Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

tools/testing/selftests/net/mptcp/mptcp_join.sh 34aa6e3bccd8 ("selftests: mptcp: add ip mptcp wrappers") 857898eb4b28 ("selftests: mptcp: add missing join check") 6ef84b1517e0 ("selftests: mptcp: more robust signal race test") https://lore.kernel.org/all/20220221131842.468893-1-broonie@kernel.org/ drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/ct.c fb7e76ea3f3b6 ("net/mlx5e: TC, Skip redundant ct clear actions") c63741b426e11 ("net/mlx5e: Fix MPLSoUDP encap to use MPLS action information") 09bf97923224f ("net/mlx5e: TC, Move pedit_headers_action to parse_attr") 84ba8062e383 ("net/mlx5e: Test CT and SAMPLE on flow attr") efe6f961cd2e ("net/mlx5e: CT, Don't set flow flag CT for ct clear flow") 3b49a7edec1d ("net/mlx5e: TC, Reject rules with multiple CT actions")

Jakub Kicinski committed 4 years ago

Commit aaa25a22 parents 9e7b78d d8152cf227 files · +1756 −925Browse files

Showing the changes to kernel (9 of 227 files). Show all

Unified · Split

9 files

kernel/cgroup/cgroup-v1.c +4 −2
kernel/cgroup/cgroup.c +14 −0
kernel/cgroup/cpuset.c +7 −5
kernel/cred.c +2 −7
kernel/fork.c +20 −10
kernel/locking/lockdep.c +2 −2
kernel/sched/core.c +21 −13
kernel/sys.c +14 −6
kernel/ucount.c +2 −1

kernel/cgroup/cgroup-v1.c+4−2

 					  char *buf, size_t nbytes, loff_t off)
 {
 	struct cgroup *cgrp;
+	struct cgroup_file_ctx *ctx;
 	BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);
 	 * Release agent gets called with all capabilities,
 	 * require capabilities to set release agent.
 	 */
-	if ((of->file->f_cred->user_ns != &init_user_ns) ||
+	ctx = of->priv;
-	    !capable(CAP_SYS_ADMIN))
+	if ((ctx->ns->user_ns != &init_user_ns) ||
+	    !file_ns_capable(of->file, &init_user_ns, CAP_SYS_ADMIN))
 		return -EPERM;
 	cgrp = cgroup_kn_lock_live(of->kn, false);

kernel/cgroup/cgroup.c+14−0

@@ -6166,6 +6166,20 @@ static int cgroup_css_set_fork(struct kernel_clone_args *kargs) · 6165 unmodified lines
6166	if (ret)	6166	if (ret)
6167	goto err;	6167	goto err;
6168		6168
		6169	/*
		6170	* Spawning a task directly into a cgroup works by passing a file
		6171	* descriptor to the target cgroup directory. This can even be an O_PATH
		6172	* file descriptor. But it can never be a cgroup.procs file descriptor.
		6173	* This was done on purpose so spawning into a cgroup could be
		6174	* conceptualized as an atomic
		6175	*
		6176	* fd = openat(dfd_cgroup, "cgroup.procs", ...);
		6177	* write(fd, <child-pid>, ...);
		6178	*
		6179	* sequence, i.e. it's a shorthand for the caller opening and writing
		6180	* cgroup.procs of the cgroup indicated by @dfd_cgroup. This allows us
		6181	* to always use the caller's credentials.
		6182	*/
6169	ret = cgroup_attach_permissions(cset->dfl_cgrp, dst_cgrp, sb,	6183	ret = cgroup_attach_permissions(cset->dfl_cgrp, dst_cgrp, sb,
6170	!(kargs->flags & CLONE_THREAD),	6184	!(kargs->flags & CLONE_THREAD),
6171	current->nsproxy->cgroup_ns);	6185	current->nsproxy->cgroup_ns);

kernel/cgroup/cpuset.c+7−5

 	cgroup_taskset_first(tset, &css);
 	cs = css_cs(css);
+	cpus_read_lock();
 	percpu_down_write(&cpuset_rwsem);
 	guarantee_online_mems(cs, &cpuset_attach_nodemask_to);
 		wake_up(&cpuset_attach_wq);
 	percpu_up_write(&cpuset_rwsem);
+	cpus_read_unlock();
 }
 /* The various types of files and directories in a cpuset file system */
 	return cs;
 }
-/**
+/*
- * cpuset_node_allowed - Can we allocate on a memory node?
+ * __cpuset_node_allowed - Can we allocate on a memory node?
  * @node: is this an allowed node?
  * @gfp_mask: memory allocation flags
  *
 int cpuset_memory_pressure_enabled __read_mostly;
-/**
+/*
- * cpuset_memory_pressure_bump - keep stats of per-cpuset reclaims.
+ * __cpuset_memory_pressure_bump - keep stats of per-cpuset reclaims.
  *
  * Keep a running average of the rate of synchronous (direct)
  * page reclaim efforts initiated by tasks in each cpuset.
  * "memory_pressure".  Value displayed is an integer
  * representing the recent rate of entry into the synchronous
  * (direct) page reclaim by any task attached to the cpuset.
- **/
+ */
 void __cpuset_memory_pressure_bump(void)
 {

kernel/cred.c+2−7

 int set_cred_ucounts(struct cred *new)
 {
-	struct task_struct *task = current;
-	const struct cred *old = task->real_cred;
 	struct ucounts *new_ucounts, *old_ucounts = new->ucounts;
-	if (new->user == old->user && new->user_ns == old->user_ns)
-		return 0;
 	/*
 	 * This optimization is needed because alloc_ucounts() uses locks
 	 * for table lookups.
 	 */
-	if (old_ucounts->ns == new->user_ns && uid_eq(old_ucounts->uid, new->euid))
+	if (old_ucounts->ns == new->user_ns && uid_eq(old_ucounts->uid, new->uid))
 		return 0;
-	if (!(new_ucounts = alloc_ucounts(new->user_ns, new->euid)))
+	if (!(new_ucounts = alloc_ucounts(new->user_ns, new->uid)))
 		return -EAGAIN;
 	new->ucounts = new_ucounts;

kernel/fork.c+20−10

 #ifdef CONFIG_PROVE_LOCKING
 	DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
 #endif
+	retval = copy_creds(p, clone_flags);
+	if (retval < 0)
+		goto bad_fork_free;
 	retval = -EAGAIN;
 	if (is_ucounts_overlimit(task_ucounts(p), UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC))) {
 		if (p->real_cred->user != INIT_USER &&
 		    !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
-			goto bad_fork_free;
+			goto bad_fork_cleanup_count;
 	}
 	current->flags &= ~PF_NPROC_EXCEEDED;
-	retval = copy_creds(p, clone_flags);
-	if (retval < 0)
-		goto bad_fork_free;
 	/*
 	 * If multiple threads are within copy_process(), then this check
 	 * triggers too late. This doesn't hurt, the check is only there
 	if (retval)
 		goto bad_fork_put_pidfd;
+	/*
+	 * Now that the cgroups are pinned, re-clone the parent cgroup and put
+	 * the new task on the correct runqueue. All this *before* the task
+	 * becomes visible.
+	 *
+	 * This isn't part of ->can_fork() because while the re-cloning is
+	 * cgroup specific, it unconditionally needs to place the task on a
+	 * runqueue.
+	 */
+	sched_cgroup_fork(p, args);
 	/*
 	 * From this point on we must avoid any synchronous user-space
 	 * communication until we take the tasklist-lock. In particular, we do
 		goto bad_fork_cancel_cgroup;
 	}
-	/* past the last point of failure */
-	if (pidfile)
-		fd_install(pidfd, pidfile);
 	init_task_pid_links(p);
 	if (likely(p->pid)) {
 		ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace);
 	syscall_tracepoint_update(p);
 	write_unlock_irq(&tasklist_lock);
+	if (pidfile)
+		fd_install(pidfd, pidfile);
 	proc_fork_connector(p);
-	sched_post_fork(p, args);
+	sched_post_fork(p);
 	cgroup_post_fork(p, args);
 	perf_event_fork(p);

kernel/locking/lockdep.c+2−2

@@ -3462,7 +3462,7 @@ struct lock_class lock_chain_get_class(struct lock_chain chain, int i) · 3461 unmodified lines
3462	u16 chain_hlock = chain_hlocks[chain->base + i];	3462	u16 chain_hlock = chain_hlocks[chain->base + i];
3463	unsigned int class_idx = chain_hlock_class_idx(chain_hlock);	3463	unsigned int class_idx = chain_hlock_class_idx(chain_hlock);
3464		3464
3465	return lock_classes + class_idx - 1;	3465	return lock_classes + class_idx;
3466	}	3466	}
3467		3467
3468	/*	3468	/*
@@ -3530,7 +3530,7 @@ static void print_chain_keys_chain(struct lock_chain *chain) · 61 unmodified lines
3530	hlock_id = chain_hlocks[chain->base + i];	3530	hlock_id = chain_hlocks[chain->base + i];
3531	chain_key = print_chain_key_iteration(hlock_id, chain_key);	3531	chain_key = print_chain_key_iteration(hlock_id, chain_key);
3532		3532
3533	print_lock_name(lock_classes + chain_hlock_class_idx(hlock_id) - 1);	3533	print_lock_name(lock_classes + chain_hlock_class_idx(hlock_id));
3534	printk("\n");	3534	printk("\n");
3535	}	3535	}
3536	}	3536	}

kernel/sched/core.c+21−13

 }
 #endif
-static void set_load_weight(struct task_struct *p)
+static void set_load_weight(struct task_struct *p, bool update_load)
 {
-	bool update_load = !(READ_ONCE(p->__state) & TASK_NEW);
 	int prio = p->static_prio - MAX_RT_PRIO;
 	struct load_weight *load = &p->se.load;
 			p->static_prio = NICE_TO_PRIO(0);
 		p->prio = p->normal_prio = p->static_prio;
-		set_load_weight(p);
+		set_load_weight(p, false);
 		/*
 		 * We don't need the reset flag anymore after the fork. It has
 	init_entity_runnable_average(&p->se);
 #ifdef CONFIG_SCHED_INFO
 	if (likely(sched_info_on()))
 		memset(&p->sched_info, 0, sizeof(p->sched_info));
 	return 0;
 }
-void sched_post_fork(struct task_struct *p, struct kernel_clone_args *kargs)
+void sched_cgroup_fork(struct task_struct *p, struct kernel_clone_args *kargs)
 {
 	unsigned long flags;
-#ifdef CONFIG_CGROUP_SCHED
-	struct task_group *tg;
-#endif
+	/*
+	 * Because we're not yet on the pid-hash, p->pi_lock isn't strictly
+	 * required yet, but lockdep gets upset if rules are violated.
+	 */
 	raw_spin_lock_irqsave(&p->pi_lock, flags);
 #ifdef CONFIG_CGROUP_SCHED
-	tg = container_of(kargs->cset->subsys[cpu_cgrp_id],
+	if (1) {
-			  struct task_group, css);
+		struct task_group *tg;
-	p->sched_task_group = autogroup_task_group(p, tg);
+		tg = container_of(kargs->cset->subsys[cpu_cgrp_id],
+				  struct task_group, css);
+		tg = autogroup_task_group(p, tg);
+		p->sched_task_group = tg;
+	}
 #endif
 	rseq_migrate(p);
 	/*
 	if (p->sched_class->task_fork)
 		p->sched_class->task_fork(p);
 	raw_spin_unlock_irqrestore(&p->pi_lock, flags);
+}
+void sched_post_fork(struct task_struct *p)
+{
 	uclamp_post_fork(p);
 }
 		put_prev_task(rq, p);
 	p->static_prio = NICE_TO_PRIO(nice);
-	set_load_weight(p);
+	set_load_weight(p, true);
 	old_prio = p->prio;
 	p->prio = effective_prio(p);
 	 */
 	p->rt_priority = attr->sched_priority;
 	p->normal_prio = normal_prio(p);
-	set_load_weight(p);
+	set_load_weight(p, true);
 }
 /*
 #endif
 	}
-	set_load_weight(&init_task);
+	set_load_weight(&init_task, false);
 	/*
 	 * The boot idle thread does lazy MMU switching as well:

kernel/sys.c+14−6

 	if (!new_user)
 		return -EAGAIN;
+	free_uid(new->user);
+	new->user = new_user;
+	return 0;
+}
+static void flag_nproc_exceeded(struct cred *new)
+{
+	if (new->ucounts == current_ucounts())
+		return;
 	/*
 	 * We don't fail in case of NPROC limit excess here because too many
 	 * poorly written programs don't check set*uid() return code, assuming
 	 * failure to the execve() stage.
 	 */
 	if (is_ucounts_overlimit(new->ucounts, UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC)) &&
-			new_user != INIT_USER &&
+			new->user != INIT_USER)
-			!capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
 		current->flags |= PF_NPROC_EXCEEDED;
 	else
 		current->flags &= ~PF_NPROC_EXCEEDED;
-	free_uid(new->user);
-	new->user = new_user;
-	return 0;
 }
 /*
 	if (retval < 0)
 		goto error;
+	flag_nproc_exceeded(new);
 	return commit_creds(new);
 error:
 	if (retval < 0)
 		goto error;
+	flag_nproc_exceeded(new);
 	return commit_creds(new);
 error:
 	if (retval < 0)
 		goto error;
+	flag_nproc_exceeded(new);
 	return commit_creds(new);
 error:

kernel/ucount.c+2−1

 	if (rlimit > LONG_MAX)
 		max = LONG_MAX;
 	for (iter = ucounts; iter; iter = iter->ns->ucounts) {
-		if (get_ucounts_value(iter, type) > max)
+		long val = get_ucounts_value(iter, type);
+		if (val < 0 || val > max)
 			return true;
 		max = READ_ONCE(iter->ns->ucount_max[type]);
 	}