From: Greg Kroah-Hartman Date: Wed, 19 Apr 2017 11:30:55 +0000 (+0200) Subject: delete cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch X-Git-Tag: v4.4.63~19 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=2cb58e4b59ac24a743f90f80a5534c31543b4106;p=thirdparty%2Fkernel%2Fstable-queue.git delete cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch --- diff --git a/queue-3.18/cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch b/queue-3.18/cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch deleted file mode 100644 index 0e943afbce6..00000000000 --- a/queue-3.18/cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch +++ /dev/null @@ -1,92 +0,0 @@ -From bfb0b80db5f9dca5ac0a5fd0edb765ee555e5a8e Mon Sep 17 00:00:00 2001 -From: Zefan Li -Date: Fri, 7 Apr 2017 16:51:55 +0800 -Subject: cgroup: avoid attaching a cgroup root to two different superblocks - -From: Zefan Li - -commit bfb0b80db5f9dca5ac0a5fd0edb765ee555e5a8e upstream. - -Run this: - - touch file0 - for ((; ;)) - { - mount -t cpuset xxx file0 - } - -And this concurrently: - - touch file1 - for ((; ;)) - { - mount -t cpuset xxx file1 - } - -We'll trigger a warning like this: - - ------------[ cut here ]------------ - WARNING: CPU: 1 PID: 4675 at lib/percpu-refcount.c:317 percpu_ref_kill_and_confirm+0x92/0xb0 - percpu_ref_kill_and_confirm called more than once on css_release! - CPU: 1 PID: 4675 Comm: mount Not tainted 4.11.0-rc5+ #5 - Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007 - Call Trace: - dump_stack+0x63/0x84 - __warn+0xd1/0xf0 - warn_slowpath_fmt+0x5f/0x80 - percpu_ref_kill_and_confirm+0x92/0xb0 - cgroup_kill_sb+0x95/0xb0 - deactivate_locked_super+0x43/0x70 - deactivate_super+0x46/0x60 - ... - ---[ end trace a79f61c2a2633700 ]--- - -Here's a race: - - Thread A Thread B - - cgroup1_mount() - # alloc a new cgroup root - cgroup_setup_root() - cgroup1_mount() - # no sb yet, returns NULL - kernfs_pin_sb() - - # but succeeds in getting the refcnt, - # so re-use cgroup root - percpu_ref_tryget_live() - # alloc sb with cgroup root - cgroup_do_mount() - - cgroup_kill_sb() - # alloc another sb with same root - cgroup_do_mount() - - cgroup_kill_sb() - -We end up using the same cgroup root for two different superblocks, -so percpu_ref_kill() will be called twice on the same root when the -two superblocks are destroyed. - -We should fix to make sure the superblock pinning is really successful. - -Reported-by: Dmitry Vyukov -Signed-off-by: Zefan Li -Signed-off-by: Tejun Heo -Signed-off-by: Greg Kroah-Hartman - ---- - kernel/cgroup.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/kernel/cgroup.c -+++ b/kernel/cgroup.c -@@ -1786,7 +1786,7 @@ static struct dentry *cgroup_mount(struc - * path is super cold. Let's just sleep a bit and retry. - */ - pinned_sb = kernfs_pin_sb(root->kf_root, NULL); -- if (IS_ERR(pinned_sb) || -+ if (IS_ERR_OR_NULL(pinned_sb) || - !percpu_ref_tryget_live(&root->cgrp.self.refcnt)) { - mutex_unlock(&cgroup_mutex); - if (!IS_ERR_OR_NULL(pinned_sb)) diff --git a/queue-3.18/series b/queue-3.18/series index c833184519f..1b3a9a738a6 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -1,4 +1,3 @@ -cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch cifs-store-results-of-cifs_reopen_file-to-avoid-infinite-wait.patch input-xpad-add-support-for-razer-wildcat-gamepad.patch perf-x86-avoid-exposing-wrong-stale-data-in-intel_pmu_lbr_read_32.patch diff --git a/queue-4.10/cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch b/queue-4.10/cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch deleted file mode 100644 index 7847d8152bf..00000000000 --- a/queue-4.10/cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch +++ /dev/null @@ -1,92 +0,0 @@ -From bfb0b80db5f9dca5ac0a5fd0edb765ee555e5a8e Mon Sep 17 00:00:00 2001 -From: Zefan Li -Date: Fri, 7 Apr 2017 16:51:55 +0800 -Subject: cgroup: avoid attaching a cgroup root to two different superblocks - -From: Zefan Li - -commit bfb0b80db5f9dca5ac0a5fd0edb765ee555e5a8e upstream. - -Run this: - - touch file0 - for ((; ;)) - { - mount -t cpuset xxx file0 - } - -And this concurrently: - - touch file1 - for ((; ;)) - { - mount -t cpuset xxx file1 - } - -We'll trigger a warning like this: - - ------------[ cut here ]------------ - WARNING: CPU: 1 PID: 4675 at lib/percpu-refcount.c:317 percpu_ref_kill_and_confirm+0x92/0xb0 - percpu_ref_kill_and_confirm called more than once on css_release! - CPU: 1 PID: 4675 Comm: mount Not tainted 4.11.0-rc5+ #5 - Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007 - Call Trace: - dump_stack+0x63/0x84 - __warn+0xd1/0xf0 - warn_slowpath_fmt+0x5f/0x80 - percpu_ref_kill_and_confirm+0x92/0xb0 - cgroup_kill_sb+0x95/0xb0 - deactivate_locked_super+0x43/0x70 - deactivate_super+0x46/0x60 - ... - ---[ end trace a79f61c2a2633700 ]--- - -Here's a race: - - Thread A Thread B - - cgroup1_mount() - # alloc a new cgroup root - cgroup_setup_root() - cgroup1_mount() - # no sb yet, returns NULL - kernfs_pin_sb() - - # but succeeds in getting the refcnt, - # so re-use cgroup root - percpu_ref_tryget_live() - # alloc sb with cgroup root - cgroup_do_mount() - - cgroup_kill_sb() - # alloc another sb with same root - cgroup_do_mount() - - cgroup_kill_sb() - -We end up using the same cgroup root for two different superblocks, -so percpu_ref_kill() will be called twice on the same root when the -two superblocks are destroyed. - -We should fix to make sure the superblock pinning is really successful. - -Reported-by: Dmitry Vyukov -Signed-off-by: Zefan Li -Signed-off-by: Tejun Heo -Signed-off-by: Greg Kroah-Hartman - ---- - kernel/cgroup.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/kernel/cgroup.c -+++ b/kernel/cgroup.c -@@ -2195,7 +2195,7 @@ static struct dentry *cgroup_mount(struc - * path is super cold. Let's just sleep a bit and retry. - */ - pinned_sb = kernfs_pin_sb(root->kf_root, NULL); -- if (IS_ERR(pinned_sb) || -+ if (IS_ERR_OR_NULL(pinned_sb) || - !percpu_ref_tryget_live(&root->cgrp.self.refcnt)) { - mutex_unlock(&cgroup_mutex); - if (!IS_ERR_OR_NULL(pinned_sb)) diff --git a/queue-4.10/series b/queue-4.10/series index 266e05a8c51..e9a477c63ae 100644 --- a/queue-4.10/series +++ b/queue-4.10/series @@ -1,4 +1,3 @@ -cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch cgroup-kthread-close-race-window-where-new-kthreads-can-be-migrated-to-non-root-cgroups.patch audit-make-sure-we-don-t-let-the-retry-queue-grow-without-bounds.patch tcmu-fix-possible-overwrite-of-t_data_sg-s-last-iov.patch diff --git a/queue-4.4/cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch b/queue-4.4/cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch deleted file mode 100644 index 54a04540503..00000000000 --- a/queue-4.4/cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch +++ /dev/null @@ -1,92 +0,0 @@ -From bfb0b80db5f9dca5ac0a5fd0edb765ee555e5a8e Mon Sep 17 00:00:00 2001 -From: Zefan Li -Date: Fri, 7 Apr 2017 16:51:55 +0800 -Subject: cgroup: avoid attaching a cgroup root to two different superblocks - -From: Zefan Li - -commit bfb0b80db5f9dca5ac0a5fd0edb765ee555e5a8e upstream. - -Run this: - - touch file0 - for ((; ;)) - { - mount -t cpuset xxx file0 - } - -And this concurrently: - - touch file1 - for ((; ;)) - { - mount -t cpuset xxx file1 - } - -We'll trigger a warning like this: - - ------------[ cut here ]------------ - WARNING: CPU: 1 PID: 4675 at lib/percpu-refcount.c:317 percpu_ref_kill_and_confirm+0x92/0xb0 - percpu_ref_kill_and_confirm called more than once on css_release! - CPU: 1 PID: 4675 Comm: mount Not tainted 4.11.0-rc5+ #5 - Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007 - Call Trace: - dump_stack+0x63/0x84 - __warn+0xd1/0xf0 - warn_slowpath_fmt+0x5f/0x80 - percpu_ref_kill_and_confirm+0x92/0xb0 - cgroup_kill_sb+0x95/0xb0 - deactivate_locked_super+0x43/0x70 - deactivate_super+0x46/0x60 - ... - ---[ end trace a79f61c2a2633700 ]--- - -Here's a race: - - Thread A Thread B - - cgroup1_mount() - # alloc a new cgroup root - cgroup_setup_root() - cgroup1_mount() - # no sb yet, returns NULL - kernfs_pin_sb() - - # but succeeds in getting the refcnt, - # so re-use cgroup root - percpu_ref_tryget_live() - # alloc sb with cgroup root - cgroup_do_mount() - - cgroup_kill_sb() - # alloc another sb with same root - cgroup_do_mount() - - cgroup_kill_sb() - -We end up using the same cgroup root for two different superblocks, -so percpu_ref_kill() will be called twice on the same root when the -two superblocks are destroyed. - -We should fix to make sure the superblock pinning is really successful. - -Reported-by: Dmitry Vyukov -Signed-off-by: Zefan Li -Signed-off-by: Tejun Heo -Signed-off-by: Greg Kroah-Hartman - ---- - kernel/cgroup.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/kernel/cgroup.c -+++ b/kernel/cgroup.c -@@ -2105,7 +2105,7 @@ static struct dentry *cgroup_mount(struc - * path is super cold. Let's just sleep a bit and retry. - */ - pinned_sb = kernfs_pin_sb(root->kf_root, NULL); -- if (IS_ERR(pinned_sb) || -+ if (IS_ERR_OR_NULL(pinned_sb) || - !percpu_ref_tryget_live(&root->cgrp.self.refcnt)) { - mutex_unlock(&cgroup_mutex); - if (!IS_ERR_OR_NULL(pinned_sb)) diff --git a/queue-4.4/series b/queue-4.4/series index ed292f0f4dc..270680505a9 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -1,4 +1,3 @@ -cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch cgroup-kthread-close-race-window-where-new-kthreads-can-be-migrated-to-non-root-cgroups.patch thp-fix-madv_dontneed-vs-clear-soft-dirty-race.patch zram-fix-operator-precedence-to-get-offset.patch diff --git a/queue-4.9/cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch b/queue-4.9/cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch deleted file mode 100644 index 7847d8152bf..00000000000 --- a/queue-4.9/cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch +++ /dev/null @@ -1,92 +0,0 @@ -From bfb0b80db5f9dca5ac0a5fd0edb765ee555e5a8e Mon Sep 17 00:00:00 2001 -From: Zefan Li -Date: Fri, 7 Apr 2017 16:51:55 +0800 -Subject: cgroup: avoid attaching a cgroup root to two different superblocks - -From: Zefan Li - -commit bfb0b80db5f9dca5ac0a5fd0edb765ee555e5a8e upstream. - -Run this: - - touch file0 - for ((; ;)) - { - mount -t cpuset xxx file0 - } - -And this concurrently: - - touch file1 - for ((; ;)) - { - mount -t cpuset xxx file1 - } - -We'll trigger a warning like this: - - ------------[ cut here ]------------ - WARNING: CPU: 1 PID: 4675 at lib/percpu-refcount.c:317 percpu_ref_kill_and_confirm+0x92/0xb0 - percpu_ref_kill_and_confirm called more than once on css_release! - CPU: 1 PID: 4675 Comm: mount Not tainted 4.11.0-rc5+ #5 - Hardware name: Bochs Bochs, BIOS Bochs 01/01/2007 - Call Trace: - dump_stack+0x63/0x84 - __warn+0xd1/0xf0 - warn_slowpath_fmt+0x5f/0x80 - percpu_ref_kill_and_confirm+0x92/0xb0 - cgroup_kill_sb+0x95/0xb0 - deactivate_locked_super+0x43/0x70 - deactivate_super+0x46/0x60 - ... - ---[ end trace a79f61c2a2633700 ]--- - -Here's a race: - - Thread A Thread B - - cgroup1_mount() - # alloc a new cgroup root - cgroup_setup_root() - cgroup1_mount() - # no sb yet, returns NULL - kernfs_pin_sb() - - # but succeeds in getting the refcnt, - # so re-use cgroup root - percpu_ref_tryget_live() - # alloc sb with cgroup root - cgroup_do_mount() - - cgroup_kill_sb() - # alloc another sb with same root - cgroup_do_mount() - - cgroup_kill_sb() - -We end up using the same cgroup root for two different superblocks, -so percpu_ref_kill() will be called twice on the same root when the -two superblocks are destroyed. - -We should fix to make sure the superblock pinning is really successful. - -Reported-by: Dmitry Vyukov -Signed-off-by: Zefan Li -Signed-off-by: Tejun Heo -Signed-off-by: Greg Kroah-Hartman - ---- - kernel/cgroup.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/kernel/cgroup.c -+++ b/kernel/cgroup.c -@@ -2195,7 +2195,7 @@ static struct dentry *cgroup_mount(struc - * path is super cold. Let's just sleep a bit and retry. - */ - pinned_sb = kernfs_pin_sb(root->kf_root, NULL); -- if (IS_ERR(pinned_sb) || -+ if (IS_ERR_OR_NULL(pinned_sb) || - !percpu_ref_tryget_live(&root->cgrp.self.refcnt)) { - mutex_unlock(&cgroup_mutex); - if (!IS_ERR_OR_NULL(pinned_sb)) diff --git a/queue-4.9/series b/queue-4.9/series index c1d989b0e5d..9e7d0c73b56 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -1,4 +1,3 @@ -cgroup-avoid-attaching-a-cgroup-root-to-two-different-superblocks.patch cgroup-kthread-close-race-window-where-new-kthreads-can-be-migrated-to-non-root-cgroups.patch tcmu-fix-possible-overwrite-of-t_data_sg-s-last-iov.patch tcmu-fix-wrongly-calculating-of-the-base_command_size.patch