Update Kconfig #294

iambrosie · 2016-05-30T22:29:54Z

typo: missing verb.

FadeMind · 2016-05-31T06:01:19Z

@iambrosie FYI
https://www.kernel.org/doc/Documentation/SubmittingPatches
http://kernelnewbies.org/FirstKernelPatch
https://shkspr.mobi/blog/2014/04/submitting-trivial-linux-kernel-patches/

iambrosie · 2016-05-31T22:31:40Z

@FadeMind Thanks, will follow when time allows it.

lkl tools: add symlink support to cptofs

As the kylin had not ready supported it during the short time. Due to kylin enabled the psci will cause crash on bootup. .. [ 0.000000] psci: probing for conduit method from DT. [ 0.000000] Bad mode in prefetch abort handler detected [ 0.000000] Internal error: Oops - bad mode: 0 [#1] SMP ARM [ 0.000000] Modules linked in: [ 0.000000] CPU: 0 PID: 0 Comm: swapper Not tainted 4.4.103 torvalds#294 [ 0.000000] Hardware name: Generic DT based system [ 0.000000] task: c130d04 task.stack: c1300000 [ 0.000000] PC is at 0xa60656a8 [ 0.000000] LR is at __invoke_psci_fn_smc+0x38/0x44 [ 0.000000] pc : [<a60656a8>] lr : [<c0922234>] psr: 600001d6 Change-Id: I2edc8d1becc63e932321698b6d4a6090b527a360 Signed-off-by: Caesar Wang <wxt@rock-chips.com>

This commits adds verifier tests covering per-cpu cgroup storage functionality. There are 6 new tests, which are exactly the same as for shared cgroup storage, but do use per-cpu cgroup storage map. Expected output: $ ./test_verifier #0/u add+sub+mul OK #0/p add+sub+mul OK ... torvalds#286/p invalid cgroup storage access 6 OK torvalds#287/p valid per-cpu cgroup storage access OK torvalds#288/p invalid per-cpu cgroup storage access 1 OK torvalds#289/p invalid per-cpu cgroup storage access 2 OK torvalds#290/p invalid per-cpu cgroup storage access 3 OK torvalds#291/p invalid per-cpu cgroup storage access 4 OK torvalds#292/p invalid per-cpu cgroup storage access 5 OK torvalds#293/p invalid per-cpu cgroup storage access 6 OK torvalds#294/p multiple registers share map_lookup_elem result OK ... torvalds#662/p mov64 src == dst OK torvalds#663/p mov64 src != dst OK Summary: 914 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Roman Gushchin <guro@fb.com> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: Alexei Starovoitov <ast@kernel.org>

This commits adds verifier tests covering per-cpu cgroup storage functionality. There are 6 new tests, which are exactly the same as for shared cgroup storage, but do use per-cpu cgroup storage map. Expected output: $ ./test_verifier #0/u add+sub+mul OK #0/p add+sub+mul OK ... torvalds#286/p invalid cgroup storage access 6 OK torvalds#287/p valid per-cpu cgroup storage access OK torvalds#288/p invalid per-cpu cgroup storage access 1 OK torvalds#289/p invalid per-cpu cgroup storage access 2 OK torvalds#290/p invalid per-cpu cgroup storage access 3 OK torvalds#291/p invalid per-cpu cgroup storage access 4 OK torvalds#292/p invalid per-cpu cgroup storage access 5 OK torvalds#293/p invalid per-cpu cgroup storage access 6 OK torvalds#294/p multiple registers share map_lookup_elem result OK ... torvalds#662/p mov64 src == dst OK torvalds#663/p mov64 src != dst OK Summary: 914 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Roman Gushchin <guro@fb.com> Acked-by: Song Liu <songliubraving@fb.com> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

This commits adds verifier tests covering per-cpu cgroup storage functionality. There are 6 new tests, which are exactly the same as for shared cgroup storage, but do use per-cpu cgroup storage map. Expected output: $ ./test_verifier #0/u add+sub+mul OK #0/p add+sub+mul OK ... torvalds#286/p invalid cgroup storage access 6 OK torvalds#287/p valid per-cpu cgroup storage access OK torvalds#288/p invalid per-cpu cgroup storage access 1 OK torvalds#289/p invalid per-cpu cgroup storage access 2 OK torvalds#290/p invalid per-cpu cgroup storage access 3 OK torvalds#291/p invalid per-cpu cgroup storage access 4 OK torvalds#292/p invalid per-cpu cgroup storage access 5 OK torvalds#293/p invalid per-cpu cgroup storage access 6 OK torvalds#294/p multiple registers share map_lookup_elem result OK ... torvalds#662/p mov64 src == dst OK torvalds#663/p mov64 src != dst OK Summary: 914 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Roman Gushchin <guro@fb.com> Acked-by: Song Liu <songliubraving@fb.com> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: Alexei Starovoitov <ast@kernel.org>

This commits adds verifier tests covering per-cpu cgroup storage functionality. There are 6 new tests, which are exactly the same as for shared cgroup storage, but do use per-cpu cgroup storage map. Expected output: $ ./test_verifier #0/u add+sub+mul OK #0/p add+sub+mul OK ... torvalds#286/p invalid cgroup storage access 6 OK torvalds#287/p valid per-cpu cgroup storage access OK torvalds#288/p invalid per-cpu cgroup storage access 1 OK torvalds#289/p invalid per-cpu cgroup storage access 2 OK torvalds#290/p invalid per-cpu cgroup storage access 3 OK torvalds#291/p invalid per-cpu cgroup storage access 4 OK torvalds#292/p invalid per-cpu cgroup storage access 5 OK torvalds#293/p invalid per-cpu cgroup storage access 6 OK torvalds#294/p multiple registers share map_lookup_elem result OK ... torvalds#662/p mov64 src == dst OK torvalds#663/p mov64 src != dst OK Summary: 914 PASSED, 0 SKIPPED, 0 FAILED Signed-off-by: Roman Gushchin <guro@fb.com> Acked-by: Song Liu <songliubraving@fb.com> Cc: Daniel Borkmann <daniel@iogearbox.net> Cc: Alexei Starovoitov <ast@kernel.org> Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>

WARNING: please, no spaces at the start of a line torvalds#249: FILE: mm/page-writeback.c:2089: + {$ ERROR: code indent should use tabs where possible torvalds#250: FILE: mm/page-writeback.c:2090: + .procname = "dirty_background_ratio",$ WARNING: please, no spaces at the start of a line torvalds#250: FILE: mm/page-writeback.c:2090: + .procname = "dirty_background_ratio",$ ERROR: code indent should use tabs where possible torvalds#251: FILE: mm/page-writeback.c:2091: + .data = &dirty_background_ratio,$ WARNING: please, no spaces at the start of a line torvalds#251: FILE: mm/page-writeback.c:2091: + .data = &dirty_background_ratio,$ ERROR: code indent should use tabs where possible torvalds#252: FILE: mm/page-writeback.c:2092: + .maxlen = sizeof(dirty_background_ratio),$ WARNING: please, no spaces at the start of a line torvalds#252: FILE: mm/page-writeback.c:2092: + .maxlen = sizeof(dirty_background_ratio),$ ERROR: code indent should use tabs where possible torvalds#253: FILE: mm/page-writeback.c:2093: + .mode = 0644,$ WARNING: please, no spaces at the start of a line torvalds#253: FILE: mm/page-writeback.c:2093: + .mode = 0644,$ ERROR: code indent should use tabs where possible torvalds#254: FILE: mm/page-writeback.c:2094: + .proc_handler = dirty_background_ratio_handler,$ WARNING: please, no spaces at the start of a line torvalds#254: FILE: mm/page-writeback.c:2094: + .proc_handler = dirty_background_ratio_handler,$ ERROR: code indent should use tabs where possible torvalds#255: FILE: mm/page-writeback.c:2095: + .extra1 = SYSCTL_ZERO,$ WARNING: please, no spaces at the start of a line torvalds#255: FILE: mm/page-writeback.c:2095: + .extra1 = SYSCTL_ZERO,$ ERROR: code indent should use tabs where possible torvalds#256: FILE: mm/page-writeback.c:2096: + .extra2 = SYSCTL_ONE_HUNDRED,$ WARNING: please, no spaces at the start of a line torvalds#256: FILE: mm/page-writeback.c:2096: + .extra2 = SYSCTL_ONE_HUNDRED,$ WARNING: please, no spaces at the start of a line torvalds#257: FILE: mm/page-writeback.c:2097: + },$ WARNING: please, no spaces at the start of a line torvalds#258: FILE: mm/page-writeback.c:2098: + {$ ERROR: code indent should use tabs where possible torvalds#259: FILE: mm/page-writeback.c:2099: + .procname = "dirty_background_bytes",$ WARNING: please, no spaces at the start of a line torvalds#259: FILE: mm/page-writeback.c:2099: + .procname = "dirty_background_bytes",$ ERROR: code indent should use tabs where possible torvalds#260: FILE: mm/page-writeback.c:2100: + .data = &dirty_background_bytes,$ WARNING: please, no spaces at the start of a line torvalds#260: FILE: mm/page-writeback.c:2100: + .data = &dirty_background_bytes,$ ERROR: code indent should use tabs where possible torvalds#261: FILE: mm/page-writeback.c:2101: + .maxlen = sizeof(dirty_background_bytes),$ WARNING: please, no spaces at the start of a line torvalds#261: FILE: mm/page-writeback.c:2101: + .maxlen = sizeof(dirty_background_bytes),$ ERROR: code indent should use tabs where possible torvalds#262: FILE: mm/page-writeback.c:2102: + .mode = 0644,$ WARNING: please, no spaces at the start of a line torvalds#262: FILE: mm/page-writeback.c:2102: + .mode = 0644,$ ERROR: code indent should use tabs where possible torvalds#263: FILE: mm/page-writeback.c:2103: + .proc_handler = dirty_background_bytes_handler,$ WARNING: please, no spaces at the start of a line torvalds#263: FILE: mm/page-writeback.c:2103: + .proc_handler = dirty_background_bytes_handler,$ ERROR: code indent should use tabs where possible torvalds#264: FILE: mm/page-writeback.c:2104: + .extra1 = SYSCTL_LONG_ONE,$ WARNING: please, no spaces at the start of a line torvalds#264: FILE: mm/page-writeback.c:2104: + .extra1 = SYSCTL_LONG_ONE,$ WARNING: please, no spaces at the start of a line torvalds#265: FILE: mm/page-writeback.c:2105: + },$ WARNING: please, no spaces at the start of a line torvalds#266: FILE: mm/page-writeback.c:2106: + {$ ERROR: code indent should use tabs where possible torvalds#267: FILE: mm/page-writeback.c:2107: + .procname = "dirty_ratio",$ WARNING: please, no spaces at the start of a line torvalds#267: FILE: mm/page-writeback.c:2107: + .procname = "dirty_ratio",$ ERROR: code indent should use tabs where possible torvalds#268: FILE: mm/page-writeback.c:2108: + .data = &vm_dirty_ratio,$ WARNING: please, no spaces at the start of a line torvalds#268: FILE: mm/page-writeback.c:2108: + .data = &vm_dirty_ratio,$ ERROR: code indent should use tabs where possible torvalds#269: FILE: mm/page-writeback.c:2109: + .maxlen = sizeof(vm_dirty_ratio),$ WARNING: please, no spaces at the start of a line torvalds#269: FILE: mm/page-writeback.c:2109: + .maxlen = sizeof(vm_dirty_ratio),$ ERROR: code indent should use tabs where possible torvalds#270: FILE: mm/page-writeback.c:2110: + .mode = 0644,$ WARNING: please, no spaces at the start of a line torvalds#270: FILE: mm/page-writeback.c:2110: + .mode = 0644,$ ERROR: code indent should use tabs where possible torvalds#271: FILE: mm/page-writeback.c:2111: + .proc_handler = dirty_ratio_handler,$ WARNING: please, no spaces at the start of a line torvalds#271: FILE: mm/page-writeback.c:2111: + .proc_handler = dirty_ratio_handler,$ ERROR: code indent should use tabs where possible torvalds#272: FILE: mm/page-writeback.c:2112: + .extra1 = SYSCTL_ZERO,$ WARNING: please, no spaces at the start of a line torvalds#272: FILE: mm/page-writeback.c:2112: + .extra1 = SYSCTL_ZERO,$ ERROR: code indent should use tabs where possible torvalds#273: FILE: mm/page-writeback.c:2113: + .extra2 = SYSCTL_ONE_HUNDRED,$ WARNING: please, no spaces at the start of a line torvalds#273: FILE: mm/page-writeback.c:2113: + .extra2 = SYSCTL_ONE_HUNDRED,$ WARNING: please, no spaces at the start of a line torvalds#274: FILE: mm/page-writeback.c:2114: + },$ WARNING: please, no spaces at the start of a line torvalds#275: FILE: mm/page-writeback.c:2115: + {$ ERROR: code indent should use tabs where possible torvalds#276: FILE: mm/page-writeback.c:2116: + .procname = "dirty_bytes",$ WARNING: please, no spaces at the start of a line torvalds#276: FILE: mm/page-writeback.c:2116: + .procname = "dirty_bytes",$ ERROR: code indent should use tabs where possible torvalds#277: FILE: mm/page-writeback.c:2117: + .data = &vm_dirty_bytes,$ WARNING: please, no spaces at the start of a line torvalds#277: FILE: mm/page-writeback.c:2117: + .data = &vm_dirty_bytes,$ ERROR: code indent should use tabs where possible torvalds#278: FILE: mm/page-writeback.c:2118: + .maxlen = sizeof(vm_dirty_bytes),$ WARNING: please, no spaces at the start of a line torvalds#278: FILE: mm/page-writeback.c:2118: + .maxlen = sizeof(vm_dirty_bytes),$ ERROR: code indent should use tabs where possible torvalds#279: FILE: mm/page-writeback.c:2119: + .mode = 0644,$ WARNING: please, no spaces at the start of a line torvalds#279: FILE: mm/page-writeback.c:2119: + .mode = 0644,$ ERROR: code indent should use tabs where possible torvalds#280: FILE: mm/page-writeback.c:2120: + .proc_handler = dirty_bytes_handler,$ WARNING: please, no spaces at the start of a line torvalds#280: FILE: mm/page-writeback.c:2120: + .proc_handler = dirty_bytes_handler,$ ERROR: code indent should use tabs where possible torvalds#281: FILE: mm/page-writeback.c:2121: + .extra1 = (void *)&dirty_bytes_min,$ WARNING: please, no spaces at the start of a line torvalds#281: FILE: mm/page-writeback.c:2121: + .extra1 = (void *)&dirty_bytes_min,$ WARNING: please, no spaces at the start of a line torvalds#282: FILE: mm/page-writeback.c:2122: + },$ WARNING: please, no spaces at the start of a line torvalds#283: FILE: mm/page-writeback.c:2123: + {$ ERROR: code indent should use tabs where possible torvalds#284: FILE: mm/page-writeback.c:2124: + .procname = "dirty_writeback_centisecs",$ WARNING: please, no spaces at the start of a line torvalds#284: FILE: mm/page-writeback.c:2124: + .procname = "dirty_writeback_centisecs",$ ERROR: code indent should use tabs where possible torvalds#285: FILE: mm/page-writeback.c:2125: + .data = &dirty_writeback_interval,$ WARNING: please, no spaces at the start of a line torvalds#285: FILE: mm/page-writeback.c:2125: + .data = &dirty_writeback_interval,$ ERROR: code indent should use tabs where possible torvalds#286: FILE: mm/page-writeback.c:2126: + .maxlen = sizeof(dirty_writeback_interval),$ WARNING: please, no spaces at the start of a line torvalds#286: FILE: mm/page-writeback.c:2126: + .maxlen = sizeof(dirty_writeback_interval),$ ERROR: code indent should use tabs where possible torvalds#287: FILE: mm/page-writeback.c:2127: + .mode = 0644,$ WARNING: please, no spaces at the start of a line torvalds#287: FILE: mm/page-writeback.c:2127: + .mode = 0644,$ ERROR: code indent should use tabs where possible torvalds#288: FILE: mm/page-writeback.c:2128: + .proc_handler = dirty_writeback_centisecs_handler,$ WARNING: please, no spaces at the start of a line torvalds#288: FILE: mm/page-writeback.c:2128: + .proc_handler = dirty_writeback_centisecs_handler,$ WARNING: please, no spaces at the start of a line torvalds#289: FILE: mm/page-writeback.c:2129: + },$ WARNING: please, no spaces at the start of a line torvalds#290: FILE: mm/page-writeback.c:2130: + {$ ERROR: code indent should use tabs where possible torvalds#291: FILE: mm/page-writeback.c:2131: + .procname = "dirty_expire_centisecs",$ WARNING: please, no spaces at the start of a line torvalds#291: FILE: mm/page-writeback.c:2131: + .procname = "dirty_expire_centisecs",$ ERROR: code indent should use tabs where possible torvalds#292: FILE: mm/page-writeback.c:2132: + .data = &dirty_expire_interval,$ WARNING: please, no spaces at the start of a line torvalds#292: FILE: mm/page-writeback.c:2132: + .data = &dirty_expire_interval,$ ERROR: code indent should use tabs where possible torvalds#293: FILE: mm/page-writeback.c:2133: + .maxlen = sizeof(dirty_expire_interval),$ WARNING: please, no spaces at the start of a line torvalds#293: FILE: mm/page-writeback.c:2133: + .maxlen = sizeof(dirty_expire_interval),$ ERROR: code indent should use tabs where possible torvalds#294: FILE: mm/page-writeback.c:2134: + .mode = 0644,$ WARNING: please, no spaces at the start of a line torvalds#294: FILE: mm/page-writeback.c:2134: + .mode = 0644,$ ERROR: code indent should use tabs where possible torvalds#295: FILE: mm/page-writeback.c:2135: + .proc_handler = proc_dointvec_minmax,$ WARNING: please, no spaces at the start of a line torvalds#295: FILE: mm/page-writeback.c:2135: + .proc_handler = proc_dointvec_minmax,$ ERROR: code indent should use tabs where possible torvalds#296: FILE: mm/page-writeback.c:2136: + .extra1 = SYSCTL_ZERO,$ WARNING: please, no spaces at the start of a line torvalds#296: FILE: mm/page-writeback.c:2136: + .extra1 = SYSCTL_ZERO,$ WARNING: please, no spaces at the start of a line torvalds#297: FILE: mm/page-writeback.c:2137: + },$ total: 37 errors, 49 warnings, 287 lines checked NOTE: For some of the reported defects, checkpatch may be able to mechanically convert to the typical style using --fix or --fix-inplace. NOTE: Whitespace errors detected. You may wish to use scripts/cleanpatch or scripts/cleanfile ./patches/mm-move-page-writeback-sysctls-to-is-own-file.patch has style problems, please review. NOTE: If any of the errors are false positives, please report them to the maintainer, see CHECKPATCH in MAINTAINERS. Please run checkpatch prior to sending patches Cc: Iurii Zaikin <yzaikin@google.com> Cc: Kees Cook <keescook@chromium.org> Cc: Luis Chamberlain <mcgrof@kernel.org> Cc: zhanglianjie <zhanglianjie@uniontech.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>

The rounddown_pow_of_two(0) is undefined, so val = 0 is not allowed in the fault_around_bytes_set(), and leads to shift-out-of-bounds, UBSAN: shift-out-of-bounds in include/linux/log2.h:67:13 shift exponent 4294967295 is too large for 64-bit type 'long unsigned int' CPU: 7 PID: 107 Comm: sh Not tainted 6.8.0-rc6-next-20240301 torvalds#294 Hardware name: QEMU QEMU Virtual Machine, BIOS 0.0.0 02/06/2015 Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x78/0x90 dump_stack+0x18/0x24 ubsan_epilogue+0x10/0x44 __ubsan_handle_shift_out_of_bounds+0x98/0x134 fault_around_bytes_set+0xa4/0xb0 simple_attr_write_xsigned.isra.0+0xe4/0x1ac simple_attr_write+0x18/0x24 debugfs_attr_write+0x4c/0x98 vfs_write+0xd0/0x4b0 ksys_write+0x6c/0xfc __arm64_sys_write+0x1c/0x28 invoke_syscall+0x44/0x104 el0_svc_common.constprop.0+0x40/0xe0 do_el0_svc+0x1c/0x28 el0_svc+0x34/0xdc el0t_64_sync_handler+0xc0/0xc4 el0t_64_sync+0x190/0x194 ---[ end trace ]--- Fix it by setting the minimum val to PAGE_SIZE. Link: https://lkml.kernel.org/r/20240302064312.2358924-1-wangkefeng.wang@huawei.com Fixes: 53d36a5 ("mm: prefer fault_around_pages to fault_around_bytes") Signed-off-by: Kefeng Wang <wangkefeng.wang@huawei.com> Reported-by: Yue Sun <samsun1006219@gmail.com> Closes: https://lore.kernel.org/all/CAEkJfYPim6DQqW1GqCiHLdh2-eweqk1fGyXqs3JM+8e1qGge8w@mail.gmail.com/ Reviewed-by: Lorenzo Stoakes <lstoakes@gmail.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org>

We observed a kernel crash when the I/O scheduler allocates an sbitmap for a hardware queue (hctx) that has no associated software queues (ctx), and later attempts to free it. When no software queues are mapped to a hardware queue, the sbitmap is initialized with a depth of zero. In such cases, the sbitmap_init_node() function should set sb->alloc_hint to NULL. However, if this is not done, sb->alloc_hint may contain garbage, and calling sbitmap_free() will pass this invalid pointer to free_percpu(), resulting in a kernel crash. Example crash trace: ================================================================== Kernel attempted to read user page (28) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000028 Faulting instruction address: 0xc000000000708f88 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries [...] CPU: 5 UID: 0 PID: 5491 Comm: mk_nullb_shared Kdump: loaded Tainted: G B 6.16.0-rc5+ torvalds#294 VOLUNTARY Tainted: [B]=BAD_PAGE Hardware name: IBM,9043-MRX POWER10 (architected) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_028) hv:phyp pSeries [...] NIP [c000000000708f88] free_percpu+0x144/0xba8 LR [c000000000708f84] free_percpu+0x140/0xba8 Call Trace: free_percpu+0x140/0xba8 (unreliable) kyber_exit_hctx+0x94/0x124 blk_mq_exit_sched+0xe4/0x214 elevator_exit+0xa8/0xf4 elevator_switch+0x3b8/0x5d8 elv_update_nr_hw_queues+0x14c/0x300 blk_mq_update_nr_hw_queues+0x5cc/0x670 nullb_update_nr_hw_queues+0x118/0x1f8 [null_blk] nullb_device_submit_queues_store+0xac/0x170 [null_blk] configfs_write_iter+0x1dc/0x2d0 vfs_write+0x5b0/0x77c ksys_write+0xa0/0x180 system_call_exception+0x1b0/0x4f0 system_call_vectored_common+0x15c/0x2ec If the sbitmap depth is zero, sb->alloc_hint memory is NOT allocated, but the pointer is not explicitly set to NULL. Later, during sbitmap_free(), the kernel attempts to free sb->alloc_hint, which is a per cpu pointer variable, regardless of whether it was valid, leading to a crash. This patch ensures that sb->alloc_hint is explicitly set to NULL in sbitmap_init_node() when the requested depth is zero. This prevents free_percpu() from freeing sb->alloc_hint and thus avoids the observed crash. Signed-off-by: Nilay Shroff <nilay@linux.ibm.com>

We observed a kernel crash when the I/O scheduler allocates an sbitmap for a hardware queue (hctx) that has no associated software queues (ctx), and later attempts to free it. When no software queues are mapped to a hardware queue, the sbitmap is initialized with a depth of zero. In such cases, the sbitmap_init_node() function should set sb->alloc_hint to NULL. However, if this is not done, sb->alloc_hint may contain garbage, and calling sbitmap_free() will pass this invalid pointer to free_percpu(), resulting in a kernel crash. Example crash trace: ================================================================== Kernel attempted to read user page (28) - exploit attempt? (uid: 0) BUG: Kernel NULL pointer dereference on read at 0x00000028 Faulting instruction address: 0xc000000000708f88 Oops: Kernel access of bad area, sig: 11 [#1] LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries [...] CPU: 5 UID: 0 PID: 5491 Comm: mk_nullb_shared Kdump: loaded Tainted: G B 6.16.0-rc5+ torvalds#294 VOLUNTARY Tainted: [B]=BAD_PAGE Hardware name: IBM,9043-MRX POWER10 (architected) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_028) hv:phyp pSeries [...] NIP [c000000000708f88] free_percpu+0x144/0xba8 LR [c000000000708f84] free_percpu+0x140/0xba8 Call Trace: free_percpu+0x140/0xba8 (unreliable) kyber_exit_hctx+0x94/0x124 blk_mq_exit_sched+0xe4/0x214 elevator_exit+0xa8/0xf4 elevator_switch+0x3b8/0x5d8 elv_update_nr_hw_queues+0x14c/0x300 blk_mq_update_nr_hw_queues+0x5cc/0x670 nullb_update_nr_hw_queues+0x118/0x1f8 [null_blk] nullb_device_submit_queues_store+0xac/0x170 [null_blk] configfs_write_iter+0x1dc/0x2d0 vfs_write+0x5b0/0x77c ksys_write+0xa0/0x180 system_call_exception+0x1b0/0x4f0 system_call_vectored_common+0x15c/0x2ec If the sbitmap depth is zero, sb->alloc_hint memory is NOT allocated, but the pointer is not explicitly set to NULL. Later, during sbitmap_free(), the kernel attempts to free sb->alloc_hint, which is a per cpu pointer variable, regardless of whether it was valid, leading to a crash. This patch ensures that sb->alloc_hint is explicitly set to NULL in sbitmap_init_node() when the requested depth is zero. This prevents free_percpu() from freeing sb->alloc_hint and thus avoids the observed crash. Reviewed-by: Damien Le Moal <dlemoal@kernel.org> Reviewed-by: Hannes Reinecke <hare@suse.de> Signed-off-by: Nilay Shroff <nilay@linux.ibm.com>

Update Kconfig

e35a40e

typo: missing verb.

iambrosie closed this May 31, 2016

laijs pushed a commit to laijs/linux that referenced this pull request Feb 13, 2017

Merge pull request torvalds#294 from copumpkin/cptofs-symlinks

6c7ad3e

lkl tools: add symlink support to cptofs

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Update Kconfig #294

Update Kconfig #294

Uh oh!

iambrosie commented May 30, 2016

Uh oh!

FadeMind commented May 31, 2016

Uh oh!

iambrosie commented May 31, 2016

Uh oh!

Uh oh!

Update Kconfig #294

Update Kconfig #294

Uh oh!

Conversation

iambrosie commented May 30, 2016

Uh oh!

FadeMind commented May 31, 2016

Uh oh!

iambrosie commented May 31, 2016

Uh oh!

Uh oh!