Skip to content

Commit 7c90325

Browse files
torvaldstorvalds
committed
Merge branch 'akpm' (patches from Andrew)
Merge misc fixes from Andrew Morton: "23 fixes" * emailed patches from Andrew Morton <akpm@linux-foundation.org>: (23 commits) mm, memory_hotplug: fix off-by-one in is_pageblock_removable mm: don't let userspace spam allocations warnings slub: fix a crash with SLUB_DEBUG + KASAN_SW_TAGS kasan, slab: remove redundant kasan_slab_alloc hooks kasan, slab: make freelist stored without tags kasan, slab: fix conflicts with CONFIG_HARDENED_USERCOPY kasan: prevent tracing of tags.c kasan: fix random seed generation for tag-based mode tmpfs: fix link accounting when a tmpfile is linked in psi: avoid divide-by-zero crash inside virtual machines mm: handle lru_add_drain_all for UP properly mm, page_alloc: fix a division by zero error when boosting watermarks v2 mm/debug.c: fix __dump_page() for poisoned pages proc, oom: do not report alien mms when setting oom_score_adj slub: fix SLAB_CONSISTENCY_CHECKS + KASAN_SW_TAGS kasan, slub: fix more conflicts with CONFIG_SLAB_FREELIST_HARDENED kasan, slub: fix conflicts with CONFIG_SLAB_FREELIST_HARDENED kasan, slub: move kasan_poison_slab hook before page_address kmemleak: account for tagged pointers when calculating pointer range kasan, kmemleak: pass tagged pointers to kmemleak ...
2 parents f6163d6 + 891cb2a commit 7c90325

File tree

20 files changed

+140
-82
lines changed

20 files changed

+140
-82
lines changed

‎arch/arm64/kernel/setup.c

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -339,6 +339,9 @@ void __init setup_arch(char **cmdline_p)
339339
smp_init_cpus();
340340
smp_build_mpidr_hash();
341341

342+
/* Init percpu seeds for random tags after cpus are set up. */
343+
kasan_init_tags();
344+
342345
#ifdef CONFIG_ARM64_SW_TTBR0_PAN
343346
/*
344347
* Make sure init_thread_info.ttbr0 always generates translation

‎arch/arm64/mm/kasan_init.c

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -252,8 +252,6 @@ void __init kasan_init(void)
252252
memset(kasan_early_shadow_page, KASAN_SHADOW_INIT, PAGE_SIZE);
253253
cpu_replace_ttbr1(lm_alias(swapper_pg_dir));
254254

255-
kasan_init_tags();
256-
257255
/* At this point kasan is fully initialized. Enable error messages */
258256
init_task.kasan_depth = 0;
259257
pr_info("KernelAddressSanitizer initialized\n");

‎fs/proc/base.c

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1086,10 +1086,6 @@ static int __set_oom_adj(struct file *file, int oom_adj, bool legacy)
10861086

10871087
task_lock(p);
10881088
if (!p->vfork_done && process_shares_mm(p, mm)) {
1089-
pr_info("updating oom_score_adj for %d (%s) from %d to %d because it shares mm with %d (%s). Report if this is unexpected.\n",
1090-
task_pid_nr(p), p->comm,
1091-
p->signal->oom_score_adj, oom_adj,
1092-
task_pid_nr(task), task->comm);
10931089
p->signal->oom_score_adj = oom_adj;
10941090
if (!legacy && has_capability_noaudit(current, CAP_SYS_RESOURCE))
10951091
p->signal->oom_score_adj_min = (short)oom_adj;

‎init/initramfs.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -550,6 +550,7 @@ static void __init free_initrd(void)
550550
initrd_end = 0;
551551
}
552552

553+
#ifdef CONFIG_BLK_DEV_RAM
553554
#define BUF_SIZE 1024
554555
static void __init clean_rootfs(void)
555556
{
@@ -596,6 +597,7 @@ static void __init clean_rootfs(void)
596597
ksys_close(fd);
597598
kfree(buf);
598599
}
600+
#endif
599601

600602
static int __init populate_rootfs(void)
601603
{
@@ -638,10 +640,8 @@ static int __init populate_rootfs(void)
638640
printk(KERN_INFO "Unpacking initramfs...\n");
639641
err = unpack_to_rootfs((char *)initrd_start,
640642
initrd_end - initrd_start);
641-
if (err) {
643+
if (err)
642644
printk(KERN_EMERG "Initramfs unpacking failed: %s\n", err);
643-
clean_rootfs();
644-
}
645645
free_initrd();
646646
#endif
647647
}

‎kernel/sched/psi.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -322,7 +322,7 @@ static bool update_stats(struct psi_group *group)
322322
expires = group->next_update;
323323
if (now < expires)
324324
goto out;
325-
if (now - expires > psi_period)
325+
if (now - expires >= psi_period)
326326
missed_periods = div_u64(now - expires, psi_period);
327327

328328
/*

‎mm/debug.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ const struct trace_print_flags vmaflag_names[] = {
4444

4545
void __dump_page(struct page *page, const char *reason)
4646
{
47-
struct address_space *mapping = page_mapping(page);
47+
struct address_space *mapping;
4848
bool page_poisoned = PagePoisoned(page);
4949
int mapcount;
5050

@@ -58,6 +58,8 @@ void __dump_page(struct page *page, const char *reason)
5858
goto hex_only;
5959
}
6060

61+
mapping = page_mapping(page);
62+
6163
/*
6264
* Avoid VM_BUG_ON() in page_mapcount().
6365
* page->_mapcount space in struct page is used by sl[aou]b pages to

‎mm/kasan/Makefile

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ KCOV_INSTRUMENT := n
77

88
CFLAGS_REMOVE_common.o = -pg
99
CFLAGS_REMOVE_generic.o = -pg
10+
CFLAGS_REMOVE_tags.o = -pg
11+
1012
# Function splitter causes unnecessary splits in __asan_load1/__asan_store1
1113
# see: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63533
1214

‎mm/kasan/common.c

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -361,10 +361,15 @@ void kasan_poison_object_data(struct kmem_cache *cache, void *object)
361361
* get different tags.
362362
*/
363363
static u8 assign_tag(struct kmem_cache *cache, const void *object,
364-
bool init, bool krealloc)
364+
bool init, bool keep_tag)
365365
{
366-
/* Reuse the same tag for krealloc'ed objects. */
367-
if (krealloc)
366+
/*
367+
* 1. When an object is kmalloc()'ed, two hooks are called:
368+
* kasan_slab_alloc() and kasan_kmalloc(). We assign the
369+
* tag only in the first one.
370+
* 2. We reuse the same tag for krealloc'ed objects.
371+
*/
372+
if (keep_tag)
368373
return get_tag(object);
369374

370375
/*
@@ -405,12 +410,6 @@ void * __must_check kasan_init_slab_obj(struct kmem_cache *cache,
405410
return (void *)object;
406411
}
407412

408-
void * __must_check kasan_slab_alloc(struct kmem_cache *cache, void *object,
409-
gfp_t flags)
410-
{
411-
return kasan_kmalloc(cache, object, cache->object_size, flags);
412-
}
413-
414413
static inline bool shadow_invalid(u8 tag, s8 shadow_byte)
415414
{
416415
if (IS_ENABLED(CONFIG_KASAN_GENERIC))
@@ -467,7 +466,7 @@ bool kasan_slab_free(struct kmem_cache *cache, void *object, unsigned long ip)
467466
}
468467

469468
static void *__kasan_kmalloc(struct kmem_cache *cache, const void *object,
470-
size_t size, gfp_t flags, bool krealloc)
469+
size_t size, gfp_t flags, bool keep_tag)
471470
{
472471
unsigned long redzone_start;
473472
unsigned long redzone_end;
@@ -485,7 +484,7 @@ static void *__kasan_kmalloc(struct kmem_cache *cache, const void *object,
485484
KASAN_SHADOW_SCALE_SIZE);
486485

487486
if (IS_ENABLED(CONFIG_KASAN_SW_TAGS))
488-
tag = assign_tag(cache, object, false, krealloc);
487+
tag = assign_tag(cache, object, false, keep_tag);
489488

490489
/* Tag is ignored in set_tag without CONFIG_KASAN_SW_TAGS */
491490
kasan_unpoison_shadow(set_tag(object, tag), size);
@@ -498,10 +497,16 @@ static void *__kasan_kmalloc(struct kmem_cache *cache, const void *object,
498497
return set_tag(object, tag);
499498
}
500499

500+
void * __must_check kasan_slab_alloc(struct kmem_cache *cache, void *object,
501+
gfp_t flags)
502+
{
503+
return __kasan_kmalloc(cache, object, cache->object_size, flags, false);
504+
}
505+
501506
void * __must_check kasan_kmalloc(struct kmem_cache *cache, const void *object,
502507
size_t size, gfp_t flags)
503508
{
504-
return __kasan_kmalloc(cache, object, size, flags, false);
509+
return __kasan_kmalloc(cache, object, size, flags, true);
505510
}
506511
EXPORT_SYMBOL(kasan_kmalloc);
507512

‎mm/kasan/tags.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ void kasan_init_tags(void)
4646
int cpu;
4747

4848
for_each_possible_cpu(cpu)
49-
per_cpu(prng_state, cpu) = get_random_u32();
49+
per_cpu(prng_state, cpu) = (u32)get_cycles();
5050
}
5151

5252
/*

‎mm/kmemleak.c

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -574,6 +574,7 @@ static struct kmemleak_object *create_object(unsigned long ptr, size_t size,
574574
unsigned long flags;
575575
struct kmemleak_object *object, *parent;
576576
struct rb_node **link, *rb_parent;
577+
unsigned long untagged_ptr;
577578

578579
object = kmem_cache_alloc(object_cache, gfp_kmemleak_mask(gfp));
579580
if (!object) {
@@ -619,8 +620,9 @@ static struct kmemleak_object *create_object(unsigned long ptr, size_t size,
619620

620621
write_lock_irqsave(&kmemleak_lock, flags);
621622

622-
min_addr = min(min_addr, ptr);
623-
max_addr = max(max_addr, ptr + size);
623+
untagged_ptr = (unsigned long)kasan_reset_tag((void *)ptr);
624+
min_addr = min(min_addr, untagged_ptr);
625+
max_addr = max(max_addr, untagged_ptr + size);
624626
link = &object_tree_root.rb_node;
625627
rb_parent = NULL;
626628
while (*link) {
@@ -1333,6 +1335,7 @@ static void scan_block(void *_start, void *_end,
13331335
unsigned long *start = PTR_ALIGN(_start, BYTES_PER_POINTER);
13341336
unsigned long *end = _end - (BYTES_PER_POINTER - 1);
13351337
unsigned long flags;
1338+
unsigned long untagged_ptr;
13361339

13371340
read_lock_irqsave(&kmemleak_lock, flags);
13381341
for (ptr = start; ptr < end; ptr++) {
@@ -1347,7 +1350,8 @@ static void scan_block(void *_start, void *_end,
13471350
pointer = *ptr;
13481351
kasan_enable_current();
13491352

1350-
if (pointer < min_addr || pointer >= max_addr)
1353+
untagged_ptr = (unsigned long)kasan_reset_tag((void *)pointer);
1354+
if (untagged_ptr < min_addr || untagged_ptr >= max_addr)
13511355
continue;
13521356

13531357
/*

‎mm/memory_hotplug.c

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1188,28 +1188,30 @@ static inline int pageblock_free(struct page *page)
11881188
return PageBuddy(page) && page_order(page) >= pageblock_order;
11891189
}
11901190

1191-
/* Return the start of the next active pageblock after a given page */
1192-
static struct page *next_active_pageblock(struct page *page)
1191+
/* Return the pfn of the start of the next active pageblock after a given pfn */
1192+
static unsigned long next_active_pageblock(unsigned long pfn)
11931193
{
1194+
struct page *page = pfn_to_page(pfn);
1195+
11941196
/* Ensure the starting page is pageblock-aligned */
1195-
BUG_ON(page_to_pfn(page) & (pageblock_nr_pages - 1));
1197+
BUG_ON(pfn & (pageblock_nr_pages - 1));
11961198

11971199
/* If the entire pageblock is free, move to the end of free page */
11981200
if (pageblock_free(page)) {
11991201
int order;
12001202
/* be careful. we don't have locks, page_order can be changed.*/
12011203
order = page_order(page);
12021204
if ((order < MAX_ORDER) && (order >= pageblock_order))
1203-
return page + (1 << order);
1205+
return pfn + (1 << order);
12041206
}
12051207

1206-
return page + pageblock_nr_pages;
1208+
return pfn + pageblock_nr_pages;
12071209
}
12081210

1209-
static bool is_pageblock_removable_nolock(struct page *page)
1211+
static bool is_pageblock_removable_nolock(unsigned long pfn)
12101212
{
1213+
struct page *page = pfn_to_page(pfn);
12111214
struct zone *zone;
1212-
unsigned long pfn;
12131215

12141216
/*
12151217
* We have to be careful here because we are iterating over memory
@@ -1232,13 +1234,14 @@ static bool is_pageblock_removable_nolock(struct page *page)
12321234
/* Checks if this range of memory is likely to be hot-removable. */
12331235
bool is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages)
12341236
{
1235-
struct page *page = pfn_to_page(start_pfn);
1236-
unsigned long end_pfn = min(start_pfn + nr_pages, zone_end_pfn(page_zone(page)));
1237-
struct page *end_page = pfn_to_page(end_pfn);
1237+
unsigned long end_pfn, pfn;
1238+
1239+
end_pfn = min(start_pfn + nr_pages,
1240+
zone_end_pfn(page_zone(pfn_to_page(start_pfn))));
12381241

12391242
/* Check the starting page of each pageblock within the range */
1240-
for (; page < end_page; page = next_active_pageblock(page)) {
1241-
if (!is_pageblock_removable_nolock(page))
1243+
for (pfn = start_pfn; pfn < end_pfn; pfn = next_active_pageblock(pfn)) {
1244+
if (!is_pageblock_removable_nolock(pfn))
12421245
return false;
12431246
cond_resched();
12441247
}

‎mm/mempolicy.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1314,7 +1314,7 @@ static int copy_nodes_to_user(unsigned long __user *mask, unsigned long maxnode,
13141314
nodemask_t *nodes)
13151315
{
13161316
unsigned long copy = ALIGN(maxnode-1, 64) / 8;
1317-
const int nbytes = BITS_TO_LONGS(MAX_NUMNODES) * sizeof(long);
1317+
unsigned int nbytes = BITS_TO_LONGS(nr_node_ids) * sizeof(long);
13181318

13191319
if (copy > nbytes) {
13201320
if (copy > PAGE_SIZE)
@@ -1491,7 +1491,7 @@ static int kernel_get_mempolicy(int __user *policy,
14911491
int uninitialized_var(pval);
14921492
nodemask_t nodes;
14931493

1494-
if (nmask != NULL && maxnode < MAX_NUMNODES)
1494+
if (nmask != NULL && maxnode < nr_node_ids)
14951495
return -EINVAL;
14961496

14971497
err = do_get_mempolicy(&pval, &nodes, addr, flags);
@@ -1527,7 +1527,7 @@ COMPAT_SYSCALL_DEFINE5(get_mempolicy, int __user *, policy,
15271527
unsigned long nr_bits, alloc_size;
15281528
DECLARE_BITMAP(bm, MAX_NUMNODES);
15291529

1530-
nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES);
1530+
nr_bits = min_t(unsigned long, maxnode-1, nr_node_ids);
15311531
alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
15321532

15331533
if (nmask)

‎mm/page_alloc.c

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2170,6 +2170,18 @@ static inline void boost_watermark(struct zone *zone)
21702170

21712171
max_boost = mult_frac(zone->_watermark[WMARK_HIGH],
21722172
watermark_boost_factor, 10000);
2173+
2174+
/*
2175+
* high watermark may be uninitialised if fragmentation occurs
2176+
* very early in boot so do not boost. We do not fall
2177+
* through and boost by pageblock_nr_pages as failing
2178+
* allocations that early means that reclaim is not going
2179+
* to help and it may even be impossible to reclaim the
2180+
* boosted watermark resulting in a hang.
2181+
*/
2182+
if (!max_boost)
2183+
return;
2184+
21732185
max_boost = max(pageblock_nr_pages, max_boost);
21742186

21752187
zone->watermark_boost = min(zone->watermark_boost + pageblock_nr_pages,

‎mm/shmem.c

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2854,10 +2854,14 @@ static int shmem_link(struct dentry *old_dentry, struct inode *dir, struct dentr
28542854
* No ordinary (disk based) filesystem counts links as inodes;
28552855
* but each new link needs a new dentry, pinning lowmem, and
28562856
* tmpfs dentries cannot be pruned until they are unlinked.
2857+
* But if an O_TMPFILE file is linked into the tmpfs, the
2858+
* first link must skip that, to get the accounting right.
28572859
*/
2858-
ret = shmem_reserve_inode(inode->i_sb);
2859-
if (ret)
2860-
goto out;
2860+
if (inode->i_nlink) {
2861+
ret = shmem_reserve_inode(inode->i_sb);
2862+
if (ret)
2863+
goto out;
2864+
}
28612865

28622866
dir->i_size += BOGO_DIRENT_SIZE;
28632867
inode->i_ctime = dir->i_ctime = dir->i_mtime = current_time(inode);

‎mm/slab.c

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2359,7 +2359,7 @@ static void *alloc_slabmgmt(struct kmem_cache *cachep,
23592359
void *freelist;
23602360
void *addr = page_address(page);
23612361

2362-
page->s_mem = kasan_reset_tag(addr) + colour_off;
2362+
page->s_mem = addr + colour_off;
23632363
page->active = 0;
23642364

23652365
if (OBJFREELIST_SLAB(cachep))
@@ -2368,6 +2368,7 @@ static void *alloc_slabmgmt(struct kmem_cache *cachep,
23682368
/* Slab management obj is off-slab. */
23692369
freelist = kmem_cache_alloc_node(cachep->freelist_cache,
23702370
local_flags, nodeid);
2371+
freelist = kasan_reset_tag(freelist);
23712372
if (!freelist)
23722373
return NULL;
23732374
} else {
@@ -2681,6 +2682,13 @@ static struct page *cache_grow_begin(struct kmem_cache *cachep,
26812682

26822683
offset *= cachep->colour_off;
26832684

2685+
/*
2686+
* Call kasan_poison_slab() before calling alloc_slabmgmt(), so
2687+
* page_address() in the latter returns a non-tagged pointer,
2688+
* as it should be for slab pages.
2689+
*/
2690+
kasan_poison_slab(page);
2691+
26842692
/* Get slab management. */
26852693
freelist = alloc_slabmgmt(cachep, page, offset,
26862694
local_flags & ~GFP_CONSTRAINT_MASK, page_node);
@@ -2689,7 +2697,6 @@ static struct page *cache_grow_begin(struct kmem_cache *cachep,
26892697

26902698
slab_map_pages(cachep, page, freelist);
26912699

2692-
kasan_poison_slab(page);
26932700
cache_init_objs(cachep, page);
26942701

26952702
if (gfpflags_allow_blocking(local_flags))
@@ -3540,7 +3547,6 @@ void *kmem_cache_alloc(struct kmem_cache *cachep, gfp_t flags)
35403547
{
35413548
void *ret = slab_alloc(cachep, flags, _RET_IP_);
35423549

3543-
ret = kasan_slab_alloc(cachep, ret, flags);
35443550
trace_kmem_cache_alloc(_RET_IP_, ret,
35453551
cachep->object_size, cachep->size, flags);
35463552

@@ -3630,7 +3636,6 @@ void *kmem_cache_alloc_node(struct kmem_cache *cachep, gfp_t flags, int nodeid)
36303636
{
36313637
void *ret = slab_alloc_node(cachep, flags, nodeid, _RET_IP_);
36323638

3633-
ret = kasan_slab_alloc(cachep, ret, flags);
36343639
trace_kmem_cache_alloc_node(_RET_IP_, ret,
36353640
cachep->object_size, cachep->size,
36363641
flags, nodeid);
@@ -4408,6 +4413,8 @@ void __check_heap_object(const void *ptr, unsigned long n, struct page *page,
44084413
unsigned int objnr;
44094414
unsigned long offset;
44104415

4416+
ptr = kasan_reset_tag(ptr);
4417+
44114418
/* Find and validate object. */
44124419
cachep = page->slab_cache;
44134420
objnr = obj_to_index(cachep, page, (void *)ptr);

0 commit comments

Comments
 (0)