zio: free the gang header ABD when its read fails
zio_gang_tree_assemble() wraps the gang header buffer in an ABD with
abd_get_from_buf(). zio_gang_tree_assemble_done() frees it, but only
when the read succeeded: on an error it returns first and the abd_t is
never freed. Each failed gang header read, whether from a checksum
or an I/O error, leaks one.
A pool whose MOS has large gang headers that can not be read while
the pool is loading (#19189) shows it. On a debug kernel, the failed
imports of such a pool left six abd_t objects behind and "rmmod zfs"
then panicked on
VERIFY3U(percpu_counter_sum(&skc->skc_linux_alloc), ==, 0). valgrind
on a failed "zdb -e" of the same kind of pool reports the abd_t
allocated by abd_get_from_buf() in zio_gang_tree_assemble() as
definitely lost.
Free the ABD on the error path as well. Nothing else owns it: the
gang tree only frees the header buffer, and the other gang callbacks
[5 lines not shown]
[lldb-dap] Return raw stop info from exceptionInfo (#231760)
lldb-dap folds the thread's extended stop info and the process's
extended crash information into the exceptionInfo description as
formatted text. Clients that want interpret these themselves currently
have to parse them back out.
Return both as raw JSON in two new lldb-dap extension fields,
`$__lldb_stopReasonExtendedInfo` and `$__lldb_extendedCrashInformation`.
rdar://188761988
[Clang][counted_by] Load the count through unions by byte offset (#228309)
`getGEPIndicesToField()` indexed into a union with 0 and kept walking the
counter's struct field numbers, but the union's IR type is its largest
member, so the count was loaded from inside that member instead.
In Linux, `landlock_domain` hits this and FORTIFY panics on every nested
`landlock_restrict_self()` on kernel 7.3.0-rc5-next as of this writing.
I ran into this bug when trying to daily drive the aforementioned
kernel.
Below is a reduced version of `landlock_domain`. The `work` member
stands in for the kernel's `struct work_struct`, which is larger than the
anonymous struct holding the count, so it becomes the union's IR type.
```c
struct dom {
void *rules[3];
[18 lines not shown]
[WebAssembly] Preserve tail-call pseudos during stack-protector splitting (#230073)
WebAssembly tail calls use a parameter/result pseudo-instruction pair
that is combined during FinalizeISel. Before that, stack-protector
insertion looks for the first terminator so it can move the terminating
sequence into the success block. The tail-call pseudos lack those flags,
causing an assertion in findSplitPointForStackProtector.
This reproduces with an assertions-enabled build:
```llvm
declare i32 @callee(i32)
define i32 @caller(i32 %x) sspreq {
%r = tail call i32 @callee(i32 %x)
ret i32 %r
}
```
```sh
[15 lines not shown]
[scudo] Re-check freelist before populating blocks in popBlocksWithCV (#231750)
In popBlocksWithCV, the region freelist may become non-empty before the
thread calls populateFreeListAndPopBlocks. This can happen in two
scenarios:
1. Another thread may push blocks or finish
populateFreeListAndPopBlocks() in the window between releasing FLLock in
popBlocks() and reacquiring it in popBlocksWithCV().
2. releaseToOSMaybe() holds MMLock while temporarily extracting
GroupsToRelease with FLLock unlocked, and merges those groups back into
BlockList before releasing MMLock.
When this does happen, popBlocksWithCV unconditionally calls
populateFreeListAndPopBlocks, permanently growing the region mapping and
BatchClassId freelist metadata.
The fix here is to re-check popBlocksImpl() under FLLock before setting
[5 lines not shown]
[lld][MachO] Don't create thunkMap entries for branches without a thunk (#231594)
This is part of the ld64.lld performance improvements tracked by
#222068.
TextOutputSection::finalize() created a thunkInfo for every thunkMap
entry found using []. However, the DenseMap::operator[] inserts an empty
default constructed entry whenever the key is not in thunkMap.
This led to millions of unnecessary empty entries. This change adds a
TextOutputSection::findThunkInRange that first uses find() to check if
the thunk exists.
It then calls getThunkInRange(), so the reads in finalize() still
function the same, just without adding a default entry that counted as a
cache miss anyways.
This commit is output preserving.
ZIL: zero the header bp in zil_crash() only if lwbs own it
zil_crash() zeroes the syncing header's zh_log because the lwbs it
takes over include the block zh_log points to, and zil_clean() frees
them. When it takes no lwbs, nothing frees that block. Since 5d1ed14b3
zil_create() can crash the ZIL before it has an lwb, while it waits for
a pending zil_destroy(). zil_replay() does a keep_first destroy at
every mount of a file system whose ZIL needs no replay, and the
destroy's sync keeps the block that zh_log points to at that time:
after the zeroing, none. The pool then leaks the kept log block, which
zdb -b reports after the pool resumes.
Leave zh_log alone when there are no lwbs to free. The header still
owns the block, and the next zil_create() reuses it.
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Signed-off-by: Will Rouesnel <wrouesnel at wrouesnel.com>
Closes #19320
ZTS: suspend the pool while zil_create() waits for a destroy
zil_replay() at mount destroys a ZIL that needs no replay but keeps its
first log block, which the header still points to until the destroy
syncs. If the pool suspends while an fsync() waits in zil_create() for
that txg, zil_crash() zeroes the header and the kept block is never
freed. Mount with txgs held back, pull the disk under an fsync(), and
check with zdb that no space leaked after the pool resumes.
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Signed-off-by: Will Rouesnel <wrouesnel at wrouesnel.com>
Closes #19320
[sanitizer_common] Implement address sanitizer on AIX: process memory mapping (#138537)
Implement process memory mapping on AIX using `sys/procfs.h`. We don't
have direct access to the full path in the case of user libraries or
executables, so we use the path `/proc/<pid>/object/<object_id>` for
now.
Issue: https://github.com/llvm/llvm-project/issues/138916
---------
Co-authored-by: Midhunesh <midhunesh.p at ibm.com>
zdb: print TX_SETSAXATTR values as text
zil_prt_rec_setsaxattr() printed each byte of an xattr value with
"%c" and no trailing newline. Values often contain non-printable
bytes; SELinux labels end in a NUL. So "zdb -ivvvvv" output had NUL
bytes in it (GNU grep then treats it as binary and stops printing
matches) and the next line was glued onto the XAT_VALUE line.
Move the value printing from dump_znode_sa_xattr() into a helper,
dump_xattr_value(), and use it for TX_SETSAXATTR records too, followed
by a newline. As before for SA xattrs, a value is printed as is if
every byte is printable; otherwise, or with -P, every byte is printed
as an octal \ooo escape. "zdb -dddd" output is unchanged.
Add zdb_il_saxattr to check this.
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Signed-off-by: Matthew Ahrens <matt at mahrens.org>
Co-authored-by: Claude Opus 5.5 <noreply at anthropic.com>
Closes #19361
CI: Reuse successful QEMU jobs from forks
Find completed push runs for the exact PR head SHA and reuse successful
per-OS QEMU jobs from the source fork. Preserve upstream check names and
link to the original logs, while running missing results normally.
Require successful build, test and summary steps, and limit results to
completed runs from the last seven days. Reuse is available for all
forks without additional repository configuration. CI file comparison
is deferred so the introducing PR can exercise reuse.
Reviewed-by: Brian Behlendorf <behlendorf1 at llnl.gov>
Reviewed-by: Tony Hutter <hutter2 at llnl.gov>
Signed-off-by: George Melikov <mail at gmelikov.ru>
Closes #19394
[CIR] Move records through memory in x86_64 call lowering (#231663)
CIR lowers a union to its storage type, so moving one as an SSA value
can drop bytes. An x86_fp80 member stores only 10 of its 16 bytes, for
example. The calling-convention rewriter now passes records through
memory at every coercion site, the way classic CodeGen does. That lets
us drop the union check #230302 added, which broke std::format.
Assisted-by: Cursor / Claude Opus 5.5
[AArch64] Add pre-commit tests for SVE AND-NOT folding
Add pre-commit tests demonstrating missed BIC selection for SVE AND-NOT
operations. Record the current NOT plus AND sequences for all-active and
undefined NOT results, and for intrinsic pairs with matching predicates.
Cover merging inactive lanes, commuted operands, all integer element
widths, and multiple uses of NOT. Include negative cases where folding
would change defined inactive lanes.
Both test files pass with SVE, SVE2p2, and streaming SME, with machine
instruction verification enabled.
[AArch64] Combine SVE AND-NOT operations into BIC
Fold a scalable-vector AND of an SVE NOT into BIC when the NOT predicate
is all-active or its inactive lanes are undefined.
Also fold SVE AND-NOT intrinsic pairs with matching predicates before
lowering discards the AND predicate. The NOT passthru is irrelevant in
the active lanes, allowing defined passthru values to fold as well.
Preserve the first operand's inactive lanes for merging AND, and only
commute the undef form. Keep standalone NOTs available for predicated
instruction selection.
Update the pre-commit tests to show BIC replacing NOT plus AND, while
retaining the negative cases. Both test files pass with SVE, SVE2p2, and
streaming SME, with machine instruction verification enabled.
[RISCV][P-ext] Use ISD::AVGSUBFLOOR(S/U) for (p)asub(u).
This replaces RISCVISD::ASUB(U) with ISD::AVGSUBFLOOR(S/U).
Co-Authored-By: Claude Sonnet 5.5 <noreply at anthropic.com>
