1. 03 4月, 2019 1 次提交
    • P
      x86/uaccess, ubsan: Fix UBSAN vs. SMAP · d08965a2
      Peter Zijlstra 提交于
      UBSAN can insert extra code in random locations; including AC=1
      sections. Typically this code is not safe and needs wrapping.
      
      So far, only __ubsan_handle_type_mismatch* have been observed in AC=1
      sections and therefore only those are annotated.
      Signed-off-by: NPeter Zijlstra (Intel) <peterz@infradead.org>
      Cc: Borislav Petkov <bp@alien8.de>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: Josh Poimboeuf <jpoimboe@redhat.com>
      Cc: Linus Torvalds <torvalds@linux-foundation.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Signed-off-by: NIngo Molnar <mingo@kernel.org>
      d08965a2
  2. 26 3月, 2019 1 次提交
    • M
      sbitmap: order READ/WRITE freed instance and setting clear bit · e6d1fa58
      Ming Lei 提交于
      Inside sbitmap_queue_clear(), once the clear bit is set, it will be
      visiable to allocation path immediately. Meantime READ/WRITE on old
      associated instance(such as request in case of blk-mq) may be
      out-of-order with the setting clear bit, so race with re-allocation
      may be triggered.
      
      Adds one memory barrier for ordering READ/WRITE of the freed associated
      instance with setting clear bit for avoiding race with re-allocation.
      
      The following kernel oops triggerd by block/006 on aarch64 may be fixed:
      
      [  142.330954] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000330
      [  142.338794] Mem abort info:
      [  142.341554]   ESR = 0x96000005
      [  142.344632]   Exception class = DABT (current EL), IL = 32 bits
      [  142.350500]   SET = 0, FnV = 0
      [  142.353544]   EA = 0, S1PTW = 0
      [  142.356678] Data abort info:
      [  142.359528]   ISV = 0, ISS = 0x00000005
      [  142.363343]   CM = 0, WnR = 0
      [  142.366305] user pgtable: 64k pages, 48-bit VAs, pgdp = 000000002a3c51c0
      [  142.372983] [0000000000000330] pgd=0000000000000000, pud=0000000000000000
      [  142.379777] Internal error: Oops: 96000005 [#1] SMP
      [  142.384613] Modules linked in: null_blk ib_isert iscsi_target_mod ib_srpt target_core_mod ib_srp scsi_transport_srp vfat fat rpcrdma sunrpc rdma_ucm ib_iser rdma_cm iw_cm libiscsi ib_umad scsi_transport_iscsi ib_ipoib ib_cm mlx5_ib ib_uverbs ib_core sbsa_gwdt crct10dif_ce ghash_ce ipmi_ssif sha2_ce ipmi_devintf sha256_arm64 sg sha1_ce ipmi_msghandler ip_tables xfs libcrc32c mlx5_core sdhci_acpi mlxfw ahci_platform at803x sdhci libahci_platform qcom_emac mmc_core hdma hdma_mgmt i2c_dev [last unloaded: null_blk]
      [  142.429753] CPU: 7 PID: 1983 Comm: fio Not tainted 5.0.0.cki #2
      [  142.449458] pstate: 00400005 (nzcv daif +PAN -UAO)
      [  142.454239] pc : __blk_mq_free_request+0x4c/0xa8
      [  142.458830] lr : blk_mq_free_request+0xec/0x118
      [  142.463344] sp : ffff00003360f6a0
      [  142.466646] x29: ffff00003360f6a0 x28: ffff000010e70000
      [  142.471941] x27: ffff801729a50048 x26: 0000000000010000
      [  142.477232] x25: ffff00003360f954 x24: ffff7bdfff021440
      [  142.482529] x23: 0000000000000000 x22: 00000000ffffffff
      [  142.487830] x21: ffff801729810000 x20: 0000000000000000
      [  142.493123] x19: ffff801729a50000 x18: 0000000000000000
      [  142.498413] x17: 0000000000000000 x16: 0000000000000001
      [  142.503709] x15: 00000000000000ff x14: ffff7fe000000000
      [  142.509003] x13: ffff8017dcde09a0 x12: 0000000000000000
      [  142.514308] x11: 0000000000000001 x10: 0000000000000008
      [  142.519597] x9 : ffff8017dcde09a0 x8 : 0000000000002000
      [  142.524889] x7 : ffff8017dcde0a00 x6 : 000000015388f9be
      [  142.530187] x5 : 0000000000000001 x4 : 0000000000000000
      [  142.535478] x3 : 0000000000000000 x2 : 0000000000000000
      [  142.540777] x1 : 0000000000000001 x0 : ffff00001041b194
      [  142.546071] Process fio (pid: 1983, stack limit = 0x000000006460a0ea)
      [  142.552500] Call trace:
      [  142.554926]  __blk_mq_free_request+0x4c/0xa8
      [  142.559181]  blk_mq_free_request+0xec/0x118
      [  142.563352]  blk_mq_end_request+0xfc/0x120
      [  142.567444]  end_cmd+0x3c/0xa8 [null_blk]
      [  142.571434]  null_complete_rq+0x20/0x30 [null_blk]
      [  142.576194]  blk_mq_complete_request+0x108/0x148
      [  142.580797]  null_handle_cmd+0x1d4/0x718 [null_blk]
      [  142.585662]  null_queue_rq+0x60/0xa8 [null_blk]
      [  142.590171]  blk_mq_try_issue_directly+0x148/0x280
      [  142.594949]  blk_mq_try_issue_list_directly+0x9c/0x108
      [  142.600064]  blk_mq_sched_insert_requests+0xb0/0xd0
      [  142.604926]  blk_mq_flush_plug_list+0x16c/0x2a0
      [  142.609441]  blk_flush_plug_list+0xec/0x118
      [  142.613608]  blk_finish_plug+0x3c/0x4c
      [  142.617348]  blkdev_direct_IO+0x3b4/0x428
      [  142.621336]  generic_file_read_iter+0x84/0x180
      [  142.625761]  blkdev_read_iter+0x50/0x78
      [  142.629579]  aio_read.isra.6+0xf8/0x190
      [  142.633409]  __io_submit_one.isra.8+0x148/0x738
      [  142.637912]  io_submit_one.isra.9+0x88/0xb8
      [  142.642078]  __arm64_sys_io_submit+0xe0/0x238
      [  142.646428]  el0_svc_handler+0xa0/0x128
      [  142.650238]  el0_svc+0x8/0xc
      [  142.653104] Code: b9402a63 f9000a7f 3100047f 540000a0 (f9419a81)
      [  142.659202] ---[ end trace 467586bc175eb09d ]---
      
      Fixes: ea86ea2c ("sbitmap: ammortize cost of clearing bits")
      Reported-and-bisected_and_tested-by: Yi Zhang <yi.zhang@redhat.com>
      Cc: Yi Zhang <yi.zhang@redhat.com>
      Cc: "jianchao.wang" <jianchao.w.wang@oracle.com>
      Reviewed-by: NOmar Sandoval <osandov@fb.com>
      Signed-off-by: NMing Lei <ming.lei@redhat.com>
      Signed-off-by: NJens Axboe <axboe@kernel.dk>
      e6d1fa58
  3. 22 3月, 2019 1 次提交
  4. 14 3月, 2019 1 次提交
  5. 13 3月, 2019 3 次提交
  6. 08 3月, 2019 15 次提交
  7. 06 3月, 2019 4 次提交
    • C
      mm/page_owner: move config option to mm/Kconfig.debug · 8aa49762
      Changbin Du 提交于
      Move the PAGE_OWNER option from submenu "Compile-time checks and
      compiler options" to dedicated submenu "Memory Debugging".
      
      Link: http://lkml.kernel.org/r/20190120024254.6270-1-changbin.du@gmail.comSigned-off-by: NChangbin Du <changbin.du@gmail.com>
      Acked-by: NVlastimil Babka <vbabka@suse.cz>
      Cc: Masahiro Yamada <yamada.masahiro@socionext.com>
      Cc: Ingo Molnar <mingo@kernel.org>
      Cc: Arnd Bergmann <arnd@arndb.de>
      Cc: Randy Dunlap <rdunlap@infradead.org>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      8aa49762
    • U
      vmalloc: add test driver to analyse vmalloc allocator · 3f21a6b7
      Uladzislau Rezki (Sony) 提交于
      This adds a new kernel module for analysis of vmalloc allocator.  It is
      only enabled as a module.  There are two main reasons this module should
      be used for: performance evaluation and stressing of vmalloc subsystem.
      
      It consists of several test cases.  As of now there are 8.  The module
      has five parameters we can specify to change its the behaviour.
      
      1) run_test_mask - set of tests to be run
      
      id: 1,   name: fix_size_alloc_test
      id: 2,   name: full_fit_alloc_test
      id: 4,   name: long_busy_list_alloc_test
      id: 8,   name: random_size_alloc_test
      id: 16,  name: fix_align_alloc_test
      id: 32,  name: random_size_align_alloc_test
      id: 64,  name: align_shift_alloc_test
      id: 128, name: pcpu_alloc_test
      
      By default all tests are in run test mask.  If you want to select some
      specific tests it is possible to pass the mask.  For example for first,
      second and fourth tests we go 11 value.
      
      2) test_repeat_count - how many times each test should be repeated
      By default it is one time per test. It is possible to pass any number.
      As high the value is the test duration gets increased.
      
      3) test_loop_count - internal test loop counter. By default it is set
      to 1000000.
      
      4) single_cpu_test - use one CPU to run the tests
      By default this parameter is set to false. It means that all online
      CPUs execute tests. By setting it to 1, the tests are executed by
      first online CPU only.
      
      5) sequential_test_order - run tests in sequential order
      By default this parameter is set to false. It means that before running
      tests the order is shuffled. It is possible to make it sequential, just
      set it to 1.
      
      Performance analysis:
      In order to evaluate performance of vmalloc allocations, usually it
      makes sense to use only one CPU that runs tests, use sequential order,
      number of repeat tests can be different as well as set of test mask.
      
      For example if we want to run all tests, to use one CPU and repeat each
      test 3 times. Insert the module passing following parameters:
      
      single_cpu_test=1 sequential_test_order=1 test_repeat_count=3
      
      with following output:
      
      <snip>
      Summary: fix_size_alloc_test passed: 3 failed: 0 repeat: 3 loops: 1000000 avg: 901177 usec
      Summary: full_fit_alloc_test passed: 3 failed: 0 repeat: 3 loops: 1000000 avg: 1039341 usec
      Summary: long_busy_list_alloc_test passed: 3 failed: 0 repeat: 3 loops: 1000000 avg: 11775763 usec
      Summary: random_size_alloc_test passed 3: failed: 0 repeat: 3 loops: 1000000 avg: 6081992 usec
      Summary: fix_align_alloc_test passed: 3 failed: 0 repeat: 3, loops: 1000000 avg: 2003712 usec
      Summary: random_size_align_alloc_test passed: 3 failed: 0 repeat: 3 loops: 1000000 avg: 2895689 usec
      Summary: align_shift_alloc_test passed: 0 failed: 3 repeat: 3 loops: 1000000 avg: 573 usec
      Summary: pcpu_alloc_test passed: 3 failed: 0 repeat: 3 loops: 1000000 avg: 95802 usec
      All test took CPU0=192945605995 cycles
      <snip>
      
      The align_shift_alloc_test is expected to be failed.
      
      Stressing:
      In order to stress the vmalloc subsystem we run all available test cases
      on all available CPUs simultaneously. In order to prevent constant behaviour
      pattern, the test cases array is shuffled by default to randomize the order
      of test execution.
      
      For example if we want to run all tests(default), use all online CPUs(default)
      with shuffled order(default) and to repeat each test 30 times. The command
      would be like:
      
      modprobe vmalloc_test test_repeat_count=30
      
      Expected results are the system is alive, there are no any BUG_ONs or Kernel
      Panics the tests are completed, no memory leaks.
      
      [urezki@gmail.com: fix 32-bit builds]
        Link: http://lkml.kernel.org/r/20190106214839.ffvjvmrn52uqog7k@pc636
      [urezki@gmail.com: make CONFIG_TEST_VMALLOC depend on CONFIG_MMU]
        Link: http://lkml.kernel.org/r/20190219085441.s6bg2gpy4esny5vw@pc636
      Link: http://lkml.kernel.org/r/20190103142108.20744-3-urezki@gmail.comSigned-off-by: NUladzislau Rezki (Sony) <urezki@gmail.com>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Matthew Wilcox <willy@infradead.org>
      Cc: Michal Hocko <mhocko@suse.com>
      Cc: Oleksiy Avramchenko <oleksiy.avramchenko@sonymobile.com>
      Cc: Shuah Khan <shuah@kernel.org>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      3f21a6b7
    • A
      mm: replace all open encodings for NUMA_NO_NODE · 98fa15f3
      Anshuman Khandual 提交于
      Patch series "Replace all open encodings for NUMA_NO_NODE", v3.
      
      All these places for replacement were found by running the following
      grep patterns on the entire kernel code.  Please let me know if this
      might have missed some instances.  This might also have replaced some
      false positives.  I will appreciate suggestions, inputs and review.
      
      1. git grep "nid == -1"
      2. git grep "node == -1"
      3. git grep "nid = -1"
      4. git grep "node = -1"
      
      This patch (of 2):
      
      At present there are multiple places where invalid node number is
      encoded as -1.  Even though implicitly understood it is always better to
      have macros in there.  Replace these open encodings for an invalid node
      number with the global macro NUMA_NO_NODE.  This helps remove NUMA
      related assumptions like 'invalid node' from various places redirecting
      them to a common definition.
      
      Link: http://lkml.kernel.org/r/1545127933-10711-2-git-send-email-anshuman.khandual@arm.comSigned-off-by: NAnshuman Khandual <anshuman.khandual@arm.com>
      Reviewed-by: NDavid Hildenbrand <david@redhat.com>
      Acked-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>	[ixgbe]
      Acked-by: Jens Axboe <axboe@kernel.dk>			[mtip32xx]
      Acked-by: Vinod Koul <vkoul@kernel.org>			[dmaengine.c]
      Acked-by: Michael Ellerman <mpe@ellerman.id.au>		[powerpc]
      Acked-by: Doug Ledford <dledford@redhat.com>		[drivers/infiniband]
      Cc: Joseph Qi <jiangqi903@gmail.com>
      Cc: Hans Verkuil <hverkuil@xs4all.nl>
      Cc: Stephen Rothwell <sfr@canb.auug.org.au>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      98fa15f3
    • A
      kasan: remove use after scope bugs detection. · 7771bdbb
      Andrey Ryabinin 提交于
      Use after scope bugs detector seems to be almost entirely useless for
      the linux kernel.  It exists over two years, but I've seen only one
      valid bug so far [1].  And the bug was fixed before it has been
      reported.  There were some other use-after-scope reports, but they were
      false-positives due to different reasons like incompatibility with
      structleak plugin.
      
      This feature significantly increases stack usage, especially with GCC <
      9 version, and causes a 32K stack overflow.  It probably adds
      performance penalty too.
      
      Given all that, let's remove use-after-scope detector entirely.
      
      While preparing this patch I've noticed that we mistakenly enable
      use-after-scope detection for clang compiler regardless of
      CONFIG_KASAN_EXTRA setting.  This is also fixed now.
      
      [1] http://lkml.kernel.org/r/<20171129052106.rhgbjhhis53hkgfn@wfg-t540p.sh.intel.com>
      
      Link: http://lkml.kernel.org/r/20190111185842.13978-1-aryabinin@virtuozzo.comSigned-off-by: NAndrey Ryabinin <aryabinin@virtuozzo.com>
      Acked-by: Will Deacon <will.deacon@arm.com>		[arm64]
      Cc: Qian Cai <cai@lca.pw>
      Cc: Alexander Potapenko <glider@google.com>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: Catalin Marinas <catalin.marinas@arm.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      7771bdbb
  8. 05 3月, 2019 1 次提交
    • K
      lib: Introduce test_stackinit module · 50ceaa95
      Kees Cook 提交于
      Adds test for stack initialization coverage. We have several build options
      that control the level of stack variable initialization. This test lets us
      visualize which options cover which cases, and provide tests for some of
      the pathological padding conditions the compiler will sometimes fail to
      initialize.
      
      All options pass the explicit initialization cases and the partial
      initializers (even with padding):
      
      test_stackinit: u8_zero ok
      test_stackinit: u16_zero ok
      test_stackinit: u32_zero ok
      test_stackinit: u64_zero ok
      test_stackinit: char_array_zero ok
      test_stackinit: small_hole_zero ok
      test_stackinit: big_hole_zero ok
      test_stackinit: trailing_hole_zero ok
      test_stackinit: packed_zero ok
      test_stackinit: small_hole_dynamic_partial ok
      test_stackinit: big_hole_dynamic_partial ok
      test_stackinit: trailing_hole_dynamic_partial ok
      test_stackinit: packed_dynamic_partial ok
      test_stackinit: small_hole_static_partial ok
      test_stackinit: big_hole_static_partial ok
      test_stackinit: trailing_hole_static_partial ok
      test_stackinit: packed_static_partial ok
      test_stackinit: packed_static_all ok
      test_stackinit: packed_dynamic_all ok
      test_stackinit: packed_runtime_all ok
      
      The results of the other tests (which contain no explicit initialization),
      change based on the build's configured compiler instrumentation.
      
      No options:
      
      test_stackinit: small_hole_static_all FAIL (uninit bytes: 3)
      test_stackinit: big_hole_static_all FAIL (uninit bytes: 61)
      test_stackinit: trailing_hole_static_all FAIL (uninit bytes: 7)
      test_stackinit: small_hole_dynamic_all FAIL (uninit bytes: 3)
      test_stackinit: big_hole_dynamic_all FAIL (uninit bytes: 61)
      test_stackinit: trailing_hole_dynamic_all FAIL (uninit bytes: 7)
      test_stackinit: small_hole_runtime_partial FAIL (uninit bytes: 23)
      test_stackinit: big_hole_runtime_partial FAIL (uninit bytes: 127)
      test_stackinit: trailing_hole_runtime_partial FAIL (uninit bytes: 24)
      test_stackinit: packed_runtime_partial FAIL (uninit bytes: 24)
      test_stackinit: small_hole_runtime_all FAIL (uninit bytes: 3)
      test_stackinit: big_hole_runtime_all FAIL (uninit bytes: 61)
      test_stackinit: trailing_hole_runtime_all FAIL (uninit bytes: 7)
      test_stackinit: u8_none FAIL (uninit bytes: 1)
      test_stackinit: u16_none FAIL (uninit bytes: 2)
      test_stackinit: u32_none FAIL (uninit bytes: 4)
      test_stackinit: u64_none FAIL (uninit bytes: 8)
      test_stackinit: char_array_none FAIL (uninit bytes: 16)
      test_stackinit: switch_1_none FAIL (uninit bytes: 8)
      test_stackinit: switch_2_none FAIL (uninit bytes: 8)
      test_stackinit: small_hole_none FAIL (uninit bytes: 24)
      test_stackinit: big_hole_none FAIL (uninit bytes: 128)
      test_stackinit: trailing_hole_none FAIL (uninit bytes: 32)
      test_stackinit: packed_none FAIL (uninit bytes: 32)
      test_stackinit: user FAIL (uninit bytes: 32)
      test_stackinit: failures: 25
      
      CONFIG_GCC_PLUGIN_STRUCTLEAK_USER=y
      This only tries to initialize structs with __user markings, so
      only the difference from above is now the "user" test passes:
      
      test_stackinit: small_hole_static_all FAIL (uninit bytes: 3)
      test_stackinit: big_hole_static_all FAIL (uninit bytes: 61)
      test_stackinit: trailing_hole_static_all FAIL (uninit bytes: 7)
      test_stackinit: small_hole_dynamic_all FAIL (uninit bytes: 3)
      test_stackinit: big_hole_dynamic_all FAIL (uninit bytes: 61)
      test_stackinit: trailing_hole_dynamic_all FAIL (uninit bytes: 7)
      test_stackinit: small_hole_runtime_partial FAIL (uninit bytes: 23)
      test_stackinit: big_hole_runtime_partial FAIL (uninit bytes: 127)
      test_stackinit: trailing_hole_runtime_partial FAIL (uninit bytes: 24)
      test_stackinit: packed_runtime_partial FAIL (uninit bytes: 24)
      test_stackinit: small_hole_runtime_all FAIL (uninit bytes: 3)
      test_stackinit: big_hole_runtime_all FAIL (uninit bytes: 61)
      test_stackinit: trailing_hole_runtime_all FAIL (uninit bytes: 7)
      test_stackinit: u8_none FAIL (uninit bytes: 1)
      test_stackinit: u16_none FAIL (uninit bytes: 2)
      test_stackinit: u32_none FAIL (uninit bytes: 4)
      test_stackinit: u64_none FAIL (uninit bytes: 8)
      test_stackinit: char_array_none FAIL (uninit bytes: 16)
      test_stackinit: switch_1_none FAIL (uninit bytes: 8)
      test_stackinit: switch_2_none FAIL (uninit bytes: 8)
      test_stackinit: small_hole_none FAIL (uninit bytes: 24)
      test_stackinit: big_hole_none FAIL (uninit bytes: 128)
      test_stackinit: trailing_hole_none FAIL (uninit bytes: 32)
      test_stackinit: packed_none FAIL (uninit bytes: 32)
      test_stackinit: user ok
      test_stackinit: failures: 24
      
      CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF=y
      This initializes all structures passed by reference (scalars and strings
      remain uninitialized):
      
      test_stackinit: small_hole_static_all ok
      test_stackinit: big_hole_static_all ok
      test_stackinit: trailing_hole_static_all ok
      test_stackinit: small_hole_dynamic_all ok
      test_stackinit: big_hole_dynamic_all ok
      test_stackinit: trailing_hole_dynamic_all ok
      test_stackinit: small_hole_runtime_partial ok
      test_stackinit: big_hole_runtime_partial ok
      test_stackinit: trailing_hole_runtime_partial ok
      test_stackinit: packed_runtime_partial ok
      test_stackinit: small_hole_runtime_all ok
      test_stackinit: big_hole_runtime_all ok
      test_stackinit: trailing_hole_runtime_all ok
      test_stackinit: u8_none FAIL (uninit bytes: 1)
      test_stackinit: u16_none FAIL (uninit bytes: 2)
      test_stackinit: u32_none FAIL (uninit bytes: 4)
      test_stackinit: u64_none FAIL (uninit bytes: 8)
      test_stackinit: char_array_none FAIL (uninit bytes: 16)
      test_stackinit: switch_1_none FAIL (uninit bytes: 8)
      test_stackinit: switch_2_none FAIL (uninit bytes: 8)
      test_stackinit: small_hole_none ok
      test_stackinit: big_hole_none ok
      test_stackinit: trailing_hole_none ok
      test_stackinit: packed_none ok
      test_stackinit: user ok
      test_stackinit: failures: 7
      
      CONFIG_GCC_PLUGIN_STRUCTLEAK_BYREF_ALL=y
      This initializes all variables, so it matches above with the scalars
      and arrays included:
      
      test_stackinit: small_hole_static_all ok
      test_stackinit: big_hole_static_all ok
      test_stackinit: trailing_hole_static_all ok
      test_stackinit: small_hole_dynamic_all ok
      test_stackinit: big_hole_dynamic_all ok
      test_stackinit: trailing_hole_dynamic_all ok
      test_stackinit: small_hole_runtime_partial ok
      test_stackinit: big_hole_runtime_partial ok
      test_stackinit: trailing_hole_runtime_partial ok
      test_stackinit: packed_runtime_partial ok
      test_stackinit: small_hole_runtime_all ok
      test_stackinit: big_hole_runtime_all ok
      test_stackinit: trailing_hole_runtime_all ok
      test_stackinit: u8_none ok
      test_stackinit: u16_none ok
      test_stackinit: u32_none ok
      test_stackinit: u64_none ok
      test_stackinit: char_array_none ok
      test_stackinit: switch_1_none ok
      test_stackinit: switch_2_none ok
      test_stackinit: small_hole_none ok
      test_stackinit: big_hole_none ok
      test_stackinit: trailing_hole_none ok
      test_stackinit: packed_none ok
      test_stackinit: user ok
      test_stackinit: all tests passed!
      Signed-off-by: NKees Cook <keescook@chromium.org>
      Reviewed-by: NArd Biesheuvel <ard.biesheuvel@linaro.org>
      50ceaa95
  9. 02 3月, 2019 1 次提交
    • A
      kasan: turn off asan-stack for clang-8 and earlier · 6baec880
      Arnd Bergmann 提交于
      Building an arm64 allmodconfig kernel with clang results in over 140
      warnings about overly large stack frames, the worst ones being:
      
        drivers/gpu/drm/panel/panel-sitronix-st7789v.c:196:12: error: stack frame size of 20224 bytes in function 'st7789v_prepare'
        drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td028ttec1.c:196:12: error: stack frame size of 13120 bytes in function 'td028ttec1_panel_enable'
        drivers/usb/host/max3421-hcd.c:1395:1: error: stack frame size of 10048 bytes in function 'max3421_spi_thread'
        drivers/net/wan/slic_ds26522.c:209:12: error: stack frame size of 9664 bytes in function 'slic_ds26522_probe'
        drivers/crypto/ccp/ccp-ops.c:2434:5: error: stack frame size of 8832 bytes in function 'ccp_run_cmd'
        drivers/media/dvb-frontends/stv0367.c:1005:12: error: stack frame size of 7840 bytes in function 'stv0367ter_algo'
      
      None of these happen with gcc today, and almost all of these are the
      result of a single known issue in llvm.  Hopefully it will eventually
      get fixed with the clang-9 release.
      
      In the meantime, the best idea I have is to turn off asan-stack for
      clang-8 and earlier, so we can produce a kernel that is safe to run.
      
      I have posted three patches that address the frame overflow warnings
      that are not addressed by turning off asan-stack, so in combination with
      this change, we get much closer to a clean allmodconfig build, which in
      turn is necessary to do meaningful build regression testing.
      
      It is still possible to turn on the CONFIG_ASAN_STACK option on all
      versions of clang, and it's always enabled for gcc, but when
      CONFIG_COMPILE_TEST is set, the option remains invisible, so
      allmodconfig and randconfig builds (which are normally done with a
      forced CONFIG_COMPILE_TEST) will still result in a mostly clean build.
      
      Link: http://lkml.kernel.org/r/20190222222950.3997333-1-arnd@arndb.de
      Link: https://bugs.llvm.org/show_bug.cgi?id=38809Signed-off-by: NArnd Bergmann <arnd@arndb.de>
      Reviewed-by: NQian Cai <cai@lca.pw>
      Reviewed-by: NMark Brown <broonie@kernel.org>
      Acked-by: NAndrey Ryabinin <aryabinin@virtuozzo.com>
      Cc: Dmitry Vyukov <dvyukov@google.com>
      Cc: Nick Desaulniers <ndesaulniers@google.com>
      Cc: Kostya Serebryany <kcc@google.com>
      Cc: Andrey Konovalov <andreyknvl@google.com>
      Signed-off-by: NAndrew Morton <akpm@linux-foundation.org>
      Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>
      6baec880
  10. 01 3月, 2019 2 次提交
  11. 28 2月, 2019 3 次提交
  12. 27 2月, 2019 1 次提交
    • E
      iov_iter: optimize page_copy_sane() · 6daef95b
      Eric Dumazet 提交于
      Avoid cache line miss dereferencing struct page if we can.
      
      page_copy_sane() mostly deals with order-0 pages.
      
      Extra cache line miss is visible on TCP recvmsg() calls dealing
      with GRO packets (typically 45 page frags are attached to one skb).
      
      Bringing the 45 struct pages into cpu cache while copying the data
      is not free, since the freeing of the skb (and associated
      page frags put_page()) can happen after cache lines have been evicted.
      Signed-off-by: NEric Dumazet <edumazet@google.com>
      Cc: Al Viro <viro@zeniv.linux.org.uk>
      Signed-off-by: NAl Viro <viro@zeniv.linux.org.uk>
      6daef95b
  13. 26 2月, 2019 1 次提交
    • A
      bpf: test_bpf: turn off preemption in function __run_once · fd92d664
      Anders Roxell 提交于
      When running BPF test suite the following splat occurs:
      
      [  415.930950] test_bpf: #0 TAX jited:0
      [  415.931067] BUG: assuming atomic context at lib/test_bpf.c:6674
      [  415.946169] in_atomic(): 0, irqs_disabled(): 0, pid: 11556, name: modprobe
      [  415.953176] INFO: lockdep is turned off.
      [  415.957207] CPU: 1 PID: 11556 Comm: modprobe Tainted: G        W         5.0.0-rc7-next-20190220 #1
      [  415.966328] Hardware name: HiKey Development Board (DT)
      [  415.971592] Call trace:
      [  415.974069]  dump_backtrace+0x0/0x160
      [  415.977761]  show_stack+0x24/0x30
      [  415.981104]  dump_stack+0xc8/0x114
      [  415.984534]  __cant_sleep+0xf0/0x108
      [  415.988145]  test_bpf_init+0x5e0/0x1000 [test_bpf]
      [  415.992971]  do_one_initcall+0x90/0x428
      [  415.996837]  do_init_module+0x60/0x1e4
      [  416.000614]  load_module+0x1de0/0x1f50
      [  416.004391]  __se_sys_finit_module+0xc8/0xe0
      [  416.008691]  __arm64_sys_finit_module+0x24/0x30
      [  416.013255]  el0_svc_common+0x78/0x130
      [  416.017031]  el0_svc_handler+0x38/0x78
      [  416.020806]  el0_svc+0x8/0xc
      
      Rework so that preemption is disabled when we loop over function
      'BPF_PROG_RUN(...)'.
      
      Fixes: 568f1967 ("bpf: check that BPF programs run with preemption disabled")
      Suggested-by: NArnd Bergmann <arnd@arndb.de>
      Signed-off-by: NAnders Roxell <anders.roxell@linaro.org>
      Signed-off-by: NDaniel Borkmann <daniel@iogearbox.net>
      fd92d664
  14. 22 2月, 2019 4 次提交
  15. 21 2月, 2019 1 次提交