summaryrefslogtreecommitdiff
AgeCommit message (Collapse)Author
2023-08-24dt-bindings: Drop remaining unneeded quotesRob Herring
Cleanup bindings dropping the last remaining unneeded quotes. With this, the check for this can be enabled in yamllint. Acked-by: Miquel Raynal <miquel.raynal@bootlin.com> # for mtd Acked-by: Sudeep Holla <sudeep.holla@arm.com> Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Acked-by: Mark Brown <broonie@kernel.org> Acked-by: Wolfram Sang <wsa@kernel.org> # for AT24/I2C Acked-by: Guenter Roeck <linux@roeck-us.net> Acked-by: Ulf Hansson <ulf.hansson@linaro.org> # For MMC Acked-by: Geert Uytterhoeven <geert+renesas@glider.be> Link: https://lore.kernel.org/r/20230823183749.2609013-1-robh@kernel.org Signed-off-by: Rob Herring <robh@kernel.org>
2023-08-24Merge branch 'add-support-cpu-v4-insns-for-rv64'Alexei Starovoitov
Pu Lehui says: ==================== Add support cpu v4 insns for RV64 Add support cpu v4 instructions for RV64. The relevant tests have passed as show bellow: Summary: 6/166 PASSED, 0 SKIPPED, 0 FAILED NOTE: ldsx_insn testcase uses fentry and needs to rely on ftrace direct call [0]. [0] https://lore.kernel.org/all/20230627111612.761164-1-suagrfillet@gmail.com/ v2: - Use temporary reg to avoid clobbering the source reg in movs_8/16 insns. (Björn) - Add Acked-by v1: https://lore.kernel.org/bpf/20230823231059.3363698-1-pulehui@huaweicloud.com ==================== Tested-by: Björn Töpel <bjorn@rivosinc.com> Link: https://lore.kernel.org/r/20230824095001.3408573-1-pulehui@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-24selftests/bpf: Enable cpu v4 tests for RV64Pu Lehui
Enable cpu v4 tests for RV64, and the relevant tests have passed. Signed-off-by: Pu Lehui <pulehui@huawei.com> Acked-by: Yonghong Song <yonghong.song@linux.dev> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/r/20230824095001.3408573-8-pulehui@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-24riscv, bpf: Support unconditional bswap insnPu Lehui
Add support unconditional bswap instruction. Since riscv is always little-endian, just treat the unconditional scenario the same as big-endian conversion. Signed-off-by: Pu Lehui <pulehui@huawei.com> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/r/20230824095001.3408573-7-pulehui@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-24riscv, bpf: Support signed div/mod insnsPu Lehui
Add support signed div/mod instructions for RV64. Signed-off-by: Pu Lehui <pulehui@huawei.com> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/r/20230824095001.3408573-6-pulehui@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-24riscv, bpf: Support 32-bit offset jmp insnPu Lehui
Add support 32-bit offset jmp instruction for RV64. Signed-off-by: Pu Lehui <pulehui@huawei.com> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/r/20230824095001.3408573-5-pulehui@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-24riscv, bpf: Support sign-extension mov insnsPu Lehui
Add support sign-extension mov instructions for RV64. Signed-off-by: Pu Lehui <pulehui@huawei.com> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/r/20230824095001.3408573-4-pulehui@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-24riscv, bpf: Support sign-extension load insnsPu Lehui
Add Support sign-extension load instructions for RV64. Signed-off-by: Pu Lehui <pulehui@huawei.com> Acked-by: Björn Töpel <bjorn@kernel.org> Link: https://lore.kernel.org/r/20230824095001.3408573-3-pulehui@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-24riscv, bpf: Fix missing exception handling and redundant zext for LDX_B/H/WPu Lehui
For LDX_B/H/W, when zext has been inserted by verifier, it'll return 1, and no exception handling will continue. Also, when the offset is 12-bit value, the redundant zext inserted by the verifier is not removed. Fix both scenarios by moving down the removal of redundant zext. Signed-off-by: Pu Lehui <pulehui@huawei.com> Link: https://lore.kernel.org/r/20230824095001.3408573-2-pulehui@huaweicloud.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-24Merge branch 'samples-bpf-remove-unmaintained-xdp-sample-utilities'Alexei Starovoitov
Toke Høiland-Jørgensen says: ==================== samples/bpf: Remove unmaintained XDP sample utilities The samples/bpf directory in the kernel tree started out as a way of showcasing different aspects of BPF functionality by writing small utility programs for each feature. However, as the BPF subsystem has matured, the preferred way of including userspace code with a feature has become the BPF selftests, which also have the benefit of being consistently run as part of the BPF CI system. As a result of this shift, the utilities in samples/bpf have seen little love, and have slowly bitrotted. There have been sporadic cleanup patches over the years, but it's clear that the utilities are far from maintained. For XDP in particular, some of the utilities have been used as benchmarking aids when implementing new kernel features, which seems to be the main reason they have stuck around; any updates the utilities have seen have been targeted at this use case. However, as the BPF subsystem as a whole has moved on, it has become increasingly difficult to incorporate new features into these utilities because they predate most of the modern BPF features (such as kfuncs and BTF). Rather than try to update these utilities and keep maintaining them in the kernel tree, we have ported the useful features of the utilities to the xdp-tools package. In the porting process we also updated the utilities to take advantage of modern BPF features, integrated them with libxdp, and polished the user interface. As these utilities are standalone tools, maintaining them out of tree is simpler, and we plan to keep maintaining them in the xdp-tools repo. To direct users of these utilities to the right place, this series removes the utilities from samples/bpf, leaving in place only a couple of utilities whose functionality have not yet been ported to xdp-tools. The xdp-tools repository is located on Github at the following URL: https://github.com/xdp-project/xdp-tools The commits in the series removes one utility each, explaining how the equivalent functionality can be obtained with xdp-tools. v2: - Add equivalent xdp-tools commands for each removed utility v3: - Add link to xdp-tools in the README Toke Høiland-Jørgensen (7): samples/bpf: Remove the xdp_monitor utility samples/bpf: Remove the xdp_redirect* utilities samples/bpf: Remove the xdp_rxq_info utility samples/bpf: Remove the xdp1 and xdp2 utilities samples/bpf: Remove the xdp_sample_pkts utility samples/bpf: Cleanup .gitignore samples/bpf: Add note to README about the XDP utilities moved to xdp-tools samples/bpf/.gitignore | 12 - samples/bpf/Makefile | 48 +- samples/bpf/README.rst | 6 + samples/bpf/xdp1_kern.c | 100 ---- samples/bpf/xdp1_user.c | 166 ------ samples/bpf/xdp2_kern.c | 125 ----- samples/bpf/xdp_monitor.bpf.c | 8 - samples/bpf/xdp_monitor_user.c | 118 ----- samples/bpf/xdp_redirect.bpf.c | 49 -- samples/bpf/xdp_redirect_cpu.bpf.c | 539 ------------------- samples/bpf/xdp_redirect_cpu_user.c | 559 -------------------- samples/bpf/xdp_redirect_map.bpf.c | 97 ---- samples/bpf/xdp_redirect_map_multi.bpf.c | 77 --- samples/bpf/xdp_redirect_map_multi_user.c | 232 -------- samples/bpf/xdp_redirect_map_user.c | 228 -------- samples/bpf/xdp_redirect_user.c | 172 ------ samples/bpf/xdp_rxq_info_kern.c | 140 ----- samples/bpf/xdp_rxq_info_user.c | 614 ---------------------- samples/bpf/xdp_sample_pkts_kern.c | 57 -- samples/bpf/xdp_sample_pkts_user.c | 196 ------- 20 files changed, 7 insertions(+), 3536 deletions(-) delete mode 100644 samples/bpf/xdp1_kern.c delete mode 100644 samples/bpf/xdp1_user.c delete mode 100644 samples/bpf/xdp2_kern.c delete mode 100644 samples/bpf/xdp_monitor.bpf.c delete mode 100644 samples/bpf/xdp_monitor_user.c delete mode 100644 samples/bpf/xdp_redirect.bpf.c delete mode 100644 samples/bpf/xdp_redirect_cpu.bpf.c delete mode 100644 samples/bpf/xdp_redirect_cpu_user.c delete mode 100644 samples/bpf/xdp_redirect_map.bpf.c delete mode 100644 samples/bpf/xdp_redirect_map_multi.bpf.c delete mode 100644 samples/bpf/xdp_redirect_map_multi_user.c delete mode 100644 samples/bpf/xdp_redirect_map_user.c delete mode 100644 samples/bpf/xdp_redirect_user.c delete mode 100644 samples/bpf/xdp_rxq_info_kern.c delete mode 100644 samples/bpf/xdp_rxq_info_user.c delete mode 100644 samples/bpf/xdp_sample_pkts_kern.c delete mode 100644 samples/bpf/xdp_sample_pkts_user.c ==================== Link: https://lore.kernel.org/r/20230824102255.1561885-1-toke@redhat.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-24samples/bpf: Add note to README about the XDP utilities moved to xdp-toolsToke Høiland-Jørgensen
To help users find the XDP utilities, add a note to the README about the new location and the conversion documentation in the commit messages. Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Link: https://lore.kernel.org/r/20230824102255.1561885-8-toke@redhat.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-24samples/bpf: Cleanup .gitignoreToke Høiland-Jørgensen
Remove no longer present XDP utilities from .gitignore. Apart from the recently removed XDP utilities this also includes the previously removed xdpsock and xsk utilities. Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Link: https://lore.kernel.org/r/20230824102255.1561885-7-toke@redhat.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-24samples/bpf: Remove the xdp_sample_pkts utilityToke Høiland-Jørgensen
The functionality of this utility is covered by the xdpdump utility in xdp-tools. There's a slight difference in usage as the xdpdump utility's main focus is to dump packets before or after they are processed by an existing XDP program. However, xdpdump also has the --load-xdp-program switch, which will make it attach its own program if no existing program is loaded. With this, xdp_sample_pkts usage can be converted as: xdp_sample_pkts eth0 --> xdpdump --load-xdp-program eth0 To get roughly equivalent behaviour. Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Link: https://lore.kernel.org/r/20230824102255.1561885-6-toke@redhat.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-24samples/bpf: Remove the xdp1 and xdp2 utilitiesToke Høiland-Jørgensen
The functionality of these utilities have been incorporated into the xdp-bench utility in xdp-tools. Equivalent functionality is: xdp1 eth0 --> xdp-bench drop -p parse-ip -l load-bytes eth0 xdp2 eth0 --> xdp-bench drop -p swap-macs eth0 Note that there's a slight difference in behaviour of those examples: the swap-macs operation of xdp-bench doesn't use the bpf_xdp_load_bytes() helper to load the packet data, whereas the xdp2 utility did so unconditionally. For the parse-ip action the use of bpf_xdp_load_bytes() can be selected by the '-l load-bytes' switch, with the difference that the xdp-bench utility will perform two separate calls to the helper, one to load the ethernet header and another to load the IP header; where the xdp1 utility only performed one call always loading 60 bytes of data. Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Link: https://lore.kernel.org/r/20230824102255.1561885-5-toke@redhat.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-24samples/bpf: Remove the xdp_rxq_info utilityToke Høiland-Jørgensen
The functionality of this utility has been incorporated into the xdp-bench utility in xdp-tools, by way of the --rxq-stats argument to the 'drop', 'pass' and 'tx' commands of xdp-bench. Some examples of how to convert xdp_rxq_info invocations into equivalent xdp-bench commands: xdp_rxq_info -d eth0 --> xdp-bench pass --rxq-stats eth0 xdp_rxq_info -d eth0 -a XDP_DROP -m --> xdp-bench drop --rxq-stats -p swap-macs eth0 Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Link: https://lore.kernel.org/r/20230824102255.1561885-4-toke@redhat.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-24samples/bpf: Remove the xdp_redirect* utilitiesToke Høiland-Jørgensen
These utilities have all been ported to xdp-tools as functions of the xdp-bench utility. The four different utilities in samples are incorporated as separate subcommands to xdp-bench, with most of the command line parameters left intact, except that mandatory arguments are always positional in xdp-bench. For full usage details see the --help output of each command, or the xdp-bench man page. Some examples of how to convert usage to xdp-bench are: xdp_redirect eth0 eth1 --> xdp-bench redirect eth0 eth1 xdp_redirect_map eth0 eth1 --> xdp-bench redirect-map eth0 eth1 xdp_redirect_map_multi eth0 eth1 eth2 eth3 --> xdp-bench redirect-multi eth0 eth1 eth2 eth3 xdp_redirect_cpu -d eth0 -c 0 -c 1 --> xdp-bench redirect-cpu -c 0 -c 1 eth0 xdp_redirect_cpu -d eth0 -c 0 -c 1 -r eth1 --> xdp-bench redirect-cpu -c 0 -c 1 eth0 -r redirect -D eth1 Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Link: https://lore.kernel.org/r/20230824102255.1561885-3-toke@redhat.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-24samples/bpf: Remove the xdp_monitor utilityToke Høiland-Jørgensen
This utility has been ported as-is to xdp-tools as 'xdp-monitor'. The only difference in usage between the samples and xdp-tools versions is that the '-v' command line parameter has been changed to '-e' in the xdp-tools version for consistency with the other utilities. Signed-off-by: Toke Høiland-Jørgensen <toke@redhat.com> Link: https://lore.kernel.org/r/20230824102255.1561885-2-toke@redhat.com Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-24PCI: brcmstb: Remove stale commentJim Quinlan
A comment says that Multi-MSI is not supported by the driver. A past commit [1] added this feature, so the comment is incorrect and is removed. [1] commit 198acab1772f22f2 ("PCI: brcmstb: Enable Multi-MSI") Link: https://lore.kernel.org/r/20230623144100.34196-6-james.quinlan@broadcom.com Signed-off-by: Jim Quinlan <james.quinlan@broadcom.com> Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org> Acked-by: Florian Fainelli <f.fainelli@gmail.com>
2023-08-24PCI: brcmstb: Assert PERST# on BCM2711Jim Quinlan
The current PCIe driver assumes PERST# is asserted when probe() is invoked. Some older versions of the 2711/RPi bootloader left PERST# unasserted, as the Raspian OS does assert PERST# on probe(). For this reason, we assert PERST# for BCM2711 SOCs (i.e. RPi). Link: https://lore.kernel.org/r/20230623144100.34196-5-james.quinlan@broadcom.com Signed-off-by: Jim Quinlan <james.quinlan@broadcom.com> Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org>
2023-08-24Merge tag 'net-6.5-rc8' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Paolo Abeni: "Including fixes from wifi, can and netfilter. Fixes to fixes: - nf_tables: - GC transaction race with abort path - defer gc run if previous batch is still pending Previous releases - regressions: - ipv4: fix data-races around inet->inet_id - phy: fix deadlocking in phy_error() invocation - mdio: fix C45 read/write protocol - ipvlan: fix a reference count leak warning in ipvlan_ns_exit() - ice: fix NULL pointer deref during VF reset - i40e: fix potential NULL pointer dereferencing of pf->vf in i40e_sync_vsi_filters() - tg3: use slab_build_skb() when needed - mtk_eth_soc: fix NULL pointer on hw reset Previous releases - always broken: - core: validate veth and vxcan peer ifindexes - sched: fix a qdisc modification with ambiguous command request - devlink: add missing unregister linecard notification - wifi: mac80211: limit reorder_buf_filtered to avoid UBSAN warning - batman: - do not get eth header before batadv_check_management_packet - fix batadv_v_ogm_aggr_send memory leak - bonding: fix macvlan over alb bond support - mlxsw: set time stamp fields also when its type is MIRROR_UTC" * tag 'net-6.5-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (54 commits) selftests: bonding: add macvlan over bond testing selftest: bond: add new topo bond_topo_2d1c.sh bonding: fix macvlan over alb bond support rtnetlink: Reject negative ifindexes in RTM_NEWLINK netfilter: nf_tables: defer gc run if previous batch is still pending netfilter: nf_tables: fix out of memory error handling netfilter: nf_tables: use correct lock to protect gc_list netfilter: nf_tables: GC transaction race with abort path netfilter: nf_tables: flush pending destroy work before netlink notifier netfilter: nf_tables: validate all pending tables ibmveth: Use dcbf rather than dcbfl i40e: fix potential NULL pointer dereferencing of pf->vf i40e_sync_vsi_filters() net/sched: fix a qdisc modification with ambiguous command request igc: Fix the typo in the PTM Control macro batman-adv: Hold rtnl lock during MTU update via netlink igb: Avoid starting unnecessary workqueues can: raw: add missing refcount for memory leak fix can: isotp: fix support for transmission of SF without flow control bnx2x: new flag for track HW resource allocation sfc: allocate a big enough SKB for loopback selftest packet ...
2023-08-24selftests/bpf: Add a local kptr test with no special fieldsYonghong Song
Add a local kptr test with no special fields in the struct. Without the previous patch, the following warning will hit: [ 44.683877] WARNING: CPU: 3 PID: 485 at kernel/bpf/syscall.c:660 bpf_obj_free_fields+0x220/0x240 [ 44.684640] Modules linked in: bpf_testmod(OE) [ 44.685044] CPU: 3 PID: 485 Comm: kworker/u8:5 Tainted: G OE 6.5.0-rc5-01703-g260d855e9b90 #248 [ 44.685827] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 [ 44.686693] Workqueue: events_unbound bpf_map_free_deferred [ 44.687297] RIP: 0010:bpf_obj_free_fields+0x220/0x240 [ 44.687775] Code: e8 55 17 1f 00 49 8b 74 24 08 4c 89 ef e8 e8 14 05 00 e8 a3 da e2 ff e9 55 fe ff ff 0f 0b e9 4e fe ff ff 0f 0b e9 47 fe ff ff <0f> 0b e8 d9 d9 e2 ff 31 f6 eb d5 48 83 c4 10 5b 41 5c e [ 44.689353] RSP: 0018:ffff888106467cb8 EFLAGS: 00010246 [ 44.689806] RAX: 0000000000000000 RBX: ffff888112b3a200 RCX: 0000000000000001 [ 44.690433] RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffff8881128ad988 [ 44.691094] RBP: 0000000000000002 R08: ffffffff81370bd0 R09: 1ffff110216231a5 [ 44.691643] R10: dffffc0000000000 R11: ffffed10216231a6 R12: ffff88810d68a488 [ 44.692245] R13: ffff88810767c288 R14: ffff88810d68a400 R15: ffff88810d68a418 [ 44.692829] FS: 0000000000000000(0000) GS:ffff8881f7580000(0000) knlGS:0000000000000000 [ 44.693484] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 44.693964] CR2: 000055c7f2afce28 CR3: 000000010fee4002 CR4: 0000000000370ee0 [ 44.694513] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 44.695102] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 44.695747] Call Trace: [ 44.696001] <TASK> [ 44.696183] ? __warn+0xfe/0x270 [ 44.696447] ? bpf_obj_free_fields+0x220/0x240 [ 44.696817] ? report_bug+0x220/0x2d0 [ 44.697180] ? handle_bug+0x3d/0x70 [ 44.697507] ? exc_invalid_op+0x1a/0x50 [ 44.697887] ? asm_exc_invalid_op+0x1a/0x20 [ 44.698282] ? btf_find_struct_meta+0xd0/0xd0 [ 44.698634] ? bpf_obj_free_fields+0x220/0x240 [ 44.699027] ? bpf_obj_free_fields+0x1e2/0x240 [ 44.699414] array_map_free+0x1a3/0x260 [ 44.699763] bpf_map_free_deferred+0x7b/0xe0 [ 44.700154] process_one_work+0x46d/0x750 [ 44.700523] worker_thread+0x49e/0x900 [ 44.700892] ? pr_cont_work+0x270/0x270 [ 44.701224] kthread+0x1ae/0x1d0 [ 44.701516] ? kthread_blkcg+0x50/0x50 [ 44.701860] ret_from_fork+0x34/0x50 [ 44.702178] ? kthread_blkcg+0x50/0x50 [ 44.702508] ret_from_fork_asm+0x11/0x20 [ 44.702880] </TASK> With the previous patch, there is no warnings. Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20230824063422.203097-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-24bpf: Remove a WARN_ON_ONCE warning related to local kptrYonghong Song
Currently, in function bpf_obj_free_fields(), for local kptr, a warning will be issued if the struct does not contain any special fields. But actually the kernel seems totally okay with a local kptr without any special fields. Permitting no special fields also aligns with future percpu kptr which also allows no special fields. Acked-by: Dave Marchevsky <davemarchevsky@fb.com> Signed-off-by: Yonghong Song <yonghong.song@linux.dev> Link: https://lore.kernel.org/r/20230824063417.201925-1-yonghong.song@linux.dev Signed-off-by: Alexei Starovoitov <ast@kernel.org>
2023-08-24NFSD: Fix a thinko introduced by recent trace point changesChuck Lever
The fixed commit erroneously removed a call to nfsd_end_grace(), which makes calls to write_v4_end_grace() a no-op. Reported-by: kernel test robot <oliver.sang@intel.com> Closes: https://lore.kernel.org/oe-lkp/202308241229.68396422-oliver.sang@intel.com Fixes: 39d432fc7630 ("NFSD: trace nfsctl operations") Reviewed-by: Jeff Layton <jlayton@kernel.org> Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
2023-08-24locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lockWill Shiu
As following backtrace, the struct file_lock request , in posix_lock_inode is free before ftrace function using. Replace the ftrace function ahead free flow could fix the use-after-free issue. [name:report&]=============================================== BUG:KASAN: use-after-free in trace_event_raw_event_filelock_lock+0x80/0x12c [name:report&]Read at addr f6ffff8025622620 by task NativeThread/16753 [name:report_hw_tags&]Pointer tag: [f6], memory tag: [fe] [name:report&] BT: Hardware name: MT6897 (DT) Call trace: dump_backtrace+0xf8/0x148 show_stack+0x18/0x24 dump_stack_lvl+0x60/0x7c print_report+0x2c8/0xa08 kasan_report+0xb0/0x120 __do_kernel_fault+0xc8/0x248 do_bad_area+0x30/0xdc do_tag_check_fault+0x1c/0x30 do_mem_abort+0x58/0xbc el1_abort+0x3c/0x5c el1h_64_sync_handler+0x54/0x90 el1h_64_sync+0x68/0x6c trace_event_raw_event_filelock_lock+0x80/0x12c posix_lock_inode+0xd0c/0xd60 do_lock_file_wait+0xb8/0x190 fcntl_setlk+0x2d8/0x440 ... [name:report&] [name:report&]Allocated by task 16752: ... slab_post_alloc_hook+0x74/0x340 kmem_cache_alloc+0x1b0/0x2f0 posix_lock_inode+0xb0/0xd60 ... [name:report&] [name:report&]Freed by task 16752: ... kmem_cache_free+0x274/0x5b0 locks_dispose_list+0x3c/0x148 posix_lock_inode+0xc40/0xd60 do_lock_file_wait+0xb8/0x190 fcntl_setlk+0x2d8/0x440 do_fcntl+0x150/0xc18 ... Signed-off-by: Will Shiu <Will.Shiu@mediatek.com> Signed-off-by: Jeff Layton <jlayton@kernel.org>
2023-08-24fs/locks: Fix typoJakub Wilk
Signed-off-by: Jakub Wilk <jwilk@jwilk.net> Signed-off-by: Jeff Layton <jlayton@kernel.org>
2023-08-24selftests: add OFD lock testsStas Sergeev
Test the basic locking stuff on 2 fds: multiple read locks, conflicts between read and write locks, use of len==0 for queries. Also tests for F_UNLCK F_OFD_GETLK extension. [ jlayton: fix unlink() pathname in selftest ] Cc: Jeff Layton <jlayton@kernel.org> Cc: Chuck Lever <chuck.lever@oracle.com> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: Christian Brauner <brauner@kernel.org> Cc: linux-fsdevel@vger.kernel.org Cc: linux-kernel@vger.kernel.org Cc: Shuah Khan <shuah@kernel.org> Cc: linux-kselftest@vger.kernel.org Cc: linux-api@vger.kernel.org Signed-off-by: Stas Sergeev <stsp2@yandex.ru> Signed-off-by: Jeff Layton <jlayton@kernel.org>
2023-08-24HID: nvidia-shield: Reference hid_device devm allocation of input_dev nameRahul Rameshbabu
Use hid_device for devm allocation of the input_dev name to avoid a use-after-free. input_unregister_device would trigger devres cleanup of all resources associated with the input_dev, free-ing the name. The name would subsequently be used in a uevent fired at the end of unregistering the input_dev. Reported-by: Maxime Ripard <mripard@kernel.org> Closes: https://lore.kernel.org/linux-input/ZOZIZCND+L0P1wJc@penguin/T/#m443f3dce92520f74b6cf6ffa8653f9c92643d4ae Fixes: 09308562d4af ("HID: nvidia-shield: Initial driver implementation with Thunderstrike support") Suggested-by: Maxime Ripard <mripard@kernel.org> Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Rahul Rameshbabu <rrameshbabu@nvidia.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Link: https://lore.kernel.org/r/20230824061308.222021-4-sergeantsagara@protonmail.com Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2023-08-24HID: multitouch: Correct devm device reference for hidinput input_dev nameRahul Rameshbabu
Reference the HID device rather than the input device for the devm allocation of the input_dev name. Referencing the input_dev would lead to a use-after-free when the input_dev was unregistered and subsequently fires a uevent that depends on the name. At the point of firing the uevent, the name would be freed by devres management. Use devm_kasprintf to simplify the logic for allocating memory and formatting the input_dev name string. Reported-by: Maxime Ripard <mripard@kernel.org> Closes: https://lore.kernel.org/linux-input/ZOZIZCND+L0P1wJc@penguin/T/#m443f3dce92520f74b6cf6ffa8653f9c92643d4ae Fixes: c08d46aa805b ("HID: multitouch: devm conversion") Suggested-by: Maxime Ripard <mripard@kernel.org> Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Rahul Rameshbabu <sergeantsagara@protonmail.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Link: https://lore.kernel.org/r/20230824061308.222021-3-sergeantsagara@protonmail.com Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2023-08-24HID: uclogic: Correct devm device reference for hidinput input_dev nameRahul Rameshbabu
Reference the HID device rather than the input device for the devm allocation of the input_dev name. Referencing the input_dev would lead to a use-after-free when the input_dev was unregistered and subsequently fires a uevent that depends on the name. At the point of firing the uevent, the name would be freed by devres management. Use devm_kasprintf to simplify the logic for allocating memory and formatting the input_dev name string. Reported-by: syzbot+3a0ebe8a52b89c63739d@syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-input/ZOZIZCND+L0P1wJc@penguin/T/ Reported-by: Maxime Ripard <mripard@kernel.org> Closes: https://lore.kernel.org/linux-input/ZOZIZCND+L0P1wJc@penguin/T/#m443f3dce92520f74b6cf6ffa8653f9c92643d4ae Fixes: cce2dbdf258e ("HID: uclogic: name the input nodes based on their tool") Suggested-by: Maxime Ripard <mripard@kernel.org> Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: Rahul Rameshbabu <sergeantsagara@protonmail.com> Reviewed-by: Maxime Ripard <mripard@kernel.org> Link: https://lore.kernel.org/r/20230824061308.222021-2-sergeantsagara@protonmail.com Signed-off-by: Benjamin Tissoires <bentiss@kernel.org>
2023-08-24Merge tag 'mlx5-updates-2023-08-22' of ↵Paolo Abeni
git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux Saeed Mahameed says: ==================== mlx5-updates-2023-08-22 1) Patches #1..#13 From Jiri: The goal of this patchset is to make the SF code cleaner. Benefit from previously introduced devlink_port struct containerization to avoid unnecessary lookups in devlink port ops. Also, benefit from the devlink locking changes and avoid unnecessary reference counting. 2) Patches #14,#15: Add ability to configure proto both UDP and TCP selectors in RX and TX directions. * tag 'mlx5-updates-2023-08-22' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux: net/mlx5e: Support IPsec upper TCP protocol selector net/mlx5e: Support IPsec upper protocol selector field offload for RX net/mlx5: Store vport in struct mlx5_devlink_port and use it in port ops net/mlx5: Check vhca_resource_manager capability in each op and add extack msg net/mlx5: Relax mlx5_devlink_eswitch_get() return value checking net/mlx5: Return -EOPNOTSUPP in mlx5_devlink_port_fn_migratable_set() directly net/mlx5: Reduce number of vport lookups passing vport pointer instead of index net/mlx5: Embed struct devlink_port into driver structure net/mlx5: Don't register ops for non-PF/VF/SF port and avoid checks in ops net/mlx5: Remove no longer used mlx5_esw_offloads_sf_vport_enable/disable() net/mlx5: Introduce mlx5_eswitch_load/unload_sf_vport() and use it from SF code net/mlx5: Allow mlx5_esw_offloads_devlink_port_register() to register SFs net/mlx5: Push devlink port PF/VF init/cleanup calls out of devlink_port_register/unregister() net/mlx5: Push out SF devlink port init and cleanup code to separate helpers net/mlx5: Rework devlink port alloc/free into init/cleanup ==================== Link: https://lore.kernel.org/all/20230823051012.162483-1-saeed@kernel.org/ Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2023-08-24powerpc/pseries: Rework lppaca_shared_proc() to avoid DEBUG_PREEMPTRussell Currey
lppaca_shared_proc() takes a pointer to the lppaca which is typically accessed through get_lppaca(). With DEBUG_PREEMPT enabled, this leads to checking if preemption is enabled, for example: BUG: using smp_processor_id() in preemptible [00000000] code: grep/10693 caller is lparcfg_data+0x408/0x19a0 CPU: 4 PID: 10693 Comm: grep Not tainted 6.5.0-rc3 #2 Call Trace: dump_stack_lvl+0x154/0x200 (unreliable) check_preemption_disabled+0x214/0x220 lparcfg_data+0x408/0x19a0 ... This isn't actually a problem however, as it does not matter which lppaca is accessed, the shared proc state will be the same. vcpudispatch_stats_procfs_init() already works around this by disabling preemption, but the lparcfg code does not, erroring any time /proc/powerpc/lparcfg is accessed with DEBUG_PREEMPT enabled. Instead of disabling preemption on the caller side, rework lppaca_shared_proc() to not take a pointer and instead directly access the lppaca, bypassing any potential preemption checks. Fixes: f13c13a00512 ("powerpc: Stop using non-architected shared_proc field in lppaca") Signed-off-by: Russell Currey <ruscur@russell.cc> [mpe: Rework to avoid needing a definition in paca.h and lppaca.h] Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://msgid.link/20230823055317.751786-4-mpe@ellerman.id.au
2023-08-24powerpc: Don't include lppaca.h in paca.hMichael Ellerman
By adding a forward declaration for struct lppaca we can untangle paca.h and lppaca.h. Also move get_lppaca() into lppaca.h for consistency. Add includes of lppaca.h to some files that need it. Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://msgid.link/20230823055317.751786-3-mpe@ellerman.id.au
2023-08-24powerpc/pseries: Move hcall_vphn() prototype into vphn.hMichael Ellerman
Consolidate the two prototypes for hcall_vphn() into vphn.h. Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://msgid.link/20230823055317.751786-2-mpe@ellerman.id.au
2023-08-24powerpc/pseries: Move VPHN constants into vphn.hMichael Ellerman
These don't have any particularly good reason to belong in lppaca.h, move them into their own header. Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://msgid.link/20230823055317.751786-1-mpe@ellerman.id.au
2023-08-24cxl: Drop unused detach_spa()Michael Ellerman
Clang warns: drivers/misc/cxl/native.c:272:20: error: unused function 'detach_spa' [-Werror,-Wunused-function] It was created as part of some refactoring in commit 05155772f642 ("cxl: Allocate and release the SPA with the AFU"), but has never been called in its current form. Drop it. Acked-by: Andrew Donnellan <ajd@linux.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://msgid.link/20230823044803.737175-1-mpe@ellerman.id.au
2023-08-24powerpc: Drop zalloc_maybe_bootmem()Michael Ellerman
The only callers of zalloc_maybe_bootmem() are PCI setup routines. These used to be called early during boot before slab setup, and also during runtime due to hotplug. But commit 5537fcb319d0 ("powerpc/pci: Add ppc_md.discover_phbs()") moved the boot-time calls later, after slab setup, meaning there's no longer any need for zalloc_maybe_bootmem(), kzalloc() can be used in all cases. Reviewed-by: Christophe Leroy <christophe.leroy@csgroup.eu> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://msgid.link/20230823055430.752550-1-mpe@ellerman.id.au
2023-08-24powerpc/powernv: Use struct opal_prd_msg in more placesMichael Ellerman
Use the newly added struct opal_prd_msg in some other functions that operate on opal_prd messages, rather than using other types. Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://msgid.link/20230821142820.497107-2-mpe@ellerman.id.au
2023-08-24powerpc/powernv: Fix fortify source warnings in opal-prd.cMichael Ellerman
As reported by Mahesh & Aneesh, opal_prd_msg_notifier() triggers a FORTIFY_SOURCE warning: memcpy: detected field-spanning write (size 32) of single field "&item->msg" at arch/powerpc/platforms/powernv/opal-prd.c:355 (size 4) WARNING: CPU: 9 PID: 660 at arch/powerpc/platforms/powernv/opal-prd.c:355 opal_prd_msg_notifier+0x174/0x188 [opal_prd] NIP opal_prd_msg_notifier+0x174/0x188 [opal_prd] LR opal_prd_msg_notifier+0x170/0x188 [opal_prd] Call Trace: opal_prd_msg_notifier+0x170/0x188 [opal_prd] (unreliable) notifier_call_chain+0xc0/0x1b0 atomic_notifier_call_chain+0x2c/0x40 opal_message_notify+0xf4/0x2c0 This happens because the copy is targeting item->msg, which is only 4 bytes in size, even though the enclosing item was allocated with extra space following the msg. To fix the warning define struct opal_prd_msg with a union of the header and a flex array, and have the memcpy target the flex array. Reported-by: "Aneesh Kumar K.V" <aneesh.kumar@linux.ibm.com> Reported-by: Mahesh Salgaonkar <mahesh@linux.ibm.com> Tested-by: Mahesh Salgaonkar <mahesh@linux.ibm.com> Reviewed-by: Mahesh Salgaonkar <mahesh@linux.ibm.com> Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://msgid.link/20230821142820.497107-1-mpe@ellerman.id.au
2023-08-24drm/gpuva_mgr: remove unused prev pointer in __drm_gpuva_sm_map()Danilo Krummrich
The prev pointer in __drm_gpuva_sm_map() was used to implement automatic merging of mappings. Since automatic merging did not make its way upstream, remove this leftover. Fixes: e6303f323b1a ("drm: manager to keep track of GPUs VA mappings") Signed-off-by: Danilo Krummrich <dakr@redhat.com> Reviewed-by: Dave Airlie <airlied@redhat.com> Link: https://patchwork.freedesktop.org/patch/msgid/20230823233119.2891-1-dakr@redhat.com
2023-08-24ASoC: amd: yc: Fix a non-functional mic on Lenovo 82SJMario Limonciello
Lenovo 82SJ doesn't have DMIC connected like 82V2 does. Narrow the match down to only cover 82V2. Reported-by: prosenfeld@Yuhsbstudents.org Closes: https://bugzilla.kernel.org/show_bug.cgi?id=217063 Fixes: 2232b2dd8cd4 ("ASoC: amd: yc: Add Lenovo Yoga Slim 7 Pro X to quirks table") Signed-off-by: Mario Limonciello <mario.limonciello@amd.com Link: https://lore.kernel.org/r/20230824011149.1395-1-mario.limonciello@amd.com Signed-off-by: Mark Brown <broonie@kernel.org
2023-08-24Merge tag 'icc-6.6-rc1' of ↵Greg Kroah-Hartman
git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc into char-misc-next Georgi writes: interconnect changes for 6.6 This pull request contains the interconnect changes for the 6.6-rc1 merge window which is a mix of core and driver changes with the following highlights: Core changes: - New generic test client driver that allows issuing bandwidth requests between endpoints via debugfs. - Annotate all structs with flexible array members with the __counted_by attribute. - Introduce new icc_bw_lock for cases where we need to serialize bandwidth aggregation and update to decouple that from paths that require memory allocation. Driver changes: - Move the Qualcomm SMD RPM bus-clocks from CCF to interconnect framework where they actually belong. This brings power management improvements and reduces the overhead and layering. These changes are in immutable branch that is being pulled also into the qcom tree. - Fixes for QUP nodes on SM8250. - Enable sync_state and keepalive for QCM2290. - Enable sync_state for SM8450. - Improve enable_mask-based BCMs handling and fix some bugs. - Add compatible string for the OSM-L3 on SDM670. - Add compatible strings for SC7180, SM8250 and SM6350 bandwidth monitors. - Expand and retire the DEFINE_QNODE and DEFINE_QBCM macros, which have become ugly beasts with many different arguments. Signed-off-by: Georgi Djakov <djakov@kernel.org> * tag 'icc-6.6-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/djakov/icc: (64 commits) interconnect: Add debugfs test client interconnect: Reintroduce icc_get() debugfs: Add write support to debugfs_create_str() interconnect: qcom: icc-rpmh: Retire DEFINE_QBCM interconnect: qcom: sm8350: Retire DEFINE_QBCM interconnect: qcom: sm8250: Retire DEFINE_QBCM interconnect: qcom: sm8150: Retire DEFINE_QBCM interconnect: qcom: sm6350: Retire DEFINE_QBCM interconnect: qcom: sdx65: Retire DEFINE_QBCM interconnect: qcom: sdx55: Retire DEFINE_QBCM interconnect: qcom: sdm845: Retire DEFINE_QBCM interconnect: qcom: sdm670: Retire DEFINE_QBCM interconnect: qcom: sc7180: Retire DEFINE_QBCM interconnect: qcom: icc-rpmh: Retire DEFINE_QNODE interconnect: qcom: sm8350: Retire DEFINE_QNODE interconnect: qcom: sm8250: Retire DEFINE_QNODE interconnect: qcom: sm8150: Retire DEFINE_QNODE interconnect: qcom: sm6350: Retire DEFINE_QNODE interconnect: qcom: sdx65: Retire DEFINE_QNODE interconnect: qcom: sdx55: Retire DEFINE_QNODE ...
2023-08-24mmc: sdhci-of-dwcmshc: Add runtime PM operationsLiming Sun
This commit implements the runtime PM operations to disable eMMC card clock when idle. Reviewed-by: David Thompson <davthompson@nvidia.com> Signed-off-by: Liming Sun <limings@nvidia.com> Acked-by: Adrian Hunter <adrian.hunter@intel.com> Link: https://lore.kernel.org/r/20230822195929.168552-2-limings@nvidia.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2023-08-24mmc: sdhci-of-dwcmshc: Add error handling in dwcmshc_resumeLiming Sun
This commit adds handling in dwcmshc_resume() for different error cases. Signed-off-by: Liming Sun <limings@nvidia.com> Acked-by: Adrian Hunter <adrian.hunter@intel.com> Link: https://lore.kernel.org/r/20230822195929.168552-1-limings@nvidia.com Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>
2023-08-24PCI: layerscape: Add power management support for ls1028aHou Zhiqiang
Add PME_Turn_off/PME_TO_Ack handshake sequence for ls1028a platform. Implemented on top of common dwc dw_pcie_suspend(resume)_noirq() functions to handle system enter/exit suspend states. Link: https://lore.kernel.org/r/20230821184815.2167131-4-Frank.Li@nxp.com Signed-off-by: Hou Zhiqiang <Zhiqiang.Hou@nxp.com> Signed-off-by: Frank Li <Frank.Li@nxp.com> Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org> Acked-by: Manivannan Sadhasivam <mani@kernel.org>
2023-08-24PCI: dwc: Implement generic suspend/resume functionalityFrank Li
Introduce an helper function (dw_pcie_get_ltssm()) to retrieve SMLH_LTSS_STATE. Add common dw_pcie_suspend(resume)_noirq() API to implement the DWC controller generic suspend/resume functionality. Add a controller specific callback to send the PME_Turn_Off message (ie .pme_turn_off) for controller platform specific PME handling. Link: https://lore.kernel.org/r/20230821184815.2167131-3-Frank.Li@nxp.com Signed-off-by: Frank Li <Frank.Li@nxp.com> [lpieralisi@kernel.org: commit log] Signed-off-by: Lorenzo Pieralisi <lpieralisi@kernel.org> Acked-by: Manivannan Sadhasivam <mani@kernel.org>
2023-08-24libceph: do not include crypto/algapi.hHerbert Xu
The header file crypto/algapi.h is for internal use only. Use the header file crypto/utils.h instead. Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Reviewed-by: Ilya Dryomov <idryomov@gmail.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
2023-08-24ceph: switch ceph_lookup/atomic_open() to use new fscrypt helperLuís Henriques
Instead of setting the no-key dentry, use the new fscrypt_prepare_lookup_partial() helper. We still need to mark the directory as incomplete if the directory was just unlocked. In ceph_atomic_open() this fixes a bug where a dentry is incorrectly set with DCACHE_NOKEY_NAME when 'dir' has been evicted but the key is still available (for example, where there's a drop_caches). Signed-off-by: Luís Henriques <lhenriques@suse.de> Reviewed-by: Xiubo Li <xiubli@redhat.com> Reviewed-by: Milind Changire <mchangir@redhat.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
2023-08-24ceph: fix updating i_truncate_pagecache_size for fscryptXiubo Li
When fscrypt is enabled we will align the truncate size up to the CEPH_FSCRYPT_BLOCK_SIZE always, so if we truncate the size in the same block more than once, the latter ones will be skipped being invalidated from the page caches. This will force invalidating the page caches by using the smaller size than the real file size. At the same time add more debug log and fix the debug log for truncate code. Link: https://tracker.ceph.com/issues/58834 Signed-off-by: Xiubo Li <xiubli@redhat.com> Reviewed-and-tested-by: Luís Henriques <lhenriques@suse.de> Reviewed-by: Milind Changire <mchangir@redhat.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
2023-08-24ceph: wait for OSD requests' callbacks to finish when unmountingXiubo Li
The sync_filesystem() will flush all the dirty buffer and submit the osd reqs to the osdc and then is blocked to wait for all the reqs to finish. But the when the reqs' replies come, the reqs will be removed from osdc just before the req->r_callback()s are called. Which means the sync_filesystem() will be woke up by leaving the req->r_callback()s are still running. This will be buggy when the waiter require the req->r_callback()s to release some resources before continuing. So we need to make sure the req->r_callback()s are called before removing the reqs from the osdc. WARNING: CPU: 4 PID: 168846 at fs/crypto/keyring.c:242 fscrypt_destroy_keyring+0x7e/0xd0 CPU: 4 PID: 168846 Comm: umount Tainted: G S 6.1.0-rc5-ceph-g72ead199864c #1 Hardware name: Supermicro SYS-5018R-WR/X10SRW-F, BIOS 2.0 12/17/2015 RIP: 0010:fscrypt_destroy_keyring+0x7e/0xd0 RSP: 0018:ffffc9000b277e28 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff88810d52ac00 RCX: ffff88810b56aa00 RDX: 0000000080000000 RSI: ffffffff822f3a09 RDI: ffff888108f59000 RBP: ffff8881d394fb88 R08: 0000000000000028 R09: 0000000000000000 R10: 0000000000000001 R11: 11ff4fe6834fcd91 R12: ffff8881d394fc40 R13: ffff888108f59000 R14: ffff8881d394f800 R15: 0000000000000000 FS: 00007fd83f6f1080(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f918d417000 CR3: 000000017f89a005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> generic_shutdown_super+0x47/0x120 kill_anon_super+0x14/0x30 ceph_kill_sb+0x36/0x90 [ceph] deactivate_locked_super+0x29/0x60 cleanup_mnt+0xb8/0x140 task_work_run+0x67/0xb0 exit_to_user_mode_prepare+0x23d/0x240 syscall_exit_to_user_mode+0x25/0x60 do_syscall_64+0x40/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd83dc39e9b We need to increase the blocker counter to make sure all the osd requests' callbacks have been finished just before calling the kill_anon_super() when unmounting. Link: https://tracker.ceph.com/issues/58126 Signed-off-by: Xiubo Li <xiubli@redhat.com> Reviewed-and-tested-by: Luís Henriques <lhenriques@suse.de> Reviewed-by: Milind Changire <mchangir@redhat.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
2023-08-24ceph: drop messages from MDS when unmountingXiubo Li
When unmounting all the dirty buffers will be flushed and after the last osd request is finished the last reference of the i_count will be released. Then it will flush the dirty cap/snap to MDSs, and the unmounting won't wait the possible acks, which will ihold the inodes when updating the metadata locally but makes no sense any more, of this. This will make the evict_inodes() to skip these inodes. If encrypt is enabled the kernel generate a warning when removing the encrypt keys when the skipped inodes still hold the keyring: WARNING: CPU: 4 PID: 168846 at fs/crypto/keyring.c:242 fscrypt_destroy_keyring+0x7e/0xd0 CPU: 4 PID: 168846 Comm: umount Tainted: G S 6.1.0-rc5-ceph-g72ead199864c #1 Hardware name: Supermicro SYS-5018R-WR/X10SRW-F, BIOS 2.0 12/17/2015 RIP: 0010:fscrypt_destroy_keyring+0x7e/0xd0 RSP: 0018:ffffc9000b277e28 EFLAGS: 00010202 RAX: 0000000000000002 RBX: ffff88810d52ac00 RCX: ffff88810b56aa00 RDX: 0000000080000000 RSI: ffffffff822f3a09 RDI: ffff888108f59000 RBP: ffff8881d394fb88 R08: 0000000000000028 R09: 0000000000000000 R10: 0000000000000001 R11: 11ff4fe6834fcd91 R12: ffff8881d394fc40 R13: ffff888108f59000 R14: ffff8881d394f800 R15: 0000000000000000 FS: 00007fd83f6f1080(0000) GS:ffff88885fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f918d417000 CR3: 000000017f89a005 CR4: 00000000003706e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> generic_shutdown_super+0x47/0x120 kill_anon_super+0x14/0x30 ceph_kill_sb+0x36/0x90 [ceph] deactivate_locked_super+0x29/0x60 cleanup_mnt+0xb8/0x140 task_work_run+0x67/0xb0 exit_to_user_mode_prepare+0x23d/0x240 syscall_exit_to_user_mode+0x25/0x60 do_syscall_64+0x40/0x80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7fd83dc39e9b Later the kernel will crash when iput() the inodes and dereferencing the "sb->s_master_keys", which has been released by the generic_shutdown_super(). Link: https://tracker.ceph.com/issues/59162 Signed-off-by: Xiubo Li <xiubli@redhat.com> Reviewed-and-tested-by: Luís Henriques <lhenriques@suse.de> Reviewed-by: Milind Changire <mchangir@redhat.com> Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
generated by cgit (git 2.34.1) at 2025-09-19 14:48:29 +0000