* Re: [syzbot] [fs?] WARNING in nsproxy_ns_active_put
From: Christian Brauner @ 2025-11-11 11:23 UTC (permalink / raw)
To: syzbot
Cc: akpm, bpf, bsegall, david, dietmar.eggemann, jack, jsavitz,
juri.lelli, kartikey406, kees, liam.howlett, linux-fsdevel,
linux-kernel, linux-mm, linux-security-module, lorenzo.stoakes,
mgorman, mhocko, mingo, mjguzik, oleg, paul, peterz, rostedt,
rppt, sergeh, surenb, syzkaller-bugs, vbabka, vincent.guittot,
viro, vschneid
In-Reply-To: <691317ab.a70a0220.22f260.0135.GAE@google.com>
On Tue, Nov 11, 2025 at 03:02:03AM -0800, syzbot wrote:
> Hello,
>
> syzbot tried to test the proposed patch but the build/boot failed:
I think that's unrelated. Anyway, I managed to point this to the wrong
branch. I'll send another test request in a bit.
^ permalink raw reply
* Re: [syzbot] [fs?] WARNING in nsproxy_ns_active_put
From: Christian Brauner @ 2025-11-11 11:38 UTC (permalink / raw)
To: syzbot
Cc: akpm, bpf, bsegall, david, dietmar.eggemann, jack, jsavitz,
juri.lelli, kartikey406, kees, liam.howlett, linux-fsdevel,
linux-kernel, linux-mm, linux-security-module, lorenzo.stoakes,
mgorman, mhocko, mingo, mjguzik, oleg, paul, peterz, rostedt,
rppt, sergeh, surenb, syzkaller-bugs, vbabka, vincent.guittot,
viro, vschneid
In-Reply-To: <20251111-dozent-losgefahren-0a3a086b293e@brauner>
On Tue, Nov 11, 2025 at 12:23:18PM +0100, Christian Brauner wrote:
> On Tue, Nov 11, 2025 at 03:02:03AM -0800, syzbot wrote:
> > Hello,
> >
> > syzbot tried to test the proposed patch but the build/boot failed:
>
> I think that's unrelated. Anyway, I managed to point this to the wrong
> branch. I'll send another test request in a bit.
#syz test: https://github.com/brauner/linux.git namespace-6.19
^ permalink raw reply
* Re: [Patch V1] ima: avoid duplicate policy rules insertions
From: Mimi Zohar @ 2025-11-11 11:40 UTC (permalink / raw)
To: Tahera Fahimi, roberto.sassu, dmitry.kasatkin, eric.snowberg,
paul, jmorris, serge, linux-integrity, linux-security-module,
linux-kernel, code
Cc: Lennart Poettering
In-Reply-To: <20251106181404.3429710-1-taherafahimi@linux.microsoft.com>
[Cc'ing Lennart Poettering]
On Thu, 2025-11-06 at 18:14 +0000, Tahera Fahimi wrote:
> Prevent redundant IMA policy rules by checking for duplicates before insertion. This ensures that
> rules are not re-added when userspace is restarted (using systemd-soft-reboot) without a full system
> reboot. ima_rule_exists() detects duplicates in both temporary and active rule lists.
>
> Signed-off-by: Tahera Fahimi <taherafahimi@linux.microsoft.com>
Sorry for the delay in responding ...
Before trying to fix the "problem", let's try to understand it first. At least
on my test system (-rc5), kexec is working as designed. On boot, systemd
replaces the existing builtin IMA policy with a custom IMA policy. The arch
specific policies are not affected, as they are persistent. On a soft reboot
(kexec), the IMA custom policy is re-loaded as expected.
To verify the above behavior, extend the IMA policy before the soft reboot.
Notice after the soft reboot that the original custom IMA policy is loaded and
not the extended IMA policy. Roberto, if there is a problem with this behavior,
we'll discuss it independently of this proposed patch.
The question is why are you seeing duplicate IMA policy rules? What is special
about your environment?
--
thanks,
Mimi
^ permalink raw reply
* Re: [PATCH 1/2] fs: add iput_not_last()
From: Christian Brauner @ 2025-11-11 11:46 UTC (permalink / raw)
To: mic, Mateusz Guzik
Cc: Christian Brauner, linux-security-module, linux-fsdevel, viro,
eadavis, gnoack, jack, jannh, max.kellermann, m,
syzbot+12479ae15958fc3f54ec
In-Reply-To: <20251105212025.807549-1-mjguzik@gmail.com>
On Wed, 05 Nov 2025 22:20:24 +0100, Mateusz Guzik wrote:
>
Applied to the vfs-6.19.inode branch of the vfs/vfs.git tree.
Patches in the vfs-6.19.inode branch should appear in linux-next soon.
Please report any outstanding bugs that were missed during review in a
new review to the original patch series allowing us to drop it.
It's encouraged to provide Acked-bys and Reviewed-bys even though the
patch has now been applied. If possible patch trailers will be updated.
Note that commit hashes shown below are subject to change due to rebase,
trailer updates or similar. If in doubt, please check the listed branch.
tree: https://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs.git
branch: vfs-6.19.inode
[1/2] fs: add iput_not_last()
https://git.kernel.org/vfs/vfs/c/a1cece5d8881
[2/2] landlock: fix splats from iput() after it started calling might_sleep()
https://git.kernel.org/vfs/vfs/c/9638e5c3b673
^ permalink raw reply
* Re: [PATCH 1/2] fs: add iput_not_last()
From: Mateusz Guzik @ 2025-11-11 11:53 UTC (permalink / raw)
To: Christian Brauner
Cc: mic, linux-security-module, linux-fsdevel, viro, eadavis, gnoack,
jack, jannh, max.kellermann, m, syzbot+12479ae15958fc3f54ec
In-Reply-To: <20251111-fluss-vokabel-7be060af7f11@brauner>
On Tue, Nov 11, 2025 at 12:46 PM Christian Brauner <brauner@kernel.org> wrote:
>
> On Wed, 05 Nov 2025 22:20:24 +0100, Mateusz Guzik wrote:
> >
>
>
> Applied to the vfs-6.19.inode branch of the vfs/vfs.git tree.
> Patches in the vfs-6.19.inode branch should appear in linux-next soon.
>
That might_sleep in iput is already in master slated for 6.18, so this
should land in vfs.fixes instead.
^ permalink raw reply
* Re: [syzbot] [fs?] WARNING in nsproxy_ns_active_put
From: syzbot @ 2025-11-11 13:03 UTC (permalink / raw)
To: akpm, bpf, brauner, bsegall, david, dietmar.eggemann, jack,
jsavitz, juri.lelli, kartikey406, kees, liam.howlett,
linux-fsdevel, linux-kernel, linux-mm, linux-security-module,
lorenzo.stoakes, mgorman, mhocko, mingo, mjguzik, oleg, paul,
peterz, rostedt, rppt, sergeh, surenb, syzkaller-bugs, vbabka,
vincent.guittot, viro, vschneid
In-Reply-To: <20251111-covern-deklamieren-ee89b7b4e502@brauner>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING in __ns_ref_active_put
------------[ cut here ]------------
WARNING: CPU: 0 PID: 6581 at kernel/nscommon.c:171 __ns_ref_active_put+0x3d7/0x450 kernel/nscommon.c:171
Modules linked in:
CPU: 0 UID: 0 PID: 6581 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
RIP: 0010:__ns_ref_active_put+0x3d7/0x450 kernel/nscommon.c:171
Code: 4d 8b 3e e9 1b fd ff ff e8 76 62 32 00 90 0f 0b 90 e9 29 fd ff ff e8 68 62 32 00 90 0f 0b 90 e9 59 fd ff ff e8 5a 62 32 00 90 <0f> 0b 90 e9 72 ff ff ff e8 4c 62 32 00 90 0f 0b 90 e9 64 ff ff ff
RSP: 0018:ffffc9000238fd68 EFLAGS: 00010293
RAX: ffffffff818e5946 RBX: 00000000ffffffff RCX: ffff8880302ebc80
RDX: 0000000000000000 RSI: 00000000ffffffff RDI: 0000000000000000
RBP: ffffc9000238fe00 R08: ffff888078968c2b R09: 1ffff1100f12d185
R10: dffffc0000000000 R11: ffffed100f12d186 R12: dffffc0000000000
R13: 1ffff1100f12d184 R14: ffff888078968c20 R15: ffff888078968c28
FS: 00007efc0fd536c0(0000) GS:ffff888125cf3000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b33263fff CR3: 0000000030876000 CR4: 00000000003526f0
Call Trace:
<TASK>
nsproxy_ns_active_put+0x4a/0x200 fs/nsfs.c:701
free_nsproxy kernel/nsproxy.c:80 [inline]
put_nsset kernel/nsproxy.c:316 [inline]
__do_sys_setns kernel/nsproxy.c:-1 [inline]
__se_sys_setns+0x1349/0x1b60 kernel/nsproxy.c:534
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7efc0ef90ef7
Code: 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 34 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007efc0fd52fd8 EFLAGS: 00000246 ORIG_RAX: 0000000000000134
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007efc0ef90ef7
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000000000c9
RBP: 00007efc0f011f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007efc0f1e6038 R14: 00007efc0f1e5fa0 R15: 00007fff5692b648
</TASK>
Tested on:
commit: cc719c88 nsproxy: fix free_nsproxy() and simplify crea..
git tree: https://github.com/brauner/linux.git namespace-6.19
console output: https://syzkaller.appspot.com/x/log.txt?x=1613f17c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=59952e73920025e4
dashboard link: https://syzkaller.appspot.com/bug?extid=0b2e79f91ff6579bfa5b
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Note: no patches were applied.
^ permalink raw reply
* Re: [PATCH v17] exec: Fix dead-lock in de_thread with ptrace_attach
From: Oleg Nesterov @ 2025-11-11 13:12 UTC (permalink / raw)
To: Bernd Edlinger
Cc: Christian Brauner, Alexander Viro, Alexey Dobriyan, Kees Cook,
Andy Lutomirski, Will Drewry, Andrew Morton, Michal Hocko,
Serge Hallyn, James Morris, Randy Dunlap, Suren Baghdasaryan,
Yafang Shao, Helge Deller, Eric W. Biederman, Adrian Reber,
Thomas Gleixner, Jens Axboe, Alexei Starovoitov,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-kselftest, linux-mm, linux-security-module, tiozhang,
Luis Chamberlain, Paulo Alcantara (SUSE), Sergey Senozhatsky,
Frederic Weisbecker, YueHaibing, Paul Moore, Aleksa Sarai,
Stefan Roesch, Chao Yu, xu xin, Jeff Layton, Jan Kara,
David Hildenbrand, Dave Chinner, Shuah Khan, Elena Reshetova,
David Windsor, Mateusz Guzik, Ard Biesheuvel,
Joel Fernandes (Google), Matthew Wilcox (Oracle),
Hans Liljestrand, Penglei Jiang, Lorenzo Stoakes, Adrian Ratiu,
Ingo Molnar, Peter Zijlstra (Intel), Cyrill Gorcunov,
Eric Dumazet
In-Reply-To: <GV2PPF74270EBEEDCF80CEE0F08891ED37BE4CFA@GV2PPF74270EBEE.EURP195.PROD.OUTLOOK.COM>
On 11/11, Bernd Edlinger wrote:
>
> On 11/11/25 10:21, Christian Brauner wrote:
> > On Wed, Nov 05, 2025 at 03:32:10PM +0100, Oleg Nesterov wrote:
> >>
> >> This is the most problematic change which I can't review...
> >>
> >> Firstly, it changes task->mm/real_cred for __ptrace_may_access() and this
> >> looks dangerous to me.
> >
> > Yeah, that is not ok. This is effectively override_creds for real_cred
> > and that is not a pattern I want to see us establish at all! Temporary
> > credential overrides for the subjective credentials is already terrible
> > but at least we have the explicit split between real_cred and cred
> > expressely for that. So no, that's not an acceptable solution.
> >
>
> Well when this is absolutely not acceptable then I would have to change
> all security engines to be aware of the current and the new credentials.
Hmm... even if we find another way to avoid the deadlock? Say, the patches
I sent...
Oleg.
^ permalink raw reply
* Re: [PATCH v17] exec: Fix dead-lock in de_thread with ptrace_attach
From: Bernd Edlinger @ 2025-11-11 13:45 UTC (permalink / raw)
To: Oleg Nesterov
Cc: Christian Brauner, Alexander Viro, Alexey Dobriyan, Kees Cook,
Andy Lutomirski, Will Drewry, Andrew Morton, Michal Hocko,
Serge Hallyn, James Morris, Randy Dunlap, Suren Baghdasaryan,
Yafang Shao, Helge Deller, Eric W. Biederman, Adrian Reber,
Thomas Gleixner, Jens Axboe, Alexei Starovoitov,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-kselftest, linux-mm, linux-security-module, tiozhang,
Luis Chamberlain, Paulo Alcantara (SUSE), Sergey Senozhatsky,
Frederic Weisbecker, YueHaibing, Paul Moore, Aleksa Sarai,
Stefan Roesch, Chao Yu, xu xin, Jeff Layton, Jan Kara,
David Hildenbrand, Dave Chinner, Shuah Khan, Elena Reshetova,
David Windsor, Mateusz Guzik, Ard Biesheuvel,
Joel Fernandes (Google), Matthew Wilcox (Oracle),
Hans Liljestrand, Penglei Jiang, Lorenzo Stoakes, Adrian Ratiu,
Ingo Molnar, Peter Zijlstra (Intel), Cyrill Gorcunov,
Eric Dumazet
In-Reply-To: <aRM2POTDTxEzeF2F@redhat.com>
On 11/11/25 14:12, Oleg Nesterov wrote:
> On 11/11, Bernd Edlinger wrote:
>>
>> On 11/11/25 10:21, Christian Brauner wrote:
>>> On Wed, Nov 05, 2025 at 03:32:10PM +0100, Oleg Nesterov wrote:
>>>>
>>>> This is the most problematic change which I can't review...
>>>>
>>>> Firstly, it changes task->mm/real_cred for __ptrace_may_access() and this
>>>> looks dangerous to me.
>>>
>>> Yeah, that is not ok. This is effectively override_creds for real_cred
>>> and that is not a pattern I want to see us establish at all! Temporary
>>> credential overrides for the subjective credentials is already terrible
>>> but at least we have the explicit split between real_cred and cred
>>> expressely for that. So no, that's not an acceptable solution.
>>>
>>
>> Well when this is absolutely not acceptable then I would have to change
>> all security engines to be aware of the current and the new credentials.
>
> Hmm... even if we find another way to avoid the deadlock? Say, the patches
> I sent...
>
Maybe, but it looks almost too simple ;-)
164 sleep(2);
165 /* deadlock may happen here */
166 k = ptrace(PTRACE_ATTACH, thread2_tid, 0L, 0L);
what happens if you change the test expectation here, that the
ptrace may fail instead of succeed?
What signals does the debugger receive after that point?
Is the debugger notified that the debugged process continues,
has the same PID, and is no longer ptraced?
Thanks
Bernd.
> Oleg.
>
^ permalink raw reply
* Re: [RFC PATCH 2/3] exec: don't wait for zombie threads with cred_guard_mutex held
From: Oleg Nesterov @ 2025-11-11 14:09 UTC (permalink / raw)
To: Cyrill Gorcunov
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-kselftest, linux-mm, linux-security-module
In-Reply-To: <aRJd8Z-DrYrjRt4r@grain>
On 11/11, Cyrill Gorcunov wrote:
>
> Anyway while looking into patch I got wonder why
>
> +static int wait_for_notify_count(struct task_struct *tsk)
> +{
> + for (;;) {
> + return -EINTR;
> + set_current_state(TASK_KILLABLE);
> + if (!tsk->signal->notify_count)
> + break;
>
> We have no any barrier here in fetching @notify_count? I mean updating
> this value is done under locks (spin or read/write) in turn condition
> test is a raw one. Not a big deal since set_current_state() and schedule()
Yes, so I think that, correctness-wise, this doesn't need additional barriers.
> but I've
> been a bit confused that we don't use some read_once here or something.
Yes, this needs READ_ONCE() to avoid the warnings from KCSAN. And in fact
this code was written with READ_ONCE() but I removed it before sending this
RFC.
I was going to do this later. I always forget how KCSAN works, IIUC I also
need to add WRITE_ONCE() into exit_notify() and __exit_signal() to make
KCSAN happy, even if ->notify_count is always updated under the lock.
Same for the "if (me->signal->group_exec_task == me)" check in begin_new_exec().
Right now I would like to know if this RFC (approach) makes any sense,
especially because 3/3 adds a user-visible change.
Oleg.
^ permalink raw reply
* Re: [syzbot] [fs?] WARNING in nsproxy_ns_active_put
From: Christian Brauner @ 2025-11-11 15:07 UTC (permalink / raw)
To: syzbot
Cc: akpm, bpf, bsegall, david, dietmar.eggemann, jack, jsavitz,
juri.lelli, kartikey406, kees, liam.howlett, linux-fsdevel,
linux-kernel, linux-mm, linux-security-module, lorenzo.stoakes,
mgorman, mhocko, mingo, mjguzik, oleg, paul, peterz, rostedt,
rppt, sergeh, surenb, syzkaller-bugs, vbabka, vincent.guittot,
viro, vschneid
In-Reply-To: <69133407.a70a0220.22f260.0138.GAE@google.com>
On Tue, Nov 11, 2025 at 05:03:03AM -0800, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch but the reproducer is still triggering an issue:
> WARNING in __ns_ref_active_put
#syz test: https://github.com/brauner/linux.git namespace-6.19
Groan, forgot the actual important bit after the cleanup:
* Called from unshare. Unshare all the namespaces part of nsproxy.
* On success, returns the new nsproxy.
@@ -338,7 +313,7 @@ static void put_nsset(struct nsset *nsset)
if (nsset->fs && (flags & CLONE_NEWNS) && (flags & ~CLONE_NEWNS))
free_fs_struct(nsset->fs);
if (nsset->nsproxy)
- free_nsproxy(nsset->nsproxy);
+ nsproxy_free(nsset->nsproxy);
}
^ permalink raw reply
* Re: [syzbot] [fs?] WARNING in nsproxy_ns_active_put
From: syzbot @ 2025-11-11 16:14 UTC (permalink / raw)
To: akpm, bpf, brauner, bsegall, david, dietmar.eggemann, jack,
jsavitz, juri.lelli, kartikey406, kees, liam.howlett,
linux-fsdevel, linux-kernel, linux-mm, linux-security-module,
lorenzo.stoakes, mgorman, mhocko, mingo, mjguzik, oleg, paul,
peterz, rostedt, rppt, sergeh, surenb, syzkaller-bugs, vbabka,
vincent.guittot, viro, vschneid
In-Reply-To: <20251111-gaspipeline-getippt-9b19b62f89d2@brauner>
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+0b2e79f91ff6579bfa5b@syzkaller.appspotmail.com
Tested-by: syzbot+0b2e79f91ff6579bfa5b@syzkaller.appspotmail.com
Tested on:
commit: d2bab7f2 nsproxy: fix free_nsproxy() and simplify crea..
git tree: https://github.com/brauner/linux.git namespace-6.19
console output: https://syzkaller.appspot.com/x/log.txt?x=123a8658580000
kernel config: https://syzkaller.appspot.com/x/.config?x=59952e73920025e4
dashboard link: https://syzkaller.appspot.com/bug?extid=0b2e79f91ff6579bfa5b
compiler: Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
Note: no patches were applied.
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply
* Re: Module signing and post-quantum crypto public key algorithms
From: Simo Sorce @ 2025-11-11 16:14 UTC (permalink / raw)
To: Elliott, Robert (Servers), David Howells
Cc: James Bottomley, Ignat Korchagin, Herbert Xu, Stephan Mueller,
torvalds@linux-foundation.org, Paul Moore, Lukas Wunner,
Clemens Lang, David Bohannon, Roberto Sassu,
keyrings@vger.kernel.org, linux-crypto@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org
In-Reply-To: <IA4PR84MB4011485C0EFFFF9F2820A1BFABC1A@IA4PR84MB4011.NAMPRD84.PROD.OUTLOOK.COM>
On Sun, 2025-11-09 at 19:30 +0000, Elliott, Robert (Servers) wrote:
> The composite motivation is to provide some protection if someone
> discovers a basic flaw in the PQC algorithm. If quantum computers
> haven't arrived yet to break the traditional algorithm, the
> composite still proves validity.
Given you quoted me wrt composite signatures, I'd like to make clear I
do *not* necessarily favor it.
Unlike regular software or firmware, kernel modules are generally tied
to a specific version of the kernel, therefore there is no real need
for long term resistance (unless you plan to never upgrade a kernel).
If a defect in a signing algorithm is found you can simply distribute a
new kernel with modules resigned with a different algorithm.
The problem of using composite algorithms are many:
- You need composite keys (or at least two keys, depending on the
implementation).
- You will pay a higher price in terms of CPU/time for verification for
each signature.
- You will pay a higher price in terms of disk/ram space to store
multiple signatures.
It is generally not worth paying this price when the remediation is
easy.
--
Simo Sorce
Distinguished Engineer
RHEL Crypto Team
Red Hat, Inc
^ permalink raw reply
* Re: Module signing and post-quantum crypto public key algorithms
From: David Howells @ 2025-11-11 18:38 UTC (permalink / raw)
To: Simo Sorce
Cc: dhowells, Elliott, Robert (Servers), James Bottomley,
Ignat Korchagin, Herbert Xu, Stephan Mueller,
torvalds@linux-foundation.org, Paul Moore, Lukas Wunner,
Clemens Lang, David Bohannon, Roberto Sassu,
keyrings@vger.kernel.org, linux-crypto@vger.kernel.org,
linux-security-module@vger.kernel.org,
linux-kernel@vger.kernel.org
In-Reply-To: <1ce413b202ca7c008e077a6f1cfa88f94a3a7cbd.camel@redhat.com>
Simo Sorce <simo@redhat.com> wrote:
> If a defect in a signing algorithm is found you can simply distribute a
> new kernel with modules resigned with a different algorithm.
Probably more "have to" than "can". The cert providing the composite key for
both would have to be invalidated to stop it from being used - and invalidated
by having it added to the UEFI dbx table.
David
^ permalink raw reply
* [PATCH] nsproxy: fix free_nsproxy() and simplify create_new_namespaces()
From: Christian Brauner @ 2025-11-11 21:29 UTC (permalink / raw)
To: syzbot
Cc: Christian Brauner, akpm, bpf, bsegall, david, dietmar.eggemann,
jack, jsavitz, juri.lelli, kartikey406, kees, liam.howlett,
linux-fsdevel, linux-kernel, linux-mm, linux-security-module,
lorenzo.stoakes, mgorman, mhocko, mingo, mjguzik, oleg, paul,
peterz, rostedt, rppt, sergeh, surenb, syzkaller-bugs, vbabka,
vincent.guittot, viro, vschneid, syzbot+0a8655a80e189278487e
In-Reply-To: <691360cc.a70a0220.22f260.013e.GAE@google.com>
Make it possible to handle NULL being passed to the reference count
helpers instead of forcing the caller to handle this. Afterwards we can
nicely allow a cleanup guard to handle nsproxy freeing.
Active reference count handling is not done in nsproxy_free() but rather
in free_nsproxy() as nsproxy_free() is also called from setns() failure
paths where a new nsproxy has been prepared but has not been marked as
active via switch_task_namespaces().
Fixes: 3c9820d5c64a ("ns: add active reference count")
Reported-by: syzbot+0b2e79f91ff6579bfa5b@syzkaller.appspotmail.com
Reported-by: syzbot+0a8655a80e189278487e@syzkaller.appspotmail.com
Link: https://lore.kernel.org/690bfb9e.050a0220.2e3c35.0013.GAE@google.com
Signed-off-by: Christian Brauner <brauner@kernel.org>
---
include/linux/ns_common.h | 11 ++--
kernel/nsproxy.c | 107 +++++++++++++++-----------------------
2 files changed, 48 insertions(+), 70 deletions(-)
diff --git a/include/linux/ns_common.h b/include/linux/ns_common.h
index 136f6a322e53..825f5865bfc5 100644
--- a/include/linux/ns_common.h
+++ b/include/linux/ns_common.h
@@ -114,11 +114,14 @@ static __always_inline __must_check bool __ns_ref_dec_and_lock(struct ns_common
}
#define ns_ref_read(__ns) __ns_ref_read(to_ns_common((__ns)))
-#define ns_ref_inc(__ns) __ns_ref_inc(to_ns_common((__ns)))
-#define ns_ref_get(__ns) __ns_ref_get(to_ns_common((__ns)))
-#define ns_ref_put(__ns) __ns_ref_put(to_ns_common((__ns)))
+#define ns_ref_inc(__ns) \
+ do { if (__ns) __ns_ref_inc(to_ns_common((__ns))); } while (0)
+#define ns_ref_get(__ns) \
+ ((__ns) ? __ns_ref_get(to_ns_common((__ns))) : false)
+#define ns_ref_put(__ns) \
+ ((__ns) ? __ns_ref_put(to_ns_common((__ns))) : false)
#define ns_ref_put_and_lock(__ns, __ns_lock) \
- __ns_ref_dec_and_lock(to_ns_common((__ns)), __ns_lock)
+ ((__ns) ? __ns_ref_dec_and_lock(to_ns_common((__ns)), __ns_lock) : false)
#define ns_ref_active_read(__ns) \
((__ns) ? __ns_ref_active_read(to_ns_common(__ns)) : 0)
diff --git a/kernel/nsproxy.c b/kernel/nsproxy.c
index 94c2cfe0afa1..2c94452dc793 100644
--- a/kernel/nsproxy.c
+++ b/kernel/nsproxy.c
@@ -60,6 +60,27 @@ static inline struct nsproxy *create_nsproxy(void)
return nsproxy;
}
+static inline void nsproxy_free(struct nsproxy *ns)
+{
+ put_mnt_ns(ns->mnt_ns);
+ put_uts_ns(ns->uts_ns);
+ put_ipc_ns(ns->ipc_ns);
+ put_pid_ns(ns->pid_ns_for_children);
+ put_time_ns(ns->time_ns);
+ put_time_ns(ns->time_ns_for_children);
+ put_cgroup_ns(ns->cgroup_ns);
+ put_net(ns->net_ns);
+ kmem_cache_free(nsproxy_cachep, ns);
+}
+
+DEFINE_FREE(nsproxy_free, struct nsproxy *, if (_T) nsproxy_free(_T))
+
+void free_nsproxy(struct nsproxy *ns)
+{
+ nsproxy_ns_active_put(ns);
+ nsproxy_free(ns);
+}
+
/*
* Create new nsproxy and all of its the associated namespaces.
* Return the newly created nsproxy. Do not attach this to the task,
@@ -69,76 +90,45 @@ static struct nsproxy *create_new_namespaces(u64 flags,
struct task_struct *tsk, struct user_namespace *user_ns,
struct fs_struct *new_fs)
{
- struct nsproxy *new_nsp;
- int err;
+ struct nsproxy *new_nsp __free(nsproxy_free) = NULL;
new_nsp = create_nsproxy();
if (!new_nsp)
return ERR_PTR(-ENOMEM);
new_nsp->mnt_ns = copy_mnt_ns(flags, tsk->nsproxy->mnt_ns, user_ns, new_fs);
- if (IS_ERR(new_nsp->mnt_ns)) {
- err = PTR_ERR(new_nsp->mnt_ns);
- goto out_ns;
- }
+ if (IS_ERR(new_nsp->mnt_ns))
+ return ERR_CAST(new_nsp->mnt_ns);
new_nsp->uts_ns = copy_utsname(flags, user_ns, tsk->nsproxy->uts_ns);
- if (IS_ERR(new_nsp->uts_ns)) {
- err = PTR_ERR(new_nsp->uts_ns);
- goto out_uts;
- }
+ if (IS_ERR(new_nsp->uts_ns))
+ return ERR_CAST(new_nsp->uts_ns);
new_nsp->ipc_ns = copy_ipcs(flags, user_ns, tsk->nsproxy->ipc_ns);
- if (IS_ERR(new_nsp->ipc_ns)) {
- err = PTR_ERR(new_nsp->ipc_ns);
- goto out_ipc;
- }
+ if (IS_ERR(new_nsp->ipc_ns))
+ return ERR_CAST(new_nsp->ipc_ns);
- new_nsp->pid_ns_for_children =
- copy_pid_ns(flags, user_ns, tsk->nsproxy->pid_ns_for_children);
- if (IS_ERR(new_nsp->pid_ns_for_children)) {
- err = PTR_ERR(new_nsp->pid_ns_for_children);
- goto out_pid;
- }
+ new_nsp->pid_ns_for_children = copy_pid_ns(flags, user_ns,
+ tsk->nsproxy->pid_ns_for_children);
+ if (IS_ERR(new_nsp->pid_ns_for_children))
+ return ERR_CAST(new_nsp->pid_ns_for_children);
new_nsp->cgroup_ns = copy_cgroup_ns(flags, user_ns,
tsk->nsproxy->cgroup_ns);
- if (IS_ERR(new_nsp->cgroup_ns)) {
- err = PTR_ERR(new_nsp->cgroup_ns);
- goto out_cgroup;
- }
+ if (IS_ERR(new_nsp->cgroup_ns))
+ return ERR_CAST(new_nsp->cgroup_ns);
new_nsp->net_ns = copy_net_ns(flags, user_ns, tsk->nsproxy->net_ns);
- if (IS_ERR(new_nsp->net_ns)) {
- err = PTR_ERR(new_nsp->net_ns);
- goto out_net;
- }
+ if (IS_ERR(new_nsp->net_ns))
+ return ERR_CAST(new_nsp->net_ns);
new_nsp->time_ns_for_children = copy_time_ns(flags, user_ns,
- tsk->nsproxy->time_ns_for_children);
- if (IS_ERR(new_nsp->time_ns_for_children)) {
- err = PTR_ERR(new_nsp->time_ns_for_children);
- goto out_time;
- }
+ tsk->nsproxy->time_ns_for_children);
+ if (IS_ERR(new_nsp->time_ns_for_children))
+ return ERR_CAST(new_nsp->time_ns_for_children);
new_nsp->time_ns = get_time_ns(tsk->nsproxy->time_ns);
- return new_nsp;
-
-out_time:
- put_net(new_nsp->net_ns);
-out_net:
- put_cgroup_ns(new_nsp->cgroup_ns);
-out_cgroup:
- put_pid_ns(new_nsp->pid_ns_for_children);
-out_pid:
- put_ipc_ns(new_nsp->ipc_ns);
-out_ipc:
- put_uts_ns(new_nsp->uts_ns);
-out_uts:
- put_mnt_ns(new_nsp->mnt_ns);
-out_ns:
- kmem_cache_free(nsproxy_cachep, new_nsp);
- return ERR_PTR(err);
+ return no_free_ptr(new_nsp);
}
/*
@@ -185,21 +175,6 @@ int copy_namespaces(u64 flags, struct task_struct *tsk)
return 0;
}
-void free_nsproxy(struct nsproxy *ns)
-{
- nsproxy_ns_active_put(ns);
-
- put_mnt_ns(ns->mnt_ns);
- put_uts_ns(ns->uts_ns);
- put_ipc_ns(ns->ipc_ns);
- put_pid_ns(ns->pid_ns_for_children);
- put_time_ns(ns->time_ns);
- put_time_ns(ns->time_ns_for_children);
- put_cgroup_ns(ns->cgroup_ns);
- put_net(ns->net_ns);
- kmem_cache_free(nsproxy_cachep, ns);
-}
-
/*
* Called from unshare. Unshare all the namespaces part of nsproxy.
* On success, returns the new nsproxy.
@@ -338,7 +313,7 @@ static void put_nsset(struct nsset *nsset)
if (nsset->fs && (flags & CLONE_NEWNS) && (flags & ~CLONE_NEWNS))
free_fs_struct(nsset->fs);
if (nsset->nsproxy)
- free_nsproxy(nsset->nsproxy);
+ nsproxy_free(nsset->nsproxy);
}
static int prepare_nsset(unsigned flags, struct nsset *nsset)
--
2.47.3
^ permalink raw reply related
* Re: [PATCH v2] device_cgroup: Refactor devcgroup_seq_show to use seq_put* helpers
From: Paul Moore @ 2025-11-12 0:47 UTC (permalink / raw)
To: Thorsten Blum, David Laight, James Morris, Serge E. Hallyn
Cc: Thorsten Blum, linux-security-module, linux-kernel
In-Reply-To: <20251031213915.211046-1-thorsten.blum@linux.dev>
On Oct 31, 2025 Thorsten Blum <thorsten.blum@linux.dev> wrote:
>
> Replace set_access(), set_majmin(), and type_to_char() with new helpers
> seq_putaccess(), seq_puttype(), and seq_putversion() that write directly
> to 'seq_file'.
>
> Simplify devcgroup_seq_show() by hard-coding "a *:* rwm", and use the
> new seq_put* helper functions to list the exceptions otherwise.
>
> This allows us to remove the intermediate string buffers while
> maintaining the same functionality, including wildcard handling.
>
> Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
> Acked-by: Serge Hallyn <serge@hallyn.com>
> ---
> Changes in v2:
> - Add setq_put* helpers to modify seq_file directly (David)
> - Update patch subject and description
> - Link to v1: https://lore.kernel.org/lkml/20251031110647.102728-2-thorsten.blum@linux.dev/
> ---
> security/device_cgroup.c | 56 ++++++++++++++++++----------------------
> 1 file changed, 25 insertions(+), 31 deletions(-)
Looks good to me, merged into lsm/dev, thanks!
--
paul-moore.com
^ permalink raw reply
* Re: [PATCH] security: sctp: Format type and permission checks tables
From: Paul Moore @ 2025-11-12 0:50 UTC (permalink / raw)
To: Bagas Sanjaya
Cc: Linux Kernel Mailing List, Linux Documentation,
Linux Security Module, Jonathan Corbet, Jarkko Sakkinen,
Christian Brauner, Jeff Layton, Kees Cook,
Mickaël Salaün, Stuart Yoder, Randy Dunlap
In-Reply-To: <aRKgyvrTxldlTv9t@archie.me>
On Mon, Nov 10, 2025 at 9:35 PM Bagas Sanjaya <bagasdotme@gmail.com> wrote:
>
> On Mon, Nov 03, 2025 at 06:39:23PM +0700, Bagas Sanjaya wrote:
> > Use reST grid tables for both type and permission checks tables.
>
> review ping
You don't need to 'ping' for a review, your patch is in my review
queue, but code changes take priority at this point in the dev cycle
as I'm okay with merging documentation changes fairly late.
--
paul-moore.com
^ permalink raw reply
* 少子化は追い風。次世代の教育ビジネス
From: 教育フランチャイズセミナー事務局 @ 2025-11-12 2:04 UTC (permalink / raw)
To: linux-security-module
いつもお世話になります。
少子化が進む中で、多くの企業が 「教育市場は縮小する」 と考えています。
しかし実際には、一人あたりの教育支出は年々微増しており、
教育業界はむしろ堅調に成長を続けています。
今回は、地域貢献と収益性を両立できる
次世代型の教育事業をテーマに、
新規事業での収益づくりをお考えの法人様向けに
オンライン説明会を開催いたします。
11月18日（火）16：00〜17：00 オンライン開催
----------------------------------------------------------
◆フランチャイズ事業 WEB説明会◆
“プログラミング教育×個別指導”
不況に強く、少子化でも成長する
ハイブリッド型の教育事業
▼ 視聴予約 ▼
https://wam-edu-fc.jp/wam2/
◆ ご案内事業 ◆
個別指導 WAM
◇ 提供 ◇
エイチ・エム・グループ
----------------------------------------------------------
『少子化なのに、教育事業？』と思うかもしれませんが、
実は子ども一人にかける教育費の増加に伴い、市場は成長し続けています。
また、教育費は不況時でも削減されにくいため
コロナ下でも大きく落ち込むことなく底堅さを見せました。
幼児教育無償化などの国策もあり、今後も教育投資の増加が予想されます。
そこでご紹介するのが、「プログラミング×個別指導」の
ハイブリッド教育事業です。
プログラミングは小学校で必修化されたため、保護者の関心も高まっています。
本事業のスタートは業界未経験・社員１名で可能です。
新たな事業収益づくりをお考えの方は、是非ご参加ください。
11月18日（火）16：00〜17：00 オンライン開催
▼ 視聴予約はこちら
https://wam-edu-fc.jp/wam2/
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
教育事業FCセミナー事務局
電話：0120-891-893
住所：東京都中央区銀座7-13-6
―――――――――――――――――――――――――――――――
本メールのご不要な方には大変ご迷惑をおかけいたしました。
今後ご案内が不要な方は下記URLよりお手続きをお願いいたします。
┗ https://wam-edu-fc.jp/mail/
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
^ permalink raw reply
* [BUG] landlock: sleeping function called from invalid context in hook_sb_delete()
From: 许佳凯 @ 2025-11-12 2:35 UTC (permalink / raw)
To: linux-kernel; +Cc: linux-security-module, Günther Noack, Serge E. Hallyn
Hello,
This issue occurs when unmounting a tmpfs filesystem that has previously been added to a Landlock path-beneath rule.
During this operation, the kernel reports a “sleeping function called from invalid context” bug in hook_sb_delete() (security/landlock/fs.c).
This bug was initially discovered on the Linux riscv branch via a fuzzing framework.
It was later confirmed reproducible on Linux mainline v6.18-rc5 (x86).
The tested kernel source, configuration, and related materials are provided below:
Kernel source: https://git.kernel.org/torvalds/t/linux-6.18-rc5.tar.gz
Config file: https://github.com/j1akai/KConfigFuzz_bug/blob/main/report/0c844d5f7bcf0ac21ef4ed85459676ab264e8b6b/.config
Reproducer source: https://github.com/j1akai/KConfigFuzz_bug/blob/main/report/0c844d5f7bcf0ac21ef4ed85459676ab264e8b6b/repro.cprog
GCC compiler info: https://github.com/j1akai/KConfigFuzz_bug/blob/main/report/0c844d5f7bcf0ac21ef4ed85459676ab264e8b6b/gcc.info
Kernel log (dmesg): https://github.com/j1akai/KConfigFuzz_bug/blob/main/report/0c844d5f7bcf0ac21ef4ed85459676ab264e8b6b/dmesg.info
Additional riscv fuzzing context (report0, etc.): https://github.com/j1akai/KConfigFuzz_bug/tree/main/report/0c844d5f7bcf0ac21ef4ed85459676ab264e8b6b
The call trace indicates that hook_sb_delete() holds s_inode_list_lock (a spinlock) while invoking operations that may eventually call iput(), which can sleep.
This violates the locking context expectations and triggers __might_sleep() warnings.
The issue seems to be related to how Landlock handles superblock cleanup during security_sb_delete().
I’m currently only reporting this issue to the community; the exact fix will likely need to be confirmed and implemented by the Landlock and filesystem maintainers.
^ permalink raw reply
* Re: [PATCH v1] fs: Move might_sleep() annotation to iput_final()
From: kernel test robot @ 2025-11-12 5:40 UTC (permalink / raw)
To: Mickaël Salaün
Cc: oe-lkp, lkp, Christian Brauner, Edward Adam Davis,
Günther Noack, Hillf Danton, Jan Kara, Jann Horn,
Mateusz Guzik, Max Kellermann, Tingmao Wang, linux-fsdevel,
Mickaël Salaün, linux-security-module, Al Viro,
syzbot+12479ae15958fc3f54ec, oliver.sang
In-Reply-To: <20251105193800.2340868-1-mic@digikod.net>
Hello,
kernel test robot noticed "BUG:sleeping_function_called_from_invalid_context_at_fs/inode.c" on:
commit: 29fb8368dfb5d1f784fd936cec578c9601d77325 ("[PATCH v1] fs: Move might_sleep() annotation to iput_final()")
url: https://github.com/intel-lab-lkp/linux/commits/Micka-l-Sala-n/fs-Move-might_sleep-annotation-to-iput_final/20251106-060704
patch link: https://lore.kernel.org/all/20251105193800.2340868-1-mic@digikod.net/
patch subject: [PATCH v1] fs: Move might_sleep() annotation to iput_final()
in testcase: boot
config: x86_64-rhel-9.4-rust
compiler: clang-20
test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 32G
(please refer to attached dmesg/kmsg for entire log/backtrace)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <oliver.sang@intel.com>
| Closes: https://lore.kernel.org/oe-lkp/202511121304.5e522f7b-lkp@intel.com
[ 18.387422][ T1] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 18.389429][ T1] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1, name: init
[ 18.390340][ T1] preempt_count: 1, expected: 0
[ 18.390892][ T1] RCU nest depth: 0, expected: 0
[ 18.391438][ T1] CPU: 1 UID: 0 PID: 1 Comm: init Not tainted 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 18.391441][ T1] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 18.391443][ T1] Call Trace:
[ 18.392215][ T1] <TASK>
[ 18.392219][ T1] dump_stack_lvl (lib/dump_stack.c:123)
[ 18.392228][ T1] __might_resched (kernel/sched/core.c:8838)
[ 18.393064][ T1] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 18.393072][ T1] __dentry_kill (fs/dcache.c:?)
[ 18.393075][ T1] dput (fs/dcache.c:912)
[ 18.393077][ T1] __fput (fs/file_table.c:477)
[ 18.393081][ T1] __x64_sys_close (fs/open.c:1591)
[ 18.393082][ T1] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 18.393086][ T1] ? __x64_sys_connect (net/socket.c:2131 net/socket.c:2128 net/socket.c:2128)
[ 18.393098][ T1] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 18.393099][ T1] ? kmem_cache_alloc_noprof (include/linux/kernel.h:?)
[ 18.393104][ T1] ? alloc_empty_file (fs/file_table.c:238)
[ 18.393105][ T1] ? init_file (fs/file_table.c:174)
[ 18.393107][ T1] ? file_init_path (fs/file_table.c:326)
[ 18.393108][ T1] ? alloc_file_pseudo (fs/file_table.c:?)
[ 18.393110][ T1] ? sock_alloc_file (net/socket.c:?)
[ 18.393113][ T1] ? __sys_socket (net/socket.c:?)
[ 18.393115][ T1] ? __x64_sys_socket (net/socket.c:1765 net/socket.c:1763 net/socket.c:1763)
[ 18.393117][ T1] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 18.393119][ T1] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 18.393121][ T1] RIP: 0033:0x7fcfd14c3040
[ 18.393126][ T1] Code: 40 75 0b 31 c0 48 83 c4 08 e9 0c ff ff ff 48 8d 3d c5 99 09 00 e8 a0 3f 02 00 83 3d 9d 71 2d 00 00 75 10 b8 03 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 9e b1 01 00 48 89 04 24
All code
========
0: 40 75 0b rex jne 0xe
3: 31 c0 xor %eax,%eax
5: 48 83 c4 08 add $0x8,%rsp
9: e9 0c ff ff ff jmp 0xffffffffffffff1a
e: 48 8d 3d c5 99 09 00 lea 0x999c5(%rip),%rdi # 0x999da
15: e8 a0 3f 02 00 call 0x23fba
1a: 83 3d 9d 71 2d 00 00 cmpl $0x0,0x2d719d(%rip) # 0x2d71be
21: 75 10 jne 0x33
23: b8 03 00 00 00 mov $0x3,%eax
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 31 jae 0x63
32: c3 ret
33: 48 83 ec 08 sub $0x8,%rsp
37: e8 9e b1 01 00 call 0x1b1da
3c: 48 89 04 24 mov %rax,(%rsp)
Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 73 31 jae 0x39
8: c3 ret
9: 48 83 ec 08 sub $0x8,%rsp
d: e8 9e b1 01 00 call 0x1b1b0
12: 48 89 04 24 mov %rax,(%rsp)
[ 18.393128][ T1] RSP: 002b:00007ffd4cbc7398 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 18.393131][ T1] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fcfd14c3040
[ 18.393132][ T1] RDX: 00007fcfd1526f2c RSI: 0000000000000000 RDI: 0000000000000008
[ 18.393133][ T1] RBP: 0000000000000008 R08: 0000000000000003 R09: 0000000000000000
[ 18.393134][ T1] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fcfd221b6a0
[ 18.393135][ T1] R13: 00007fcfd15563cb R14: 00000000ffffffff R15: 0000000000000000
[ 18.393137][ T1] </TASK>
LKP: ttyS0: 86: skip deploy intel ucode as no ucode is specified
LKP: ttyS0: 86: Kernel tests: Boot OK!
LKP: ttyS0: 86: HOSTNAME vm-snb, MAC 52:54:00:12:34:56, kernel 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 1
[ 18.589452][ T181] udevd[181]: starting version 175
[ 18.598118][ T107] is_virt=true
[ 18.598124][ T107]
[ 18.603531][ T107] lkp: kernel tainted state: 512
[ 18.603537][ T107]
[ 18.612979][ T107] LKP: stdout: 86: Kernel tests: Boot OK!
[ 18.612986][ T107]
LKP: ttyS0: 86: /lkp/lkp/src/bin/run-lkp /lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml
[ 18.661802][ T107] LKP: stdout: 86: HOSTNAME vm-snb, MAC 52:54:00:12:34:56, kernel 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 1
[ 18.661809][ T107]
[ 18.676637][ T107] NO_NETWORK=
[ 18.676643][ T107]
[ 18.680228][ T200] piix4_smbus 0000:00:01.3: SMBus Host Controller at 0x700, revision 0
[ 18.690939][ T107] INFO: lkp CACHE_DIR is /tmp/cache
[ 18.690945][ T107]
[ 18.694448][ T200] i2c i2c-0: Memory type 0x07 not supported yet, not instantiating SPD
[ 18.761028][ T107] LKP: stdout: 86: /lkp/lkp/src/bin/run-lkp /lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml
[ 18.761038][ T107]
[ 18.781039][ T107] RESULT_ROOT=/result/boot/1/vm-snb/quantal-x86_64-core-20190426.cgz/x86_64-rhel-9.4-rust/clang-20/29fb8368dfb5d1f784fd936cec578c9601d77325/0
[ 18.781047][ T107]
[ 18.805586][ T107] job=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml
[ 18.805592][ T107]
[ 18.857299][ T201] libata version 3.00 loaded.
[ 18.872519][ T107] result_service: raw_upload, RESULT_MNT: /internal-lkp-server/result, RESULT_ROOT: /internal-lkp-server/result/boot/1/vm-snb/quantal-x86_64-core-20190426.cgz/x86_64-rhel-9.4-rust/clang-20/29fb8368dfb5d1f784fd936cec578c9601d77325/0, TMP_RESULT_ROOT: /tmp/lkp/result
[ 18.872526][ T107]
[ 18.880780][ T201] scsi host0: ata_piix
[ 18.899515][ T107] run-job /lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml
[ 18.899520][ T107]
[ 18.908385][ T201] scsi host1: ata_piix
[ 18.910926][ T201] ata1: PATA max MWDMA2 cmd 0x1f0 ctl 0x3f6 bmdma 0xc140 irq 14 lpm-pol 0
[ 18.911964][ T201] ata2: PATA max MWDMA2 cmd 0x170 ctl 0x376 bmdma 0xc148 irq 15 lpm-pol 0
[ 18.932209][ T107] /usr/bin/wget -nv --timeout=3600 --tries=1 --local-encoding=UTF-8 http://internal-lkp-server:80/~lkp/cgi-bin/lkp-jobfile-append-var?job_file=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml&job_state=running -O /dev/null
[ 18.932216][ T107]
[ 18.974405][ T212] ACPI: bus type drm_connector registered
[ 18.978482][ T1] init: failsafe main process (320) killed by TERM signal
[ 19.074983][ T307] ata2: found unknown device (class 0)
[ 19.076067][ T307] ata2.00: ATAPI: QEMU DVD-ROM, 2.5+, max UDMA/100
[ 19.077908][ T12] scsi 1:0:0:0: CD-ROM QEMU QEMU DVD-ROM 2.5+ PQ: 0 ANSI: 5
[ 19.099276][ T312] parport_pc 00:03: reported by Plug and Play ACPI
[ 19.104906][ T312] parport0: PC-style at 0x378, irq 7 [PCSPP,TRISTATE]
[ 19.190656][ T384] sr 1:0:0:0: [sr0] scsi3-mmc drive: 4x/4x cd/rw xa/form2 tray
[ 19.191608][ T384] cdrom: Uniform CD-ROM driver Revision: 3.20
[ 19.201172][ T212] bochs-drm 0000:00:02.0: vgaarb: deactivate vga console
[ 19.206902][ T212] Console: switching to colour dummy device 80x25
[ 19.207699][ T212] [drm] Found bochs VGA, ID 0xb0c5.
[ 19.208107][ T212] [drm] Framebuffer size 16384 kB @ 0xfd000000, mmio @ 0xfebf0000.
[ 19.209140][ T212] [drm] Initialized bochs-drm 1.0.0 for 0000:00:02.0 on minor 0
[ 19.216585][ T212] fbcon: bochs-drmdrmfb (fb0) is primary device
[ 19.233924][ T384] sr 1:0:0:0: Attached scsi CD-ROM sr0
[ 19.236779][ T212] Console: switching to colour frame buffer device 160x50
[ 19.296502][ T212] bochs-drm 0000:00:02.0: [drm] fb0: bochs-drmdrmfb frame buffer device
[ 19.300750][ T391] ppdev: user-space parallel port driver
[ 19.386935][ T82] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 19.387879][ T82] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 82, name: plymouthd
[ 19.388607][ T82] preempt_count: 1, expected: 0
[ 19.389718][ T82] RCU nest depth: 0, expected: 0
[ 19.391578][ T82] CPU: 1 UID: 0 PID: 82 Comm: plymouthd Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 19.391582][ T82] Tainted: [W]=WARN
[ 19.391583][ T82] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 19.391584][ T82] Call Trace:
[ 19.391587][ T82] <TASK>
[ 19.391590][ T82] dump_stack_lvl (lib/dump_stack.c:123)
[ 19.391599][ T82] __might_resched (kernel/sched/core.c:8838)
[ 19.391605][ T82] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 19.391609][ T82] __dentry_kill (fs/dcache.c:?)
[ 19.391613][ T82] dput (fs/dcache.c:912)
[ 19.391615][ T82] __fput (fs/file_table.c:477)
[ 19.391625][ T82] __x64_sys_close (fs/open.c:1591)
[ 19.391627][ T82] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 19.391631][ T82] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 19.391633][ T82] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 19.391635][ T82] ? __x64_sys_sendto (net/socket.c:2255 net/socket.c:2251 net/socket.c:2251)
[ 19.391645][ T82] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 19.391647][ T82] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 19.391650][ T82] RIP: 0033:0x7ff9cf9f9040
[ 19.391654][ T82] Code: 40 75 0b 31 c0 48 83 c4 08 e9 0c ff ff ff 48 8d 3d c5 99 09 00 e8 a0 3f 02 00 83 3d 9d 71 2d 00 00 75 10 b8 03 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 9e b1 01 00 48 89 04 24
All code
========
0: 40 75 0b rex jne 0xe
3: 31 c0 xor %eax,%eax
5: 48 83 c4 08 add $0x8,%rsp
9: e9 0c ff ff ff jmp 0xffffffffffffff1a
e: 48 8d 3d c5 99 09 00 lea 0x999c5(%rip),%rdi # 0x999da
15: e8 a0 3f 02 00 call 0x23fba
1a: 83 3d 9d 71 2d 00 00 cmpl $0x0,0x2d719d(%rip) # 0x2d71be
21: 75 10 jne 0x33
23: b8 03 00 00 00 mov $0x3,%eax
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 31 jae 0x63
32: c3 ret
33: 48 83 ec 08 sub $0x8,%rsp
37: e8 9e b1 01 00 call 0x1b1da
3c: 48 89 04 24 mov %rax,(%rsp)
Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 73 31 jae 0x39
8: c3 ret
9: 48 83 ec 08 sub $0x8,%rsp
d: e8 9e b1 01 00 call 0x1b1b0
12: 48 89 04 24 mov %rax,(%rsp)
[ 19.391656][ T82] RSP: 002b:00007ffd01a06c28 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 19.391659][ T82] RAX: ffffffffffffffda RBX: 0000000034e212e0 RCX: 00007ff9cf9f9040
[ 19.391661][ T82] RDX: 00007ffd01a06cbc RSI: 0000000034e212e0 RDI: 0000000000000007
[ 19.391662][ T82] RBP: 0000000034e20f50 R08: 00000000118a0360 R09: 7fffffffffffffff
[ 19.391664][ T82] R10: 3fffffffffffffff R11: 0000000000000246 R12: 0000000034e215a0
[ 19.391668][ T82] R13: 0000000034e21570 R14: 0000000000000058 R15: 0000000000000000
[ 19.391670][ T82] </TASK>
[ 19.684798][ C0] hrtimer: interrupt took 7335062 ns
[ 19.697123][ T109] 2025-11-10 18:26:34 URL:http://internal-lkp-server/~lkp/cgi-bin/lkp-jobfile-append-var?job_file=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml&job_state=running [0/0] -> "/dev/null" [1]
[ 19.773587][ T109]
[ 19.827552][ T107] target ucode:
[ 19.827558][ T107]
[ 19.854980][ T107] check_nr_cpu
[ 19.872576][ T107]
[ 19.875184][ T107] CPU(s): 2
[ 19.877090][ T107]
[ 19.888546][ T107] On-line CPU(s) list: 0,1
[ 19.888553][ T107]
[ 19.922264][ T107] Thread(s) per core: 1
[ 19.922272][ T107]
[ 19.925376][ T107] Core(s) per socket: 2
[ 19.925383][ T107]
[ 19.942720][ T107] Socket(s): 1
[ 19.942727][ T107]
[ 19.966452][ T107] NUMA node(s): 1
[ 19.966460][ T107]
[ 19.981930][ T107] NUMA node0 CPU(s): 0,1
[ 19.981942][ T107]
[ 20.557619][ T497] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 20.558839][ T497] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 497, name: udevd
[ 20.559927][ T497] preempt_count: 1, expected: 0
[ 20.562617][ T497] RCU nest depth: 0, expected: 0
[ 20.563969][ T497] CPU: 0 UID: 0 PID: 497 Comm: udevd Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 20.563978][ T497] Tainted: [W]=WARN
[ 20.563979][ T497] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 20.563981][ T497] Call Trace:
[ 20.563986][ T497] <TASK>
[ 20.563989][ T497] dump_stack_lvl (lib/dump_stack.c:123)
[ 20.563999][ T497] __might_resched (kernel/sched/core.c:8838)
[ 20.564004][ T497] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 20.564008][ T497] __dentry_kill (fs/dcache.c:?)
[ 20.564012][ T497] shrink_dentry_list (fs/dcache.c:1114)
[ 20.564015][ T497] shrink_dcache_parent (fs/dcache.c:1550)
[ 20.564019][ T497] d_invalidate (fs/dcache.c:1660)
[ 20.564022][ T497] proc_invalidate_siblings_dcache (fs/proc/inode.c:143)
[ 20.564026][ T497] release_task (kernel/exit.c:292)
[ 20.564030][ T497] wait_consider_task (kernel/exit.c:1276)
[ 20.564033][ T497] ? do_wait (kernel/exit.c:1714)
[ 20.564035][ T497] __do_wait (kernel/exit.c:1640 kernel/exit.c:1674)
[ 20.564037][ T497] ? do_wait (kernel/exit.c:1714)
[ 20.564039][ T497] do_wait (kernel/exit.c:1716)
[ 20.564041][ T497] kernel_wait4 (kernel/exit.c:1874)
[ 20.564043][ T497] ? get_task_struct (kernel/exit.c:1599)
[ 20.564045][ T497] __x64_sys_wait4 (kernel/exit.c:1902 kernel/exit.c:1898 kernel/exit.c:1898)
[ 20.564048][ T497] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 20.564052][ T497] ? vfs_read (fs/read_write.c:492)
[ 20.564055][ T497] ? __x64_sys_read (fs/read_write.c:?)
[ 20.564056][ T497] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 20.564058][ T497] ? irqentry_exit (include/linux/rseq_entry.h:576 include/linux/irq-entry-common.h:271 include/linux/irq-entry-common.h:339 kernel/entry/common.c:196)
[ 20.564061][ T497] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 20.564064][ T497] RIP: 0033:0x7f0bbd443c3e
[ 20.564068][ T497] Code: 00 f7 d8 64 89 02 48 89 f8 eb cc 90 48 83 ec 28 8b 05 aa e5 2f 00 85 c0 75 1d 45 31 d2 48 63 d2 48 63 ff b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 48 83 c4 28 c3 89 54 24 08 48 89 74 24 10
All code
========
0: 00 f7 add %dh,%bh
2: d8 64 89 02 fsubs 0x2(%rcx,%rcx,4)
6: 48 89 f8 mov %rdi,%rax
9: eb cc jmp 0xffffffffffffffd7
b: 90 nop
c: 48 83 ec 28 sub $0x28,%rsp
10: 8b 05 aa e5 2f 00 mov 0x2fe5aa(%rip),%eax # 0x2fe5c0
16: 85 c0 test %eax,%eax
18: 75 1d jne 0x37
1a: 45 31 d2 xor %r10d,%r10d
1d: 48 63 d2 movslq %edx,%rdx
20: 48 63 ff movslq %edi,%rdi
23: b8 3d 00 00 00 mov $0x3d,%eax
28: 0f 05 syscall
2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction
30: 77 51 ja 0x83
32: 48 83 c4 28 add $0x28,%rsp
36: c3 ret
37: 89 54 24 08 mov %edx,0x8(%rsp)
3b: 48 89 74 24 10 mov %rsi,0x10(%rsp)
Code starting with the faulting instruction
===========================================
0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
6: 77 51 ja 0x59
8: 48 83 c4 28 add $0x28,%rsp
c: c3 ret
d: 89 54 24 08 mov %edx,0x8(%rsp)
11: 48 89 74 24 10 mov %rsi,0x10(%rsp)
[ 20.564071][ T497] RSP: 002b:00007fff65aecee0 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
[ 20.564074][ T497] RAX: ffffffffffffffda RBX: 0000556a4924f6d0 RCX: 00007f0bbd443c3e
[ 20.564076][ T497] RDX: 0000000000000001 RSI: 00007fff65aedfe4 RDI: 00000000000001f2
[ 20.564077][ T497] RBP: 0000000000000000 R08: 000000001bb5db01 R09: 7fffffffffffffff
[ 20.564079][ T497] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff65af3948
[ 20.564080][ T497] R13: 00000000000001f2 R14: 0000556a49215250 R15: 00000000000003e8
[ 20.564083][ T497] </TASK>
[ 20.689253][ T1] init: networking main process (512) terminated with status 1
[ 21.005572][ T107] sleep started
[ 21.005581][ T107]
[ 22.006385][ T210] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 22.007457][ T210] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 210, name: run-lkp
[ 22.008482][ T210] preempt_count: 1, expected: 0
[ 22.009261][ T210] RCU nest depth: 0, expected: 0
[ 22.009992][ T210] CPU: 1 UID: 0 PID: 210 Comm: run-lkp Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 22.009996][ T210] Tainted: [W]=WARN
[ 22.009997][ T210] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 22.009999][ T210] Call Trace:
[ 22.010003][ T210] <TASK>
[ 22.010005][ T210] dump_stack_lvl (lib/dump_stack.c:123)
[ 22.010015][ T210] __might_resched (kernel/sched/core.c:8838)
[ 22.010021][ T210] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 22.010026][ T210] __dentry_kill (fs/dcache.c:?)
[ 22.010030][ T210] shrink_dentry_list (fs/dcache.c:1114)
[ 22.010034][ T210] shrink_dcache_parent (fs/dcache.c:1550)
[ 22.010037][ T210] d_invalidate (fs/dcache.c:1660)
[ 22.010040][ T210] proc_invalidate_siblings_dcache (fs/proc/inode.c:143)
[ 22.010046][ T210] release_task (kernel/exit.c:292)
[ 22.010051][ T210] wait_consider_task (kernel/exit.c:1276)
[ 22.010057][ T210] __do_wait (kernel/exit.c:1565 kernel/exit.c:1681)
[ 22.010059][ T210] ? do_wait (kernel/exit.c:1714)
[ 22.010061][ T210] do_wait (kernel/exit.c:1716)
[ 22.010063][ T210] kernel_wait4 (kernel/exit.c:1874)
[ 22.010066][ T210] ? get_task_struct (kernel/exit.c:1599)
[ 22.010069][ T210] __x64_sys_wait4 (kernel/exit.c:1902 kernel/exit.c:1898 kernel/exit.c:1898)
[ 22.010071][ T210] ? count_memcg_events (mm/memcontrol.c:? mm/memcontrol.c:847)
[ 22.010073][ T210] ? handle_mm_fault (mm/memory.c:6423)
[ 22.010078][ T210] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 22.010082][ T210] ? do_user_addr_fault (arch/x86/mm/fault.c:1337)
[ 22.010086][ T210] ? irqentry_exit (include/linux/rseq_entry.h:576 include/linux/irq-entry-common.h:271 include/linux/irq-entry-common.h:339 kernel/entry/common.c:196)
[ 22.010089][ T210] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 22.010093][ T210] RIP: 0033:0x7fe001e18c3e
[ 22.010097][ T210] Code: 00 f7 d8 64 89 02 48 89 f8 eb cc 90 48 83 ec 28 8b 05 aa e5 2f 00 85 c0 75 1d 45 31 d2 48 63 d2 48 63 ff b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 48 83 c4 28 c3 89 54 24 08 48 89 74 24 10
All code
========
0: 00 f7 add %dh,%bh
2: d8 64 89 02 fsubs 0x2(%rcx,%rcx,4)
6: 48 89 f8 mov %rdi,%rax
9: eb cc jmp 0xffffffffffffffd7
b: 90 nop
c: 48 83 ec 28 sub $0x28,%rsp
10: 8b 05 aa e5 2f 00 mov 0x2fe5aa(%rip),%eax # 0x2fe5c0
16: 85 c0 test %eax,%eax
18: 75 1d jne 0x37
1a: 45 31 d2 xor %r10d,%r10d
1d: 48 63 d2 movslq %edx,%rdx
20: 48 63 ff movslq %edi,%rdi
23: b8 3d 00 00 00 mov $0x3d,%eax
28: 0f 05 syscall
2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction
30: 77 51 ja 0x83
32: 48 83 c4 28 add $0x28,%rsp
36: c3 ret
37: 89 54 24 08 mov %edx,0x8(%rsp)
3b: 48 89 74 24 10 mov %rsi,0x10(%rsp)
Code starting with the faulting instruction
===========================================
0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
6: 77 51 ja 0x59
8: 48 83 c4 28 add $0x28,%rsp
c: c3 ret
d: 89 54 24 08 mov %edx,0x8(%rsp)
11: 48 89 74 24 10 mov %rsi,0x10(%rsp)
[ 22.010099][ T210] RSP: 002b:00007ffc8644ef50 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
[ 22.010102][ T210] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007fe001e18c3e
[ 22.010104][ T210] RDX: 0000000000000000 RSI: 00007ffc8644efb8 RDI: ffffffffffffffff
[ 22.010105][ T210] RBP: 000000003db55300 R08: 000000003db553c8 R09: 0000000000000001
[ 22.010107][ T210] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 22.010108][ T210] R13: 0000000000000000 R14: 0000000000000000 R15: 00000000ffffffff
[ 22.010110][ T210] </TASK>
[ 22.147235][ T107] /usr/bin/wget -nv --timeout=3600 --tries=1 --local-encoding=UTF-8 http://internal-lkp-server:80/~lkp/cgi-bin/lkp-jobfile-append-var?job_file=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml&job_state=post_run -O /dev/null
[ 22.147244][ T107]
[ 22.859171][ T109] 2025-11-10 18:26:38 URL:http://internal-lkp-server/~lkp/cgi-bin/lkp-jobfile-append-var?job_file=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml&job_state=post_run [0/0] -> "/dev/null" [1]
[ 22.859180][ T109]
[ 23.872028][ T539] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 23.873181][ T539] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 539, name: post-run
[ 23.875374][ T539] preempt_count: 1, expected: 0
[ 23.876396][ T539] RCU nest depth: 0, expected: 0
[ 23.877455][ T539] CPU: 1 UID: 0 PID: 539 Comm: post-run Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 23.877459][ T539] Tainted: [W]=WARN
[ 23.877460][ T539] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 23.877461][ T539] Call Trace:
[ 23.877465][ T539] <TASK>
[ 23.877467][ T539] dump_stack_lvl (lib/dump_stack.c:123)
[ 23.877475][ T539] __might_resched (kernel/sched/core.c:8838)
[ 23.877480][ T539] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 23.877484][ T539] __dentry_kill (fs/dcache.c:?)
[ 23.877488][ T539] dput (fs/dcache.c:912)
[ 23.877490][ T539] __fput (fs/file_table.c:477)
[ 23.877494][ T539] __x64_sys_close (fs/open.c:1591)
[ 23.877496][ T539] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 23.877499][ T539] ? handle_mm_fault (mm/memory.c:6423)
[ 23.877504][ T539] ? do_user_addr_fault (arch/x86/mm/fault.c:1337)
[ 23.877508][ T539] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 23.877510][ T539] ? irqentry_exit (include/linux/rseq_entry.h:576 include/linux/irq-entry-common.h:271 include/linux/irq-entry-common.h:339 kernel/entry/common.c:196)
[ 23.877513][ T539] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 23.877516][ T539] RIP: 0033:0x7f1031cde040
[ 23.877519][ T539] Code: 40 75 0b 31 c0 48 83 c4 08 e9 0c ff ff ff 48 8d 3d c5 99 09 00 e8 a0 3f 02 00 83 3d 9d 71 2d 00 00 75 10 b8 03 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 9e b1 01 00 48 89 04 24
All code
========
0: 40 75 0b rex jne 0xe
3: 31 c0 xor %eax,%eax
5: 48 83 c4 08 add $0x8,%rsp
9: e9 0c ff ff ff jmp 0xffffffffffffff1a
e: 48 8d 3d c5 99 09 00 lea 0x999c5(%rip),%rdi # 0x999da
15: e8 a0 3f 02 00 call 0x23fba
1a: 83 3d 9d 71 2d 00 00 cmpl $0x0,0x2d719d(%rip) # 0x2d71be
21: 75 10 jne 0x33
23: b8 03 00 00 00 mov $0x3,%eax
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 31 jae 0x63
32: c3 ret
33: 48 83 ec 08 sub $0x8,%rsp
37: e8 9e b1 01 00 call 0x1b1da
3c: 48 89 04 24 mov %rax,(%rsp)
Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 73 31 jae 0x39
8: c3 ret
9: 48 83 ec 08 sub $0x8,%rsp
d: e8 9e b1 01 00 call 0x1b1b0
12: 48 89 04 24 mov %rax,(%rsp)
[ 23.877521][ T539] RSP: 002b:00007fff879e0888 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 23.877524][ T539] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f1031cde040
[ 23.877525][ T539] RDX: 0000000000000001 RSI: 0000000000000002 RDI: 0000000000000003
[ 23.877526][ T539] RBP: 0000000000000000 R08: 000000000000000a R09: 0000000000000000
[ 23.877527][ T539] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff879e08e4
[ 23.877528][ T539] R13: 0000000000000080 R14: 000000000000000a R15: 000000001dc63a08
[ 23.877530][ T539] </TASK>
[ 23.937654][ T107] kill 429 vmstat -n 10
[ 23.937662][ T107]
[ 23.944123][ T107] kill 425 cat /proc/kmsg
[ 23.944131][ T107]
[ 23.962000][ T107] wait for background processes: 435 432 oom-killer meminfo
[ 23.962008][ T107]
[ 24.972654][ T561] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 24.973813][ T561] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 561, name: post-run
[ 24.974943][ T561] preempt_count: 1, expected: 0
[ 24.975752][ T561] RCU nest depth: 0, expected: 0
[ 24.976454][ T561] CPU: 1 UID: 0 PID: 561 Comm: post-run Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 24.976459][ T561] Tainted: [W]=WARN
[ 24.976459][ T561] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 24.976461][ T561] Call Trace:
[ 24.976464][ T561] <TASK>
[ 24.976466][ T561] dump_stack_lvl (lib/dump_stack.c:123)
[ 24.976476][ T561] __might_resched (kernel/sched/core.c:8838)
[ 24.976485][ T561] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 24.976489][ T561] __dentry_kill (fs/dcache.c:?)
[ 24.976492][ T561] shrink_dentry_list (fs/dcache.c:1114)
[ 24.976495][ T561] shrink_dcache_parent (fs/dcache.c:1550)
[ 24.976498][ T561] d_invalidate (fs/dcache.c:1660)
[ 24.976502][ T561] proc_invalidate_siblings_dcache (fs/proc/inode.c:143)
[ 24.976507][ T561] release_task (kernel/exit.c:292)
[ 24.976510][ T561] wait_consider_task (kernel/exit.c:1276)
[ 24.976513][ T561] __do_wait (kernel/exit.c:1565 kernel/exit.c:1681)
[ 24.976515][ T561] ? do_wait (kernel/exit.c:1714)
[ 24.976517][ T561] do_wait (kernel/exit.c:1716)
[ 24.976519][ T561] kernel_wait4 (kernel/exit.c:1874)
[ 24.976522][ T561] ? get_task_struct (kernel/exit.c:1599)
[ 24.976524][ T561] __x64_sys_wait4 (kernel/exit.c:1902 kernel/exit.c:1898 kernel/exit.c:1898)
[ 24.976526][ T561] ? _copy_to_user (arch/x86/include/asm/uaccess_64.h:126 arch/x86/include/asm/uaccess_64.h:134 arch/x86/include/asm/uaccess_64.h:147 include/linux/uaccess.h:204 lib/usercopy.c:26)
[ 24.976530][ T561] ? __x64_sys_rt_sigaction (include/linux/uaccess.h:232 kernel/signal.c:4648 kernel/signal.c:4629 kernel/signal.c:4629)
[ 24.976535][ T561] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 24.976538][ T561] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 24.976539][ T561] ? _copy_from_user (arch/x86/include/asm/uaccess_64.h:126 arch/x86/include/asm/uaccess_64.h:141 include/linux/uaccess.h:185 lib/usercopy.c:18)
[ 24.976541][ T561] ? __x64_sys_rt_sigprocmask (kernel/signal.c:3340)
[ 24.976544][ T561] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 24.976546][ T561] ? do_user_addr_fault (arch/x86/mm/fault.c:1337)
[ 24.976549][ T561] ? irqentry_exit (include/linux/rseq_entry.h:576 include/linux/irq-entry-common.h:271 include/linux/irq-entry-common.h:339 kernel/entry/common.c:196)
[ 24.976553][ T561] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 24.976556][ T561] RIP: 0033:0x7f1031cb6c3e
[ 24.976560][ T561] Code: 00 f7 d8 64 89 02 48 89 f8 eb cc 90 48 83 ec 28 8b 05 aa e5 2f 00 85 c0 75 1d 45 31 d2 48 63 d2 48 63 ff b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 48 83 c4 28 c3 89 54 24 08 48 89 74 24 10
All code
========
0: 00 f7 add %dh,%bh
2: d8 64 89 02 fsubs 0x2(%rcx,%rcx,4)
6: 48 89 f8 mov %rdi,%rax
9: eb cc jmp 0xffffffffffffffd7
b: 90 nop
c: 48 83 ec 28 sub $0x28,%rsp
10: 8b 05 aa e5 2f 00 mov 0x2fe5aa(%rip),%eax # 0x2fe5c0
16: 85 c0 test %eax,%eax
18: 75 1d jne 0x37
1a: 45 31 d2 xor %r10d,%r10d
1d: 48 63 d2 movslq %edx,%rdx
20: 48 63 ff movslq %edi,%rdi
23: b8 3d 00 00 00 mov $0x3d,%eax
28: 0f 05 syscall
2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction
30: 77 51 ja 0x83
32: 48 83 c4 28 add $0x28,%rsp
36: c3 ret
37: 89 54 24 08 mov %edx,0x8(%rsp)
3b: 48 89 74 24 10 mov %rsi,0x10(%rsp)
Code starting with the faulting instruction
===========================================
0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
6: 77 51 ja 0x59
8: 48 83 c4 28 add $0x28,%rsp
c: c3 ret
d: 89 54 24 08 mov %edx,0x8(%rsp)
11: 48 89 74 24 10 mov %rsi,0x10(%rsp)
[ 24.976562][ T561] RSP: 002b:00007fff879dfb10 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
[ 24.976564][ T561] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f1031cb6c3e
[ 24.976566][ T561] RDX: 0000000000000000 RSI: 00007fff879dfb78 RDI: ffffffffffffffff
[ 24.976567][ T561] RBP: 000000001dc65f00 R08: 000000001dc65f48 R09: 0000000000000000
[ 24.976568][ T561] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 24.976570][ T561] R13: 0000000000000000 R14: 0000000000000000 R15: 00000000ffffffff
[ 24.976572][ T561] </TASK>
[ 26.014722][ T539] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 26.015763][ T539] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 539, name: post-run
[ 26.016818][ T539] preempt_count: 1, expected: 0
[ 26.017515][ T539] RCU nest depth: 0, expected: 0
[ 26.018261][ T539] CPU: 0 UID: 0 PID: 539 Comm: post-run Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 26.018266][ T539] Tainted: [W]=WARN
[ 26.018266][ T539] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 26.018268][ T539] Call Trace:
[ 26.018271][ T539] <TASK>
[ 26.018274][ T539] dump_stack_lvl (lib/dump_stack.c:123)
[ 26.018284][ T539] __might_resched (kernel/sched/core.c:8838)
[ 26.018289][ T539] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 26.018293][ T539] __dentry_kill (fs/dcache.c:?)
[ 26.018296][ T539] dput (fs/dcache.c:912)
[ 26.018299][ T539] __fput (fs/file_table.c:477)
[ 26.018302][ T539] __x64_sys_close (fs/open.c:1591)
[ 26.018305][ T539] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 26.018309][ T539] ? mutex_lock (arch/x86/include/asm/current.h:25 kernel/locking/mutex.c:152 kernel/locking/mutex.c:273)
[ 26.018311][ T539] ? anon_pipe_read (fs/pipe.c:404)
[ 26.018313][ T539] ? arch_exit_to_user_mode_prepare (arch/x86/include/asm/entry-common.h:?)
[ 26.018317][ T539] ? vfs_read (fs/read_write.c:492)
[ 26.018319][ T539] ? __x64_sys_read (fs/read_write.c:?)
[ 26.018321][ T539] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 26.018323][ T539] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 26.018324][ T539] ? do_user_addr_fault (arch/x86/mm/fault.c:1337)
[ 26.018328][ T539] ? irqentry_exit (include/linux/rseq_entry.h:576 include/linux/irq-entry-common.h:271 include/linux/irq-entry-common.h:339 kernel/entry/common.c:196)
[ 26.018332][ T539] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 26.018334][ T539] RIP: 0033:0x7f1031cde040
[ 26.018338][ T539] Code: 40 75 0b 31 c0 48 83 c4 08 e9 0c ff ff ff 48 8d 3d c5 99 09 00 e8 a0 3f 02 00 83 3d 9d 71 2d 00 00 75 10 b8 03 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 9e b1 01 00 48 89 04 24
All code
========
0: 40 75 0b rex jne 0xe
3: 31 c0 xor %eax,%eax
5: 48 83 c4 08 add $0x8,%rsp
9: e9 0c ff ff ff jmp 0xffffffffffffff1a
e: 48 8d 3d c5 99 09 00 lea 0x999c5(%rip),%rdi # 0x999da
15: e8 a0 3f 02 00 call 0x23fba
1a: 83 3d 9d 71 2d 00 00 cmpl $0x0,0x2d719d(%rip) # 0x2d71be
21: 75 10 jne 0x33
23: b8 03 00 00 00 mov $0x3,%eax
28: 0f 05 syscall
2a:* 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax <-- trapping instruction
30: 73 31 jae 0x63
32: c3 ret
33: 48 83 ec 08 sub $0x8,%rsp
37: e8 9e b1 01 00 call 0x1b1da
3c: 48 89 04 24 mov %rax,(%rsp)
Code starting with the faulting instruction
===========================================
0: 48 3d 01 f0 ff ff cmp $0xfffffffffffff001,%rax
6: 73 31 jae 0x39
8: c3 ret
9: 48 83 ec 08 sub $0x8,%rsp
d: e8 9e b1 01 00 call 0x1b1b0
12: 48 89 04 24 mov %rax,(%rsp)
[ 26.018340][ T539] RSP: 002b:00007fff879e0888 EFLAGS: 00000246 ORIG_RAX: 0000000000000003
[ 26.018343][ T539] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007f1031cde040
[ 26.018345][ T539] RDX: 0000000000000001 RSI: 0000000000000002 RDI: 0000000000000003
[ 26.018346][ T539] RBP: 0000000000000000 R08: 000000000000000a R09: 0000000000000000
[ 26.018347][ T539] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fff879e08e4
[ 26.018348][ T539] R13: 0000000000000080 R14: 000000000000000a R15: 000000001dc65a08
[ 26.018350][ T539] </TASK>
[ 27.079314][ T577] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 27.080408][ T577] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 577, name: grep
[ 27.081456][ T577] preempt_count: 1, expected: 0
[ 27.082233][ T577] RCU nest depth: 0, expected: 0
[ 27.082945][ T577] CPU: 0 UID: 0 PID: 577 Comm: grep Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 27.082949][ T577] Tainted: [W]=WARN
[ 27.082950][ T577] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 27.082951][ T577] Call Trace:
[ 27.082954][ T577] <TASK>
[ 27.082957][ T577] dump_stack_lvl (lib/dump_stack.c:123)
[ 27.082966][ T577] __might_resched (kernel/sched/core.c:8838)
[ 27.082972][ T577] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 27.082979][ T577] __dentry_kill (fs/dcache.c:?)
[ 27.082983][ T577] dput (fs/dcache.c:912)
[ 27.082986][ T577] __fput (fs/file_table.c:477)
[ 27.082989][ T577] task_work_run (kernel/task_work.c:235)
[ 27.082994][ T577] do_exit (kernel/exit.c:971)
[ 27.082997][ T577] do_group_exit (kernel/exit.c:1111)
[ 27.083000][ T577] __x64_sys_exit_group (kernel/exit.c:1122)
[ 27.083001][ T577] x64_sys_call (??:?)
[ 27.083004][ T577] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 27.083008][ T577] ? __x64_sys_close (fs/open.c:1591)
[ 27.083010][ T577] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 27.083011][ T577] ? do_user_addr_fault (arch/x86/mm/fault.c:1337)
[ 27.083015][ T577] ? irqentry_exit (include/linux/rseq_entry.h:576 include/linux/irq-entry-common.h:271 include/linux/irq-entry-common.h:339 kernel/entry/common.c:196)
[ 27.083018][ T577] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 27.083021][ T577] RIP: 0033:0x7f5f03de3408
[ 27.083024][ T577] Code: Unable to access opcode bytes at 0x7f5f03de33de.
Code starting with the faulting instruction
===========================================
[ 27.083025][ T577] RSP: 002b:00007ffd05f705b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 27.083028][ T577] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f5f03de3408
[ 27.083029][ T577] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[ 27.083031][ T577] RBP: 00007f5f040d7820 R08: 00000000000000e7 R09: ffffffffffffffa0
[ 27.083032][ T577] R10: 00007f5f040ddb80 R11: 0000000000000246 R12: 00007f5f040d7820
[ 27.083033][ T577] R13: 0000000000000001 R14: 000000002f100438 R15: 000000000000000a
[ 27.083036][ T577] </TASK>
[ 28.126767][ T582] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 28.127828][ T582] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 582, name: grep
[ 28.128876][ T582] preempt_count: 1, expected: 0
[ 28.129633][ T582] RCU nest depth: 0, expected: 0
[ 28.130368][ T582] CPU: 1 UID: 0 PID: 582 Comm: grep Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 28.130373][ T582] Tainted: [W]=WARN
[ 28.130374][ T582] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 28.130375][ T582] Call Trace:
[ 28.130379][ T582] <TASK>
[ 28.130381][ T582] dump_stack_lvl (lib/dump_stack.c:123)
[ 28.130391][ T582] __might_resched (kernel/sched/core.c:8838)
[ 28.130396][ T582] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 28.130400][ T582] __dentry_kill (fs/dcache.c:?)
[ 28.130404][ T582] dput (fs/dcache.c:912)
[ 28.130407][ T582] __fput (fs/file_table.c:477)
[ 28.130410][ T582] task_work_run (kernel/task_work.c:235)
[ 28.130414][ T582] do_exit (kernel/exit.c:971)
[ 28.130418][ T582] ? get_page_from_freelist (mm/page_alloc.c:?)
[ 28.130421][ T582] do_group_exit (kernel/exit.c:1111)
[ 28.130423][ T582] __x64_sys_exit_group (kernel/exit.c:1122)
[ 28.130425][ T582] x64_sys_call (??:?)
[ 28.130428][ T582] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 28.130431][ T582] ? __x64_sys_close (fs/open.c:1591)
[ 28.130433][ T582] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 28.130435][ T582] ? __x64_sys_close (fs/open.c:1591)
[ 28.130436][ T582] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 28.130438][ T582] ? alloc_pages_mpol (mm/mempolicy.c:2481)
[ 28.130443][ T582] ? update_curr (kernel/sched/fair.c:1224)
[ 28.130445][ T582] ? place_entity (kernel/sched/fair.c:?)
[ 28.130447][ T582] ? kvm_sched_clock_read (arch/x86/kernel/kvmclock.c:91)
[ 28.130450][ T582] ? __smp_call_single_queue (kernel/smp.c:117)
[ 28.130454][ T582] ? native_smp_send_reschedule (arch/x86/kernel/apic/ipi.c:78)
[ 28.130457][ T582] ? ttwu_queue_wakelist (kernel/sched/core.c:? kernel/sched/core.c:3880)
[ 28.130459][ T582] ? try_to_wake_up (kernel/sched/core.c:4224)
[ 28.130460][ T582] ? tick_setup_sched_timer (kernel/time/tick-sched.c:307)
[ 28.130464][ T582] ? swake_up_one (include/linux/list.h:226 include/linux/list.h:295 kernel/sched/swait.c:31 kernel/sched/swait.c:53)
[ 28.130467][ T582] ? kvm_sched_clock_read (arch/x86/kernel/kvmclock.c:91)
[ 28.130469][ T582] ? sched_clock (arch/x86/include/asm/preempt.h:95 arch/x86/kernel/tsc.c:289)
[ 28.130477][ T582] ? sched_clock_cpu (kernel/sched/clock.c:397)
[ 28.130478][ T582] ? irqtime_account_irq (kernel/sched/cputime.c:67)
[ 28.130481][ T582] ? handle_softirqs (arch/x86/include/asm/preempt.h:27 kernel/softirq.c:407 kernel/softirq.c:468 kernel/softirq.c:654)
[ 28.130483][ T582] ? irqentry_exit (include/linux/rseq_entry.h:576 include/linux/irq-entry-common.h:271 include/linux/irq-entry-common.h:339 kernel/entry/common.c:196)
[ 28.130486][ T582] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 28.130488][ T582] RIP: 0033:0x7fe98a926408
[ 28.130491][ T582] Code: Unable to access opcode bytes at 0x7fe98a9263de.
Code starting with the faulting instruction
===========================================
[ 28.130493][ T582] RSP: 002b:00007ffc82246da8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 28.130496][ T582] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe98a926408
[ 28.130497][ T582] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[ 28.130498][ T582] RBP: 00007fe98ac1a820 R08: 00000000000000e7 R09: ffffffffffffffa0
[ 28.130499][ T582] R10: 00007fe98ac20b80 R11: 0000000000000246 R12: 00007fe98ac1a820
[ 28.130501][ T582] R13: 0000000000000001 R14: 0000000012c71014 R15: 000000000000000a
[ 28.130503][ T582] </TASK>
[ 28.839638][ T107] /usr/bin/wget -nv --timeout=3600 --tries=1 --local-encoding=UTF-8 http://internal-lkp-server:80/~lkp/cgi-bin/lkp-jobfile-append-var?job_file=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml&loadavg=0.78%200.19%200.06%201/108%20594&start_time=1762799196&end_time=1762799197&version=/lkp/lkp/.src-20251109-171750:1aad5493ad31-dirty:35b842bfeaee-dirty& -O /dev/null
[ 28.839648][ T107]
[ 29.442824][ T614] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 29.443836][ T614] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 614, name: wget
[ 29.444824][ T614] preempt_count: 1, expected: 0
[ 29.445535][ T614] RCU nest depth: 0, expected: 0
[ 29.446242][ T614] CPU: 1 UID: 0 PID: 614 Comm: wget Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 29.446246][ T614] Tainted: [W]=WARN
[ 29.446247][ T614] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 29.446249][ T614] Call Trace:
[ 29.446252][ T614] <TASK>
[ 29.446255][ T614] dump_stack_lvl (lib/dump_stack.c:123)
[ 29.446265][ T614] __might_resched (kernel/sched/core.c:8838)
[ 29.446270][ T614] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 29.446274][ T614] __dentry_kill (fs/dcache.c:?)
[ 29.446278][ T614] dput (fs/dcache.c:912)
[ 29.446280][ T614] __fput (fs/file_table.c:477)
[ 29.446283][ T614] task_work_run (kernel/task_work.c:235)
[ 29.446287][ T614] do_exit (kernel/exit.c:971)
[ 29.446290][ T614] ? __lruvec_stat_mod_folio (include/linux/rcupdate.h:899 mm/memcontrol.c:798)
[ 29.446292][ T614] do_group_exit (kernel/exit.c:1111)
[ 29.446294][ T614] __x64_sys_exit_group (kernel/exit.c:1122)
[ 29.446296][ T614] x64_sys_call (??:?)
[ 29.446298][ T614] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 29.446300][ T614] ? filemap_map_pages (mm/filemap.c:3935)
[ 29.446307][ T614] ? count_memcg_events (mm/memcontrol.c:? mm/memcontrol.c:847)
[ 29.446308][ T614] ? handle_mm_fault (mm/memory.c:6423)
[ 29.446317][ T614] ? do_user_addr_fault (arch/x86/mm/fault.c:1337)
[ 29.446321][ T614] ? __x64_sys_close (fs/open.c:1591)
[ 29.446323][ T614] ? irqentry_exit (include/linux/rseq_entry.h:576 include/linux/irq-entry-common.h:271 include/linux/irq-entry-common.h:339 kernel/entry/common.c:196)
[ 29.446326][ T614] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 29.446329][ T614] RIP: 0033:0x7f69b74d2408
[ 29.446331][ T614] Code: Unable to access opcode bytes at 0x7f69b74d23de.
Code starting with the faulting instruction
===========================================
[ 29.446332][ T614] RSP: 002b:00007ffcd55f1d78 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 29.446335][ T614] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f69b74d2408
[ 29.446337][ T614] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[ 29.446338][ T614] RBP: 00007f69b77c6820 R08: 00000000000000e7 R09: ffffffffffffffa0
[ 29.446339][ T614] R10: 00007f69b77cdfa8 R11: 0000000000000246 R12: 00007f69b77c6820
[ 29.446340][ T614] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
[ 29.446343][ T614] </TASK>
[ 29.519252][ T107] /usr/bin/wget -nv --timeout=3600 --tries=1 --local-encoding=UTF-8 http://internal-lkp-server:80/~lkp/cgi-bin/lkp-jobfile-append-var?job_file=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml&job_state=finished -O /dev/null
[ 29.519260][ T107]
[ 29.555346][ T109] 2025-11-10 18:26:44 URL:http://internal-lkp-server/~lkp/cgi-bin/lkp-jobfile-append-var?job_file=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml&loadavg=0.78%200.19%200.06%201/108%20594&start_time=1762799196&end_time=1762799197&version=/lkp/lkp/.src-20251109-171750:1aad5493ad31-dirty:35b842bfeaee-dirty& [0/0] -> "/dev/null" [1]
[ 29.555355][ T109]
[ 30.276210][ T109] 2025-11-10 18:26:45 URL:http://internal-lkp-server/~lkp/cgi-bin/lkp-jobfile-append-var?job_file=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml&job_state=finished [0/0] -> "/dev/null" [1]
LKP: ttyS0: 86: LKP: rebooting forcely
[ 30.276218][ T109]
[ 30.285962][ T107] LKP: stdout: 86: LKP: rebooting forcely
[ 30.285968][ T107]
[ 30.324585][ T107] /usr/bin/wget -nv --timeout=3600 --tries=1 --local-encoding=UTF-8 http://internal-lkp-server:80/~lkp/cgi-bin/lkp-wtmp?tbox_name=vm-snb&tbox_state=rebooting&job_file=/lkp/jobs/scheduled/vm-meta-119/boot-1-quantal-x86_64-core-20190426.cgz-29fb8368dfb5-20251110-11844-dgg7hi-0.yaml -O /dev/null
[ 30.324593][ T107]
[ 31.152096][ T641] BUG: sleeping function called from invalid context at fs/inode.c:1920
[ 31.153357][ T641] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 641, name: wget
[ 31.154471][ T641] preempt_count: 1, expected: 0
[ 31.155280][ T641] RCU nest depth: 0, expected: 0
[ 31.156362][ T641] CPU: 1 UID: 0 PID: 641 Comm: wget Tainted: G W 6.18.0-rc4-next-20251105-00001-g29fb8368dfb5 #1 PREEMPT(voluntary)
[ 31.156367][ T641] Tainted: [W]=WARN
[ 31.156367][ T641] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 31.156369][ T641] Call Trace:
[ 31.156392][ T641] <TASK>
[ 31.156395][ T641] dump_stack_lvl (lib/dump_stack.c:123)
[ 31.156408][ T641] __might_resched (kernel/sched/core.c:8838)
[ 31.156415][ T641] iput (include/linux/kernel.h:61 fs/inode.c:1920 fs/inode.c:2010)
[ 31.156420][ T641] __dentry_kill (fs/dcache.c:?)
[ 31.156423][ T641] dput (fs/dcache.c:912)
[ 31.156429][ T641] __fput (fs/file_table.c:477)
[ 31.156432][ T641] task_work_run (kernel/task_work.c:235)
[ 31.156436][ T641] do_exit (kernel/exit.c:971)
[ 31.156440][ T641] do_group_exit (kernel/exit.c:1111)
[ 31.156442][ T641] __x64_sys_exit_group (kernel/exit.c:1122)
[ 31.156444][ T641] x64_sys_call (??:?)
[ 31.156447][ T641] do_syscall_64 (arch/x86/entry/syscall_64.c:?)
[ 31.156451][ T641] ? count_memcg_events (mm/memcontrol.c:? mm/memcontrol.c:847)
[ 31.156453][ T641] ? handle_mm_fault (mm/memory.c:6423)
[ 31.156458][ T641] ? do_user_addr_fault (arch/x86/mm/fault.c:1337)
[ 31.156462][ T641] ? do_syscall_64 (arch/x86/include/asm/atomic64_64.h:15 include/linux/atomic/atomic-arch-fallback.h:2583 include/linux/atomic/atomic-long.h:38 include/linux/atomic/atomic-instrumented.h:3189 include/linux/unwind_deferred.h:37 include/linux/irq-entry-common.h:300 include/linux/entry-common.h:196 arch/x86/entry/syscall_64.c:100)
[ 31.156463][ T641] ? irqentry_exit (include/linux/rseq_entry.h:576 include/linux/irq-entry-common.h:271 include/linux/irq-entry-common.h:339 kernel/entry/common.c:196)
[ 31.156466][ T641] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
[ 31.156468][ T641] RIP: 0033:0x7f07d32bf408
[ 31.156471][ T641] Code: Unable to access opcode bytes at 0x7f07d32bf3de.
Code starting with the faulting instruction
===========================================
[ 31.156472][ T641] RSP: 002b:00007ffc164c7eb8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7
[ 31.156475][ T641] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f07d32bf408
[ 31.156477][ T641] RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000
[ 31.156478][ T641] RBP: 00007f07d35b3820 R08: 00000000000000e7 R09: ffffffffffffffa0
[ 31.156479][ T641] R10: 00007f07d35bafa8 R11: 0000000000000246 R12: 00007f07d35b3820
[ 31.156480][ T641] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
[ 31.156482][ T641] </TASK>
The kernel config and materials to reproduce are available at:
https://download.01.org/0day-ci/archive/20251112/202511121304.5e522f7b-lkp@intel.com
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [PATCH 1/2] fs: add iput_not_last()
From: Christian Brauner @ 2025-11-12 9:48 UTC (permalink / raw)
To: Mateusz Guzik
Cc: mic, linux-security-module, linux-fsdevel, viro, eadavis, gnoack,
jack, jannh, max.kellermann, m, syzbot+12479ae15958fc3f54ec
In-Reply-To: <CAGudoHF_9_7cEgwtX=huvSf1q-FF0gSwTn2imXHmszYoa2xPZA@mail.gmail.com>
On Tue, Nov 11, 2025 at 12:53:53PM +0100, Mateusz Guzik wrote:
> On Tue, Nov 11, 2025 at 12:46 PM Christian Brauner <brauner@kernel.org> wrote:
> >
> > On Wed, 05 Nov 2025 22:20:24 +0100, Mateusz Guzik wrote:
> > >
> >
> >
> > Applied to the vfs-6.19.inode branch of the vfs/vfs.git tree.
> > Patches in the vfs-6.19.inode branch should appear in linux-next soon.
> >
>
> That might_sleep in iput is already in master slated for 6.18, so this
> should land in vfs.fixes instead.
Done, thanks.
^ permalink raw reply
* Re: [PATCH v17] exec: Fix dead-lock in de_thread with ptrace_attach
From: Oleg Nesterov @ 2025-11-12 9:52 UTC (permalink / raw)
To: Bernd Edlinger
Cc: Christian Brauner, Alexander Viro, Alexey Dobriyan, Kees Cook,
Andy Lutomirski, Will Drewry, Andrew Morton, Michal Hocko,
Serge Hallyn, James Morris, Randy Dunlap, Suren Baghdasaryan,
Yafang Shao, Helge Deller, Eric W. Biederman, Adrian Reber,
Thomas Gleixner, Jens Axboe, Alexei Starovoitov,
linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-kselftest, linux-mm, linux-security-module, tiozhang,
Luis Chamberlain, Paulo Alcantara (SUSE), Sergey Senozhatsky,
Frederic Weisbecker, YueHaibing, Paul Moore, Aleksa Sarai,
Stefan Roesch, Chao Yu, xu xin, Jeff Layton, Jan Kara,
David Hildenbrand, Dave Chinner, Shuah Khan, Elena Reshetova,
David Windsor, Mateusz Guzik, Ard Biesheuvel,
Joel Fernandes (Google), Matthew Wilcox (Oracle),
Hans Liljestrand, Penglei Jiang, Lorenzo Stoakes, Adrian Ratiu,
Ingo Molnar, Peter Zijlstra (Intel), Cyrill Gorcunov,
Eric Dumazet
In-Reply-To: <GV2PPF74270EBEE16FE36CF873C5C2309A9E4CFA@GV2PPF74270EBEE.EURP195.PROD.OUTLOOK.COM>
On 11/11, Bernd Edlinger wrote:
>
> On 11/11/25 14:12, Oleg Nesterov wrote:
> > On 11/11, Bernd Edlinger wrote:
> >>
> >> Well when this is absolutely not acceptable then I would have to change
> >> all security engines to be aware of the current and the new credentials.
> >
> > Hmm... even if we find another way to avoid the deadlock? Say, the patches
> > I sent...
> >
>
> Maybe, but it looks almost too simple ;-)
>
> 164 sleep(2);
> 165 /* deadlock may happen here */
> 166 k = ptrace(PTRACE_ATTACH, thread2_tid, 0L, 0L);
>
> what happens if you change the test expectation here, that the
> ptrace may fail instead of succeed?
>
> What signals does the debugger receive after that point?
> Is the debugger notified that the debugged process continues,
> has the same PID, and is no longer ptraced?
Ah, but this is another thing... OK, you dislike 3/3 and I have to agree.
Yes, de_thread() silently untraces/reaps the old leader and after 3/3 debugger
can't rely on PTRACE_EVENT_EXIT, so unless the debugger has already attached to
all sub-threads (at least to execing thread) it looks as if the leader was just
untraced somehow.
OK, this is probably too bad, we need another solution...
Oleg.
^ permalink raw reply
* Re: [PATCH] security: sctp: Format type and permission checks tables
From: Bagas Sanjaya @ 2025-11-12 12:07 UTC (permalink / raw)
To: Paul Moore
Cc: Linux Kernel Mailing List, Linux Documentation,
Linux Security Module, Jonathan Corbet, Jarkko Sakkinen,
Christian Brauner, Jeff Layton, Kees Cook,
Mickaël Salaün, Stuart Yoder, Randy Dunlap
In-Reply-To: <CAHC9VhQeghqosexgOQO3==poNwsf_6mNiOqkUTUOdYnzRYzKmQ@mail.gmail.com>
[-- Attachment #1: Type: text/plain, Size: 594 bytes --]
On Tue, Nov 11, 2025 at 07:50:56PM -0500, Paul Moore wrote:
> On Mon, Nov 10, 2025 at 9:35 PM Bagas Sanjaya <bagasdotme@gmail.com> wrote:
> >
> > On Mon, Nov 03, 2025 at 06:39:23PM +0700, Bagas Sanjaya wrote:
> > > Use reST grid tables for both type and permission checks tables.
> >
> > review ping
>
> You don't need to 'ping' for a review, your patch is in my review
> queue, but code changes take priority at this point in the dev cycle
> as I'm okay with merging documentation changes fairly late.
OK, thanks!
--
An old man doll... just what I always wanted! - Clara
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply
* Re: [PATCH v5 02/14] VFS: introduce start_dirop() and end_dirop()
From: Jeff Layton @ 2025-11-12 14:46 UTC (permalink / raw)
To: NeilBrown, Alexander Viro, Christian Brauner, Amir Goldstein
Cc: Jan Kara, linux-fsdevel, Chris Mason, David Sterba, David Howells,
Greg Kroah-Hartman, Rafael J. Wysocki, Danilo Krummrich,
Tyler Hicks, Miklos Szeredi, Chuck Lever, Olga Kornievskaia,
Dai Ngo, Namjae Jeon, Steve French, Sergey Senozhatsky,
Carlos Maiolino, John Johansen, Paul Moore, James Morris,
Serge E. Hallyn, Stephen Smalley, Ondrej Mosnacek, Mateusz Guzik,
Lorenzo Stoakes, Stefan Berger, Darrick J. Wong, linux-kernel,
netfs, ecryptfs, linux-nfs, linux-unionfs, linux-cifs, linux-xfs,
linux-security-module, selinux
In-Reply-To: <20251106005333.956321-3-neilb@ownmail.net>
On Thu, 2025-11-06 at 11:50 +1100, NeilBrown wrote:
> From: NeilBrown <neil@brown.name>
>
> The fact that directory operations (create,remove,rename) are protected
> by a lock on the parent is known widely throughout the kernel.
> In order to change this - to instead lock the target dentry - it is
> best to centralise this knowledge so it can be changed in one place.
>
> This patch introduces start_dirop() which is local to VFS code.
> It performs the required locking for create and remove. Rename
> will be handled separately.
>
> Various functions with names like start_creating() or start_removing_path(),
> some of which already exist, will export this functionality beyond the VFS.
>
> end_dirop() is the partner of start_dirop(). It drops the lock and
> releases the reference on the dentry.
> It *is* exported so that various end_creating etc functions can be inline.
>
> As vfs_mkdir() drops the dentry on error we cannot use end_dirop() as
> that won't unlock when the dentry IS_ERR(). For now we need an explicit
> unlock when dentry IS_ERR(). I hope to change vfs_mkdir() to unlock
> when it drops a dentry so that explicit unlock can go away.
>
> end_dirop() can always be called on the result of start_dirop(), but not
> after vfs_mkdir(). After a vfs_mkdir() we still may need the explicit
> unlock as seen in end_creating_path().
>
> As well as adding start_dirop() and end_dirop()
> this patch uses them in:
> - simple_start_creating (which requires sharing lookup_noperm_common()
> with libfs.c)
> - start_removing_path / start_removing_user_path_at
> - filename_create / end_creating_path()
> - do_rmdir(), do_unlinkat()
>
> Reviewed-by: Amir Goldstein <amir73il@gmail.com>
> Signed-off-by: NeilBrown <neil@brown.name>
> ---
> fs/internal.h | 3 ++
> fs/libfs.c | 36 ++++++++---------
> fs/namei.c | 98 ++++++++++++++++++++++++++++++++++------------
> include/linux/fs.h | 2 +
> 4 files changed, 95 insertions(+), 44 deletions(-)
>
> diff --git a/fs/internal.h b/fs/internal.h
> index 9b2b4d116880..d08d5e2235e9 100644
> --- a/fs/internal.h
> +++ b/fs/internal.h
> @@ -67,6 +67,9 @@ int vfs_tmpfile(struct mnt_idmap *idmap,
> const struct path *parentpath,
> struct file *file, umode_t mode);
> struct dentry *d_hash_and_lookup(struct dentry *, struct qstr *);
> +struct dentry *start_dirop(struct dentry *parent, struct qstr *name,
> + unsigned int lookup_flags);
> +int lookup_noperm_common(struct qstr *qname, struct dentry *base);
>
> /*
> * namespace.c
> diff --git a/fs/libfs.c b/fs/libfs.c
> index 1661dcb7d983..2d6657947abd 100644
> --- a/fs/libfs.c
> +++ b/fs/libfs.c
> @@ -2290,27 +2290,25 @@ void stashed_dentry_prune(struct dentry *dentry)
> cmpxchg(stashed, dentry, NULL);
> }
>
> -/* parent must be held exclusive */
> +/**
> + * simple_start_creating - prepare to create a given name
> + * @parent: directory in which to prepare to create the name
> + * @name: the name to be created
> + *
> + * Required lock is taken and a lookup in performed prior to creating an
> + * object in a directory. No permission checking is performed.
> + *
> + * Returns: a negative dentry on which vfs_create() or similar may
> + * be attempted, or an error.
> + */
> struct dentry *simple_start_creating(struct dentry *parent, const char *name)
> {
> - struct dentry *dentry;
> - struct inode *dir = d_inode(parent);
> + struct qstr qname = QSTR(name);
> + int err;
>
> - inode_lock(dir);
> - if (unlikely(IS_DEADDIR(dir))) {
> - inode_unlock(dir);
> - return ERR_PTR(-ENOENT);
> - }
> - dentry = lookup_noperm(&QSTR(name), parent);
> - if (IS_ERR(dentry)) {
> - inode_unlock(dir);
> - return dentry;
> - }
> - if (dentry->d_inode) {
> - dput(dentry);
> - inode_unlock(dir);
> - return ERR_PTR(-EEXIST);
> - }
> - return dentry;
> + err = lookup_noperm_common(&qname, parent);
> + if (err)
> + return ERR_PTR(err);
> + return start_dirop(parent, &qname, LOOKUP_CREATE | LOOKUP_EXCL);
> }
> EXPORT_SYMBOL(simple_start_creating);
> diff --git a/fs/namei.c b/fs/namei.c
> index 39c4d52f5b54..231e1ffd4b8d 100644
> --- a/fs/namei.c
> +++ b/fs/namei.c
> @@ -2765,6 +2765,48 @@ static int filename_parentat(int dfd, struct filename *name,
> return __filename_parentat(dfd, name, flags, parent, last, type, NULL);
> }
>
> +/**
> + * start_dirop - begin a create or remove dirop, performing locking and lookup
> + * @parent: the dentry of the parent in which the operation will occur
> + * @name: a qstr holding the name within that parent
> + * @lookup_flags: intent and other lookup flags.
> + *
> + * The lookup is performed and necessary locks are taken so that, on success,
> + * the returned dentry can be operated on safely.
> + * The qstr must already have the hash value calculated.
> + *
> + * Returns: a locked dentry, or an error.
> + *
> + */
> +struct dentry *start_dirop(struct dentry *parent, struct qstr *name,
> + unsigned int lookup_flags)
> +{
> + struct dentry *dentry;
> + struct inode *dir = d_inode(parent);
> +
> + inode_lock_nested(dir, I_MUTEX_PARENT);
> + dentry = lookup_one_qstr_excl(name, parent, lookup_flags);
> + if (IS_ERR(dentry))
> + inode_unlock(dir);
> + return dentry;
> +}
> +
> +/**
> + * end_dirop - signal completion of a dirop
> + * @de: the dentry which was returned by start_dirop or similar.
> + *
> + * If the de is an error, nothing happens. Otherwise any lock taken to
> + * protect the dentry is dropped and the dentry itself is release (dput()).
> + */
> +void end_dirop(struct dentry *de)
> +{
> + if (!IS_ERR(de)) {
> + inode_unlock(de->d_parent->d_inode);
> + dput(de);
> + }
> +}
> +EXPORT_SYMBOL(end_dirop);
> +
> /* does lookup, returns the object with parent locked */
> static struct dentry *__start_removing_path(int dfd, struct filename *name,
> struct path *path)
> @@ -2781,10 +2823,9 @@ static struct dentry *__start_removing_path(int dfd, struct filename *name,
> return ERR_PTR(-EINVAL);
> /* don't fail immediately if it's r/o, at least try to report other errors */
> error = mnt_want_write(parent_path.mnt);
> - inode_lock_nested(parent_path.dentry->d_inode, I_MUTEX_PARENT);
> - d = lookup_one_qstr_excl(&last, parent_path.dentry, 0);
> + d = start_dirop(parent_path.dentry, &last, 0);
> if (IS_ERR(d))
> - goto unlock;
> + goto drop;
> if (error)
> goto fail;
> path->dentry = no_free_ptr(parent_path.dentry);
> @@ -2792,10 +2833,9 @@ static struct dentry *__start_removing_path(int dfd, struct filename *name,
> return d;
>
> fail:
> - dput(d);
> + end_dirop(d);
> d = ERR_PTR(error);
> -unlock:
> - inode_unlock(parent_path.dentry->d_inode);
> +drop:
> if (!error)
> mnt_drop_write(parent_path.mnt);
> return d;
> @@ -2910,7 +2950,7 @@ int vfs_path_lookup(struct dentry *dentry, struct vfsmount *mnt,
> }
> EXPORT_SYMBOL(vfs_path_lookup);
>
> -static int lookup_noperm_common(struct qstr *qname, struct dentry *base)
> +int lookup_noperm_common(struct qstr *qname, struct dentry *base)
> {
> const char *name = qname->name;
> u32 len = qname->len;
> @@ -4223,21 +4263,18 @@ static struct dentry *filename_create(int dfd, struct filename *name,
> */
> if (last.name[last.len] && !want_dir)
> create_flags &= ~LOOKUP_CREATE;
> - inode_lock_nested(path->dentry->d_inode, I_MUTEX_PARENT);
> - dentry = lookup_one_qstr_excl(&last, path->dentry,
> - reval_flag | create_flags);
> + dentry = start_dirop(path->dentry, &last, reval_flag | create_flags);
> if (IS_ERR(dentry))
> - goto unlock;
> + goto out_drop_write;
>
> if (unlikely(error))
> goto fail;
>
> return dentry;
> fail:
> - dput(dentry);
> + end_dirop(dentry);
> dentry = ERR_PTR(error);
> -unlock:
> - inode_unlock(path->dentry->d_inode);
> +out_drop_write:
> if (!error)
> mnt_drop_write(path->mnt);
> out:
> @@ -4256,11 +4293,26 @@ struct dentry *start_creating_path(int dfd, const char *pathname,
> }
> EXPORT_SYMBOL(start_creating_path);
>
> +/**
> + * end_creating_path - finish a code section started by start_creating_path()
> + * @path: the path instantiated by start_creating_path()
> + * @dentry: the dentry returned by start_creating_path()
> + *
> + * end_creating_path() will unlock and locks taken by start_creating_path()
> + * and drop an references that were taken. It should only be called
> + * if start_creating_path() returned a non-error.
> + * If vfs_mkdir() was called and it returned an error, that error *should*
> + * be passed to end_creating_path() together with the path.
> + */
> void end_creating_path(const struct path *path, struct dentry *dentry)
> {
> - if (!IS_ERR(dentry))
> - dput(dentry);
> - inode_unlock(path->dentry->d_inode);
> + if (IS_ERR(dentry))
> + /* The parent is still locked despite the error from
> + * vfs_mkdir() - must unlock it.
> + */
> + inode_unlock(path->dentry->d_inode);
> + else
> + end_dirop(dentry);
> mnt_drop_write(path->mnt);
> path_put(path);
> }
> @@ -4592,8 +4644,7 @@ int do_rmdir(int dfd, struct filename *name)
> if (error)
> goto exit2;
>
> - inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
> - dentry = lookup_one_qstr_excl(&last, path.dentry, lookup_flags);
> + dentry = start_dirop(path.dentry, &last, lookup_flags);
> error = PTR_ERR(dentry);
> if (IS_ERR(dentry))
> goto exit3;
> @@ -4602,9 +4653,8 @@ int do_rmdir(int dfd, struct filename *name)
> goto exit4;
> error = vfs_rmdir(mnt_idmap(path.mnt), path.dentry->d_inode, dentry);
> exit4:
> - dput(dentry);
> + end_dirop(dentry);
> exit3:
> - inode_unlock(path.dentry->d_inode);
> mnt_drop_write(path.mnt);
> exit2:
> path_put(&path);
> @@ -4721,8 +4771,7 @@ int do_unlinkat(int dfd, struct filename *name)
> if (error)
> goto exit2;
> retry_deleg:
> - inode_lock_nested(path.dentry->d_inode, I_MUTEX_PARENT);
> - dentry = lookup_one_qstr_excl(&last, path.dentry, lookup_flags);
> + dentry = start_dirop(path.dentry, &last, lookup_flags);
> error = PTR_ERR(dentry);
> if (!IS_ERR(dentry)) {
>
> @@ -4737,9 +4786,8 @@ int do_unlinkat(int dfd, struct filename *name)
> error = vfs_unlink(mnt_idmap(path.mnt), path.dentry->d_inode,
> dentry, &delegated_inode);
> exit3:
> - dput(dentry);
> + end_dirop(dentry);
> }
> - inode_unlock(path.dentry->d_inode);
> if (inode)
> iput(inode); /* truncate the inode here */
> inode = NULL;
> diff --git a/include/linux/fs.h b/include/linux/fs.h
> index 03e450dd5211..9e7556e79d19 100644
> --- a/include/linux/fs.h
> +++ b/include/linux/fs.h
> @@ -3196,6 +3196,8 @@ extern void iterate_supers_type(struct file_system_type *,
> void filesystems_freeze(void);
> void filesystems_thaw(void);
>
> +void end_dirop(struct dentry *de);
> +
> extern int dcache_dir_open(struct inode *, struct file *);
> extern int dcache_dir_close(struct inode *, struct file *);
> extern loff_t dcache_dir_lseek(struct file *, loff_t, int);
Reviewed-by: Jeff Layton <jlayton@kernel.org>
^ permalink raw reply
* Re: [PATCH v5 03/14] VFS: tidy up do_unlinkat()
From: Jeff Layton @ 2025-11-12 14:47 UTC (permalink / raw)
To: NeilBrown, Alexander Viro, Christian Brauner, Amir Goldstein
Cc: Jan Kara, linux-fsdevel, Chris Mason, David Sterba, David Howells,
Greg Kroah-Hartman, Rafael J. Wysocki, Danilo Krummrich,
Tyler Hicks, Miklos Szeredi, Chuck Lever, Olga Kornievskaia,
Dai Ngo, Namjae Jeon, Steve French, Sergey Senozhatsky,
Carlos Maiolino, John Johansen, Paul Moore, James Morris,
Serge E. Hallyn, Stephen Smalley, Ondrej Mosnacek, Mateusz Guzik,
Lorenzo Stoakes, Stefan Berger, Darrick J. Wong, linux-kernel,
netfs, ecryptfs, linux-nfs, linux-unionfs, linux-cifs, linux-xfs,
linux-security-module, selinux
In-Reply-To: <20251106005333.956321-4-neilb@ownmail.net>
On Thu, 2025-11-06 at 11:50 +1100, NeilBrown wrote:
> From: NeilBrown <neil@brown.name>
>
> The simplification of locking in the previous patch opens up some room
> for tidying up do_unlinkat()
>
> - change all "exit" labels to describe what will happen at the label.
> - always goto an exit label on an error - unwrap the "if (!IS_ERR())" branch.
> - Move the "slashes" handing inline, but mark it as unlikely()
> - simplify use of the "inode" variable - we no longer need to test for NULL.
>
> Reviewed-by: Amir Goldstein <amir73il@gmail.com>
> Signed-off-by: NeilBrown <neil@brown.name>
> ---
> fs/namei.c | 55 ++++++++++++++++++++++++++----------------------------
> 1 file changed, 26 insertions(+), 29 deletions(-)
>
> diff --git a/fs/namei.c b/fs/namei.c
> index 231e1ffd4b8d..93c5fce2d814 100644
> --- a/fs/namei.c
> +++ b/fs/namei.c
> @@ -4755,65 +4755,62 @@ int do_unlinkat(int dfd, struct filename *name)
> struct path path;
> struct qstr last;
> int type;
> - struct inode *inode = NULL;
> + struct inode *inode;
> struct inode *delegated_inode = NULL;
> unsigned int lookup_flags = 0;
> retry:
> error = filename_parentat(dfd, name, lookup_flags, &path, &last, &type);
> if (error)
> - goto exit1;
> + goto exit_putname;
>
> error = -EISDIR;
> if (type != LAST_NORM)
> - goto exit2;
> + goto exit_path_put;
>
> error = mnt_want_write(path.mnt);
> if (error)
> - goto exit2;
> + goto exit_path_put;
> retry_deleg:
> dentry = start_dirop(path.dentry, &last, lookup_flags);
> error = PTR_ERR(dentry);
> - if (!IS_ERR(dentry)) {
> + if (IS_ERR(dentry))
> + goto exit_drop_write;
>
> - /* Why not before? Because we want correct error value */
> - if (last.name[last.len])
> - goto slashes;
> - inode = dentry->d_inode;
> - ihold(inode);
> - error = security_path_unlink(&path, dentry);
> - if (error)
> - goto exit3;
> - error = vfs_unlink(mnt_idmap(path.mnt), path.dentry->d_inode,
> - dentry, &delegated_inode);
> -exit3:
> + /* Why not before? Because we want correct error value */
> + if (unlikely(last.name[last.len])) {
> + if (d_is_dir(dentry))
> + error = -EISDIR;
> + else
> + error = -ENOTDIR;
> end_dirop(dentry);
> + goto exit_drop_write;
> }
> - if (inode)
> - iput(inode); /* truncate the inode here */
> - inode = NULL;
> + inode = dentry->d_inode;
> + ihold(inode);
> + error = security_path_unlink(&path, dentry);
> + if (error)
> + goto exit_end_dirop;
> + error = vfs_unlink(mnt_idmap(path.mnt), path.dentry->d_inode,
> + dentry, &delegated_inode);
> +exit_end_dirop:
> + end_dirop(dentry);
> + iput(inode); /* truncate the inode here */
> if (delegated_inode) {
> error = break_deleg_wait(&delegated_inode);
> if (!error)
> goto retry_deleg;
> }
> +exit_drop_write:
> mnt_drop_write(path.mnt);
> -exit2:
> +exit_path_put:
> path_put(&path);
> if (retry_estale(error, lookup_flags)) {
> lookup_flags |= LOOKUP_REVAL;
> - inode = NULL;
> goto retry;
> }
> -exit1:
> +exit_putname:
> putname(name);
> return error;
> -
> -slashes:
> - if (d_is_dir(dentry))
> - error = -EISDIR;
> - else
> - error = -ENOTDIR;
> - goto exit3;
> }
>
> SYSCALL_DEFINE3(unlinkat, int, dfd, const char __user *, pathname, int, flag)
Reviewed-by: Jeff Layton <jlayton@kernel.org>
^ permalink raw reply
* Re: [PATCH v5 05/14] VFS/nfsd/cachefiles/ovl: introduce start_removing() and end_removing()
From: Jeff Layton @ 2025-11-12 14:51 UTC (permalink / raw)
To: NeilBrown, Alexander Viro, Christian Brauner, Amir Goldstein
Cc: Jan Kara, linux-fsdevel, Chris Mason, David Sterba, David Howells,
Greg Kroah-Hartman, Rafael J. Wysocki, Danilo Krummrich,
Tyler Hicks, Miklos Szeredi, Chuck Lever, Olga Kornievskaia,
Dai Ngo, Namjae Jeon, Steve French, Sergey Senozhatsky,
Carlos Maiolino, John Johansen, Paul Moore, James Morris,
Serge E. Hallyn, Stephen Smalley, Ondrej Mosnacek, Mateusz Guzik,
Lorenzo Stoakes, Stefan Berger, Darrick J. Wong, linux-kernel,
netfs, ecryptfs, linux-nfs, linux-unionfs, linux-cifs, linux-xfs,
linux-security-module, selinux
In-Reply-To: <20251106005333.956321-6-neilb@ownmail.net>
On Thu, 2025-11-06 at 11:50 +1100, NeilBrown wrote:
> From: NeilBrown <neil@brown.name>
>
> start_removing() is similar to start_creating() but will only return a
> positive dentry with the expectation that it will be removed. This is
> used by nfsd, cachefiles, and overlayfs. They are changed to also use
> end_removing() to terminate the action begun by start_removing(). This
> is a simple alias for end_dirop().
>
> Apart from changes to the error paths, as we no longer need to unlock on
> a lookup error, an effect on callers is that they don't need to test if
> the found dentry is positive or negative - they can be sure it is
> positive.
>
> Reviewed-by: Amir Goldstein <amir73il@gmail.com>
> Signed-off-by: NeilBrown <neil@brown.name>
> ---
> fs/cachefiles/namei.c | 32 ++++++++++++++------------------
> fs/namei.c | 27 +++++++++++++++++++++++++++
> fs/nfsd/nfs4recover.c | 18 +++++-------------
> fs/nfsd/vfs.c | 26 ++++++++++----------------
> fs/overlayfs/dir.c | 15 +++++++--------
> fs/overlayfs/overlayfs.h | 8 ++++++++
> include/linux/namei.h | 18 ++++++++++++++++++
> 7 files changed, 89 insertions(+), 55 deletions(-)
>
> diff --git a/fs/cachefiles/namei.c b/fs/cachefiles/namei.c
> index 0a136eb434da..c7f0c6ab9b88 100644
> --- a/fs/cachefiles/namei.c
> +++ b/fs/cachefiles/namei.c
> @@ -260,6 +260,7 @@ static int cachefiles_unlink(struct cachefiles_cache *cache,
> * - File backed objects are unlinked
> * - Directory backed objects are stuffed into the graveyard for userspace to
> * delete
> + * On entry dir must be locked. It will be unlocked on exit.
> */
> int cachefiles_bury_object(struct cachefiles_cache *cache,
> struct cachefiles_object *object,
> @@ -274,28 +275,30 @@ int cachefiles_bury_object(struct cachefiles_cache *cache,
>
> _enter(",'%pd','%pd'", dir, rep);
>
> + /* end_removing() will dput() @rep but we need to keep
> + * a ref, so take one now. This also stops the dentry
> + * being negated when unlinked which we need.
> + */
> + dget(rep);
> +
> if (rep->d_parent != dir) {
> - inode_unlock(d_inode(dir));
> + end_removing(rep);
> _leave(" = -ESTALE");
> return -ESTALE;
> }
>
> /* non-directories can just be unlinked */
> if (!d_is_dir(rep)) {
> - dget(rep); /* Stop the dentry being negated if it's only pinned
> - * by a file struct.
> - */
> ret = cachefiles_unlink(cache, object, dir, rep, why);
> - dput(rep);
> + end_removing(rep);
>
> - inode_unlock(d_inode(dir));
> _leave(" = %d", ret);
> return ret;
> }
>
> /* directories have to be moved to the graveyard */
> _debug("move stale object to graveyard");
> - inode_unlock(d_inode(dir));
> + end_removing(rep);
>
> try_again:
> /* first step is to make up a grave dentry in the graveyard */
> @@ -749,26 +752,20 @@ static struct dentry *cachefiles_lookup_for_cull(struct cachefiles_cache *cache,
> struct dentry *victim;
> int ret = -ENOENT;
>
> - inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
> + victim = start_removing(&nop_mnt_idmap, dir, &QSTR(filename));
>
> - victim = lookup_one(&nop_mnt_idmap, &QSTR(filename), dir);
> if (IS_ERR(victim))
> goto lookup_error;
> - if (d_is_negative(victim))
> - goto lookup_put;
> if (d_inode(victim)->i_flags & S_KERNEL_FILE)
> goto lookup_busy;
> return victim;
>
> lookup_busy:
> ret = -EBUSY;
> -lookup_put:
> - inode_unlock(d_inode(dir));
> - dput(victim);
> + end_removing(victim);
> return ERR_PTR(ret);
>
> lookup_error:
> - inode_unlock(d_inode(dir));
> ret = PTR_ERR(victim);
> if (ret == -ENOENT)
> return ERR_PTR(-ESTALE); /* Probably got retired by the netfs */
> @@ -816,18 +813,17 @@ int cachefiles_cull(struct cachefiles_cache *cache, struct dentry *dir,
>
> ret = cachefiles_bury_object(cache, NULL, dir, victim,
> FSCACHE_OBJECT_WAS_CULLED);
> + dput(victim);
> if (ret < 0)
> goto error;
>
> fscache_count_culled();
> - dput(victim);
> _leave(" = 0");
> return 0;
>
> error_unlock:
> - inode_unlock(d_inode(dir));
> + end_removing(victim);
> error:
> - dput(victim);
> if (ret == -ENOENT)
> return -ESTALE; /* Probably got retired by the netfs */
>
> diff --git a/fs/namei.c b/fs/namei.c
> index 8873ad0f05b0..38dda29552f6 100644
> --- a/fs/namei.c
> +++ b/fs/namei.c
> @@ -3248,6 +3248,33 @@ struct dentry *start_creating(struct mnt_idmap *idmap, struct dentry *parent,
> }
> EXPORT_SYMBOL(start_creating);
>
> +/**
> + * start_removing - prepare to remove a given name with permission checking
> + * @idmap: idmap of the mount
> + * @parent: directory in which to find the name
> + * @name: the name to be removed
> + *
> + * Locks are taken and a lookup in performed prior to removing
> + * an object from a directory. Permission checking (MAY_EXEC) is performed
> + * against @idmap.
> + *
> + * If the name doesn't exist, an error is returned.
> + *
> + * end_removing() should be called when removal is complete, or aborted.
> + *
> + * Returns: a positive dentry, or an error.
> + */
> +struct dentry *start_removing(struct mnt_idmap *idmap, struct dentry *parent,
> + struct qstr *name)
> +{
> + int err = lookup_one_common(idmap, name, parent);
> +
> + if (err)
> + return ERR_PTR(err);
> + return start_dirop(parent, name, 0);
> +}
> +EXPORT_SYMBOL(start_removing);
> +
> #ifdef CONFIG_UNIX98_PTYS
> int path_pts(struct path *path)
> {
> diff --git a/fs/nfsd/nfs4recover.c b/fs/nfsd/nfs4recover.c
> index c247a7c3291c..3eefaa2202e3 100644
> --- a/fs/nfsd/nfs4recover.c
> +++ b/fs/nfsd/nfs4recover.c
> @@ -324,20 +324,12 @@ nfsd4_unlink_clid_dir(char *name, struct nfsd_net *nn)
> dprintk("NFSD: nfsd4_unlink_clid_dir. name %s\n", name);
>
> dir = nn->rec_file->f_path.dentry;
> - inode_lock_nested(d_inode(dir), I_MUTEX_PARENT);
> - dentry = lookup_one(&nop_mnt_idmap, &QSTR(name), dir);
> - if (IS_ERR(dentry)) {
> - status = PTR_ERR(dentry);
> - goto out_unlock;
> - }
> - status = -ENOENT;
> - if (d_really_is_negative(dentry))
> - goto out;
> + dentry = start_removing(&nop_mnt_idmap, dir, &QSTR(name));
> + if (IS_ERR(dentry))
> + return PTR_ERR(dentry);
> +
> status = vfs_rmdir(&nop_mnt_idmap, d_inode(dir), dentry);
> -out:
> - dput(dentry);
> -out_unlock:
> - inode_unlock(d_inode(dir));
> + end_removing(dentry);
> return status;
> }
>
> diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
> index 24e501abad0e..6291c371caa7 100644
> --- a/fs/nfsd/vfs.c
> +++ b/fs/nfsd/vfs.c
> @@ -2044,7 +2044,7 @@ nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
> {
> struct dentry *dentry, *rdentry;
> struct inode *dirp;
> - struct inode *rinode;
> + struct inode *rinode = NULL;
> __be32 err;
> int host_err;
>
> @@ -2063,24 +2063,21 @@ nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
>
> dentry = fhp->fh_dentry;
> dirp = d_inode(dentry);
> - inode_lock_nested(dirp, I_MUTEX_PARENT);
>
> - rdentry = lookup_one(&nop_mnt_idmap, &QSTR_LEN(fname, flen), dentry);
> + rdentry = start_removing(&nop_mnt_idmap, dentry, &QSTR_LEN(fname, flen));
> +
> host_err = PTR_ERR(rdentry);
> if (IS_ERR(rdentry))
> - goto out_unlock;
> + goto out_drop_write;
>
> - if (d_really_is_negative(rdentry)) {
> - dput(rdentry);
> - host_err = -ENOENT;
> - goto out_unlock;
> - }
> - rinode = d_inode(rdentry);
> err = fh_fill_pre_attrs(fhp);
> if (err != nfs_ok)
> goto out_unlock;
>
> + rinode = d_inode(rdentry);
> + /* Prevent truncation until after locks dropped */
> ihold(rinode);
> +
> if (!type)
> type = d_inode(rdentry)->i_mode & S_IFMT;
>
> @@ -2102,10 +2099,10 @@ nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
> }
> fh_fill_post_attrs(fhp);
>
> - inode_unlock(dirp);
> - if (!host_err)
> +out_unlock:
> + end_removing(rdentry);
> + if (!err && !host_err)
> host_err = commit_metadata(fhp);
> - dput(rdentry);
> iput(rinode); /* truncate the inode here */
>
> out_drop_write:
> @@ -2123,9 +2120,6 @@ nfsd_unlink(struct svc_rqst *rqstp, struct svc_fh *fhp, int type,
> }
> out:
> return err != nfs_ok ? err : nfserrno(host_err);
> -out_unlock:
> - inode_unlock(dirp);
> - goto out_drop_write;
> }
>
> /*
> diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
> index b9160fefbd00..20682afdbd20 100644
> --- a/fs/overlayfs/dir.c
> +++ b/fs/overlayfs/dir.c
> @@ -866,17 +866,17 @@ static int ovl_remove_upper(struct dentry *dentry, bool is_dir,
> goto out;
> }
>
> - inode_lock_nested(dir, I_MUTEX_PARENT);
> - upper = ovl_lookup_upper(ofs, dentry->d_name.name, upperdir,
> - dentry->d_name.len);
> + upper = ovl_start_removing_upper(ofs, upperdir,
> + &QSTR_LEN(dentry->d_name.name,
> + dentry->d_name.len));
> err = PTR_ERR(upper);
> if (IS_ERR(upper))
> - goto out_unlock;
> + goto out_dput;
>
> err = -ESTALE;
> if ((opaquedir && upper != opaquedir) ||
> (!opaquedir && !ovl_matches_upper(dentry, upper)))
> - goto out_dput_upper;
> + goto out_unlock;
>
> if (is_dir)
> err = ovl_do_rmdir(ofs, dir, upper);
> @@ -892,10 +892,9 @@ static int ovl_remove_upper(struct dentry *dentry, bool is_dir,
> */
> if (!err)
> d_drop(dentry);
> -out_dput_upper:
> - dput(upper);
> out_unlock:
> - inode_unlock(dir);
> + end_removing(upper);
> +out_dput:
> dput(opaquedir);
> out:
> return err;
> diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
> index beeba96cfcb2..49ad65f829dc 100644
> --- a/fs/overlayfs/overlayfs.h
> +++ b/fs/overlayfs/overlayfs.h
> @@ -423,6 +423,14 @@ static inline struct dentry *ovl_start_creating_upper(struct ovl_fs *ofs,
> parent, name);
> }
>
> +static inline struct dentry *ovl_start_removing_upper(struct ovl_fs *ofs,
> + struct dentry *parent,
> + struct qstr *name)
> +{
> + return start_removing(ovl_upper_mnt_idmap(ofs),
> + parent, name);
> +}
> +
> static inline bool ovl_open_flags_need_copy_up(int flags)
> {
> if (!flags)
> diff --git a/include/linux/namei.h b/include/linux/namei.h
> index 37b72f4a64f0..6d1069f93ebf 100644
> --- a/include/linux/namei.h
> +++ b/include/linux/namei.h
> @@ -91,6 +91,8 @@ struct dentry *lookup_one_positive_killable(struct mnt_idmap *idmap,
>
> struct dentry *start_creating(struct mnt_idmap *idmap, struct dentry *parent,
> struct qstr *name);
> +struct dentry *start_removing(struct mnt_idmap *idmap, struct dentry *parent,
> + struct qstr *name);
>
> /**
> * end_creating - finish action started with start_creating
> @@ -122,6 +124,22 @@ static inline void end_creating(struct dentry *child, struct dentry *parent)
> end_dirop(child);
> }
>
> +/**
> + * end_removing - finish action started with start_removing
> + * @child: dentry returned by start_removing()
> + * @parent: dentry given to start_removing()
> + *
> + * Unlock and release the child.
> + *
> + * This is identical to end_dirop(). It can be passed the result of
> + * start_removing() whether that was successful or not, but it not needed
> + * if start_removing() failed.
> + */
> +static inline void end_removing(struct dentry *child)
> +{
> + end_dirop(child);
> +}
> +
> extern int follow_down_one(struct path *);
> extern int follow_down(struct path *path, unsigned int flags);
> extern int follow_up(struct path *);
This looks fine to me (particularly the knfsd parts), but doesn't ksmbd
need to be similarly converted?
Reviewed-by: Jeff Layton <jlayton@kernel.org>
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox