Skip to content

fix sbitmap initialization and null_blk tagset setup #44

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
blktests-ci wants to merge 3 commits into from
Closed

fix sbitmap initialization and null_blk tagset setup #44

blktests-ci wants to merge 3 commits into from

Conversation

@blktests-ci
Copy link

@blktests-ci blktests-ci bot commented Jul 23, 2025

Pull request for series with
subject: fix sbitmap initialization and null_blk tagset setup
version: 1
url: https://patchwork.kernel.org/project/linux-block/list/?series=984340

@blktests-ci
Copy link
Author

blktests-ci bot commented Jul 23, 2025

Upstream branch: 89be9a8
series: https://patchwork.kernel.org/project/linux-block/list/?series=984340
version: 1

@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from 81f31a4 to 87bbbbc Compare July 24, 2025 05:40
@blktests-ci
Copy link
Author

blktests-ci bot commented Jul 24, 2025

Upstream branch: 25fae0b
series: https://patchwork.kernel.org/project/linux-block/list/?series=984340
version: 1

@blktests-ci blktests-ci bot force-pushed the series/984084=>linus-master branch from 4cc8be2 to af24d2a Compare July 24, 2025 05:41
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch 2 times, most recently from 6637119 to f092a9b Compare July 31, 2025 04:25
@blktests-ci
Copy link
Author

blktests-ci bot commented Jul 31, 2025

Upstream branch: 260f6f4
series: https://patchwork.kernel.org/project/linux-block/list/?series=984340
version: 1

@blktests-ci blktests-ci bot force-pushed the series/984084=>linus-master branch from af24d2a to 66b032c Compare July 31, 2025 04:35
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from f092a9b to 0b59764 Compare July 31, 2025 17:58
@blktests-ci
Copy link
Author

blktests-ci bot commented Jul 31, 2025

Upstream branch: d6084bb
series: https://patchwork.kernel.org/project/linux-block/list/?series=984340
version: 1

@blktests-ci blktests-ci bot force-pushed the series/984084=>linus-master branch from 66b032c to ddf0ba1 Compare July 31, 2025 18:08
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from 0b59764 to aee5bd3 Compare July 31, 2025 19:11
@blktests-ci
Copy link
Author

blktests-ci bot commented Jul 31, 2025

Upstream branch: 831462f
series: https://patchwork.kernel.org/project/linux-block/list/?series=984340
version: 1

@blktests-ci blktests-ci bot force-pushed the series/984084=>linus-master branch from ddf0ba1 to 4ced250 Compare July 31, 2025 19:21
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from aee5bd3 to ef18525 Compare July 31, 2025 20:07
@blktests-ci
Copy link
Author

blktests-ci bot commented Jul 31, 2025

Upstream branch: c93529a
series: https://patchwork.kernel.org/project/linux-block/list/?series=984340
version: 1

@blktests-ci blktests-ci bot force-pushed the series/984084=>linus-master branch from 4ced250 to c81ac97 Compare July 31, 2025 20:17
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from ef18525 to 3851b3f Compare July 31, 2025 20:55
@blktests-ci
Copy link
Author

blktests-ci bot commented Jul 31, 2025

Upstream branch: cbbf0a7
series: https://patchwork.kernel.org/project/linux-block/list/?series=984340
version: 1

@blktests-ci blktests-ci bot force-pushed the series/984084=>linus-master branch from c81ac97 to f1d1184 Compare July 31, 2025 21:05
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from 3851b3f to 28b3384 Compare July 31, 2025 23:42
@blktests-ci
Copy link
Author

blktests-ci bot commented Jul 31, 2025

Upstream branch: 6a68cec
series: https://patchwork.kernel.org/project/linux-block/list/?series=984340
version: 1

@blktests-ci blktests-ci bot force-pushed the series/984084=>linus-master branch from f1d1184 to ff9a3a1 Compare July 31, 2025 23:52
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from 28b3384 to 8ab9be5 Compare August 1, 2025 00:45
@blktests-ci
Copy link
Author

blktests-ci bot commented Aug 1, 2025

Upstream branch: f2d282e
series: https://patchwork.kernel.org/project/linux-block/list/?series=984340
version: 1

@blktests-ci blktests-ci bot force-pushed the series/984084=>linus-master branch from ff9a3a1 to 66f0e52 Compare August 1, 2025 00:55
@blktests-ci blktests-ci bot force-pushed the series/984084=>linus-master branch from d6c1665 to f6f9618 Compare August 12, 2025 16:23
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from 404c2ca to b39b4d5 Compare August 12, 2025 19:19
@blktests-ci
Copy link
Author

blktests-ci bot commented Aug 12, 2025

Upstream branch: 8742b2d
series: https://patchwork.kernel.org/project/linux-block/list/?series=984340
version: 1

@blktests-ci blktests-ci bot force-pushed the series/984084=>linus-master branch from f6f9618 to 5032047 Compare August 12, 2025 19:34
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from b39b4d5 to d7e410a Compare August 13, 2025 15:44
@blktests-ci
Copy link
Author

blktests-ci bot commented Aug 13, 2025

Upstream branch: 91325f3
series: https://patchwork.kernel.org/project/linux-block/list/?series=984340
version: 1

@blktests-ci blktests-ci bot force-pushed the series/984084=>linus-master branch from 5032047 to 28995e1 Compare August 13, 2025 15:59
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from d7e410a to ee33a84 Compare August 13, 2025 17:55
@blktests-ci
Copy link
Author

blktests-ci bot commented Aug 13, 2025

Upstream branch: 3a4a036
series: https://patchwork.kernel.org/project/linux-block/list/?series=984340
version: 1

@blktests-ci blktests-ci bot force-pushed the series/984084=>linus-master branch from 28995e1 to f068d0a Compare August 13, 2025 18:11
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from ee33a84 to 44c61ab Compare August 13, 2025 19:02
@blktests-ci
Copy link
Author

blktests-ci bot commented Aug 13, 2025

Upstream branch: dfc0f63
series: https://patchwork.kernel.org/project/linux-block/list/?series=984340
version: 1

@blktests-ci blktests-ci bot force-pushed the series/984084=>linus-master branch from f068d0a to 8abcf37 Compare August 13, 2025 19:18
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from 44c61ab to 89d0c23 Compare August 14, 2025 03:34
@blktests-ci
Copy link
Author

blktests-ci bot commented Aug 14, 2025

Upstream branch: 0cc5352
series: https://patchwork.kernel.org/project/linux-block/list/?series=984340
version: 1

@blktests-ci blktests-ci bot force-pushed the series/984084=>linus-master branch from 8abcf37 to 9c123bd Compare August 14, 2025 03:50
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from 89d0c23 to 1cd470e Compare August 14, 2025 15:49
@blktests-ci
Copy link
Author

blktests-ci bot commented Aug 14, 2025

Upstream branch: 24ea63e
series: https://patchwork.kernel.org/project/linux-block/list/?series=984340
version: 1

@blktests-ci blktests-ci bot force-pushed the series/984084=>linus-master branch from 9c123bd to 85db7d7 Compare August 14, 2025 16:06
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from 1cd470e to 38c66a9 Compare August 15, 2025 02:29
@shroffni @kawasaki
lib/sbitmap: fix kernel crash observed when sbitmap depth is zero
7d43994 
We observed a kernel crash when the I/O scheduler allocates an sbitmap
for a hardware queue (hctx) that has no associated software queues (ctx),
and later attempts to free it. When no software queues are mapped to a
hardware queue, the sbitmap is initialized with a depth of zero. In such
cases, the sbitmap_init_node() function should set sb->alloc_hint to NULL.
However, if this is not done, sb->alloc_hint may contain garbage, and
calling sbitmap_free() will pass this invalid pointer to free_percpu(),
resulting in a kernel crash.

Example crash trace:
==================================================================
Kernel attempted to read user page (28) - exploit attempt? (uid: 0)
BUG: Kernel NULL pointer dereference on read at 0x00000028
Faulting instruction address: 0xc000000000708f88
Oops: Kernel access of bad area, sig: 11 [#1]
LE PAGE_SIZE=64K MMU=Radix  SMP NR_CPUS=2048 NUMA pSeries
[...]
CPU: 5 UID: 0 PID: 5491 Comm: mk_nullb_shared Kdump: loaded Tainted: G    B               6.16.0-rc5+ #294 VOLUNTARY
Tainted: [B]=BAD_PAGE
Hardware name: IBM,9043-MRX POWER10 (architected) 0x800200 0xf000006 of:IBM,FW1060.00 (NM1060_028) hv:phyp pSeries
[...]
NIP [c000000000708f88] free_percpu+0x144/0xba8
LR [c000000000708f84] free_percpu+0x140/0xba8
Call Trace:
    free_percpu+0x140/0xba8 (unreliable)
    kyber_exit_hctx+0x94/0x124
    blk_mq_exit_sched+0xe4/0x214
    elevator_exit+0xa8/0xf4
    elevator_switch+0x3b8/0x5d8
    elv_update_nr_hw_queues+0x14c/0x300
    blk_mq_update_nr_hw_queues+0x5cc/0x670
    nullb_update_nr_hw_queues+0x118/0x1f8 [null_blk]
    nullb_device_submit_queues_store+0xac/0x170 [null_blk]
    configfs_write_iter+0x1dc/0x2d0
    vfs_write+0x5b0/0x77c
    ksys_write+0xa0/0x180
    system_call_exception+0x1b0/0x4f0
    system_call_vectored_common+0x15c/0x2ec

If the sbitmap depth is zero, sb->alloc_hint memory is NOT allocated, but
the pointer is not explicitly set to NULL. Later, during sbitmap_free(),
the kernel attempts to free sb->alloc_hint, which is a per cpu pointer
variable, regardless of whether it was valid, leading to a crash.

This patch ensures that sb->alloc_hint is explicitly set to NULL in
sbitmap_init_node() when the requested depth is zero. This prevents
free_percpu() from freeing sb->alloc_hint and thus avoids the observed
crash.

Reviewed-by: Damien Le Moal <dlemoal@kernel.org>
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Nilay Shroff <nilay@linux.ibm.com>
@shroffni @kawasaki
null_blk: fix set->driver_data while setting up tagset
2173de6 
When setting up a null block device, we initialize a tagset that
includes a driver_data field—typically used by block drivers to
store a pointer to driver-specific data. In the case of null_blk,
this should point to the struct nullb instance.

However, due to recent tagset refactoring in the null_blk driver, we
missed initializing driver_data when creating a shared tagset. As a
result, software queues (ctx) fail to map correctly to new hardware
queues (hctx). For example, increasing the number of submit queues
triggers an nr_hw_queues update, which invokes null_map_queues() to
remap queues. Since set->driver_data is unset, null_map_queues()
fails to map any ctx to the new hctxs, leading to hctx->nr_ctx == 0,
effectively making the hardware queues unusable for I/O.

This patch fixes the issue by ensuring that set->driver_data is properly
initialized to point to the struct nullb during tagset setup.

Fixes: 72ca287 ("null_blk: refactor tag_set setup")
Reviewed-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Nilay Shroff <nilay@linux.ibm.com>
@blktests-ci
Copy link
Author

blktests-ci bot commented Aug 15, 2025

Upstream branch: d7ee5bd
series: https://patchwork.kernel.org/project/linux-block/list/?series=984340
version: 1

@blktests-ci blktests-ci bot force-pushed the series/984084=>linus-master branch from 85db7d7 to 2173de6 Compare August 15, 2025 02:46
@blktests-ci blktests-ci bot force-pushed the linus-master_base branch from 38c66a9 to 593e738 Compare August 20, 2025 11:56
@blktests-ci
Copy link
Author

blktests-ci bot commented Aug 20, 2025

Upstream branch: b19a97d
series: https://patchwork.kernel.org/project/linux-block/list/?series=984340
version: 1

@kawasaki kawasaki closed this Aug 23, 2025
@blktests-ci blktests-ci bot deleted the series/984084=>linus-master branch August 31, 2025 02:51
blktests-ci bot pushed a commit that referenced this pull request Sep 6, 2025
netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in…
479a54a 
…() after confirm

When send a broadcast packet to a tap device, which was added to a bridge,
br_nf_local_in() is called to confirm the conntrack. If another conntrack
with the same hash value is added to the hash table, which can be
triggered by a normal packet to a non-bridge device, the below warning
may happen.

  ------------[ cut here ]------------
  WARNING: CPU: 1 PID: 96 at net/bridge/br_netfilter_hooks.c:632 br_nf_local_in+0x168/0x200
  CPU: 1 UID: 0 PID: 96 Comm: tap_send Not tainted 6.17.0-rc2-dirty #44 PREEMPT(voluntary)
  RIP: 0010:br_nf_local_in+0x168/0x200
  Call Trace:
   <TASK>
   nf_hook_slow+0x3e/0xf0
   br_pass_frame_up+0x103/0x180
   br_handle_frame_finish+0x2de/0x5b0
   br_nf_hook_thresh+0xc0/0x120
   br_nf_pre_routing_finish+0x168/0x3a0
   br_nf_pre_routing+0x237/0x5e0
   br_handle_frame+0x1ec/0x3c0
   __netif_receive_skb_core+0x225/0x1210
   __netif_receive_skb_one_core+0x37/0xa0
   netif_receive_skb+0x36/0x160
   tun_get_user+0xa54/0x10c0
   tun_chr_write_iter+0x65/0xb0
   vfs_write+0x305/0x410
   ksys_write+0x60/0xd0
   do_syscall_64+0xa4/0x260
   entry_SYSCALL_64_after_hwframe+0x77/0x7f
   </TASK>
  ---[ end trace 0000000000000000 ]---

To solve the hash conflict, nf_ct_resolve_clash() try to merge the
conntracks, and update skb->_nfct. However, br_nf_local_in() still use the
old ct from local variable 'nfct' after confirm(), which leads to this
warning.

If confirm() does not insert the conntrack entry and return NF_DROP, the
warning may also occur. There is no need to reserve the WARN_ON_ONCE, just
remove it.

Link: https://lore.kernel.org/netdev/20250820043329.2902014-1-wangliang74@huawei.com/
Fixes: 62e7151 ("netfilter: bridge: confirm multicast packets before passing them up the stack")
Suggested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Wang Liang <wangliang74@huawei.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

linus-master new V1-ci-pass V1

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@kawasaki @shroffni