2022-06-25 13:57:56

by Greg Kroah-Hartman

Subject: Linux 5.10.125

I'm announcing the release of the 5.10.125 kernel.

All users of the 5.10 kernel series must upgrade.

The updated 5.10.y git tree can be found at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
and can be browsed at the normal kernel.org git web browser:
https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary

thanks,

greg k-h

------------

Makefile | 2
arch/arm64/mm/cache.S | 2
arch/s390/mm/pgtable.c | 2
drivers/tty/serial/serial_core.c | 34 ++++--------
drivers/usb/gadget/function/u_ether.c | 11 +++-
fs/io_uring.c | 23 +++++---
fs/zonefs/super.c | 92 ++++++++++++++++++++++------------
net/ipv4/inet_hashtables.c | 31 ++++++++---
8 files changed, 122 insertions(+), 75 deletions(-)

Christian Borntraeger (1):
s390/mm: use non-quiescing sske for KVM switch to keyed guest

Damien Le Moal (1):
zonefs: fix zonefs_iomap_begin() for reads

Eric Dumazet (1):
tcp: add some entropy in __inet_hash_connect()

Greg Kroah-Hartman (1):
Linux 5.10.125

Jens Axboe (1):
io_uring: add missing item types for various requests

Lukas Wunner (1):
serial: core: Initialize rs485 RTS polarity already on probe

Marian Postevca (1):
usb: gadget: u_ether: fix regression in setting fixed MAC address

Will Deacon (1):
arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer

Willy Tarreau (5):
tcp: use different parts of the port_offset for index and offset
tcp: add small random increments to the source port
tcp: dynamically allocate the perturb table used by source ports
tcp: increase source port perturb table to 2^16
tcp: drop the hash_32() part from the index calculation

2022-06-25 13:57:58

by Greg Kroah-Hartman

Subject: Re: Linux 5.10.125

diff --git a/Makefile b/Makefile
index 9ed79a05a972..da5b28931e5c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0
VERSION = 5
PATCHLEVEL = 10
-SUBLEVEL = 124
+SUBLEVEL = 125
EXTRAVERSION =
NAME = Dare mighty things

diff --git a/arch/arm64/mm/cache.S b/arch/arm64/mm/cache.S
index 2d881f34dd9d..7b8158ae36ec 100644
--- a/arch/arm64/mm/cache.S
+++ b/arch/arm64/mm/cache.S
@@ -228,8 +228,6 @@ SYM_FUNC_END_PI(__dma_flush_area)
* - dir - DMA direction
*/
SYM_FUNC_START_PI(__dma_map_area)
- cmp w2, #DMA_FROM_DEVICE
- b.eq __dma_inv_area
b __dma_clean_area
SYM_FUNC_END_PI(__dma_map_area)

diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index fabaedddc90c..1c05caf68e7d 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -734,7 +734,7 @@ void ptep_zap_key(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
pgste_val(pgste) |= PGSTE_GR_BIT | PGSTE_GC_BIT;
ptev = pte_val(*ptep);
if (!(ptev & _PAGE_INVALID) && (ptev & _PAGE_WRITE))
- page_set_storage_key(ptev & PAGE_MASK, PAGE_DEFAULT_KEY, 1);
+ page_set_storage_key(ptev & PAGE_MASK, PAGE_DEFAULT_KEY, 0);
pgste_set_unlock(ptep, pgste);
preempt_enable();
}
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 19f0c5db11e3..32d09d024f6c 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -144,6 +144,11 @@ uart_update_mctrl(struct uart_port *port, unsigned int set, unsigned int clear)
unsigned long flags;
unsigned int old;

+ if (port->rs485.flags & SER_RS485_ENABLED) {
+ set &= ~TIOCM_RTS;
+ clear &= ~TIOCM_RTS;
+ }
+
spin_lock_irqsave(&port->lock, flags);
old = port->mctrl;
port->mctrl = (old & ~clear) | set;
@@ -157,23 +162,10 @@ uart_update_mctrl(struct uart_port *port, unsigned int set, unsigned int clear)

static void uart_port_dtr_rts(struct uart_port *uport, int raise)
{
- int rs485_on = uport->rs485_config &&
- (uport->rs485.flags & SER_RS485_ENABLED);
- int RTS_after_send = !!(uport->rs485.flags & SER_RS485_RTS_AFTER_SEND);
-
- if (raise) {
- if (rs485_on && RTS_after_send) {
- uart_set_mctrl(uport, TIOCM_DTR);
- uart_clear_mctrl(uport, TIOCM_RTS);
- } else {
- uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
- }
- } else {
- unsigned int clear = TIOCM_DTR;
-
- clear |= (!rs485_on || RTS_after_send) ? TIOCM_RTS : 0;
- uart_clear_mctrl(uport, clear);
- }
+ if (raise)
+ uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
+ else
+ uart_clear_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
}

/*
@@ -1116,11 +1108,6 @@ uart_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear)
goto out;

if (!tty_io_error(tty)) {
- if (uport->rs485.flags & SER_RS485_ENABLED) {
- set &= ~TIOCM_RTS;
- clear &= ~TIOCM_RTS;
- }
-
uart_update_mctrl(uport, set, clear);
ret = 0;
}
@@ -2429,6 +2416,9 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state,
*/
spin_lock_irqsave(&port->lock, flags);
port->mctrl &= TIOCM_DTR;
+ if (port->rs485.flags & SER_RS485_ENABLED &&
+ !(port->rs485.flags & SER_RS485_RTS_AFTER_SEND))
+ port->mctrl |= TIOCM_RTS;
port->ops->set_mctrl(port, port->mctrl);
spin_unlock_irqrestore(&port->lock, flags);

diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index a40be8b448c2..64ef97ab9274 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -772,9 +772,13 @@ struct eth_dev *gether_setup_name(struct usb_gadget *g,
dev->qmult = qmult;
snprintf(net->name, sizeof(net->name), "%s%%d", netname);

- if (get_ether_addr(dev_addr, net->dev_addr))
+ if (get_ether_addr(dev_addr, net->dev_addr)) {
+ net->addr_assign_type = NET_ADDR_RANDOM;
dev_warn(&g->dev,
"using random %s ethernet address\n", "self");
+ } else {
+ net->addr_assign_type = NET_ADDR_SET;
+ }
if (get_ether_addr(host_addr, dev->host_mac))
dev_warn(&g->dev,
"using random %s ethernet address\n", "host");
@@ -831,6 +835,9 @@ struct net_device *gether_setup_name_default(const char *netname)
INIT_LIST_HEAD(&dev->tx_reqs);
INIT_LIST_HEAD(&dev->rx_reqs);

+ /* by default we always have a random MAC address */
+ net->addr_assign_type = NET_ADDR_RANDOM;
+
skb_queue_head_init(&dev->rx_frames);

/* network device setup */
@@ -868,7 +875,6 @@ int gether_register_netdev(struct net_device *net)
g = dev->gadget;

memcpy(net->dev_addr, dev->dev_mac, ETH_ALEN);
- net->addr_assign_type = NET_ADDR_RANDOM;

status = register_netdev(net);
if (status < 0) {
@@ -908,6 +914,7 @@ int gether_set_dev_addr(struct net_device *net, const char *dev_addr)
if (get_ether_addr(dev_addr, new_addr))
return -EINVAL;
memcpy(dev->dev_mac, new_addr, ETH_ALEN);
+ net->addr_assign_type = NET_ADDR_SET;
return 0;
}
EXPORT_SYMBOL_GPL(gether_set_dev_addr);
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 871475d3fca2..40ac37beca47 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -773,7 +773,8 @@ static const struct io_op_def io_op_defs[] = {
.buffer_select = 1,
.needs_async_data = 1,
.async_size = sizeof(struct io_async_rw),
- .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG,
+ .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
+ IO_WQ_WORK_FILES,
},
[IORING_OP_WRITEV] = {
.needs_file = 1,
@@ -783,7 +784,7 @@ static const struct io_op_def io_op_defs[] = {
.needs_async_data = 1,
.async_size = sizeof(struct io_async_rw),
.work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
- IO_WQ_WORK_FSIZE,
+ IO_WQ_WORK_FSIZE | IO_WQ_WORK_FILES,
},
[IORING_OP_FSYNC] = {
.needs_file = 1,
@@ -794,7 +795,8 @@ static const struct io_op_def io_op_defs[] = {
.unbound_nonreg_file = 1,
.pollin = 1,
.async_size = sizeof(struct io_async_rw),
- .work_flags = IO_WQ_WORK_BLKCG | IO_WQ_WORK_MM,
+ .work_flags = IO_WQ_WORK_BLKCG | IO_WQ_WORK_MM |
+ IO_WQ_WORK_FILES,
},
[IORING_OP_WRITE_FIXED] = {
.needs_file = 1,
@@ -803,7 +805,7 @@ static const struct io_op_def io_op_defs[] = {
.pollout = 1,
.async_size = sizeof(struct io_async_rw),
.work_flags = IO_WQ_WORK_BLKCG | IO_WQ_WORK_FSIZE |
- IO_WQ_WORK_MM,
+ IO_WQ_WORK_MM | IO_WQ_WORK_FILES,
},
[IORING_OP_POLL_ADD] = {
.needs_file = 1,
@@ -857,7 +859,7 @@ static const struct io_op_def io_op_defs[] = {
.pollout = 1,
.needs_async_data = 1,
.async_size = sizeof(struct io_async_connect),
- .work_flags = IO_WQ_WORK_MM,
+ .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_FS,
},
[IORING_OP_FALLOCATE] = {
.needs_file = 1,
@@ -885,7 +887,8 @@ static const struct io_op_def io_op_defs[] = {
.pollin = 1,
.buffer_select = 1,
.async_size = sizeof(struct io_async_rw),
- .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG,
+ .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
+ IO_WQ_WORK_FILES,
},
[IORING_OP_WRITE] = {
.needs_file = 1,
@@ -894,7 +897,7 @@ static const struct io_op_def io_op_defs[] = {
.pollout = 1,
.async_size = sizeof(struct io_async_rw),
.work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
- IO_WQ_WORK_FSIZE,
+ IO_WQ_WORK_FSIZE | IO_WQ_WORK_FILES,
},
[IORING_OP_FADVISE] = {
.needs_file = 1,
@@ -907,14 +910,16 @@ static const struct io_op_def io_op_defs[] = {
.needs_file = 1,
.unbound_nonreg_file = 1,
.pollout = 1,
- .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG,
+ .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
+ IO_WQ_WORK_FS,
},
[IORING_OP_RECV] = {
.needs_file = 1,
.unbound_nonreg_file = 1,
.pollin = 1,
.buffer_select = 1,
- .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG,
+ .work_flags = IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
+ IO_WQ_WORK_FS,
},
[IORING_OP_OPENAT2] = {
.work_flags = IO_WQ_WORK_FILES | IO_WQ_WORK_FS |
diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c
index 8c7d01e907a3..bf5cb6efb8c0 100644
--- a/fs/zonefs/super.c
+++ b/fs/zonefs/super.c
@@ -68,15 +68,49 @@ static inline void zonefs_i_size_write(struct inode *inode, loff_t isize)
zi->i_flags &= ~ZONEFS_ZONE_OPEN;
}

-static int zonefs_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
- unsigned int flags, struct iomap *iomap,
- struct iomap *srcmap)
+static int zonefs_read_iomap_begin(struct inode *inode, loff_t offset,
+ loff_t length, unsigned int flags,
+ struct iomap *iomap, struct iomap *srcmap)
{
struct zonefs_inode_info *zi = ZONEFS_I(inode);
struct super_block *sb = inode->i_sb;
loff_t isize;

- /* All I/Os should always be within the file maximum size */
+ /*
+ * All blocks are always mapped below EOF. If reading past EOF,
+ * act as if there is a hole up to the file maximum size.
+ */
+ mutex_lock(&zi->i_truncate_mutex);
+ iomap->bdev = inode->i_sb->s_bdev;
+ iomap->offset = ALIGN_DOWN(offset, sb->s_blocksize);
+ isize = i_size_read(inode);
+ if (iomap->offset >= isize) {
+ iomap->type = IOMAP_HOLE;
+ iomap->addr = IOMAP_NULL_ADDR;
+ iomap->length = length;
+ } else {
+ iomap->type = IOMAP_MAPPED;
+ iomap->addr = (zi->i_zsector << SECTOR_SHIFT) + iomap->offset;
+ iomap->length = isize - iomap->offset;
+ }
+ mutex_unlock(&zi->i_truncate_mutex);
+
+ return 0;
+}
+
+static const struct iomap_ops zonefs_read_iomap_ops = {
+ .iomap_begin = zonefs_read_iomap_begin,
+};
+
+static int zonefs_write_iomap_begin(struct inode *inode, loff_t offset,
+ loff_t length, unsigned int flags,
+ struct iomap *iomap, struct iomap *srcmap)
+{
+ struct zonefs_inode_info *zi = ZONEFS_I(inode);
+ struct super_block *sb = inode->i_sb;
+ loff_t isize;
+
+ /* All write I/Os should always be within the file maximum size */
if (WARN_ON_ONCE(offset + length > zi->i_max_size))
return -EIO;

@@ -86,7 +120,7 @@ static int zonefs_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
* operation.
*/
if (WARN_ON_ONCE(zi->i_ztype == ZONEFS_ZTYPE_SEQ &&
- (flags & IOMAP_WRITE) && !(flags & IOMAP_DIRECT)))
+ !(flags & IOMAP_DIRECT)))
return -EIO;

/*
@@ -95,45 +129,42 @@ static int zonefs_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
* write pointer) and unwriten beyond.
*/
mutex_lock(&zi->i_truncate_mutex);
+ iomap->bdev = inode->i_sb->s_bdev;
+ iomap->offset = ALIGN_DOWN(offset, sb->s_blocksize);
+ iomap->addr = (zi->i_zsector << SECTOR_SHIFT) + iomap->offset;
isize = i_size_read(inode);
- if (offset >= isize)
+ if (iomap->offset >= isize) {
iomap->type = IOMAP_UNWRITTEN;
- else
+ iomap->length = zi->i_max_size - iomap->offset;
+ } else {
iomap->type = IOMAP_MAPPED;
- if (flags & IOMAP_WRITE)
- length = zi->i_max_size - offset;
- else
- length = min(length, isize - offset);
+ iomap->length = isize - iomap->offset;
+ }
mutex_unlock(&zi->i_truncate_mutex);

- iomap->offset = ALIGN_DOWN(offset, sb->s_blocksize);
- iomap->length = ALIGN(offset + length, sb->s_blocksize) - iomap->offset;
- iomap->bdev = inode->i_sb->s_bdev;
- iomap->addr = (zi->i_zsector << SECTOR_SHIFT) + iomap->offset;
-
return 0;
}

-static const struct iomap_ops zonefs_iomap_ops = {
- .iomap_begin = zonefs_iomap_begin,
+static const struct iomap_ops zonefs_write_iomap_ops = {
+ .iomap_begin = zonefs_write_iomap_begin,
};

static int zonefs_readpage(struct file *unused, struct page *page)
{
- return iomap_readpage(page, &zonefs_iomap_ops);
+ return iomap_readpage(page, &zonefs_read_iomap_ops);
}

static void zonefs_readahead(struct readahead_control *rac)
{
- iomap_readahead(rac, &zonefs_iomap_ops);
+ iomap_readahead(rac, &zonefs_read_iomap_ops);
}

/*
* Map blocks for page writeback. This is used only on conventional zone files,
* which implies that the page range can only be within the fixed inode size.
*/
-static int zonefs_map_blocks(struct iomap_writepage_ctx *wpc,
- struct inode *inode, loff_t offset)
+static int zonefs_write_map_blocks(struct iomap_writepage_ctx *wpc,
+ struct inode *inode, loff_t offset)
{
struct zonefs_inode_info *zi = ZONEFS_I(inode);

@@ -147,12 +178,12 @@ static int zonefs_map_blocks(struct iomap_writepage_ctx *wpc,
offset < wpc->iomap.offset + wpc->iomap.length)
return 0;

- return zonefs_iomap_begin(inode, offset, zi->i_max_size - offset,
- IOMAP_WRITE, &wpc->iomap, NULL);
+ return zonefs_write_iomap_begin(inode, offset, zi->i_max_size - offset,
+ IOMAP_WRITE, &wpc->iomap, NULL);
}

static const struct iomap_writeback_ops zonefs_writeback_ops = {
- .map_blocks = zonefs_map_blocks,
+ .map_blocks = zonefs_write_map_blocks,
};

static int zonefs_writepage(struct page *page, struct writeback_control *wbc)
@@ -182,7 +213,8 @@ static int zonefs_swap_activate(struct swap_info_struct *sis,
return -EINVAL;
}

- return iomap_swapfile_activate(sis, swap_file, span, &zonefs_iomap_ops);
+ return iomap_swapfile_activate(sis, swap_file, span,
+ &zonefs_read_iomap_ops);
}

static const struct address_space_operations zonefs_file_aops = {
@@ -612,7 +644,7 @@ static vm_fault_t zonefs_filemap_page_mkwrite(struct vm_fault *vmf)

/* Serialize against truncates */
down_read(&zi->i_mmap_sem);
- ret = iomap_page_mkwrite(vmf, &zonefs_iomap_ops);
+ ret = iomap_page_mkwrite(vmf, &zonefs_write_iomap_ops);
up_read(&zi->i_mmap_sem);

sb_end_pagefault(inode->i_sb);
@@ -869,7 +901,7 @@ static ssize_t zonefs_file_dio_write(struct kiocb *iocb, struct iov_iter *from)
if (append)
ret = zonefs_file_dio_append(iocb, from);
else
- ret = iomap_dio_rw(iocb, from, &zonefs_iomap_ops,
+ ret = iomap_dio_rw(iocb, from, &zonefs_write_iomap_ops,
&zonefs_write_dio_ops, sync);
if (zi->i_ztype == ZONEFS_ZTYPE_SEQ &&
(ret > 0 || ret == -EIOCBQUEUED)) {
@@ -911,7 +943,7 @@ static ssize_t zonefs_file_buffered_write(struct kiocb *iocb,
if (ret <= 0)
goto inode_unlock;

- ret = iomap_file_buffered_write(iocb, from, &zonefs_iomap_ops);
+ ret = iomap_file_buffered_write(iocb, from, &zonefs_write_iomap_ops);
if (ret > 0)
iocb->ki_pos += ret;
else if (ret == -EIO)
@@ -1004,7 +1036,7 @@ static ssize_t zonefs_file_read_iter(struct kiocb *iocb, struct iov_iter *to)
goto inode_unlock;
}
file_accessed(iocb->ki_filp);
- ret = iomap_dio_rw(iocb, to, &zonefs_iomap_ops,
+ ret = iomap_dio_rw(iocb, to, &zonefs_read_iomap_ops,
&zonefs_read_dio_ops, is_sync_kiocb(iocb));
} else {
ret = generic_file_read_iter(iocb, to);
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 44b524136f95..f38b71cc3edb 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -726,12 +726,14 @@ EXPORT_SYMBOL_GPL(inet_unhash);
* Note that we use 32bit integers (vs RFC 'short integers')
* because 2^16 is not a multiple of num_ephemeral and this
* property might be used by clever attacker.
- * RFC claims using TABLE_LENGTH=10 buckets gives an improvement,
- * we use 256 instead to really give more isolation and
- * privacy, this only consumes 1 KB of kernel memory.
+ * RFC claims using TABLE_LENGTH=10 buckets gives an improvement, though
+ * attacks were since demonstrated, thus we use 65536 instead to really
+ * give more isolation and privacy, at the expense of 256kB of kernel
+ * memory.
*/
-#define INET_TABLE_PERTURB_SHIFT 8
-static u32 table_perturb[1 << INET_TABLE_PERTURB_SHIFT];
+#define INET_TABLE_PERTURB_SHIFT 16
+#define INET_TABLE_PERTURB_SIZE (1 << INET_TABLE_PERTURB_SHIFT)
+static u32 *table_perturb;

int __inet_hash_connect(struct inet_timewait_death_row *death_row,
struct sock *sk, u64 port_offset,
@@ -774,10 +776,11 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
if (likely(remaining > 1))
remaining &= ~1U;

- net_get_random_once(table_perturb, sizeof(table_perturb));
- index = hash_32(port_offset, INET_TABLE_PERTURB_SHIFT);
+ net_get_random_once(table_perturb,
+ INET_TABLE_PERTURB_SIZE * sizeof(*table_perturb));
+ index = port_offset & (INET_TABLE_PERTURB_SIZE - 1);

- offset = READ_ONCE(table_perturb[index]) + port_offset;
+ offset = READ_ONCE(table_perturb[index]) + (port_offset >> 32);
offset %= remaining;

/* In first pass we try ports of @low parity.
@@ -833,6 +836,12 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
return -EADDRNOTAVAIL;

ok:
+ /* Here we want to add a little bit of randomness to the next source
+ * port that will be chosen. We use a max() with a random here so that
+ * on low contention the randomness is maximal and on high contention
+ * it may be inexistent.
+ */
+ i = max_t(int, i, (prandom_u32() & 7) * 2);
WRITE_ONCE(table_perturb[index], READ_ONCE(table_perturb[index]) + i + 2);

/* Head lock still held and bh's disabled */
@@ -906,6 +915,12 @@ void __init inet_hashinfo2_init(struct inet_hashinfo *h, const char *name,
low_limit,
high_limit);
init_hashinfo_lhash2(h);
+
+ /* this one is used for source ports of outgoing connections */
+ table_perturb = kmalloc_array(INET_TABLE_PERTURB_SIZE,
+ sizeof(*table_perturb), GFP_KERNEL);
+ if (!table_perturb)
+ panic("TCP: failed to alloc table_perturb");
}

int inet_hashinfo2_init_mod(struct inet_hashinfo *h)

2022-06-26 23:17:18

by Greg Thelen

Subject: Re: Linux 5.10.125

Greg Kroah-Hartman <[email protected]> wrote:

> I'm announcing the release of the 5.10.125 kernel.
>
> All users of the 5.10 kernel series must upgrade.
>
> The updated 5.10.y git tree can be found at:
> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
> and can be browsed at the normal kernel.org git web browser:
> https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
>
> thanks,
>
> greg k-h
>
> ------------
>
> Makefile | 2
> arch/arm64/mm/cache.S | 2
> arch/s390/mm/pgtable.c | 2
> drivers/tty/serial/serial_core.c | 34 ++++--------
> drivers/usb/gadget/function/u_ether.c | 11 +++-
> fs/io_uring.c | 23 +++++---
> fs/zonefs/super.c | 92 ++++++++++++++++++++++------------
> net/ipv4/inet_hashtables.c | 31 ++++++++---
> 8 files changed, 122 insertions(+), 75 deletions(-)
>
> Christian Borntraeger (1):
> s390/mm: use non-quiescing sske for KVM switch to keyed guest
>
> Damien Le Moal (1):
> zonefs: fix zonefs_iomap_begin() for reads
>
> Eric Dumazet (1):
> tcp: add some entropy in __inet_hash_connect()
>
> Greg Kroah-Hartman (1):
> Linux 5.10.125
>
> Jens Axboe (1):
> io_uring: add missing item types for various requests
>
> Lukas Wunner (1):
> serial: core: Initialize rs485 RTS polarity already on probe
>
> Marian Postevca (1):
> usb: gadget: u_ether: fix regression in setting fixed MAC address
>
> Will Deacon (1):
> arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
>
> Willy Tarreau (5):
> tcp: use different parts of the port_offset for index and offset
> tcp: add small random increments to the source port
> tcp: dynamically allocate the perturb table used by source ports
> tcp: increase source port perturb table to 2^16
> tcp: drop the hash_32() part from the index calculation

5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add
missing item types for various requests") causes panic when running
test/iopoll.t from https://github.com/axboe/liburing commit
dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).

Here's a manually annotated panic message:
[ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
[ 359.055393] kernel BUG at lib/list_debug.c:47!
[ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
[ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1
[ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
[ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
[ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
[ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
[ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
[ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
[ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
[ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
[ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
[ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
[ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 359.180647] Call Trace:
[ 359.183064] io_dismantle_req+0x1da/0x2b0
__list_del_entry [include/linux/list.h:132]
list_del [include/linux/list.h:146]
io_req_drop_files [fs/io_uring.c:5934]
io_req_clean_work [fs/io_uring.c:1315]
io_dismantle_req [fs/io_uring.c:1911]
[ 359.187023] io_do_iopoll+0x4e5/0x790
[ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0
[ 359.208318] __x64_sys_io_uring_enter+0x29/0x30
[ 359.212793] do_syscall_64+0x31/0x40
[ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9

2022-06-27 00:16:59

by Jens Axboe

Subject: Re: Linux 5.10.125

On 6/26/22 4:56 PM, Greg Thelen wrote:
> Greg Kroah-Hartman <[email protected]> wrote:
>
>> I'm announcing the release of the 5.10.125 kernel.
>>
>> All users of the 5.10 kernel series must upgrade.
>>
>> The updated 5.10.y git tree can be found at:
>> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
>> and can be browsed at the normal kernel.org git web browser:
>> https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
>>
>> thanks,
>>
>> greg k-h
>>
>> ------------
>>
>> Makefile | 2
>> arch/arm64/mm/cache.S | 2
>> arch/s390/mm/pgtable.c | 2
>> drivers/tty/serial/serial_core.c | 34 ++++--------
>> drivers/usb/gadget/function/u_ether.c | 11 +++-
>> fs/io_uring.c | 23 +++++---
>> fs/zonefs/super.c | 92 ++++++++++++++++++++++------------
>> net/ipv4/inet_hashtables.c | 31 ++++++++---
>> 8 files changed, 122 insertions(+), 75 deletions(-)
>>
>> Christian Borntraeger (1):
>> s390/mm: use non-quiescing sske for KVM switch to keyed guest
>>
>> Damien Le Moal (1):
>> zonefs: fix zonefs_iomap_begin() for reads
>>
>> Eric Dumazet (1):
>> tcp: add some entropy in __inet_hash_connect()
>>
>> Greg Kroah-Hartman (1):
>> Linux 5.10.125
>>
>> Jens Axboe (1):
>> io_uring: add missing item types for various requests
>>
>> Lukas Wunner (1):
>> serial: core: Initialize rs485 RTS polarity already on probe
>>
>> Marian Postevca (1):
>> usb: gadget: u_ether: fix regression in setting fixed MAC address
>>
>> Will Deacon (1):
>> arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
>>
>> Willy Tarreau (5):
>> tcp: use different parts of the port_offset for index and offset
>> tcp: add small random increments to the source port
>> tcp: dynamically allocate the perturb table used by source ports
>> tcp: increase source port perturb table to 2^16
>> tcp: drop the hash_32() part from the index calculation
>
> 5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add
> missing item types for various requests") causes panic when running
> test/iopoll.t from https://github.com/axboe/liburing commit
> dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
>
> Here's a manually annotated panic message:
> [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
> [ 359.055393] kernel BUG at lib/list_debug.c:47!
> [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
> [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1
> [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
> [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
> [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
> [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
> [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
> [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
> [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
> [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
> [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
> [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
> [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [ 359.180647] Call Trace:
> [ 359.183064] io_dismantle_req+0x1da/0x2b0
> __list_del_entry [include/linux/list.h:132]
> list_del [include/linux/list.h:146]
> io_req_drop_files [fs/io_uring.c:5934]
> io_req_clean_work [fs/io_uring.c:1315]
> io_dismantle_req [fs/io_uring.c:1911]
> [ 359.187023] io_do_iopoll+0x4e5/0x790
> [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0
> [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30
> [ 359.212793] do_syscall_64+0x31/0x40
> [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9

Well that sucks, I wonder why mine didn't fail like that. I'll see if I
can hit this and send a fix. Thanks for reporting!

--
Jens Axboe

2022-06-27 00:34:20

by Jens Axboe

Subject: Re: Linux 5.10.125

On 6/26/22 6:04 PM, Jens Axboe wrote:
> On 6/26/22 4:56 PM, Greg Thelen wrote:
>> Greg Kroah-Hartman <[email protected]> wrote:
>>
>>> I'm announcing the release of the 5.10.125 kernel.
>>>
>>> All users of the 5.10 kernel series must upgrade.
>>>
>>> The updated 5.10.y git tree can be found at:
>>> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
>>> and can be browsed at the normal kernel.org git web browser:
>>> https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
>>>
>>> thanks,
>>>
>>> greg k-h
>>>
>>> ------------
>>>
>>> Makefile | 2
>>> arch/arm64/mm/cache.S | 2
>>> arch/s390/mm/pgtable.c | 2
>>> drivers/tty/serial/serial_core.c | 34 ++++--------
>>> drivers/usb/gadget/function/u_ether.c | 11 +++-
>>> fs/io_uring.c | 23 +++++---
>>> fs/zonefs/super.c | 92 ++++++++++++++++++++++------------
>>> net/ipv4/inet_hashtables.c | 31 ++++++++---
>>> 8 files changed, 122 insertions(+), 75 deletions(-)
>>>
>>> Christian Borntraeger (1):
>>> s390/mm: use non-quiescing sske for KVM switch to keyed guest
>>>
>>> Damien Le Moal (1):
>>> zonefs: fix zonefs_iomap_begin() for reads
>>>
>>> Eric Dumazet (1):
>>> tcp: add some entropy in __inet_hash_connect()
>>>
>>> Greg Kroah-Hartman (1):
>>> Linux 5.10.125
>>>
>>> Jens Axboe (1):
>>> io_uring: add missing item types for various requests
>>>
>>> Lukas Wunner (1):
>>> serial: core: Initialize rs485 RTS polarity already on probe
>>>
>>> Marian Postevca (1):
>>> usb: gadget: u_ether: fix regression in setting fixed MAC address
>>>
>>> Will Deacon (1):
>>> arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
>>>
>>> Willy Tarreau (5):
>>> tcp: use different parts of the port_offset for index and offset
>>> tcp: add small random increments to the source port
>>> tcp: dynamically allocate the perturb table used by source ports
>>> tcp: increase source port perturb table to 2^16
>>> tcp: drop the hash_32() part from the index calculation
>>
>> 5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add
>> missing item types for various requests") causes panic when running
>> test/iopoll.t from https://github.com/axboe/liburing commit
>> dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
>>
>> Here's a manually annotated panic message:
>> [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
>> [ 359.055393] kernel BUG at lib/list_debug.c:47!
>> [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
>> [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1
>> [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
>> [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
>> [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
>> [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
>> [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
>> [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
>> [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
>> [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
>> [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
>> [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
>> [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>> [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>> [ 359.180647] Call Trace:
>> [ 359.183064] io_dismantle_req+0x1da/0x2b0
>> __list_del_entry [include/linux/list.h:132]
>> list_del [include/linux/list.h:146]
>> io_req_drop_files [fs/io_uring.c:5934]
>> io_req_clean_work [fs/io_uring.c:1315]
>> io_dismantle_req [fs/io_uring.c:1911]
>> [ 359.187023] io_do_iopoll+0x4e5/0x790
>> [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0
>> [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30
>> [ 359.212793] do_syscall_64+0x31/0x40
>> [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>
> Well that sucks, I wonder why mine didn't fail like that. I'll see if I
> can hit this and send a fix. Thanks for reporting!

Below should do it, I apologize for that. I think my test box booted the
previous kernel which is why it didn't hit it in my regression tests :-(

Greg, can you add this to 5.10-stable? Verified it ran tests with the
right kernel now...


commit d2aaf8fdc544a3edf44820a07294d693dedd12e3
Author: Jens Axboe <[email protected]>
Date: Sun Jun 26 18:16:17 2022 -0600

io_uring: use separate list entry for iopoll requests

A previous commit ended up enabling file tracking for iopoll requests,
which conflicts with both of them using the same list entry for tracking.
Add a separate list entry just for iopoll requests, avoid this issue.

No upstream commit exists for this issue.

Reported-by: Greg Thelen <[email protected]>
Fixes: df3f3bb5059d ("io_uring: add missing item types for various requests")
Signed-off-by: Jens Axboe <[email protected]>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 40ac37beca47..2e12dcbc7b0f 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -696,6 +696,8 @@ struct io_kiocb {
*/
struct list_head inflight_entry;

+ struct list_head iopoll_entry;
+
struct percpu_ref *fixed_file_refs;
struct callback_head task_work;
/* for polled requests, i.e. IORING_OP_POLL_ADD and async armed poll */
@@ -2350,8 +2352,8 @@ static void io_iopoll_queue(struct list_head *again)
struct io_kiocb *req;

do {
- req = list_first_entry(again, struct io_kiocb, inflight_entry);
- list_del(&req->inflight_entry);
+ req = list_first_entry(again, struct io_kiocb, iopoll_entry);
+ list_del(&req->iopoll_entry);
__io_complete_rw(req, -EAGAIN, 0, NULL);
} while (!list_empty(again));
}
@@ -2373,14 +2375,14 @@ static void io_iopoll_complete(struct io_ring_ctx *ctx, unsigned int *nr_events,
while (!list_empty(done)) {
int cflags = 0;

- req = list_first_entry(done, struct io_kiocb, inflight_entry);
+ req = list_first_entry(done, struct io_kiocb, iopoll_entry);
if (READ_ONCE(req->result) == -EAGAIN) {
req->result = 0;
req->iopoll_completed = 0;
- list_move_tail(&req->inflight_entry, &again);
+ list_move_tail(&req->iopoll_entry, &again);
continue;
}
- list_del(&req->inflight_entry);
+ list_del(&req->iopoll_entry);

if (req->flags & REQ_F_BUFFER_SELECTED)
cflags = io_put_rw_kbuf(req);
@@ -2416,7 +2418,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
spin = !ctx->poll_multi_file && *nr_events < min;

ret = 0;
- list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, inflight_entry) {
+ list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, iopoll_entry) {
struct kiocb *kiocb = &req->rw.kiocb;

/*
@@ -2425,7 +2427,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
* and complete those lists first, if we have entries there.
*/
if (READ_ONCE(req->iopoll_completed)) {
- list_move_tail(&req->inflight_entry, &done);
+ list_move_tail(&req->iopoll_entry, &done);
continue;
}
if (!list_empty(&done))
@@ -2437,7 +2439,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,

/* iopoll may have completed current req */
if (READ_ONCE(req->iopoll_completed))
- list_move_tail(&req->inflight_entry, &done);
+ list_move_tail(&req->iopoll_entry, &done);

if (ret && spin)
spin = false;
@@ -2670,7 +2672,7 @@ static void io_iopoll_req_issued(struct io_kiocb *req)
struct io_kiocb *list_req;

list_req = list_first_entry(&ctx->iopoll_list, struct io_kiocb,
- inflight_entry);
+ iopoll_entry);
if (list_req->file != req->file)
ctx->poll_multi_file = true;
}
@@ -2680,9 +2682,9 @@ static void io_iopoll_req_issued(struct io_kiocb *req)
* it to the front so we find it first.
*/
if (READ_ONCE(req->iopoll_completed))
- list_add(&req->inflight_entry, &ctx->iopoll_list);
+ list_add(&req->iopoll_entry, &ctx->iopoll_list);
else
- list_add_tail(&req->inflight_entry, &ctx->iopoll_list);
+ list_add_tail(&req->iopoll_entry, &ctx->iopoll_list);

if ((ctx->flags & IORING_SETUP_SQPOLL) &&
wq_has_sleeper(&ctx->sq_data->wait))

--
Jens Axboe

2022-06-27 06:01:04

by Greg Thelen

Subject: Re: Linux 5.10.125

Jens Axboe <[email protected]> wrote:

> On 6/26/22 6:04 PM, Jens Axboe wrote:
>> On 6/26/22 4:56 PM, Greg Thelen wrote:
>>> Greg Kroah-Hartman <[email protected]> wrote:
>>>
>>>> I'm announcing the release of the 5.10.125 kernel.
>>>>
>>>> All users of the 5.10 kernel series must upgrade.
>>>>
>>>> The updated 5.10.y git tree can be found at:
>>>> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
>>>> and can be browsed at the normal kernel.org git web browser:
>>>> https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
>>>>
>>>> thanks,
>>>>
>>>> greg k-h
>>>>
>>>> ------------
>>>>
>>>> Makefile | 2
>>>> arch/arm64/mm/cache.S | 2
>>>> arch/s390/mm/pgtable.c | 2
>>>> drivers/tty/serial/serial_core.c | 34 ++++--------
>>>> drivers/usb/gadget/function/u_ether.c | 11 +++-
>>>> fs/io_uring.c | 23 +++++---
>>>> fs/zonefs/super.c | 92 ++++++++++++++++++++++------------
>>>> net/ipv4/inet_hashtables.c | 31 ++++++++---
>>>> 8 files changed, 122 insertions(+), 75 deletions(-)
>>>>
>>>> Christian Borntraeger (1):
>>>> s390/mm: use non-quiescing sske for KVM switch to keyed guest
>>>>
>>>> Damien Le Moal (1):
>>>> zonefs: fix zonefs_iomap_begin() for reads
>>>>
>>>> Eric Dumazet (1):
>>>> tcp: add some entropy in __inet_hash_connect()
>>>>
>>>> Greg Kroah-Hartman (1):
>>>> Linux 5.10.125
>>>>
>>>> Jens Axboe (1):
>>>> io_uring: add missing item types for various requests
>>>>
>>>> Lukas Wunner (1):
>>>> serial: core: Initialize rs485 RTS polarity already on probe
>>>>
>>>> Marian Postevca (1):
>>>> usb: gadget: u_ether: fix regression in setting fixed MAC address
>>>>
>>>> Will Deacon (1):
>>>> arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
>>>>
>>>> Willy Tarreau (5):
>>>> tcp: use different parts of the port_offset for index and offset
>>>> tcp: add small random increments to the source port
>>>> tcp: dynamically allocate the perturb table used by source ports
>>>> tcp: increase source port perturb table to 2^16
>>>> tcp: drop the hash_32() part from the index calculation
>>>
>>> 5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add
>>> missing item types for various requests") causes panic when running
>>> test/iopoll.t from https://github.com/axboe/liburing commit
>>> dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
>>>
>>> Here's a manually annotated panic message:
>>> [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
>>> [ 359.055393] kernel BUG at lib/list_debug.c:47!
>>> [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
>>> [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1
>>> [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
>>> [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
>>> [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
>>> [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
>>> [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
>>> [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
>>> [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
>>> [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
>>> [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
>>> [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
>>> [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>>> [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>>> [ 359.180647] Call Trace:
>>> [ 359.183064] io_dismantle_req+0x1da/0x2b0
>>> __list_del_entry [include/linux/list.h:132]
>>> list_del [include/linux/list.h:146]
>>> io_req_drop_files [fs/io_uring.c:5934]
>>> io_req_clean_work [fs/io_uring.c:1315]
>>> io_dismantle_req [fs/io_uring.c:1911]
>>> [ 359.187023] io_do_iopoll+0x4e5/0x790
>>> [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0
>>> [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30
>>> [ 359.212793] do_syscall_64+0x31/0x40
>>> [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>>
>> Well that sucks, I wonder why mine didn't fail like that. I'll see if I
>> can hit this and send a fix. Thanks for reporting!
>
> Below should do it, I apologize for that. I think my test box booted the
> previous kernel which is why it didn't hit it in my regression tests :-(
>
> Greg, can you add this to 5.10-stable? Verified it ran tests with the
> right kernel now...
>
>
> commit d2aaf8fdc544a3edf44820a07294d693dedd12e3
> Author: Jens Axboe <[email protected]>
> Date: Sun Jun 26 18:16:17 2022 -0600
>
> io_uring: use separate list entry for iopoll requests
>
> A previous commit ended up enabling file tracking for iopoll requests,
> which conflicts with both of them using the same list entry for tracking.
> Add a separate list entry just for iopoll requests, avoid this issue.
>
> No upstream commit exists for this issue.
>
> Reported-by: Greg Thelen <[email protected]>
> Fixes: df3f3bb5059d ("io_uring: add missing item types for various requests")
> Signed-off-by: Jens Axboe <[email protected]>

Confirmed. This patch fixes the error I saw.

Tested-by: Greg Thelen <[email protected]>

> diff --git a/fs/io_uring.c b/fs/io_uring.c
> index 40ac37beca47..2e12dcbc7b0f 100644
> --- a/fs/io_uring.c
> +++ b/fs/io_uring.c
> @@ -696,6 +696,8 @@ struct io_kiocb {
> */
> struct list_head inflight_entry;
>
> + struct list_head iopoll_entry;
> +
> struct percpu_ref *fixed_file_refs;
> struct callback_head task_work;
> /* for polled requests, i.e. IORING_OP_POLL_ADD and async armed poll */
> @@ -2350,8 +2352,8 @@ static void io_iopoll_queue(struct list_head *again)
> struct io_kiocb *req;
>
> do {
> - req = list_first_entry(again, struct io_kiocb, inflight_entry);
> - list_del(&req->inflight_entry);
> + req = list_first_entry(again, struct io_kiocb, iopoll_entry);
> + list_del(&req->iopoll_entry);
> __io_complete_rw(req, -EAGAIN, 0, NULL);
> } while (!list_empty(again));
> }
> @@ -2373,14 +2375,14 @@ static void io_iopoll_complete(struct io_ring_ctx *ctx, unsigned int *nr_events,
> while (!list_empty(done)) {
> int cflags = 0;
>
> - req = list_first_entry(done, struct io_kiocb, inflight_entry);
> + req = list_first_entry(done, struct io_kiocb, iopoll_entry);
> if (READ_ONCE(req->result) == -EAGAIN) {
> req->result = 0;
> req->iopoll_completed = 0;
> - list_move_tail(&req->inflight_entry, &again);
> + list_move_tail(&req->iopoll_entry, &again);
> continue;
> }
> - list_del(&req->inflight_entry);
> + list_del(&req->iopoll_entry);
>
> if (req->flags & REQ_F_BUFFER_SELECTED)
> cflags = io_put_rw_kbuf(req);
> @@ -2416,7 +2418,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
> spin = !ctx->poll_multi_file && *nr_events < min;
>
> ret = 0;
> - list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, inflight_entry) {
> + list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, iopoll_entry) {
> struct kiocb *kiocb = &req->rw.kiocb;
>
> /*
> @@ -2425,7 +2427,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
> * and complete those lists first, if we have entries there.
> */
> if (READ_ONCE(req->iopoll_completed)) {
> - list_move_tail(&req->inflight_entry, &done);
> + list_move_tail(&req->iopoll_entry, &done);
> continue;
> }
> if (!list_empty(&done))
> @@ -2437,7 +2439,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
>
> /* iopoll may have completed current req */
> if (READ_ONCE(req->iopoll_completed))
> - list_move_tail(&req->inflight_entry, &done);
> + list_move_tail(&req->iopoll_entry, &done);
>
> if (ret && spin)
> spin = false;
> @@ -2670,7 +2672,7 @@ static void io_iopoll_req_issued(struct io_kiocb *req)
> struct io_kiocb *list_req;
>
> list_req = list_first_entry(&ctx->iopoll_list, struct io_kiocb,
> - inflight_entry);
> + iopoll_entry);
> if (list_req->file != req->file)
> ctx->poll_multi_file = true;
> }
> @@ -2680,9 +2682,9 @@ static void io_iopoll_req_issued(struct io_kiocb *req)
> * it to the front so we find it first.
> */
> if (READ_ONCE(req->iopoll_completed))
> - list_add(&req->inflight_entry, &ctx->iopoll_list);
> + list_add(&req->iopoll_entry, &ctx->iopoll_list);
> else
> - list_add_tail(&req->inflight_entry, &ctx->iopoll_list);
> + list_add_tail(&req->iopoll_entry, &ctx->iopoll_list);
>
> if ((ctx->flags & IORING_SETUP_SQPOLL) &&
> wq_has_sleeper(&ctx->sq_data->wait))

2022-06-27 06:13:34

by Greg Kroah-Hartman

Subject: Re: Linux 5.10.125

On Sun, Jun 26, 2022 at 10:42:06PM -0700, Greg Thelen wrote:
> Jens Axboe <[email protected]> wrote:
>
> > On 6/26/22 6:04 PM, Jens Axboe wrote:
> >> On 6/26/22 4:56 PM, Greg Thelen wrote:
> >>> Greg Kroah-Hartman <[email protected]> wrote:
> >>>
> >>>> I'm announcing the release of the 5.10.125 kernel.
> >>>>
> >>>> All users of the 5.10 kernel series must upgrade.
> >>>>
> >>>> The updated 5.10.y git tree can be found at:
> >>>> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
> >>>> and can be browsed at the normal kernel.org git web browser:
> >>>> https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
> >>>>
> >>>> thanks,
> >>>>
> >>>> greg k-h
> >>>>
> >>>> ------------
> >>>>
> >>>> Makefile | 2
> >>>> arch/arm64/mm/cache.S | 2
> >>>> arch/s390/mm/pgtable.c | 2
> >>>> drivers/tty/serial/serial_core.c | 34 ++++--------
> >>>> drivers/usb/gadget/function/u_ether.c | 11 +++-
> >>>> fs/io_uring.c | 23 +++++---
> >>>> fs/zonefs/super.c | 92 ++++++++++++++++++++++------------
> >>>> net/ipv4/inet_hashtables.c | 31 ++++++++---
> >>>> 8 files changed, 122 insertions(+), 75 deletions(-)
> >>>>
> >>>> Christian Borntraeger (1):
> >>>> s390/mm: use non-quiescing sske for KVM switch to keyed guest
> >>>>
> >>>> Damien Le Moal (1):
> >>>> zonefs: fix zonefs_iomap_begin() for reads
> >>>>
> >>>> Eric Dumazet (1):
> >>>> tcp: add some entropy in __inet_hash_connect()
> >>>>
> >>>> Greg Kroah-Hartman (1):
> >>>> Linux 5.10.125
> >>>>
> >>>> Jens Axboe (1):
> >>>> io_uring: add missing item types for various requests
> >>>>
> >>>> Lukas Wunner (1):
> >>>> serial: core: Initialize rs485 RTS polarity already on probe
> >>>>
> >>>> Marian Postevca (1):
> >>>> usb: gadget: u_ether: fix regression in setting fixed MAC address
> >>>>
> >>>> Will Deacon (1):
> >>>> arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
> >>>>
> >>>> Willy Tarreau (5):
> >>>> tcp: use different parts of the port_offset for index and offset
> >>>> tcp: add small random increments to the source port
> >>>> tcp: dynamically allocate the perturb table used by source ports
> >>>> tcp: increase source port perturb table to 2^16
> >>>> tcp: drop the hash_32() part from the index calculation
> >>>
> >>> 5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add
> >>> missing item types for various requests") causes panic when running
> >>> test/iopoll.t from https://github.com/axboe/liburing commit
> >>> dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
> >>>
> >>> Here's a manually annotated panic message:
> >>> [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
> >>> [ 359.055393] kernel BUG at lib/list_debug.c:47!
> >>> [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
> >>> [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1
> >>> [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
> >>> [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
> >>> [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
> >>> [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
> >>> [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
> >>> [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
> >>> [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
> >>> [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
> >>> [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
> >>> [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >>> [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
> >>> [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> >>> [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> >>> [ 359.180647] Call Trace:
> >>> [ 359.183064] io_dismantle_req+0x1da/0x2b0
> >>> __list_del_entry [include/linux/list.h:132]
> >>> list_del [include/linux/list.h:146]
> >>> io_req_drop_files [fs/io_uring.c:5934]
> >>> io_req_clean_work [fs/io_uring.c:1315]
> >>> io_dismantle_req [fs/io_uring.c:1911]
> >>> [ 359.187023] io_do_iopoll+0x4e5/0x790
> >>> [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0
> >>> [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30
> >>> [ 359.212793] do_syscall_64+0x31/0x40
> >>> [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> >>
> >> Well that sucks, I wonder why mine didn't fail like that. I'll see if I
> >> can hit this and send a fix. Thanks for reporting!
> >
> > Below should do it, I apologize for that. I think my test box booted the
> > previous kernel which is why it didn't hit it in my regression tests :-(
> >
> > Greg, can you add this to 5.10-stable? Verified it ran tests with the
> > right kernel now...

Great, I'll go just do a release with this in it right now to help
others out.

greg k-h

2022-06-27 08:15:56

by Greg Kroah-Hartman

Subject: Re: Linux 5.10.125

On Mon, Jun 27, 2022 at 07:54:23AM +0200, Greg Kroah-Hartman wrote:
> On Sun, Jun 26, 2022 at 10:42:06PM -0700, Greg Thelen wrote:
> > Jens Axboe <[email protected]> wrote:
> >
> > > On 6/26/22 6:04 PM, Jens Axboe wrote:
> > >> On 6/26/22 4:56 PM, Greg Thelen wrote:
> > >>> Greg Kroah-Hartman <[email protected]> wrote:
> > >>>
> > >>>> I'm announcing the release of the 5.10.125 kernel.
> > >>>>
> > >>>> All users of the 5.10 kernel series must upgrade.
> > >>>>
> > >>>> The updated 5.10.y git tree can be found at:
> > >>>> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
> > >>>> and can be browsed at the normal kernel.org git web browser:
> > >>>> https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
> > >>>>
> > >>>> thanks,
> > >>>>
> > >>>> greg k-h
> > >>>>
> > >>>> ------------
> > >>>>
> > >>>> Makefile | 2
> > >>>> arch/arm64/mm/cache.S | 2
> > >>>> arch/s390/mm/pgtable.c | 2
> > >>>> drivers/tty/serial/serial_core.c | 34 ++++--------
> > >>>> drivers/usb/gadget/function/u_ether.c | 11 +++-
> > >>>> fs/io_uring.c | 23 +++++---
> > >>>> fs/zonefs/super.c | 92 ++++++++++++++++++++++------------
> > >>>> net/ipv4/inet_hashtables.c | 31 ++++++++---
> > >>>> 8 files changed, 122 insertions(+), 75 deletions(-)
> > >>>>
> > >>>> Christian Borntraeger (1):
> > >>>> s390/mm: use non-quiescing sske for KVM switch to keyed guest
> > >>>>
> > >>>> Damien Le Moal (1):
> > >>>> zonefs: fix zonefs_iomap_begin() for reads
> > >>>>
> > >>>> Eric Dumazet (1):
> > >>>> tcp: add some entropy in __inet_hash_connect()
> > >>>>
> > >>>> Greg Kroah-Hartman (1):
> > >>>> Linux 5.10.125
> > >>>>
> > >>>> Jens Axboe (1):
> > >>>> io_uring: add missing item types for various requests
> > >>>>
> > >>>> Lukas Wunner (1):
> > >>>> serial: core: Initialize rs485 RTS polarity already on probe
> > >>>>
> > >>>> Marian Postevca (1):
> > >>>> usb: gadget: u_ether: fix regression in setting fixed MAC address
> > >>>>
> > >>>> Will Deacon (1):
> > >>>> arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
> > >>>>
> > >>>> Willy Tarreau (5):
> > >>>> tcp: use different parts of the port_offset for index and offset
> > >>>> tcp: add small random increments to the source port
> > >>>> tcp: dynamically allocate the perturb table used by source ports
> > >>>> tcp: increase source port perturb table to 2^16
> > >>>> tcp: drop the hash_32() part from the index calculation
> > >>>
> > >>> 5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add
> > >>> missing item types for various requests") causes panic when running
> > >>> test/iopoll.t from https://github.com/axboe/liburing commit
> > >>> dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
> > >>>
> > >>> Here's a manually annotated panic message:
> > >>> [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
> > >>> [ 359.055393] kernel BUG at lib/list_debug.c:47!
> > >>> [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
> > >>> [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1
> > >>> [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
> > >>> [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
> > >>> [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
> > >>> [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
> > >>> [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
> > >>> [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
> > >>> [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
> > >>> [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
> > >>> [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
> > >>> [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > >>> [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
> > >>> [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > >>> [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > >>> [ 359.180647] Call Trace:
> > >>> [ 359.183064] io_dismantle_req+0x1da/0x2b0
> > >>> __list_del_entry [include/linux/list.h:132]
> > >>> list_del [include/linux/list.h:146]
> > >>> io_req_drop_files [fs/io_uring.c:5934]
> > >>> io_req_clean_work [fs/io_uring.c:1315]
> > >>> io_dismantle_req [fs/io_uring.c:1911]
> > >>> [ 359.187023] io_do_iopoll+0x4e5/0x790
> > >>> [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0
> > >>> [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30
> > >>> [ 359.212793] do_syscall_64+0x31/0x40
> > >>> [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
> > >>
> > >> Well that sucks, I wonder why mine didn't fail like that. I'll see if I
> > >> can hit this and send a fix. Thanks for reporting!
> > >
> > > Below should do it, I apologize for that. I think my test box booted the
> > > previous kernel which is why it didn't hit it in my regression tests :-(
> > >
> > > Greg, can you add this to 5.10-stable? Verified it ran tests with the
> > > right kernel now...
>
> Great, I'll go just do a release with this in it right now to help
> others out.

5.10.126 is now released with this fix.

2022-06-27 12:37:09

by Jens Axboe

Subject: Re: Linux 5.10.125

On 6/27/22 2:05 AM, Greg Kroah-Hartman wrote:
> On Mon, Jun 27, 2022 at 07:54:23AM +0200, Greg Kroah-Hartman wrote:
>> On Sun, Jun 26, 2022 at 10:42:06PM -0700, Greg Thelen wrote:
>>> Jens Axboe <[email protected]> wrote:
>>>
>>>> On 6/26/22 6:04 PM, Jens Axboe wrote:
>>>>> On 6/26/22 4:56 PM, Greg Thelen wrote:
>>>>>> Greg Kroah-Hartman <[email protected]> wrote:
>>>>>>
>>>>>>> I'm announcing the release of the 5.10.125 kernel.
>>>>>>>
>>>>>>> All users of the 5.10 kernel series must upgrade.
>>>>>>>
>>>>>>> The updated 5.10.y git tree can be found at:
>>>>>>> git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
>>>>>>> and can be browsed at the normal kernel.org git web browser:
>>>>>>> https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
>>>>>>>
>>>>>>> thanks,
>>>>>>>
>>>>>>> greg k-h
>>>>>>>
>>>>>>> ------------
>>>>>>>
>>>>>>> Makefile | 2
>>>>>>> arch/arm64/mm/cache.S | 2
>>>>>>> arch/s390/mm/pgtable.c | 2
>>>>>>> drivers/tty/serial/serial_core.c | 34 ++++--------
>>>>>>> drivers/usb/gadget/function/u_ether.c | 11 +++-
>>>>>>> fs/io_uring.c | 23 +++++---
>>>>>>> fs/zonefs/super.c | 92 ++++++++++++++++++++++------------
>>>>>>> net/ipv4/inet_hashtables.c | 31 ++++++++---
>>>>>>> 8 files changed, 122 insertions(+), 75 deletions(-)
>>>>>>>
>>>>>>> Christian Borntraeger (1):
>>>>>>> s390/mm: use non-quiescing sske for KVM switch to keyed guest
>>>>>>>
>>>>>>> Damien Le Moal (1):
>>>>>>> zonefs: fix zonefs_iomap_begin() for reads
>>>>>>>
>>>>>>> Eric Dumazet (1):
>>>>>>> tcp: add some entropy in __inet_hash_connect()
>>>>>>>
>>>>>>> Greg Kroah-Hartman (1):
>>>>>>> Linux 5.10.125
>>>>>>>
>>>>>>> Jens Axboe (1):
>>>>>>> io_uring: add missing item types for various requests
>>>>>>>
>>>>>>> Lukas Wunner (1):
>>>>>>> serial: core: Initialize rs485 RTS polarity already on probe
>>>>>>>
>>>>>>> Marian Postevca (1):
>>>>>>> usb: gadget: u_ether: fix regression in setting fixed MAC address
>>>>>>>
>>>>>>> Will Deacon (1):
>>>>>>> arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
>>>>>>>
>>>>>>> Willy Tarreau (5):
>>>>>>> tcp: use different parts of the port_offset for index and offset
>>>>>>> tcp: add small random increments to the source port
>>>>>>> tcp: dynamically allocate the perturb table used by source ports
>>>>>>> tcp: increase source port perturb table to 2^16
>>>>>>> tcp: drop the hash_32() part from the index calculation
>>>>>>
>>>>>> 5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add
>>>>>> missing item types for various requests") causes panic when running
>>>>>> test/iopoll.t from https://github.com/axboe/liburing commit
>>>>>> dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
>>>>>>
>>>>>> Here's a manually annotated panic message:
>>>>>> [ 359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
>>>>>> [ 359.055393] kernel BUG at lib/list_debug.c:47!
>>>>>> [ 359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
>>>>>> [ 359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S I 5.10.124 #1
>>>>>> [ 359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
>>>>>> [ 359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
>>>>>> [ 359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
>>>>>> [ 359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
>>>>>> [ 359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
>>>>>> [ 359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
>>>>>> [ 359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
>>>>>> [ 359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
>>>>>> [ 359.145836] FS: 00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
>>>>>> [ 359.153830] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>>>> [ 359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
>>>>>> [ 359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>>>>>> [ 359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>>>>>> [ 359.180647] Call Trace:
>>>>>> [ 359.183064] io_dismantle_req+0x1da/0x2b0
>>>>>> __list_del_entry [include/linux/list.h:132]
>>>>>> list_del [include/linux/list.h:146]
>>>>>> io_req_drop_files [fs/io_uring.c:5934]
>>>>>> io_req_clean_work [fs/io_uring.c:1315]
>>>>>> io_dismantle_req [fs/io_uring.c:1911]
>>>>>> [ 359.187023] io_do_iopoll+0x4e5/0x790
>>>>>> [ 359.194602] __se_sys_io_uring_enter+0x39b/0x6f0
>>>>>> [ 359.208318] __x64_sys_io_uring_enter+0x29/0x30
>>>>>> [ 359.212793] do_syscall_64+0x31/0x40
>>>>>> [ 359.216324] entry_SYSCALL_64_after_hwframe+0x44/0xa9
>>>>>
>>>>> Well that sucks, I wonder why mine didn't fail like that. I'll see if I
>>>>> can hit this and send a fix. Thanks for reporting!
>>>>
>>>> Below should do it, I apologize for that. I think my test box booted the
>>>> previous kernel which is why it didn't hit it in my regression tests :-(
>>>>
>>>> Greg, can you add this to 5.10-stable? Verified it ran tests with the
>>>> right kernel now...
>>
>> Great, I'll go just do a release with this in it right now to help
>> others out.
>
> 5.10.126 is now released with this fix.

Thanks - to both Gregs!

--
Jens Axboe