History

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

tools/testing/selftests/net/mptcp/mptcp_join.sh 34aa6e3bccd8 ("selftests: mptcp: add ip mptcp wrappers") 857898eb4b28 ("selftests: mptcp: add missing join check") 6ef84b1517e0 ("selftests: mptcp: more robust signal race test") https://lore.kernel.org/all/20220221131842.468893-1-broonie@kernel.org/ drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/act.h drivers/net/ethernet/mellanox/mlx5/core/en/tc/act/ct.c fb7e76ea3f3b6 ("net/mlx5e: TC, Skip redundant ct clear actions") c63741b426e11 ("net/mlx5e: Fix MPLSoUDP encap to use MPLS action information") 09bf97923224f ("net/mlx5e: TC, Move pedit_headers_action to parse_attr") 84ba8062e383 ("net/mlx5e: Test CT and SAMPLE on flow attr") efe6f961cd2e ("net/mlx5e: CT, Don't set flow flag CT for ct clear flow") 3b49a7edec1d ("net/mlx5e: TC, Reject rules with multiple CT actions")

Jakub Kicinski committed 4 years ago

Commit aaa25a22 parents 9e7b78d d8152cf227 files · +1756 −925Browse files

Showing the changes to kernel (9 of 227 files). Show all

Unified · Split

9 files
  1. kernel/cgroup/cgroup-v1.c +4 −2
  2. kernel/cgroup/cgroup.c +14 −0
  3. kernel/cgroup/cpuset.c +7 −5
  4. kernel/cred.c +2 −7
  5. kernel/fork.c +20 −10
  6. kernel/locking/lockdep.c +2 −2
  7. kernel/sched/core.c +21 −13
  8. kernel/sys.c +14 −6
  9. kernel/ucount.c +2 −1
kernel/cgroup/cgroup-v1.c+4−2
@@ -546,6 +546,7 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of, · 545 unmodified lines
546546 char *buf, size_t nbytes, loff_t off)
547547 {
548548 struct cgroup *cgrp;
549+ struct cgroup_file_ctx *ctx;
549550
550551 BUILD_BUG_ON(sizeof(cgrp->root->release_agent_path) < PATH_MAX);
551552
@@ -553,8 +554,9 @@ static ssize_t cgroup_release_agent_write(struct kernfs_open_file *of, · 1 unmodified line
553554 * Release agent gets called with all capabilities,
554555 * require capabilities to set release agent.
555556 */
556− if ((of->file->f_cred->user_ns != &init_user_ns) ||
557− !capable(CAP_SYS_ADMIN))
557+ ctx = of->priv;
558+ if ((ctx->ns->user_ns != &init_user_ns) ||
559+ !file_ns_capable(of->file, &init_user_ns, CAP_SYS_ADMIN))
558560 return -EPERM;
559561
560562 cgrp = cgroup_kn_lock_live(of->kn, false);
kernel/cgroup/cgroup.c+14−0
@@ -6166,6 +6166,20 @@ static int cgroup_css_set_fork(struct kernel_clone_args *kargs) · 6165 unmodified lines
61666166 if (ret)
61676167 goto err;
61686168
6169+ /*
6170+ * Spawning a task directly into a cgroup works by passing a file
6171+ * descriptor to the target cgroup directory. This can even be an O_PATH
6172+ * file descriptor. But it can never be a cgroup.procs file descriptor.
6173+ * This was done on purpose so spawning into a cgroup could be
6174+ * conceptualized as an atomic
6175+ *
6176+ * fd = openat(dfd_cgroup, "cgroup.procs", ...);
6177+ * write(fd, <child-pid>, ...);
6178+ *
6179+ * sequence, i.e. it's a shorthand for the caller opening and writing
6180+ * cgroup.procs of the cgroup indicated by @dfd_cgroup. This allows us
6181+ * to always use the caller's credentials.
6182+ */
61696183 ret = cgroup_attach_permissions(cset->dfl_cgrp, dst_cgrp, sb,
61706184 !(kargs->flags & CLONE_THREAD),
61716185 current->nsproxy->cgroup_ns);
kernel/cgroup/cpuset.c+7−5
@@ -2289,6 +2289,7 @@ static void cpuset_attach(struct cgroup_taskset *tset) · 2288 unmodified lines
22892289 cgroup_taskset_first(tset, &css);
22902290 cs = css_cs(css);
22912291
2292+ cpus_read_lock();
22922293 percpu_down_write(&cpuset_rwsem);
22932294
22942295 guarantee_online_mems(cs, &cpuset_attach_nodemask_to);
@@ -2342,6 +2343,7 @@ static void cpuset_attach(struct cgroup_taskset *tset) · 47 unmodified lines
23422343 wake_up(&cpuset_attach_wq);
23432344
23442345 percpu_up_write(&cpuset_rwsem);
2346+ cpus_read_unlock();
23452347 }
23462348
23472349 /* The various types of files and directories in a cpuset file system */
@@ -3522,8 +3524,8 @@ static struct cpuset *nearest_hardwall_ancestor(struct cpuset *cs) · 1174 unmodified lines
35223524 return cs;
35233525 }
35243526
3525−/**
3526− * cpuset_node_allowed - Can we allocate on a memory node?
3527+/*
3528+ * __cpuset_node_allowed - Can we allocate on a memory node?
35273529 * @node: is this an allowed node?
35283530 * @gfp_mask: memory allocation flags
35293531 *
@@ -3694,8 +3696,8 @@ void cpuset_print_current_mems_allowed(void) · 164 unmodified lines
36943696
36953697 int cpuset_memory_pressure_enabled __read_mostly;
36963698
3697−/**
3698− * cpuset_memory_pressure_bump - keep stats of per-cpuset reclaims.
3699+/*
3700+ * __cpuset_memory_pressure_bump - keep stats of per-cpuset reclaims.
36993701 *
37003702 * Keep a running average of the rate of synchronous (direct)
37013703 * page reclaim efforts initiated by tasks in each cpuset.
@@ -3710,7 +3712,7 @@ int cpuset_memory_pressure_enabled __read_mostly; · 8 unmodified lines
37103712 * "memory_pressure". Value displayed is an integer
37113713 * representing the recent rate of entry into the synchronous
37123714 * (direct) page reclaim by any task attached to the cpuset.
3713− **/
3715+ */
37143716
37153717 void __cpuset_memory_pressure_bump(void)
37163718 {
kernel/cred.c+2−7
@@ -665,21 +665,16 @@ EXPORT_SYMBOL(cred_fscmp); · 664 unmodified lines
665665
666666 int set_cred_ucounts(struct cred *new)
667667 {
668− struct task_struct *task = current;
669− const struct cred *old = task->real_cred;
670668 struct ucounts *new_ucounts, *old_ucounts = new->ucounts;
671669
672− if (new->user == old->user && new->user_ns == old->user_ns)
673− return 0;
674−
675670 /*
676671 * This optimization is needed because alloc_ucounts() uses locks
677672 * for table lookups.
678673 */
679− if (old_ucounts->ns == new->user_ns && uid_eq(old_ucounts->uid, new->euid))
674+ if (old_ucounts->ns == new->user_ns && uid_eq(old_ucounts->uid, new->uid))
680675 return 0;
681676
682− if (!(new_ucounts = alloc_ucounts(new->user_ns, new->euid)))
677+ if (!(new_ucounts = alloc_ucounts(new->user_ns, new->uid)))
683678 return -EAGAIN;
684679
685680 new->ucounts = new_ucounts;
kernel/fork.c+20−10
@@ -2021,18 +2021,18 @@ static __latent_entropy struct task_struct *copy_process( · 2020 unmodified lines
20212021 #ifdef CONFIG_PROVE_LOCKING
20222022 DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
20232023 #endif
2024+ retval = copy_creds(p, clone_flags);
2025+ if (retval < 0)
2026+ goto bad_fork_free;
2027+
20242028 retval = -EAGAIN;
20252029 if (is_ucounts_overlimit(task_ucounts(p), UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC))) {
20262030 if (p->real_cred->user != INIT_USER &&
20272031 !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
2028− goto bad_fork_free;
2032+ goto bad_fork_cleanup_count;
20292033 }
20302034 current->flags &= ~PF_NPROC_EXCEEDED;
20312035
2032− retval = copy_creds(p, clone_flags);
2033− if (retval < 0)
2034− goto bad_fork_free;
2035−
20362036 /*
20372037 * If multiple threads are within copy_process(), then this check
20382038 * triggers too late. This doesn't hurt, the check is only there
@@ -2266,6 +2266,17 @@ static __latent_entropy struct task_struct *copy_process( · 227 unmodified lines
22662266 if (retval)
22672267 goto bad_fork_put_pidfd;
22682268
2269+ /*
2270+ * Now that the cgroups are pinned, re-clone the parent cgroup and put
2271+ * the new task on the correct runqueue. All this *before* the task
2272+ * becomes visible.
2273+ *
2274+ * This isn't part of ->can_fork() because while the re-cloning is
2275+ * cgroup specific, it unconditionally needs to place the task on a
2276+ * runqueue.
2277+ */
2278+ sched_cgroup_fork(p, args);
2279+
22692280 /*
22702281 * From this point on we must avoid any synchronous user-space
22712282 * communication until we take the tasklist-lock. In particular, we do
@@ -2323,10 +2334,6 @@ static __latent_entropy struct task_struct *copy_process( · 51 unmodified lines
23232334 goto bad_fork_cancel_cgroup;
23242335 }
23252336
2326− /* past the last point of failure */
2327− if (pidfile)
2328− fd_install(pidfd, pidfile);
2329−
23302337 init_task_pid_links(p);
23312338 if (likely(p->pid)) {
23322339 ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace);
@@ -2375,8 +2382,11 @@ static __latent_entropy struct task_struct *copy_process( · 42 unmodified lines
23752382 syscall_tracepoint_update(p);
23762383 write_unlock_irq(&tasklist_lock);
23772384
2385+ if (pidfile)
2386+ fd_install(pidfd, pidfile);
2387+
23782388 proc_fork_connector(p);
2379− sched_post_fork(p, args);
2389+ sched_post_fork(p);
23802390 cgroup_post_fork(p, args);
23812391 perf_event_fork(p);
23822392
kernel/locking/lockdep.c+2−2
@@ -3462,7 +3462,7 @@ struct lock_class *lock_chain_get_class(struct lock_chain *chain, int i) · 3461 unmodified lines
34623462 u16 chain_hlock = chain_hlocks[chain->base + i];
34633463 unsigned int class_idx = chain_hlock_class_idx(chain_hlock);
34643464
3465− return lock_classes + class_idx - 1;
3465+ return lock_classes + class_idx;
34663466 }
34673467
34683468 /*
@@ -3530,7 +3530,7 @@ static void print_chain_keys_chain(struct lock_chain *chain) · 61 unmodified lines
35303530 hlock_id = chain_hlocks[chain->base + i];
35313531 chain_key = print_chain_key_iteration(hlock_id, chain_key);
35323532
3533− print_lock_name(lock_classes + chain_hlock_class_idx(hlock_id) - 1);
3533+ print_lock_name(lock_classes + chain_hlock_class_idx(hlock_id));
35343534 printk("\n");
35353535 }
35363536 }
kernel/sched/core.c+21−13
@@ -1214,9 +1214,8 @@ int tg_nop(struct task_group *tg, void *data) · 1213 unmodified lines
12141214 }
12151215 #endif
12161216
1217−static void set_load_weight(struct task_struct *p)
1217+static void set_load_weight(struct task_struct *p, bool update_load)
12181218 {
1219− bool update_load = !(READ_ONCE(p->__state) & TASK_NEW);
12201219 int prio = p->static_prio - MAX_RT_PRIO;
12211220 struct load_weight *load = &p->se.load;
12221221
@@ -4407,7 +4406,7 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p) · 3184 unmodified lines
44074406 p->static_prio = NICE_TO_PRIO(0);
44084407
44094408 p->prio = p->normal_prio = p->static_prio;
4410− set_load_weight(p);
4409+ set_load_weight(p, false);
44114410
44124411 /*
44134412 * We don't need the reset flag anymore after the fork. It has
@@ -4425,6 +4424,7 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p) · 11 unmodified lines
44254424
44264425 init_entity_runnable_average(&p->se);
44274426
4427+
44284428 #ifdef CONFIG_SCHED_INFO
44294429 if (likely(sched_info_on()))
44304430 memset(&p->sched_info, 0, sizeof(p->sched_info));
@@ -4440,18 +4440,23 @@ int sched_fork(unsigned long clone_flags, struct task_struct *p) · 9 unmodified lines
44404440 return 0;
44414441 }
44424442
4443−void sched_post_fork(struct task_struct *p, struct kernel_clone_args *kargs)
4443+void sched_cgroup_fork(struct task_struct *p, struct kernel_clone_args *kargs)
44444444 {
44454445 unsigned long flags;
4446−#ifdef CONFIG_CGROUP_SCHED
4447− struct task_group *tg;
4448−#endif
44494446
4447+ /*
4448+ * Because we're not yet on the pid-hash, p->pi_lock isn't strictly
4449+ * required yet, but lockdep gets upset if rules are violated.
4450+ */
44504451 raw_spin_lock_irqsave(&p->pi_lock, flags);
44514452 #ifdef CONFIG_CGROUP_SCHED
4452− tg = container_of(kargs->cset->subsys[cpu_cgrp_id],
4453− struct task_group, css);
4454− p->sched_task_group = autogroup_task_group(p, tg);
4453+ if (1) {
4454+ struct task_group *tg;
4455+ tg = container_of(kargs->cset->subsys[cpu_cgrp_id],
4456+ struct task_group, css);
4457+ tg = autogroup_task_group(p, tg);
4458+ p->sched_task_group = tg;
4459+ }
44554460 #endif
44564461 rseq_migrate(p);
44574462 /*
@@ -4462,7 +4467,10 @@ void sched_post_fork(struct task_struct *p, struct kernel_clone_args *kargs) · 4 unmodified lines
44624467 if (p->sched_class->task_fork)
44634468 p->sched_class->task_fork(p);
44644469 raw_spin_unlock_irqrestore(&p->pi_lock, flags);
4470+}
44654471
4472+void sched_post_fork(struct task_struct *p)
4473+{
44664474 uclamp_post_fork(p);
44674475 }
44684476
@@ -6922,7 +6930,7 @@ void set_user_nice(struct task_struct *p, long nice) · 2453 unmodified lines
69226930 put_prev_task(rq, p);
69236931
69246932 p->static_prio = NICE_TO_PRIO(nice);
6925− set_load_weight(p);
6933+ set_load_weight(p, true);
69266934 old_prio = p->prio;
69276935 p->prio = effective_prio(p);
69286936
@@ -7213,7 +7221,7 @@ static void __setscheduler_params(struct task_struct *p, · 284 unmodified lines
72137221 */
72147222 p->rt_priority = attr->sched_priority;
72157223 p->normal_prio = normal_prio(p);
7216− set_load_weight(p);
7224+ set_load_weight(p, true);
72177225 }
72187226
72197227 /*
@@ -9446,7 +9454,7 @@ void __init sched_init(void) · 2226 unmodified lines
94469454 #endif
94479455 }
94489456
9449− set_load_weight(&init_task);
9457+ set_load_weight(&init_task, false);
94509458
94519459 /*
94529460 * The boot idle thread does lazy MMU switching as well:
kernel/sys.c+14−6
@@ -472,6 +472,16 @@ static int set_user(struct cred *new) · 471 unmodified lines
472472 if (!new_user)
473473 return -EAGAIN;
474474
475+ free_uid(new->user);
476+ new->user = new_user;
477+ return 0;
478+}
479+
480+static void flag_nproc_exceeded(struct cred *new)
481+{
482+ if (new->ucounts == current_ucounts())
483+ return;
484+
475485 /*
476486 * We don't fail in case of NPROC limit excess here because too many
477487 * poorly written programs don't check set*uid() return code, assuming
@@ -480,15 +490,10 @@ static int set_user(struct cred *new) · 2 unmodified lines
480490 * failure to the execve() stage.
481491 */
482492 if (is_ucounts_overlimit(new->ucounts, UCOUNT_RLIMIT_NPROC, rlimit(RLIMIT_NPROC)) &&
483− new_user != INIT_USER &&
484− !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
493+ new->user != INIT_USER)
485494 current->flags |= PF_NPROC_EXCEEDED;
486495 else
487496 current->flags &= ~PF_NPROC_EXCEEDED;
488−
489− free_uid(new->user);
490− new->user = new_user;
491− return 0;
492497 }
493498
494499 /*
@@ -563,6 +568,7 @@ long __sys_setreuid(uid_t ruid, uid_t euid) · 68 unmodified lines
563568 if (retval < 0)
564569 goto error;
565570
571+ flag_nproc_exceeded(new);
566572 return commit_creds(new);
567573
568574 error:
@@ -625,6 +631,7 @@ long __sys_setuid(uid_t uid) · 56 unmodified lines
625631 if (retval < 0)
626632 goto error;
627633
634+ flag_nproc_exceeded(new);
628635 return commit_creds(new);
629636
630637 error:
@@ -704,6 +711,7 @@ long __sys_setresuid(uid_t ruid, uid_t euid, uid_t suid) · 73 unmodified lines
704711 if (retval < 0)
705712 goto error;
706713
714+ flag_nproc_exceeded(new);
707715 return commit_creds(new);
708716
709717 error:
kernel/ucount.c+2−1
@@ -350,7 +350,8 @@ bool is_ucounts_overlimit(struct ucounts *ucounts, enum ucount_type type, unsign · 349 unmodified lines
350350 if (rlimit > LONG_MAX)
351351 max = LONG_MAX;
352352 for (iter = ucounts; iter; iter = iter->ns->ucounts) {
353− if (get_ucounts_value(iter, type) > max)
353+ long val = get_ucounts_value(iter, type);
354+ if (val < 0 || val > max)
354355 return true;
355356 max = READ_ONCE(iter->ns->ucount_max[type]);
356357 }