset: Use cpuset_v2() in cpuset_num_cpus() selftests/cgroup: add settings file with a longer timeout cgroup/cpuset: Remove CS_CPU_EXCLUSIVE handling code from v2 cgroup/cpuset: Run SCHED_DEADLINE shrink test on valid partition root only docs: cgroup-v2: Describe effective CPUs of partition roots docs: cgroup-v2: Describe boot-isolated CPUs in cpuset.cpus.isolated cgroup/cpuset: Remove redundant sched domain rebuild from update_prstate() selftests/cgroup: don't crash on a truncated mount entry in cg_find_root() selftests/cgroup: read the entire file in read_text() blk-cgroup: skip rstat flush for cgroups without blkgs cgroup: use assign_bit() where applicable ... |
||
|
Christian Brauner
|
c84de57efe
|
super: convert to plain hashtable
Convert the rhltable to a plain hashtable under a spinlock. The walks
keep their place with a cursor entry in the chain. A claim is unhashed
the moment it's dropped and a walk that finds a superblock that isn't
born yet waits for it to be born or to die and looks again. Since
hashing can't fail anymore the entry for the superblock's own s_dev is
embedded in struct super_block and the preallocation in alloc_super()
goes away. This all simplifies things quite a lot.
It also fixes a btrfs bug where fs_bdev_freeze() ended up freezing a
btrfs filesystem through a stale member that open_ctree() had already
released while the freeze was waiting for SB_BORN. The resume doesn't
find a holder for that device anymore so the filesystem stays frozen
for good.
The walks return superblocks instead of table entries now and
user_get_super() hands out the passive reference the walk took.
Reproducer, a three device btrfs with a stale copy of a removed member.
dm-delay under the remaining members stretches the window between
btrfs_open_devices() and btrfs_free_extra_devids():
truncate -s 1G a1 a2 b
A1=$(losetup -f --show a1); A2=$(losetup -f --show a2); B=$(losetup -f --show b)
mkfs.btrfs -f -d single -m single $A1 $A2 $B
cp b b.old
mount $A1 /mnt && btrfs device remove 3 /mnt && umount /mnt
OLD=$(losetup -f --show b.old)
dmsetup create d1 --table "0 $(blockdev --getsz $A1) delay $A1 0 200"
dmsetup create d2 --table "0 $(blockdev --getsz $A2) delay $A2 0 200"
dmsetup create old --table "0 $(blockdev --getsz $OLD) linear $OLD 0"
mount -o device=/dev/mapper/d2,device=/dev/mapper/old /dev/mapper/d1 /mnt &
sleep 1; dmsetup suspend old; wait
dmsetup resume old
touch /mnt/foo # hangs until fsfreeze -u /mnt
That left btrfs frozen in 5 of 5 rounds with the same tables issued
through raw dm ioctls. The -o degraded variant needs the mount held
between the insertion and the bd_fsfreeze_count check in
fs_bdev_register() with a kprobe.
Fixes:
|
||
|
Keith Busch
|
bcbd808652 |
block: reject dma-bufs larger than 4GiB
The dma-buf offset is set in the 32-bit bvec_iter bi_offset. Reject
buffers that can carry an offset that would wrap.
Fixes:
|
||
|
Andrew Morton
|
40d070cbb1 |
block: restore the iterator when rejecting a misaligned bio
bio_iov_iter_get_pages() can extract some iovecs before encountering a
misaligned one. It releases the pages and rejects the entire bio, but
leaves the supplied iterator advanced.
An iomap direct-I/O caller may subsequently reexpand the iterator's
byte count and fall back to buffered I/O. The reexpanded count then
includes bytes before the iterator's current segment, potentially
causing iterate_iovec() to read beyond the imported iovec array.
In a reproducer using an initial empty iovec followed by 10-byte and
1015-byte segments, writev() returned 1015 instead of 1025 and KASAN
reported an 8-byte read beyond the nine-element iovec allocation.
Saving and restoring the iterator on the rejected-bio path makes
writev() return 1025 and eliminates the KASAN report.
Restore the entire iterator rather than reverting a byte count:
advancing past an empty segment changes its position without consuming
any bytes.
Leave successful and partially accepted bio paths unchanged.
Fixes:
|
||
|
Nirmoy Das
|
afc1de47a7 |
blk-mq: clear stale inactive flag on hctx reuse
When the last CPU mapped to an hctx goes offline,
blk_mq_hctx_notify_offline() sets BLK_MQ_S_INACTIVE. Updating the
number of hardware queues exits every hctx and parks it on
q->unused_hctx_list. A later update can reuse a parked hctx through
blk_mq_alloc_and_init_hctx(), at any queue index, and nothing clears
the flag.
If the reused hctx is mapped to an online CPU, blk_mq_get_tag() keeps
returning BLK_MQ_NO_TAG for it. __blk_mq_alloc_requests() sleeps and
retries, expecting CPU hotplug to move the task to another CPU, so a
task that stays on that CPU never gets a tag. Onlining the original CPU
doesn't recover it either, because blk_mq_hctx_notify_online() only
clears the flag on the hctx that CPU now maps to.
Clear BLK_MQ_S_INACTIVE in blk_mq_init_hctx() so a reused hctx starts
like a freshly allocated one. A reused hctx has no cpuhp instances at
that point, so the offline callback can't set the flag again before
blk_mq_add_hw_queues_cpuhp() registers it. Clearing the flag in
blk_mq_exit_hctx() is not enough, because a parked hctx keeps its cpuhp
instances until blk_mq_remove_hw_queues_cpuhp(). Preserve the other
hctx state flags.
Reproduced with null_blk on v7.3 in a four-vCPU arm64 QEMU/KVM guest:
modprobe null_blk nr_devices=0
mkdir /sys/kernel/config/nullb/nullb0
cd /sys/kernel/config/nullb/nullb0
echo 4 > submit_queues; echo 1 > memory_backed; echo 16 > size
echo 1 > power
echo 0 > /sys/devices/system/cpu/cpu3/online
echo 2 > submit_queues
echo 4 > submit_queues
Offlining CPU3 marks hctx3 inactive. After the two updates it comes back
as hctx1 and is mapped to CPU0:
# cat /sys/block/nullb0/mq/1/cpu_list
0
# cat /sys/kernel/debug/block/nullb0/hctx1/state
INACTIVE
A 4K O_DIRECT read pinned to CPU0 hangs in D state, while the same read
on CPU1 and CPU2 completes. Onlining CPU3 again leaves hctx1 inactive
and the CPU0 read still hangs. With this change hctx1 state is empty and
the reads on CPU0, CPU1 and CPU2 complete, before and after onlining
CPU3.
Fixes:
|
||
|
Linus Torvalds
|
27dd2772e6 |
vfs-7.4-rc1.iomap
Please consider pulling these changes from the signed vfs-7.4-rc1.iomap tag.
Thanks!
Christian
-----BEGIN PGP SIGNATURE-----
iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCatHrlgAKCRCRxhvAZXjc
okLFAQDtL+joq4F75iD2qaULpmj7kWby23E7u88ccIVUONbpWgD+L0S5lPCd4upL
fGyRMlQOybiRX1uHH13xGPU9wZ2Iggk=
=ZSC6
-----END PGP SIGNATURE-----
Merge tag 'vfs-7.4-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs
Pull iomap updates from Christian Brauner:
"This contains the iomap changes for this cycle.
The bulk is lazy bounce buffering for checksummed reads. XFS bounce
buffers every direct read on a device that requires stable pages for
checksumming so that userspace modifying the buffer while the read is
in flight can't corrupt the data and fail the checksum.
That burns DRAM bandwidth and CPU for copies that are almost never
needed and, since the bounce buffer was a bio_vec, produced smaller
and unaligned I/Os with 4k pages, i.e. 1 MB minus 4k.
Now the read goes to the user buffer first and only a checksum failure
allocates a bounce buffer and reads again. Integrity verification
moves out of iomap into the filesystem so it can handle errors its own
way, T10 PI handling for direct I/O moves into ->submit_io() to match
buffered I/O, and a sysfs knob restores the old behaviour for the rare
application that really does modify in-flight buffers.
The block side gains bio_prepare_reissue(), exports
fs_bio_integrity_{alloc,free}(), caps atomic writes by the PI buffer
size and fixes an integer overflow in max_integrity_io_size() and a PI
verification bug with an initial bvec offset. The old read side bounce
buffering in the block layer is removed. This is a branch shared with
the block tree and may also reach you through the block pull request.
Three error handling regressions are fixed:
- A failed ->writeback_submit() left wpc->wb_ctx pointing at an
already completed ioend which was then submitted a second time and
corrupted ip->i_ioend_list on XFS
- iomap_fiemap() lost an iteration error when it flushed the pending
extent and marked a truncated list as complete
- A failed direct I/O bio lost its error when the sub-block tail
zeroing succeeded. An XFS error tag to inject the writeback failure
comes with it.
iomap_dio_hole_iter() respects the block size alignment when
iov_iter_zero() stops short at a page boundary, which btrfs with 8k
blocks on 4k pages hit as an assertion since it disables page faults
during direct I/O. The homegrown deferral of error completions to task
context is replaced with bio_complete_in_task(). Plus an unused
parameter, two typo fixes and a kernel-doc fix"
* tag 'vfs-7.4-rc1.iomap' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (34 commits)
fs/iomap: document ret parameter of iomap_iter_continue
iomap: follow the alignment requirement for iomap_dio_hole_iter()
iomap: don't lose a failed direct I/O bio's error when zeroing the tail
iomap: don't lose a fiemap iteration error when emitting the last extent
xfs: add an error tag to inject a ->writeback_submit() failure
iomap: don't resubmit an ioend after ->writeback_submit() failed
iomap: use bio_complete_in_task for buffered simple dio read failures
iomap: use bio_complete_in_task for buffered write failures
iomap: use bio_complete_in_task for buffered read failures
block,iomap: remove the old read side bounce buffering support
xfs: log a message at mount time when using integrity protection
xfs: add error injection for lazy bounce buffering
xfs: add support for lazy direct read bounce buffering
iomap,xfs: move integrity verification to the file system
xfs: use BIO_COMPLETE_IN_TASK for bounce buffered read I/Os
iomap: better read bounce buffering support
block,iomap: fix protection information verification with initial bvec offset
xfs: move PI generation into xfs_submit_zoned_bio
iomap,xfs: move T10 PI handling for direct I/O into ->submit_io
iomap: add a IOMAP_IOEND_INTEGRITY flag
...
|
||
|
Li RongQing
|
00c2c34ead |
block, bfq: initialize active lists for all actuators
Commit |
||
|
Linus Torvalds
|
f909e534f5 |
SCSI fixes on 20261018
All fixes in drivers (or the tape ULD) and one core fix to bsg (the block ioctl equivalent of sg_io). The biggest is the race in auth updates fix in iscsi configfs, but the next biggest one is in bsg but the generic pieces of that are mostly threading reply_len. Signed-off-by: James E.J. Bottomley <James.Bottomley@HansenPartnership.com> -----BEGIN PGP SIGNATURE----- iLgEABMIAGAWIQTnYEDbdso9F2cI+arnQslM7pishQUCatTZmRsUgAAAAAAEAA5t YW51MiwyLjUrMS4xMiwyLDImHGphbWVzLmJvdHRvbWxleUBoYW5zZW5wYXJ0bmVy c2hpcC5jb20ACgkQ50LJTO6YrIWZfAD/ZC6Pwo0OMS8MuYYGwb+fF2YM0Msr+zAG 4gDRU5yDWl0A/jEw1iFbmGyoNTtBTHSE9I38j/nRAaa+UT/JeS4q0g1E =wBqG -----END PGP SIGNATURE----- Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi Pull SCSI fixes from James Bottomley: "All fixes in drivers (or the tape ULD) and one core fix to bsg (the block ioctl equivalent of sg_io). The biggest is the race in auth updates fix in iscsi configfs, but the next biggest one is in bsg but the generic pieces of that are mostly threading reply_len" * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi: scsi: bsg: Pass reply_len to bsg_setup_queue() to fit UFS ARPMB replies scsi: libsas: Fix SMP IO deadlock during HA resume scsi: libiscsi: Validate the task named by a management response scsi: libiscsi: Validate the ITT reflected in a Reject PDU scsi: libiscsi: Reject a negative task index from parse_pdu_itt scsi: target: iscsi: Fix race in discovery auth updates scsi: target: Disable interrupts while holding delayed_cmd_lock scsi: st: Fix use-after-free race between st_remove() and st_open() scsi: st: Save the visited block for the partition the drive is in scsi: xen/scsifront: Check for a NULL shadow entry on a backend response |
||
|
Qiliang Yuan
|
5f702d4bd6 |
blk-mq: drop the tag_set argument from blk_mq_free_rq_map/tags
Commit
|
||
|
Qiliang Yuan
|
e1c51edd6a |
blk-mq: share one tags_srcu instance across all tag sets
Freed request pages and flush queues are handed to call_srcu() so that
concurrent tag iterators never see them disappear. Each tag set embeds
its own srcu_struct for this, which blk_mq_free_tag_set() has to drain
with srcu_barrier() before cleanup_srcu_struct(). The barrier waits for
a full SRCU grace period even when the callbacks are long done, adding
1-3 ms to every tag set teardown. Drivers that free tag sets under a
lock make it worse: ublk does it under the global ublk_ctl_mutex, so
deleting devices from many threads serializes on that grace period.
The callbacks free memory that only blk-mq owns. They touch neither
the tag set nor driver code, so they don't need a per-set domain.
Replace the per-set srcu_struct with a single global one. Freeing a tag
set no longer waits for a grace period, and each tag set no longer
allocates per-CPU SRCU state. The read side is unchanged. The only cost
is that a long-running iterator can now delay these frees for other tag
sets too, which only postpones freeing memory.
On 7.3-rc5 in a 16-vCPU VM, with 1 queue and depth 16 per ublk device,
median of 3 runs (5 for the 16-thread null_blk case):
before after
ublk DEL_DEV p50, serial 3.45 ms 0.17 ms
ublk delete 1000 devices, serial 19.5 s 14.9 s
ublk delete 4000 devices, 16 thr 19.0 s 2.9 s
null_blk destroy 500 devs, serial 9.97 s 9.25 s
null_blk destroy 256 devs, 16 thr 5.15 s 4.30 s
Fixes:
|
||
|
Pavel Begunkov
|
20d808694e |
block: fix indention for dma-buf checks
There is a weird indention I botched while rebasing, fix it. Signed-off-by: Pavel Begunkov <asml.silence@gmail.com> Link: https://patch.msgid.link/de91f480f8507d44ddf99c193ef63dec0f02c749.1792142187.git.asml.silence@gmail.com Signed-off-by: Jens Axboe <axboe@kernel.dk> |
||
|
Tao Cui
|
40607f9a6a |
blk-iocost: fix stale comment in ioc_rqos_throttle()
The comment says that priority-inversion IOs are "punted to
@ioc->aux_iocg", but no aux_iocg field ever existed in struct ioc.
The comment was introduced already stale by commit
|
||
|
Tao Cui
|
c38975c427 |
blk-iocost: account zone append completions in latency stats
ioc_rqos_done() only accounts READ and WRITE completions, so zone
append completions are excluded from the latency window: the vrate
feedback loop cannot see ZA-induced latency, leaving it unable to
respond to device saturation caused by zone appends. Similarly,
calc_size_vtime_cost_builtin() does not classify zone append as a
write operation.
Charging (the cost model) and feedback (the latency window) are
separate mechanisms, so this is not covered by the previous patch
that prices zone appends.
Treat zone append as WRITE for both latency accounting and cost
classification.
Fixes:
|
||
|
Tao Cui
|
febdbf5682 |
blk-iocost: charge zone appends as writes
Zone append is a primary write operation for zoned devices; zoned xfs
and btrfs use it for data writes. It is priced at zero, so the zone
append portion of zoned workloads runs outside the controller: a
1%-weight cgroup issued 16000 appends at zero cost on a zoned null_blk.
Treat REQ_OP_ZONE_APPEND the same as REQ_OP_WRITE so it goes through
the existing seq/rand classification and charging.
Fixes:
|
||
|
Tao Cui
|
f8bc5c74d9 |
blk-iocost: add flush cost support with the flushiops model parameter
The builtin linear cost model defines coefficients only for READ and WRITE, so the flush component of IOs is priced at zero: standalone flushes (the dataless REQ_OP_WRITE | REQ_PREFLUSH bios from blkdev_issue_flush()) and the pre-flush the block layer issues ahead of data-bearing REQ_PREFLUSH bios are both free. A cgroup limited to 1% weight could issue an unbounded number of flushes without being throttled: an fsync loop produced ~510k flushes in 12s with cost.usage staying at zero, monopolizing the device while iocost reported no activity. On ext4, a write+fsync workload showed the same gap: the write component was charged but the flush component was not. A flush is not like a write and the write coefficients say nothing about what it costs, so instead of pricing it off them, add a flushiops entry to io.cost.model, following the existing iops parameters: it sets the rate at which flushes are charged, LCOEF_FLUSH = VTIME_PER_SEC / flushiops. The linear model cannot express how the cost of a flush depends on the preceding writes, so this is a per-request policy charge: a user-tunable knob rather than a hardware property. A bio with REQ_PREFLUSH is charged one flush on top of its data cost, and a bio with REQ_FUA one more flush on devices without native FUA support. Zero (the default and the builtin profiles) means no charge, so nothing changes until the parameter is configured. Also skip the iocg->cursor update for dataless bios: they only reach it once priced, and their bi_sector is not a data position, so setting the cursor from it would misclassify the following IOs. Signed-off-by: Tao Cui <cuitao@kylinos.cn> Acked-by: Tejun Heo <tj@kernel.org> Link: https://patch.msgid.link/20260922043856.2020116-2-cui.tao@linux.dev Signed-off-by: Jens Axboe <axboe@kernel.dk> |