{"push_id":2445813974,"size":2,"distinct_size":2,"ref":"refs/heads/master","head":"042ef8adc97581e304aa1acf61f3c22e2c65e792","before":"826528064b82ffd7a528360b07c34d83b70f6b48","commits":[{"sha":"8a3b58a3cf1adf7391d16e8e54156afc1596ee92","author":{"name":"Jens Axboe","email":"f8b120bbe297304053fa957b507156696820d130@fb.com"},"message":"blk-mq: update hardware and software queues for sleeping alloc\n\nIf we end up sleeping due to running out of requests, we should\nupdate the hardware and software queues in the map ctx structure.\nOtherwise we could end up having rq->mq_ctx point to the pre-sleep\ncontext, and risk corrupting ctx->rq_list since we'll be\ngrabbing the wrong lock when inserting the request.\n\nReported-by: Dave Jones <davej@codemonkey.org.uk>\nReported-by: Chris Mason <clm@fb.com>\nTested-by: Chris Mason <clm@fb.com>\nFixes: 63581af3f31e (\"blk-mq: remove non-blocking pass in blk_mq_map_request\")\nSigned-off-by: Jens Axboe <axboe@fb.com>\nSigned-off-by: Francisco Franco <franciscofranco.1990@gmail.com>\nSigned-off-by: Michele Beccalossi <beccalossi.michele@gmail.com>","distinct":true,"url":"https://api.github.com/repos/mawrick26/S7E-N6/commits/8a3b58a3cf1adf7391d16e8e54156afc1596ee92"},{"sha":"042ef8adc97581e304aa1acf61f3c22e2c65e792","author":{"name":"Linus Torvalds","email":"ead7104581934751970e9decb2db5deb20a9e407@linux-foundation.org"},"message":"shmem: fix shm fallocate() list corruption\n\nThe shmem hole punching with fallocate(FALLOC_FL_PUNCH_HOLE) does not\nwant to race with generating new pages by faulting them in.\n\nHowever, the wait-queue used to delay the page faulting has a serious\nproblem: the wait queue head (in shmem_fallocate()) is allocated on the\nstack, and the code expects that \"wake_up_all()\" will make sure that all\nthe queue entries are gone before the stack frame is de-allocated.\n\nAnd that is not at all necessarily the case.\n\nYes, a normal wake-up sequence will remove the wait-queue entry that\ncaused the wakeup (see \"autoremove_wake_function()\"), but the key\nwording there is \"that caused the wakeup\".  When there are multiple\npossible wakeup sources, the wait queue entry may well stay around.\n\nAnd _particularly_ in a page fault path, we may be faulting in new pages\nfrom user space while we also have other things going on, and there may\nwell be other pending wakeups.\n\nSo despite the \"wake_up_all()\", it's not at all guaranteed that all list\nentries are removed from the wait queue head on the stack.\n\nFix this by introducing a new wakeup function that removes the list\nentry unconditionally, even if the target process had already woken up\nfor other reasons.  Use that \"synchronous\" function to set up the\nwaiters in shmem_fault().\n\nThis problem has never been seen in the wild afaik, but Dave Jones has\nreported it on and off while running trinity.  We thought we fixed the\nstack corruption with the blk-mq rq_list locking fix (commit\n7fe311302f7d: \"blk-mq: update hardware and software queues for sleeping\nalloc\"), but it turns out there was _another_ stack corruptor hiding\nin the trinity runs.\n\nVegard Nossum (also running trinity) was able to trigger this one fairly\nconsistently, and made us look once again at the shmem code due to the\nfaults often being in that area.\n\nChange-Id: I9b8e00b36bbbcb8a5bf9586fff65e9f6727f258e\nReported-and-tested-by: Vegard Nossum <vegard.nossum@oracle.com>.\nReported-by: Dave Jones <davej@codemonkey.org.uk>\nSigned-off-by: Linus Torvalds <torvalds@linux-foundation.org>","distinct":true,"url":"https://api.github.com/repos/mawrick26/S7E-N6/commits/042ef8adc97581e304aa1acf61f3c22e2c65e792"}]}
{"actor":{"display_login":"mawrick26"}}