October 2020 - Kernel - mailweb.openeuler.org

perf spe-c2c record失败的问题
by haoxin 15 Dec '21

15 Dec '21

您好，我采用最细的openEuler-1.0测试perf spe-c2c的功能，但是发现/sys/devices下没有arm_spe_0这个目录执行perf spe-c2c record时显示： event syntax error: 'arm_spe_0/ts_enable=1,pct_enable=1,pa_enable=1,load_filter=1,jitter=1,store_filter=1,min_latency=0/' \___ Cannot find PMU `arm_spe_0'. Missing kernel support? 想问下您这是为什么？需要哪里开启spe功能吗？

3 2

[PATCH 000/145] backport stable-4.19.153
by Yang Yingliang 30 Oct '20

30 Oct '20

Alex Dewar (1): VMCI: check return value of get_user_pages_fast() for errors Arnd Bergmann (1): mtd: lpddr: fix excessive stack usage with clang Artem Savkov (1): pty: do tty_flip_buffer_push without port->lock in pty_write Arvind Sankar (1): x86/fpu: Allow multiple bits in clearcpuid= parameter Bryan O'Donoghue (1): wcn36xx: Fix reported 802.11n rx_highest rate wcn3660/wcn3680 Christophe JAILLET (5): crypto: ixp4xx - Fix the size used in a 'dma_free_coherent()' call ath10k: Fix the size used in a 'dma_free_coherent()' call in an error handling path mwifiex: Do not use GFP_KERNEL in atomic context staging: rtl8192u: Do not use GFP_KERNEL in atomic context scsi: qla4xxx: Fix an error handling path in 'qla4xxx_get_host_stats()' Colin Ian King (3): x86/events/amd/iommu: Fix sizeof mismatch video: fbdev: vga16fb: fix setting of pixclock because a pass-by-value error qtnfmac: fix resource leaks on unsupported iftype error return path Cong Wang (1): tipc: fix the skb_unshare() in tipc_buf_append() Dan Carpenter (8): ALSA: bebob: potential info leak in hwdep_read() cifs: remove bogus debug code ath6kl: prevent potential array overflow in ath6kl_add_new_sta() ath9k: Fix potential out of bounds in ath9k_htc_txcompletion_cb() HID: roccat: add bounds checking in kone_sysfs_write_settings() ath6kl: wmi: prevent a shift wrapping bug in ath6kl_wmi_delete_pstream_cmd() mfd: sm501: Fix leaks in probe() scsi: be2iscsi: Fix a theoretical leak in beiscsi_create_eqs() Darrick J. Wong (2): xfs: limit entries returned when counting fsmap records xfs: fix high key handling in the rt allocator's query_range function David Ahern (1): ipv4: Restore flowi4_oif update before call to xfrm_lookup_route David Wilder (2): ibmveth: Switch order of ibmveth_helper calls. ibmveth: Identify ingress large send packets. Davide Caratti (1): net/sched: act_tunnel_key: fix OOB write in case of IPv6 ERSPAN tunnels Defang Bo (1): nfc: Ensure presence of NFC_ATTR_FIRMWARE_NAME attribute in nfc_genl_fw_download() Dinghao Liu (4): EDAC/i5100: Fix error handling order in i5100_init_one() media: omap3isp: Fix memleak in isp_probe media: mx2_emmaprp: Fix memleak in emmaprp_probe video: fbdev: radeon: Fix memleak in radeonfb_pci_register Dmitry Torokhov (1): HID: hid-input: fix stylus battery reporting Emmanuel Grumbach (1): iwlwifi: mvm: split a print to avoid a WARNING in ROC Eran Ben Elisha (1): net/mlx5: Don't call timecounter cyc2time directly from 1PPS flow Eric Dumazet (2): icmp: randomize the global rate limiter quota: clear padding in v2r1_mem2diskdqb() Finn Thain (3): powerpc/tau: Use appropriate temperature sample interval powerpc/tau: Convert from timer to workqueue powerpc/tau: Remove duplicated set_thresholds() call Greg Kroah-Hartman (1): Linux 4.19.153 Guenter Roeck (1): hwmon: (pmbus/max34440) Fix status register reads for MAX344{51,60,61} Guillaume Tucker (1): ARM: 9007/1: l2c: fix prefetch bits init in L2X0_AUX_CTRL using DT values Hans de Goede (2): pwm: lpss: Fix off by one error in base_unit math in pwm_lpss_prepare() pwm: lpss: Add range limit check for the base_unit register value Heiner Kallweit (2): r8169: fix data corruption issue on RTL8402 r8169: fix operation under forced interrupt threading Herbert Xu (2): crypto: algif_aead - Do not set MAY_BACKLOG on the async path crypto: algif_skcipher - EBUSY on aio should be an error Håkon Bugge (2): IB/mlx4: Fix starvation in paravirt mux/demux IB/mlx4: Adjust delayed work when a dup is observed Jason Gunthorpe (2): RDMA/ucma: Fix locking for ctx->events_reported RDMA/ucma: Add missing locking around rdma_leave_multicast() Jian-Hong Pan (1): ALSA: hda/realtek: Enable audio jacks of ASUS D700SA with ALC887 Johannes Berg (1): nl80211: fix non-split wiphy information John Donnelly (1): scsi: target: tcmu: Fix warning: 'page' may be used uninitialized Jonathan Lemon (1): mlx4: handle non-napi callers to napi_poll Julian Anastasov (1): ipvs: clear skb->tstamp in forwarding path Karsten Graul (1): net/smc: fix valid DMBE buffer sizes Krzysztof Kozlowski (1): EDAC/ti: Fix handling of platform_get_irq() error Laurent Pinchart (2): media: uvcvideo: Set media controller entity functions media: uvcvideo: Silence shift-out-of-bounds warning Libing Zhou (1): x86/nmi: Fix nmi_handle() duration miscalculation Linus Walleij (4): net: dsa: rtl8366: Check validity of passed VLANs net: dsa: rtl8366: Refactor VLAN/PVID init net: dsa: rtl8366: Skip PVID setting if not requested net: dsa: rtl8366rb: Support all 4096 VLANs Lorenzo Colitti (2): usb: gadget: f_ncm: fix ncm_bitrate for SuperSpeed and above. usb: gadget: u_ether: enable qmult on SuperSpeed Plus as well Maciej Żenczykowski (1): net/ipv4: always honour route mtu during forwarding Madhuparna Bhowmik (1): crypto: picoxcell - Fix potential race condition bug Marek Vasut (2): net: fec: Fix phy_device lookup for phy_reset_after_clk_enable() net: fec: Fix PHY init after phy_reset_after_clk_enable() Mark Salter (1): drivers/perf: xgene_pmu: Fix uninitialized resource struct Mark Tomlinson (1): mtd: mtdoops: Don't write panic data twice Michal Kalderon (2): RDMA/qedr: Fix use of uninitialized field RDMA/qedr: Fix inline size returned for iWARP Michał Mirosław (1): regulator: resolve supply after creating regulator Minas Harutyunyan (1): usb: dwc2: Fix INTR OUT transfers in DDMA mode. Nathan Chancellor (1): usb: dwc2: Fix parameter type in function pointer prototype Nathan Lynch (1): powerpc/pseries: explicitly reschedule during drmem_lmb list traversal Neal Cardwell (1): tcp: fix to update snd_wl1 in bulk receiver fast path Necip Fazil Yildiran (2): pinctrl: bcm: fix kconfig dependency warning when !GPIOLIB arc: plat-hsdk: fix kconfig dependency warning when !RESET_CONTROLLER Nicholas Mc Guire (2): powerpc/pseries: Fix missing of_node_put() in rng_init() powerpc/icp-hv: Fix missing of_node_put() in success path Ong Boon Leong (1): net: stmmac: use netif_tx_start|stop_all_queues() function Pablo Neira Ayuso (1): netfilter: nf_log: missing vlan offload tag and proto Pali Rohár (1): cpufreq: armada-37xx: Add missing MODULE_DEVICE_TABLE Qiushi Wu (7): media: rcar-vin: Fix a reference count leak. media: rockchip/rga: Fix a reference count leak. media: platform: fcp: Fix a reference count leak. media: camss: Fix a reference count leak. media: s5p-mfc: Fix a reference count leak media: stm32-dcmi: Fix a reference count leak media: ti-vpe: Fix a missing check and reference count leak Ralph Campbell (1): mm/memcg: fix device private memcg accounting Rohit Maheshwari (1): net/tls: sendfile fails with ktls offload Rohit kumar (2): ASoC: qcom: lpass-platform: fix memory leak ASoC: qcom: lpass-cpu: fix concurrency issue Samuel Holland (1): Bluetooth: hci_uart: Cancel init work before unregistering Sean Christopherson (1): KVM: x86/mmu: Commit zap of remaining invalid pages when recovering lpages Shyam Prasad N (1): cifs: Return the error from crypt_message when enc/dec key not found. Souptick Joarder (2): drivers/virt/fsl_hypervisor: Fix error handling path misc: mic: scif: Fix error handling path Srinivas Kandagatla (3): slimbus: core: check get_addr before removing laddr ida slimbus: core: do not enter to clock pause mode in core slimbus: qcom-ngd-ctrl: disable ngd in qmi server down callback Suravee Suthikulpanit (1): KVM: SVM: Initialize prev_ga_tag before use Suren Baghdasaryan (1): mm, oom_adj: don't loop through tasks in __set_oom_adj when not necessary Sylwester Nawrocki (1): media: Revert "media: exynos4-is: Add missed check for pinctrl_lookup_state()" Takashi Iwai (1): ALSA: seq: oss: Avoid mutex lock for a long-time ioctl Tero Kristo (1): crypto: omap-sham - fix digcnt register handling with export/import Thomas Gleixner (1): net: enic: Cure the enic api locking trainwreck Thomas Preston (2): pinctrl: mcp23s08: Fix mcp23x17_regmap initialiser pinctrl: mcp23s08: Fix mcp23x17 precious range Tianjia Zhang (3): crypto: mediatek - Fix wrong return value in mtk_desc_ring_alloc() scsi: qla2xxx: Fix wrong return value in qla_nvme_register_hba() scsi: csiostor: Fix wrong return value in csio_hw_prep_fw() Todd Kjos (1): binder: fix UAF when releasing todo list Tom Rix (8): media: tuner-simple: fix regression in simple_set_radio_freq media: m5mols: Check function pointer in m5mols_sensor_power media: tc358743: initialize variable media: tc358743: cleanup tc358743_cec_isr brcmfmac: check ndev pointer drm/gma500: fix error check video: fbdev: sis: fix null ptr dereference mwifiex: fix double free Tong Zhang (1): tty: serial: earlycon dependency Tyrel Datwyler (1): tty: hvcs: Don't NULL tty->driver_data until hvcs_cleanup() Vadim Pasternak (1): platform/x86: mlx-platform: Remove PSU EEPROM configuration Valentin Vidic (1): net: korina: fix kfree of rx/tx descriptor array Venkateswara Naralasetty (1): ath10k: provide survey info as accumulated data Vinay Kumar Yadav (3): chelsio/chtls: fix socket lock chelsio/chtls: correct netdevice for vlan interface chelsio/chtls: correct function return and return type Wilken Gottwalt (1): net: usb: qmi_wwan: add Cellient MPL200 card Xiaoliang Pang (1): cypto: mediatek - fix leaks in mtk_desc_ring_alloc Xie He (2): net: hdlc: In hdlc_rcv, check to make sure dev is an HDLC device net: hdlc_raw_eth: Clear the IFF_TX_SKB_SHARING flag after calling ether_setup Yonghong Song (1): net: fix pos incrementment in ipv6_route_seq_next dinghao.liu(a)zju.edu.cn (1): backlight: sky81452-backlight: Fix refcount imbalance on error Łukasz Stelmach (2): spi: spi-s3c64xx: swap s3c64xx_spi_set_cs() and s3c64xx_enable_datapath() spi: spi-s3c64xx: Check return values .../admin-guide/kernel-parameters.txt | 2 +- Documentation/networking/ip-sysctl.txt | 4 +- Makefile | 2 +- arch/arc/plat-hsdk/Kconfig | 1 + arch/arm/mm/cache-l2x0.c | 16 +- arch/powerpc/include/asm/drmem.h | 18 +- arch/powerpc/include/asm/reg.h | 2 +- arch/powerpc/kernel/tau_6xx.c | 55 ++-- arch/powerpc/platforms/pseries/rng.c | 1 + arch/powerpc/sysdev/xics/icp-hv.c | 1 + arch/x86/events/amd/iommu.c | 2 +- arch/x86/kernel/fpu/init.c | 30 +- arch/x86/kernel/nmi.c | 5 +- arch/x86/kvm/mmu.c | 1 + arch/x86/kvm/svm.c | 1 + crypto/algif_aead.c | 7 +- crypto/algif_skcipher.c | 2 +- drivers/android/binder.c | 35 +-- drivers/bluetooth/hci_ldisc.c | 1 + drivers/bluetooth/hci_serdev.c | 2 + drivers/cpufreq/armada-37xx-cpufreq.c | 6 + drivers/crypto/chelsio/chtls/chtls_cm.c | 3 + drivers/crypto/chelsio/chtls/chtls_io.c | 5 +- drivers/crypto/ixp4xx_crypto.c | 2 +- drivers/crypto/mediatek/mtk-platform.c | 8 +- drivers/crypto/omap-sham.c | 3 + drivers/crypto/picoxcell_crypto.c | 9 +- drivers/edac/i5100_edac.c | 11 +- drivers/edac/ti_edac.c | 3 +- drivers/gpu/drm/gma500/cdv_intel_dp.c | 2 +- drivers/hid/hid-input.c | 4 +- drivers/hid/hid-roccat-kone.c | 23 +- drivers/hwmon/pmbus/max34440.c | 3 - drivers/infiniband/core/ucma.c | 6 +- drivers/infiniband/hw/mlx4/cm.c | 3 + drivers/infiniband/hw/mlx4/mad.c | 34 ++- drivers/infiniband/hw/mlx4/mlx4_ib.h | 2 + drivers/infiniband/hw/qedr/main.c | 2 +- drivers/infiniband/hw/qedr/verbs.c | 2 +- drivers/media/i2c/m5mols/m5mols_core.c | 3 +- drivers/media/i2c/tc358743.c | 14 +- drivers/media/platform/exynos4-is/media-dev.c | 4 +- drivers/media/platform/mx2_emmaprp.c | 7 +- drivers/media/platform/omap3isp/isp.c | 6 +- .../media/platform/qcom/camss/camss-csiphy.c | 4 +- drivers/media/platform/rcar-fcp.c | 4 +- drivers/media/platform/rcar-vin/rcar-dma.c | 4 +- drivers/media/platform/rockchip/rga/rga-buf.c | 1 + drivers/media/platform/s5p-mfc/s5p_mfc_pm.c | 4 +- drivers/media/platform/stm32/stm32-dcmi.c | 4 +- drivers/media/platform/ti-vpe/vpe.c | 2 + drivers/media/tuners/tuner-simple.c | 5 +- drivers/media/usb/uvc/uvc_ctrl.c | 6 +- drivers/media/usb/uvc/uvc_entity.c | 35 +++ drivers/mfd/sm501.c | 8 +- drivers/misc/mic/scif/scif_rma.c | 4 +- drivers/misc/vmw_vmci/vmci_queue_pair.c | 10 +- drivers/mtd/lpddr/lpddr2_nvm.c | 35 ++- drivers/mtd/mtdoops.c | 11 +- drivers/net/dsa/realtek-smi.h | 4 +- drivers/net/dsa/rtl8366.c | 280 ++++++++++-------- drivers/net/dsa/rtl8366rb.c | 2 +- drivers/net/ethernet/cisco/enic/enic.h | 1 + drivers/net/ethernet/cisco/enic/enic_api.c | 6 + drivers/net/ethernet/cisco/enic/enic_main.c | 27 +- drivers/net/ethernet/freescale/fec_main.c | 35 ++- drivers/net/ethernet/ibm/ibmveth.c | 19 +- drivers/net/ethernet/korina.c | 3 +- drivers/net/ethernet/mellanox/mlx4/en_rx.c | 3 + drivers/net/ethernet/mellanox/mlx4/en_tx.c | 2 +- .../ethernet/mellanox/mlx5/core/lib/clock.c | 5 +- drivers/net/ethernet/realtek/r8169.c | 54 ++-- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 33 +-- drivers/net/usb/qmi_wwan.c | 1 + drivers/net/wan/hdlc.c | 10 +- drivers/net/wan/hdlc_raw_eth.c | 1 + drivers/net/wireless/ath/ath10k/ce.c | 2 +- drivers/net/wireless/ath/ath10k/mac.c | 2 +- drivers/net/wireless/ath/ath6kl/main.c | 3 + drivers/net/wireless/ath/ath6kl/wmi.c | 5 + drivers/net/wireless/ath/ath9k/htc_hst.c | 2 + drivers/net/wireless/ath/wcn36xx/main.c | 2 +- .../broadcom/brcm80211/brcmfmac/core.c | 2 +- .../net/wireless/intel/iwlwifi/mvm/mac80211.c | 9 +- drivers/net/wireless/marvell/mwifiex/scan.c | 2 +- drivers/net/wireless/marvell/mwifiex/sdio.c | 2 + .../net/wireless/quantenna/qtnfmac/commands.c | 2 + drivers/perf/xgene_pmu.c | 32 +- drivers/pinctrl/bcm/Kconfig | 1 + drivers/pinctrl/pinctrl-mcp23s08.c | 24 +- drivers/platform/x86/mlx-platform.c | 15 +- drivers/pwm/pwm-lpss.c | 7 +- drivers/regulator/core.c | 21 +- drivers/scsi/be2iscsi/be_main.c | 4 +- drivers/scsi/csiostor/csio_hw.c | 2 +- drivers/scsi/qla2xxx/qla_nvme.c | 2 +- drivers/scsi/qla4xxx/ql4_os.c | 2 +- drivers/slimbus/core.c | 6 +- drivers/slimbus/qcom-ngd-ctrl.c | 4 + drivers/spi/spi-s3c64xx.c | 52 +++- .../staging/rtl8192u/ieee80211/ieee80211_rx.c | 2 +- drivers/target/target_core_user.c | 2 +- drivers/tty/hvc/hvcs.c | 14 +- drivers/tty/pty.c | 2 +- drivers/tty/serial/Kconfig | 1 + drivers/usb/dwc2/gadget.c | 40 ++- drivers/usb/dwc2/params.c | 2 +- drivers/usb/gadget/function/f_ncm.c | 6 +- drivers/usb/gadget/function/u_ether.c | 2 +- drivers/video/backlight/sky81452-backlight.c | 1 + drivers/video/fbdev/aty/radeon_base.c | 2 +- drivers/video/fbdev/sis/init.c | 11 +- drivers/video/fbdev/vga16fb.c | 14 +- drivers/virt/fsl_hypervisor.c | 17 +- fs/cifs/asn1.c | 16 +- fs/cifs/smb2ops.c | 2 +- fs/proc/base.c | 3 +- fs/quota/quota_v2.c | 1 + fs/xfs/libxfs/xfs_rtbitmap.c | 11 +- fs/xfs/xfs_fsmap.c | 3 + include/linux/oom.h | 1 + include/linux/sched/coredump.h | 1 + include/net/ip.h | 6 + include/net/netfilter/nf_log.h | 1 + kernel/fork.c | 21 ++ mm/memcontrol.c | 5 +- mm/oom_kill.c | 2 + net/ipv4/icmp.c | 7 +- net/ipv4/netfilter/nf_log_arp.c | 19 +- net/ipv4/netfilter/nf_log_ipv4.c | 6 +- net/ipv4/route.c | 4 +- net/ipv4/tcp_input.c | 2 + net/ipv6/ip6_fib.c | 4 +- net/ipv6/netfilter/nf_log_ipv6.c | 8 +- net/netfilter/ipvs/ip_vs_xmit.c | 6 + net/netfilter/nf_log_common.c | 12 + net/nfc/netlink.c | 2 +- net/sched/act_tunnel_key.c | 2 +- net/smc/smc_core.c | 2 +- net/tipc/msg.c | 3 +- net/tls/tls_device.c | 11 +- net/wireless/nl80211.c | 5 +- sound/core/seq/oss/seq_oss.c | 7 +- sound/firewire/bebob/bebob_hwdep.c | 3 +- sound/pci/hda/patch_realtek.c | 42 +++ sound/soc/qcom/lpass-cpu.c | 16 - sound/soc/qcom/lpass-platform.c | 3 +- 147 files changed, 968 insertions(+), 566 deletions(-) -- 2.25.1

1 145

openEuler 21.03 5.10 kernel defconfig review
by Xie XiuQi 30 Oct '20

30 Oct '20

openEuler 21.03 5.10 kernel defconfig 基于 openEuler 20.09 适配而来，请大家评审。有问题可以在下面 issue 中讨论： https://gitee.com/openeuler/kernel/issues/I22VGE

1 1

本次 kernel sig 例会无议题，本次会议取消，欢迎积极申报议题
by Xie XiuQi 29 Oct '20

29 Oct '20

本次 kernel sig 例会无议题，本次会议取消，欢迎积极申报议题

1 0

[PATCH openEuler-1.0-LTS 0/5] kvm: arm64: emulate ID registers
by Yang Yingliang 29 Oct '20

29 Oct '20

In AArch64, guest will read the same values of the ID regsiters with host. Both of them read the values from arm64_ftr_regs. This patch series add support to emulate and configure ID registers so that we can control the value of ID registers that guest read. Peng Liang (5): arm64: add a helper function to traverse arm64_ftr_regs kvm: arm64: emulate the ID registers kvm: arm64: make ID registers configurable kvm: arm64: add KVM_CAP_ARM_CPU_FEATURE extension kvm: fix compile error when including linux/kvm.h arch/arm64/include/asm/cpufeature.h | 2 + arch/arm64/include/asm/kvm_host.h | 2 + arch/arm64/kernel/cpufeature.c | 13 ++++++ arch/arm64/kvm/sys_regs.c | 71 ++++++++++++++++++++++------- include/uapi/linux/kvm.h | 13 ++++++ virt/kvm/arm/arm.c | 23 ++++++++++ 6 files changed, 107 insertions(+), 17 deletions(-) -- 2.25.1

1 5

[PATCH 1/5] khugepaged: do not stop collapse if less than half PTEs are referenced
by Yang Yingliang 29 Oct '20

29 Oct '20

From: "Kirill A. Shutemov" <kirill.shutemov(a)linux.intel.com> mainline inclusion from mainline-v5.8-rc1 commit ffe945e633b527d5a4577b42cbadec3c7cbcf096 category: bugfix bugzilla: 36230 CVE: NA ------------------------------------------------- __collapse_huge_page_swapin() checks the number of referenced PTE to decide if the memory range is hot enough to justify swapin. We have few problems with the approach: - It is way too late: we can do the check much earlier and safe time. khugepaged_scan_pmd() already knows if we have any pages to swap in and number of referenced page. - It stops collapse altogether if there's not enough referenced pages, not only swappingin. Fix it by making the right check early. We also can avoid additional page table scanning if khugepaged_scan_pmd() haven't found any swap entries. Fixes: 0db501f7a34c ("mm, thp: convert from optimistic swapin collapsing to conservative") Signed-off-by: Kirill A. Shutemov <kirill.shutemov(a)linux.intel.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Tested-by: Zi Yan <ziy(a)nvidia.com> Reviewed-by: William Kucharski <william.kucharski(a)oracle.com> Reviewed-by: Zi Yan <ziy(a)nvidia.com> Acked-by: Yang Shi <yang.shi(a)linux.alibaba.com> Cc: Andrea Arcangeli <aarcange(a)redhat.com> Cc: John Hubbard <jhubbard(a)nvidia.com> Cc: Mike Kravetz <mike.kravetz(a)oracle.com> Cc: Ralph Campbell <rcampbell(a)nvidia.com> Link: http://lkml.kernel.org/r/20200416160026.16538-3-kirill.shutemov@linux.intel… Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/khugepaged.c | 27 +++++++++++---------------- 1 file changed, 11 insertions(+), 16 deletions(-) diff --git a/mm/khugepaged.c b/mm/khugepaged.c index 5883fd75d6fc..0ad9f2b2b33e 100644 --- a/mm/khugepaged.c +++ b/mm/khugepaged.c @@ -905,11 +905,6 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm, .pgoff = linear_page_index(vma, address), }; - /* we only decide to swapin, if there is enough young ptes */ - if (referenced < HPAGE_PMD_NR/2) { - trace_mm_collapse_huge_page_swapin(mm, swapped_in, referenced, 0); - return false; - } vmf.pte = pte_offset_map(pmd, address); for (; vmf.address < address + HPAGE_PMD_NR*PAGE_SIZE; vmf.pte++, vmf.address += PAGE_SIZE) { @@ -949,7 +944,7 @@ static bool __collapse_huge_page_swapin(struct mm_struct *mm, static void collapse_huge_page(struct mm_struct *mm, unsigned long address, struct page **hpage, - int node, int referenced) + int node, int referenced, int unmapped) { pmd_t *pmd, _pmd; pte_t *pte; @@ -1007,7 +1002,8 @@ static void collapse_huge_page(struct mm_struct *mm, * If it fails, we release mmap_sem and jump out_nolock. * Continuing to collapse causes inconsistency. */ - if (!__collapse_huge_page_swapin(mm, vma, address, pmd, referenced)) { + if (unmapped && !__collapse_huge_page_swapin(mm, vma, address, + pmd, referenced)) { mem_cgroup_cancel_charge(new_page, memcg, true); up_read(&mm->mmap_sem); goto out_nolock; @@ -1214,22 +1210,21 @@ static int khugepaged_scan_pmd(struct mm_struct *mm, mmu_notifier_test_young(vma->vm_mm, address)) referenced++; } - if (writable) { - if (referenced) { - result = SCAN_SUCCEED; - ret = 1; - } else { - result = SCAN_LACK_REFERENCED_PAGE; - } - } else { + if (!writable) { result = SCAN_PAGE_RO; + } else if (!referenced || (unmapped && referenced < HPAGE_PMD_NR/2)) { + result = SCAN_LACK_REFERENCED_PAGE; + } else { + result = SCAN_SUCCEED; + ret = 1; } out_unmap: pte_unmap_unlock(pte, ptl); if (ret) { node = khugepaged_find_target_node(); /* collapse_huge_page will return with the mmap_sem released */ - collapse_huge_page(mm, address, hpage, node, referenced); + collapse_huge_page(mm, address, hpage, node, + referenced, unmapped); } out: trace_mm_khugepaged_scan_pmd(mm, page, writable, referenced, -- 2.25.1

1 4

[PATCH 0/4] fixes CVE-2020-27673
by Yang Yingliang 27 Oct '20

27 Oct '20

Juergen Gross (4): xen/events: add a new "late EOI" evtchn framework xen/events: switch user event channels to lateeoi model xen/events: use a common cpu hotplug hook for event channels xen/events: defer eoi in case of excessive number of events .../admin-guide/kernel-parameters.txt | 8 + drivers/xen/events/events_2l.c | 7 +- drivers/xen/events/events_base.c | 363 +++++++++++++++++- drivers/xen/events/events_fifo.c | 70 ++-- drivers/xen/events/events_internal.h | 17 +- drivers/xen/evtchn.c | 7 +- include/xen/events.h | 21 + 7 files changed, 420 insertions(+), 73 deletions(-) -- 2.25.1

1 4

openEuler 选择 5.10 作为下一个长期维护的内核版本 (公示)
by Xie XiuQi 27 Oct '20

27 Oct '20

openEuler 选择 5.10 作为下一个长期维护的内核版本 (公示) - /本文//链接 <https://gitee.com/openeuler/community/blob/master/sig/Kernel/kernel-upgrade…>/ Linux 5.10 预计是 Linux 社区今年的 LTS (long-term support) 版本。openEuler 社区经过多轮沟通，选择 5.10 作为 openEuler 内核的下一个长期维护版本（openEuler Long-term support Kernel, OLK）。openEuler 社区提供不少于4年的维护时间和不少于2年的扩展维护时间。按照规划 openEuler 21.03、21.09 以及 openEuler 22.03 LTS 都将选择该内核版本。（具体时间以openEuler社区官网公布为准）升级安排： * v5.10-rc1 版本发布后，openEuler master 分支切换成 5.10。 * 由于主线 rc 版本尚在更新，openeuler_defconfig 暂时在 src-openeuler/kernel 仓库中提供，待 5.10 正式版本发布之后，再提交到源码仓库。 * openeuler_defconfig 基于 openEuler 20.09 的 config 修改适配，后续根据需求进行调整。 * 版本号格式，切换成 5.10.0-<devel_release>.<maintainence_release>。 * 首先支持 arm64 和 x86_64 架构，risc-v 的支持需要 risc-v sig 做适配。 * 上游社区 5.10 正式发布后（预计12月下旬）， openeuler/kernel 正式建立 OLK-5.10 分支（OLK: openEuler Long-term support Kernel），作为 5.10 的长期维护分支，接受补丁。 * 上游 5.10 正式发布前，如果有补丁需要发送 5.10，可以在 kernel(a)openeuler.org <mailto:kernel@openeuler.org> 中发 RFC 补丁，提前 Review 和讨论。 * 我们也可能提前建立 OLK-5.10 分支，以提前合入部分补丁做验证，但是在上游社区 5.10 正式发布之前，该分支可能会经常做 rebase 和 force push。对 OLK-5.10 或 openEuler 21.03 kernel 的需求 * 需求可以在 https://gitee.com/openeuler/kernel/issues 中提出。 * 如对 defconfig 有诉求也请在上述链接中提 issue。 * openEuler 21.03 计划使用该内核版本，预计2021年1月份之后，将从 OLK-5.10 拉出 openEuler-21.03 维护分支，同时补丁将受限合入 openEuler 21.03。注意事项和说明 * OLK 是 openEuler Long-term support Kernel 的缩写。openEuler LTS 版本和部分创新版本的内核基于 OLK 拉出分支进行维护。 * openEuler 5.10 内核不是基于 openEuler 4.19 内核的演进，而是基于上游社区内核的重新选型，因此如果您之前有合入 openEuler 4.19 的补丁，且这些补丁没有进入上游 5.10 内核，则需要您重新适配后推送到 openEuler 5.10 内核。 * openEuler 5.10 和 openEuler 4.19 两个版本 kabi 不兼容，您在 4.19 编译的 ko 不能直接在 5.10 上安装使用，需要重新适配和编译。 * openEuler 4.19 内核仍然处于维护周期内，如果您正在使用 4.19 内核，也不必紧张，您仍然能收到 4.19 的更新和增强。问题反馈 * kernel 升级期间，如果遇到兼容性、功能等问题，可以在 https://gitee.com/openeuler/kernel/issues 提交 issue。有疑问也可以在 PR 评论中，或者提交 issue 讨论。 * 你也可以发邮件到 kernel(a)openeuler.org <mailto:kernel@openeuler.org> 报议题在 kernel sig 例会中讨论。 * 如果 kernel sig 范围内协调或解决不了的问题，你也可以在 tc 报议题讨论。相关讨论纪要 kernel-sig 切换 5.10 的会议纪要： https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/thread/6… openEuler kernel 版本号在 TC 的议题及会议纪要： * 议题及讨论记录： https://mailweb.openeuler.org/hyperkitty/list/tc@openeuler.org/thread/KOHJN… https://mailweb.openeuler.org/hyperkitty/list/tc@openeuler.org/thread/VNJQ6… * 纪要： https://mailweb.openeuler.org/hyperkitty/list/tc@openeuler.org/thread/ZLAWQ…

1 0

[PATCH] xen/events: avoid removing an event channel while handling it
by Yang Yingliang 27 Oct '20

27 Oct '20

From: Juergen Gross <jgross(a)suse.com> mainline inclusion from mainline-v5.10 commit 073d0552ead5bfc7a3a9c01de590e924f11b5dd2 category: bugfix bugzilla: NA CVE: CVE-2020-27675 -------------------------------- Today it can happen that an event channel is being removed from the system while the event handling loop is active. This can lead to a race resulting in crashes or WARN() splats when trying to access the irq_info structure related to the event channel. Fix this problem by using a rwlock taken as reader in the event handling loop and as writer when deallocating the irq_info structure. As the observed problem was a NULL dereference in evtchn_from_irq() make this function more robust against races by testing the irq_info pointer to be not NULL before dereferencing it. And finally make all accesses to evtchn_to_irq[row][col] atomic ones in order to avoid seeing partial updates of an array element in irq handling. Note that irq handling can be entered only for event channels which have been valid before, so any not populated row isn't a problem in this regard, as rows are only ever added and never removed. This is XSA-331. Cc: stable(a)vger.kernel.org Reported-by: Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com> Reported-by: Jinoh Kang <luke1337(a)theori.io> Signed-off-by: Juergen Gross <jgross(a)suse.com> Reviewed-by: Stefano Stabellini <sstabellini(a)kernel.org> Reviewed-by: Wei Liu <wl(a)xen.org> Conflicts: drivers/xen/events/events_base.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/xen/events/events_base.c | 40 ++++++++++++++++++++++++++++---- 1 file changed, 35 insertions(+), 5 deletions(-) diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c index 95e5a9300ff0..75eade7d2017 100644 --- a/drivers/xen/events/events_base.c +++ b/drivers/xen/events/events_base.c @@ -32,6 +32,7 @@ #include <linux/slab.h> #include <linux/irqnr.h> #include <linux/pci.h> +#include <linux/spinlock.h> #ifdef CONFIG_X86 #include <asm/desc.h> @@ -69,6 +70,23 @@ const struct evtchn_ops *evtchn_ops; */ static DEFINE_MUTEX(irq_mapping_update_lock); +/* + * Lock protecting event handling loop against removing event channels. + * Adding of event channels is no issue as the associated IRQ becomes active + * only after everything is setup (before request_[threaded_]irq() the handler + * can't be entered for an event, as the event channel will be unmasked only + * then). + */ +static DEFINE_RWLOCK(evtchn_rwlock); + +/* + * Lock hierarchy: + * + * irq_mapping_update_lock + * evtchn_rwlock + * IRQ-desc lock + */ + static LIST_HEAD(xen_irq_list_head); /* IRQ <-> VIRQ mapping. */ @@ -101,7 +119,7 @@ static void clear_evtchn_to_irq_row(unsigned row) unsigned col; for (col = 0; col < EVTCHN_PER_ROW; col++) - evtchn_to_irq[row][col] = -1; + WRITE_ONCE(evtchn_to_irq[row][col], -1); } static void clear_evtchn_to_irq_all(void) @@ -138,7 +156,7 @@ static int set_evtchn_to_irq(unsigned evtchn, unsigned irq) clear_evtchn_to_irq_row(row); } - evtchn_to_irq[row][col] = irq; + WRITE_ONCE(evtchn_to_irq[row][col], irq); return 0; } @@ -148,7 +166,7 @@ int get_evtchn_to_irq(unsigned evtchn) return -1; if (evtchn_to_irq[EVTCHN_ROW(evtchn)] == NULL) return -1; - return evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)]; + return READ_ONCE(evtchn_to_irq[EVTCHN_ROW(evtchn)][EVTCHN_COL(evtchn)]); } /* Get info for IRQ */ @@ -246,10 +264,14 @@ static void xen_irq_info_cleanup(struct irq_info *info) */ unsigned int evtchn_from_irq(unsigned irq) { - if (unlikely(WARN(irq >= nr_irqs, "Invalid irq %d!\n", irq))) + const struct irq_info *info = NULL; + + if (likely(irq < nr_irqs)) + info = info_for_irq(irq); + if (!info) return 0; - return info_for_irq(irq)->evtchn; + return info->evtchn; } unsigned irq_from_evtchn(unsigned int evtchn) @@ -425,16 +447,21 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi) static void xen_free_irq(unsigned irq) { struct irq_info *info = irq_get_chip_data(irq); + unsigned long flags; if (WARN_ON(!info)) return; + write_lock_irqsave(&evtchn_rwlock, flags); + list_del(&info->list); irq_set_chip_data(irq, NULL); WARN_ON(info->refcnt > 0); + write_unlock_irqrestore(&evtchn_rwlock, flags); + kfree(info); /* Legacy IRQ descriptors are managed by the arch. */ @@ -1220,6 +1247,8 @@ static void __xen_evtchn_do_upcall(void) int cpu = get_cpu(); unsigned count; + read_lock(&evtchn_rwlock); + do { vcpu_info->evtchn_upcall_pending = 0; @@ -1236,6 +1265,7 @@ static void __xen_evtchn_do_upcall(void) out: + read_unlock(&evtchn_rwlock); put_cpu(); } -- 2.25.1

1 0

[PATCH 1/7] iommu/sysfs: Rename iommu_release_device()
by Yang Yingliang 27 Oct '20

27 Oct '20

From: Joerg Roedel <jroedel(a)suse.de> mainline inclusion from mainline-v4.20-rc1 commit 6954cf9bfda153f9544c63761aabf0199710aec3 category:bugfix bugzilla:NA CVE:NA ------------------- Remove the iommu_ prefix from the function and a few other static data structures so that the iommu_release_device name can be re-used in iommu core code. Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/iommu/iommu-sysfs.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/drivers/iommu/iommu-sysfs.c b/drivers/iommu/iommu-sysfs.c index 36d1a7ce7fc4..71c2249d3260 100644 --- a/drivers/iommu/iommu-sysfs.c +++ b/drivers/iommu/iommu-sysfs.c @@ -22,25 +22,25 @@ static struct attribute *devices_attr[] = { NULL, }; -static const struct attribute_group iommu_devices_attr_group = { +static const struct attribute_group devices_attr_group = { .name = "devices", .attrs = devices_attr, }; -static const struct attribute_group *iommu_dev_groups[] = { - &iommu_devices_attr_group, +static const struct attribute_group *dev_groups[] = { + &devices_attr_group, NULL, }; -static void iommu_release_device(struct device *dev) +static void release_device(struct device *dev) { kfree(dev); } static struct class iommu_class = { .name = "iommu", - .dev_release = iommu_release_device, - .dev_groups = iommu_dev_groups, + .dev_release = release_device, + .dev_groups = dev_groups, }; static int __init iommu_dev_init(void) -- 2.25.1

1 6

[PATCH 1/8] bcache: use a separate data structure for the on-disk super block
by Yang Yingliang 26 Oct '20

26 Oct '20

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-5.6-rc1 commit a702a692cd7559053ea573f4e2c84828f0e62824 category: feature bugzilla: 43003 CVE: NA --------------------------- Split out an on-disk version struct cache_sb with the proper endianness annotations. This fixes a fair chunk of sparse warnings, but there are some left due to the way the checksum is defined. Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Coly Li <colyli(a)suse.de> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Acked-by: Hanjun Guo <guohanjun(a)huawei.com> Reviewed-by: Yufen Yu <yuyufen(a)huawei.com> Signed-off-by: zhangyi (F) <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/md/bcache/super.c | 6 ++--- include/uapi/linux/bcache.h | 51 +++++++++++++++++++++++++++++++++++++ 2 files changed, 54 insertions(+), 3 deletions(-) diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c index 78854837f398..8f8a0a69cc0e 100644 --- a/drivers/md/bcache/super.c +++ b/drivers/md/bcache/super.c @@ -63,14 +63,14 @@ static const char *read_super(struct cache_sb *sb, struct block_device *bdev, struct page **res) { const char *err; - struct cache_sb *s; + struct cache_sb_disk *s; struct buffer_head *bh = __bread(bdev, 1, SB_SIZE); unsigned int i; if (!bh) return "IO error"; - s = (struct cache_sb *) bh->b_data; + s = (struct cache_sb_disk *)bh->b_data; sb->offset = le64_to_cpu(s->offset); sb->version = le64_to_cpu(s->version); @@ -209,7 +209,7 @@ static void write_bdev_super_endio(struct bio *bio) static void __write_super(struct cache_sb *sb, struct bio *bio) { - struct cache_sb *out = page_address(bio_first_page_all(bio)); + struct cache_sb_disk *out = page_address(bio_first_page_all(bio)); unsigned int i; bio->bi_iter.bi_sector = SB_SECTOR; diff --git a/include/uapi/linux/bcache.h b/include/uapi/linux/bcache.h index 5d4f58e059fd..1d8b3a9fc080 100644 --- a/include/uapi/linux/bcache.h +++ b/include/uapi/linux/bcache.h @@ -156,6 +156,57 @@ static inline struct bkey *bkey_idx(const struct bkey *k, unsigned int nr_keys) #define BDEV_DATA_START_DEFAULT 16 /* sectors */ +struct cache_sb_disk { + __le64 csum; + __le64 offset; /* sector where this sb was written */ + __le64 version; + + __u8 magic[16]; + + __u8 uuid[16]; + union { + __u8 set_uuid[16]; + __le64 set_magic; + }; + __u8 label[SB_LABEL_SIZE]; + + __le64 flags; + __le64 seq; + __le64 pad[8]; + + union { + struct { + /* Cache devices */ + __le64 nbuckets; /* device size */ + + __le16 block_size; /* sectors */ + __le16 bucket_size; /* sectors */ + + __le16 nr_in_set; + __le16 nr_this_dev; + }; + struct { + /* Backing devices */ + __le64 data_offset; + + /* + * block_size from the cache device section is still used by + * backing devices, so don't add anything here until we fix + * things to not need it for backing devices anymore + */ + }; + }; + + __le32 last_mount; /* time overflow in y2106 */ + + __le16 first_bucket; + union { + __le16 njournal_buckets; + __le16 keys; + }; + __le64 d[SB_JOURNAL_BUCKETS]; /* journal buckets */ +}; + struct cache_sb { __u64 csum; __u64 offset; /* sector where this sb was written */ -- 2.25.1

1 7

[PATCH 1/2] list: introduce list_for_each_continue()
by Yang Yingliang 26 Oct '20

26 Oct '20

From: Pavel Begunkov <asml.silence(a)gmail.com> mainline inclusion from mainline-v5.6-rc1 commit 28ca0d6d39ab1d01c86762c82a585b7cedd2920c category: bugfix bugzilla: 35619 CVE: NA -------------------------------- As other *continue() helpers, this continues iteration from a given position. Signed-off-by: Pavel Begunkov <asml.silence(a)gmail.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Reviewed-by: zhangyi (F) <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/list.h | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/include/linux/list.h b/include/linux/list.h index de04cc5ed536..0e540581d52c 100644 --- a/include/linux/list.h +++ b/include/linux/list.h @@ -455,6 +455,16 @@ static inline void list_splice_tail_init(struct list_head *list, #define list_for_each(pos, head) \ for (pos = (head)->next; pos != (head); pos = pos->next) +/** + * list_for_each_continue - continue iteration over a list + * @pos: the &struct list_head to use as a loop cursor. + * @head: the head for your list. + * + * Continue to iterate over a list, continuing after the current position. + */ +#define list_for_each_continue(pos, head) \ + for (pos = pos->next; pos != (head); pos = pos->next) + /** * list_for_each_prev - iterate over a list backwards * @pos: the &struct list_head to use as a loop cursor. -- 2.25.1

1 1

[PATCH 1/6] driver core: Introduce device_iommu_mapped() function
by Yang Yingliang 22 Oct '20

22 Oct '20

From: Joerg Roedel <jroedel(a)suse.de> mainline inclusion from mainline-v4.20-rc1 commit dbba197edf32209d110727a02d3a91de4c88520f category:feature bugzilla:NA CVE:NA ------------------- Some places in the kernel check the iommu_group pointer in 'struct device' in order to find out whether a device is mapped by an IOMMU. This is not good way to make this check, as the pointer will be moved to 'struct dev_iommu_data'. This way to make the check is also not very readable. Introduce an explicit function to perform this check. Acked-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Acked-by: Robin Murphy <robin.murphy(a)arm.com> Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Chen Jun <chenjun102(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/device.h | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/include/linux/device.h b/include/linux/device.h index ee4ed3af30d0..cb9df20a9c97 100644 --- a/include/linux/device.h +++ b/include/linux/device.h @@ -1090,6 +1090,16 @@ static inline struct device *kobj_to_dev(struct kobject *kobj) return container_of(kobj, struct device, kobj); } +/** + * device_iommu_mapped - Returns true when the device DMA is translated + * by an IOMMU + * @dev: Device to perform the check on + */ +static inline bool device_iommu_mapped(struct device *dev) +{ + return (dev->iommu_group != NULL); +} + /* Get the wakeup routines, which depend on struct device */ #include <linux/pm_wakeup.h> -- 2.25.1

1 5

[PATCH 1/6] net/hinic: Fix the driver does not report an error when setting MAC fails
by Yang Yingliang 22 Oct '20

22 Oct '20

From: Chiqijun <chiqijun(a)huawei.com> driver inclusion category: bugfix bugzilla: 4472 ----------------------------------------------------------------------- When using the ip link command to configure the MAC for the VF in the PF, the status 4 will be returned when the MAC is set on the VF; when the PF driver receives the status 4 returned by the firmwre, the MAC setting failed and an error should be reported. Signed-off-by: Chiqijun <chiqijun(a)huawei.com> Reviewed-by: Wangxiaoyun <cloud.wangxiaoyun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- .../net/ethernet/huawei/hinic/hinic_main.c | 7 +++- .../net/ethernet/huawei/hinic/hinic_nic_cfg.c | 41 ++++++++++++------- 2 files changed, 31 insertions(+), 17 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c index b5d0bdadf509..cf7b6ceef060 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_main.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c @@ -1305,8 +1305,11 @@ static int hinic_set_mac_addr(struct net_device *netdev, void *addr) err = hinic_update_mac(nic_dev->hwdev, netdev->dev_addr, saddr->sa_data, 0, func_id); - if (err) - return err; + if (err) { + nicif_err(nic_dev, drv, netdev, "Failed to update mac, err: %d\n", + err); + return err == HINIC_PF_SET_VF_ALREADY ? -EPERM : err; + } memcpy(netdev->dev_addr, saddr->sa_data, ETH_ALEN); diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c b/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c index a42dea0ad707..2b349e17260b 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c @@ -231,6 +231,23 @@ int hinic_get_fw_support_func(void *hwdev) #define HINIC_ADD_VLAN_IN_MAC 0x8000 #define HINIC_VLAN_ID_MASK 0x7FFF +#define PF_SET_VF_MAC(hwdev, status) \ + (HINIC_FUNC_TYPE(hwdev) == TYPE_VF && \ + (status) == HINIC_PF_SET_VF_ALREADY) + +static int hinic_check_mac_status(struct hinic_hwdev *hwdev, u8 status, + u16 vlan_id) +{ + if ((status && status != HINIC_MGMT_STATUS_EXIST) || + (vlan_id & CHECK_IPSU_15BIT && status == HINIC_MGMT_STATUS_EXIST)) { + if (PF_SET_VF_MAC(hwdev, status)) + return 0; + + return -EINVAL; + } + + return 0; +} int hinic_set_mac(void *hwdev, const u8 *mac_addr, u16 vlan_id, u16 func_id) { @@ -255,17 +272,14 @@ int hinic_set_mac(void *hwdev, const u8 *mac_addr, u16 vlan_id, u16 func_id) err = l2nic_msg_to_mgmt_sync(hwdev, HINIC_PORT_CMD_SET_MAC, &mac_info, sizeof(mac_info), &mac_info, &out_size); if (err || !out_size || - (mac_info.status && mac_info.status != HINIC_MGMT_STATUS_EXIST && - mac_info.status != HINIC_PF_SET_VF_ALREADY) || - (mac_info.vlan_id & CHECK_IPSU_15BIT && - mac_info.status == HINIC_MGMT_STATUS_EXIST)) { + hinic_check_mac_status(hwdev, mac_info.status, mac_info.vlan_id)) { nic_err(nic_hwdev->dev_hdl, "Failed to update MAC, err: %d, status: 0x%x, out size: 0x%x\n", err, mac_info.status, out_size); - return -EINVAL; + return -EIO; } - if (mac_info.status == HINIC_PF_SET_VF_ALREADY) { + if (PF_SET_VF_MAC(nic_hwdev, mac_info.status)) { nic_warn(nic_hwdev->dev_hdl, "PF has already set VF mac, Ignore set operation\n"); return HINIC_PF_SET_VF_ALREADY; } @@ -302,13 +316,13 @@ int hinic_del_mac(void *hwdev, const u8 *mac_addr, u16 vlan_id, u16 func_id) err = l2nic_msg_to_mgmt_sync(hwdev, HINIC_PORT_CMD_DEL_MAC, &mac_info, sizeof(mac_info), &mac_info, &out_size); if (err || !out_size || - (mac_info.status && mac_info.status != HINIC_PF_SET_VF_ALREADY)) { + (mac_info.status && !PF_SET_VF_MAC(nic_hwdev, mac_info.status))) { nic_err(nic_hwdev->dev_hdl, "Failed to delete MAC, err: %d, status: 0x%x, out size: 0x%x\n", err, mac_info.status, out_size); - return -EINVAL; + return -EIO; } - if (mac_info.status == HINIC_PF_SET_VF_ALREADY) { + if (PF_SET_VF_MAC(nic_hwdev, mac_info.status)) { nic_warn(nic_hwdev->dev_hdl, "PF has already set VF mac, Ignore delete operation\n"); return HINIC_PF_SET_VF_ALREADY; } @@ -343,17 +357,14 @@ int hinic_update_mac(void *hwdev, u8 *old_mac, u8 *new_mac, u16 vlan_id, &mac_info, sizeof(mac_info), &mac_info, &out_size); if (err || !out_size || - (mac_info.status && mac_info.status != HINIC_MGMT_STATUS_EXIST && - mac_info.status != HINIC_PF_SET_VF_ALREADY) || - (mac_info.vlan_id & CHECK_IPSU_15BIT && - mac_info.status == HINIC_MGMT_STATUS_EXIST)) { + hinic_check_mac_status(hwdev, mac_info.status, mac_info.vlan_id)) { nic_err(nic_hwdev->dev_hdl, "Failed to update MAC, err: %d, status: 0x%x, out size: 0x%x\n", err, mac_info.status, out_size); - return -EINVAL; + return -EIO; } - if (mac_info.status == HINIC_PF_SET_VF_ALREADY) { + if (PF_SET_VF_MAC(nic_hwdev, mac_info.status)) { nic_warn(nic_hwdev->dev_hdl, "PF has already set VF MAC. Ignore update operation\n"); return HINIC_PF_SET_VF_ALREADY; } -- 2.25.1

1 5

[PATCH 01/20] nvme-rdma: remove redundant reference between ib_device and tagset
by Yang Yingliang 22 Oct '20

22 Oct '20

From: Max Gurtovoy <maxg(a)mellanox.com> mainline inclusion from mainline-v5.2-rc1 commit 87fd125344d68adf7699ec7396aa9f905ce79a80 category: bugfix bugzilla: NA CVE: NA Link: https://gitee.com/openeuler/kernel/issues/I1WGZE ------------------------------------------------- In the past, before adding f41725bb ("nvme-rdma: Use mr pool") commit, we needed a reference on the ib_device as long as the tagset was alive, as the MRs in the request structures needed a valid ib_device. Now, we allocate/deallocate MR pool per QP and consume on demand. Also remove nvme_rdma_free_tagset function and use blk_mq_free_tag_set instead, as it unneeded anymore. This commit also fixes a memory leakage and possible segmentation fault. When configuring the system with NIC teaming (aka bonding), we use 1 network interface to create an HA connection to the target side. In case one connection breaks down, nvme-rdma driver will get notification from rdma-cm layer that underlying address was change and will start error recovery process. During this process, we'll reconnect to the target via the second interface in the bond without destroying the tagset. This will cause a leakage of the initial rdma device (ndev) and miscount in the reference count of the new created rdma device (new ndev). In the final destruction (or in another error flow), we'll get a warning dump from the ib_dealloc_pd that we still have inflight MR's related to that pd. This happens becasue of the miscount of the reference tag of the rdma device and causing access violation to it's elements (some queues are not destroyed yet). Signed-off-by: Max Gurtovoy <maxg(a)mellanox.com> Signed-off-by: Israel Rukshin <israelr(a)mellanox.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Chao Leng <lengchao(a)huawei.com> Reviewed-by: Jike Cheng <chengjike.cheng(a)huawei.com> Conflicts: drivers/nvme/host/rdma.c [lrz: adjust context] Signed-off-by: Ruozhu Li <liruozhu(a)huawei.com> Signed-off-by: Lijie <lijie34(a)huawei.com> Reviewed-by: Tao Hou <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/nvme/host/rdma.c | 34 +++++----------------------------- 1 file changed, 5 insertions(+), 29 deletions(-) diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c index 077c67816665..0bfc1875575d 100644 --- a/drivers/nvme/host/rdma.c +++ b/drivers/nvme/host/rdma.c @@ -666,15 +666,6 @@ static int nvme_rdma_alloc_io_queues(struct nvme_rdma_ctrl *ctrl) return ret; } -static void nvme_rdma_free_tagset(struct nvme_ctrl *nctrl, - struct blk_mq_tag_set *set) -{ - struct nvme_rdma_ctrl *ctrl = to_rdma_ctrl(nctrl); - - blk_mq_free_tag_set(set); - nvme_rdma_dev_put(ctrl->device); -} - static struct blk_mq_tag_set *nvme_rdma_alloc_tagset(struct nvme_ctrl *nctrl, bool admin) { @@ -712,24 +703,9 @@ static struct blk_mq_tag_set *nvme_rdma_alloc_tagset(struct nvme_ctrl *nctrl, ret = blk_mq_alloc_tag_set(set); if (ret) - goto out; - - /* - * We need a reference on the device as long as the tag_set is alive, - * as the MRs in the request structures need a valid ib_device. - */ - ret = nvme_rdma_dev_get(ctrl->device); - if (!ret) { - ret = -EINVAL; - goto out_free_tagset; - } + return ERR_PTR(ret); return set; - -out_free_tagset: - blk_mq_free_tag_set(set); -out: - return ERR_PTR(ret); } static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl, @@ -737,7 +713,7 @@ static void nvme_rdma_destroy_admin_queue(struct nvme_rdma_ctrl *ctrl, { if (remove) { blk_cleanup_queue(ctrl->ctrl.admin_q); - nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset); + blk_mq_free_tag_set(ctrl->ctrl.admin_tagset); } if (ctrl->async_event_sqe.data) { cancel_work_sync(&ctrl->ctrl.async_event_work); @@ -815,7 +791,7 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl, blk_cleanup_queue(ctrl->ctrl.admin_q); out_free_tagset: if (new) - nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.admin_tagset); + blk_mq_free_tag_set(ctrl->ctrl.admin_tagset); out_free_async_qe: if (ctrl->async_event_sqe.data) { nvme_rdma_free_qe(ctrl->device->dev, &ctrl->async_event_sqe, @@ -832,7 +808,7 @@ static void nvme_rdma_destroy_io_queues(struct nvme_rdma_ctrl *ctrl, { if (remove) { blk_cleanup_queue(ctrl->ctrl.connect_q); - nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.tagset); + blk_mq_free_tag_set(ctrl->ctrl.tagset); } nvme_rdma_free_io_queues(ctrl); } @@ -873,7 +849,7 @@ static int nvme_rdma_configure_io_queues(struct nvme_rdma_ctrl *ctrl, bool new) blk_cleanup_queue(ctrl->ctrl.connect_q); out_free_tag_set: if (new) - nvme_rdma_free_tagset(&ctrl->ctrl, ctrl->ctrl.tagset); + blk_mq_free_tag_set(ctrl->ctrl.tagset); out_free_io_queues: nvme_rdma_free_io_queues(ctrl); return ret; -- 2.25.1

1 19

【议题收集】【Meeting Notice】openEuler kernel sig meeting Time: 2020-10-16 10:00-12:00
by Xie XiuQi 20 Oct '20

20 Oct '20

openEuler kernel sig meeting 定于 2020-10-16 10:00-12:00 召开，欢迎回复邮件申报议题。 --- 会议信息 --- 会议链接：https://zoom.us/j/94156903933 会议 ID : 94156903933 --- 会议纪要归档 --- Meeting Record 20200918： https://gitee.com/openeuler/kernel/issues/I1WGN0

1 3

[PATCH 00/19] backport stable-4.19.152
by Yang Yingliang 19 Oct '20

19 Oct '20

Anant Thazhemadam (1): staging: comedi: check validity of wMaxPacketSize of usb endpoints found Arnaud Patard (1): drivers/net/ethernet/marvell/mvmdio.c: Fix non OF case Dmitry Golovin (1): ARM: 8939/1: kbuild: use correct nm executable Dominik Przychodni (1): crypto: qat - check cipher length for aead AES-CBC-HMAC-SHA Greg Kroah-Hartman (1): Linux 4.19.152 Herbert Xu (1): crypto: bcm - Verify GCM/CCM key length in setkey Jan Kara (2): reiserfs: Initialize inode keys properly reiserfs: Fix oops during mount Jason A. Donenfeld (1): ARM: 8867/1: vdso: pass --be8 to linker if necessary Leo Yan (1): perf cs-etm: Move definition of 'traceid_list' global variable from header file Leonid Bloch (1): USB: serial: option: Add Telit FT980-KS composition Luiz Augusto von Dentz (2): Bluetooth: Consolidate encryption handling in hci_encrypt_cfm Bluetooth: Disconnect if E0 is used for Level 4 Masahiro Yamada (1): ARM: 8858/1: vdso: use $(LD) instead of $(CC) to link VDSO Mychaela N. Falconia (1): USB: serial: ftdi_sio: add support for FreeCalypso JTAG+UART adapters Oliver Neukum (1): media: usbtv: Fix refcounting mixup Patrick Steinhardt (1): Bluetooth: Fix update of connection state in `hci_encrypt_cfm` Scott Chen (1): USB: serial: pl2303: add device-id for HP GC device Wilken Gottwalt (1): USB: serial: option: add Cellient MPL200 card Makefile | 2 +- arch/arm/boot/compressed/Makefile | 4 +- arch/arm/vdso/Makefile | 22 +++++------ drivers/crypto/bcm/cipher.c | 15 +++++++- drivers/crypto/qat/qat_common/qat_algs.c | 10 ++++- drivers/media/usb/usbtv/usbtv-core.c | 3 +- drivers/net/ethernet/marvell/mvmdio.c | 22 ++++++++--- drivers/staging/comedi/drivers/vmk80xx.c | 3 ++ drivers/usb/serial/ftdi_sio.c | 5 +++ drivers/usb/serial/ftdi_sio_ids.h | 7 ++++ drivers/usb/serial/option.c | 5 +++ drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + fs/reiserfs/inode.c | 6 +-- fs/reiserfs/xattr.c | 7 ++++ include/net/bluetooth/hci_core.h | 30 ++++++++++++--- net/bluetooth/hci_conn.c | 17 +++++++++ net/bluetooth/hci_event.c | 48 ++++++------------------ tools/perf/util/cs-etm.c | 3 ++ tools/perf/util/cs-etm.h | 3 -- 20 files changed, 138 insertions(+), 76 deletions(-) -- 2.25.1

1 19

[PATCH 00/26] huge vmalloc mappings
by Yang Yingliang 19 Oct '20

19 Oct '20

Anshuman Khandual (1): mm/ioremap: probe platform for p4d huge map support Christoph Hellwig (8): mm: remove __get_vm_area mm: unexport unmap_kernel_range_noflush mm: only allow page table mappings for built-in zsmalloc mm: pass addr as unsigned long to vb_free mm: remove vmap_page_range_noflush and vunmap_page_range mm: rename vmap_page_range to map_kernel_range mm: don't return the number of pages from map_kernel_range{, _noflush} mm: remove map_vm_range Daniel Axtens (1): mm/memory.c: add apply_to_existing_page_range() helper Ingo Molnar (1): mm/vmalloc: Add empty <asm/vmalloc.h> headers and use them from <linux/vmalloc.h> Mike Rapoport (1): mm: move lib/ioremap.c to mm/ Nicholas Piggin (9): mm/vmalloc: fix vmalloc_to_page for huge vmap mappings mm: apply_to_pte_range warn and fail if a large pte is encountered mm/vmalloc: rename vmap_*_range vmap_pages_*_range mm/ioremap: rename ioremap_*_range to vmap_*_range mm: HUGE_VMAP arch support cleanup arm64: inline huge vmap supported functions mm: Move vmap_range from mm/ioremap.c to mm/vmalloc.c mm/vmalloc: add vmap_range_noflush variant mm/vmalloc: Hugepage vmalloc mappings Steven Price (2): mm: add generic p?d_leaf() macros arm64: mm: add p?d_leaf() definitions Will Deacon (3): ioremap: rework pXd_free_pYd_page() API lib/ioremap: ensure phys_addr actually corresponds to a physical address lib/ioremap: ensure break-before-make is used for huge p4d mappings Documentation/core-api/cachetlb.rst | 2 +- arch/Kconfig | 4 + arch/alpha/include/asm/vmalloc.h | 4 + arch/arc/include/asm/vmalloc.h | 4 + arch/arm/include/asm/vmalloc.h | 4 + arch/arm64/include/asm/pgtable.h | 2 + arch/arm64/include/asm/vmalloc.h | 29 ++ arch/arm64/mm/mmu.c | 16 - arch/c6x/include/asm/vmalloc.h | 4 + arch/csky/include/asm/vmalloc.h | 4 + arch/h8300/include/asm/vmalloc.h | 4 + arch/hexagon/include/asm/vmalloc.h | 4 + arch/ia64/include/asm/vmalloc.h | 4 + arch/m68k/include/asm/vmalloc.h | 4 + arch/microblaze/include/asm/vmalloc.h | 4 + arch/mips/include/asm/vmalloc.h | 4 + arch/nds32/include/asm/vmalloc.h | 4 + arch/nios2/include/asm/vmalloc.h | 4 + arch/openrisc/include/asm/vmalloc.h | 4 + arch/parisc/include/asm/vmalloc.h | 4 + arch/powerpc/include/asm/vmalloc.h | 12 + arch/powerpc/kernel/pci_64.c | 3 +- arch/riscv/include/asm/vmalloc.h | 4 + arch/s390/include/asm/vmalloc.h | 4 + arch/sh/include/asm/vmalloc.h | 4 + arch/sh/kernel/cpu/sh4/sq.c | 3 +- arch/sparc/include/asm/vmalloc.h | 4 + arch/um/include/asm/vmalloc.h | 4 + arch/unicore32/include/asm/vmalloc.h | 4 + arch/x86/include/asm/vmalloc.h | 12 + arch/x86/mm/ioremap.c | 11 +- arch/x86/mm/pgtable.c | 8 + arch/xtensa/include/asm/vmalloc.h | 4 + include/asm-generic/pgtable.h | 25 ++ include/linux/io.h | 8 - include/linux/mm.h | 3 + include/linux/vmalloc.h | 24 +- init/main.c | 1 - kernel/dma/mapping.c | 3 +- lib/Makefile | 1 - lib/ioremap.c | 183 --------- mm/Kconfig | 2 +- mm/Makefile | 2 +- mm/ioremap.c | 34 ++ mm/memory.c | 152 ++++++-- mm/vmalloc.c | 518 +++++++++++++++++++------- mm/zsmalloc.c | 4 +- 47 files changed, 752 insertions(+), 398 deletions(-) create mode 100644 arch/alpha/include/asm/vmalloc.h create mode 100644 arch/arc/include/asm/vmalloc.h create mode 100644 arch/arm/include/asm/vmalloc.h create mode 100644 arch/arm64/include/asm/vmalloc.h create mode 100644 arch/c6x/include/asm/vmalloc.h create mode 100644 arch/csky/include/asm/vmalloc.h create mode 100644 arch/h8300/include/asm/vmalloc.h create mode 100644 arch/hexagon/include/asm/vmalloc.h create mode 100644 arch/ia64/include/asm/vmalloc.h create mode 100644 arch/m68k/include/asm/vmalloc.h create mode 100644 arch/microblaze/include/asm/vmalloc.h create mode 100644 arch/mips/include/asm/vmalloc.h create mode 100644 arch/nds32/include/asm/vmalloc.h create mode 100644 arch/nios2/include/asm/vmalloc.h create mode 100644 arch/openrisc/include/asm/vmalloc.h create mode 100644 arch/parisc/include/asm/vmalloc.h create mode 100644 arch/powerpc/include/asm/vmalloc.h create mode 100644 arch/riscv/include/asm/vmalloc.h create mode 100644 arch/s390/include/asm/vmalloc.h create mode 100644 arch/sh/include/asm/vmalloc.h create mode 100644 arch/sparc/include/asm/vmalloc.h create mode 100644 arch/um/include/asm/vmalloc.h create mode 100644 arch/unicore32/include/asm/vmalloc.h create mode 100644 arch/x86/include/asm/vmalloc.h create mode 100644 arch/xtensa/include/asm/vmalloc.h delete mode 100644 lib/ioremap.c create mode 100644 mm/ioremap.c -- 2.25.1

1 26

[PATCH 0/4] fixes CVE-2020-12351 and CVE-2020-12352
by Yang Yingliang 19 Oct '20

19 Oct '20

Luiz Augusto von Dentz (4): Bluetooth: A2MP: Fix not initializing all members Bluetooth: L2CAP: Fix calling sk_filter on non-socket based channel Bluetooth: Disable High Speed by default Bluetooth: MGMT: Fix not checking if BT_HS is enabled include/net/bluetooth/l2cap.h | 2 ++ net/bluetooth/Kconfig | 1 - net/bluetooth/a2mp.c | 22 +++++++++++++++++++++- net/bluetooth/l2cap_core.c | 7 ++++--- net/bluetooth/l2cap_sock.c | 14 ++++++++++++++ net/bluetooth/mgmt.c | 7 ++++++- 6 files changed, 47 insertions(+), 6 deletions(-) -- 2.25.1

1 4

[PATCH 00/49] backport stable-4.19.151
by Yang Yingliang 19 Oct '20

19 Oct '20

Aaron Ma (1): platform/x86: thinkpad_acpi: re-initialize ACPI buffer size when reuse Anant Thazhemadam (3): net: wireless: nl80211: fix out-of-bounds access in nl80211_del_key() net: team: fix memory leak in __team_options_register net: usb: rtl8150: set random MAC address when set_ethernet_addr() fails Antony Antony (4): xfrm: clone XFRMA_SET_MARK in xfrm_do_migrate xfrm: clone XFRMA_REPLAY_ESN_VAL in xfrm_do_migrate xfrm: clone XFRMA_SEC_CTX in xfrm_do_migrate xfrm: clone whole liftime_cur structure in xfrm_do_migrate Aya Levin (2): net/mlx5e: Fix VLAN cleanup flow net/mlx5e: Fix VLAN create flow Chaitanya Kulkarni (1): nvme-core: put ctrl ref when module ref get fail Coly Li (1): mmc: core: don't set limits.discard_granularity as 0 Cristian Ciocaltea (1): i2c: owl: Clear NACK and BUS error bits David Howells (3): rxrpc: Downgrade the BUG() for unsupported token type in rxrpc_read() rxrpc: Fix some missing _bh annotations on locking conn->state_lock rxrpc: Fix server keyring leak Dinh Nguyen (1): arm64: dts: stratix10: add status to qspi dts node Dumitru Ceara (1): openvswitch: handle DNAT tuple collision Eric Dumazet (4): macsec: avoid use-after-free in macsec_handle_frame() sctp: fix sctp_auth_init_hmacs() error path team: set dev->needed_headroom in team_setup_by_port() bonding: set dev->needed_headroom in bond_setup_by_slave() Geert Uytterhoeven (1): Revert "ravb: Fixed to be able to unload modules" Greg Kroah-Hartman (1): Linux 4.19.151 Hans de Goede (2): platform/x86: intel-vbtn: Fix SW_TABLET_MODE always reporting 1 on the HP Pavilion 11 x360 platform/x86: intel-vbtn: Switch to an allow-list for SW_TABLET_MODE reporting Herbert Xu (1): xfrm: Use correct address family in xfrm_state_find Hugh Dickins (1): mm/khugepaged: fix filemap page_to_pgoff(page) != offset Jean Delvare (1): i2c: i801: Exclude device from suspend direct complete optimization Jerome Brunet (1): i2c: meson: fix clock setting overwrite Kajol Jain (1): perf: Fix task_function_call() error handling Karol Herbst (1): drm/nouveau/mem: guard against NULL pointer access in mem_del Linus Torvalds (1): usermodehelper: reset umask to default before executing user process Marc Dionne (1): rxrpc: Fix rxkad token xdr encoding Miquel Raynal (1): mtd: rawnand: sunxi: Fix the probe error path Necip Fazil Yildiran (1): platform/x86: fix kconfig dependency warning for FUJITSU_LAPTOP Nicolas Belin (1): i2c: meson: fixup rate calculation with filter delay Peilin Ye (3): fbdev, newport_con: Move FONT_EXTRA_WORDS macros into linux/font.h Fonts: Support FONT_EXTRA_WORDS macros for built-in fonts fbcon: Fix global-out-of-bounds read in fbcon_get_font() Philip Yang (1): drm/amdgpu: prevent double kfree ttm->sg Randy Dunlap (1): mdio: fix mdio-thunder.c dependency & build error Sabrina Dubroca (1): xfrmi: drop ignore_df check before updating pmtu Tetsuo Handa (1): driver core: Fix probe_count imbalance in really_probe() Tom Rix (1): platform/x86: thinkpad_acpi: initialize tp_nvram_state variable Vijay Balakrishna (1): mm: khugepaged: recalculate min_free_kbytes after memory hotplug as expected by khugepaged Vladimir Zapolskiy (1): cifs: Fix incomplete memory allocation on setxattr path Voon Weifeng (1): net: stmmac: removed enabling eee in EEE set callback Wilken Gottwalt (1): net: usb: ax88179_178a: fix missing stop entry in driver_info Makefile | 2 +- .../dts/altera/socfpga_stratix10_socdk.dts | 1 + drivers/base/dd.c | 5 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + drivers/gpu/drm/nouveau/nouveau_mem.c | 2 + drivers/i2c/busses/i2c-i801.c | 1 + drivers/i2c/busses/i2c-meson.c | 42 +++++-- drivers/i2c/busses/i2c-owl.c | 6 + drivers/mmc/core/queue.c | 2 +- drivers/mtd/nand/raw/sunxi_nand.c | 2 +- drivers/net/bonding/bond_main.c | 1 + .../net/ethernet/mellanox/mlx5/core/en_fs.c | 14 ++- drivers/net/ethernet/renesas/ravb_main.c | 110 +++++++++--------- .../ethernet/stmicro/stmmac/stmmac_ethtool.c | 15 +-- drivers/net/macsec.c | 4 +- drivers/net/phy/Kconfig | 1 + drivers/net/team/team.c | 3 +- drivers/net/usb/ax88179_178a.c | 1 + drivers/net/usb/rtl8150.c | 16 ++- drivers/nvme/host/core.c | 4 +- drivers/platform/x86/Kconfig | 1 + drivers/platform/x86/intel-vbtn.c | 64 +++++++--- drivers/platform/x86/thinkpad_acpi.c | 6 +- drivers/video/console/newport_con.c | 7 +- drivers/video/fbdev/core/fbcon.c | 12 ++ drivers/video/fbdev/core/fbcon.h | 7 -- drivers/video/fbdev/core/fbcon_rotate.c | 1 + drivers/video/fbdev/core/tileblit.c | 1 + fs/cifs/smb2ops.c | 2 +- include/linux/font.h | 13 +++ include/linux/khugepaged.h | 5 + include/net/xfrm.h | 16 +-- kernel/events/core.c | 5 +- kernel/umh.c | 9 ++ lib/fonts/font_10x18.c | 9 +- lib/fonts/font_6x10.c | 9 +- lib/fonts/font_6x11.c | 9 +- lib/fonts/font_7x14.c | 9 +- lib/fonts/font_8x16.c | 9 +- lib/fonts/font_8x8.c | 9 +- lib/fonts/font_acorn_8x8.c | 9 +- lib/fonts/font_mini_4x6.c | 8 +- lib/fonts/font_pearl_8x8.c | 9 +- lib/fonts/font_sun12x22.c | 9 +- lib/fonts/font_sun8x16.c | 7 +- mm/khugepaged.c | 25 +++- mm/page_alloc.c | 3 + net/openvswitch/conntrack.c | 22 ++-- net/rxrpc/conn_event.c | 6 +- net/rxrpc/key.c | 18 ++- net/sctp/auth.c | 1 + net/wireless/nl80211.c | 3 + net/xfrm/xfrm_interface.c | 2 +- net/xfrm/xfrm_state.c | 42 ++++++- 54 files changed, 391 insertions(+), 209 deletions(-) -- 2.25.1

1 49

[PATCH] perf/core: Fix race in the perf_mmap_close() function
by Yang Yingliang 16 Oct '20

16 Oct '20

From: Jiri Olsa <jolsa(a)redhat.com> mainline inclusion from mainline-v5.10 commit f91072ed1b7283b13ca57fcfbece5a3b92726143 category: bugfix bugzilla: NA CVE: CVE-2020-14351 -------------------------------- There's a possible race in perf_mmap_close() when checking ring buffer's mmap_count refcount value. The problem is that the mmap_count check is not atomic because we call atomic_dec() and atomic_read() separately. perf_mmap_close: ... atomic_dec(&rb->mmap_count); ... if (atomic_read(&rb->mmap_count)) goto out_put; <ring buffer detach> free_uid out_put: ring_buffer_put(rb); /* could be last */ The race can happen when we have two (or more) events sharing same ring buffer and they go through atomic_dec() and then they both see 0 as refcount value later in atomic_read(). Then both will go on and execute code which is meant to be run just once. The code that detaches ring buffer is probably fine to be executed more than once, but the problem is in calling free_uid(), which will later on demonstrate in related crashes and refcount warnings, like: refcount_t: addition on 0; use-after-free. ... RIP: 0010:refcount_warn_saturate+0x6d/0xf ... Call Trace: prepare_creds+0x190/0x1e0 copy_creds+0x35/0x172 copy_process+0x471/0x1a80 _do_fork+0x83/0x3a0 __do_sys_wait4+0x83/0x90 __do_sys_clone+0x85/0xa0 do_syscall_64+0x5b/0x1e0 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Using atomic decrease and check instead of separated calls. Tested-by: Michael Petlan <mpetlan(a)redhat.com> Signed-off-by: Jiri Olsa <jolsa(a)kernel.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Acked-by: Peter Zijlstra <a.p.zijlstra(a)chello.nl> Acked-by: Namhyung Kim <namhyung(a)kernel.org> Acked-by: Wade Mealing <wmealing(a)redhat.com> Fixes: 9bb5d40cd93c ("perf: Fix mmap() accounting hole"); Link: https://lore.kernel.org/r/20200916115311.GE2301783@krava Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Conflicts: kernel/events/core.c [yyl: adjust context] Reviewed-by: Jian Cheng <cj.chengjian(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/events/core.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 30a81d1b7b5c..452775f68129 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -5496,11 +5496,11 @@ static void perf_pmu_output_stop(struct perf_event *event); static void perf_mmap_close(struct vm_area_struct *vma) { struct perf_event *event = vma->vm_file->private_data; - struct ring_buffer *rb = ring_buffer_get(event); struct user_struct *mmap_user = rb->mmap_user; int mmap_locked = rb->mmap_locked; unsigned long size = perf_data_size(rb); + bool detach_rest = false; if (event->pmu->event_unmapped) event->pmu->event_unmapped(event, vma->vm_mm); @@ -5531,7 +5531,8 @@ static void perf_mmap_close(struct vm_area_struct *vma) mutex_unlock(&event->mmap_mutex); } - atomic_dec(&rb->mmap_count); + if (atomic_dec_and_test(&rb->mmap_count)) + detach_rest = true; if (!atomic_dec_and_mutex_lock(&event->mmap_count, &event->mmap_mutex)) goto out_put; @@ -5540,7 +5541,7 @@ static void perf_mmap_close(struct vm_area_struct *vma) mutex_unlock(&event->mmap_mutex); /* If there's still other mmap()s of this buffer, we're done. */ - if (atomic_read(&rb->mmap_count)) + if (!detach_rest) goto out_put; /* -- 2.25.1

1 0

[PATCH] geneve: add transport ports in route lookup for geneve
by Yang Yingliang 15 Oct '20

15 Oct '20

From: Mark Gray <mark.d.gray(a)redhat.com> stable inclusion from linux-4.19.148 commit c797110d97c48054d1491251fd713900ff51615c CVE: CVE-2020-25645 -------------------------------- [ Upstream commit 34beb21594519ce64a55a498c2fe7d567bc1ca20 ] This patch adds transport ports information for route lookup so that IPsec can select Geneve tunnel traffic to do encryption. This is needed for OVS/OVN IPsec with encrypted Geneve tunnels. This can be tested by configuring a host-host VPN using an IKE daemon and specifying port numbers. For example, for an Openswan-type configuration, the following parameters should be configured on both hosts and IPsec set up as-per normal: $ cat /etc/ipsec.conf conn in ... left=$IP1 right=$IP2 ... leftprotoport=udp/6081 rightprotoport=udp ... conn out ... left=$IP1 right=$IP2 ... leftprotoport=udp rightprotoport=udp/6081 ... The tunnel can then be setup using "ip" on both hosts (but changing the relevant IP addresses): $ ip link add tun type geneve id 1000 remote $IP2 $ ip addr add 192.168.0.1/24 dev tun $ ip link set tun up This can then be tested by pinging from $IP1: $ ping 192.168.0.2 Without this patch the traffic is unencrypted on the wire. Fixes: 2d07dc79fe04 ("geneve: add initial netdev driver for GENEVE tunnels") Signed-off-by: Qiuyu Xiao <qiuyu.xiao.qyx(a)gmail.com> Signed-off-by: Mark Gray <mark.d.gray(a)redhat.com> Reviewed-by: Greg Rose <gvrose8192(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/geneve.c | 37 +++++++++++++++++++++++++++---------- 1 file changed, 27 insertions(+), 10 deletions(-) diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c index 1506e913cebb..fdb251e1f471 100644 --- a/drivers/net/geneve.c +++ b/drivers/net/geneve.c @@ -721,7 +721,8 @@ static struct rtable *geneve_get_v4_rt(struct sk_buff *skb, struct net_device *dev, struct geneve_sock *gs4, struct flowi4 *fl4, - const struct ip_tunnel_info *info) + const struct ip_tunnel_info *info, + __be16 dport, __be16 sport) { bool use_cache = ip_tunnel_dst_cache_usable(skb, info); struct geneve_dev *geneve = netdev_priv(dev); @@ -737,6 +738,8 @@ static struct rtable *geneve_get_v4_rt(struct sk_buff *skb, fl4->flowi4_proto = IPPROTO_UDP; fl4->daddr = info->key.u.ipv4.dst; fl4->saddr = info->key.u.ipv4.src; + fl4->fl4_dport = dport; + fl4->fl4_sport = sport; tos = info->key.tos; if ((tos == 1) && !geneve->collect_md) { @@ -771,7 +774,8 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb, struct net_device *dev, struct geneve_sock *gs6, struct flowi6 *fl6, - const struct ip_tunnel_info *info) + const struct ip_tunnel_info *info, + __be16 dport, __be16 sport) { bool use_cache = ip_tunnel_dst_cache_usable(skb, info); struct geneve_dev *geneve = netdev_priv(dev); @@ -787,6 +791,9 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb, fl6->flowi6_proto = IPPROTO_UDP; fl6->daddr = info->key.u.ipv6.dst; fl6->saddr = info->key.u.ipv6.src; + fl6->fl6_dport = dport; + fl6->fl6_sport = sport; + prio = info->key.tos; if ((prio == 1) && !geneve->collect_md) { prio = ip_tunnel_get_dsfield(ip_hdr(skb), skb); @@ -833,14 +840,15 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev, __be16 df; int err; - rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info); + sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); + rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info, + geneve->info.key.tp_dst, sport); if (IS_ERR(rt)) return PTR_ERR(rt); skb_tunnel_check_pmtu(skb, &rt->dst, GENEVE_IPV4_HLEN + info->options_len); - sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); if (geneve->collect_md) { tos = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb); ttl = key->ttl; @@ -875,13 +883,14 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev, __be16 sport; int err; - dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info); + sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); + dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info, + geneve->info.key.tp_dst, sport); if (IS_ERR(dst)) return PTR_ERR(dst); skb_tunnel_check_pmtu(skb, dst, GENEVE_IPV6_HLEN + info->options_len); - sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); if (geneve->collect_md) { prio = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb); ttl = key->ttl; @@ -957,13 +966,18 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) { struct ip_tunnel_info *info = skb_tunnel_info(skb); struct geneve_dev *geneve = netdev_priv(dev); + __be16 sport; if (ip_tunnel_info_af(info) == AF_INET) { struct rtable *rt; struct flowi4 fl4; + struct geneve_sock *gs4 = rcu_dereference(geneve->sock4); + sport = udp_flow_src_port(geneve->net, skb, + 1, USHRT_MAX, true); - rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info); + rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info, + geneve->info.key.tp_dst, sport); if (IS_ERR(rt)) return PTR_ERR(rt); @@ -973,9 +987,13 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) } else if (ip_tunnel_info_af(info) == AF_INET6) { struct dst_entry *dst; struct flowi6 fl6; + struct geneve_sock *gs6 = rcu_dereference(geneve->sock6); + sport = udp_flow_src_port(geneve->net, skb, + 1, USHRT_MAX, true); - dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info); + dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info, + geneve->info.key.tp_dst, sport); if (IS_ERR(dst)) return PTR_ERR(dst); @@ -986,8 +1004,7 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) return -EINVAL; } - info->key.tp_src = udp_flow_src_port(geneve->net, skb, - 1, USHRT_MAX, true); + info->key.tp_src = sport; info->key.tp_dst = geneve->info.key.tp_dst; return 0; } -- 2.25.1

1 0

[PATCH 00/78] bugfixes for openEuler-1.0-LTS
by Yang Yingliang 15 Oct '20

15 Oct '20

Al Grant (1): perf tools: Correct SNOOPX field offset Al Viro (2): do_epoll_ctl(): clean the failure exits up a bit fix regression in "epoll: Keep a reference on files added to the check list" Alex Williamson (1): vfio/type1: Add proper error unwind for vfio_iommu_replay() Alvin Šipraga (1): macvlan: validate setting of multiple remote source MAC addresses Bodo Stroesser (1): scsi: target: tcmu: Fix crash in tcmu_flush_dcache_range on ARM Brian Foster (3): xfs: acquire superblock freeze protection on eofblocks scans xfs: reset buffer write failure state on successful completion xfs: fix duplicate verification from xfs_qm_dqflush() Charan Teja Reddy (1): mm, page_alloc: fix core hung in free_pcppages_bulk() Chris Wilson (1): locking/lockdep: Fix overflow in presentation of average lock-time Chuck Lever (1): NFS: Zero-stateid SETATTR should first return delegation Daniel Borkmann (1): uaccess: Add non-pagefault user-space write function Darrick J. Wong (4): xfs: fix partially uninitialized structure in xfs_reflink_remap_extent xfs: fix inode quota reservation checks xfs: fix xfs_bmap_validate_extent_raw when checking attr fork of rt files xfs: initialize the shortform attr header padding entry Dave Chinner (1): xfs: Don't allow logging of XFS_ISTALE inodes David Milburn (2): nvme-fc: cancel async events before freeing event struct nvme-rdma: cancel async events before freeing event struct Doug Berger (1): mm: include CMA pages in lowmem_reserve at boot Eiichi Tsukata (1): xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init Eric Biggers (1): xfs: clear PF_MEMALLOC before exiting xfsaild thread George Kennedy (1): vt_ioctl: change VT_RESIZEX ioctl to check for error return from vc_resize() Gustav Wiklander (1): spi: Fix memory leak on splited transfers Heikki Krogerus (1): device property: Fix the secondary firmware node handling in set_primary_fwnode() Helge Deller (1): fs/signalfd.c: fix inconsistent return codes for signalfd4 Hou Pu (1): scsi: target: iscsi: Fix hang in iscsit_access_np() when getting tpg->np_login_sem Hugh Dickins (2): khugepaged: khugepaged_test_exit() check mmget_still_valid() khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter() Jan Kara (5): ext4: fix checking of directory entry validity for inline directories ext4: don't BUG on inconsistent journal feature writeback: Protect inode->i_io_list with inode->i_lock writeback: Avoid skipping inode writeback writeback: Fix sync livelock due to b_dirty_time processing Jarkko Sakkinen (1): tpm: Unify the mismatching TPM space buffer sizes Jason Gunthorpe (1): include/linux/log2.h: add missing () around n in roundup_pow_of_two() Javed Hasan (1): scsi: fcoe: Memory leak fix in fcoe_sysfs_fcf_del() Jens Axboe (1): block: ensure bdi->io_pages is always initialized Jing Xiangfeng (1): scsi: iscsi: Do not put host in iscsi_set_flashnode_param() Li Heng (1): efi: add missed destroy_workqueue when efisubsys_init fails Lukas Czerner (3): jbd2: make sure jh have b_transaction set in refile/unfile_buffer ext4: handle read only external journal device ext4: handle option set by mount flags correctly Lukas Wunner (4): spi: Prevent adding devices below an unregistering controller serial: pl011: Fix oops on -EPROBE_DEFER serial: pl011: Don't leak amba_ports entry on driver register error serial: 8250: Avoid error message on reprobe Luo Meng (1): ext4: only set last error block when check system zone failed Mao Wenan (1): virtio_ring: Avoid loop when vq is broken in virtqueue_poll Marc Zyngier (1): epoll: Keep a reference on files added to the check list Masami Hiramatsu (2): perf probe: Fix memory leakage when the probe point is not found uaccess: Add non-pagefault user-space read functions Max Reitz (1): xfs: Fix tail rounding in xfs_alloc_file_space() Mikulas Patocka (2): xfs: don't update mtime on COW faults dm writecache: handle DAX to partitions on persistent memory correctly Ming Lei (1): blk-mq: order adding requests to hctx->dispatch and checking SCHED_RESTART Muchun Song (1): kprobes: fix kill kprobe which has been marked as gone Namhyung Kim (1): perf jevents: Fix suspicious code in fixregex() Peter Xu (1): mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible Peter Zijlstra (1): cpuidle: Fixup IRQ state Qiushi Wu (1): PCI: Fix pci_create_slot() reference count leak Rafael J. Wysocki (1): PM: sleep: core: Fix the handling of pending runtime resume requests Ralph Campbell (1): mm/thp: fix __split_huge_pmd_locked() for migration PMD Robin Murphy (1): iommu/iova: Don't BUG on invalid PFNs Selvin Xavier (1): RDMA/bnxt_re: Do not add user qps to flushlist Sergey Senozhatsky (1): serial: 8250: change lock order in serial8250_do_startup() Sunghyun Jin (1): percpu: fix first chunk size calculation for populated bitmap Tejun Heo (1): libata: implement ATA_HORKAGE_MAX_TRIM_128M and apply to Sandisks Tetsuo Handa (1): vt: defer kfree() of vc_screenbuf in vc_do_resize() Valmer Huhn (1): serial: 8250_exar: Fix number of ports for Commtech PCIe cards Varun Prakash (1): scsi: target: iscsi: Fix data digest calculation Wei Yongjun (1): kernel/relay.c: fix memleak on destroy relay channel Xianting Tian (1): fs: prevent BUG_ON in submit_bh_wbc() Xunlei Pang (1): mm: memcg: fix memcg reclaim soft lockup Yang Xu (1): KEYS: reaching the keys quotas correctly kaixuxia (1): xfs: Fix deadlock between AGI and AGF with RENAME_WHITEOUT zhangyi (F) (1): jbd2: add the missing unlock_buffer() in the error path of jbd2_write_superblock() block/blk-core.c | 2 + block/blk-mq-sched.c | 9 ++ block/blk-mq.c | 9 ++ drivers/ata/libata-core.c | 5 +- drivers/ata/libata-scsi.c | 8 +- drivers/base/core.c | 12 +- drivers/base/power/main.c | 16 ++- drivers/char/tpm/tpm-chip.c | 9 +- drivers/char/tpm/tpm.h | 6 +- drivers/char/tpm/tpm2-space.c | 26 ++-- drivers/char/tpm/tpmrm-dev.c | 2 +- drivers/cpuidle/cpuidle.c | 3 +- drivers/firmware/efi/efi.c | 2 + drivers/infiniband/hw/bnxt_re/main.c | 3 +- drivers/iommu/iova.c | 4 +- drivers/md/dm-writecache.c | 12 +- drivers/net/macvlan.c | 21 ++- drivers/nvme/host/fc.c | 1 + drivers/nvme/host/rdma.c | 1 + drivers/pci/slot.c | 6 +- drivers/scsi/fcoe/fcoe_ctlr.c | 2 +- drivers/scsi/scsi_transport_iscsi.c | 2 +- drivers/spi/Kconfig | 3 + drivers/spi/spi.c | 30 +++- drivers/target/iscsi/iscsi_target.c | 17 ++- drivers/target/iscsi/iscsi_target_login.c | 6 +- drivers/target/iscsi/iscsi_target_login.h | 3 +- drivers/target/iscsi/iscsi_target_nego.c | 3 +- drivers/target/target_core_user.c | 2 +- drivers/tty/serial/8250/8250_core.c | 11 +- drivers/tty/serial/8250/8250_exar.c | 24 +++- drivers/tty/serial/8250/8250_port.c | 9 +- drivers/tty/serial/amba-pl011.c | 16 ++- drivers/tty/vt/vt.c | 5 +- drivers/tty/vt/vt_ioctl.c | 12 +- drivers/vfio/vfio_iommu_type1.c | 71 ++++++++- drivers/virtio/virtio_ring.c | 3 + fs/buffer.c | 9 ++ fs/eventpoll.c | 23 +-- fs/ext4/block_validity.c | 3 +- fs/ext4/namei.c | 6 +- fs/ext4/super.c | 147 ++++++++++++------- fs/fs-writeback.c | 83 ++++++----- fs/jbd2/journal.c | 4 +- fs/jbd2/transaction.c | 10 ++ fs/nfs/nfs4proc.c | 4 +- fs/signalfd.c | 10 +- fs/xfs/libxfs/xfs_attr_leaf.c | 4 +- fs/xfs/libxfs/xfs_bmap.c | 2 +- fs/xfs/xfs_bmap_util.c | 4 +- fs/xfs/xfs_buf.c | 8 +- fs/xfs/xfs_dquot.c | 9 +- fs/xfs/xfs_file.c | 12 +- fs/xfs/xfs_icache.c | 13 +- fs/xfs/xfs_inode.c | 110 ++++++++------ fs/xfs/xfs_ioctl.c | 5 +- fs/xfs/xfs_reflink.c | 1 + fs/xfs/xfs_sysfs.h | 6 +- fs/xfs/xfs_trans_ail.c | 4 +- fs/xfs/xfs_trans_dquot.c | 2 +- fs/xfs/xfs_trans_inode.c | 2 + include/linux/fs.h | 8 +- include/linux/libata.h | 1 + include/linux/log2.h | 2 +- include/linux/uaccess.h | 26 ++++ include/trace/events/writeback.h | 13 +- kernel/kprobes.c | 9 +- kernel/locking/lockdep_proc.c | 2 +- kernel/relay.c | 1 + mm/huge_memory.c | 40 +++--- mm/hugetlb.c | 24 ++-- mm/khugepaged.c | 7 +- mm/maccess.c | 167 ++++++++++++++++++++-- mm/page_alloc.c | 7 +- mm/percpu.c | 2 +- mm/vmscan.c | 8 ++ security/keys/key.c | 2 +- security/keys/keyctl.c | 4 +- tools/include/uapi/linux/perf_event.h | 2 +- tools/perf/pmu-events/jevents.c | 2 +- tools/perf/util/probe-finder.c | 2 +- 81 files changed, 864 insertions(+), 322 deletions(-) -- 2.25.1

1 78

[PATCH 01/11] xfs: Fix tail rounding in xfs_alloc_file_space()
by Yang Yingliang 15 Oct '20

15 Oct '20

From: Max Reitz <mreitz(a)redhat.com> mainline inclusion from mainline-v5.4-rc3 commit e093c4be760ebf46c131ae0dd6138865a22f46fa category: bugfix bugzilla: NA CVE: NA --------------------------- To ensure that all blocks touched by the range [offset, offset + count) are allocated, we need to calculate the block count from the difference of the range end (rounded up) and the range start (rounded down). Before this patch, we just round up the byte count, which may lead to unaligned ranges not being fully allocated: $ touch test_file $ block_size=$(stat -fc '%S' test_file) $ fallocate -o $((block_size / 2)) -l $block_size test_file $ xfs_bmap test_file test_file: 0: [0..7]: 1396264..1396271 1: [8..15]: hole There should not be a hole there. Instead, the first two blocks should be fully allocated. With this patch applied, the result is something like this: $ touch test_file $ block_size=$(stat -fc '%S' test_file) $ fallocate -o $((block_size / 2)) -l $block_size test_file $ xfs_bmap test_file test_file: 0: [0..15]: 11024..11039 Signed-off-by: Max Reitz <mreitz(a)redhat.com> Reviewed-by: Carlos Maiolino <cmaiolino(a)redhat.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Darrick J. Wong <darrick.wong(a)oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong(a)oracle.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: zhangyi (F) <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/xfs/xfs_bmap_util.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c index 3e1dd66bd676..e54f5aed30a9 100644 --- a/fs/xfs/xfs_bmap_util.c +++ b/fs/xfs/xfs_bmap_util.c @@ -869,6 +869,7 @@ xfs_alloc_file_space( xfs_filblks_t allocatesize_fsb; xfs_extlen_t extsz, temp; xfs_fileoff_t startoffset_fsb; + xfs_fileoff_t endoffset_fsb; int nimaps; int quota_flag; int rt; @@ -896,7 +897,8 @@ xfs_alloc_file_space( imapp = &imaps[0]; nimaps = 1; startoffset_fsb = XFS_B_TO_FSBT(mp, offset); - allocatesize_fsb = XFS_B_TO_FSB(mp, count); + endoffset_fsb = XFS_B_TO_FSB(mp, offset + count); + allocatesize_fsb = endoffset_fsb - startoffset_fsb; /* * Allocate file space until done or until there is an error -- 2.25.1

1 10

[PATCH kernel-5.5] RISCV-V: KVM: use __u64 define variables instead of u64 in kvm.h
by l00484210 13 Oct '20

13 Oct '20

From: MingWang Li <limingwang(a)huawei.com> euleros inclusion category: bugfix bugzilla: NA CVE: NA one error occurred while building qemu on riscv system, which is unknown type name 'u64'. Link: https://gitee.com/openeuler/kernel/issues/I1XUB0 Signed-off-by: MingWang Li <limingwang(a)huawei.com> --- arch/riscv/include/uapi/asm/kvm.h | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/arch/riscv/include/uapi/asm/kvm.h b/arch/riscv/include/uapi/asm/kvm.h index 65cd00654..c2b4ad6b1 100644 --- a/arch/riscv/include/uapi/asm/kvm.h +++ b/arch/riscv/include/uapi/asm/kvm.h @@ -75,10 +75,10 @@ struct kvm_riscv_csr { /* TIMER registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */ struct kvm_riscv_timer { - u64 frequency; - u64 time; - u64 compare; - u64 state; + __u64 frequency; + __u64 time; + __u64 compare; + __u64 state; }; /* Possible states for kvm_riscv_timer */ @@ -110,17 +110,17 @@ struct kvm_riscv_timer { /* Timer registers are mapped as type 4 */ #define KVM_REG_RISCV_TIMER (0x04 << KVM_REG_RISCV_TYPE_SHIFT) #define KVM_REG_RISCV_TIMER_REG(name) \ - (offsetof(struct kvm_riscv_timer, name) / sizeof(u64)) + (offsetof(struct kvm_riscv_timer, name) / sizeof(__u64)) /* F extension registers are mapped as type 5 */ #define KVM_REG_RISCV_FP_F (0x05 << KVM_REG_RISCV_TYPE_SHIFT) #define KVM_REG_RISCV_FP_F_REG(name) \ - (offsetof(struct __riscv_f_ext_state, name) / sizeof(u32)) + (offsetof(struct __riscv_f_ext_state, name) / sizeof(__u32)) /* D extension registers are mapped as type 6 */ #define KVM_REG_RISCV_FP_D (0x06 << KVM_REG_RISCV_TYPE_SHIFT) #define KVM_REG_RISCV_FP_D_REG(name) \ - (offsetof(struct __riscv_d_ext_state, name) / sizeof(u64)) + (offsetof(struct __riscv_d_ext_state, name) / sizeof(__u64)) #endif -- 2.19.1

2 1