Skip to content

Commit b7cbaf5

Browse files
torvaldstorvalds
committed
Merge branch 'akpm' (patches from Andrew)
Merge misc fixes from Andrew Morton: "Subsystems affected by this patch series: mm (memremap, memcg, slab-generic, kasan, mempolicy, pagecache, oom-kill, pagemap), kthread, signals, lib, epoll, and core-kernel" * emailed patches from Andrew Morton <[email protected]>: kernel/hung_task.c: make type annotations consistent epoll: add a selftest for epoll timeout race mm: always have io_remap_pfn_range() set pgprot_decrypted() mm, oom: keep oom_adj under or at upper limit when printing kthread_worker: prevent queuing delayed work from timer_fn when it is being canceled mm/truncate.c: make __invalidate_mapping_pages() static lib/crc32test: remove extra local_irq_disable/enable ptrace: fix task_join_group_stop() for the case when current is traced mm: mempolicy: fix potential pte_unmap_unlock pte error kasan: adopt KUNIT tests to SW_TAGS mode mm: memcg: link page counters to root if use_hierarchy is false mm: memcontrol: correct the NR_ANON_THPS counter of hierarchical memcg hugetlb_cgroup: fix reservation accounting mm/mremap_pages: fix static key devmap_managed_key updates
2 parents 495023e + 3b70ae4 commit b7cbaf5

File tree

14 files changed

+275
-105
lines changed

14 files changed

+275
-105
lines changed

‎fs/proc/base.c

+2
Original file line numberDiff line numberDiff line change
@@ -1049,6 +1049,8 @@ static ssize_t oom_adj_read(struct file *file, char __user *buf, size_t count,
10491049
oom_adj = (task->signal->oom_score_adj * -OOM_DISABLE) /
10501050
OOM_SCORE_ADJ_MAX;
10511051
put_task_struct(task);
1052+
if (oom_adj > OOM_ADJUST_MAX)
1053+
oom_adj = OOM_ADJUST_MAX;
10521054
len = snprintf(buffer, sizeof(buffer), "%d\n", oom_adj);
10531055
return simple_read_from_buffer(buf, count, ppos, buffer, len);
10541056
}

‎include/linux/mm.h

+9
Original file line numberDiff line numberDiff line change
@@ -2759,6 +2759,15 @@ static inline vm_fault_t vmf_insert_page(struct vm_area_struct *vma,
27592759
return VM_FAULT_NOPAGE;
27602760
}
27612761

2762+
#ifndef io_remap_pfn_range
2763+
static inline int io_remap_pfn_range(struct vm_area_struct *vma,
2764+
unsigned long addr, unsigned long pfn,
2765+
unsigned long size, pgprot_t prot)
2766+
{
2767+
return remap_pfn_range(vma, addr, pfn, size, pgprot_decrypted(prot));
2768+
}
2769+
#endif
2770+
27622771
static inline vm_fault_t vmf_error(int err)
27632772
{
27642773
if (err == -ENOMEM)

‎include/linux/pgtable.h

-4
Original file line numberDiff line numberDiff line change
@@ -1427,10 +1427,6 @@ typedef unsigned int pgtbl_mod_mask;
14271427

14281428
#endif /* !__ASSEMBLY__ */
14291429

1430-
#ifndef io_remap_pfn_range
1431-
#define io_remap_pfn_range remap_pfn_range
1432-
#endif
1433-
14341430
#ifndef has_transparent_hugepage
14351431
#ifdef CONFIG_TRANSPARENT_HUGEPAGE
14361432
#define has_transparent_hugepage() 1

‎kernel/hung_task.c

+1-2
Original file line numberDiff line numberDiff line change
@@ -225,8 +225,7 @@ static long hung_timeout_jiffies(unsigned long last_checked,
225225
* Process updating of timeout sysctl
226226
*/
227227
int proc_dohung_task_timeout_secs(struct ctl_table *table, int write,
228-
void __user *buffer,
229-
size_t *lenp, loff_t *ppos)
228+
void *buffer, size_t *lenp, loff_t *ppos)
230229
{
231230
int ret;
232231

‎kernel/kthread.c

+2-1
Original file line numberDiff line numberDiff line change
@@ -897,7 +897,8 @@ void kthread_delayed_work_timer_fn(struct timer_list *t)
897897
/* Move the work from worker->delayed_work_list. */
898898
WARN_ON_ONCE(list_empty(&work->node));
899899
list_del_init(&work->node);
900-
kthread_insert_work(worker, work, &worker->work_list);
900+
if (!work->canceling)
901+
kthread_insert_work(worker, work, &worker->work_list);
901902

902903
raw_spin_unlock_irqrestore(&worker->lock, flags);
903904
}

‎kernel/signal.c

+10-9
Original file line numberDiff line numberDiff line change
@@ -391,16 +391,17 @@ static bool task_participate_group_stop(struct task_struct *task)
391391

392392
void task_join_group_stop(struct task_struct *task)
393393
{
394+
unsigned long mask = current->jobctl & JOBCTL_STOP_SIGMASK;
395+
struct signal_struct *sig = current->signal;
396+
397+
if (sig->group_stop_count) {
398+
sig->group_stop_count++;
399+
mask |= JOBCTL_STOP_CONSUME;
400+
} else if (!(sig->flags & SIGNAL_STOP_STOPPED))
401+
return;
402+
394403
/* Have the new thread join an on-going signal group stop */
395-
unsigned long jobctl = current->jobctl;
396-
if (jobctl & JOBCTL_STOP_PENDING) {
397-
struct signal_struct *sig = current->signal;
398-
unsigned long signr = jobctl & JOBCTL_STOP_SIGMASK;
399-
unsigned long gstop = JOBCTL_STOP_PENDING | JOBCTL_STOP_CONSUME;
400-
if (task_set_jobctl_pending(task, signr | gstop)) {
401-
sig->group_stop_count++;
402-
}
403-
}
404+
task_set_jobctl_pending(task, mask | JOBCTL_STOP_PENDING);
404405
}
405406

406407
/*

‎lib/crc32test.c

-4
Original file line numberDiff line numberDiff line change
@@ -683,7 +683,6 @@ static int __init crc32c_test(void)
683683

684684
/* reduce OS noise */
685685
local_irq_save(flags);
686-
local_irq_disable();
687686

688687
nsec = ktime_get_ns();
689688
for (i = 0; i < 100; i++) {
@@ -694,7 +693,6 @@ static int __init crc32c_test(void)
694693
nsec = ktime_get_ns() - nsec;
695694

696695
local_irq_restore(flags);
697-
local_irq_enable();
698696

699697
pr_info("crc32c: CRC_LE_BITS = %d\n", CRC_LE_BITS);
700698

@@ -768,7 +766,6 @@ static int __init crc32_test(void)
768766

769767
/* reduce OS noise */
770768
local_irq_save(flags);
771-
local_irq_disable();
772769

773770
nsec = ktime_get_ns();
774771
for (i = 0; i < 100; i++) {
@@ -783,7 +780,6 @@ static int __init crc32_test(void)
783780
nsec = ktime_get_ns() - nsec;
784781

785782
local_irq_restore(flags);
786-
local_irq_enable();
787783

788784
pr_info("crc32: CRC_LE_BITS = %d, CRC_BE BITS = %d\n",
789785
CRC_LE_BITS, CRC_BE_BITS);

‎lib/test_kasan.c

+107-42
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,12 @@ static void kmalloc_oob_16(struct kunit *test)
216216
u64 words[2];
217217
} *ptr1, *ptr2;
218218

219+
/* This test is specifically crafted for the generic mode. */
220+
if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) {
221+
kunit_info(test, "CONFIG_KASAN_GENERIC required\n");
222+
return;
223+
}
224+
219225
ptr1 = kmalloc(sizeof(*ptr1) - 3, GFP_KERNEL);
220226
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
221227

@@ -227,6 +233,23 @@ static void kmalloc_oob_16(struct kunit *test)
227233
kfree(ptr2);
228234
}
229235

236+
static void kmalloc_uaf_16(struct kunit *test)
237+
{
238+
struct {
239+
u64 words[2];
240+
} *ptr1, *ptr2;
241+
242+
ptr1 = kmalloc(sizeof(*ptr1), GFP_KERNEL);
243+
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr1);
244+
245+
ptr2 = kmalloc(sizeof(*ptr2), GFP_KERNEL);
246+
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr2);
247+
kfree(ptr2);
248+
249+
KUNIT_EXPECT_KASAN_FAIL(test, *ptr1 = *ptr2);
250+
kfree(ptr1);
251+
}
252+
230253
static void kmalloc_oob_memset_2(struct kunit *test)
231254
{
232255
char *ptr;
@@ -429,6 +452,12 @@ static void kasan_global_oob(struct kunit *test)
429452
volatile int i = 3;
430453
char *p = &global_array[ARRAY_SIZE(global_array) + i];
431454

455+
/* Only generic mode instruments globals. */
456+
if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) {
457+
kunit_info(test, "CONFIG_KASAN_GENERIC required");
458+
return;
459+
}
460+
432461
KUNIT_EXPECT_KASAN_FAIL(test, *(volatile char *)p);
433462
}
434463

@@ -467,6 +496,12 @@ static void kasan_alloca_oob_left(struct kunit *test)
467496
char alloca_array[i];
468497
char *p = alloca_array - 1;
469498

499+
/* Only generic mode instruments dynamic allocas. */
500+
if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) {
501+
kunit_info(test, "CONFIG_KASAN_GENERIC required");
502+
return;
503+
}
504+
470505
if (!IS_ENABLED(CONFIG_KASAN_STACK)) {
471506
kunit_info(test, "CONFIG_KASAN_STACK is not enabled");
472507
return;
@@ -481,6 +516,12 @@ static void kasan_alloca_oob_right(struct kunit *test)
481516
char alloca_array[i];
482517
char *p = alloca_array + i;
483518

519+
/* Only generic mode instruments dynamic allocas. */
520+
if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) {
521+
kunit_info(test, "CONFIG_KASAN_GENERIC required");
522+
return;
523+
}
524+
484525
if (!IS_ENABLED(CONFIG_KASAN_STACK)) {
485526
kunit_info(test, "CONFIG_KASAN_STACK is not enabled");
486527
return;
@@ -551,6 +592,9 @@ static void kasan_memchr(struct kunit *test)
551592
return;
552593
}
553594

595+
if (OOB_TAG_OFF)
596+
size = round_up(size, OOB_TAG_OFF);
597+
554598
ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
555599
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
556600

@@ -573,6 +617,9 @@ static void kasan_memcmp(struct kunit *test)
573617
return;
574618
}
575619

620+
if (OOB_TAG_OFF)
621+
size = round_up(size, OOB_TAG_OFF);
622+
576623
ptr = kmalloc(size, GFP_KERNEL | __GFP_ZERO);
577624
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, ptr);
578625
memset(arr, 0, sizeof(arr));
@@ -619,69 +666,85 @@ static void kasan_strings(struct kunit *test)
619666
KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = strnlen(ptr, 1));
620667
}
621668

622-
static void kasan_bitops(struct kunit *test)
669+
static void kasan_bitops_modify(struct kunit *test, int nr, void *addr)
670+
{
671+
KUNIT_EXPECT_KASAN_FAIL(test, set_bit(nr, addr));
672+
KUNIT_EXPECT_KASAN_FAIL(test, __set_bit(nr, addr));
673+
KUNIT_EXPECT_KASAN_FAIL(test, clear_bit(nr, addr));
674+
KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit(nr, addr));
675+
KUNIT_EXPECT_KASAN_FAIL(test, clear_bit_unlock(nr, addr));
676+
KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit_unlock(nr, addr));
677+
KUNIT_EXPECT_KASAN_FAIL(test, change_bit(nr, addr));
678+
KUNIT_EXPECT_KASAN_FAIL(test, __change_bit(nr, addr));
679+
}
680+
681+
static void kasan_bitops_test_and_modify(struct kunit *test, int nr, void *addr)
682+
{
683+
KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit(nr, addr));
684+
KUNIT_EXPECT_KASAN_FAIL(test, __test_and_set_bit(nr, addr));
685+
KUNIT_EXPECT_KASAN_FAIL(test, test_and_set_bit_lock(nr, addr));
686+
KUNIT_EXPECT_KASAN_FAIL(test, test_and_clear_bit(nr, addr));
687+
KUNIT_EXPECT_KASAN_FAIL(test, __test_and_clear_bit(nr, addr));
688+
KUNIT_EXPECT_KASAN_FAIL(test, test_and_change_bit(nr, addr));
689+
KUNIT_EXPECT_KASAN_FAIL(test, __test_and_change_bit(nr, addr));
690+
KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result = test_bit(nr, addr));
691+
692+
#if defined(clear_bit_unlock_is_negative_byte)
693+
KUNIT_EXPECT_KASAN_FAIL(test, kasan_int_result =
694+
clear_bit_unlock_is_negative_byte(nr, addr));
695+
#endif
696+
}
697+
698+
static void kasan_bitops_generic(struct kunit *test)
623699
{
700+
long *bits;
701+
702+
/* This test is specifically crafted for the generic mode. */
703+
if (!IS_ENABLED(CONFIG_KASAN_GENERIC)) {
704+
kunit_info(test, "CONFIG_KASAN_GENERIC required\n");
705+
return;
706+
}
707+
624708
/*
625709
* Allocate 1 more byte, which causes kzalloc to round up to 16-bytes;
626710
* this way we do not actually corrupt other memory.
627711
*/
628-
long *bits = kzalloc(sizeof(*bits) + 1, GFP_KERNEL);
712+
bits = kzalloc(sizeof(*bits) + 1, GFP_KERNEL);
629713
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits);
630714

631715
/*
632716
* Below calls try to access bit within allocated memory; however, the
633717
* below accesses are still out-of-bounds, since bitops are defined to
634718
* operate on the whole long the bit is in.
635719
*/
636-
KUNIT_EXPECT_KASAN_FAIL(test, set_bit(BITS_PER_LONG, bits));
637-
638-
KUNIT_EXPECT_KASAN_FAIL(test, __set_bit(BITS_PER_LONG, bits));
639-
640-
KUNIT_EXPECT_KASAN_FAIL(test, clear_bit(BITS_PER_LONG, bits));
641-
642-
KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit(BITS_PER_LONG, bits));
643-
644-
KUNIT_EXPECT_KASAN_FAIL(test, clear_bit_unlock(BITS_PER_LONG, bits));
645-
646-
KUNIT_EXPECT_KASAN_FAIL(test, __clear_bit_unlock(BITS_PER_LONG, bits));
647-
648-
KUNIT_EXPECT_KASAN_FAIL(test, change_bit(BITS_PER_LONG, bits));
649-
650-
KUNIT_EXPECT_KASAN_FAIL(test, __change_bit(BITS_PER_LONG, bits));
720+
kasan_bitops_modify(test, BITS_PER_LONG, bits);
651721

652722
/*
653723
* Below calls try to access bit beyond allocated memory.
654724
*/
655-
KUNIT_EXPECT_KASAN_FAIL(test,
656-
test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
657-
658-
KUNIT_EXPECT_KASAN_FAIL(test,
659-
__test_and_set_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
660-
661-
KUNIT_EXPECT_KASAN_FAIL(test,
662-
test_and_set_bit_lock(BITS_PER_LONG + BITS_PER_BYTE, bits));
725+
kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, bits);
663726

664-
KUNIT_EXPECT_KASAN_FAIL(test,
665-
test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
727+
kfree(bits);
728+
}
666729

667-
KUNIT_EXPECT_KASAN_FAIL(test,
668-
__test_and_clear_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
730+
static void kasan_bitops_tags(struct kunit *test)
731+
{
732+
long *bits;
669733

670-
KUNIT_EXPECT_KASAN_FAIL(test,
671-
test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
734+
/* This test is specifically crafted for the tag-based mode. */
735+
if (IS_ENABLED(CONFIG_KASAN_GENERIC)) {
736+
kunit_info(test, "CONFIG_KASAN_SW_TAGS required\n");
737+
return;
738+
}
672739

673-
KUNIT_EXPECT_KASAN_FAIL(test,
674-
__test_and_change_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
740+
/* Allocation size will be rounded to up granule size, which is 16. */
741+
bits = kzalloc(sizeof(*bits), GFP_KERNEL);
742+
KUNIT_ASSERT_NOT_ERR_OR_NULL(test, bits);
675743

676-
KUNIT_EXPECT_KASAN_FAIL(test,
677-
kasan_int_result =
678-
test_bit(BITS_PER_LONG + BITS_PER_BYTE, bits));
744+
/* Do the accesses past the 16 allocated bytes. */
745+
kasan_bitops_modify(test, BITS_PER_LONG, &bits[1]);
746+
kasan_bitops_test_and_modify(test, BITS_PER_LONG + BITS_PER_BYTE, &bits[1]);
679747

680-
#if defined(clear_bit_unlock_is_negative_byte)
681-
KUNIT_EXPECT_KASAN_FAIL(test,
682-
kasan_int_result = clear_bit_unlock_is_negative_byte(
683-
BITS_PER_LONG + BITS_PER_BYTE, bits));
684-
#endif
685748
kfree(bits);
686749
}
687750

@@ -728,6 +791,7 @@ static struct kunit_case kasan_kunit_test_cases[] = {
728791
KUNIT_CASE(kmalloc_oob_krealloc_more),
729792
KUNIT_CASE(kmalloc_oob_krealloc_less),
730793
KUNIT_CASE(kmalloc_oob_16),
794+
KUNIT_CASE(kmalloc_uaf_16),
731795
KUNIT_CASE(kmalloc_oob_in_memset),
732796
KUNIT_CASE(kmalloc_oob_memset_2),
733797
KUNIT_CASE(kmalloc_oob_memset_4),
@@ -751,7 +815,8 @@ static struct kunit_case kasan_kunit_test_cases[] = {
751815
KUNIT_CASE(kasan_memchr),
752816
KUNIT_CASE(kasan_memcmp),
753817
KUNIT_CASE(kasan_strings),
754-
KUNIT_CASE(kasan_bitops),
818+
KUNIT_CASE(kasan_bitops_generic),
819+
KUNIT_CASE(kasan_bitops_tags),
755820
KUNIT_CASE(kmalloc_double_kzfree),
756821
KUNIT_CASE(vmalloc_oob),
757822
{}

0 commit comments

Comments
 (0)