Skip to content
Snippets Groups Projects
  1. Dec 26, 2022
  2. Dec 25, 2022
    • Steven Rostedt (Google)'s avatar
      treewide: Convert del_timer*() to timer_shutdown*() · 292a089d
      Steven Rostedt (Google) authored
      Due to several bugs caused by timers being re-armed after they are
      shutdown and just before they are freed, a new state of timers was added
      called "shutdown".  After a timer is set to this state, then it can no
      longer be re-armed.
      
      The following script was run to find all the trivial locations where
      del_timer() or del_timer_sync() is called in the same function that the
      object holding the timer is freed.  It also ignores any locations where
      the timer->function is modified between the del_timer*() and the free(),
      as that is not considered a "trivial" case.
      
      This was created by using a coccinelle script and the following
      commands:
      
          $ cat timer.cocci
          @@
          expression ptr, slab;
          identifier timer, rfield;
          @@
          (
          -       del_timer(&ptr->timer);
          +       timer_shutdown(&ptr->timer);
          |
          -       del_timer_sync(&ptr->timer);
          +       timer_shutdown_sync(&ptr->timer);
          )
            ... when strict
                when != ptr->timer
          (
                  kfree_rcu(ptr, rfield);
          |
                  kmem_cache_free(slab, ptr);
          |
                  kfree(ptr);
          )
      
          $ spatch timer.cocci . > /tmp/t.patch
          $ patch -p1 < /tmp/t.patch
      
      Link: https://lore.kernel.org/lkml/20221123201306.823305113@linutronix.de/
      
      
      Signed-off-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
      Acked-by: Pavel Machek <pavel@ucw.cz> [ LED ]
      Acked-by: Kalle Valo <kvalo@kernel.org> [ wireless ]
      Acked-by: Paolo Abeni <pabeni@redhat.com> [ networking ]
      Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      292a089d
  3. Dec 15, 2022
  4. Dec 14, 2022
    • Tejun Heo's avatar
      blk-iolatency: Fix memory leak on add_disk() failures · 813e6930
      Tejun Heo authored
      
      When a gendisk is successfully initialized but add_disk() fails such as when
      a loop device has invalid number of minor device numbers specified,
      blkcg_init_disk() is called during init and then blkcg_exit_disk() during
      error handling. Unfortunately, iolatency gets initialized in the former but
      doesn't get cleaned up in the latter.
      
      This is because, in non-error cases, the cleanup is performed by
      del_gendisk() calling rq_qos_exit(), the assumption being that rq_qos
      policies, iolatency being one of them, can only be activated once the disk
      is fully registered and visible. That assumption is true for wbt and iocost,
      but not so for iolatency as it gets initialized before add_disk() is called.
      
      It is desirable to lazy-init rq_qos policies because they are optional
      features and add to hot path overhead once initialized - each IO has to walk
      all the registered rq_qos policies. So, we want to switch iolatency to lazy
      init too. However, that's a bigger change. As a fix for the immediate
      problem, let's just add an extra call to rq_qos_exit() in blkcg_exit_disk().
      This is safe because duplicate calls to rq_qos_exit() become noop's.
      
      Signed-off-by: default avatarTejun Heo <tj@kernel.org>
      Reported-by: default avatar <darklight2357@icloud.com>
      Cc: Josef Bacik <josef@toxicpanda.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Fixes: d7067512 ("block: introduce blk-iolatency io controller")
      Cc: stable@vger.kernel.org # v4.19+
      Reviewed-by: default avatarChristoph Hellwig <hch@lst.de>
      Link: https://lore.kernel.org/r/Y5TQ5gm3O4HXrXR3@slm.duckdns.org
      
      
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      813e6930
    • Jiri Slaby (SUSE)'s avatar
      block/blk-iocost (gcc13): keep large values in a new enum · ff1cc97b
      Jiri Slaby (SUSE) authored
      Since gcc13, each member of an enum has the same type as the enum [1]. And
      that is inherited from its members. Provided:
        VTIME_PER_SEC_SHIFT     = 37,
        VTIME_PER_SEC           = 1LLU << VTIME_PER_SEC_SHIFT,
        ...
        AUTOP_CYCLE_NSEC        = 10LLU * NSEC_PER_SEC,
      the named type is unsigned long.
      
      This generates warnings with gcc-13:
        block/blk-iocost.c: In function 'ioc_weight_prfill':
        block/blk-iocost.c:3037:37: error: format '%u' expects argument of type 'unsigned int', but argument 4 has type 'long unsigned int'
      
        block/blk-iocost.c: In function 'ioc_weight_show':
        block/blk-iocost.c:3047:34: error: format '%u' expects argument of type 'unsigned int', but argument 3 has type 'long unsigned int'
      
      So split the anonymous enum with large values to a separate enum, so
      that they don't affect other members.
      
      [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=36113
      
      
      
      Cc: Martin Liska <mliska@suse.cz>
      Cc: Tejun Heo <tj@kernel.org>
      Cc: Josef Bacik <josef@toxicpanda.com>
      Cc: Jens Axboe <axboe@kernel.dk>
      Cc: cgroups@vger.kernel.org
      Cc: linux-block@vger.kernel.org
      Signed-off-by: default avatarJiri Slaby (SUSE) <jirislaby@kernel.org>
      Link: https://lore.kernel.org/r/20221213120826.17446-1-jirislaby@kernel.org
      
      
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      ff1cc97b
    • Yu Kuai's avatar
      block, bfq: replace 0/1 with false/true in bic apis · 337366e0
      Yu Kuai authored
      
      Just to make the code a litter cleaner, there are no functional changes.
      
      Signed-off-by: default avatarYu Kuai <yukuai3@huawei.com>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Link: https://lore.kernel.org/r/20221214033155.3455754-3-yukuai1@huaweicloud.com
      
      
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      337366e0
    • Yu Kuai's avatar
      block, bfq: don't return bfqg from __bfq_bic_change_cgroup() · 452af7dc
      Yu Kuai authored
      
      The return value is not used, hence remove it.
      
      Signed-off-by: default avatarYu Kuai <yukuai3@huawei.com>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Link: https://lore.kernel.org/r/20221214033155.3455754-2-yukuai1@huaweicloud.com
      
      
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      452af7dc
    • Yu Kuai's avatar
      block, bfq: fix possible uaf for 'bfqq->bic' · 64dc8c73
      Yu Kuai authored
      
      Our test report a uaf for 'bfqq->bic' in 5.10:
      
      ==================================================================
      BUG: KASAN: use-after-free in bfq_select_queue+0x378/0xa30
      
      CPU: 6 PID: 2318352 Comm: fsstress Kdump: loaded Not tainted 5.10.0-60.18.0.50.h602.kasan.eulerosv2r11.x86_64 #1
      Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58-20220320_160524-szxrtosci10000 04/01/2014
      Call Trace:
       bfq_select_queue+0x378/0xa30
       bfq_dispatch_request+0xe8/0x130
       blk_mq_do_dispatch_sched+0x62/0xb0
       __blk_mq_sched_dispatch_requests+0x215/0x2a0
       blk_mq_sched_dispatch_requests+0x8f/0xd0
       __blk_mq_run_hw_queue+0x98/0x180
       __blk_mq_delay_run_hw_queue+0x22b/0x240
       blk_mq_run_hw_queue+0xe3/0x190
       blk_mq_sched_insert_requests+0x107/0x200
       blk_mq_flush_plug_list+0x26e/0x3c0
       blk_finish_plug+0x63/0x90
       __iomap_dio_rw+0x7b5/0x910
       iomap_dio_rw+0x36/0x80
       ext4_dio_read_iter+0x146/0x190 [ext4]
       ext4_file_read_iter+0x1e2/0x230 [ext4]
       new_sync_read+0x29f/0x400
       vfs_read+0x24e/0x2d0
       ksys_read+0xd5/0x1b0
       do_syscall_64+0x33/0x40
       entry_SYSCALL_64_after_hwframe+0x61/0xc6
      
      Commit 3bc5e683 ("bfq: Split shared queues on move between cgroups")
      changes that move process to a new cgroup will allocate a new bfqq to
      use, however, the old bfqq and new bfqq can point to the same bic:
      
      1) Initial state, two process with io in the same cgroup.
      
      Process 1       Process 2
       (BIC1)          (BIC2)
        |  Λ            |  Λ
        |  |            |  |
        V  |            V  |
        bfqq1           bfqq2
      
      2) bfqq1 is merged to bfqq2.
      
      Process 1       Process 2
       (BIC1)          (BIC2)
        |               |
         \-------------\|
                        V
        bfqq1           bfqq2(coop)
      
      3) Process 1 exit, then issue new io(denoce IOA) from Process 2.
      
       (BIC2)
        |  Λ
        |  |
        V  |
        bfqq2(coop)
      
      4) Before IOA is completed, move Process 2 to another cgroup and issue io.
      
      Process 2
       (BIC2)
         Λ
         |\--------------\
         |                V
        bfqq2           bfqq3
      
      Now that BIC2 points to bfqq3, while bfqq2 and bfqq3 both point to BIC2.
      If all the requests are completed, and Process 2 exit, BIC2 will be
      freed while there is no guarantee that bfqq2 will be freed before BIC2.
      
      Fix the problem by clearing bfqq->bic while bfqq is detached from bic.
      
      Fixes: 3bc5e683 ("bfq: Split shared queues on move between cgroups")
      Suggested-by: default avatarJan Kara <jack@suse.cz>
      Signed-off-by: default avatarYu Kuai <yukuai3@huawei.com>
      Reviewed-by: default avatarJan Kara <jack@suse.cz>
      Link: https://lore.kernel.org/r/20221214030430.3304151-1-yukuai1@huaweicloud.com
      
      
      Signed-off-by: default avatarJens Axboe <axboe@kernel.dk>
      64dc8c73
  5. Dec 08, 2022
  6. Dec 06, 2022
  7. Dec 05, 2022
  8. Dec 03, 2022
  9. Dec 02, 2022
  10. Dec 01, 2022
  11. Nov 30, 2022
  12. Nov 29, 2022
Loading