History

Merge tag 'v5.12-rc5' into locking/core, to pick up fixes

Ingo Molnar committed 5 years ago

Commit feecb812 parents bd9a5fc a5e13c6758 files · +6083 −3294Browse files

Showing the changes to kernel (23 of 758 files). Show all

Unified · Split

23 files
  1. kernel/bpf/bpf_inode_storage.c +1 −1
  2. kernel/bpf/bpf_struct_ops.c +1 −1
  3. kernel/bpf/core.c +2 −2
  4. kernel/bpf/preload/bpf_preload_kern.c +15 −4
  5. kernel/bpf/syscall.c +5 −0
  6. kernel/bpf/trampoline.c +168 −50
  7. kernel/bpf/verifier.c +25 −12
  8. kernel/fork.c +8 −9
  9. kernel/futex.c +1 −2
  10. kernel/gcov/clang.c +69 −0
  11. kernel/irq/irq_sim.c +2 −2
  12. kernel/irq/manage.c +4 −0
  13. kernel/jump_label.c +8 −0
  14. kernel/power/energy_model.c +1 −1
  15. kernel/ptrace.c +1 −1
  16. kernel/reboot.c +0 −2
  17. kernel/signal.c +11 −3
  18. kernel/static_call.c +24 −18
  19. kernel/time/alarmtimer.c +1 −1
  20. kernel/time/hrtimer.c +1 −1
  21. kernel/time/posix-cpu-timers.c +1 −1
  22. kernel/trace/ftrace.c +38 −5
  23. kernel/usermode_driver.c +15 −6
kernel/bpf/bpf_inode_storage.c+1−1
@@ -109,7 +109,7 @@ static void *bpf_fd_inode_storage_lookup_elem(struct bpf_map *map, void *key) · 108 unmodified lines
109109 fd = *(int *)key;
110110 f = fget_raw(fd);
111111 if (!f)
112− return NULL;
112+ return ERR_PTR(-EBADF);
113113
114114 sdata = inode_storage_lookup(f->f_inode, map, true);
115115 fput(f);
kernel/bpf/bpf_struct_ops.c+1−1
@@ -430,7 +430,7 @@ static int bpf_struct_ops_map_update_elem(struct bpf_map *map, void *key, · 429 unmodified lines
430430
431431 tprogs[BPF_TRAMP_FENTRY].progs[0] = prog;
432432 tprogs[BPF_TRAMP_FENTRY].nr_progs = 1;
433− err = arch_prepare_bpf_trampoline(image,
433+ err = arch_prepare_bpf_trampoline(NULL, image,
434434 st_map->image + PAGE_SIZE,
435435 &st_ops->func_models[i], 0,
436436 tprogs, NULL);
kernel/bpf/core.c+2−2
@@ -827,7 +827,7 @@ static int __init bpf_jit_charge_init(void) · 826 unmodified lines
827827 }
828828 pure_initcall(bpf_jit_charge_init);
829829
830−static int bpf_jit_charge_modmem(u32 pages)
830+int bpf_jit_charge_modmem(u32 pages)
831831 {
832832 if (atomic_long_add_return(pages, &bpf_jit_current) >
833833 (bpf_jit_limit >> PAGE_SHIFT)) {
@@ -840,7 +840,7 @@ static int bpf_jit_charge_modmem(u32 pages) · 6 unmodified lines
840840 return 0;
841841 }
842842
843−static void bpf_jit_uncharge_modmem(u32 pages)
843+void bpf_jit_uncharge_modmem(u32 pages)
844844 {
845845 atomic_long_sub(pages, &bpf_jit_current);
846846 }
kernel/bpf/preload/bpf_preload_kern.c+15−4
@@ -60,9 +60,12 @@ static int finish(void) · 59 unmodified lines
6060 &magic, sizeof(magic), &pos);
6161 if (n != sizeof(magic))
6262 return -EPIPE;
63+
6364 tgid = umd_ops.info.tgid;
64− wait_event(tgid->wait_pidfd, thread_group_exited(tgid));
65− umd_ops.info.tgid = NULL;
65+ if (tgid) {
66+ wait_event(tgid->wait_pidfd, thread_group_exited(tgid));
67+ umd_cleanup_helper(&umd_ops.info);
68+ }
6669 return 0;
6770 }
6871
@@ -80,10 +83,18 @@ static int __init load_umd(void) · 11 unmodified lines
8083
8184 static void __exit fini_umd(void)
8285 {
86+ struct pid *tgid;
87+
8388 bpf_preload_ops = NULL;
89+
8490 /* kill UMD in case it's still there due to earlier error */
85− kill_pid(umd_ops.info.tgid, SIGKILL, 1);
86− umd_ops.info.tgid = NULL;
91+ tgid = umd_ops.info.tgid;
92+ if (tgid) {
93+ kill_pid(tgid, SIGKILL, 1);
94+
95+ wait_event(tgid->wait_pidfd, thread_group_exited(tgid));
96+ umd_cleanup_helper(&umd_ops.info);
97+ }
8798 umd_unload_blob(&umd_ops.info);
8899 }
89100 late_initcall(load_umd);
kernel/bpf/syscall.c+5−0
@@ -854,6 +854,11 @@ static int map_create(union bpf_attr *attr) · 853 unmodified lines
854854 err = PTR_ERR(btf);
855855 goto free_map;
856856 }
857+ if (btf_is_kernel(btf)) {
858+ btf_put(btf);
859+ err = -EACCES;
860+ goto free_map;
861+ }
857862 map->btf = btf;
858863
859864 if (attr->btf_value_type_id) {
kernel/bpf/trampoline.c+168−50
@@ -57,19 +57,10 @@ void bpf_image_ksym_del(struct bpf_ksym *ksym) · 56 unmodified lines
5757 PAGE_SIZE, true, ksym->name);
5858 }
5959
60−static void bpf_trampoline_ksym_add(struct bpf_trampoline *tr)
61−{
62− struct bpf_ksym *ksym = &tr->ksym;
63−
64− snprintf(ksym->name, KSYM_NAME_LEN, "bpf_trampoline_%llu", tr->key);
65− bpf_image_ksym_add(tr->image, ksym);
66−}
67−
6860 static struct bpf_trampoline *bpf_trampoline_lookup(u64 key)
6961 {
7062 struct bpf_trampoline *tr;
7163 struct hlist_head *head;
72− void *image;
7364 int i;
7465
7566 mutex_lock(&trampoline_mutex);
@@ -84,14 +75,6 @@ static struct bpf_trampoline *bpf_trampoline_lookup(u64 key) · 8 unmodified lines
8475 if (!tr)
8576 goto out;
8677
87− /* is_root was checked earlier. No need for bpf_jit_charge_modmem() */
88− image = bpf_jit_alloc_exec_page();
89− if (!image) {
90− kfree(tr);
91− tr = NULL;
92− goto out;
93− }
94−
9578 tr->key = key;
9679 INIT_HLIST_NODE(&tr->hlist);
9780 hlist_add_head(&tr->hlist, head);
@@ -99,9 +82,6 @@ static struct bpf_trampoline *bpf_trampoline_lookup(u64 key) · 1 unmodified line
9982 mutex_init(&tr->mutex);
10083 for (i = 0; i < BPF_TRAMP_MAX; i++)
10184 INIT_HLIST_HEAD(&tr->progs_hlist[i]);
102− tr->image = image;
103− INIT_LIST_HEAD_RCU(&tr->ksym.lnode);
104− bpf_trampoline_ksym_add(tr);
10585 out:
10686 mutex_unlock(&trampoline_mutex);
10787 return tr;
@@ -185,10 +165,142 @@ bpf_trampoline_get_progs(const struct bpf_trampoline *tr, int *total) · 77 unmodified lines
185165 return tprogs;
186166 }
187167
168+static void __bpf_tramp_image_put_deferred(struct work_struct *work)
169+{
170+ struct bpf_tramp_image *im;
171+
172+ im = container_of(work, struct bpf_tramp_image, work);
173+ bpf_image_ksym_del(&im->ksym);
174+ bpf_jit_free_exec(im->image);
175+ bpf_jit_uncharge_modmem(1);
176+ percpu_ref_exit(&im->pcref);
177+ kfree_rcu(im, rcu);
178+}
179+
180+/* callback, fexit step 3 or fentry step 2 */
181+static void __bpf_tramp_image_put_rcu(struct rcu_head *rcu)
182+{
183+ struct bpf_tramp_image *im;
184+
185+ im = container_of(rcu, struct bpf_tramp_image, rcu);
186+ INIT_WORK(&im->work, __bpf_tramp_image_put_deferred);
187+ schedule_work(&im->work);
188+}
189+
190+/* callback, fexit step 2. Called after percpu_ref_kill confirms. */
191+static void __bpf_tramp_image_release(struct percpu_ref *pcref)
192+{
193+ struct bpf_tramp_image *im;
194+
195+ im = container_of(pcref, struct bpf_tramp_image, pcref);
196+ call_rcu_tasks(&im->rcu, __bpf_tramp_image_put_rcu);
197+}
198+
199+/* callback, fexit or fentry step 1 */
200+static void __bpf_tramp_image_put_rcu_tasks(struct rcu_head *rcu)
201+{
202+ struct bpf_tramp_image *im;
203+
204+ im = container_of(rcu, struct bpf_tramp_image, rcu);
205+ if (im->ip_after_call)
206+ /* the case of fmod_ret/fexit trampoline and CONFIG_PREEMPTION=y */
207+ percpu_ref_kill(&im->pcref);
208+ else
209+ /* the case of fentry trampoline */
210+ call_rcu_tasks(&im->rcu, __bpf_tramp_image_put_rcu);
211+}
212+
213+static void bpf_tramp_image_put(struct bpf_tramp_image *im)
214+{
215+ /* The trampoline image that calls original function is using:
216+ * rcu_read_lock_trace to protect sleepable bpf progs
217+ * rcu_read_lock to protect normal bpf progs
218+ * percpu_ref to protect trampoline itself
219+ * rcu tasks to protect trampoline asm not covered by percpu_ref
220+ * (which are few asm insns before __bpf_tramp_enter and
221+ * after __bpf_tramp_exit)
222+ *
223+ * The trampoline is unreachable before bpf_tramp_image_put().
224+ *
225+ * First, patch the trampoline to avoid calling into fexit progs.
226+ * The progs will be freed even if the original function is still
227+ * executing or sleeping.
228+ * In case of CONFIG_PREEMPT=y use call_rcu_tasks() to wait on
229+ * first few asm instructions to execute and call into
230+ * __bpf_tramp_enter->percpu_ref_get.
231+ * Then use percpu_ref_kill to wait for the trampoline and the original
232+ * function to finish.
233+ * Then use call_rcu_tasks() to make sure few asm insns in
234+ * the trampoline epilogue are done as well.
235+ *
236+ * In !PREEMPT case the task that got interrupted in the first asm
237+ * insns won't go through an RCU quiescent state which the
238+ * percpu_ref_kill will be waiting for. Hence the first
239+ * call_rcu_tasks() is not necessary.
240+ */
241+ if (im->ip_after_call) {
242+ int err = bpf_arch_text_poke(im->ip_after_call, BPF_MOD_JUMP,
243+ NULL, im->ip_epilogue);
244+ WARN_ON(err);
245+ if (IS_ENABLED(CONFIG_PREEMPTION))
246+ call_rcu_tasks(&im->rcu, __bpf_tramp_image_put_rcu_tasks);
247+ else
248+ percpu_ref_kill(&im->pcref);
249+ return;
250+ }
251+
252+ /* The trampoline without fexit and fmod_ret progs doesn't call original
253+ * function and doesn't use percpu_ref.
254+ * Use call_rcu_tasks_trace() to wait for sleepable progs to finish.
255+ * Then use call_rcu_tasks() to wait for the rest of trampoline asm
256+ * and normal progs.
257+ */
258+ call_rcu_tasks_trace(&im->rcu, __bpf_tramp_image_put_rcu_tasks);
259+}
260+
261+static struct bpf_tramp_image *bpf_tramp_image_alloc(u64 key, u32 idx)
262+{
263+ struct bpf_tramp_image *im;
264+ struct bpf_ksym *ksym;
265+ void *image;
266+ int err = -ENOMEM;
267+
268+ im = kzalloc(sizeof(*im), GFP_KERNEL);
269+ if (!im)
270+ goto out;
271+
272+ err = bpf_jit_charge_modmem(1);
273+ if (err)
274+ goto out_free_im;
275+
276+ err = -ENOMEM;
277+ im->image = image = bpf_jit_alloc_exec_page();
278+ if (!image)
279+ goto out_uncharge;
280+
281+ err = percpu_ref_init(&im->pcref, __bpf_tramp_image_release, 0, GFP_KERNEL);
282+ if (err)
283+ goto out_free_image;
284+
285+ ksym = &im->ksym;
286+ INIT_LIST_HEAD_RCU(&ksym->lnode);
287+ snprintf(ksym->name, KSYM_NAME_LEN, "bpf_trampoline_%llu_%u", key, idx);
288+ bpf_image_ksym_add(image, ksym);
289+ return im;
290+
291+out_free_image:
292+ bpf_jit_free_exec(im->image);
293+out_uncharge:
294+ bpf_jit_uncharge_modmem(1);
295+out_free_im:
296+ kfree(im);
297+out:
298+ return ERR_PTR(err);
299+}
300+
188301 static int bpf_trampoline_update(struct bpf_trampoline *tr)
189302 {
190− void *old_image = tr->image + ((tr->selector + 1) & 1) * PAGE_SIZE/2;
191− void *new_image = tr->image + (tr->selector & 1) * PAGE_SIZE/2;
303+ struct bpf_tramp_image *im;
192304 struct bpf_tramp_progs *tprogs;
193305 u32 flags = BPF_TRAMP_F_RESTORE_REGS;
194306 int err, total;
@@ -198,41 +310,42 @@ static int bpf_trampoline_update(struct bpf_trampoline *tr) · 3 unmodified lines
198310 return PTR_ERR(tprogs);
199311
200312 if (total == 0) {
201− err = unregister_fentry(tr, old_image);
313+ err = unregister_fentry(tr, tr->cur_image->image);
314+ bpf_tramp_image_put(tr->cur_image);
315+ tr->cur_image = NULL;
202316 tr->selector = 0;
203317 goto out;
204318 }
205319
320+ im = bpf_tramp_image_alloc(tr->key, tr->selector);
321+ if (IS_ERR(im)) {
322+ err = PTR_ERR(im);
323+ goto out;
324+ }
325+
206326 if (tprogs[BPF_TRAMP_FEXIT].nr_progs ||
207327 tprogs[BPF_TRAMP_MODIFY_RETURN].nr_progs)
208328 flags = BPF_TRAMP_F_CALL_ORIG | BPF_TRAMP_F_SKIP_FRAME;
209329
210− /* Though the second half of trampoline page is unused a task could be
211− * preempted in the middle of the first half of trampoline and two
212− * updates to trampoline would change the code from underneath the
213− * preempted task. Hence wait for tasks to voluntarily schedule or go
214− * to userspace.
215− * The same trampoline can hold both sleepable and non-sleepable progs.
216− * synchronize_rcu_tasks_trace() is needed to make sure all sleepable
217− * programs finish executing.
218− * Wait for these two grace periods together.
219− */
220− synchronize_rcu_mult(call_rcu_tasks, call_rcu_tasks_trace);
221−
222− err = arch_prepare_bpf_trampoline(new_image, new_image + PAGE_SIZE / 2,
330+ err = arch_prepare_bpf_trampoline(im, im->image, im->image + PAGE_SIZE,
223331 &tr->func.model, flags, tprogs,
224332 tr->func.addr);
225333 if (err < 0)
226334 goto out;
227335
228− if (tr->selector)
336+ WARN_ON(tr->cur_image && tr->selector == 0);
337+ WARN_ON(!tr->cur_image && tr->selector);
338+ if (tr->cur_image)
229339 /* progs already running at this address */
230− err = modify_fentry(tr, old_image, new_image);
340+ err = modify_fentry(tr, tr->cur_image->image, im->image);
231341 else
232342 /* first time registering */
233− err = register_fentry(tr, new_image);
343+ err = register_fentry(tr, im->image);
234344 if (err)
235345 goto out;
346+ if (tr->cur_image)
347+ bpf_tramp_image_put(tr->cur_image);
348+ tr->cur_image = im;
236349 tr->selector++;
237350 out:
238351 kfree(tprogs);
@@ -364,17 +477,12 @@ void bpf_trampoline_put(struct bpf_trampoline *tr) · 125 unmodified lines
364477 goto out;
365478 if (WARN_ON_ONCE(!hlist_empty(&tr->progs_hlist[BPF_TRAMP_FEXIT])))
366479 goto out;
367− bpf_image_ksym_del(&tr->ksym);
368− /* This code will be executed when all bpf progs (both sleepable and
369− * non-sleepable) went through
370− * bpf_prog_put()->call_rcu[_tasks_trace]()->bpf_prog_free_deferred().
371− * Hence no need for another synchronize_rcu_tasks_trace() here,
372− * but synchronize_rcu_tasks() is still needed, since trampoline
373− * may not have had any sleepable programs and we need to wait
374− * for tasks to get out of trampoline code before freeing it.
480+ /* This code will be executed even when the last bpf_tramp_image
481+ * is alive. All progs are detached from the trampoline and the
482+ * trampoline image is patched with jmp into epilogue to skip
483+ * fexit progs. The fentry-only trampoline will be freed via
484+ * multiple rcu callbacks.
375485 */
376− synchronize_rcu_tasks();
377− bpf_jit_free_exec(tr->image);
378486 hlist_del(&tr->hlist);
379487 kfree(tr);
380488 out:
@@ -478,8 +586,18 @@ void notrace __bpf_prog_exit_sleepable(struct bpf_prog *prog, u64 start) · 97 unmodified lines
478586 rcu_read_unlock_trace();
479587 }
480588
589+void notrace __bpf_tramp_enter(struct bpf_tramp_image *tr)
590+{
591+ percpu_ref_get(&tr->pcref);
592+}
593+
594+void notrace __bpf_tramp_exit(struct bpf_tramp_image *tr)
595+{
596+ percpu_ref_put(&tr->pcref);
597+}
598+
481599 int __weak
482−arch_prepare_bpf_trampoline(void *image, void *image_end,
600+arch_prepare_bpf_trampoline(struct bpf_tramp_image *tr, void *image, void *image_end,
483601 const struct btf_func_model *m, u32 flags,
484602 struct bpf_tramp_progs *tprogs,
485603 void *orig_call)
kernel/bpf/verifier.c+25−12
@@ -5861,10 +5861,14 @@ static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg, · 5860 unmodified lines
58615861 {
58625862 bool mask_to_left = (opcode == BPF_ADD && off_is_neg) ||
58635863 (opcode == BPF_SUB && !off_is_neg);
5864− u32 off;
5864+ u32 off, max;
58655865
58665866 switch (ptr_reg->type) {
58675867 case PTR_TO_STACK:
5868+ /* Offset 0 is out-of-bounds, but acceptable start for the
5869+ * left direction, see BPF_REG_FP.
5870+ */
5871+ max = MAX_BPF_STACK + mask_to_left;
58685872 /* Indirect variable offset stack access is prohibited in
58695873 * unprivileged mode so it's not handled here.
58705874 */
@@ -5872,16 +5876,17 @@ static int retrieve_ptr_limit(const struct bpf_reg_state *ptr_reg, · 1 unmodified line
58725876 if (mask_to_left)
58735877 *ptr_limit = MAX_BPF_STACK + off;
58745878 else
5875− *ptr_limit = -off;
5876− return 0;
5879+ *ptr_limit = -off - 1;
5880+ return *ptr_limit >= max ? -ERANGE : 0;
58775881 case PTR_TO_MAP_VALUE:
5882+ max = ptr_reg->map_ptr->value_size;
58785883 if (mask_to_left) {
58795884 *ptr_limit = ptr_reg->umax_value + ptr_reg->off;
58805885 } else {
58815886 off = ptr_reg->smin_value + ptr_reg->off;
5882− *ptr_limit = ptr_reg->map_ptr->value_size - off;
5887+ *ptr_limit = ptr_reg->map_ptr->value_size - off - 1;
58835888 }
5884− return 0;
5889+ return *ptr_limit >= max ? -ERANGE : 0;
58855890 default:
58865891 return -EINVAL;
58875892 }
@@ -5934,6 +5939,7 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env, · 46 unmodified lines
59345939 u32 alu_state, alu_limit;
59355940 struct bpf_reg_state tmp;
59365941 bool ret;
5942+ int err;
59375943
59385944 if (can_skip_alu_sanitation(env, insn))
59395945 return 0;
@@ -5949,10 +5955,13 @@ static int sanitize_ptr_alu(struct bpf_verifier_env *env, · 9 unmodified lines
59495955 alu_state |= ptr_is_dst_reg ?
59505956 BPF_ALU_SANITIZE_SRC : BPF_ALU_SANITIZE_DST;
59515957
5952− if (retrieve_ptr_limit(ptr_reg, &alu_limit, opcode, off_is_neg))
5953− return 0;
5954− if (update_alu_sanitation_state(aux, alu_state, alu_limit))
5955− return -EACCES;
5958+ err = retrieve_ptr_limit(ptr_reg, &alu_limit, opcode, off_is_neg);
5959+ if (err < 0)
5960+ return err;
5961+
5962+ err = update_alu_sanitation_state(aux, alu_state, alu_limit);
5963+ if (err < 0)
5964+ return err;
59565965 do_sim:
59575966 /* Simulate and find potential out-of-bounds access under
59585967 * speculative execution from truncation as a result of
@@ -6103,7 +6112,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, · 144 unmodified lines
61036112 case BPF_ADD:
61046113 ret = sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0);
61056114 if (ret < 0) {
6106− verbose(env, "R%d tried to add from different maps or paths\n", dst);
6115+ verbose(env, "R%d tried to add from different maps, paths, or prohibited types\n", dst);
61076116 return ret;
61086117 }
61096118 /* We can take a fixed offset as long as it doesn't overflow
@@ -6158,7 +6167,7 @@ static int adjust_ptr_min_max_vals(struct bpf_verifier_env *env, · 48 unmodified lines
61586167 case BPF_SUB:
61596168 ret = sanitize_ptr_alu(env, insn, ptr_reg, dst_reg, smin_val < 0);
61606169 if (ret < 0) {
6161− verbose(env, "R%d tried to sub from different maps or paths\n", dst);
6170+ verbose(env, "R%d tried to sub from different maps, paths, or prohibited types\n", dst);
61626171 return ret;
61636172 }
61646173 if (dst_reg == off_reg) {
@@ -9056,6 +9065,10 @@ static int check_btf_info(struct bpf_verifier_env *env, · 2891 unmodified lines
90569065 btf = btf_get_by_fd(attr->prog_btf_fd);
90579066 if (IS_ERR(btf))
90589067 return PTR_ERR(btf);
9068+ if (btf_is_kernel(btf)) {
9069+ btf_put(btf);
9070+ return -EACCES;
9071+ }
90599072 env->prog->aux->btf = btf;
90609073
90619074 err = check_btf_func(env, attr, uattr);
@@ -11660,7 +11673,7 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env) · 2598 unmodified lines
1166011673 off_reg = issrc ? insn->src_reg : insn->dst_reg;
1166111674 if (isneg)
1166211675 *patch++ = BPF_ALU64_IMM(BPF_MUL, off_reg, -1);
11663− *patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit - 1);
11676+ *patch++ = BPF_MOV32_IMM(BPF_REG_AX, aux->alu_limit);
1166411677 *patch++ = BPF_ALU64_REG(BPF_SUB, BPF_REG_AX, off_reg);
1166511678 *patch++ = BPF_ALU64_REG(BPF_OR, BPF_REG_AX, off_reg);
1166611679 *patch++ = BPF_ALU64_IMM(BPF_NEG, BPF_REG_AX, 0);
kernel/fork.c+8−9
@@ -1948,8 +1948,14 @@ static __latent_entropy struct task_struct *copy_process( · 1947 unmodified lines
19481948 p = dup_task_struct(current, node);
19491949 if (!p)
19501950 goto fork_out;
1951− if (args->io_thread)
1951+ if (args->io_thread) {
1952+ /*
1953+ * Mark us an IO worker, and block any signal that isn't
1954+ * fatal or STOP
1955+ */
19521956 p->flags |= PF_IO_WORKER;
1957+ siginitsetinv(&p->blocked, sigmask(SIGKILL)|sigmask(SIGSTOP));
1958+ }
19531959
19541960 /*
19551961 * This _must_ happen before we call free_task(), i.e. before we jump
@@ -2438,15 +2444,8 @@ struct task_struct *create_io_thread(int (*fn)(void *), void *arg, int node) · 482 unmodified lines
24382444 .stack_size = (unsigned long)arg,
24392445 .io_thread = 1,
24402446 };
2441− struct task_struct *tsk;
24422447
2443− tsk = copy_process(NULL, 0, node, &args);
2444− if (!IS_ERR(tsk)) {
2445− sigfillset(&tsk->blocked);
2446− sigdelsetmask(&tsk->blocked, sigmask(SIGKILL));
2447− tsk->flags |= PF_NOFREEZE;
2448− }
2449− return tsk;
2448+ return copy_process(NULL, 0, node, &args);
24502449 }
24512450
24522451 /*
kernel/futex.c+1−2
@@ -2728,14 +2728,13 @@ retry: · 2727 unmodified lines
27282728 goto out;
27292729
27302730 restart = &current->restart_block;
2731− restart->fn = futex_wait_restart;
27322731 restart->futex.uaddr = uaddr;
27332732 restart->futex.val = val;
27342733 restart->futex.time = *abs_time;
27352734 restart->futex.bitset = bitset;
27362735 restart->futex.flags = flags | FLAGS_HAS_TIMEOUT;
27372736
2738− ret = -ERESTART_RESTARTBLOCK;
2737+ ret = set_restart_fn(restart, futex_wait_restart);
27392738
27402739 out:
27412740 if (to) {
kernel/gcov/clang.c+69−0
@@ -75,7 +75,9 @@ struct gcov_fn_info { · 74 unmodified lines
7575
7676 u32 num_counters;
7777 u64 *counters;
78+#if CONFIG_CLANG_VERSION < 110000
7879 const char *function_name;
80+#endif
7981 };
8082
8183 static struct gcov_info *current_info;
@@ -105,6 +107,7 @@ void llvm_gcov_init(llvm_gcov_callback writeout, llvm_gcov_callback flush) · 23 unmodified lines
105107 }
106108 EXPORT_SYMBOL(llvm_gcov_init);
107109
110+#if CONFIG_CLANG_VERSION < 110000
108111 void llvm_gcda_start_file(const char *orig_filename, const char version[4],
109112 u32 checksum)
110113 {
@@ -113,7 +116,17 @@ void llvm_gcda_start_file(const char *orig_filename, const char version[4], · 2 unmodified lines
113116 current_info->checksum = checksum;
114117 }
115118 EXPORT_SYMBOL(llvm_gcda_start_file);
119+#else
120+void llvm_gcda_start_file(const char *orig_filename, u32 version, u32 checksum)
121+{
122+ current_info->filename = orig_filename;
123+ current_info->version = version;
124+ current_info->checksum = checksum;
125+}
126+EXPORT_SYMBOL(llvm_gcda_start_file);
127+#endif
116128
129+#if CONFIG_CLANG_VERSION < 110000
117130 void llvm_gcda_emit_function(u32 ident, const char *function_name,
118131 u32 func_checksum, u8 use_extra_checksum, u32 cfg_checksum)
119132 {
@@ -133,6 +146,24 @@ void llvm_gcda_emit_function(u32 ident, const char *function_name, · 13 unmodified lines
133146 list_add_tail(&info->head, &current_info->functions);
134147 }
135148 EXPORT_SYMBOL(llvm_gcda_emit_function);
149+#else
150+void llvm_gcda_emit_function(u32 ident, u32 func_checksum,
151+ u8 use_extra_checksum, u32 cfg_checksum)
152+{
153+ struct gcov_fn_info *info = kzalloc(sizeof(*info), GFP_KERNEL);
154+
155+ if (!info)
156+ return;
157+
158+ INIT_LIST_HEAD(&info->head);
159+ info->ident = ident;
160+ info->checksum = func_checksum;
161+ info->use_extra_checksum = use_extra_checksum;
162+ info->cfg_checksum = cfg_checksum;
163+ list_add_tail(&info->head, &current_info->functions);
164+}
165+EXPORT_SYMBOL(llvm_gcda_emit_function);
166+#endif
136167
137168 void llvm_gcda_emit_arcs(u32 num_counters, u64 *counters)
138169 {
@@ -295,6 +326,7 @@ void gcov_info_add(struct gcov_info *dst, struct gcov_info *src) · 156 unmodified lines
295326 }
296327 }
297328
329+#if CONFIG_CLANG_VERSION < 110000
298330 static struct gcov_fn_info *gcov_fn_info_dup(struct gcov_fn_info *fn)
299331 {
300332 size_t cv_size; /* counter values size */
@@ -322,6 +354,28 @@ err_name: · 21 unmodified lines
322354 kfree(fn_dup);
323355 return NULL;
324356 }
357+#else
358+static struct gcov_fn_info *gcov_fn_info_dup(struct gcov_fn_info *fn)
359+{
360+ size_t cv_size; /* counter values size */
361+ struct gcov_fn_info *fn_dup = kmemdup(fn, sizeof(*fn),
362+ GFP_KERNEL);
363+ if (!fn_dup)
364+ return NULL;
365+ INIT_LIST_HEAD(&fn_dup->head);
366+
367+ cv_size = fn->num_counters * sizeof(fn->counters[0]);
368+ fn_dup->counters = vmalloc(cv_size);
369+ if (!fn_dup->counters) {
370+ kfree(fn_dup);
371+ return NULL;
372+ }
373+
374+ memcpy(fn_dup->counters, fn->counters, cv_size);
375+
376+ return fn_dup;
377+}
378+#endif
325379
326380 /**
327381 * gcov_info_dup - duplicate profiling data set
@@ -362,6 +416,7 @@ err: · 34 unmodified lines
362416 * gcov_info_free - release memory for profiling data set duplicate
363417 * @info: profiling data set duplicate to free
364418 */
419+#if CONFIG_CLANG_VERSION < 110000
365420 void gcov_info_free(struct gcov_info *info)
366421 {
367422 struct gcov_fn_info *fn, *tmp;
@@ -375,6 +430,20 @@ void gcov_info_free(struct gcov_info *info) · 7 unmodified lines
375430 kfree(info->filename);
376431 kfree(info);
377432 }
433+#else
434+void gcov_info_free(struct gcov_info *info)
435+{
436+ struct gcov_fn_info *fn, *tmp;
437+
438+ list_for_each_entry_safe(fn, tmp, &info->functions, head) {
439+ vfree(fn->counters);
440+ list_del(&fn->head);
441+ kfree(fn);
442+ }
443+ kfree(info->filename);
444+ kfree(info);
445+}
446+#endif
378447
379448 #define ITER_STRIDE PAGE_SIZE
380449
kernel/irq/irq_sim.c+2−2
@@ -159,7 +159,7 @@ static const struct irq_domain_ops irq_sim_domain_ops = { · 158 unmodified lines
159159 * irq_domain_create_sim - Create a new interrupt simulator irq_domain and
160160 * allocate a range of dummy interrupts.
161161 *
162− * @fnode: struct fwnode_handle to be associated with this domain.
162+ * @fwnode: struct fwnode_handle to be associated with this domain.
163163 * @num_irqs: Number of interrupts to allocate.
164164 *
165165 * On success: return a new irq_domain object.
@@ -228,7 +228,7 @@ static void devm_irq_domain_release_sim(struct device *dev, void *res) · 62 unmodified lines
228228 * a managed device.
229229 *
230230 * @dev: Device to initialize the simulator object for.
231− * @fnode: struct fwnode_handle to be associated with this domain.
231+ * @fwnode: struct fwnode_handle to be associated with this domain.
232232 * @num_irqs: Number of interrupts to allocate
233233 *
234234 * On success: return a new irq_domain object.
kernel/irq/manage.c+4−0
@@ -1142,11 +1142,15 @@ irq_forced_thread_fn(struct irq_desc *desc, struct irqaction *action) · 1141 unmodified lines
11421142 irqreturn_t ret;
11431143
11441144 local_bh_disable();
1145+ if (!IS_ENABLED(CONFIG_PREEMPT_RT))
1146+ local_irq_disable();
11451147 ret = action->thread_fn(action->irq, action->dev_id);
11461148 if (ret == IRQ_HANDLED)
11471149 atomic_inc(&desc->threads_handled);
11481150
11491151 irq_finalize_oneshot(desc, action);
1152+ if (!IS_ENABLED(CONFIG_PREEMPT_RT))
1153+ local_irq_enable();
11501154 local_bh_enable();
11511155 return ret;
11521156 }
kernel/jump_label.c+8−0
@@ -407,6 +407,14 @@ static bool jump_label_can_update(struct jump_entry *entry, bool init) · 406 unmodified lines
407407 return false;
408408
409409 if (!kernel_text_address(jump_entry_code(entry))) {
410+ /*
411+ * This skips patching built-in __exit, which
412+ * is part of init_section_contains() but is
413+ * not part of kernel_text_address().
414+ *
415+ * Skipping built-in __exit is fine since it
416+ * will never be executed.
417+ */
410418 WARN_ONCE(!jump_entry_is_init(entry),
411419 "can't patch jump_label at %pS",
412420 (void *)jump_entry_code(entry));
kernel/power/energy_model.c+1−1
@@ -98,7 +98,7 @@ static int __init em_debug_init(void) · 97 unmodified lines
9898
9999 return 0;
100100 }
101−core_initcall(em_debug_init);
101+fs_initcall(em_debug_init);
102102 #else /* CONFIG_DEBUG_FS */
103103 static void em_debug_create_pd(struct device *dev) {}
104104 static void em_debug_remove_pd(struct device *dev) {}
kernel/ptrace.c+1−1
@@ -375,7 +375,7 @@ static int ptrace_attach(struct task_struct *task, long request, · 374 unmodified lines
375375 audit_ptrace(task);
376376
377377 retval = -EPERM;
378− if (unlikely(task->flags & (PF_KTHREAD | PF_IO_WORKER)))
378+ if (unlikely(task->flags & PF_KTHREAD))
379379 goto out;
380380 if (same_thread_group(task, current))
381381 goto out;
kernel/reboot.c+0−2
@@ -244,8 +244,6 @@ void migrate_to_reboot_cpu(void) · 243 unmodified lines
244244 void kernel_restart(char *cmd)
245245 {
246246 kernel_restart_prepare(cmd);
247− if (pm_power_off_prepare)
248− pm_power_off_prepare();
249247 migrate_to_reboot_cpu();
250248 syscore_shutdown();
251249 if (!cmd)
kernel/signal.c+11−3
@@ -91,7 +91,7 @@ static bool sig_task_ignored(struct task_struct *t, int sig, bool force) · 90 unmodified lines
9191 return true;
9292
9393 /* Only allow kernel generated signals to this kthread */
94− if (unlikely((t->flags & (PF_KTHREAD | PF_IO_WORKER)) &&
94+ if (unlikely((t->flags & PF_KTHREAD) &&
9595 (handler == SIG_KTHREAD_KERNEL) && !force))
9696 return true;
9797
@@ -1096,7 +1096,7 @@ static int __send_signal(int sig, struct kernel_siginfo *info, struct task_struc · 998 unmodified lines
10961096 /*
10971097 * Skip useless siginfo allocation for SIGKILL and kernel threads.
10981098 */
1099− if ((sig == SIGKILL) || (t->flags & (PF_KTHREAD | PF_IO_WORKER)))
1099+ if ((sig == SIGKILL) || (t->flags & PF_KTHREAD))
11001100 goto out_set;
11011101
11021102 /*
@@ -2767,6 +2767,14 @@ relock: · 1664 unmodified lines
27672767 do_coredump(&ksig->info);
27682768 }
27692769
2770+ /*
2771+ * PF_IO_WORKER threads will catch and exit on fatal signals
2772+ * themselves. They have cleanup that must be performed, so
2773+ * we cannot call do_exit() on their behalf.
2774+ */
2775+ if (current->flags & PF_IO_WORKER)
2776+ goto out;
2777+
27702778 /*
27712779 * Death signals, no core dump.
27722780 */
@@ -2774,7 +2782,7 @@ relock: · 1 unmodified line
27742782 /* NOTREACHED */
27752783 }
27762784 spin_unlock_irq(&sighand->siglock);
2777−
2785+out:
27782786 ksig->sig = signr;
27792787
27802788 if (!(ksig->ka.sa.sa_flags & SA_EXPOSE_TAGBITS))
kernel/static_call.c+24−18
@@ -35,27 +35,30 @@ static inline void *static_call_addr(struct static_call_site *site) · 34 unmodified lines
3535 return (void *)((long)site->addr + (long)&site->addr);
3636 }
3737
38+static inline unsigned long __static_call_key(const struct static_call_site *site)
39+{
40+ return (long)site->key + (long)&site->key;
41+}
3842
3943 static inline struct static_call_key *static_call_key(const struct static_call_site *site)
4044 {
41− return (struct static_call_key *)
42− (((long)site->key + (long)&site->key) & ~STATIC_CALL_SITE_FLAGS);
45+ return (void *)(__static_call_key(site) & ~STATIC_CALL_SITE_FLAGS);
4346 }
4447
4548 /* These assume the key is word-aligned. */
4649 static inline bool static_call_is_init(struct static_call_site *site)
4750 {
48− return ((long)site->key + (long)&site->key) & STATIC_CALL_SITE_INIT;
51+ return __static_call_key(site) & STATIC_CALL_SITE_INIT;
4952 }
5053
5154 static inline bool static_call_is_tail(struct static_call_site *site)
5255 {
53− return ((long)site->key + (long)&site->key) & STATIC_CALL_SITE_TAIL;
56+ return __static_call_key(site) & STATIC_CALL_SITE_TAIL;
5457 }
5558
5659 static inline void static_call_set_init(struct static_call_site *site)
5760 {
58− site->key = ((long)static_call_key(site) | STATIC_CALL_SITE_INIT) -
61+ site->key = (__static_call_key(site) | STATIC_CALL_SITE_INIT) -
5962 (long)&site->key;
6063 }
6164
@@ -146,6 +149,7 @@ void __static_call_update(struct static_call_key *key, void *tramp, void *func) · 84 unmodified lines
146149 };
147150
148151 for (site_mod = &first; site_mod; site_mod = site_mod->next) {
152+ bool init = system_state < SYSTEM_RUNNING;
149153 struct module *mod = site_mod->mod;
150154
151155 if (!site_mod->sites) {
@@ -165,6 +169,7 @@ void __static_call_update(struct static_call_key *key, void *tramp, void *func) · 13 unmodified lines
165169 if (mod) {
166170 stop = mod->static_call_sites +
167171 mod->num_static_call_sites;
172+ init = mod->state == MODULE_STATE_COMING;
168173 }
169174 #endif
170175
@@ -172,25 +177,26 @@ void __static_call_update(struct static_call_key *key, void *tramp, void *func) · 1 unmodified line
172177 site < stop && static_call_key(site) == key; site++) {
173178 void *site_addr = static_call_addr(site);
174179
175− if (static_call_is_init(site)) {
176− /*
177− * Don't write to call sites which were in
178− * initmem and have since been freed.
179− */
180− if (!mod && system_state >= SYSTEM_RUNNING)
181− continue;
182− if (mod && !within_module_init((unsigned long)site_addr, mod))
183− continue;
184− }
180+ if (!init && static_call_is_init(site))
181+ continue;
185182
186183 if (!kernel_text_address((unsigned long)site_addr)) {
187− WARN_ONCE(1, "can't patch static call site at %pS",
184+ /*
185+ * This skips patching built-in __exit, which
186+ * is part of init_section_contains() but is
187+ * not part of kernel_text_address().
188+ *
189+ * Skipping built-in __exit is fine since it
190+ * will never be executed.
191+ */
192+ WARN_ONCE(!static_call_is_init(site),
193+ "can't patch static call site at %pS",
188194 site_addr);
189195 continue;
190196 }
191197
192198 arch_static_call_transform(site_addr, NULL, func,
193− static_call_is_tail(site));
199+ static_call_is_tail(site));
194200 }
195201 }
196202
@@ -349,7 +355,7 @@ static int static_call_add_module(struct module *mod) · 152 unmodified lines
349355 struct static_call_site *site;
350356
351357 for (site = start; site != stop; site++) {
352− unsigned long s_key = (long)site->key + (long)&site->key;
358+ unsigned long s_key = __static_call_key(site);
353359 unsigned long addr = s_key & ~STATIC_CALL_SITE_FLAGS;
354360 unsigned long key;
355361
kernel/time/alarmtimer.c+1−1
@@ -854,9 +854,9 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags, · 853 unmodified lines
854854 if (flags == TIMER_ABSTIME)
855855 return -ERESTARTNOHAND;
856856
857− restart->fn = alarm_timer_nsleep_restart;
858857 restart->nanosleep.clockid = type;
859858 restart->nanosleep.expires = exp;
859+ set_restart_fn(restart, alarm_timer_nsleep_restart);
860860 return ret;
861861 }
862862
kernel/time/hrtimer.c+1−1
@@ -1957,9 +1957,9 @@ long hrtimer_nanosleep(ktime_t rqtp, const enum hrtimer_mode mode, · 1956 unmodified lines
19571957 }
19581958
19591959 restart = &current->restart_block;
1960− restart->fn = hrtimer_nanosleep_restart;
19611960 restart->nanosleep.clockid = t.timer.base->clockid;
19621961 restart->nanosleep.expires = hrtimer_get_expires_tv64(&t.timer);
1962+ set_restart_fn(restart, hrtimer_nanosleep_restart);
19631963 out:
19641964 destroy_hrtimer_on_stack(&t.timer);
19651965 return ret;
kernel/time/posix-cpu-timers.c+1−1
@@ -1480,8 +1480,8 @@ static int posix_cpu_nsleep(const clockid_t which_clock, int flags, · 1479 unmodified lines
14801480 if (flags & TIMER_ABSTIME)
14811481 return -ERESTARTNOHAND;
14821482
1483− restart_block->fn = posix_cpu_nsleep_restart;
14841483 restart_block->nanosleep.clockid = which_clock;
1484+ set_restart_fn(restart_block, posix_cpu_nsleep_restart);
14851485 }
14861486 return error;
14871487 }
kernel/trace/ftrace.c+38−5
@@ -5045,6 +5045,20 @@ struct ftrace_direct_func *ftrace_find_direct_func(unsigned long addr) · 5044 unmodified lines
50455045 return NULL;
50465046 }
50475047
5048+static struct ftrace_direct_func *ftrace_alloc_direct_func(unsigned long addr)
5049+{
5050+ struct ftrace_direct_func *direct;
5051+
5052+ direct = kmalloc(sizeof(*direct), GFP_KERNEL);
5053+ if (!direct)
5054+ return NULL;
5055+ direct->addr = addr;
5056+ direct->count = 0;
5057+ list_add_rcu(&direct->next, &ftrace_direct_funcs);
5058+ ftrace_direct_func_count++;
5059+ return direct;
5060+}
5061+
50485062 /**
50495063 * register_ftrace_direct - Call a custom trampoline directly
50505064 * @ip: The address of the nop at the beginning of a function
@@ -5120,15 +5134,11 @@ int register_ftrace_direct(unsigned long ip, unsigned long addr) · 69 unmodified lines
51205134
51215135 direct = ftrace_find_direct_func(addr);
51225136 if (!direct) {
5123− direct = kmalloc(sizeof(*direct), GFP_KERNEL);
5137+ direct = ftrace_alloc_direct_func(addr);
51245138 if (!direct) {
51255139 kfree(entry);
51265140 goto out_unlock;
51275141 }
5128− direct->addr = addr;
5129− direct->count = 0;
5130− list_add_rcu(&direct->next, &ftrace_direct_funcs);
5131− ftrace_direct_func_count++;
51325142 }
51335143
51345144 entry->ip = ip;
@@ -5329,6 +5339,7 @@ int __weak ftrace_modify_direct_caller(struct ftrace_func_entry *entry, · 194 unmodified lines
53295339 int modify_ftrace_direct(unsigned long ip,
53305340 unsigned long old_addr, unsigned long new_addr)
53315341 {
5342+ struct ftrace_direct_func *direct, *new_direct = NULL;
53325343 struct ftrace_func_entry *entry;
53335344 struct dyn_ftrace *rec;
53345345 int ret = -ENODEV;
@@ -5344,6 +5355,20 @@ int modify_ftrace_direct(unsigned long ip, · 9 unmodified lines
53445355 if (entry->direct != old_addr)
53455356 goto out_unlock;
53465357
5358+ direct = ftrace_find_direct_func(old_addr);
5359+ if (WARN_ON(!direct))
5360+ goto out_unlock;
5361+ if (direct->count > 1) {
5362+ ret = -ENOMEM;
5363+ new_direct = ftrace_alloc_direct_func(new_addr);
5364+ if (!new_direct)
5365+ goto out_unlock;
5366+ direct->count--;
5367+ new_direct->count++;
5368+ } else {
5369+ direct->addr = new_addr;
5370+ }
5371+
53475372 /*
53485373 * If there's no other ftrace callback on the rec->ip location,
53495374 * then it can be changed directly by the architecture.
@@ -5357,6 +5382,14 @@ int modify_ftrace_direct(unsigned long ip, · 7 unmodified lines
53575382 ret = 0;
53585383 }
53595384
5385+ if (unlikely(ret && new_direct)) {
5386+ direct->count++;
5387+ list_del_rcu(&new_direct->next);
5388+ synchronize_rcu_tasks();
5389+ kfree(new_direct);
5390+ ftrace_direct_func_count--;
5391+ }
5392+
53605393 out_unlock:
53615394 mutex_unlock(&ftrace_lock);
53625395 mutex_unlock(&direct_mutex);
kernel/usermode_driver.c+15−6
@@ -139,13 +139,22 @@ static void umd_cleanup(struct subprocess_info *info) · 138 unmodified lines
139139 struct umd_info *umd_info = info->data;
140140
141141 /* cleanup if umh_setup() was successful but exec failed */
142− if (info->retval) {
143− fput(umd_info->pipe_to_umh);
144− fput(umd_info->pipe_from_umh);
145− put_pid(umd_info->tgid);
146− umd_info->tgid = NULL;
147− }
142+ if (info->retval)
143+ umd_cleanup_helper(umd_info);
144+}
145+
146+/**
147+ * umd_cleanup_helper - release the resources which were allocated in umd_setup
148+ * @info: information about usermode driver
149+ */
150+void umd_cleanup_helper(struct umd_info *info)
151+{
152+ fput(info->pipe_to_umh);
153+ fput(info->pipe_from_umh);
154+ put_pid(info->tgid);
155+ info->tgid = NULL;
148156 }
157+EXPORT_SYMBOL_GPL(umd_cleanup_helper);
149158
150159 /**
151160 * fork_usermode_driver - fork a usermode driver

Keyboard shortcuts

General

Show keyboard shortcuts
?
Focus the current search
/

Issues and pull requests

Open filters
f

Issues, pull requests and Inbox

Select next item
j↓
Select previous item
k↑
Open selected item
Enter
Dismiss filters or clear selection
Esc

Repository code

Go to file
t