History

Merge tag 'v5.12-rc5' into locking/core, to pick up fixes

Ingo Molnar committed 5 years ago

Commit feecb812 parents bd9a5fc a5e13c6758 files · +6083 −3294Browse files

Showing the changes to kernel (23 of 758 files). Show all

Unified · Split

23 files
  1. kernel/bpf/bpf_inode_storage.c +1 −1
  2. kernel/bpf/bpf_struct_ops.c +1 −1
  3. kernel/bpf/core.c +2 −2
  4. kernel/bpf/preload/bpf_preload_kern.c +15 −4
  5. kernel/bpf/syscall.c +5 −0
  6. kernel/bpf/trampoline.c +168 −50
  7. kernel/bpf/verifier.c +25 −12
  8. kernel/fork.c +8 −9
  9. kernel/futex.c +1 −2
  10. kernel/gcov/clang.c +69 −0
  11. kernel/irq/irq_sim.c +2 −2
  12. kernel/irq/manage.c +4 −0
  13. kernel/jump_label.c +8 −0
  14. kernel/power/energy_model.c +1 −1
  15. kernel/ptrace.c +1 −1
  16. kernel/reboot.c +0 −2
  17. kernel/signal.c +11 −3
  18. kernel/static_call.c +24 −18
  19. kernel/time/alarmtimer.c +1 −1
  20. kernel/time/hrtimer.c +1 −1
  21. kernel/time/posix-cpu-timers.c +1 −1
  22. kernel/trace/ftrace.c +38 −5
  23. kernel/usermode_driver.c +15 −6
kernel/bpf/bpf_inode_storage.c+1−1
@@ -109,7 +109,7 @@ static void *bpf_fd_inode_storage_lookup_elem(struct bpf_map *map, void *key) · 108 unmodified lines
109 fd = *(int *)key;109 fd = *(int *)key;
110 f = fget_raw(fd);110 f = fget_raw(fd);
111 if (!f)111 if (!f)
112 return NULL;112 return ERR_PTR(-EBADF);
113 113
114 sdata = inode_storage_lookup(f->f_inode, map, true);114 sdata = inode_storage_lookup(f->f_inode, map, true);
115 fput(f);115 fput(f);
kernel/bpf/bpf_struct_ops.c+1−1
@@ -430,7 +430,7 @@ static int bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key, · 429 unmodified lines
430 430
431 tprogs[BPF_TRAMP_FENTRY].progs[0] = prog;431 tprogs[BPF_TRAMP_FENTRY].progs[0] = prog;
432 tprogs[BPF_TRAMP_FENTRY].nr_progs = 1;432 tprogs[BPF_TRAMP_FENTRY].nr_progs = 1;
433 err = arch_prepare_bpf_trampoline(image,433 err = arch_prepare_bpf_trampoline(NULL, image,
434 st_map->image + PAGE_SIZE,434 st_map->image + PAGE_SIZE,
435 &st_ops->func_models[i], 0,435 &st_ops->func_models[i], 0,
436 tprogs, NULL);436 tprogs, NULL);
kernel/bpf/core.c+2−2
@@ -827,7 +827,7 @@ static int __init bpf_jit_charge_init(void) · 826 unmodified lines
827}827}
828pure_initcall(bpf_jit_charge_init);828pure_initcall(bpf_jit_charge_init);
829 829
830static int bpf_jit_charge_modmem(u32 pages)830int bpf_jit_charge_modmem(u32 pages)
831{831{
832 if (atomic_long_add_return(pages, &bpf_jit_current) >832 if (atomic_long_add_return(pages, &bpf_jit_current) >
833 (bpf_jit_limit >> PAGE_SHIFT)) {833 (bpf_jit_limit >> PAGE_SHIFT)) {
@@ -840,7 +840,7 @@ static int bpf_jit_charge_modmem(u32 pages) · 6 unmodified lines
840 return 0;840 return 0;
841}841}
842 842
843static void bpf_jit_uncharge_modmem(u32 pages)843void bpf_jit_uncharge_modmem(u32 pages)
844{844{
845 atomic_long_sub(pages, &bpf_jit_current);845 atomic_long_sub(pages, &bpf_jit_current);
846}846}
kernel/bpf/preload/bpf_preload_kern.c+15−4
@@ -60,9 +60,12 @@ static int finish(void) · 59 unmodified lines
60 &magic, sizeof(magic), &pos);60 &magic, sizeof(magic), &pos);
61 if (n != sizeof(magic))61 if (n != sizeof(magic))
62 return -EPIPE;62 return -EPIPE;
63
63 tgid = umd_ops.info.tgid;64 tgid = umd_ops.info.tgid;
64 wait_event(tgid->wait_pidfd, thread_group_exited(tgid));65 if (tgid) {
65 umd_ops.info.tgid = NULL;66 wait_event(tgid->wait_pidfd, thread_group_exited(tgid));
67 umd_cleanup_helper(&umd_ops.info);
68 }
66 return 0;69 return 0;
67}70}
68 71
@@ -80,10 +83,18 @@ static int __init load_umd(void) · 11 unmodified lines
80 83
81static void __exit fini_umd(void)84static void __exit fini_umd(void)
82{85{
86 struct pid *tgid;
87
83 bpf_preload_ops = NULL;88 bpf_preload_ops = NULL;
89
84 /* kill UMD in case it's still there due to earlier error */90 /* kill UMD in case it's still there due to earlier error */
85 kill_pid(umd_ops.info.tgid, SIGKILL, 1);91 tgid = umd_ops.info.tgid;
86 umd_ops.info.tgid = NULL;92 if (tgid) {
93 kill_pid(tgid, SIGKILL, 1);
94
95 wait_event(tgid->wait_pidfd, thread_group_exited(tgid));
96 umd_cleanup_helper(&umd_ops.info);
97 }
87 umd_unload_blob(&umd_ops.info);98 umd_unload_blob(&umd_ops.info);
88}99}
89late_initcall(load_umd);100late_initcall(load_umd);
kernel/bpf/syscall.c+5−0
@@ -854,6 +854,11 @@ static int map_create(union bpf_attr *attr) · 853 unmodified lines
854 err = PTR_ERR(btf);854 err = PTR_ERR(btf);
855 goto free_map;855 goto free_map;
856 }856 }
857 if (btf_is_kernel(btf)) {
858 btf_put(btf);
859 err = -EACCES;
860 goto free_map;
861 }
857 map->btf = btf;862 map->btf = btf;
858 863
859 if (attr->btf_value_type_id) {864 if (attr->btf_value_type_id) {
kernel/bpf/trampoline.c+168−50
@@ -57,19 +57,10 @@ void bpf_image_ksym_del(struct bpf_ksym *ksym) · 56 unmodified lines
57 PAGE_SIZE, true, ksym->name);57 PAGE_SIZE, true, ksym->name);
58}58}
59 59
60static void bpf_trampoline_ksym_add(struct bpf_trampoline *tr)
61{
62 struct bpf_ksym *ksym = &tr->ksym;
63
64 snprintf(ksym->name, KSYM_NAME_LEN, "bpf_trampoline_%llu", tr->key);
65 bpf_image_ksym_add(tr->image, ksym);
66}
67
68static struct bpf_trampoline *bpf_trampoline_lookup(u64 key)60static struct bpf_trampoline *bpf_trampoline_lookup(u64 key)
69{61{
70 struct bpf_trampoline *tr;62 struct bpf_trampoline *tr;
71 struct hlist_head *head;63 struct hlist_head *head;
72 void *image;
73 int i;64 int i;
74 65
75 mutex_lock(&trampoline_mutex);66 mutex_lock(&trampoline_mutex);
@@ -84,14 +75,6 @@ static struct bpf_trampoline *bpf_trampoline_lookup(u64 key) · 8 unmodified lines
84 if (!tr)75 if (!tr)
85 goto out;76 goto out;
86 77
87 /* is_root was checked earlier. No need for bpf_jit_charge_modmem() */
88 image = bpf_jit_alloc_exec_page();
89 if (!image) {
90 kfree(tr);
91 tr = NULL;
92 goto out;
93 }
94
95 tr->key = key;78 tr->key = key;
96 INIT_HLIST_NODE(&tr->hlist);79 INIT_HLIST_NODE(&tr->hlist);
97 hlist_add_head(&tr->hlist, head);80 hlist_add_head(&tr->hlist, head);
@@ -99,9 +82,6 @@ static struct bpf_trampoline *bpf_trampoline_lookup(u64 key) · 1 unmodified line
99 mutex_init(&tr->mutex);82 mutex_init(&tr->mutex);
100 for (i = 0; i < BPF_TRAMP_MAX; i++)83 for (i = 0; i < BPF_TRAMP_MAX; i++)
101 INIT_HLIST_HEAD(&tr->progs_hlist[i]);84 INIT_HLIST_HEAD(&tr->progs_hlist[i]);
102 tr->image = image;
103 INIT_LIST_HEAD_RCU(&tr->ksym.lnode);
104 bpf_trampoline_ksym_add(tr);
105out:85out:
106 mutex_unlock(&trampoline_mutex);86 mutex_unlock(&trampoline_mutex);
107 return tr;87 return tr;
@@ -185,10 +165,142 @@ bpf_trampoline_get_progs(const struct bpf_trampoline *tr, int *total) · 77 unmodified lines
185 return tprogs;165 return tprogs;
186}166}
187 167
168static void __bpf_tramp_image_put_deferred(struct work_struct *work)
169{
170 struct bpf_tramp_image *im;
171
172 im = container_of(work, struct bpf_tramp_image, work);
173 bpf_image_ksym_del(&im->ksym);
174 bpf_jit_free_exec(im->image);
175 bpf_jit_uncharge_modmem(1);
176 percpu_ref_exit(&im->pcref);
177 kfree_rcu(im, rcu);
178}
179
180/* callback, fexit step 3 or fentry step 2 */
181static void __bpf_tramp_image_put_rcu(struct rcu_head *rcu)
182{
183 struct bpf_tramp_image *im;
184
185 im = container_of(rcu, struct bpf_tramp_image, rcu);
186 INIT_WORK(&im->work, __bpf_tramp_image_put_deferred);
187 schedule_work(&im->work);
188}
189
190/* callback, fexit step 2. Called after percpu_ref_kill confirms. */
191static void __bpf_tramp_image_release(struct percpu_ref *pcref)
192{
193 struct bpf_tramp_image *im;
194
195 im = container_of(pcref, struct bpf_tramp_image, pcref);
196 call_rcu_tasks(&im->rcu, __bpf_tramp_image_put_rcu);
197}
198
199/* callback, fexit or fentry step 1 */
200static void __bpf_tramp_image_put_rcu_tasks(struct rcu_head *rcu)
201{
202 struct bpf_tramp_image *im;
203
204 im = container_of(rcu, struct bpf_tramp_image, rcu);
205 if (im->ip_after_call)
206 /* the case of fmod_ret/fexit trampoline and CONFIG_PREEMPTION=y */
207 percpu_ref_kill(&im->pcref);
208 else
209 /* the case of fentry trampoline */
210 call_rcu_tasks(&im->rcu, __bpf_tramp_image_put_rcu);
211}
212
213static void bpf_tramp_image_put(struct bpf_tramp_image *im)
214{
215 /* The trampoline image that calls original function is using:
216 * rcu_read_lock_trace to protect sleepable bpf progs
217 * rcu_read_lock to protect normal bpf progs
218 * percpu_ref to protect trampoline itself
219 * rcu tasks to protect trampoline asm not covered by percpu_ref
220 * (which are few asm insns before __bpf_tramp_enter and
221 * after __bpf_tramp_exit)
222 *
223 * The trampoline is unreachable before bpf_tramp_image_put().
224 *
225 * First, patch the trampoline to avoid calling into fexit progs.
226 * The progs will be freed even if the original function is still
227 * executing or sleeping.
228 * In case of CONFIG_PREEMPT=y use call_rcu_tasks() to wait on
229 * first few asm instructions to execute and call into
230 * __bpf_tramp_enter->percpu_ref_get.
231 * Then use percpu_ref_kill to wait for the trampoline and the original
232 * function to finish.
233 * Then use call_rcu_tasks() to make sure few asm insns in
234 * the trampoline epilogue are done as well.
235 *
236 * In !PREEMPT case the task that got interrupted in the first asm
237 * insns won't go through an RCU quiescent state which the
238 * percpu_ref_kill will be waiting for. Hence the first
239 * call_rcu_tasks() is not necessary.
240 */
241 if (im->ip_after_call) {
242 int err = bpf_arch_text_poke(im->ip_after_call, BPF_MOD_JUMP,
243 NULL, im->ip_epilogue);
244 WARN_ON(err);
245 if (IS_ENABLED(CONFIG_PREEMPTION))
246 call_rcu_tasks(&im->rcu, __bpf_tramp_image_put_rcu_tasks);
247 else
248 percpu_ref_kill(&im->pcref);
249 return;
250 }
251
252 /* The trampoline without fexit and fmod_ret progs doesn't call original
253 * function and doesn't use percpu_ref.
254 * Use call_rcu_tasks_trace() to wait for sleepable progs to finish.
255 * Then use call_rcu_tasks() to wait for the rest of trampoline asm
256 * and normal progs.
257 */
258 call_rcu_tasks_trace(&im->rcu, __bpf_tramp_image_put_rcu_tasks);
259}
260
261static struct bpf_tramp_image *bpf_tramp_image_alloc(u64 key, u32 idx)
262{
263 struct bpf_tramp_image *im;
264 struct bpf_ksym *ksym;
265 void *image;
266 int err = -ENOMEM;
267
268 im = kzalloc(sizeof(*im), GFP_KERNEL);
269 if (!im)
270 goto out;
271
272 err = bpf_jit_charge_modmem(1);
273 if (err)
274 goto out_free_im;
275
276 err = -ENOMEM;
277 im->image = image = bpf_jit_alloc_exec_page();
278 if (!image)
279 goto out_uncharge;
280
281 err = percpu_ref_init(&im->pcref, __bpf_tramp_image_release, 0, GFP_KERNEL);
282 if (err)
283 goto out_free_image;
284
285 ksym = &im->ksym;
286 INIT_LIST_HEAD_RCU(&ksym->lnode);
287 snprintf(ksym->name, KSYM_NAME_LEN, "bpf_trampoline_%llu_%u", key, idx);
288 bpf_image_ksym_add(image, ksym);
289 return im;
290
291out_free_image:
292 bpf_jit_free_exec(im->image);
293out_uncharge:
294 bpf_jit_uncharge_modmem(1);
295out_free_im:
296 kfree(im);
297out:
298 return ERR_PTR(err);
299}
300
188static int bpf_trampoline_update(struct bpf_trampoline *tr)301static int bpf_trampoline_update(struct bpf_trampoline *tr)
189{302{
190 void *old_image = tr->image + ((tr->selector + 1) & 1) * PAGE_SIZE/2;303 struct bpf_tramp_image *im;
191 void *new_image = tr->image + (tr->selector & 1) * PAGE_SIZE/2;
192 struct bpf_tramp_progs *tprogs;304 struct bpf_tramp_progs *tprogs;
193 u32 flags = BPF_TRAMP_F_RESTORE_REGS;305 u32 flags = BPF_TRAMP_F_RESTORE_REGS;
194 int err, total;306 int err, total;
@@ -198,41 +310,42 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr) · 3 unmodified lines
198 return PTR_ERR(tprogs);310 return PTR_ERR(tprogs);
199 311
200 if (total == 0) {312 if (total == 0) {
201 err = unregister_fentry(tr, old_image);313 err = unregister_fentry(tr, tr->cur_image->image);
314 bpf_tramp_image_put(tr->cur_image);
315 tr->cur_image = NULL;
202 tr->selector = 0;316 tr->selector = 0;
203 goto out;317 goto out;
204 }318 }
205 319
320 im = bpf_tramp_image_alloc(tr->key, tr->selector);
321 if (IS_ERR(im)) {
322 err = PTR_ERR(im);
323 goto out;
324 }
325
206 if (tprogs[BPF_TRAMP_FEXIT].nr_progs ||326 if (tprogs[BPF_TRAMP_FEXIT].nr_progs ||
207 tprogs[BPF_TRAMP_MODIFY_RETURN].nr_progs)327 tprogs[BPF_TRAMP_MODIFY_RETURN].nr_progs)
208 flags = BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_SKIP_FRAME;328 flags = BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_SKIP_FRAME;
209 329
210 /* Though the second half of trampoline page is unused a task could be330 err = arch_prepare_bpf_trampoline(im, im->image, im->image + PAGE_SIZE,
211 * preempted in the middle of the first half of trampoline and two
212 * updates to trampoline would change the code from underneath the
213 * preempted task. Hence wait for tasks to voluntarily schedule or go
214 * to userspace.
215 * The same trampoline can hold both sleepable and non-sleepable progs.
216 * synchronize_rcu_tasks_trace() is needed to make sure all sleepable
217 * programs finish executing.
218 * Wait for these two grace periods together.
219 */
220 synchronize_rcu_mult(call_rcu_tasks, call_rcu_tasks_trace);
221
222 err = arch_prepare_bpf_trampoline(new_image, new_image + PAGE_SIZE / 2,
223 &tr->func.model, flags, tprogs,331 &tr->func.model, flags, tprogs,
224 tr->func.addr);332 tr->func.addr);
225 if (err < 0)333 if (err < 0)
226 goto out;334 goto out;
227 335
228 if (tr->selector)336 WARN_ON(tr->cur_image && tr->selector == 0);
337 WARN_ON(!tr->cur_image && tr->selector);
338 if (tr->cur_image)
229 /* progs already running at this address */339 /* progs already running at this address */
230 err = modify_fentry(tr, old_image, new_image);340 err = modify_fentry(tr, tr->cur_image->image, im->image);
231 else341 else
232 /* first time registering */342 /* first time registering */
233 err = register_fentry(tr, new_image);343 err = register_fentry(tr, im->image);
234 if (err)344 if (err)
235 goto out;345 goto out;
346 if (tr->cur_image)
347 bpf_tramp_image_put(tr->cur_image);
348 tr->cur_image = im;
236 tr->selector++;349 tr->selector++;
237out:350out:
238 kfree(tprogs);351 kfree(tprogs);
@@ -364,17 +477,12 @@ void bpf_trampoline_put(struct bpf_trampoline *tr) · 125 unmodified lines
364 goto out;477 goto out;
365 if (WARN_ON_ONCE(!hlist_empty(&tr->progs_hlist[BPF_TRAMP_FEXIT])))478 if (WARN_ON_ONCE(!hlist_empty(&tr->progs_hlist[BPF_TRAMP_FEXIT])))
366 goto out;479 goto out;
367 bpf_image_ksym_del(&tr->ksym);480 /* This code will be executed even when the last bpf_tramp_image
368 /* This code will be executed when all bpf progs (both sleepable and481 * is alive. All progs are detached from the trampoline and the
369 * non-sleepable) went through482 * trampoline image is patched with jmp into epilogue to skip
370 * bpf_prog_put()->call_rcu[_tasks_trace]()->bpf_prog_free_deferred().483 * fexit progs. The fentry-only trampoline will be freed via
371 * Hence no need for another synchronize_rcu_tasks_trace() here,484 * multiple rcu callbacks.
372 * but synchronize_rcu_tasks() is still needed, since trampoline
373 * may not have had any sleepable programs and we need to wait
374 * for tasks to get out of trampoline code before freeing it.
375 */485 */
376 synchronize_rcu_tasks();
377 bpf_jit_free_exec(tr->image);
378 hlist_del(&tr->hlist);486 hlist_del(&tr->hlist);
379 kfree(tr);487 kfree(tr);
380out:488out:
@@ -478,8 +586,18 @@ void notrace __bpf_prog_exit_sleepable(struct bpf_prog *prog, u64 start) · 97 unmodified lines
478 rcu_read_unlock_trace();586 rcu_read_unlock_trace();
479}587}
480 588
589void notrace __bpf_tramp_enter(struct bpf_tramp_image *tr)
590{
591 percpu_ref_get(&tr->pcref);
592}
593
594void notrace __bpf_tramp_exit(struct bpf_tramp_image *tr)
595{
596 percpu_ref_put(&tr->pcref);
597}
598
481int __weak599int __weak
482arch_prepare_bpf_trampoline(void *image, void *image_end,600arch_prepare_bpf_trampoline(struct bpf_tramp_image *tr, void *image, void *image_end,
483 const struct btf_func_model *m, u32 flags,601 const struct btf_func_model *m, u32 flags,
484 struct bpf_tramp_progs *tprogs,602 struct bpf_tramp_progs *tprogs,
485 void *orig_call)603 void *orig_call)
kernel/bpf/verifier.c+25−12
@@ -5861,10 +5861,14 @@ static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg, · 5860 unmodified lines
5861{5861{
5862 bool mask_to_left = (opcode == BPF_ADD && off_is_neg) ||5862 bool mask_to_left = (opcode == BPF_ADD && off_is_neg) ||
5863 (opcode == BPF_SUB && !off_is_neg);5863 (opcode == BPF_SUB && !off_is_neg);
5864 u32 off;5864 u32 off, max;
5865 5865
5866 switch (ptr_reg->type) {5866 switch (ptr_reg->type) {
5867 case PTR_TO_STACK:5867 case PTR_TO_STACK:
5868 /* Offset 0 is out-of-bounds, but acceptable start for the
5869 * left direction, see BPF_REG_FP.
5870 */
5871 max = MAX_BPF_STACK + mask_to_left;
5868 /* Indirect variable offset stack access is prohibited in5872 /* Indirect variable offset stack access is prohibited in
5869 * unprivileged mode so it's not handled here.5873 * unprivileged mode so it's not handled here.
5870 */5874 */
@@ -5872,16 +5876,17 @@ static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg, · 1 unmodified line
5872 if (mask_to_left)5876 if (mask_to_left)
5873 *ptr_limit = MAX_BPF_STACK + off;5877 *ptr_limit = MAX_BPF_STACK + off;
5874 else5878 else
5875 *ptr_limit = -off;5879 *ptr_limit = -off - 1;
5876 return 0;5880 return *ptr_limit >= max ? -ERANGE : 0;
5877 case PTR_TO_MAP_VALUE:5881 case PTR_TO_MAP_VALUE:
5882 max = ptr_reg->map_ptr->value_size;
5878 if (mask_to_left) {5883 if (mask_to_left) {
5879 *ptr_limit = ptr_reg->umax_value + ptr_reg->off;5884 *ptr_limit = ptr_reg->umax_value + ptr_reg->off;
5880 } else {5885 } else {
5881 off = ptr_reg->smin_value + ptr_reg->off;5886 off = ptr_reg->smin_value + ptr_reg->off;
5882 *ptr_limit = ptr_reg->map_ptr->value_size - off;5887 *ptr_limit = ptr_reg->map_ptr->value_size - off - 1;
5883 }5888 }
5884 return 0;5889 return *ptr_limit >= max ? -ERANGE : 0;
5885 default:5890 default:
5886 return -EINVAL;5891 return -EINVAL;
5887 }5892 }
@@ -5934,6 +5939,7 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env, · 46 unmodified lines
5934 u32 alu_state, alu_limit;5939 u32 alu_state, alu_limit;
5935 struct bpf_reg_state tmp;5940 struct bpf_reg_state tmp;
5936 bool ret;5941 bool ret;
5942 int err;
5937 5943
5938 if (can_skip_alu_sanitation(env, insn))5944 if (can_skip_alu_sanitation(env, insn))
5939 return 0;5945 return 0;
@@ -5949,10 +5955,13 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env, · 9 unmodified lines
5949 alu_state |= ptr_is_dst_reg ?5955 alu_state |= ptr_is_dst_reg ?
5950 BPF_ALU_SANITIZE_SRC : BPF_ALU_SANITIZE_DST;5956 BPF_ALU_SANITIZE_SRC : BPF_ALU_SANITIZE_DST;
5951 5957
5952 if (retrieve_ptr_limit(ptr_reg, &alu_limit, opcode, off_is_neg))5958 err = retrieve_ptr_limit(ptr_reg, &alu_limit, opcode, off_is_neg);
5953 return 0;5959 if (err < 0)
5954 if (update_alu_sanitation_state(aux, alu_state, alu_limit))5960 return err;
5955 return -EACCES;5961
5962 err = update_alu_sanitation_state(aux, alu_state, alu_limit);
5963 if (err < 0)
5964 return err;
5956do_sim:5965do_sim:
5957 /* Simulate and find potential out-of-bounds access under5966 /* Simulate and find potential out-of-bounds access under
5958 * speculative execution from truncation as a result of5967 * speculative execution from truncation as a result of
@@ -6103,7 +6112,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, · 144 unmodified lines
6103 case BPF_ADD:6112 case BPF_ADD:
6104 ret = sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0);6113 ret = sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0);
6105 if (ret < 0) {6114 if (ret < 0) {
6106 verbose(env, "R%d tried to add from different maps or paths\n", dst);6115 verbose(env, "R%d tried to add from different maps, paths, or prohibited types\n", dst);
6107 return ret;6116 return ret;
6108 }6117 }
6109 /* We can take a fixed offset as long as it doesn't overflow6118 /* We can take a fixed offset as long as it doesn't overflow
@@ -6158,7 +6167,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, · 48 unmodified lines
6158 case BPF_SUB:6167 case BPF_SUB:
6159 ret = sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0);6168 ret = sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0);
6160 if (ret < 0) {6169 if (ret < 0) {
6161 verbose(env, "R%d tried to sub from different maps or paths\n", dst);6170 verbose(env, "R%d tried to sub from different maps, paths, or prohibited types\n", dst);
6162 return ret;6171 return ret;
6163 }6172 }
6164 if (dst_reg == off_reg) {6173 if (dst_reg == off_reg) {
@@ -9056,6 +9065,10 @@ static int check_btf_info(struct bpf_verifier_env *env, · 2891 unmodified lines
9056 btf = btf_get_by_fd(attr->prog_btf_fd);9065 btf = btf_get_by_fd(attr->prog_btf_fd);
9057 if (IS_ERR(btf))9066 if (IS_ERR(btf))
9058 return PTR_ERR(btf);9067 return PTR_ERR(btf);
9068 if (btf_is_kernel(btf)) {
9069 btf_put(btf);
9070 return -EACCES;
9071 }
9059 env->prog->aux->btf = btf;9072 env->prog->aux->btf = btf;
9060 9073
9061 err = check_btf_func(env, attr, uattr);9074 err = check_btf_func(env, attr, uattr);
@@ -11660,7 +11673,7 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) · 2598 unmodified lines
11660 off_reg = issrc ? insn->src_reg : insn->dst_reg;11673 off_reg = issrc ? insn->src_reg : insn->dst_reg;
11661 if (isneg)11674 if (isneg)
11662 *patch++ = BPF_ALU64_IMM(BPF_MUL, off_reg, -1);11675 *patch++ = BPF_ALU64_IMM(BPF_MUL, off_reg, -1);
11663 *patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit - 1);11676 *patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit);
11664 *patch++ = BPF_ALU64_REG(BPF_SUB, BPF_REG_AX, off_reg);11677 *patch++ = BPF_ALU64_REG(BPF_SUB, BPF_REG_AX, off_reg);
11665 *patch++ = BPF_ALU64_REG(BPF_OR, BPF_REG_AX, off_reg);11678 *patch++ = BPF_ALU64_REG(BPF_OR, BPF_REG_AX, off_reg);
11666 *patch++ = BPF_ALU64_IMM(BPF_NEG, BPF_REG_AX, 0);11679 *patch++ = BPF_ALU64_IMM(BPF_NEG, BPF_REG_AX, 0);
kernel/fork.c+8−9
@@ -1948,8 +1948,14 @@ static __latent_entropy struct task_struct *copy_process( · 1947 unmodified lines
1948 p = dup_task_struct(current, node);1948 p = dup_task_struct(current, node);
1949 if (!p)1949 if (!p)
1950 goto fork_out;1950 goto fork_out;
1951 if (args->io_thread)1951 if (args->io_thread) {
1952 /*
1953 * Mark us an IO worker, and block any signal that isn't
1954 * fatal or STOP
1955 */
1952 p->flags |= PF_IO_WORKER;1956 p->flags |= PF_IO_WORKER;
1957 siginitsetinv(&p->blocked, sigmask(SIGKILL)|sigmask(SIGSTOP));
1958 }
1953 1959
1954 /*1960 /*
1955 * This _must_ happen before we call free_task(), i.e. before we jump1961 * This _must_ happen before we call free_task(), i.e. before we jump
@@ -2438,15 +2444,8 @@ struct task_struct *create_io_thread(int (*fn)(void *), void *arg, int node) · 482 unmodified lines
2438 .stack_size = (unsigned long)arg,2444 .stack_size = (unsigned long)arg,
2439 .io_thread = 1,2445 .io_thread = 1,
2440 };2446 };
2441 struct task_struct *tsk;
2442 2447
2443 tsk = copy_process(NULL, 0, node, &args);2448 return copy_process(NULL, 0, node, &args);
2444 if (!IS_ERR(tsk)) {
2445 sigfillset(&tsk->blocked);
2446 sigdelsetmask(&tsk->blocked, sigmask(SIGKILL));
2447 tsk->flags |= PF_NOFREEZE;
2448 }
2449 return tsk;
2450}2449}
2451 2450
2452/*2451/*
kernel/futex.c+1−2
@@ -2728,14 +2728,13 @@ retry: · 2727 unmodified lines
2728 goto out;2728 goto out;
2729 2729
2730 restart = &current->restart_block;2730 restart = &current->restart_block;
2731 restart->fn = futex_wait_restart;
2732 restart->futex.uaddr = uaddr;2731 restart->futex.uaddr = uaddr;
2733 restart->futex.val = val;2732 restart->futex.val = val;
2734 restart->futex.time = *abs_time;2733 restart->futex.time = *abs_time;
2735 restart->futex.bitset = bitset;2734 restart->futex.bitset = bitset;
2736 restart->futex.flags = flags | FLAGS_HAS_TIMEOUT;2735 restart->futex.flags = flags | FLAGS_HAS_TIMEOUT;
2737 2736
2738 ret = -ERESTART_RESTARTBLOCK;2737 ret = set_restart_fn(restart, futex_wait_restart);
2739 2738
2740out:2739out:
2741 if (to) {2740 if (to) {
kernel/gcov/clang.c+69−0
@@ -75,7 +75,9 @@ struct gcov_fn_info { · 74 unmodified lines
75 75
76 u32 num_counters;76 u32 num_counters;
77 u64 *counters;77 u64 *counters;
78#if CONFIG_CLANG_VERSION < 110000
78 const char *function_name;79 const char *function_name;
80#endif
79};81};
80 82
81static struct gcov_info *current_info;83static struct gcov_info *current_info;
@@ -105,6 +107,7 @@ void llvm_gcov_init(llvm_gcov_callback writeout, llvm_gcov_callback flush) · 23 unmodified lines
105}107}
106EXPORT_SYMBOL(llvm_gcov_init);108EXPORT_SYMBOL(llvm_gcov_init);
107 109
110#if CONFIG_CLANG_VERSION < 110000
108void llvm_gcda_start_file(const char *orig_filename, const char version[4],111void llvm_gcda_start_file(const char *orig_filename, const char version[4],
109 u32 checksum)112 u32 checksum)
110{113{
@@ -113,7 +116,17 @@ void llvm_gcda_start_file(const char *orig_filename, const char version[4], · 2 unmodified lines
113 current_info->checksum = checksum;116 current_info->checksum = checksum;
114}117}
115EXPORT_SYMBOL(llvm_gcda_start_file);118EXPORT_SYMBOL(llvm_gcda_start_file);
119#else
120void llvm_gcda_start_file(const char *orig_filename, u32 version, u32 checksum)
121{
122 current_info->filename = orig_filename;
123 current_info->version = version;
124 current_info->checksum = checksum;
125}
126EXPORT_SYMBOL(llvm_gcda_start_file);
127#endif
116 128
129#if CONFIG_CLANG_VERSION < 110000
117void llvm_gcda_emit_function(u32 ident, const char *function_name,130void llvm_gcda_emit_function(u32 ident, const char *function_name,
118 u32 func_checksum, u8 use_extra_checksum, u32 cfg_checksum)131 u32 func_checksum, u8 use_extra_checksum, u32 cfg_checksum)
119{132{
@@ -133,6 +146,24 @@ void llvm_gcda_emit_function(u32 ident, const char *function_name, · 13 unmodified lines
133 list_add_tail(&info->head, &current_info->functions);146 list_add_tail(&info->head, &current_info->functions);
134}147}
135EXPORT_SYMBOL(llvm_gcda_emit_function);148EXPORT_SYMBOL(llvm_gcda_emit_function);
149#else
150void llvm_gcda_emit_function(u32 ident, u32 func_checksum,
151 u8 use_extra_checksum, u32 cfg_checksum)
152{
153 struct gcov_fn_info *info = kzalloc(sizeof(*info), GFP_KERNEL);
154
155 if (!info)
156 return;
157
158 INIT_LIST_HEAD(&info->head);
159 info->ident = ident;
160 info->checksum = func_checksum;
161 info->use_extra_checksum = use_extra_checksum;
162 info->cfg_checksum = cfg_checksum;
163 list_add_tail(&info->head, &current_info->functions);
164}
165EXPORT_SYMBOL(llvm_gcda_emit_function);
166#endif
136 167
137void llvm_gcda_emit_arcs(u32 num_counters, u64 *counters)168void llvm_gcda_emit_arcs(u32 num_counters, u64 *counters)
138{169{
@@ -295,6 +326,7 @@ void gcov_info_add(struct gcov_info *dst, struct gcov_info *src) · 156 unmodified lines
295 }326 }
296}327}
297 328
329#if CONFIG_CLANG_VERSION < 110000
298static struct gcov_fn_info *gcov_fn_info_dup(struct gcov_fn_info *fn)330static struct gcov_fn_info *gcov_fn_info_dup(struct gcov_fn_info *fn)
299{331{
300 size_t cv_size; /* counter values size */332 size_t cv_size; /* counter values size */
@@ -322,6 +354,28 @@ err_name: · 21 unmodified lines
322 kfree(fn_dup);354 kfree(fn_dup);
323 return NULL;355 return NULL;
324}356}
357#else
358static struct gcov_fn_info *gcov_fn_info_dup(struct gcov_fn_info *fn)
359{
360 size_t cv_size; /* counter values size */
361 struct gcov_fn_info *fn_dup = kmemdup(fn, sizeof(*fn),
362 GFP_KERNEL);
363 if (!fn_dup)
364 return NULL;
365 INIT_LIST_HEAD(&fn_dup->head);
366
367 cv_size = fn->num_counters * sizeof(fn->counters[0]);
368 fn_dup->counters = vmalloc(cv_size);
369 if (!fn_dup->counters) {
370 kfree(fn_dup);
371 return NULL;
372 }
373
374 memcpy(fn_dup->counters, fn->counters, cv_size);
375
376 return fn_dup;
377}
378#endif
325 379
326/**380/**
327 * gcov_info_dup - duplicate profiling data set381 * gcov_info_dup - duplicate profiling data set
@@ -362,6 +416,7 @@ err: · 34 unmodified lines
362 * gcov_info_free - release memory for profiling data set duplicate416 * gcov_info_free - release memory for profiling data set duplicate
363 * @info: profiling data set duplicate to free417 * @info: profiling data set duplicate to free
364 */418 */
419#if CONFIG_CLANG_VERSION < 110000
365void gcov_info_free(struct gcov_info *info)420void gcov_info_free(struct gcov_info *info)
366{421{
367 struct gcov_fn_info *fn, *tmp;422 struct gcov_fn_info *fn, *tmp;
@@ -375,6 +430,20 @@ void gcov_info_free(struct gcov_info *info) · 7 unmodified lines
375 kfree(info->filename);430 kfree(info->filename);
376 kfree(info);431 kfree(info);
377}432}
433#else
434void gcov_info_free(struct gcov_info *info)
435{
436 struct gcov_fn_info *fn, *tmp;
437
438 list_for_each_entry_safe(fn, tmp, &info->functions, head) {
439 vfree(fn->counters);
440 list_del(&fn->head);
441 kfree(fn);
442 }
443 kfree(info->filename);
444 kfree(info);
445}
446#endif
378 447
379#define ITER_STRIDE PAGE_SIZE448#define ITER_STRIDE PAGE_SIZE
380 449
kernel/irq/irq_sim.c+2−2
@@ -159,7 +159,7 @@ static const struct irq_domain_ops irq_sim_domain_ops = { · 158 unmodified lines
159 * irq_domain_create_sim - Create a new interrupt simulator irq_domain and159 * irq_domain_create_sim - Create a new interrupt simulator irq_domain and
160 * allocate a range of dummy interrupts.160 * allocate a range of dummy interrupts.
161 *161 *
162 * @fnode: struct fwnode_handle to be associated with this domain.162 * @fwnode: struct fwnode_handle to be associated with this domain.
163 * @num_irqs: Number of interrupts to allocate.163 * @num_irqs: Number of interrupts to allocate.
164 *164 *
165 * On success: return a new irq_domain object.165 * On success: return a new irq_domain object.
@@ -228,7 +228,7 @@ static void devm_irq_domain_release_sim(struct device *dev, void *res) · 62 unmodified lines
228 * a managed device.228 * a managed device.
229 *229 *
230 * @dev: Device to initialize the simulator object for.230 * @dev: Device to initialize the simulator object for.
231 * @fnode: struct fwnode_handle to be associated with this domain.231 * @fwnode: struct fwnode_handle to be associated with this domain.
232 * @num_irqs: Number of interrupts to allocate232 * @num_irqs: Number of interrupts to allocate
233 *233 *
234 * On success: return a new irq_domain object.234 * On success: return a new irq_domain object.
kernel/irq/manage.c+4−0
@@ -1142,11 +1142,15 @@ irq_forced_thread_fn(struct irq_desc *desc, struct irqaction *action) · 1141 unmodified lines
1142 irqreturn_t ret;1142 irqreturn_t ret;
1143 1143
1144 local_bh_disable();1144 local_bh_disable();
1145 if (!IS_ENABLED(CONFIG_PREEMPT_RT))
1146 local_irq_disable();
1145 ret = action->thread_fn(action->irq, action->dev_id);1147 ret = action->thread_fn(action->irq, action->dev_id);
1146 if (ret == IRQ_HANDLED)1148 if (ret == IRQ_HANDLED)
1147 atomic_inc(&desc->threads_handled);1149 atomic_inc(&desc->threads_handled);
1148 1150
1149 irq_finalize_oneshot(desc, action);1151 irq_finalize_oneshot(desc, action);
1152 if (!IS_ENABLED(CONFIG_PREEMPT_RT))
1153 local_irq_enable();
1150 local_bh_enable();1154 local_bh_enable();
1151 return ret;1155 return ret;
1152}1156}
kernel/jump_label.c+8−0
@@ -407,6 +407,14 @@ static bool jump_label_can_update(struct jump_entry *entry, bool init) · 406 unmodified lines
407 return false;407 return false;
408 408
409 if (!kernel_text_address(jump_entry_code(entry))) {409 if (!kernel_text_address(jump_entry_code(entry))) {
410 /*
411 * This skips patching built-in __exit, which
412 * is part of init_section_contains() but is
413 * not part of kernel_text_address().
414 *
415 * Skipping built-in __exit is fine since it
416 * will never be executed.
417 */
410 WARN_ONCE(!jump_entry_is_init(entry),418 WARN_ONCE(!jump_entry_is_init(entry),
411 "can't patch jump_label at %pS",419 "can't patch jump_label at %pS",
412 (void *)jump_entry_code(entry));420 (void *)jump_entry_code(entry));
kernel/power/energy_model.c+1−1
@@ -98,7 +98,7 @@ static int __init em_debug_init(void) · 97 unmodified lines
98 98
99 return 0;99 return 0;
100}100}
101core_initcall(em_debug_init);101fs_initcall(em_debug_init);
102#else /* CONFIG_DEBUG_FS */102#else /* CONFIG_DEBUG_FS */
103static void em_debug_create_pd(struct device *dev) {}103static void em_debug_create_pd(struct device *dev) {}
104static void em_debug_remove_pd(struct device *dev) {}104static void em_debug_remove_pd(struct device *dev) {}
kernel/ptrace.c+1−1
@@ -375,7 +375,7 @@ static int ptrace_attach(struct task_struct *task, long request, · 374 unmodified lines
375 audit_ptrace(task);375 audit_ptrace(task);
376 376
377 retval = -EPERM;377 retval = -EPERM;
378 if (unlikely(task->flags & (PF_KTHREAD | PF_IO_WORKER)))378 if (unlikely(task->flags & PF_KTHREAD))
379 goto out;379 goto out;
380 if (same_thread_group(task, current))380 if (same_thread_group(task, current))
381 goto out;381 goto out;
kernel/reboot.c+0−2
@@ -244,8 +244,6 @@ void migrate_to_reboot_cpu(void) · 243 unmodified lines
244void kernel_restart(char *cmd)244void kernel_restart(char *cmd)
245{245{
246 kernel_restart_prepare(cmd);246 kernel_restart_prepare(cmd);
247 if (pm_power_off_prepare)
248 pm_power_off_prepare();
249 migrate_to_reboot_cpu();247 migrate_to_reboot_cpu();
250 syscore_shutdown();248 syscore_shutdown();
251 if (!cmd)249 if (!cmd)
kernel/signal.c+11−3
@@ -91,7 +91,7 @@ static bool sig_task_ignored(struct task_struct *t, int sig, bool force) · 90 unmodified lines
91 return true;91 return true;
92 92
93 /* Only allow kernel generated signals to this kthread */93 /* Only allow kernel generated signals to this kthread */
94 if (unlikely((t->flags & (PF_KTHREAD | PF_IO_WORKER)) &&94 if (unlikely((t->flags & PF_KTHREAD) &&
95 (handler == SIG_KTHREAD_KERNEL) && !force))95 (handler == SIG_KTHREAD_KERNEL) && !force))
96 return true;96 return true;
97 97
@@ -1096,7 +1096,7 @@ static int __send_signal(int sig, struct kernel_siginfo *info, struct task_struc · 998 unmodified lines
1096 /*1096 /*
1097 * Skip useless siginfo allocation for SIGKILL and kernel threads.1097 * Skip useless siginfo allocation for SIGKILL and kernel threads.
1098 */1098 */
1099 if ((sig == SIGKILL) || (t->flags & (PF_KTHREAD | PF_IO_WORKER)))1099 if ((sig == SIGKILL) || (t->flags & PF_KTHREAD))
1100 goto out_set;1100 goto out_set;
1101 1101
1102 /*1102 /*
@@ -2767,6 +2767,14 @@ relock: · 1664 unmodified lines
2767 do_coredump(&ksig->info);2767 do_coredump(&ksig->info);
2768 }2768 }
2769 2769
2770 /*
2771 * PF_IO_WORKER threads will catch and exit on fatal signals
2772 * themselves. They have cleanup that must be performed, so
2773 * we cannot call do_exit() on their behalf.
2774 */
2775 if (current->flags & PF_IO_WORKER)
2776 goto out;
2777
2770 /*2778 /*
2771 * Death signals, no core dump.2779 * Death signals, no core dump.
2772 */2780 */
@@ -2774,7 +2782,7 @@ relock: · 1 unmodified line
2774 /* NOTREACHED */2782 /* NOTREACHED */
2775 }2783 }
2776 spin_unlock_irq(&sighand->siglock);2784 spin_unlock_irq(&sighand->siglock);
2777 2785out:
2778 ksig->sig = signr;2786 ksig->sig = signr;
2779 2787
2780 if (!(ksig->ka.sa.sa_flags & SA_EXPOSE_TAGBITS))2788 if (!(ksig->ka.sa.sa_flags & SA_EXPOSE_TAGBITS))
kernel/static_call.c+24−18
@@ -35,27 +35,30 @@ static inline void *static_call_addr(struct static_call_site *site) · 34 unmodified lines
35 return (void *)((long)site->addr + (long)&site->addr);35 return (void *)((long)site->addr + (long)&site->addr);
36}36}
37 37
38static inline unsigned long __static_call_key(const struct static_call_site *site)
39{
40 return (long)site->key + (long)&site->key;
41}
38 42
39static inline struct static_call_key *static_call_key(const struct static_call_site *site)43static inline struct static_call_key *static_call_key(const struct static_call_site *site)
40{44{
41 return (struct static_call_key *)45 return (void *)(__static_call_key(site) & ~STATIC_CALL_SITE_FLAGS);
42 (((long)site->key + (long)&site->key) & ~STATIC_CALL_SITE_FLAGS);
43}46}
44 47
45/* These assume the key is word-aligned. */48/* These assume the key is word-aligned. */
46static inline bool static_call_is_init(struct static_call_site *site)49static inline bool static_call_is_init(struct static_call_site *site)
47{50{
48 return ((long)site->key + (long)&site->key) & STATIC_CALL_SITE_INIT;51 return __static_call_key(site) & STATIC_CALL_SITE_INIT;
49}52}
50 53
51static inline bool static_call_is_tail(struct static_call_site *site)54static inline bool static_call_is_tail(struct static_call_site *site)
52{55{
53 return ((long)site->key + (long)&site->key) & STATIC_CALL_SITE_TAIL;56 return __static_call_key(site) & STATIC_CALL_SITE_TAIL;
54}57}
55 58
56static inline void static_call_set_init(struct static_call_site *site)59static inline void static_call_set_init(struct static_call_site *site)
57{60{
58 site->key = ((long)static_call_key(site) | STATIC_CALL_SITE_INIT) -61 site->key = (__static_call_key(site) | STATIC_CALL_SITE_INIT) -
59 (long)&site->key;62 (long)&site->key;
60}63}
61 64
@@ -146,6 +149,7 @@ void __static_call_update(struct static_call_key *key, void *tramp, void *func) · 84 unmodified lines
146 };149 };
147 150
148 for (site_mod = &first; site_mod; site_mod = site_mod->next) {151 for (site_mod = &first; site_mod; site_mod = site_mod->next) {
152 bool init = system_state < SYSTEM_RUNNING;
149 struct module *mod = site_mod->mod;153 struct module *mod = site_mod->mod;
150 154
151 if (!site_mod->sites) {155 if (!site_mod->sites) {
@@ -165,6 +169,7 @@ void __static_call_update(struct static_call_key *key, void *tramp, void *func) · 13 unmodified lines
165 if (mod) {169 if (mod) {
166 stop = mod->static_call_sites +170 stop = mod->static_call_sites +
167 mod->num_static_call_sites;171 mod->num_static_call_sites;
172 init = mod->state == MODULE_STATE_COMING;
168 }173 }
169#endif174#endif
170 175
@@ -172,25 +177,26 @@ void __static_call_update(struct static_call_key *key, void *tramp, void *func) · 1 unmodified line
172 site < stop && static_call_key(site) == key; site++) {177 site < stop && static_call_key(site) == key; site++) {
173 void *site_addr = static_call_addr(site);178 void *site_addr = static_call_addr(site);
174 179
175 if (static_call_is_init(site)) {180 if (!init && static_call_is_init(site))
176 /*181 continue;
177 * Don't write to call sites which were in
178 * initmem and have since been freed.
179 */
180 if (!mod && system_state >= SYSTEM_RUNNING)
181 continue;
182 if (mod && !within_module_init((unsigned long)site_addr, mod))
183 continue;
184 }
185 182
186 if (!kernel_text_address((unsigned long)site_addr)) {183 if (!kernel_text_address((unsigned long)site_addr)) {
187 WARN_ONCE(1, "can't patch static call site at %pS",184 /*
185 * This skips patching built-in __exit, which
186 * is part of init_section_contains() but is
187 * not part of kernel_text_address().
188 *
189 * Skipping built-in __exit is fine since it
190 * will never be executed.
191 */
192 WARN_ONCE(!static_call_is_init(site),
193 "can't patch static call site at %pS",
188 site_addr);194 site_addr);
189 continue;195 continue;
190 }196 }
191 197
192 arch_static_call_transform(site_addr, NULL, func,198 arch_static_call_transform(site_addr, NULL, func,
193 static_call_is_tail(site));199 static_call_is_tail(site));
194 }200 }
195 }201 }
196 202
@@ -349,7 +355,7 @@ static int static_call_add_module(struct module *mod) · 152 unmodified lines
349 struct static_call_site *site;355 struct static_call_site *site;
350 356
351 for (site = start; site != stop; site++) {357 for (site = start; site != stop; site++) {
352 unsigned long s_key = (long)site->key + (long)&site->key;358 unsigned long s_key = __static_call_key(site);
353 unsigned long addr = s_key & ~STATIC_CALL_SITE_FLAGS;359 unsigned long addr = s_key & ~STATIC_CALL_SITE_FLAGS;
354 unsigned long key;360 unsigned long key;
355 361
kernel/time/alarmtimer.c+1−1
@@ -854,9 +854,9 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags, · 853 unmodified lines
854 if (flags == TIMER_ABSTIME)854 if (flags == TIMER_ABSTIME)
855 return -ERESTARTNOHAND;855 return -ERESTARTNOHAND;
856 856
857 restart->fn = alarm_timer_nsleep_restart;
858 restart->nanosleep.clockid = type;857 restart->nanosleep.clockid = type;
859 restart->nanosleep.expires = exp;858 restart->nanosleep.expires = exp;
859 set_restart_fn(restart, alarm_timer_nsleep_restart);
860 return ret;860 return ret;
861}861}
862 862
kernel/time/hrtimer.c+1−1
@@ -1957,9 +1957,9 @@ long hrtimer_nanosleep(ktime_t rqtp, const enum hrtimer_mode mode, · 1956 unmodified lines
1957 }1957 }
1958 1958
1959 restart = &current->restart_block;1959 restart = &current->restart_block;
1960 restart->fn = hrtimer_nanosleep_restart;
1961 restart->nanosleep.clockid = t.timer.base->clockid;1960 restart->nanosleep.clockid = t.timer.base->clockid;
1962 restart->nanosleep.expires = hrtimer_get_expires_tv64(&t.timer);1961 restart->nanosleep.expires = hrtimer_get_expires_tv64(&t.timer);
1962 set_restart_fn(restart, hrtimer_nanosleep_restart);
1963out:1963out:
1964 destroy_hrtimer_on_stack(&t.timer);1964 destroy_hrtimer_on_stack(&t.timer);
1965 return ret;1965 return ret;
kernel/time/posix-cpu-timers.c+1−1
@@ -1480,8 +1480,8 @@ static int posix_cpu_nsleep(const clockid_t which_clock, int flags, · 1479 unmodified lines
1480 if (flags & TIMER_ABSTIME)1480 if (flags & TIMER_ABSTIME)
1481 return -ERESTARTNOHAND;1481 return -ERESTARTNOHAND;
1482 1482
1483 restart_block->fn = posix_cpu_nsleep_restart;
1484 restart_block->nanosleep.clockid = which_clock;1483 restart_block->nanosleep.clockid = which_clock;
1484 set_restart_fn(restart_block, posix_cpu_nsleep_restart);
1485 }1485 }
1486 return error;1486 return error;
1487}1487}
kernel/trace/ftrace.c+38−5
@@ -5045,6 +5045,20 @@ struct ftrace_direct_func *ftrace_find_direct_func(unsigned long addr) · 5044 unmodified lines
5045 return NULL;5045 return NULL;
5046}5046}
5047 5047
5048static struct ftrace_direct_func *ftrace_alloc_direct_func(unsigned long addr)
5049{
5050 struct ftrace_direct_func *direct;
5051
5052 direct = kmalloc(sizeof(*direct), GFP_KERNEL);
5053 if (!direct)
5054 return NULL;
5055 direct->addr = addr;
5056 direct->count = 0;
5057 list_add_rcu(&direct->next, &ftrace_direct_funcs);
5058 ftrace_direct_func_count++;
5059 return direct;
5060}
5061
5048/**5062/**
5049 * register_ftrace_direct - Call a custom trampoline directly5063 * register_ftrace_direct - Call a custom trampoline directly
5050 * @ip: The address of the nop at the beginning of a function5064 * @ip: The address of the nop at the beginning of a function
@@ -5120,15 +5134,11 @@ int register_ftrace_direct(unsigned long ip, unsigned long addr) · 69 unmodified lines
5120 5134
5121 direct = ftrace_find_direct_func(addr);5135 direct = ftrace_find_direct_func(addr);
5122 if (!direct) {5136 if (!direct) {
5123 direct = kmalloc(sizeof(*direct), GFP_KERNEL);5137 direct = ftrace_alloc_direct_func(addr);
5124 if (!direct) {5138 if (!direct) {
5125 kfree(entry);5139 kfree(entry);
5126 goto out_unlock;5140 goto out_unlock;
5127 }5141 }
5128 direct->addr = addr;
5129 direct->count = 0;
5130 list_add_rcu(&direct->next, &ftrace_direct_funcs);
5131 ftrace_direct_func_count++;
5132 }5142 }
5133 5143
5134 entry->ip = ip;5144 entry->ip = ip;
@@ -5329,6 +5339,7 @@ int __weak ftrace_modify_direct_caller(struct ftrace_func_entry *entry, · 194 unmodified lines
5329int modify_ftrace_direct(unsigned long ip,5339int modify_ftrace_direct(unsigned long ip,
5330 unsigned long old_addr, unsigned long new_addr)5340 unsigned long old_addr, unsigned long new_addr)
5331{5341{
5342 struct ftrace_direct_func *direct, *new_direct = NULL;
5332 struct ftrace_func_entry *entry;5343 struct ftrace_func_entry *entry;
5333 struct dyn_ftrace *rec;5344 struct dyn_ftrace *rec;
5334 int ret = -ENODEV;5345 int ret = -ENODEV;
@@ -5344,6 +5355,20 @@ int modify_ftrace_direct(unsigned long ip, · 9 unmodified lines
5344 if (entry->direct != old_addr)5355 if (entry->direct != old_addr)
5345 goto out_unlock;5356 goto out_unlock;
5346 5357
5358 direct = ftrace_find_direct_func(old_addr);
5359 if (WARN_ON(!direct))
5360 goto out_unlock;
5361 if (direct->count > 1) {
5362 ret = -ENOMEM;
5363 new_direct = ftrace_alloc_direct_func(new_addr);
5364 if (!new_direct)
5365 goto out_unlock;
5366 direct->count--;
5367 new_direct->count++;
5368 } else {
5369 direct->addr = new_addr;
5370 }
5371
5347 /*5372 /*
5348 * If there's no other ftrace callback on the rec->ip location,5373 * If there's no other ftrace callback on the rec->ip location,
5349 * then it can be changed directly by the architecture.5374 * then it can be changed directly by the architecture.
@@ -5357,6 +5382,14 @@ int modify_ftrace_direct(unsigned long ip, · 7 unmodified lines
5357 ret = 0;5382 ret = 0;
5358 }5383 }
5359 5384
5385 if (unlikely(ret && new_direct)) {
5386 direct->count++;
5387 list_del_rcu(&new_direct->next);
5388 synchronize_rcu_tasks();
5389 kfree(new_direct);
5390 ftrace_direct_func_count--;
5391 }
5392
5360 out_unlock:5393 out_unlock:
5361 mutex_unlock(&ftrace_lock);5394 mutex_unlock(&ftrace_lock);
5362 mutex_unlock(&direct_mutex);5395 mutex_unlock(&direct_mutex);
kernel/usermode_driver.c+15−6
@@ -139,13 +139,22 @@ static void umd_cleanup(struct subprocess_info *info) · 138 unmodified lines
139 struct umd_info *umd_info = info->data;139 struct umd_info *umd_info = info->data;
140 140
141 /* cleanup if umh_setup() was successful but exec failed */141 /* cleanup if umh_setup() was successful but exec failed */
142 if (info->retval) {142 if (info->retval)
143 fput(umd_info->pipe_to_umh);143 umd_cleanup_helper(umd_info);
144 fput(umd_info->pipe_from_umh);144}
145 put_pid(umd_info->tgid);145
146 umd_info->tgid = NULL;146/**
147 }147 * umd_cleanup_helper - release the resources which were allocated in umd_setup
148 * @info: information about usermode driver
149 */
150void umd_cleanup_helper(struct umd_info *info)
151{
152 fput(info->pipe_to_umh);
153 fput(info->pipe_from_umh);
154 put_pid(info->tgid);
155 info->tgid = NULL;
148}156}
157EXPORT_SYMBOL_GPL(umd_cleanup_helper);
149 158
150/**159/**
151 * fork_usermode_driver - fork a usermode driver160 * fork_usermode_driver - fork a usermode driver

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t