<feed xmlns='http://www.w3.org/2005/Atom'>
<title>linux.git/kernel, branch v5.16-rc4</title>
<subtitle>Linux kernel source tree</subtitle>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/'/>
<entry>
<title>Merge tag 'timers_urgent_for_v5.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip</title>
<updated>2021-12-05T16:58:52+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2021-12-05T16:58:52+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=7587a4a5a4f66293e13358285bcbc90cc9bddb31'/>
<id>7587a4a5a4f66293e13358285bcbc90cc9bddb31</id>
<content type='text'>
Pull timer fix from Borislav Petkov:

 - Prevent a tick storm when a dedicated timekeeper CPU in nohz_full
   mode runs for prolonged periods with interrupts disabled and ends up
   programming the next tick in the past, leading to that storm

* tag 'timers_urgent_for_v5.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  timers/nohz: Last resort update jiffies on nohz_full IRQ entry
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull timer fix from Borislav Petkov:

 - Prevent a tick storm when a dedicated timekeeper CPU in nohz_full
   mode runs for prolonged periods with interrupts disabled and ends up
   programming the next tick in the past, leading to that storm

* tag 'timers_urgent_for_v5.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  timers/nohz: Last resort update jiffies on nohz_full IRQ entry
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'sched_urgent_for_v5.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip</title>
<updated>2021-12-05T16:53:31+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2021-12-05T16:53:31+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=1d213767dc6f594022e43b6b59c45e7e3c84c4de'/>
<id>1d213767dc6f594022e43b6b59c45e7e3c84c4de</id>
<content type='text'>
Pull scheduler fixes from Borislav Petkov:

 - Properly init uclamp_flags of a runqueue, on first enqueuing

 - Fix preempt= callback return values

 - Correct utime/stime resource usage reporting on nohz_full to return
   the proper times instead of shorter ones

* tag 'sched_urgent_for_v5.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/uclamp: Fix rq-&gt;uclamp_max not set on first enqueue
  preempt/dynamic: Fix setup_preempt_mode() return value
  sched/cputime: Fix getrusage(RUSAGE_THREAD) with nohz_full
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull scheduler fixes from Borislav Petkov:

 - Properly init uclamp_flags of a runqueue, on first enqueuing

 - Fix preempt= callback return values

 - Correct utime/stime resource usage reporting on nohz_full to return
   the proper times instead of shorter ones

* tag 'sched_urgent_for_v5.16_rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/uclamp: Fix rq-&gt;uclamp_max not set on first enqueue
  preempt/dynamic: Fix setup_preempt_mode() return value
  sched/cputime: Fix getrusage(RUSAGE_THREAD) with nohz_full
</pre>
</div>
</content>
</entry>
<entry>
<title>sched/uclamp: Fix rq-&gt;uclamp_max not set on first enqueue</title>
<updated>2021-12-04T09:56:18+00:00</updated>
<author>
<name>Qais Yousef</name>
<email>qais.yousef@arm.com</email>
</author>
<published>2021-12-02T11:20:33+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=315c4f884800c45cb6bd8c90422fad554a8b9588'/>
<id>315c4f884800c45cb6bd8c90422fad554a8b9588</id>
<content type='text'>
Commit d81ae8aac85c ("sched/uclamp: Fix initialization of struct
uclamp_rq") introduced a bug where uclamp_max of the rq is not reset to
match the woken up task's uclamp_max when the rq is idle.

The code was relying on rq-&gt;uclamp_max initialized to zero, so on first
enqueue

	static inline void uclamp_rq_inc_id(struct rq *rq, struct task_struct *p,
					    enum uclamp_id clamp_id)
	{
		...

		if (uc_se-&gt;value &gt; READ_ONCE(uc_rq-&gt;value))
			WRITE_ONCE(uc_rq-&gt;value, uc_se-&gt;value);
	}

was actually resetting it. But since commit d81ae8aac85c changed the
default to 1024, this no longer works. And since rq-&gt;uclamp_flags is
also initialized to 0, neither above code path nor uclamp_idle_reset()
update the rq-&gt;uclamp_max on first wake up from idle.

This is only visible from first wake up(s) until the first dequeue to
idle after enabling the static key. And it only matters if the
uclamp_max of this task is &lt; 1024 since only then its uclamp_max will be
effectively ignored.

Fix it by properly initializing rq-&gt;uclamp_flags = UCLAMP_FLAG_IDLE to
ensure uclamp_idle_reset() is called which then will update the rq
uclamp_max value as expected.

Fixes: d81ae8aac85c ("sched/uclamp: Fix initialization of struct uclamp_rq")
Signed-off-by: Qais Yousef &lt;qais.yousef@arm.com&gt;
Signed-off-by: Peter Zijlstra (Intel) &lt;peterz@infradead.org&gt;
Reviewed-by: Valentin Schneider &lt;Valentin.Schneider@arm.com&gt;
Tested-by: Dietmar Eggemann &lt;dietmar.eggemann@arm.com&gt;
Link: https://lkml.kernel.org/r/20211202112033.1705279-1-qais.yousef@arm.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Commit d81ae8aac85c ("sched/uclamp: Fix initialization of struct
uclamp_rq") introduced a bug where uclamp_max of the rq is not reset to
match the woken up task's uclamp_max when the rq is idle.

The code was relying on rq-&gt;uclamp_max initialized to zero, so on first
enqueue

	static inline void uclamp_rq_inc_id(struct rq *rq, struct task_struct *p,
					    enum uclamp_id clamp_id)
	{
		...

		if (uc_se-&gt;value &gt; READ_ONCE(uc_rq-&gt;value))
			WRITE_ONCE(uc_rq-&gt;value, uc_se-&gt;value);
	}

was actually resetting it. But since commit d81ae8aac85c changed the
default to 1024, this no longer works. And since rq-&gt;uclamp_flags is
also initialized to 0, neither above code path nor uclamp_idle_reset()
update the rq-&gt;uclamp_max on first wake up from idle.

This is only visible from first wake up(s) until the first dequeue to
idle after enabling the static key. And it only matters if the
uclamp_max of this task is &lt; 1024 since only then its uclamp_max will be
effectively ignored.

Fix it by properly initializing rq-&gt;uclamp_flags = UCLAMP_FLAG_IDLE to
ensure uclamp_idle_reset() is called which then will update the rq
uclamp_max value as expected.

Fixes: d81ae8aac85c ("sched/uclamp: Fix initialization of struct uclamp_rq")
Signed-off-by: Qais Yousef &lt;qais.yousef@arm.com&gt;
Signed-off-by: Peter Zijlstra (Intel) &lt;peterz@infradead.org&gt;
Reviewed-by: Valentin Schneider &lt;Valentin.Schneider@arm.com&gt;
Tested-by: Dietmar Eggemann &lt;dietmar.eggemann@arm.com&gt;
Link: https://lkml.kernel.org/r/20211202112033.1705279-1-qais.yousef@arm.com
</pre>
</div>
</content>
</entry>
<entry>
<title>preempt/dynamic: Fix setup_preempt_mode() return value</title>
<updated>2021-12-04T09:56:18+00:00</updated>
<author>
<name>Andrew Halaney</name>
<email>ahalaney@redhat.com</email>
</author>
<published>2021-12-03T23:32:03+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=9ed20bafc85806ca6c97c9128cec46c3ef80ae86'/>
<id>9ed20bafc85806ca6c97c9128cec46c3ef80ae86</id>
<content type='text'>
__setup() callbacks expect 1 for success and 0 for failure. Correct the
usage here to reflect that.

Fixes: 826bfeb37bb4 ("preempt/dynamic: Support dynamic preempt with preempt= boot option")
Reported-by: Mark Rutland &lt;mark.rutland@arm.com&gt;
Signed-off-by: Andrew Halaney &lt;ahalaney@redhat.com&gt;
Signed-off-by: Peter Zijlstra (Intel) &lt;peterz@infradead.org&gt;
Link: https://lkml.kernel.org/r/20211203233203.133581-1-ahalaney@redhat.com
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
__setup() callbacks expect 1 for success and 0 for failure. Correct the
usage here to reflect that.

Fixes: 826bfeb37bb4 ("preempt/dynamic: Support dynamic preempt with preempt= boot option")
Reported-by: Mark Rutland &lt;mark.rutland@arm.com&gt;
Signed-off-by: Andrew Halaney &lt;ahalaney@redhat.com&gt;
Signed-off-by: Peter Zijlstra (Intel) &lt;peterz@infradead.org&gt;
Link: https://lkml.kernel.org/r/20211203233203.133581-1-ahalaney@redhat.com
</pre>
</div>
</content>
</entry>
<entry>
<title>sched/cputime: Fix getrusage(RUSAGE_THREAD) with nohz_full</title>
<updated>2021-12-02T14:08:22+00:00</updated>
<author>
<name>Frederic Weisbecker</name>
<email>frederic@kernel.org</email>
</author>
<published>2021-10-26T14:10:55+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=e7f2be115f0746b969c0df14c0d182f65f005ca5'/>
<id>e7f2be115f0746b969c0df14c0d182f65f005ca5</id>
<content type='text'>
getrusage(RUSAGE_THREAD) with nohz_full may return shorter utime/stime
than the actual time.

task_cputime_adjusted() snapshots utime and stime and then adjust their
sum to match the scheduler maintained cputime.sum_exec_runtime.
Unfortunately in nohz_full, sum_exec_runtime is only updated once per
second in the worst case, causing a discrepancy against utime and stime
that can be updated anytime by the reader using vtime.

To fix this situation, perform an update of cputime.sum_exec_runtime
when the cputime snapshot reports the task as actually running while
the tick is disabled. The related overhead is then contained within the
relevant situations.

Reported-by: Hasegawa Hitomi &lt;hasegawa-hitomi@fujitsu.com&gt;
Signed-off-by: Frederic Weisbecker &lt;frederic@kernel.org&gt;
Signed-off-by: Hasegawa Hitomi &lt;hasegawa-hitomi@fujitsu.com&gt;
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Tested-by: Masayoshi Mizuma &lt;m.mizuma@jp.fujitsu.com&gt;
Acked-by: Phil Auld &lt;pauld@redhat.com&gt;
Link: https://lore.kernel.org/r/20211026141055.57358-3-frederic@kernel.org

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
getrusage(RUSAGE_THREAD) with nohz_full may return shorter utime/stime
than the actual time.

task_cputime_adjusted() snapshots utime and stime and then adjust their
sum to match the scheduler maintained cputime.sum_exec_runtime.
Unfortunately in nohz_full, sum_exec_runtime is only updated once per
second in the worst case, causing a discrepancy against utime and stime
that can be updated anytime by the reader using vtime.

To fix this situation, perform an update of cputime.sum_exec_runtime
when the cputime snapshot reports the task as actually running while
the tick is disabled. The related overhead is then contained within the
relevant situations.

Reported-by: Hasegawa Hitomi &lt;hasegawa-hitomi@fujitsu.com&gt;
Signed-off-by: Frederic Weisbecker &lt;frederic@kernel.org&gt;
Signed-off-by: Hasegawa Hitomi &lt;hasegawa-hitomi@fujitsu.com&gt;
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Tested-by: Masayoshi Mizuma &lt;m.mizuma@jp.fujitsu.com&gt;
Acked-by: Phil Auld &lt;pauld@redhat.com&gt;
Link: https://lore.kernel.org/r/20211026141055.57358-3-frederic@kernel.org

</pre>
</div>
</content>
</entry>
<entry>
<title>timers/nohz: Last resort update jiffies on nohz_full IRQ entry</title>
<updated>2021-12-02T14:07:22+00:00</updated>
<author>
<name>Frederic Weisbecker</name>
<email>frederic@kernel.org</email>
</author>
<published>2021-10-26T14:10:54+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=53e87e3cdc155f20c3417b689df8d2ac88d79576'/>
<id>53e87e3cdc155f20c3417b689df8d2ac88d79576</id>
<content type='text'>
When at least one CPU runs in nohz_full mode, a dedicated timekeeper CPU
is guaranteed to stay online and to never stop its tick.

Meanwhile on some rare case, the dedicated timekeeper may be running
with interrupts disabled for a while, such as in stop_machine.

If jiffies stop being updated, a nohz_full CPU may end up endlessly
programming the next tick in the past, taking the last jiffies update
monotonic timestamp as a stale base, resulting in an tick storm.

Here is a scenario where it matters:

0) CPU 0 is the timekeeper and CPU 1 a nohz_full CPU.

1) A stop machine callback is queued to execute somewhere.

2) CPU 0 reaches MULTI_STOP_DISABLE_IRQ while CPU 1 is still in
   MULTI_STOP_PREPARE. Hence CPU 0 can't do its timekeeping duty. CPU 1
   can still take IRQs.

3) CPU 1 receives an IRQ which queues a timer callback one jiffy forward.

4) On IRQ exit, CPU 1 schedules the tick one jiffy forward, taking
   last_jiffies_update as a base. But last_jiffies_update hasn't been
   updated for 2 jiffies since the timekeeper has interrupts disabled.

5) clockevents_program_event(), which relies on ktime_get(), observes
   that the expiration is in the past and therefore programs the min
   delta event on the clock.

6) The tick fires immediately, goto 3)

7) Tick storm, the nohz_full CPU is drown and takes ages to reach
   MULTI_STOP_DISABLE_IRQ, which is the only way out of this situation.

Solve this with unconditionally updating jiffies if the value is stale
on nohz_full IRQ entry. IRQs and other disturbances are expected to be
rare enough on nohz_full for the unconditional call to ktime_get() to
actually matter.

Reported-by: Paul E. McKenney &lt;paulmck@kernel.org&gt;
Signed-off-by: Frederic Weisbecker &lt;frederic@kernel.org&gt;
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Tested-by: Paul E. McKenney &lt;paulmck@kernel.org&gt;
Link: https://lore.kernel.org/r/20211026141055.57358-2-frederic@kernel.org

</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
When at least one CPU runs in nohz_full mode, a dedicated timekeeper CPU
is guaranteed to stay online and to never stop its tick.

Meanwhile on some rare case, the dedicated timekeeper may be running
with interrupts disabled for a while, such as in stop_machine.

If jiffies stop being updated, a nohz_full CPU may end up endlessly
programming the next tick in the past, taking the last jiffies update
monotonic timestamp as a stale base, resulting in an tick storm.

Here is a scenario where it matters:

0) CPU 0 is the timekeeper and CPU 1 a nohz_full CPU.

1) A stop machine callback is queued to execute somewhere.

2) CPU 0 reaches MULTI_STOP_DISABLE_IRQ while CPU 1 is still in
   MULTI_STOP_PREPARE. Hence CPU 0 can't do its timekeeping duty. CPU 1
   can still take IRQs.

3) CPU 1 receives an IRQ which queues a timer callback one jiffy forward.

4) On IRQ exit, CPU 1 schedules the tick one jiffy forward, taking
   last_jiffies_update as a base. But last_jiffies_update hasn't been
   updated for 2 jiffies since the timekeeper has interrupts disabled.

5) clockevents_program_event(), which relies on ktime_get(), observes
   that the expiration is in the past and therefore programs the min
   delta event on the clock.

6) The tick fires immediately, goto 3)

7) Tick storm, the nohz_full CPU is drown and takes ages to reach
   MULTI_STOP_DISABLE_IRQ, which is the only way out of this situation.

Solve this with unconditionally updating jiffies if the value is stale
on nohz_full IRQ entry. IRQs and other disturbances are expected to be
rare enough on nohz_full for the unconditional call to ktime_get() to
actually matter.

Reported-by: Paul E. McKenney &lt;paulmck@kernel.org&gt;
Signed-off-by: Frederic Weisbecker &lt;frederic@kernel.org&gt;
Signed-off-by: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Tested-by: Paul E. McKenney &lt;paulmck@kernel.org&gt;
Link: https://lore.kernel.org/r/20211026141055.57358-2-frederic@kernel.org

</pre>
</div>
</content>
</entry>
<entry>
<title>kprobes: Limit max data_size of the kretprobe instances</title>
<updated>2021-12-02T02:04:34+00:00</updated>
<author>
<name>Masami Hiramatsu</name>
<email>mhiramat@kernel.org</email>
</author>
<published>2021-12-01T14:45:50+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=6bbfa44116689469267f1a6e3d233b52114139d2'/>
<id>6bbfa44116689469267f1a6e3d233b52114139d2</id>
<content type='text'>
The 'kprobe::data_size' is unsigned, thus it can not be negative.  But if
user sets it enough big number (e.g. (size_t)-8), the result of 'data_size
+ sizeof(struct kretprobe_instance)' becomes smaller than sizeof(struct
kretprobe_instance) or zero. In result, the kretprobe_instance are
allocated without enough memory, and kretprobe accesses outside of
allocated memory.

To avoid this issue, introduce a max limitation of the
kretprobe::data_size. 4KB per instance should be OK.

Link: https://lkml.kernel.org/r/163836995040.432120.10322772773821182925.stgit@devnote2

Cc: stable@vger.kernel.org
Fixes: f47cd9b553aa ("kprobes: kretprobe user entry-handler")
Reported-by: zhangyue &lt;zhangyue1@kylinos.cn&gt;
Signed-off-by: Masami Hiramatsu &lt;mhiramat@kernel.org&gt;
Signed-off-by: Steven Rostedt (VMware) &lt;rostedt@goodmis.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The 'kprobe::data_size' is unsigned, thus it can not be negative.  But if
user sets it enough big number (e.g. (size_t)-8), the result of 'data_size
+ sizeof(struct kretprobe_instance)' becomes smaller than sizeof(struct
kretprobe_instance) or zero. In result, the kretprobe_instance are
allocated without enough memory, and kretprobe accesses outside of
allocated memory.

To avoid this issue, introduce a max limitation of the
kretprobe::data_size. 4KB per instance should be OK.

Link: https://lkml.kernel.org/r/163836995040.432120.10322772773821182925.stgit@devnote2

Cc: stable@vger.kernel.org
Fixes: f47cd9b553aa ("kprobes: kretprobe user entry-handler")
Reported-by: zhangyue &lt;zhangyue1@kylinos.cn&gt;
Signed-off-by: Masami Hiramatsu &lt;mhiramat@kernel.org&gt;
Signed-off-by: Steven Rostedt (VMware) &lt;rostedt@goodmis.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>tracing: Fix a kmemleak false positive in tracing_map</title>
<updated>2021-12-02T02:04:34+00:00</updated>
<author>
<name>Chen Jun</name>
<email>chenjun102@huawei.com</email>
</author>
<published>2021-11-24T14:08:01+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=f25667e5980a4333729cac3101e5de1bb851f71a'/>
<id>f25667e5980a4333729cac3101e5de1bb851f71a</id>
<content type='text'>
Doing the command:
  echo 'hist:key=common_pid.execname,common_timestamp' &gt; /sys/kernel/debug/tracing/events/xxx/trigger

Triggers many kmemleak reports:

unreferenced object 0xffff0000c7ea4980 (size 128):
  comm "bash", pid 338, jiffies 4294912626 (age 9339.324s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;00000000f3469921&gt;] kmem_cache_alloc_trace+0x4c0/0x6f0
    [&lt;0000000054ca40c3&gt;] hist_trigger_elt_data_alloc+0x140/0x178
    [&lt;00000000633bd154&gt;] tracing_map_init+0x1f8/0x268
    [&lt;000000007e814ab9&gt;] event_hist_trigger_func+0xca0/0x1ad0
    [&lt;00000000bf8520ed&gt;] trigger_process_regex+0xd4/0x128
    [&lt;00000000f549355a&gt;] event_trigger_write+0x7c/0x120
    [&lt;00000000b80f898d&gt;] vfs_write+0xc4/0x380
    [&lt;00000000823e1055&gt;] ksys_write+0x74/0xf8
    [&lt;000000008a9374aa&gt;] __arm64_sys_write+0x24/0x30
    [&lt;0000000087124017&gt;] do_el0_svc+0x88/0x1c0
    [&lt;00000000efd0dcd1&gt;] el0_svc+0x1c/0x28
    [&lt;00000000dbfba9b3&gt;] el0_sync_handler+0x88/0xc0
    [&lt;00000000e7399680&gt;] el0_sync+0x148/0x180
unreferenced object 0xffff0000c7ea4980 (size 128):
  comm "bash", pid 338, jiffies 4294912626 (age 9339.324s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;00000000f3469921&gt;] kmem_cache_alloc_trace+0x4c0/0x6f0
    [&lt;0000000054ca40c3&gt;] hist_trigger_elt_data_alloc+0x140/0x178
    [&lt;00000000633bd154&gt;] tracing_map_init+0x1f8/0x268
    [&lt;000000007e814ab9&gt;] event_hist_trigger_func+0xca0/0x1ad0
    [&lt;00000000bf8520ed&gt;] trigger_process_regex+0xd4/0x128
    [&lt;00000000f549355a&gt;] event_trigger_write+0x7c/0x120
    [&lt;00000000b80f898d&gt;] vfs_write+0xc4/0x380
    [&lt;00000000823e1055&gt;] ksys_write+0x74/0xf8
    [&lt;000000008a9374aa&gt;] __arm64_sys_write+0x24/0x30
    [&lt;0000000087124017&gt;] do_el0_svc+0x88/0x1c0
    [&lt;00000000efd0dcd1&gt;] el0_svc+0x1c/0x28
    [&lt;00000000dbfba9b3&gt;] el0_sync_handler+0x88/0xc0
    [&lt;00000000e7399680&gt;] el0_sync+0x148/0x180

The reason is elts-&gt;pages[i] is alloced by get_zeroed_page.
and kmemleak will not scan the area alloced by get_zeroed_page.
The address stored in elts-&gt;pages will be regarded as leaked.

That is, the elts-&gt;pages[i] will have pointers loaded onto it as well, and
without telling kmemleak about it, those pointers will look like memory
without a reference.

To fix this, call kmemleak_alloc to tell kmemleak to scan elts-&gt;pages[i]

Link: https://lkml.kernel.org/r/20211124140801.87121-1-chenjun102@huawei.com

Signed-off-by: Chen Jun &lt;chenjun102@huawei.com&gt;
Signed-off-by: Steven Rostedt (VMware) &lt;rostedt@goodmis.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Doing the command:
  echo 'hist:key=common_pid.execname,common_timestamp' &gt; /sys/kernel/debug/tracing/events/xxx/trigger

Triggers many kmemleak reports:

unreferenced object 0xffff0000c7ea4980 (size 128):
  comm "bash", pid 338, jiffies 4294912626 (age 9339.324s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;00000000f3469921&gt;] kmem_cache_alloc_trace+0x4c0/0x6f0
    [&lt;0000000054ca40c3&gt;] hist_trigger_elt_data_alloc+0x140/0x178
    [&lt;00000000633bd154&gt;] tracing_map_init+0x1f8/0x268
    [&lt;000000007e814ab9&gt;] event_hist_trigger_func+0xca0/0x1ad0
    [&lt;00000000bf8520ed&gt;] trigger_process_regex+0xd4/0x128
    [&lt;00000000f549355a&gt;] event_trigger_write+0x7c/0x120
    [&lt;00000000b80f898d&gt;] vfs_write+0xc4/0x380
    [&lt;00000000823e1055&gt;] ksys_write+0x74/0xf8
    [&lt;000000008a9374aa&gt;] __arm64_sys_write+0x24/0x30
    [&lt;0000000087124017&gt;] do_el0_svc+0x88/0x1c0
    [&lt;00000000efd0dcd1&gt;] el0_svc+0x1c/0x28
    [&lt;00000000dbfba9b3&gt;] el0_sync_handler+0x88/0xc0
    [&lt;00000000e7399680&gt;] el0_sync+0x148/0x180
unreferenced object 0xffff0000c7ea4980 (size 128):
  comm "bash", pid 338, jiffies 4294912626 (age 9339.324s)
  hex dump (first 32 bytes):
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [&lt;00000000f3469921&gt;] kmem_cache_alloc_trace+0x4c0/0x6f0
    [&lt;0000000054ca40c3&gt;] hist_trigger_elt_data_alloc+0x140/0x178
    [&lt;00000000633bd154&gt;] tracing_map_init+0x1f8/0x268
    [&lt;000000007e814ab9&gt;] event_hist_trigger_func+0xca0/0x1ad0
    [&lt;00000000bf8520ed&gt;] trigger_process_regex+0xd4/0x128
    [&lt;00000000f549355a&gt;] event_trigger_write+0x7c/0x120
    [&lt;00000000b80f898d&gt;] vfs_write+0xc4/0x380
    [&lt;00000000823e1055&gt;] ksys_write+0x74/0xf8
    [&lt;000000008a9374aa&gt;] __arm64_sys_write+0x24/0x30
    [&lt;0000000087124017&gt;] do_el0_svc+0x88/0x1c0
    [&lt;00000000efd0dcd1&gt;] el0_svc+0x1c/0x28
    [&lt;00000000dbfba9b3&gt;] el0_sync_handler+0x88/0xc0
    [&lt;00000000e7399680&gt;] el0_sync+0x148/0x180

The reason is elts-&gt;pages[i] is alloced by get_zeroed_page.
and kmemleak will not scan the area alloced by get_zeroed_page.
The address stored in elts-&gt;pages will be regarded as leaked.

That is, the elts-&gt;pages[i] will have pointers loaded onto it as well, and
without telling kmemleak about it, those pointers will look like memory
without a reference.

To fix this, call kmemleak_alloc to tell kmemleak to scan elts-&gt;pages[i]

Link: https://lkml.kernel.org/r/20211124140801.87121-1-chenjun102@huawei.com

Signed-off-by: Chen Jun &lt;chenjun102@huawei.com&gt;
Signed-off-by: Steven Rostedt (VMware) &lt;rostedt@goodmis.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>tracing/histograms: String compares should not care about signed values</title>
<updated>2021-12-02T02:04:22+00:00</updated>
<author>
<name>Steven Rostedt (VMware)</name>
<email>rostedt@goodmis.org</email>
</author>
<published>2021-11-30T17:31:23+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=450fec13d9170127678f991698ac1a5b05c02e2f'/>
<id>450fec13d9170127678f991698ac1a5b05c02e2f</id>
<content type='text'>
When comparing two strings for the "onmatch" histogram trigger, fields
that are strings use string comparisons, which do not care about being
signed or not.

Do not fail to match two string fields if one is unsigned char array and
the other is a signed char array.

Link: https://lore.kernel.org/all/20211129123043.5cfd687a@gandalf.local.home/

Cc: stable@vgerk.kernel.org
Cc: Tom Zanussi &lt;zanussi@kernel.org&gt;
Cc: Yafang Shao &lt;laoar.shao@gmail.com&gt;
Fixes: b05e89ae7cf3b ("tracing: Accept different type for synthetic event fields")
Reviewed-by: Masami Hiramatsu &lt;mhiramatsu@kernel.org&gt;
Reported-by: Sven Schnelle &lt;svens@linux.ibm.com&gt;
Signed-off-by: Steven Rostedt (VMware) &lt;rostedt@goodmis.org&gt;
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
When comparing two strings for the "onmatch" histogram trigger, fields
that are strings use string comparisons, which do not care about being
signed or not.

Do not fail to match two string fields if one is unsigned char array and
the other is a signed char array.

Link: https://lore.kernel.org/all/20211129123043.5cfd687a@gandalf.local.home/

Cc: stable@vgerk.kernel.org
Cc: Tom Zanussi &lt;zanussi@kernel.org&gt;
Cc: Yafang Shao &lt;laoar.shao@gmail.com&gt;
Fixes: b05e89ae7cf3b ("tracing: Accept different type for synthetic event fields")
Reviewed-by: Masami Hiramatsu &lt;mhiramatsu@kernel.org&gt;
Reported-by: Sven Schnelle &lt;svens@linux.ibm.com&gt;
Signed-off-by: Steven Rostedt (VMware) &lt;rostedt@goodmis.org&gt;
</pre>
</div>
</content>
</entry>
<entry>
<title>Merge tag 'sched-urgent-2021-11-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip</title>
<updated>2021-11-28T17:15:34+00:00</updated>
<author>
<name>Linus Torvalds</name>
<email>torvalds@linux-foundation.org</email>
</author>
<published>2021-11-28T17:15:34+00:00</published>
<link rel='alternate' type='text/html' href='https://git.tavy.me/linux.git/commit/?id=97891bbf38f71ec97199d2459368b5b4b700706e'/>
<id>97891bbf38f71ec97199d2459368b5b4b700706e</id>
<content type='text'>
Pull scheduler fix from Thomas Gleixner:
 "A single scheduler fix to ensure that there is no stale KASAN shadow
  state left on the idle task's stack when a CPU is brought up after it
  was brought down before"

* tag 'sched-urgent-2021-11-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/scs: Reset task stack state in bringup_cpu()
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Pull scheduler fix from Thomas Gleixner:
 "A single scheduler fix to ensure that there is no stale KASAN shadow
  state left on the idle task's stack when a CPU is brought up after it
  was brought down before"

* tag 'sched-urgent-2021-11-28' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  sched/scs: Reset task stack state in bringup_cpu()
</pre>
</div>
</content>
</entry>
</feed>
