Linux 5.10.125

Linux 5.10.125

[Greg Kroah-Hartman]

I'm announcing the release of the 5.10.125 kernel.

All users of the 5.10 kernel series must upgrade.

The updated 5.10.y git tree can be found at:
	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
and can be browsed at the normal kernel.org git web browser:
	https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary

thanks,

greg k-h

------------

 Makefile                              |    2 
 arch/arm64/mm/cache.S                 |    2 
 arch/s390/mm/pgtable.c                |    2 
 drivers/tty/serial/serial_core.c      |   34 ++++--------
 drivers/usb/gadget/function/u_ether.c |   11 +++-
 fs/io_uring.c                         |   23 +++++---
 fs/zonefs/super.c                     |   92 ++++++++++++++++++++++------------
 net/ipv4/inet_hashtables.c            |   31 ++++++++---
 8 files changed, 122 insertions(+), 75 deletions(-)

Christian Borntraeger (1):
      s390/mm: use non-quiescing sske for KVM switch to keyed guest

Damien Le Moal (1):
      zonefs: fix zonefs_iomap_begin() for reads

Eric Dumazet (1):
      tcp: add some entropy in __inet_hash_connect()

Greg Kroah-Hartman (1):
      Linux 5.10.125

Jens Axboe (1):
      io_uring: add missing item types for various requests

Lukas Wunner (1):
      serial: core: Initialize rs485 RTS polarity already on probe

Marian Postevca (1):
      usb: gadget: u_ether: fix regression in setting fixed MAC address

Will Deacon (1):
      arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer

Willy Tarreau (5):
      tcp: use different parts of the port_offset for index and offset
      tcp: add small random increments to the source port
      tcp: dynamically allocate the perturb table used by source ports
      tcp: increase source port perturb table to 2^16
      tcp: drop the hash_32() part from the index calculation

Re: Linux 5.10.125

[Greg Kroah-Hartman]

diff --git a/Makefile b/Makefile
index 9ed79a05a972..da5b28931e5c 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 5
 PATCHLEVEL = 10
-SUBLEVEL = 124
+SUBLEVEL = 125
 EXTRAVERSION =
 NAME = Dare mighty things
 
diff --git a/arch/arm64/mm/cache.S b/arch/arm64/mm/cache.S
index 2d881f34dd9d..7b8158ae36ec 100644
--- a/arch/arm64/mm/cache.S
+++ b/arch/arm64/mm/cache.S
@@ -228,8 +228,6 @@ SYM_FUNC_END_PI(__dma_flush_area)
  *	- dir	- DMA direction
  */
 SYM_FUNC_START_PI(__dma_map_area)
-	cmp	w2, #DMA_FROM_DEVICE
-	b.eq	__dma_inv_area
 	b	__dma_clean_area
 SYM_FUNC_END_PI(__dma_map_area)
 
diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c
index fabaedddc90c..1c05caf68e7d 100644
--- a/arch/s390/mm/pgtable.c
+++ b/arch/s390/mm/pgtable.c
@@ -734,7 +734,7 @@ void ptep_zap_key(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
 	pgste_val(pgste) |= PGSTE_GR_BIT | PGSTE_GC_BIT;
 	ptev = pte_val(*ptep);
 	if (!(ptev & _PAGE_INVALID) && (ptev & _PAGE_WRITE))
-		page_set_storage_key(ptev & PAGE_MASK, PAGE_DEFAULT_KEY, 1);
+		page_set_storage_key(ptev & PAGE_MASK, PAGE_DEFAULT_KEY, 0);
 	pgste_set_unlock(ptep, pgste);
 	preempt_enable();
 }
diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 19f0c5db11e3..32d09d024f6c 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -144,6 +144,11 @@ uart_update_mctrl(struct uart_port *port, unsigned int set, unsigned int clear)
 	unsigned long flags;
 	unsigned int old;
 
+	if (port->rs485.flags & SER_RS485_ENABLED) {
+		set &= ~TIOCM_RTS;
+		clear &= ~TIOCM_RTS;
+	}
+
 	spin_lock_irqsave(&port->lock, flags);
 	old = port->mctrl;
 	port->mctrl = (old & ~clear) | set;
@@ -157,23 +162,10 @@ uart_update_mctrl(struct uart_port *port, unsigned int set, unsigned int clear)
 
 static void uart_port_dtr_rts(struct uart_port *uport, int raise)
 {
-	int rs485_on = uport->rs485_config &&
-		(uport->rs485.flags & SER_RS485_ENABLED);
-	int RTS_after_send = !!(uport->rs485.flags & SER_RS485_RTS_AFTER_SEND);
-
-	if (raise) {
-		if (rs485_on && RTS_after_send) {
-			uart_set_mctrl(uport, TIOCM_DTR);
-			uart_clear_mctrl(uport, TIOCM_RTS);
-		} else {
-			uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
-		}
-	} else {
-		unsigned int clear = TIOCM_DTR;
-
-		clear |= (!rs485_on || RTS_after_send) ? TIOCM_RTS : 0;
-		uart_clear_mctrl(uport, clear);
-	}
+	if (raise)
+		uart_set_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
+	else
+		uart_clear_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
 }
 
 /*
@@ -1116,11 +1108,6 @@ uart_tiocmset(struct tty_struct *tty, unsigned int set, unsigned int clear)
 		goto out;
 
 	if (!tty_io_error(tty)) {
-		if (uport->rs485.flags & SER_RS485_ENABLED) {
-			set &= ~TIOCM_RTS;
-			clear &= ~TIOCM_RTS;
-		}
-
 		uart_update_mctrl(uport, set, clear);
 		ret = 0;
 	}
@@ -2429,6 +2416,9 @@ uart_configure_port(struct uart_driver *drv, struct uart_state *state,
 		 */
 		spin_lock_irqsave(&port->lock, flags);
 		port->mctrl &= TIOCM_DTR;
+		if (port->rs485.flags & SER_RS485_ENABLED &&
+		    !(port->rs485.flags & SER_RS485_RTS_AFTER_SEND))
+			port->mctrl |= TIOCM_RTS;
 		port->ops->set_mctrl(port, port->mctrl);
 		spin_unlock_irqrestore(&port->lock, flags);
 
diff --git a/drivers/usb/gadget/function/u_ether.c b/drivers/usb/gadget/function/u_ether.c
index a40be8b448c2..64ef97ab9274 100644
--- a/drivers/usb/gadget/function/u_ether.c
+++ b/drivers/usb/gadget/function/u_ether.c
@@ -772,9 +772,13 @@ struct eth_dev *gether_setup_name(struct usb_gadget *g,
 	dev->qmult = qmult;
 	snprintf(net->name, sizeof(net->name), "%s%%d", netname);
 
-	if (get_ether_addr(dev_addr, net->dev_addr))
+	if (get_ether_addr(dev_addr, net->dev_addr)) {
+		net->addr_assign_type = NET_ADDR_RANDOM;
 		dev_warn(&g->dev,
 			"using random %s ethernet address\n", "self");
+	} else {
+		net->addr_assign_type = NET_ADDR_SET;
+	}
 	if (get_ether_addr(host_addr, dev->host_mac))
 		dev_warn(&g->dev,
 			"using random %s ethernet address\n", "host");
@@ -831,6 +835,9 @@ struct net_device *gether_setup_name_default(const char *netname)
 	INIT_LIST_HEAD(&dev->tx_reqs);
 	INIT_LIST_HEAD(&dev->rx_reqs);
 
+	/* by default we always have a random MAC address */
+	net->addr_assign_type = NET_ADDR_RANDOM;
+
 	skb_queue_head_init(&dev->rx_frames);
 
 	/* network device setup */
@@ -868,7 +875,6 @@ int gether_register_netdev(struct net_device *net)
 	g = dev->gadget;
 
 	memcpy(net->dev_addr, dev->dev_mac, ETH_ALEN);
-	net->addr_assign_type = NET_ADDR_RANDOM;
 
 	status = register_netdev(net);
 	if (status < 0) {
@@ -908,6 +914,7 @@ int gether_set_dev_addr(struct net_device *net, const char *dev_addr)
 	if (get_ether_addr(dev_addr, new_addr))
 		return -EINVAL;
 	memcpy(dev->dev_mac, new_addr, ETH_ALEN);
+	net->addr_assign_type = NET_ADDR_SET;
 	return 0;
 }
 EXPORT_SYMBOL_GPL(gether_set_dev_addr);
diff --git a/fs/io_uring.c b/fs/io_uring.c
index 871475d3fca2..40ac37beca47 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -773,7 +773,8 @@ static const struct io_op_def io_op_defs[] = {
 		.buffer_select		= 1,
 		.needs_async_data	= 1,
 		.async_size		= sizeof(struct io_async_rw),
-		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG,
+		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
+					  IO_WQ_WORK_FILES,
 	},
 	[IORING_OP_WRITEV] = {
 		.needs_file		= 1,
@@ -783,7 +784,7 @@ static const struct io_op_def io_op_defs[] = {
 		.needs_async_data	= 1,
 		.async_size		= sizeof(struct io_async_rw),
 		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
-						IO_WQ_WORK_FSIZE,
+					  IO_WQ_WORK_FSIZE | IO_WQ_WORK_FILES,
 	},
 	[IORING_OP_FSYNC] = {
 		.needs_file		= 1,
@@ -794,7 +795,8 @@ static const struct io_op_def io_op_defs[] = {
 		.unbound_nonreg_file	= 1,
 		.pollin			= 1,
 		.async_size		= sizeof(struct io_async_rw),
-		.work_flags		= IO_WQ_WORK_BLKCG | IO_WQ_WORK_MM,
+		.work_flags		= IO_WQ_WORK_BLKCG | IO_WQ_WORK_MM |
+					  IO_WQ_WORK_FILES,
 	},
 	[IORING_OP_WRITE_FIXED] = {
 		.needs_file		= 1,
@@ -803,7 +805,7 @@ static const struct io_op_def io_op_defs[] = {
 		.pollout		= 1,
 		.async_size		= sizeof(struct io_async_rw),
 		.work_flags		= IO_WQ_WORK_BLKCG | IO_WQ_WORK_FSIZE |
-						IO_WQ_WORK_MM,
+					  IO_WQ_WORK_MM | IO_WQ_WORK_FILES,
 	},
 	[IORING_OP_POLL_ADD] = {
 		.needs_file		= 1,
@@ -857,7 +859,7 @@ static const struct io_op_def io_op_defs[] = {
 		.pollout		= 1,
 		.needs_async_data	= 1,
 		.async_size		= sizeof(struct io_async_connect),
-		.work_flags		= IO_WQ_WORK_MM,
+		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_FS,
 	},
 	[IORING_OP_FALLOCATE] = {
 		.needs_file		= 1,
@@ -885,7 +887,8 @@ static const struct io_op_def io_op_defs[] = {
 		.pollin			= 1,
 		.buffer_select		= 1,
 		.async_size		= sizeof(struct io_async_rw),
-		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG,
+		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
+					  IO_WQ_WORK_FILES,
 	},
 	[IORING_OP_WRITE] = {
 		.needs_file		= 1,
@@ -894,7 +897,7 @@ static const struct io_op_def io_op_defs[] = {
 		.pollout		= 1,
 		.async_size		= sizeof(struct io_async_rw),
 		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
-						IO_WQ_WORK_FSIZE,
+					  IO_WQ_WORK_FSIZE | IO_WQ_WORK_FILES,
 	},
 	[IORING_OP_FADVISE] = {
 		.needs_file		= 1,
@@ -907,14 +910,16 @@ static const struct io_op_def io_op_defs[] = {
 		.needs_file		= 1,
 		.unbound_nonreg_file	= 1,
 		.pollout		= 1,
-		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG,
+		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
+					  IO_WQ_WORK_FS,
 	},
 	[IORING_OP_RECV] = {
 		.needs_file		= 1,
 		.unbound_nonreg_file	= 1,
 		.pollin			= 1,
 		.buffer_select		= 1,
-		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG,
+		.work_flags		= IO_WQ_WORK_MM | IO_WQ_WORK_BLKCG |
+					  IO_WQ_WORK_FS,
 	},
 	[IORING_OP_OPENAT2] = {
 		.work_flags		= IO_WQ_WORK_FILES | IO_WQ_WORK_FS |
diff --git a/fs/zonefs/super.c b/fs/zonefs/super.c
index 8c7d01e907a3..bf5cb6efb8c0 100644
--- a/fs/zonefs/super.c
+++ b/fs/zonefs/super.c
@@ -68,15 +68,49 @@ static inline void zonefs_i_size_write(struct inode *inode, loff_t isize)
 		zi->i_flags &= ~ZONEFS_ZONE_OPEN;
 }
 
-static int zonefs_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
-			      unsigned int flags, struct iomap *iomap,
-			      struct iomap *srcmap)
+static int zonefs_read_iomap_begin(struct inode *inode, loff_t offset,
+				   loff_t length, unsigned int flags,
+				   struct iomap *iomap, struct iomap *srcmap)
 {
 	struct zonefs_inode_info *zi = ZONEFS_I(inode);
 	struct super_block *sb = inode->i_sb;
 	loff_t isize;
 
-	/* All I/Os should always be within the file maximum size */
+	/*
+	 * All blocks are always mapped below EOF. If reading past EOF,
+	 * act as if there is a hole up to the file maximum size.
+	 */
+	mutex_lock(&zi->i_truncate_mutex);
+	iomap->bdev = inode->i_sb->s_bdev;
+	iomap->offset = ALIGN_DOWN(offset, sb->s_blocksize);
+	isize = i_size_read(inode);
+	if (iomap->offset >= isize) {
+		iomap->type = IOMAP_HOLE;
+		iomap->addr = IOMAP_NULL_ADDR;
+		iomap->length = length;
+	} else {
+		iomap->type = IOMAP_MAPPED;
+		iomap->addr = (zi->i_zsector << SECTOR_SHIFT) + iomap->offset;
+		iomap->length = isize - iomap->offset;
+	}
+	mutex_unlock(&zi->i_truncate_mutex);
+
+	return 0;
+}
+
+static const struct iomap_ops zonefs_read_iomap_ops = {
+	.iomap_begin	= zonefs_read_iomap_begin,
+};
+
+static int zonefs_write_iomap_begin(struct inode *inode, loff_t offset,
+				    loff_t length, unsigned int flags,
+				    struct iomap *iomap, struct iomap *srcmap)
+{
+	struct zonefs_inode_info *zi = ZONEFS_I(inode);
+	struct super_block *sb = inode->i_sb;
+	loff_t isize;
+
+	/* All write I/Os should always be within the file maximum size */
 	if (WARN_ON_ONCE(offset + length > zi->i_max_size))
 		return -EIO;
 
@@ -86,7 +120,7 @@ static int zonefs_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
 	 * operation.
 	 */
 	if (WARN_ON_ONCE(zi->i_ztype == ZONEFS_ZTYPE_SEQ &&
-			 (flags & IOMAP_WRITE) && !(flags & IOMAP_DIRECT)))
+			 !(flags & IOMAP_DIRECT)))
 		return -EIO;
 
 	/*
@@ -95,45 +129,42 @@ static int zonefs_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
 	 * write pointer) and unwriten beyond.
 	 */
 	mutex_lock(&zi->i_truncate_mutex);
+	iomap->bdev = inode->i_sb->s_bdev;
+	iomap->offset = ALIGN_DOWN(offset, sb->s_blocksize);
+	iomap->addr = (zi->i_zsector << SECTOR_SHIFT) + iomap->offset;
 	isize = i_size_read(inode);
-	if (offset >= isize)
+	if (iomap->offset >= isize) {
 		iomap->type = IOMAP_UNWRITTEN;
-	else
+		iomap->length = zi->i_max_size - iomap->offset;
+	} else {
 		iomap->type = IOMAP_MAPPED;
-	if (flags & IOMAP_WRITE)
-		length = zi->i_max_size - offset;
-	else
-		length = min(length, isize - offset);
+		iomap->length = isize - iomap->offset;
+	}
 	mutex_unlock(&zi->i_truncate_mutex);
 
-	iomap->offset = ALIGN_DOWN(offset, sb->s_blocksize);
-	iomap->length = ALIGN(offset + length, sb->s_blocksize) - iomap->offset;
-	iomap->bdev = inode->i_sb->s_bdev;
-	iomap->addr = (zi->i_zsector << SECTOR_SHIFT) + iomap->offset;
-
 	return 0;
 }
 
-static const struct iomap_ops zonefs_iomap_ops = {
-	.iomap_begin	= zonefs_iomap_begin,
+static const struct iomap_ops zonefs_write_iomap_ops = {
+	.iomap_begin	= zonefs_write_iomap_begin,
 };
 
 static int zonefs_readpage(struct file *unused, struct page *page)
 {
-	return iomap_readpage(page, &zonefs_iomap_ops);
+	return iomap_readpage(page, &zonefs_read_iomap_ops);
 }
 
 static void zonefs_readahead(struct readahead_control *rac)
 {
-	iomap_readahead(rac, &zonefs_iomap_ops);
+	iomap_readahead(rac, &zonefs_read_iomap_ops);
 }
 
 /*
  * Map blocks for page writeback. This is used only on conventional zone files,
  * which implies that the page range can only be within the fixed inode size.
  */
-static int zonefs_map_blocks(struct iomap_writepage_ctx *wpc,
-			     struct inode *inode, loff_t offset)
+static int zonefs_write_map_blocks(struct iomap_writepage_ctx *wpc,
+				   struct inode *inode, loff_t offset)
 {
 	struct zonefs_inode_info *zi = ZONEFS_I(inode);
 
@@ -147,12 +178,12 @@ static int zonefs_map_blocks(struct iomap_writepage_ctx *wpc,
 	    offset < wpc->iomap.offset + wpc->iomap.length)
 		return 0;
 
-	return zonefs_iomap_begin(inode, offset, zi->i_max_size - offset,
-				  IOMAP_WRITE, &wpc->iomap, NULL);
+	return zonefs_write_iomap_begin(inode, offset, zi->i_max_size - offset,
+					IOMAP_WRITE, &wpc->iomap, NULL);
 }
 
 static const struct iomap_writeback_ops zonefs_writeback_ops = {
-	.map_blocks		= zonefs_map_blocks,
+	.map_blocks		= zonefs_write_map_blocks,
 };
 
 static int zonefs_writepage(struct page *page, struct writeback_control *wbc)
@@ -182,7 +213,8 @@ static int zonefs_swap_activate(struct swap_info_struct *sis,
 		return -EINVAL;
 	}
 
-	return iomap_swapfile_activate(sis, swap_file, span, &zonefs_iomap_ops);
+	return iomap_swapfile_activate(sis, swap_file, span,
+				       &zonefs_read_iomap_ops);
 }
 
 static const struct address_space_operations zonefs_file_aops = {
@@ -612,7 +644,7 @@ static vm_fault_t zonefs_filemap_page_mkwrite(struct vm_fault *vmf)
 
 	/* Serialize against truncates */
 	down_read(&zi->i_mmap_sem);
-	ret = iomap_page_mkwrite(vmf, &zonefs_iomap_ops);
+	ret = iomap_page_mkwrite(vmf, &zonefs_write_iomap_ops);
 	up_read(&zi->i_mmap_sem);
 
 	sb_end_pagefault(inode->i_sb);
@@ -869,7 +901,7 @@ static ssize_t zonefs_file_dio_write(struct kiocb *iocb, struct iov_iter *from)
 	if (append)
 		ret = zonefs_file_dio_append(iocb, from);
 	else
-		ret = iomap_dio_rw(iocb, from, &zonefs_iomap_ops,
+		ret = iomap_dio_rw(iocb, from, &zonefs_write_iomap_ops,
 				   &zonefs_write_dio_ops, sync);
 	if (zi->i_ztype == ZONEFS_ZTYPE_SEQ &&
 	    (ret > 0 || ret == -EIOCBQUEUED)) {
@@ -911,7 +943,7 @@ static ssize_t zonefs_file_buffered_write(struct kiocb *iocb,
 	if (ret <= 0)
 		goto inode_unlock;
 
-	ret = iomap_file_buffered_write(iocb, from, &zonefs_iomap_ops);
+	ret = iomap_file_buffered_write(iocb, from, &zonefs_write_iomap_ops);
 	if (ret > 0)
 		iocb->ki_pos += ret;
 	else if (ret == -EIO)
@@ -1004,7 +1036,7 @@ static ssize_t zonefs_file_read_iter(struct kiocb *iocb, struct iov_iter *to)
 			goto inode_unlock;
 		}
 		file_accessed(iocb->ki_filp);
-		ret = iomap_dio_rw(iocb, to, &zonefs_iomap_ops,
+		ret = iomap_dio_rw(iocb, to, &zonefs_read_iomap_ops,
 				   &zonefs_read_dio_ops, is_sync_kiocb(iocb));
 	} else {
 		ret = generic_file_read_iter(iocb, to);
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 44b524136f95..f38b71cc3edb 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -726,12 +726,14 @@ EXPORT_SYMBOL_GPL(inet_unhash);
  * Note that we use 32bit integers (vs RFC 'short integers')
  * because 2^16 is not a multiple of num_ephemeral and this
  * property might be used by clever attacker.
- * RFC claims using TABLE_LENGTH=10 buckets gives an improvement,
- * we use 256 instead to really give more isolation and
- * privacy, this only consumes 1 KB of kernel memory.
+ * RFC claims using TABLE_LENGTH=10 buckets gives an improvement, though
+ * attacks were since demonstrated, thus we use 65536 instead to really
+ * give more isolation and privacy, at the expense of 256kB of kernel
+ * memory.
  */
-#define INET_TABLE_PERTURB_SHIFT 8
-static u32 table_perturb[1 << INET_TABLE_PERTURB_SHIFT];
+#define INET_TABLE_PERTURB_SHIFT 16
+#define INET_TABLE_PERTURB_SIZE (1 << INET_TABLE_PERTURB_SHIFT)
+static u32 *table_perturb;
 
 int __inet_hash_connect(struct inet_timewait_death_row *death_row,
 		struct sock *sk, u64 port_offset,
@@ -774,10 +776,11 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
 	if (likely(remaining > 1))
 		remaining &= ~1U;
 
-	net_get_random_once(table_perturb, sizeof(table_perturb));
-	index = hash_32(port_offset, INET_TABLE_PERTURB_SHIFT);
+	net_get_random_once(table_perturb,
+			    INET_TABLE_PERTURB_SIZE * sizeof(*table_perturb));
+	index = port_offset & (INET_TABLE_PERTURB_SIZE - 1);
 
-	offset = READ_ONCE(table_perturb[index]) + port_offset;
+	offset = READ_ONCE(table_perturb[index]) + (port_offset >> 32);
 	offset %= remaining;
 
 	/* In first pass we try ports of @low parity.
@@ -833,6 +836,12 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
 	return -EADDRNOTAVAIL;
 
 ok:
+	/* Here we want to add a little bit of randomness to the next source
+	 * port that will be chosen. We use a max() with a random here so that
+	 * on low contention the randomness is maximal and on high contention
+	 * it may be inexistent.
+	 */
+	i = max_t(int, i, (prandom_u32() & 7) * 2);
 	WRITE_ONCE(table_perturb[index], READ_ONCE(table_perturb[index]) + i + 2);
 
 	/* Head lock still held and bh's disabled */
@@ -906,6 +915,12 @@ void __init inet_hashinfo2_init(struct inet_hashinfo *h, const char *name,
 					    low_limit,
 					    high_limit);
 	init_hashinfo_lhash2(h);
+
+	/* this one is used for source ports of outgoing connections */
+	table_perturb = kmalloc_array(INET_TABLE_PERTURB_SIZE,
+				      sizeof(*table_perturb), GFP_KERNEL);
+	if (!table_perturb)
+		panic("TCP: failed to alloc table_perturb");
 }
 
 int inet_hashinfo2_init_mod(struct inet_hashinfo *h)

Re: Linux 5.10.125

[Greg Thelen]

Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:

> I'm announcing the release of the 5.10.125 kernel.
>
> All users of the 5.10 kernel series must upgrade.
>
> The updated 5.10.y git tree can be found at:
> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
> and can be browsed at the normal kernel.org git web browser:
> 	https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
>
> thanks,
>
> greg k-h
>
> ------------
>
>  Makefile                              |    2 
>  arch/arm64/mm/cache.S                 |    2 
>  arch/s390/mm/pgtable.c                |    2 
>  drivers/tty/serial/serial_core.c      |   34 ++++--------
>  drivers/usb/gadget/function/u_ether.c |   11 +++-
>  fs/io_uring.c                         |   23 +++++---
>  fs/zonefs/super.c                     |   92 ++++++++++++++++++++++------------
>  net/ipv4/inet_hashtables.c            |   31 ++++++++---
>  8 files changed, 122 insertions(+), 75 deletions(-)
>
> Christian Borntraeger (1):
>       s390/mm: use non-quiescing sske for KVM switch to keyed guest
>
> Damien Le Moal (1):
>       zonefs: fix zonefs_iomap_begin() for reads
>
> Eric Dumazet (1):
>       tcp: add some entropy in __inet_hash_connect()
>
> Greg Kroah-Hartman (1):
>       Linux 5.10.125
>
> Jens Axboe (1):
>       io_uring: add missing item types for various requests
>
> Lukas Wunner (1):
>       serial: core: Initialize rs485 RTS polarity already on probe
>
> Marian Postevca (1):
>       usb: gadget: u_ether: fix regression in setting fixed MAC address
>
> Will Deacon (1):
>       arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
>
> Willy Tarreau (5):
>       tcp: use different parts of the port_offset for index and offset
>       tcp: add small random increments to the source port
>       tcp: dynamically allocate the perturb table used by source ports
>       tcp: increase source port perturb table to 2^16
>       tcp: drop the hash_32() part from the index calculation

5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add
missing item types for various requests") causes panic when running
test/iopoll.t from https://github.com/axboe/liburing commit
dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).

Here's a manually annotated panic message:
[  359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
[  359.055393] kernel BUG at lib/list_debug.c:47!
[  359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
[  359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S        I       5.10.124 #1
[  359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
[  359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
[  359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
[  359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
[  359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
[  359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
[  359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
[  359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
[  359.145836] FS:  00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
[  359.153830] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
[  359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[  359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[  359.180647] Call Trace:
[  359.183064]  io_dismantle_req+0x1da/0x2b0
                    __list_del_entry [include/linux/list.h:132]
                    list_del [include/linux/list.h:146]
                    io_req_drop_files [fs/io_uring.c:5934]
                    io_req_clean_work [fs/io_uring.c:1315]
                    io_dismantle_req [fs/io_uring.c:1911]
[  359.187023]  io_do_iopoll+0x4e5/0x790
[  359.194602]  __se_sys_io_uring_enter+0x39b/0x6f0
[  359.208318]  __x64_sys_io_uring_enter+0x29/0x30
[  359.212793]  do_syscall_64+0x31/0x40
[  359.216324]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Re: Linux 5.10.125

[Jens Axboe]

On 6/26/22 4:56 PM, Greg Thelen wrote:
> Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> 
>> I'm announcing the release of the 5.10.125 kernel.
>>
>> All users of the 5.10 kernel series must upgrade.
>>
>> The updated 5.10.y git tree can be found at:
>> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
>> and can be browsed at the normal kernel.org git web browser:
>> 	https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
>>
>> thanks,
>>
>> greg k-h
>>
>> ------------
>>
>>  Makefile                              |    2 
>>  arch/arm64/mm/cache.S                 |    2 
>>  arch/s390/mm/pgtable.c                |    2 
>>  drivers/tty/serial/serial_core.c      |   34 ++++--------
>>  drivers/usb/gadget/function/u_ether.c |   11 +++-
>>  fs/io_uring.c                         |   23 +++++---
>>  fs/zonefs/super.c                     |   92 ++++++++++++++++++++++------------
>>  net/ipv4/inet_hashtables.c            |   31 ++++++++---
>>  8 files changed, 122 insertions(+), 75 deletions(-)
>>
>> Christian Borntraeger (1):
>>       s390/mm: use non-quiescing sske for KVM switch to keyed guest
>>
>> Damien Le Moal (1):
>>       zonefs: fix zonefs_iomap_begin() for reads
>>
>> Eric Dumazet (1):
>>       tcp: add some entropy in __inet_hash_connect()
>>
>> Greg Kroah-Hartman (1):
>>       Linux 5.10.125
>>
>> Jens Axboe (1):
>>       io_uring: add missing item types for various requests
>>
>> Lukas Wunner (1):
>>       serial: core: Initialize rs485 RTS polarity already on probe
>>
>> Marian Postevca (1):
>>       usb: gadget: u_ether: fix regression in setting fixed MAC address
>>
>> Will Deacon (1):
>>       arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
>>
>> Willy Tarreau (5):
>>       tcp: use different parts of the port_offset for index and offset
>>       tcp: add small random increments to the source port
>>       tcp: dynamically allocate the perturb table used by source ports
>>       tcp: increase source port perturb table to 2^16
>>       tcp: drop the hash_32() part from the index calculation
> 
> 5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add
> missing item types for various requests") causes panic when running
> test/iopoll.t from https://github.com/axboe/liburing commit
> dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
> 
> Here's a manually annotated panic message:
> [  359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
> [  359.055393] kernel BUG at lib/list_debug.c:47!
> [  359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
> [  359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S        I       5.10.124 #1
> [  359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
> [  359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
> [  359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
> [  359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
> [  359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
> [  359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
> [  359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
> [  359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
> [  359.145836] FS:  00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
> [  359.153830] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
> [  359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> [  359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> [  359.180647] Call Trace:
> [  359.183064]  io_dismantle_req+0x1da/0x2b0
>                     __list_del_entry [include/linux/list.h:132]
>                     list_del [include/linux/list.h:146]
>                     io_req_drop_files [fs/io_uring.c:5934]
>                     io_req_clean_work [fs/io_uring.c:1315]
>                     io_dismantle_req [fs/io_uring.c:1911]
> [  359.187023]  io_do_iopoll+0x4e5/0x790
> [  359.194602]  __se_sys_io_uring_enter+0x39b/0x6f0
> [  359.208318]  __x64_sys_io_uring_enter+0x29/0x30
> [  359.212793]  do_syscall_64+0x31/0x40
> [  359.216324]  entry_SYSCALL_64_after_hwframe+0x44/0xa9

Well that sucks, I wonder why mine didn't fail like that. I'll see if I
can hit this and send a fix. Thanks for reporting!

-- 
Jens Axboe

Re: Linux 5.10.125

[Jens Axboe]

On 6/26/22 6:04 PM, Jens Axboe wrote:
> On 6/26/22 4:56 PM, Greg Thelen wrote:
>> Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>>
>>> I'm announcing the release of the 5.10.125 kernel.
>>>
>>> All users of the 5.10 kernel series must upgrade.
>>>
>>> The updated 5.10.y git tree can be found at:
>>> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
>>> and can be browsed at the normal kernel.org git web browser:
>>> 	https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
>>>
>>> thanks,
>>>
>>> greg k-h
>>>
>>> ------------
>>>
>>>  Makefile                              |    2 
>>>  arch/arm64/mm/cache.S                 |    2 
>>>  arch/s390/mm/pgtable.c                |    2 
>>>  drivers/tty/serial/serial_core.c      |   34 ++++--------
>>>  drivers/usb/gadget/function/u_ether.c |   11 +++-
>>>  fs/io_uring.c                         |   23 +++++---
>>>  fs/zonefs/super.c                     |   92 ++++++++++++++++++++++------------
>>>  net/ipv4/inet_hashtables.c            |   31 ++++++++---
>>>  8 files changed, 122 insertions(+), 75 deletions(-)
>>>
>>> Christian Borntraeger (1):
>>>       s390/mm: use non-quiescing sske for KVM switch to keyed guest
>>>
>>> Damien Le Moal (1):
>>>       zonefs: fix zonefs_iomap_begin() for reads
>>>
>>> Eric Dumazet (1):
>>>       tcp: add some entropy in __inet_hash_connect()
>>>
>>> Greg Kroah-Hartman (1):
>>>       Linux 5.10.125
>>>
>>> Jens Axboe (1):
>>>       io_uring: add missing item types for various requests
>>>
>>> Lukas Wunner (1):
>>>       serial: core: Initialize rs485 RTS polarity already on probe
>>>
>>> Marian Postevca (1):
>>>       usb: gadget: u_ether: fix regression in setting fixed MAC address
>>>
>>> Will Deacon (1):
>>>       arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
>>>
>>> Willy Tarreau (5):
>>>       tcp: use different parts of the port_offset for index and offset
>>>       tcp: add small random increments to the source port
>>>       tcp: dynamically allocate the perturb table used by source ports
>>>       tcp: increase source port perturb table to 2^16
>>>       tcp: drop the hash_32() part from the index calculation
>>
>> 5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add
>> missing item types for various requests") causes panic when running
>> test/iopoll.t from https://github.com/axboe/liburing commit
>> dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
>>
>> Here's a manually annotated panic message:
>> [  359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
>> [  359.055393] kernel BUG at lib/list_debug.c:47!
>> [  359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
>> [  359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S        I       5.10.124 #1
>> [  359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
>> [  359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
>> [  359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
>> [  359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
>> [  359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
>> [  359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
>> [  359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
>> [  359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
>> [  359.145836] FS:  00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
>> [  359.153830] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>> [  359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
>> [  359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>> [  359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>> [  359.180647] Call Trace:
>> [  359.183064]  io_dismantle_req+0x1da/0x2b0
>>                     __list_del_entry [include/linux/list.h:132]
>>                     list_del [include/linux/list.h:146]
>>                     io_req_drop_files [fs/io_uring.c:5934]
>>                     io_req_clean_work [fs/io_uring.c:1315]
>>                     io_dismantle_req [fs/io_uring.c:1911]
>> [  359.187023]  io_do_iopoll+0x4e5/0x790
>> [  359.194602]  __se_sys_io_uring_enter+0x39b/0x6f0
>> [  359.208318]  __x64_sys_io_uring_enter+0x29/0x30
>> [  359.212793]  do_syscall_64+0x31/0x40
>> [  359.216324]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
> 
> Well that sucks, I wonder why mine didn't fail like that. I'll see if I
> can hit this and send a fix. Thanks for reporting!

Below should do it, I apologize for that. I think my test box booted the
previous kernel which is why it didn't hit it in my regression tests :-(

Greg, can you add this to 5.10-stable? Verified it ran tests with the
right kernel now...


commit d2aaf8fdc544a3edf44820a07294d693dedd12e3
Author: Jens Axboe <axboe@kernel.dk>
Date:   Sun Jun 26 18:16:17 2022 -0600

    io_uring: use separate list entry for iopoll requests
    
    A previous commit ended up enabling file tracking for iopoll requests,
    which conflicts with both of them using the same list entry for tracking.
    Add a separate list entry just for iopoll requests, avoid this issue.
    
    No upstream commit exists for this issue.
    
    Reported-by: Greg Thelen <gthelen@google.com>
    Fixes: df3f3bb5059d ("io_uring: add missing item types for various requests")
    Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/fs/io_uring.c b/fs/io_uring.c
index 40ac37beca47..2e12dcbc7b0f 100644
--- a/fs/io_uring.c
+++ b/fs/io_uring.c
@@ -696,6 +696,8 @@ struct io_kiocb {
 	 */
 	struct list_head		inflight_entry;
 
+	struct list_head		iopoll_entry;
+
 	struct percpu_ref		*fixed_file_refs;
 	struct callback_head		task_work;
 	/* for polled requests, i.e. IORING_OP_POLL_ADD and async armed poll */
@@ -2350,8 +2352,8 @@ static void io_iopoll_queue(struct list_head *again)
 	struct io_kiocb *req;
 
 	do {
-		req = list_first_entry(again, struct io_kiocb, inflight_entry);
-		list_del(&req->inflight_entry);
+		req = list_first_entry(again, struct io_kiocb, iopoll_entry);
+		list_del(&req->iopoll_entry);
 		__io_complete_rw(req, -EAGAIN, 0, NULL);
 	} while (!list_empty(again));
 }
@@ -2373,14 +2375,14 @@ static void io_iopoll_complete(struct io_ring_ctx *ctx, unsigned int *nr_events,
 	while (!list_empty(done)) {
 		int cflags = 0;
 
-		req = list_first_entry(done, struct io_kiocb, inflight_entry);
+		req = list_first_entry(done, struct io_kiocb, iopoll_entry);
 		if (READ_ONCE(req->result) == -EAGAIN) {
 			req->result = 0;
 			req->iopoll_completed = 0;
-			list_move_tail(&req->inflight_entry, &again);
+			list_move_tail(&req->iopoll_entry, &again);
 			continue;
 		}
-		list_del(&req->inflight_entry);
+		list_del(&req->iopoll_entry);
 
 		if (req->flags & REQ_F_BUFFER_SELECTED)
 			cflags = io_put_rw_kbuf(req);
@@ -2416,7 +2418,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
 	spin = !ctx->poll_multi_file && *nr_events < min;
 
 	ret = 0;
-	list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, inflight_entry) {
+	list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, iopoll_entry) {
 		struct kiocb *kiocb = &req->rw.kiocb;
 
 		/*
@@ -2425,7 +2427,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
 		 * and complete those lists first, if we have entries there.
 		 */
 		if (READ_ONCE(req->iopoll_completed)) {
-			list_move_tail(&req->inflight_entry, &done);
+			list_move_tail(&req->iopoll_entry, &done);
 			continue;
 		}
 		if (!list_empty(&done))
@@ -2437,7 +2439,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
 
 		/* iopoll may have completed current req */
 		if (READ_ONCE(req->iopoll_completed))
-			list_move_tail(&req->inflight_entry, &done);
+			list_move_tail(&req->iopoll_entry, &done);
 
 		if (ret && spin)
 			spin = false;
@@ -2670,7 +2672,7 @@ static void io_iopoll_req_issued(struct io_kiocb *req)
 		struct io_kiocb *list_req;
 
 		list_req = list_first_entry(&ctx->iopoll_list, struct io_kiocb,
-						inflight_entry);
+						iopoll_entry);
 		if (list_req->file != req->file)
 			ctx->poll_multi_file = true;
 	}
@@ -2680,9 +2682,9 @@ static void io_iopoll_req_issued(struct io_kiocb *req)
 	 * it to the front so we find it first.
 	 */
 	if (READ_ONCE(req->iopoll_completed))
-		list_add(&req->inflight_entry, &ctx->iopoll_list);
+		list_add(&req->iopoll_entry, &ctx->iopoll_list);
 	else
-		list_add_tail(&req->inflight_entry, &ctx->iopoll_list);
+		list_add_tail(&req->iopoll_entry, &ctx->iopoll_list);
 
 	if ((ctx->flags & IORING_SETUP_SQPOLL) &&
 	    wq_has_sleeper(&ctx->sq_data->wait))

-- 
Jens Axboe

Re: Linux 5.10.125

[Greg Thelen]

Jens Axboe <axboe@kernel.dk> wrote:

> On 6/26/22 6:04 PM, Jens Axboe wrote:
>> On 6/26/22 4:56 PM, Greg Thelen wrote:
>>> Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>>>
>>>> I'm announcing the release of the 5.10.125 kernel.
>>>>
>>>> All users of the 5.10 kernel series must upgrade.
>>>>
>>>> The updated 5.10.y git tree can be found at:
>>>> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
>>>> and can be browsed at the normal kernel.org git web browser:
>>>> 	https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
>>>>
>>>> thanks,
>>>>
>>>> greg k-h
>>>>
>>>> ------------
>>>>
>>>>  Makefile                              |    2 
>>>>  arch/arm64/mm/cache.S                 |    2 
>>>>  arch/s390/mm/pgtable.c                |    2 
>>>>  drivers/tty/serial/serial_core.c      |   34 ++++--------
>>>>  drivers/usb/gadget/function/u_ether.c |   11 +++-
>>>>  fs/io_uring.c                         |   23 +++++---
>>>>  fs/zonefs/super.c                     |   92 ++++++++++++++++++++++------------
>>>>  net/ipv4/inet_hashtables.c            |   31 ++++++++---
>>>>  8 files changed, 122 insertions(+), 75 deletions(-)
>>>>
>>>> Christian Borntraeger (1):
>>>>       s390/mm: use non-quiescing sske for KVM switch to keyed guest
>>>>
>>>> Damien Le Moal (1):
>>>>       zonefs: fix zonefs_iomap_begin() for reads
>>>>
>>>> Eric Dumazet (1):
>>>>       tcp: add some entropy in __inet_hash_connect()
>>>>
>>>> Greg Kroah-Hartman (1):
>>>>       Linux 5.10.125
>>>>
>>>> Jens Axboe (1):
>>>>       io_uring: add missing item types for various requests
>>>>
>>>> Lukas Wunner (1):
>>>>       serial: core: Initialize rs485 RTS polarity already on probe
>>>>
>>>> Marian Postevca (1):
>>>>       usb: gadget: u_ether: fix regression in setting fixed MAC address
>>>>
>>>> Will Deacon (1):
>>>>       arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
>>>>
>>>> Willy Tarreau (5):
>>>>       tcp: use different parts of the port_offset for index and offset
>>>>       tcp: add small random increments to the source port
>>>>       tcp: dynamically allocate the perturb table used by source ports
>>>>       tcp: increase source port perturb table to 2^16
>>>>       tcp: drop the hash_32() part from the index calculation
>>>
>>> 5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add
>>> missing item types for various requests") causes panic when running
>>> test/iopoll.t from https://github.com/axboe/liburing commit
>>> dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
>>>
>>> Here's a manually annotated panic message:
>>> [  359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
>>> [  359.055393] kernel BUG at lib/list_debug.c:47!
>>> [  359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
>>> [  359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S        I       5.10.124 #1
>>> [  359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
>>> [  359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
>>> [  359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
>>> [  359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
>>> [  359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
>>> [  359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
>>> [  359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
>>> [  359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
>>> [  359.145836] FS:  00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
>>> [  359.153830] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>> [  359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
>>> [  359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>>> [  359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>>> [  359.180647] Call Trace:
>>> [  359.183064]  io_dismantle_req+0x1da/0x2b0
>>>                     __list_del_entry [include/linux/list.h:132]
>>>                     list_del [include/linux/list.h:146]
>>>                     io_req_drop_files [fs/io_uring.c:5934]
>>>                     io_req_clean_work [fs/io_uring.c:1315]
>>>                     io_dismantle_req [fs/io_uring.c:1911]
>>> [  359.187023]  io_do_iopoll+0x4e5/0x790
>>> [  359.194602]  __se_sys_io_uring_enter+0x39b/0x6f0
>>> [  359.208318]  __x64_sys_io_uring_enter+0x29/0x30
>>> [  359.212793]  do_syscall_64+0x31/0x40
>>> [  359.216324]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
>> 
>> Well that sucks, I wonder why mine didn't fail like that. I'll see if I
>> can hit this and send a fix. Thanks for reporting!
>
> Below should do it, I apologize for that. I think my test box booted the
> previous kernel which is why it didn't hit it in my regression tests :-(
>
> Greg, can you add this to 5.10-stable? Verified it ran tests with the
> right kernel now...
>
>
> commit d2aaf8fdc544a3edf44820a07294d693dedd12e3
> Author: Jens Axboe <axboe@kernel.dk>
> Date:   Sun Jun 26 18:16:17 2022 -0600
>
>     io_uring: use separate list entry for iopoll requests
>     
>     A previous commit ended up enabling file tracking for iopoll requests,
>     which conflicts with both of them using the same list entry for tracking.
>     Add a separate list entry just for iopoll requests, avoid this issue.
>     
>     No upstream commit exists for this issue.
>     
>     Reported-by: Greg Thelen <gthelen@google.com>
>     Fixes: df3f3bb5059d ("io_uring: add missing item types for various requests")
>     Signed-off-by: Jens Axboe <axboe@kernel.dk>

Confirmed. This patch fixes the error I saw.

Tested-by: Greg Thelen <gthelen@google.com>

> diff --git a/fs/io_uring.c b/fs/io_uring.c
> index 40ac37beca47..2e12dcbc7b0f 100644
> --- a/fs/io_uring.c
> +++ b/fs/io_uring.c
> @@ -696,6 +696,8 @@ struct io_kiocb {
>  	 */
>  	struct list_head		inflight_entry;
>  
> +	struct list_head		iopoll_entry;
> +
>  	struct percpu_ref		*fixed_file_refs;
>  	struct callback_head		task_work;
>  	/* for polled requests, i.e. IORING_OP_POLL_ADD and async armed poll */
> @@ -2350,8 +2352,8 @@ static void io_iopoll_queue(struct list_head *again)
>  	struct io_kiocb *req;
>  
>  	do {
> -		req = list_first_entry(again, struct io_kiocb, inflight_entry);
> -		list_del(&req->inflight_entry);
> +		req = list_first_entry(again, struct io_kiocb, iopoll_entry);
> +		list_del(&req->iopoll_entry);
>  		__io_complete_rw(req, -EAGAIN, 0, NULL);
>  	} while (!list_empty(again));
>  }
> @@ -2373,14 +2375,14 @@ static void io_iopoll_complete(struct io_ring_ctx *ctx, unsigned int *nr_events,
>  	while (!list_empty(done)) {
>  		int cflags = 0;
>  
> -		req = list_first_entry(done, struct io_kiocb, inflight_entry);
> +		req = list_first_entry(done, struct io_kiocb, iopoll_entry);
>  		if (READ_ONCE(req->result) == -EAGAIN) {
>  			req->result = 0;
>  			req->iopoll_completed = 0;
> -			list_move_tail(&req->inflight_entry, &again);
> +			list_move_tail(&req->iopoll_entry, &again);
>  			continue;
>  		}
> -		list_del(&req->inflight_entry);
> +		list_del(&req->iopoll_entry);
>  
>  		if (req->flags & REQ_F_BUFFER_SELECTED)
>  			cflags = io_put_rw_kbuf(req);
> @@ -2416,7 +2418,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
>  	spin = !ctx->poll_multi_file && *nr_events < min;
>  
>  	ret = 0;
> -	list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, inflight_entry) {
> +	list_for_each_entry_safe(req, tmp, &ctx->iopoll_list, iopoll_entry) {
>  		struct kiocb *kiocb = &req->rw.kiocb;
>  
>  		/*
> @@ -2425,7 +2427,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
>  		 * and complete those lists first, if we have entries there.
>  		 */
>  		if (READ_ONCE(req->iopoll_completed)) {
> -			list_move_tail(&req->inflight_entry, &done);
> +			list_move_tail(&req->iopoll_entry, &done);
>  			continue;
>  		}
>  		if (!list_empty(&done))
> @@ -2437,7 +2439,7 @@ static int io_do_iopoll(struct io_ring_ctx *ctx, unsigned int *nr_events,
>  
>  		/* iopoll may have completed current req */
>  		if (READ_ONCE(req->iopoll_completed))
> -			list_move_tail(&req->inflight_entry, &done);
> +			list_move_tail(&req->iopoll_entry, &done);
>  
>  		if (ret && spin)
>  			spin = false;
> @@ -2670,7 +2672,7 @@ static void io_iopoll_req_issued(struct io_kiocb *req)
>  		struct io_kiocb *list_req;
>  
>  		list_req = list_first_entry(&ctx->iopoll_list, struct io_kiocb,
> -						inflight_entry);
> +						iopoll_entry);
>  		if (list_req->file != req->file)
>  			ctx->poll_multi_file = true;
>  	}
> @@ -2680,9 +2682,9 @@ static void io_iopoll_req_issued(struct io_kiocb *req)
>  	 * it to the front so we find it first.
>  	 */
>  	if (READ_ONCE(req->iopoll_completed))
> -		list_add(&req->inflight_entry, &ctx->iopoll_list);
> +		list_add(&req->iopoll_entry, &ctx->iopoll_list);
>  	else
> -		list_add_tail(&req->inflight_entry, &ctx->iopoll_list);
> +		list_add_tail(&req->iopoll_entry, &ctx->iopoll_list);
>  
>  	if ((ctx->flags & IORING_SETUP_SQPOLL) &&
>  	    wq_has_sleeper(&ctx->sq_data->wait))

Re: Linux 5.10.125

[Greg Kroah-Hartman]

On Sun, Jun 26, 2022 at 10:42:06PM -0700, Greg Thelen wrote:
> Jens Axboe <axboe@kernel.dk> wrote:
> 
> > On 6/26/22 6:04 PM, Jens Axboe wrote:
> >> On 6/26/22 4:56 PM, Greg Thelen wrote:
> >>> Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> >>>
> >>>> I'm announcing the release of the 5.10.125 kernel.
> >>>>
> >>>> All users of the 5.10 kernel series must upgrade.
> >>>>
> >>>> The updated 5.10.y git tree can be found at:
> >>>> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
> >>>> and can be browsed at the normal kernel.org git web browser:
> >>>> 	https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
> >>>>
> >>>> thanks,
> >>>>
> >>>> greg k-h
> >>>>
> >>>> ------------
> >>>>
> >>>>  Makefile                              |    2 
> >>>>  arch/arm64/mm/cache.S                 |    2 
> >>>>  arch/s390/mm/pgtable.c                |    2 
> >>>>  drivers/tty/serial/serial_core.c      |   34 ++++--------
> >>>>  drivers/usb/gadget/function/u_ether.c |   11 +++-
> >>>>  fs/io_uring.c                         |   23 +++++---
> >>>>  fs/zonefs/super.c                     |   92 ++++++++++++++++++++++------------
> >>>>  net/ipv4/inet_hashtables.c            |   31 ++++++++---
> >>>>  8 files changed, 122 insertions(+), 75 deletions(-)
> >>>>
> >>>> Christian Borntraeger (1):
> >>>>       s390/mm: use non-quiescing sske for KVM switch to keyed guest
> >>>>
> >>>> Damien Le Moal (1):
> >>>>       zonefs: fix zonefs_iomap_begin() for reads
> >>>>
> >>>> Eric Dumazet (1):
> >>>>       tcp: add some entropy in __inet_hash_connect()
> >>>>
> >>>> Greg Kroah-Hartman (1):
> >>>>       Linux 5.10.125
> >>>>
> >>>> Jens Axboe (1):
> >>>>       io_uring: add missing item types for various requests
> >>>>
> >>>> Lukas Wunner (1):
> >>>>       serial: core: Initialize rs485 RTS polarity already on probe
> >>>>
> >>>> Marian Postevca (1):
> >>>>       usb: gadget: u_ether: fix regression in setting fixed MAC address
> >>>>
> >>>> Will Deacon (1):
> >>>>       arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
> >>>>
> >>>> Willy Tarreau (5):
> >>>>       tcp: use different parts of the port_offset for index and offset
> >>>>       tcp: add small random increments to the source port
> >>>>       tcp: dynamically allocate the perturb table used by source ports
> >>>>       tcp: increase source port perturb table to 2^16
> >>>>       tcp: drop the hash_32() part from the index calculation
> >>>
> >>> 5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add
> >>> missing item types for various requests") causes panic when running
> >>> test/iopoll.t from https://github.com/axboe/liburing commit
> >>> dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
> >>>
> >>> Here's a manually annotated panic message:
> >>> [  359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
> >>> [  359.055393] kernel BUG at lib/list_debug.c:47!
> >>> [  359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
> >>> [  359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S        I       5.10.124 #1
> >>> [  359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
> >>> [  359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
> >>> [  359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
> >>> [  359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
> >>> [  359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
> >>> [  359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
> >>> [  359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
> >>> [  359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
> >>> [  359.145836] FS:  00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
> >>> [  359.153830] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> >>> [  359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
> >>> [  359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> >>> [  359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> >>> [  359.180647] Call Trace:
> >>> [  359.183064]  io_dismantle_req+0x1da/0x2b0
> >>>                     __list_del_entry [include/linux/list.h:132]
> >>>                     list_del [include/linux/list.h:146]
> >>>                     io_req_drop_files [fs/io_uring.c:5934]
> >>>                     io_req_clean_work [fs/io_uring.c:1315]
> >>>                     io_dismantle_req [fs/io_uring.c:1911]
> >>> [  359.187023]  io_do_iopoll+0x4e5/0x790
> >>> [  359.194602]  __se_sys_io_uring_enter+0x39b/0x6f0
> >>> [  359.208318]  __x64_sys_io_uring_enter+0x29/0x30
> >>> [  359.212793]  do_syscall_64+0x31/0x40
> >>> [  359.216324]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
> >> 
> >> Well that sucks, I wonder why mine didn't fail like that. I'll see if I
> >> can hit this and send a fix. Thanks for reporting!
> >
> > Below should do it, I apologize for that. I think my test box booted the
> > previous kernel which is why it didn't hit it in my regression tests :-(
> >
> > Greg, can you add this to 5.10-stable? Verified it ran tests with the
> > right kernel now...

Great, I'll go just do a release with this in it right now to help
others out.

greg k-h

Re: Linux 5.10.125

[Greg Kroah-Hartman]

On Mon, Jun 27, 2022 at 07:54:23AM +0200, Greg Kroah-Hartman wrote:
> On Sun, Jun 26, 2022 at 10:42:06PM -0700, Greg Thelen wrote:
> > Jens Axboe <axboe@kernel.dk> wrote:
> > 
> > > On 6/26/22 6:04 PM, Jens Axboe wrote:
> > >> On 6/26/22 4:56 PM, Greg Thelen wrote:
> > >>> Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
> > >>>
> > >>>> I'm announcing the release of the 5.10.125 kernel.
> > >>>>
> > >>>> All users of the 5.10 kernel series must upgrade.
> > >>>>
> > >>>> The updated 5.10.y git tree can be found at:
> > >>>> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
> > >>>> and can be browsed at the normal kernel.org git web browser:
> > >>>> 	https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
> > >>>>
> > >>>> thanks,
> > >>>>
> > >>>> greg k-h
> > >>>>
> > >>>> ------------
> > >>>>
> > >>>>  Makefile                              |    2 
> > >>>>  arch/arm64/mm/cache.S                 |    2 
> > >>>>  arch/s390/mm/pgtable.c                |    2 
> > >>>>  drivers/tty/serial/serial_core.c      |   34 ++++--------
> > >>>>  drivers/usb/gadget/function/u_ether.c |   11 +++-
> > >>>>  fs/io_uring.c                         |   23 +++++---
> > >>>>  fs/zonefs/super.c                     |   92 ++++++++++++++++++++++------------
> > >>>>  net/ipv4/inet_hashtables.c            |   31 ++++++++---
> > >>>>  8 files changed, 122 insertions(+), 75 deletions(-)
> > >>>>
> > >>>> Christian Borntraeger (1):
> > >>>>       s390/mm: use non-quiescing sske for KVM switch to keyed guest
> > >>>>
> > >>>> Damien Le Moal (1):
> > >>>>       zonefs: fix zonefs_iomap_begin() for reads
> > >>>>
> > >>>> Eric Dumazet (1):
> > >>>>       tcp: add some entropy in __inet_hash_connect()
> > >>>>
> > >>>> Greg Kroah-Hartman (1):
> > >>>>       Linux 5.10.125
> > >>>>
> > >>>> Jens Axboe (1):
> > >>>>       io_uring: add missing item types for various requests
> > >>>>
> > >>>> Lukas Wunner (1):
> > >>>>       serial: core: Initialize rs485 RTS polarity already on probe
> > >>>>
> > >>>> Marian Postevca (1):
> > >>>>       usb: gadget: u_ether: fix regression in setting fixed MAC address
> > >>>>
> > >>>> Will Deacon (1):
> > >>>>       arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
> > >>>>
> > >>>> Willy Tarreau (5):
> > >>>>       tcp: use different parts of the port_offset for index and offset
> > >>>>       tcp: add small random increments to the source port
> > >>>>       tcp: dynamically allocate the perturb table used by source ports
> > >>>>       tcp: increase source port perturb table to 2^16
> > >>>>       tcp: drop the hash_32() part from the index calculation
> > >>>
> > >>> 5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add
> > >>> missing item types for various requests") causes panic when running
> > >>> test/iopoll.t from https://github.com/axboe/liburing commit
> > >>> dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
> > >>>
> > >>> Here's a manually annotated panic message:
> > >>> [  359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
> > >>> [  359.055393] kernel BUG at lib/list_debug.c:47!
> > >>> [  359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
> > >>> [  359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S        I       5.10.124 #1
> > >>> [  359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
> > >>> [  359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
> > >>> [  359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
> > >>> [  359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
> > >>> [  359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
> > >>> [  359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
> > >>> [  359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
> > >>> [  359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
> > >>> [  359.145836] FS:  00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
> > >>> [  359.153830] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> > >>> [  359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
> > >>> [  359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> > >>> [  359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
> > >>> [  359.180647] Call Trace:
> > >>> [  359.183064]  io_dismantle_req+0x1da/0x2b0
> > >>>                     __list_del_entry [include/linux/list.h:132]
> > >>>                     list_del [include/linux/list.h:146]
> > >>>                     io_req_drop_files [fs/io_uring.c:5934]
> > >>>                     io_req_clean_work [fs/io_uring.c:1315]
> > >>>                     io_dismantle_req [fs/io_uring.c:1911]
> > >>> [  359.187023]  io_do_iopoll+0x4e5/0x790
> > >>> [  359.194602]  __se_sys_io_uring_enter+0x39b/0x6f0
> > >>> [  359.208318]  __x64_sys_io_uring_enter+0x29/0x30
> > >>> [  359.212793]  do_syscall_64+0x31/0x40
> > >>> [  359.216324]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
> > >> 
> > >> Well that sucks, I wonder why mine didn't fail like that. I'll see if I
> > >> can hit this and send a fix. Thanks for reporting!
> > >
> > > Below should do it, I apologize for that. I think my test box booted the
> > > previous kernel which is why it didn't hit it in my regression tests :-(
> > >
> > > Greg, can you add this to 5.10-stable? Verified it ran tests with the
> > > right kernel now...
> 
> Great, I'll go just do a release with this in it right now to help
> others out.

5.10.126 is now released with this fix.

Re: Linux 5.10.125

[Jens Axboe]

On 6/27/22 2:05 AM, Greg Kroah-Hartman wrote:
> On Mon, Jun 27, 2022 at 07:54:23AM +0200, Greg Kroah-Hartman wrote:
>> On Sun, Jun 26, 2022 at 10:42:06PM -0700, Greg Thelen wrote:
>>> Jens Axboe <axboe@kernel.dk> wrote:
>>>
>>>> On 6/26/22 6:04 PM, Jens Axboe wrote:
>>>>> On 6/26/22 4:56 PM, Greg Thelen wrote:
>>>>>> Greg Kroah-Hartman <gregkh@linuxfoundation.org> wrote:
>>>>>>
>>>>>>> I'm announcing the release of the 5.10.125 kernel.
>>>>>>>
>>>>>>> All users of the 5.10 kernel series must upgrade.
>>>>>>>
>>>>>>> The updated 5.10.y git tree can be found at:
>>>>>>> 	git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable.git linux-5.10.y
>>>>>>> and can be browsed at the normal kernel.org git web browser:
>>>>>>> 	https://git.kernel.org/?p=linux/kernel/git/stable/linux-stable.git;a=summary
>>>>>>>
>>>>>>> thanks,
>>>>>>>
>>>>>>> greg k-h
>>>>>>>
>>>>>>> ------------
>>>>>>>
>>>>>>>  Makefile                              |    2 
>>>>>>>  arch/arm64/mm/cache.S                 |    2 
>>>>>>>  arch/s390/mm/pgtable.c                |    2 
>>>>>>>  drivers/tty/serial/serial_core.c      |   34 ++++--------
>>>>>>>  drivers/usb/gadget/function/u_ether.c |   11 +++-
>>>>>>>  fs/io_uring.c                         |   23 +++++---
>>>>>>>  fs/zonefs/super.c                     |   92 ++++++++++++++++++++++------------
>>>>>>>  net/ipv4/inet_hashtables.c            |   31 ++++++++---
>>>>>>>  8 files changed, 122 insertions(+), 75 deletions(-)
>>>>>>>
>>>>>>> Christian Borntraeger (1):
>>>>>>>       s390/mm: use non-quiescing sske for KVM switch to keyed guest
>>>>>>>
>>>>>>> Damien Le Moal (1):
>>>>>>>       zonefs: fix zonefs_iomap_begin() for reads
>>>>>>>
>>>>>>> Eric Dumazet (1):
>>>>>>>       tcp: add some entropy in __inet_hash_connect()
>>>>>>>
>>>>>>> Greg Kroah-Hartman (1):
>>>>>>>       Linux 5.10.125
>>>>>>>
>>>>>>> Jens Axboe (1):
>>>>>>>       io_uring: add missing item types for various requests
>>>>>>>
>>>>>>> Lukas Wunner (1):
>>>>>>>       serial: core: Initialize rs485 RTS polarity already on probe
>>>>>>>
>>>>>>> Marian Postevca (1):
>>>>>>>       usb: gadget: u_ether: fix regression in setting fixed MAC address
>>>>>>>
>>>>>>> Will Deacon (1):
>>>>>>>       arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer
>>>>>>>
>>>>>>> Willy Tarreau (5):
>>>>>>>       tcp: use different parts of the port_offset for index and offset
>>>>>>>       tcp: add small random increments to the source port
>>>>>>>       tcp: dynamically allocate the perturb table used by source ports
>>>>>>>       tcp: increase source port perturb table to 2^16
>>>>>>>       tcp: drop the hash_32() part from the index calculation
>>>>>>
>>>>>> 5.10.125 commit df3f3bb5059d20ef094d6b2f0256c4bf4127a859 ("io_uring: add
>>>>>> missing item types for various requests") causes panic when running
>>>>>> test/iopoll.t from https://github.com/axboe/liburing commit
>>>>>> dda4848a9911120a903bef6284fb88286f4464c9 (liburing-2.2).
>>>>>>
>>>>>> Here's a manually annotated panic message:
>>>>>> [  359.047161] list_del corruption, ffffa42098824f80->next is LIST_POISON1 (dead000000000100)
>>>>>> [  359.055393] kernel BUG at lib/list_debug.c:47!
>>>>>> [  359.059786] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC PTI
>>>>>> [  359.065463] CPU: 11 PID: 15862 Comm: iopoll.t Tainted: G S        I       5.10.124 #1
>>>>>> [  359.081804] RIP: 0010:__list_del_entry_valid+0x49/0x80
>>>>>> [  359.086880] Code: c2 22 48 39 d1 74 25 48 8b 11 48 39 f2 75 2d 48 8b 50 08 48 39 f2 75 34 b0 01 5d c3 48 c7 c7 68 15 79 b1 31 c0 e8 c5 a2 5a 00 <0f> 0b 48 c7 c7 d8 8e 76 b1 31 c0 e8 b5 a2 5a 00 0f 0b 48 c7 c7 69
>>>>>> [  359.105431] RSP: 0018:ffffb6b66785bd58 EFLAGS: 00010046
>>>>>> [  359.110592] RAX: 000000000000004e RBX: ffffa42098824f00 RCX: d07284ea1fbba400
>>>>>> [  359.117642] RDX: ffffa43f7f4f05b8 RSI: ffffa43f7f4dff48 RDI: ffffa43f7f4dff48
>>>>>> [  359.124691] RBP: ffffb6b66785bd58 R08: 0000000000000000 R09: ffffffffb1f38540
>>>>>> [  359.131740] R10: 00000000ffff7fff R11: 0000000000000000 R12: 0000000000000282
>>>>>> [  359.138789] R13: ffffb6b66785beb8 R14: ffffa42095d33e00 R15: ffffa420937e3d20
>>>>>> [  359.145836] FS:  00000000004f8380(0000) GS:ffffa43f7f4c0000(0000) knlGS:0000000000000000
>>>>>> [  359.153830] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>>>>>> [  359.159506] CR2: 0000000000539388 CR3: 000000027b57c006 CR4: 00000000003706e0
>>>>>> [  359.166552] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
>>>>>> [  359.173600] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
>>>>>> [  359.180647] Call Trace:
>>>>>> [  359.183064]  io_dismantle_req+0x1da/0x2b0
>>>>>>                     __list_del_entry [include/linux/list.h:132]
>>>>>>                     list_del [include/linux/list.h:146]
>>>>>>                     io_req_drop_files [fs/io_uring.c:5934]
>>>>>>                     io_req_clean_work [fs/io_uring.c:1315]
>>>>>>                     io_dismantle_req [fs/io_uring.c:1911]
>>>>>> [  359.187023]  io_do_iopoll+0x4e5/0x790
>>>>>> [  359.194602]  __se_sys_io_uring_enter+0x39b/0x6f0
>>>>>> [  359.208318]  __x64_sys_io_uring_enter+0x29/0x30
>>>>>> [  359.212793]  do_syscall_64+0x31/0x40
>>>>>> [  359.216324]  entry_SYSCALL_64_after_hwframe+0x44/0xa9
>>>>>
>>>>> Well that sucks, I wonder why mine didn't fail like that. I'll see if I
>>>>> can hit this and send a fix. Thanks for reporting!
>>>>
>>>> Below should do it, I apologize for that. I think my test box booted the
>>>> previous kernel which is why it didn't hit it in my regression tests :-(
>>>>
>>>> Greg, can you add this to 5.10-stable? Verified it ran tests with the
>>>> right kernel now...
>>
>> Great, I'll go just do a release with this in it right now to help
>> others out.
> 
> 5.10.126 is now released with this fix.

Thanks - to both Gregs!

-- 
Jens Axboe