Skip to contentSkip to conversation

Linux 5.10.125

DISCUSSION Greg Kroah-Hartman 3 participants 9 messages Jun 25, 2022 – Jun 27, 2022 Stable branch

lore
Share & tools
lore

Greg Kroah-Hartman

author maintainer
#0 lore raw

I'm announcing the release of the 5.10.125 kernel.

All users of the 5.10 kernel series must upgrade.

The updated 5.10.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary

thanks,

greg k-h

------------

 Makefile                              |    2 
 arch/arm64/mm/cache.S                 |    2 
 arch/s390/mm/pgtable.c                |    2 
 drivers/tty/serial/serial_core.c      |   34 ++++--------
 drivers/usb/gadget/function/u_ether.c |   11 +++-
 fs/io_uring.c                         |   23 +++++---
 fs/zonefs/super.c                     |   92 ++++++++++++++++++++++------------
 net/ipv4/inet_hashtables.c            |   31 ++++++++---
 8 files changed, 122 insertions(+), 75 deletions(-)

Christian Borntraeger (1):
s390/mm: use non-quiescing sske for KVM switch to keyed guest

Damien Le Moal (1):
zonefs: fix zonefs_iomap_begin() for reads

Eric Dumazet (1):
tcp: add some entropy in __inet_hash_connect()

Greg Kroah-Hartman (1):

      Linux 5.10.125

Jens Axboe (1):
io_uring: add missing item types for various requests

Lukas Wunner (1):
serial: core: Initialize rs485 RTS polarity already on probe

Marian Postevca (1):
usb: gadget: u_ether: fix regression in setting fixed MAC address

Will Deacon (1):
arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer

Willy Tarreau (5):
tcp: use different parts of the port_offset for index and offset
tcp: add small random increments to the source port
tcp: dynamically allocate the perturb table used by source ports
tcp: increase source port perturb table to 2^16
tcp: drop the hash_32() part from the index calculation

author maintainer
#1 lore raw
Makefile +1 -1
index 9ed79a05a972..da5b28931e5c 100644
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 124
+SUBLEVEL = 125
 EXTRAVERSION =
 NAME = Dare mighty things
arch/arm64/mm/cache.S +0 -2
index 2d881f34dd9d..7b8158ae36ec 100644
@@ -228,8 +228,6 @@ SYM_FUNC_END_PI(__dma_flush_area)
  *	- dir	- DMA direction
  */
 SYM_FUNC_START_PI(__dma_map_area)
-	cmp	w2, #DMA_FROM_DEVICE
-	b.eq	__dma_inv_area
 	b	__dma_clean_area
 SYM_FUNC_END_PI(__dma_map_area)
arch/s390/mm/pgtable.c +1 -1
index fabaedddc90c..1c05caf68e7d 100644
@@ -734,7 +734,7 @@ void ptep_zap_key(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
 	pgste_val(pgste) |= PGSTE_GR_BIT | PGSTE_GC_BIT;
 	ptev = pte_val(*ptep);
 	if (!(ptev & _PAGE_INVALID) && (ptev & _PAGE_WRITE))
-		page_set_storage_key(ptev & PAGE_MASK, PAGE_DEFAULT_KEY, 1);
+		page_set_storage_key(ptev & PAGE_MASK, PAGE_DEFAULT_KEY, 0);
 	pgste_set_unlock(ptep, pgste);
 	preempt_enable();
 }
drivers/tty/serial/serial_core.c +12 -22
index 19f0c5db11e3..32d09d024f6c 100644
@@ -144,6 +144,11 @@ uart_update_mctrl(struct uart_port *port, unsigned int set, unsigned int clear)
 	unsigned long flags;
 	unsigned int old;
 
+	if (port->rs485.flags & SER_RS485_ENABLED) {
+		set &= ~TIOCM_RTS;
+		clear &= ~TIOCM_RTS;
+	}
+
 	spin_lock_irqsave(&port->lock, flags);
 	old = port->mctrl;
 	port->mctrl = (old & ~clear) | set;

@@ -157,23 +162,10 @@ uart_update_mctrl(struct uart_port *port, unsigned int set, unsigned int clear)
 
 static void uart_port_dtr_rts(struct uart_port *uport, int raise)
 {
-	int rs485_on = uport->rs485_config &&
-		(uport->rs485.flags & SER_RS485_ENABLED);
-	int RTS_after_send = !!(uport->rs485.flags & SER_RS485_RTS_AFTER_SEND);
-
-	if (raise) {
-		if (rs485_on && RTS_after_send) {
-			uart_set_mctrl(uport, TIOCM_DTR);
-			uart_clear_mctrl(uport, TIOCM_RTS);
-		} else {
-			uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
-		}
-	} else {
-		unsigned int clear = TIOCM_DTR;
-
-		clear |= (!rs485_on || RTS_after_send) ? TIOCM_RTS : 0;
-		uart_clear_mctrl(uport, clear);
-	}
+	if (raise)
+		uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
+	else
+		uart_clear_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
 }
 
 /*

@@ -1116,11 +1108,6 @@ uart_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear)
 		goto out;
 
 	if (!tty_io_error(tty)) {
-		if (uport->rs485.flags & SER_RS485_ENABLED) {
-			set &= ~TIOCM_RTS;
-			clear &= ~TIOCM_RTS;
-		}
-
 		uart_update_mctrl(uport, set, clear);
 		ret = 0;
 	}

@@ -2429,6 +2416,9 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state,
 		 */
 		spin_lock_irqsave(&port->lock, flags);
 		port->mctrl &= TIOCM_DTR;
+		if (port->rs485.flags & SER_RS485_ENABLED &&
+		    !(port->rs485.flags & SER_RS485_RTS_AFTER_SEND))
+			port->mctrl |= TIOCM_RTS;
 		port->ops->set_mctrl(port, port->mctrl);
 		spin_unlock_irqrestore(&port->lock, flags);
drivers/usb/gadget/function/u_ether.c +9 -2
index a40be8b448c2..64ef97ab9274 100644
@@ -772,9 +772,13 @@ struct eth_dev *gether_setup_name(struct usb_gadget *g,
 	dev->qmult = qmult;
 	snprintf(net->name, sizeof(net->name), "%s%%d", netname);
 
-	if (get_ether_addr(dev_addr, net->dev_addr))
+	if (get_ether_addr(dev_addr, net->dev_addr)) {
+		net->addr_assign_type = NET_ADDR_RANDOM;
 		dev_warn(&g->dev,
 			"using random %s ethernet address\n", "self");
+	} else {
+		net->addr_assign_type = NET_ADDR_SET;
+	}
 	if (get_ether_addr(host_addr, dev->host_mac))
 		dev_warn(&g->dev,
 			"using random %s ethernet address\n", "host");

@@ -831,6 +835,9 @@ struct net_device *gether_setup_name_default(const char *netname)
 	INIT_LIST_HEAD(&dev->tx_reqs);
 	INIT_LIST_HEAD(&dev->rx_reqs);
 
+	/* by default we always have a random MAC address */
+	net->addr_assign_type = NET_ADDR_RANDOM;
+
 	skb_queue_head_init(&dev->rx_frames);
 
 	/* network device setup */

@@ -868,7 +875,6 @@ int gether_register_netdev(struct net_device *net)
 	g = dev->gadget;
 
 	memcpy(net->dev_addr, dev->dev_mac, ETH_ALEN);
-	net->addr_assign_type = NET_ADDR_RANDOM;
 
 	status = register_netdev(net);
 	if (status < 0) {

@@ -908,6 +914,7 @@ int gether_set_dev_addr(struct net_device *net, const char *dev_addr)
 	if (get_ether_addr(dev_addr, new_addr))
 		return -EINVAL;
 	memcpy(dev->dev_mac, new_addr, ETH_ALEN);
+	net->addr_assign_type = NET_ADDR_SET;
 	return 0;
 }
 EXPORT_SYMBOL_GPL(gether_set_dev_addr);
fs/io_uring.c +14 -9
index 871475d3fca2..40ac37beca47 100644
@@ -773,7 +773,8 @@ static const struct io_op_def io_op_defs[] = {
 		.buffer_select		= 1,
 		.needs_async_data	= 1,
 		.async_size		= sizeof(struct io_async_rw),
-		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG,
+		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
+					  IO_WQ_WORK_FILES,
 	},
 	[IORING_OP_WRITEV] = {
 		.needs_file		= 1,

@@ -783,7 +784,7 @@ static const struct io_op_def io_op_defs[] = {
 		.needs_async_data	= 1,
 		.async_size		= sizeof(struct io_async_rw),
 		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
-						IO_WQ_WORK_FSIZE,
+					  IO_WQ_WORK_FSIZE | IO_WQ_WORK_FILES,
 	},
 	[IORING_OP_FSYNC] = {
 		.needs_file		= 1,

@@ -794,7 +795,8 @@ static const struct io_op_def io_op_defs[] = {
 		.unbound_nonreg_file	= 1,
 		.pollin			= 1,
 		.async_size		= sizeof(struct io_async_rw),
-		.work_flags		= IO_WQ_WORK_BLKCG | IO_WQ_WORK_MM,
+		.work_flags		= IO_WQ_WORK_BLKCG | IO_WQ_WORK_MM |
+					  IO_WQ_WORK_FILES,
 	},
 	[IORING_OP_WRITE_FIXED] = {
 		.needs_file		= 1,

@@ -803,7 +805,7 @@ static const struct io_op_def io_op_defs[] = {
 		.pollout		= 1,
 		.async_size		= sizeof(struct io_async_rw),
 		.work_flags		= IO_WQ_WORK_BLKCG | IO_WQ_WORK_FSIZE |
-						IO_WQ_WORK_MM,
+					  IO_WQ_WORK_MM | IO_WQ_WORK_FILES,
 	},
 	[IORING_OP_POLL_ADD] = {
 		.needs_file		= 1,

@@ -857,7 +859,7 @@ static const struct io_op_def io_op_defs[] = {
 		.pollout		= 1,
 		.needs_async_data	= 1,
 		.async_size		= sizeof(struct io_async_connect),
-		.work_flags		= IO_WQ_WORK_MM,
+		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_FS,
 	},
 	[IORING_OP_FALLOCATE] = {
 		.needs_file		= 1,

@@ -885,7 +887,8 @@ static const struct io_op_def io_op_defs[] = {
 		.pollin			= 1,
 		.buffer_select		= 1,
 		.async_size		= sizeof(struct io_async_rw),
-		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG,
+		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
+					  IO_WQ_WORK_FILES,
 	},
 	[IORING_OP_WRITE] = {
 		.needs_file		= 1,

@@ -894,7 +897,7 @@ static const struct io_op_def io_op_defs[] = {
 		.pollout		= 1,
 		.async_size		= sizeof(struct io_async_rw),
 		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
-						IO_WQ_WORK_FSIZE,
+					  IO_WQ_WORK_FSIZE | IO_WQ_WORK_FILES,
 	},
 	[IORING_OP_FADVISE] = {
 		.needs_file		= 1,

@@ -907,14 +910,16 @@ static const struct io_op_def io_op_defs[] = {
 		.needs_file		= 1,
 		.unbound_nonreg_file	= 1,
 		.pollout		= 1,
-		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG,
+		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
+					  IO_WQ_WORK_FS,
 	},
 	[IORING_OP_RECV] = {
 		.needs_file		= 1,
 		.unbound_nonreg_file	= 1,
 		.pollin			= 1,
 		.buffer_select		= 1,
-		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG,
+		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
+					  IO_WQ_WORK_FS,
 	},
 	[IORING_OP_OPENAT2] = {
 		.work_flags		= IO_WQ_WORK_FILES | IO_WQ_WORK_FS |
fs/zonefs/super.c +62 -30

176 lines not on this page · raw message

net/ipv4/inet_hashtables.c +23 -8
index 44b524136f95..f38b71cc3edb 100644
@@ -726,12 +726,14 @@ EXPORT_SYMBOL_GPL(inet_unhash);
  * Note that we use 32bit integers (vs RFC 'short integers')
  * because 2^16 is not a multiple of num_ephemeral and this
  * property might be used by clever attacker.
- * RFC claims using TABLE_LENGTH=10 buckets gives an improvement,
- * we use 256 instead to really give more isolation and
- * privacy, this only consumes 1 KB of kernel memory.
+ * RFC claims using TABLE_LENGTH=10 buckets gives an improvement, though
+ * attacks were since demonstrated, thus we use 65536 instead to really
+ * give more isolation and privacy, at the expense of 256kB of kernel
+ * memory.
  */
-#define INET_TABLE_PERTURB_SHIFT 8
-static u32 table_perturb[1 << INET_TABLE_PERTURB_SHIFT];
+#define INET_TABLE_PERTURB_SHIFT 16
+#define INET_TABLE_PERTURB_SIZE (1 << INET_TABLE_PERTURB_SHIFT)
+static u32 *table_perturb;
 
 int __inet_hash_connect(struct inet_timewait_death_row *death_row,
 		struct sock *sk, u64 port_offset,

@@ -774,10 +776,11 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
 	if (likely(remaining > 1))
 		remaining &= ~1U;
 
-	net_get_random_once(table_perturb, sizeof(table_perturb));
-	index = hash_32(port_offset, INET_TABLE_PERTURB_SHIFT);
+	net_get_random_once(table_perturb,
+			    INET_TABLE_PERTURB_SIZE * sizeof(*table_perturb));
+	index = port_offset & (INET_TABLE_PERTURB_SIZE - 1);
 
-	offset = READ_ONCE(table_perturb[index]) + port_offset;
+	offset = READ_ONCE(table_perturb[index]) + (port_offset >> 32);
 	offset %= remaining;
 
 	/* In first pass we try ports of @low parity.

@@ -833,6 +836,12 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
 	return -EADDRNOTAVAIL;
 
 ok:
+	/* Here we want to add a little bit of randomness to the next source
+	 * port that will be chosen. We use a max() with a random here so that
+	 * on low contention the randomness is maximal and on high contention
+	 * it may be inexistent.
+	 */
+	i = max_t(int, i, (prandom_u32() & 7) * 2);
 	WRITE_ONCE(table_perturb[index], READ_ONCE(table_perturb[index]) + i + 2);
 
 	/* Head lock still held and bh's disabled */

@@ -906,6 +915,12 @@ void __init inet_hashinfo2_init(struct inet_hashinfo *h, const char *name,
 					    low_limit,
 					    high_limit);
 	init_hashinfo_lhash2(h);
+
+	/* this one is used for source ports of outgoing connections */
+	table_perturb = kmalloc_array(INET_TABLE_PERTURB_SIZE,
+				      sizeof(*table_perturb), GFP_KERNEL);
+	if (!table_perturb)
+		panic("TCP: failed to alloc table_perturb");
 }
 
 int inet_hashinfo2_init_mod(struct inet_hashinfo *h)
#2 lore raw
In reply to Greg Kroah-Hartman
Quoted 49 lines · Greg Kroah-Hartman

I'm announcing the release of the 5.10.125 kernel.

All users of the 5.10 kernel series must upgrade.

The updated 5.10.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary

thanks,

greg k-h

------------

 Makefile                              |    2 
 arch/arm64/mm/cache.S                 |    2 
 arch/s390/mm/pgtable.c                |    2 
 drivers/tty/serial/serial_core.c      |   34 ++++--------
 drivers/usb/gadget/function/u_ether.c |   11 +++-
 fs/io_uring.c                         |   23 +++++---
 fs/zonefs/super.c                     |   92 ++++++++++++++++++++++------------
 net/ipv4/inet_hashtables.c            |   31 ++++++++---
 8 files changed, 122 insertions(+), 75 deletions(-)

Christian Borntraeger (1):
s390/mm: use non-quiescing sske for KVM switch to keyed guest

Damien Le Moal (1):
zonefs: fix zonefs_iomap_begin() for reads

Eric Dumazet (1):
tcp: add some entropy in __inet_hash_connect()

Greg Kroah-Hartman (1):

      Linux 5.10.125

Jens Axboe (1):
io_uring: add missing item types for various requests

Lukas Wunner (1):
serial: core: Initialize rs485 RTS polarity already on probe

Marian Postevca (1):
usb: gadget: u_ether: fix regression in setting fixed MAC address

Will Deacon (1):
arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer

Quoted 6 lines

Willy Tarreau (5):
tcp: use different parts of the port_offset for index and offset
tcp: add small random increments to the source port
tcp: dynamically allocate the perturb table used by source ports
tcp: increase source port perturb table to 2^16
tcp: drop the hash_32() part from the index calculation

5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).

Here's a manually annotated panic message:

[  359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
[  359.055393] kernel BUG at lib/list_debug.c:47!
[  359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
[  359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S        I       5.10.124 #1
[  359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
[  359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
[  359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
[  359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
[  359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
[  359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
[  359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
[  359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
[  359.145836] FS:  00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
[  359.153830] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
[  359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  359.180647] Call Trace:
[  359.183064]  io_dismantle_req+0x1da/0x2b0
                    __list_del_entry [include/linux/list.h:132]
                    list_del [include/linux/list.h:146]
                    io_req_drop_files [fs/io_uring.c:5934]
                    io_req_clean_work [fs/io_uring.c:1315]
                    io_dismantle_req [fs/io_uring.c:1911]
[  359.187023]  io_do_iopoll+0x4e5/0x790
[  359.194602]  __se_sys_io_uring_enter+0x39b/0x6f0
[  359.208318]  __x64_sys_io_uring_enter+0x29/0x30
[  359.212793]  do_syscall_64+0x31/0x40
[  359.216324]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
#3 lore raw
Quoted 85 lines · Greg Thelen
Quoted 49 lines · Greg Kroah-Hartman

I'm announcing the release of the 5.10.125 kernel.

All users of the 5.10 kernel series must upgrade.

The updated 5.10.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary

thanks,

greg k-h

------------

 Makefile                              |    2 
 arch/arm64/mm/cache.S                 |    2 
 arch/s390/mm/pgtable.c                |    2 
 drivers/tty/serial/serial_core.c      |   34 ++++--------
 drivers/usb/gadget/function/u_ether.c |   11 +++-
 fs/io_uring.c                         |   23 +++++---
 fs/zonefs/super.c                     |   92 ++++++++++++++++++++++------------
 net/ipv4/inet_hashtables.c            |   31 ++++++++---
 8 files changed, 122 insertions(+), 75 deletions(-)

Christian Borntraeger (1):
s390/mm: use non-quiescing sske for KVM switch to keyed guest

Damien Le Moal (1):
zonefs: fix zonefs_iomap_begin() for reads

Eric Dumazet (1):
tcp: add some entropy in __inet_hash_connect()

Greg Kroah-Hartman (1):

      Linux 5.10.125

Jens Axboe (1):
io_uring: add missing item types for various requests

Lukas Wunner (1):
serial: core: Initialize rs485 RTS polarity already on probe

Marian Postevca (1):
usb: gadget: u_ether: fix regression in setting fixed MAC address

Will Deacon (1):
arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer

Quoted 6 lines

Willy Tarreau (5):
tcp: use different parts of the port_offset for index and offset
tcp: add small random increments to the source port
tcp: dynamically allocate the perturb table used by source ports
tcp: increase source port perturb table to 2^16
tcp: drop the hash_32() part from the index calculation

5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).

Here's a manually annotated panic message:

[  359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
[  359.055393] kernel BUG at lib/list_debug.c:47!
[  359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
[  359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S        I       5.10.124 #1
[  359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
[  359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
[  359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
[  359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
[  359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
[  359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
[  359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
[  359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
[  359.145836] FS:  00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
[  359.153830] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
[  359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  359.180647] Call Trace:
[  359.183064]  io_dismantle_req+0x1da/0x2b0
                    __list_del_entry [include/linux/list.h:132]
                    list_del [include/linux/list.h:146]
Quoted 8 lines
                    io_req_drop_files [fs/io_uring.c:5934]
                    io_req_clean_work [fs/io_uring.c:1315]
                    io_dismantle_req [fs/io_uring.c:1911]
[  359.187023]  io_do_iopoll+0x4e5/0x790
[  359.194602]  __se_sys_io_uring_enter+0x39b/0x6f0
[  359.208318]  __x64_sys_io_uring_enter+0x29/0x30
[  359.212793]  do_syscall_64+0x31/0x40
[  359.216324]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Well that sucks, I wonder why mine didn't fail like that. I'll see if I can hit this and send a fix. Thanks for reporting!

Signature · 1 line
Jens Axboe
#4 lore raw
Quoted 95 lines · Jens Axboe
Quoted 85 lines · Greg Thelen
Quoted 49 lines · Greg Kroah-Hartman

I'm announcing the release of the 5.10.125 kernel.

All users of the 5.10 kernel series must upgrade.

The updated 5.10.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary

thanks,

greg k-h

------------

 Makefile                              |    2 
 arch/arm64/mm/cache.S                 |    2 
 arch/s390/mm/pgtable.c                |    2 
 drivers/tty/serial/serial_core.c      |   34 ++++--------
 drivers/usb/gadget/function/u_ether.c |   11 +++-
 fs/io_uring.c                         |   23 +++++---
 fs/zonefs/super.c                     |   92 ++++++++++++++++++++++------------
 net/ipv4/inet_hashtables.c            |   31 ++++++++---
 8 files changed, 122 insertions(+), 75 deletions(-)

Christian Borntraeger (1):
s390/mm: use non-quiescing sske for KVM switch to keyed guest

Damien Le Moal (1):
zonefs: fix zonefs_iomap_begin() for reads

Eric Dumazet (1):
tcp: add some entropy in __inet_hash_connect()

Greg Kroah-Hartman (1):

      Linux 5.10.125

Jens Axboe (1):
io_uring: add missing item types for various requests

Lukas Wunner (1):
serial: core: Initialize rs485 RTS polarity already on probe

Marian Postevca (1):
usb: gadget: u_ether: fix regression in setting fixed MAC address

Will Deacon (1):
arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer

Quoted 6 lines

Willy Tarreau (5):
tcp: use different parts of the port_offset for index and offset
tcp: add small random increments to the source port
tcp: dynamically allocate the perturb table used by source ports
tcp: increase source port perturb table to 2^16
tcp: drop the hash_32() part from the index calculation

5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).

Here's a manually annotated panic message:

[  359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
[  359.055393] kernel BUG at lib/list_debug.c:47!
[  359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
[  359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S        I       5.10.124 #1
[  359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
[  359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
[  359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
[  359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
[  359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
[  359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
[  359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
[  359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
[  359.145836] FS:  00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
[  359.153830] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
[  359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  359.180647] Call Trace:
[  359.183064]  io_dismantle_req+0x1da/0x2b0
                    __list_del_entry [include/linux/list.h:132]
                    list_del [include/linux/list.h:146]
Quoted 8 lines
                    io_req_drop_files [fs/io_uring.c:5934]
                    io_req_clean_work [fs/io_uring.c:1315]
                    io_dismantle_req [fs/io_uring.c:1911]
[  359.187023]  io_do_iopoll+0x4e5/0x790
[  359.194602]  __se_sys_io_uring_enter+0x39b/0x6f0
[  359.208318]  __x64_sys_io_uring_enter+0x29/0x30
[  359.212793]  do_syscall_64+0x31/0x40
[  359.216324]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
Quoted 2 lines

Well that sucks, I wonder why mine didn't fail like that. I'll see if I can hit this and send a fix. Thanks for reporting!

Below should do it, I apologize for that. I think my test box booted the previous kernel which is why it didn't hit it in my regression tests :-(

Greg, can you add this to 5.10-stable? Verified it ran tests with the right kernel now...

commit d2aaf8fdc544a3edf44820a07294d693dedd12e3

Author: Jens Axboe <[email protected]>
Date:   Sun Jun 26 18:16:17 2022 -0600

io_uring: use separate list entry for iopoll requests

A previous commit ended up enabling file tracking for iopoll requests, which conflicts with both of them using the same list entry for tracking. Add a separate list entry just for iopoll requests, avoid this issue.

No upstream commit exists for this issue.

Reported-by Greg Thelen <[email protected]>
Fixes df3f3bb5059d ("io_uring: add missing item types for various requests")
Signed-off-by Jens Axboe <[email protected]>
fs/io_uring.c +13 -11
index 40ac37beca47..2e12dcbc7b0f 100644
@@ -696,6 +696,8 @@ struct io_kiocb {
 	 */
 	struct list_head		inflight_entry;
 
+	struct list_head		iopoll_entry;
+
 	struct percpu_ref		*fixed_file_refs;
 	struct callback_head		task_work;
 	/* for polled requests, i.e. IORING_OP_POLL_ADD and async armed poll */

@@ -2350,8 +2352,8 @@ static void io_iopoll_queue(struct list_head *again)
 	struct io_kiocb *req;
 
 	do {
-		req = list_first_entry(again, struct io_kiocb, inflight_entry);
-		list_del(&req->inflight_entry);
+		req = list_first_entry(again, struct io_kiocb, iopoll_entry);
+		list_del(&req->iopoll_entry);
 		__io_complete_rw(req, -EAGAIN, 0, NULL);
 	} while (!list_empty(again));
 }

@@ -2373,14 +2375,14 @@ static void io_iopoll_complete(struct io_ring_ctx *ctx, unsigned int *nr_events,
 	while (!list_empty(done)) {
 		int cflags = 0;
 
-		req = list_first_entry(done, struct io_kiocb, inflight_entry);
+		req = list_first_entry(done, struct io_kiocb, iopoll_entry);
 		if (READ_ONCE(req->result) == -EAGAIN) {
 			req->result = 0;
 			req->iopoll_completed = 0;
-			list_move_tail(&req->inflight_entry, &again);
+			list_move_tail(&req->iopoll_entry, &again);
 			continue;
 		}
-		list_del(&req->inflight_entry);
+		list_del(&req->iopoll_entry);
 
 		if (req->flags & REQ_F_BUFFER_SELECTED)
 			cflags = io_put_rw_kbuf(req);

@@ -2416,7 +2418,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
 	spin = !ctx->poll_multi_file && *nr_events < min;
 
 	ret = 0;
-	list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, inflight_entry) {
+	list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, iopoll_entry) {
 		struct kiocb *kiocb = &req->rw.kiocb;
 
 		/*

@@ -2425,7 +2427,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
 		 * and complete those lists first, if we have entries there.
 		 */
 		if (READ_ONCE(req->iopoll_completed)) {
-			list_move_tail(&req->inflight_entry, &done);
+			list_move_tail(&req->iopoll_entry, &done);
 			continue;
 		}
 		if (!list_empty(&done))

@@ -2437,7 +2439,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
 
 		/* iopoll may have completed current req */
 		if (READ_ONCE(req->iopoll_completed))
-			list_move_tail(&req->inflight_entry, &done);
+			list_move_tail(&req->iopoll_entry, &done);
 
 		if (ret && spin)
 			spin = false;

@@ -2670,7 +2672,7 @@ static void io_iopoll_req_issued(struct io_kiocb *req)
 		struct io_kiocb *list_req;
 
 		list_req = list_first_entry(&ctx->iopoll_list, struct io_kiocb,
-						inflight_entry);
+						iopoll_entry);
 		if (list_req->file != req->file)
 			ctx->poll_multi_file = true;
 	}

@@ -2680,9 +2682,9 @@ static void io_iopoll_req_issued(struct io_kiocb *req)
 	 * it to the front so we find it first.
 	 */
 	if (READ_ONCE(req->iopoll_completed))
-		list_add(&req->inflight_entry, &ctx->iopoll_list);
+		list_add(&req->iopoll_entry, &ctx->iopoll_list);
 	else
-		list_add_tail(&req->inflight_entry, &ctx->iopoll_list);
+		list_add_tail(&req->iopoll_entry, &ctx->iopoll_list);
 
 	if ((ctx->flags & IORING_SETUP_SQPOLL) &&
 	    wq_has_sleeper(&ctx->sq_data->wait))
Signature · 1 line
Jens Axboe
Tested-by
#5 lore raw
Quoted 116 lines · Jens Axboe
Quoted 95 lines · Jens Axboe
Quoted 85 lines · Greg Thelen
Quoted 49 lines · Greg Kroah-Hartman

I'm announcing the release of the 5.10.125 kernel.

All users of the 5.10 kernel series must upgrade.

The updated 5.10.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary

thanks,

greg k-h

------------

 Makefile                              |    2 
 arch/arm64/mm/cache.S                 |    2 
 arch/s390/mm/pgtable.c                |    2 
 drivers/tty/serial/serial_core.c      |   34 ++++--------
 drivers/usb/gadget/function/u_ether.c |   11 +++-
 fs/io_uring.c                         |   23 +++++---
 fs/zonefs/super.c                     |   92 ++++++++++++++++++++++------------
 net/ipv4/inet_hashtables.c            |   31 ++++++++---
 8 files changed, 122 insertions(+), 75 deletions(-)

Christian Borntraeger (1):
s390/mm: use non-quiescing sske for KVM switch to keyed guest

Damien Le Moal (1):
zonefs: fix zonefs_iomap_begin() for reads

Eric Dumazet (1):
tcp: add some entropy in __inet_hash_connect()

Greg Kroah-Hartman (1):

      Linux 5.10.125

Jens Axboe (1):
io_uring: add missing item types for various requests

Lukas Wunner (1):
serial: core: Initialize rs485 RTS polarity already on probe

Marian Postevca (1):
usb: gadget: u_ether: fix regression in setting fixed MAC address

Will Deacon (1):
arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer

Quoted 6 lines

Willy Tarreau (5):
tcp: use different parts of the port_offset for index and offset
tcp: add small random increments to the source port
tcp: dynamically allocate the perturb table used by source ports
tcp: increase source port perturb table to 2^16
tcp: drop the hash_32() part from the index calculation

5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).

Here's a manually annotated panic message:

[  359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
[  359.055393] kernel BUG at lib/list_debug.c:47!
[  359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
[  359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S        I       5.10.124 #1
[  359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
[  359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
[  359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
[  359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
[  359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
[  359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
[  359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
[  359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
[  359.145836] FS:  00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
[  359.153830] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
[  359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  359.180647] Call Trace:
[  359.183064]  io_dismantle_req+0x1da/0x2b0
                    __list_del_entry [include/linux/list.h:132]
                    list_del [include/linux/list.h:146]
Quoted 8 lines
                    io_req_drop_files [fs/io_uring.c:5934]
                    io_req_clean_work [fs/io_uring.c:1315]
                    io_dismantle_req [fs/io_uring.c:1911]
[  359.187023]  io_do_iopoll+0x4e5/0x790
[  359.194602]  __se_sys_io_uring_enter+0x39b/0x6f0
[  359.208318]  __x64_sys_io_uring_enter+0x29/0x30
[  359.212793]  do_syscall_64+0x31/0x40
[  359.216324]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
Quoted 2 lines

Well that sucks, I wonder why mine didn't fail like that. I'll see if I can hit this and send a fix. Thanks for reporting!

Below should do it, I apologize for that. I think my test box booted the previous kernel which is why it didn't hit it in my regression tests :-(

Greg, can you add this to 5.10-stable? Verified it ran tests with the right kernel now...

commit d2aaf8fdc544a3edf44820a07294d693dedd12e3

Author: Jens Axboe <[email protected]>
Date:   Sun Jun 26 18:16:17 2022 -0600

io_uring: use separate list entry for iopoll requests

A previous commit ended up enabling file tracking for iopoll requests, which conflicts with both of them using the same list entry for tracking. Add a separate list entry just for iopoll requests, avoid this issue.

Quoted 5 lines

No upstream commit exists for this issue.

Reported-by Greg Thelen <[email protected]>
Fixes df3f3bb5059d ("io_uring: add missing item types for various requests")
Signed-off-by Jens Axboe <[email protected]>

Confirmed. This patch fixes the error I saw.

Tested-by Greg Thelen <[email protected]>
Quoted 90 lines
fs/io_uring.c +13 -11
index 40ac37beca47..2e12dcbc7b0f 100644
@@ -696,6 +696,8 @@ struct io_kiocb {
 	 */
 	struct list_head		inflight_entry;
 
+	struct list_head		iopoll_entry;
+
 	struct percpu_ref		*fixed_file_refs;
 	struct callback_head		task_work;
 	/* for polled requests, i.e. IORING_OP_POLL_ADD and async armed poll */

@@ -2350,8 +2352,8 @@ static void io_iopoll_queue(struct list_head *again)
 	struct io_kiocb *req;
 
 	do {
-		req = list_first_entry(again, struct io_kiocb, inflight_entry);
-		list_del(&req->inflight_entry);
+		req = list_first_entry(again, struct io_kiocb, iopoll_entry);
+		list_del(&req->iopoll_entry);
 		__io_complete_rw(req, -EAGAIN, 0, NULL);
 	} while (!list_empty(again));
 }

@@ -2373,14 +2375,14 @@ static void io_iopoll_complete(struct io_ring_ctx *ctx, unsigned int *nr_events,
 	while (!list_empty(done)) {
 		int cflags = 0;
 
-		req = list_first_entry(done, struct io_kiocb, inflight_entry);
+		req = list_first_entry(done, struct io_kiocb, iopoll_entry);
 		if (READ_ONCE(req->result) == -EAGAIN) {
 			req->result = 0;
 			req->iopoll_completed = 0;
-			list_move_tail(&req->inflight_entry, &again);
+			list_move_tail(&req->iopoll_entry, &again);
 			continue;
 		}
-		list_del(&req->inflight_entry);
+		list_del(&req->iopoll_entry);
 
 		if (req->flags & REQ_F_BUFFER_SELECTED)
 			cflags = io_put_rw_kbuf(req);

@@ -2416,7 +2418,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
 	spin = !ctx->poll_multi_file && *nr_events < min;
 
 	ret = 0;
-	list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, inflight_entry) {
+	list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, iopoll_entry) {
 		struct kiocb *kiocb = &req->rw.kiocb;
 
 		/*

@@ -2425,7 +2427,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
 		 * and complete those lists first, if we have entries there.
 		 */
 		if (READ_ONCE(req->iopoll_completed)) {
-			list_move_tail(&req->inflight_entry, &done);
+			list_move_tail(&req->iopoll_entry, &done);
 			continue;
 		}
 		if (!list_empty(&done))

@@ -2437,7 +2439,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
 
 		/* iopoll may have completed current req */
 		if (READ_ONCE(req->iopoll_completed))
-			list_move_tail(&req->inflight_entry, &done);
+			list_move_tail(&req->iopoll_entry, &done);
 
 		if (ret && spin)
 			spin = false;

@@ -2670,7 +2672,7 @@ static void io_iopoll_req_issued(struct io_kiocb *req)
 		struct io_kiocb *list_req;
 
 		list_req = list_first_entry(&ctx->iopoll_list, struct io_kiocb,
-						inflight_entry);
+						iopoll_entry);
 		if (list_req->file != req->file)
 			ctx->poll_multi_file = true;
 	}

@@ -2680,9 +2682,9 @@ static void io_iopoll_req_issued(struct io_kiocb *req)
 	 * it to the front so we find it first.
 	 */
 	if (READ_ONCE(req->iopoll_completed))
-		list_add(&req->inflight_entry, &ctx->iopoll_list);
+		list_add(&req->iopoll_entry, &ctx->iopoll_list);
 	else
-		list_add_tail(&req->inflight_entry, &ctx->iopoll_list);
+		list_add_tail(&req->iopoll_entry, &ctx->iopoll_list);
 
 	if ((ctx->flags & IORING_SETUP_SQPOLL) &&
 	    wq_has_sleeper(&ctx->sq_data->wait))
author maintainer
#6 lore raw
Quoted 98 lines · Greg Thelen
Quoted 96 lines · Jens Axboe
Quoted 95 lines · Jens Axboe
Quoted 93 lines · Greg Thelen
Quoted 49 lines · Greg Kroah-Hartman

I'm announcing the release of the 5.10.125 kernel.

All users of the 5.10 kernel series must upgrade.

The updated 5.10.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary

thanks,

greg k-h

------------

 Makefile                              |    2 
 arch/arm64/mm/cache.S                 |    2 
 arch/s390/mm/pgtable.c                |    2 
 drivers/tty/serial/serial_core.c      |   34 ++++--------
 drivers/usb/gadget/function/u_ether.c |   11 +++-
 fs/io_uring.c                         |   23 +++++---
 fs/zonefs/super.c                     |   92 ++++++++++++++++++++++------------
 net/ipv4/inet_hashtables.c            |   31 ++++++++---
 8 files changed, 122 insertions(+), 75 deletions(-)

Christian Borntraeger (1):
s390/mm: use non-quiescing sske for KVM switch to keyed guest

Damien Le Moal (1):
zonefs: fix zonefs_iomap_begin() for reads

Eric Dumazet (1):
tcp: add some entropy in __inet_hash_connect()

Greg Kroah-Hartman (1):

      Linux 5.10.125

Jens Axboe (1):
io_uring: add missing item types for various requests

Lukas Wunner (1):
serial: core: Initialize rs485 RTS polarity already on probe

Marian Postevca (1):
usb: gadget: u_ether: fix regression in setting fixed MAC address

Will Deacon (1):
arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer

Quoted 6 lines

Willy Tarreau (5):
tcp: use different parts of the port_offset for index and offset
tcp: add small random increments to the source port
tcp: dynamically allocate the perturb table used by source ports
tcp: increase source port perturb table to 2^16
tcp: drop the hash_32() part from the index calculation

5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).

Here's a manually annotated panic message:

[  359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
[  359.055393] kernel BUG at lib/list_debug.c:47!
[  359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
[  359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S        I       5.10.124 #1
[  359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
[  359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
[  359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
[  359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
[  359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
[  359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
[  359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
[  359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
[  359.145836] FS:  00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
[  359.153830] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
[  359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  359.180647] Call Trace:
[  359.183064]  io_dismantle_req+0x1da/0x2b0
                    __list_del_entry [include/linux/list.h:132]
                    list_del [include/linux/list.h:146]
                    io_req_drop_files [fs/io_uring.c:5934]
                    io_req_clean_work [fs/io_uring.c:1315]
                    io_dismantle_req [fs/io_uring.c:1911]
[  359.187023]  io_do_iopoll+0x4e5/0x790
[  359.194602]  __se_sys_io_uring_enter+0x39b/0x6f0
[  359.208318]  __x64_sys_io_uring_enter+0x29/0x30
[  359.212793]  do_syscall_64+0x31/0x40
[  359.216324]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
Quoted 8 lines
Quoted 8 lines
Quoted 2 lines

Well that sucks, I wonder why mine didn't fail like that. I'll see if I can hit this and send a fix. Thanks for reporting!

Below should do it, I apologize for that. I think my test box booted the previous kernel which is why it didn't hit it in my regression tests :-(

Greg, can you add this to 5.10-stable? Verified it ran tests with the right kernel now...

Great, I'll go just do a release with this in it right now to help others out.

greg k-h

author maintainer
#7 lore raw
Quoted 102 lines · Greg Kroah-Hartman
Quoted 101 lines · Greg Thelen
Quoted 99 lines · Jens Axboe
Quoted 97 lines · Jens Axboe
Quoted 85 lines · Greg Thelen
Quoted 49 lines · Greg Kroah-Hartman

I'm announcing the release of the 5.10.125 kernel.

All users of the 5.10 kernel series must upgrade.

The updated 5.10.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary

thanks,

greg k-h

------------

 Makefile                              |    2 
 arch/arm64/mm/cache.S                 |    2 
 arch/s390/mm/pgtable.c                |    2 
 drivers/tty/serial/serial_core.c      |   34 ++++--------
 drivers/usb/gadget/function/u_ether.c |   11 +++-
 fs/io_uring.c                         |   23 +++++---
 fs/zonefs/super.c                     |   92 ++++++++++++++++++++++------------
 net/ipv4/inet_hashtables.c            |   31 ++++++++---
 8 files changed, 122 insertions(+), 75 deletions(-)

Christian Borntraeger (1):
s390/mm: use non-quiescing sske for KVM switch to keyed guest

Damien Le Moal (1):
zonefs: fix zonefs_iomap_begin() for reads

Eric Dumazet (1):
tcp: add some entropy in __inet_hash_connect()

Greg Kroah-Hartman (1):

      Linux 5.10.125

Jens Axboe (1):
io_uring: add missing item types for various requests

Lukas Wunner (1):
serial: core: Initialize rs485 RTS polarity already on probe

Marian Postevca (1):
usb: gadget: u_ether: fix regression in setting fixed MAC address

Will Deacon (1):
arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer

Quoted 6 lines

Willy Tarreau (5):
tcp: use different parts of the port_offset for index and offset
tcp: add small random increments to the source port
tcp: dynamically allocate the perturb table used by source ports
tcp: increase source port perturb table to 2^16
tcp: drop the hash_32() part from the index calculation

5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).

Here's a manually annotated panic message:

[  359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
[  359.055393] kernel BUG at lib/list_debug.c:47!
[  359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
[  359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S        I       5.10.124 #1
[  359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
[  359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
[  359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
[  359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
[  359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
[  359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
[  359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
[  359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
[  359.145836] FS:  00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
[  359.153830] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
[  359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  359.180647] Call Trace:
[  359.183064]  io_dismantle_req+0x1da/0x2b0
                    __list_del_entry [include/linux/list.h:132]
                    list_del [include/linux/list.h:146]
Quoted 8 lines
                    io_req_drop_files [fs/io_uring.c:5934]
                    io_req_clean_work [fs/io_uring.c:1315]
                    io_dismantle_req [fs/io_uring.c:1911]
[  359.187023]  io_do_iopoll+0x4e5/0x790
[  359.194602]  __se_sys_io_uring_enter+0x39b/0x6f0
[  359.208318]  __x64_sys_io_uring_enter+0x29/0x30
[  359.212793]  do_syscall_64+0x31/0x40
[  359.216324]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Well that sucks, I wonder why mine didn't fail like that. I'll see if I can hit this and send a fix. Thanks for reporting!

Quoted 8 lines
Quoted 5 lines
Quoted 5 lines

Below should do it, I apologize for that. I think my test box booted the previous kernel which is why it didn't hit it in my regression tests :-(

Greg, can you add this to 5.10-stable? Verified it ran tests with the right kernel now...

Great, I'll go just do a release with this in it right now to help others out.

5.10.126 is now released with this fix.

#8 lore raw
Quoted 106 lines · Greg Kroah-Hartman
Quoted 105 lines · Greg Kroah-Hartman
Quoted 104 lines · Greg Thelen
Quoted 102 lines · Jens Axboe
Quoted 95 lines · Jens Axboe
Quoted 85 lines · Greg Thelen
Quoted 49 lines · Greg Kroah-Hartman

I'm announcing the release of the 5.10.125 kernel.

All users of the 5.10 kernel series must upgrade.

The updated 5.10.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary

thanks,

greg k-h

------------

 Makefile                              |    2 
 arch/arm64/mm/cache.S                 |    2 
 arch/s390/mm/pgtable.c                |    2 
 drivers/tty/serial/serial_core.c      |   34 ++++--------
 drivers/usb/gadget/function/u_ether.c |   11 +++-
 fs/io_uring.c                         |   23 +++++---
 fs/zonefs/super.c                     |   92 ++++++++++++++++++++++------------
 net/ipv4/inet_hashtables.c            |   31 ++++++++---
 8 files changed, 122 insertions(+), 75 deletions(-)

Christian Borntraeger (1):
s390/mm: use non-quiescing sske for KVM switch to keyed guest

Damien Le Moal (1):
zonefs: fix zonefs_iomap_begin() for reads

Eric Dumazet (1):
tcp: add some entropy in __inet_hash_connect()

Greg Kroah-Hartman (1):

      Linux 5.10.125

Jens Axboe (1):
io_uring: add missing item types for various requests

Lukas Wunner (1):
serial: core: Initialize rs485 RTS polarity already on probe

Marian Postevca (1):
usb: gadget: u_ether: fix regression in setting fixed MAC address

Will Deacon (1):
arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer

Quoted 6 lines

Willy Tarreau (5):
tcp: use different parts of the port_offset for index and offset
tcp: add small random increments to the source port
tcp: dynamically allocate the perturb table used by source ports
tcp: increase source port perturb table to 2^16
tcp: drop the hash_32() part from the index calculation

5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add missing item types for various requests") causes panic when running test/iopoll.t from https://github.com/axboe/liburing commit dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).

Here's a manually annotated panic message:

[  359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
[  359.055393] kernel BUG at lib/list_debug.c:47!
[  359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
[  359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S        I       5.10.124 #1
[  359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
[  359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
[  359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
[  359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
[  359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
[  359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
[  359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
[  359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
[  359.145836] FS:  00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
[  359.153830] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
[  359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  359.180647] Call Trace:
[  359.183064]  io_dismantle_req+0x1da/0x2b0
                    __list_del_entry [include/linux/list.h:132]
                    list_del [include/linux/list.h:146]
Quoted 8 lines
                    io_req_drop_files [fs/io_uring.c:5934]
                    io_req_clean_work [fs/io_uring.c:1315]
                    io_dismantle_req [fs/io_uring.c:1911]
[  359.187023]  io_do_iopoll+0x4e5/0x790
[  359.194602]  __se_sys_io_uring_enter+0x39b/0x6f0
[  359.208318]  __x64_sys_io_uring_enter+0x29/0x30
[  359.212793]  do_syscall_64+0x31/0x40
[  359.216324]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
Quoted 2 lines

Well that sucks, I wonder why mine didn't fail like that. I'll see if I can hit this and send a fix. Thanks for reporting!

Below should do it, I apologize for that. I think my test box booted the previous kernel which is why it didn't hit it in my regression tests :-(

Quoted 7 lines
Quoted 5 lines
Quoted 2 lines
Quoted 2 lines

Greg, can you add this to 5.10-stable? Verified it ran tests with the right kernel now...

Great, I'll go just do a release with this in it right now to help others out.

5.10.126 is now released with this fix.

Thanks - to both Gregs!

Signature · 1 line
Jens Axboe