March 2020 - Kernel - mailweb.openeuler.org

[PATCH v2] net: hns3: remove the unnecessary ccflags
by Zhengyuan Liu 28 Apr '20

28 Apr '20

category: other bugzilla: NA CVE: NA ---------------------------------- The ccflags removed in this patch shouldn't be in open kernel tree. Especially for -fstack-protector-strong, there will be a compile error when CONFIG_STACKPROTECTOR_STRONG isn't enabled. Signed-off-by: Zhengyuan Liu <liuzhengyuan(a)tj.kylinos.cn> --- drivers/net/ethernet/hisilicon/hns3/Makefile | 9 --------- 1 file changed, 9 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/Makefile b/drivers/net/ethernet/hisilicon/hns3/Makefile index 6653e81..0365f1c 100644 --- a/drivers/net/ethernet/hisilicon/hns3/Makefile +++ b/drivers/net/ethernet/hisilicon/hns3/Makefile @@ -3,15 +3,6 @@ # Makefile for the HISILICON network device drivers. # -# Add security options -ccflags-y += -fstack-protector-strong -ccflags-y += -Wl,-z,relro,-z,now -ccflags-y += -Wl,-z,noexecstack -ccflags-y += -D_FORTIFY_SOURCE=2 -O2 -ccflags-y += -fvisibility=hidden -ccflags-y += -Wformat=2 -Wfloat-equal -ccflags-y += -fsigned-char - ccflags-y += -DCONFIG_IT_VALIDATION ccflags-y += -DCONFIG_HNS3_TEST -- 2.7.4

3 2

[PATCH 00/22] Add support for Hygon Dhyana Family 18h processor
by Pu Wen 20 Apr '20

20 Apr '20

As a new x86 CPU Vendor, Chengdu Haiguang IC Design Co., Ltd (Hygon) is a Joint Venture between AMD and Haiguang Information Technology Co., Ltd., and aims at providing high performance x86 processor for China server market. The first generation Hygon's processor(Dhyana) originates from AMD technology and shares most of the architecture with AMD's family 17h, but with different CPU Vendor ID("HygonGenuine")/PCIE Device Vendor ID (0x1D94)/Family series number (Family 18h). To enable the support of Linux kernel to Hygon's CPU, we added a new vendor type (X86_VENDOR_HYGON, with value of 9) in arch/x86/include/ asm/processor.h, and shared most of kernel support codes with AMD family 17h. As Hygon will negotiate with AMD to make sure that only Hygon will use family 18h, so try to minimize code modification and share most codes with AMD under this consideration. This patch series have been applied and tested successfully on Hygon Dhyana SoC silicon. Also tested on AMD EPYC (Family 17h) processor, it works fine and makes no harm to the existing codes. This patch series are created for the current branch openEuler-1.0-LTS. References: [1] Linux kernel patches for Hygon Dhyana, merged in 4.20: https://git.kernel.org/tip/c9661c1e80b609cd038db7c908e061f0535804ef [2] MSR and CPUID definition: https://www.amd.com/system/files/TechDocs/54945_PPR_Family_17h_Models_00h-0… Pu Wen (22): x86/cpu: Create Hygon Dhyana architecture support file x86/cpu: Get cache info and setup cache cpumap for Hygon Dhyana x86/cpu/mtrr: Support TOP_MEM2 and get MTRR number x86/smpboot: Do not use BSP INIT delay and MWAIT to idle on Dhyana x86/events: Add Hygon Dhyana support to PMU infrastructure x86/alternative: Init ideal_nops for Hygon Dhyana x86/amd_nb: Check vendor in AMD-only functions x86/pci, x86/amd_nb: Add Hygon Dhyana support to PCI and northbridge x86/apic: Add Hygon Dhyana support x86/bugs: Add Hygon Dhyana to the respective mitigation machinery x86/mce: Add Hygon Dhyana support to the MCA infrastructure x86/kvm: Add Hygon Dhyana support to KVM x86/xen: Add Hygon Dhyana support to Xen ACPI: Add Hygon Dhyana support cpufreq: Add Hygon Dhyana support EDAC, amd64: Add Hygon Dhyana support tools/cpupower: Add Hygon Dhyana support hwmon: (k10temp) Add Hygon Dhyana support x86/CPU/hygon: Fix phys_proc_id calculation logic for multi-die processors i2c-piix4: Add Hygon Dhyana SMBus support x86/amd_nb: Make hygon_nb_misc_ids static NTB: Add Hygon Device ID Documentation/i2c/busses/i2c-piix4 | 2 + MAINTAINERS | 6 + arch/x86/Kconfig.cpu | 14 + arch/x86/events/amd/core.c | 4 + arch/x86/events/amd/uncore.c | 20 +- arch/x86/events/core.c | 4 + arch/x86/include/asm/amd_nb.h | 3 + arch/x86/include/asm/cacheinfo.h | 1 + arch/x86/include/asm/kvm_emulate.h | 4 + arch/x86/include/asm/mce.h | 2 + arch/x86/include/asm/processor.h | 3 +- arch/x86/include/asm/virtext.h | 5 +- arch/x86/kernel/alternative.c | 4 + arch/x86/kernel/amd_nb.c | 49 ++- arch/x86/kernel/apic/apic.c | 7 + arch/x86/kernel/apic/probe_32.c | 1 + arch/x86/kernel/cpu/Makefile | 1 + arch/x86/kernel/cpu/bugs.c | 4 +- arch/x86/kernel/cpu/cacheinfo.c | 31 +- arch/x86/kernel/cpu/common.c | 4 + arch/x86/kernel/cpu/cpu.h | 1 + arch/x86/kernel/cpu/hygon.c | 413 ++++++++++++++++++ arch/x86/kernel/cpu/mce/core.c | 20 +- arch/x86/kernel/cpu/mce/severity.c | 3 +- arch/x86/kernel/cpu/mtrr/cleanup.c | 3 +- arch/x86/kernel/cpu/mtrr/mtrr.c | 2 +- arch/x86/kernel/cpu/perfctr-watchdog.c | 2 + arch/x86/kernel/smpboot.c | 4 +- arch/x86/kvm/emulate.c | 11 +- arch/x86/pci/amd_bus.c | 6 +- arch/x86/xen/pmu.c | 12 +- drivers/acpi/acpi_pad.c | 1 + drivers/acpi/processor_idle.c | 1 + drivers/cpufreq/acpi-cpufreq.c | 5 + drivers/cpufreq/amd_freq_sensitivity.c | 9 +- drivers/edac/amd64_edac.c | 10 +- drivers/edac/mce_amd.c | 4 +- drivers/hwmon/k10temp.c | 3 +- drivers/i2c/busses/Kconfig | 1 + drivers/i2c/busses/i2c-piix4.c | 15 +- drivers/ntb/hw/amd/ntb_hw_amd.c | 1 + include/linux/pci_ids.h | 2 + tools/power/cpupower/utils/cpufreq-info.c | 6 +- tools/power/cpupower/utils/helpers/amd.c | 4 +- tools/power/cpupower/utils/helpers/cpuid.c | 8 +- tools/power/cpupower/utils/helpers/helpers.h | 2 +- tools/power/cpupower/utils/helpers/misc.c | 2 +- .../utils/idle_monitor/mperf_monitor.c | 3 +- 48 files changed, 668 insertions(+), 55 deletions(-) create mode 100644 arch/x86/kernel/cpu/hygon.c -- 2.23.0

5 28

回复:Re: 答复: [PATCH] KYLIN: hns3: fix a compilation error
by Zhengyuan Liu 31 Mar '20

31 Mar '20

Glad to. I will resend a V2. ---------- 该邮件从移动设备发送 --------------原始邮件-------------- 发件人："Xie XiuQi "<xiexiuqi(a)huawei.com>; 发送时间：2020年3月31日(星期二) 上午10:57 收件人："huangdaode" <huangdaode(a)huawei.com>;"Guohanjun (Hanjun Guo)" <guohanjun(a)huawei.com>;"Zhengyuan Liu" <liuzhengyuan(a)tj.kylinos.cn>;"kernel(a)openeuler.org" <kernel(a)openeuler.org>;"lipeng (Y)" <lipeng321(a)huawei.com>; 主题：Re: 答复: [PATCH] KYLIN: hns3: fix a compilation error ----------------------------------- Hi Zhengyuan, Would you please resend a patch to remove those ccflags? Thanks! On 2020/3/31 9:34, huangdaode wrote: > Yes, I don't think we need these flags in open kernel tree, it's for product compile. > > -----邮件原件----- > 发件人: Xiexiuqi > 发送时间: 2020年3月27日 17:14 > 收件人: Guohanjun (Hanjun Guo) <guohanjun(a)huawei.com>; Zhengyuan Liu <liuzhengyuan(a)tj.kylinos.cn>; kernel(a)openeuler.org; huangdaode <huangdaode(a)huawei.com>; lipeng (Y) <lipeng321(a)huawei.com> > 主题: Re: [PATCH] KYLIN: hns3: fix a compilation error > > Hi Li Peng & Daode, > > Please help to check this patch about hns3's Makefile. > > On 2020/3/27 11:38, Hanjun Guo via Kernel wrote: >> On 2020/3/25 9:12, Zhengyuan Liu wrote: >>> >>> >>> On 2020/3/24 下午9:22, Hanjun Guo wrote: >>>> Hi Zhengyuan, >>>> >>>> On 2020/3/20 18:55, Zhengyuan Liu via Kernel wrote: >>>>> From: Zhengyuan Liu <liuzhengyuan(a)kylinos.cn> >>>>> >>>>> Make stack-protector-strong building flag depend on >>>>> CONFIG_STACKPROTECTOR_STRONG, otherwise there could be a >>>>> copmilation error: >>>>> >>>>>     MODPOST 1532 modules >>>>>     ERROR: "__stack_chk_fail" [drivers/net/ethernet/hisilicon/hns3/hns3_cae.ko] undefined! >>>>>     ERROR: "__stack_chk_guard" [drivers/net/ethernet/hisilicon/hns3/hns3_cae.ko] undefined! >>>>>     ERROR: "__stack_chk_fail" [drivers/net/ethernet/hisilicon/hns3/hns3.ko] undefined! >>>>>     ERROR: "__stack_chk_guard" [drivers/net/ethernet/hisilicon/hns3/hns3.ko] undefined! >>>>>     ERROR: "__stack_chk_fail" [drivers/net/ethernet/hisilicon/hns3/hclgevf.ko] undefined! >>>>>     ERROR: "__stack_chk_guard" [drivers/net/ethernet/hisilicon/hns3/hclgevf.ko] undefined! >>>>>     ERROR: "__stack_chk_fail" [drivers/net/ethernet/hisilicon/hns3/hclge.ko] undefined! >>>>>     ERROR: "__stack_chk_guard" [drivers/net/ethernet/hisilicon/hns3/hclge.ko] undefined! >>>>>     make[1]: *** [scripts/Makefile.modpost:92: __modpost] Error 1 >>>>> >>>>> Signed-off-by: Zhengyuan Liu <liuzhengyuan(a)kylinos.cn> >>>>> --- >>>>>   drivers/net/ethernet/hisilicon/hns3/Makefile | 2 ++ >>>>>   1 file changed, 2 insertions(+) >>>>> >>>>> diff --git a/drivers/net/ethernet/hisilicon/hns3/Makefile >>>>> b/drivers/net/ethernet/hisilicon/hns3/Makefile >>>>> index 6653e81ede9a..f4952f46be7f 100644 >>>>> --- a/drivers/net/ethernet/hisilicon/hns3/Makefile >>>>> +++ b/drivers/net/ethernet/hisilicon/hns3/Makefile >>>>> @@ -4,7 +4,9 @@ >>>>>   # >>>>>     # Add security options >>>>> +ifdef CONFIG_STACKPROTECTOR_STRONG >>>>>   ccflags-y += -fstack-protector-strong >>>> >>>> I'm not sure why we need this compile option, seems we need to >>>> remove all those ccflags-y in this file, I will take a look and get >>>> back to you. >>> >>> Hi Hanjun, thanks for your reply. I'm curious about that ccflags too, the upstream seems to haven't those flags. >> >> I think we need to remove those ccflags, could you please send another >> version of the patch? > > Hi, Hanjun, > I agree with you, we do not need this ccflags in kernel tree. > What do you think, Li Peng & Daode? > > @Li Peng, @Huang Daode. > >> >> Thanks >> Hanjun >> _______________________________________________ >> Kernel mailing list -- kernel(a)openeuler.org To unsubscribe send an >> email to kernel-leave(a)openeuler.org >> >

1 0

Re: [PATCH] KYLIN: hns3: fix a compilation error
by Hanjun Guo 31 Mar '20

31 Mar '20

On 2020/3/25 9:12, Zhengyuan Liu wrote: > > > On 2020/3/24 下午9:22, Hanjun Guo wrote: >> Hi Zhengyuan, >> >> On 2020/3/20 18:55, Zhengyuan Liu via Kernel wrote: >>> From: Zhengyuan Liu <liuzhengyuan(a)kylinos.cn> >>> >>> Make stack-protector-strong building flag depend on >>> CONFIG_STACKPROTECTOR_STRONG, otherwise there could >>> be a copmilation error: >>> >>> MODPOST 1532 modules >>> ERROR: "__stack_chk_fail" [drivers/net/ethernet/hisilicon/hns3/hns3_cae.ko] undefined! >>> ERROR: "__stack_chk_guard" [drivers/net/ethernet/hisilicon/hns3/hns3_cae.ko] undefined! >>> ERROR: "__stack_chk_fail" [drivers/net/ethernet/hisilicon/hns3/hns3.ko] undefined! >>> ERROR: "__stack_chk_guard" [drivers/net/ethernet/hisilicon/hns3/hns3.ko] undefined! >>> ERROR: "__stack_chk_fail" [drivers/net/ethernet/hisilicon/hns3/hclgevf.ko] undefined! >>> ERROR: "__stack_chk_guard" [drivers/net/ethernet/hisilicon/hns3/hclgevf.ko] undefined! >>> ERROR: "__stack_chk_fail" [drivers/net/ethernet/hisilicon/hns3/hclge.ko] undefined! >>> ERROR: "__stack_chk_guard" [drivers/net/ethernet/hisilicon/hns3/hclge.ko] undefined! >>> make[1]: *** [scripts/Makefile.modpost:92: __modpost] Error 1 >>> >>> Signed-off-by: Zhengyuan Liu <liuzhengyuan(a)kylinos.cn> >>> --- >>> drivers/net/ethernet/hisilicon/hns3/Makefile | 2 ++ >>> 1 file changed, 2 insertions(+) >>> >>> diff --git a/drivers/net/ethernet/hisilicon/hns3/Makefile b/drivers/net/ethernet/hisilicon/hns3/Makefile >>> index 6653e81ede9a..f4952f46be7f 100644 >>> --- a/drivers/net/ethernet/hisilicon/hns3/Makefile >>> +++ b/drivers/net/ethernet/hisilicon/hns3/Makefile >>> @@ -4,7 +4,9 @@ >>> # >>> # Add security options >>> +ifdef CONFIG_STACKPROTECTOR_STRONG >>> ccflags-y += -fstack-protector-strong >> >> I'm not sure why we need this compile option, seems we need to remove >> all those ccflags-y in this file, I will take a look and get back to >> you. > > Hi Hanjun, thanks for your reply. I'm curious about that ccflags too, the upstream seems to haven't those flags. I think we need to remove those ccflags, could you please send another version of the patch? Thanks Hanjun

3 3

Re: [Tc] SIG组工作审视
by Fred Li 27 Mar '20

27 Mar '20

Happy to see technical committee members will mentor us. Many thanks in advance. On Fri, Mar 27, 2020 at 7:54 PM myeuler <myeuler(a)163.com> wrote: > > Hi, All tc members, Please do the SIG work review according to this list: > 1. xinwei hu : Virt, system-tool, storage, sig-kernel, sig-community > 2. hong xie : sig-bounds_checking_function, sig-ai-bigdata, security-committee, Runtime, Programming-language > 3. hanjun guo : Private, Packaging, oVirt, Others, Networking, > 4. xiuqi Xie : Kernel, kae, iSulad, Infrastructure, doc > 5. hailiang Zhang : Desktop, DB, Container, Computing > 6. Xun Wang : Compiler, Base-service, A-Tune, atune > 7 Wei Xiong : dev-util, Application, sig-template, sig-mate-desktop > > 请各位委员按照上述的分组对SIG组进行审视，审视的内容包含： > 1. SIG组是否正常运作。是否有明确的负责人。 > 2. 相关的项目是否已经有输出，相关软件是否已经进入gitee仓。 > 3. 相关SIG的主页面是否有明确的介绍信息和完善的说明。 > > 下次TC meeting我们审视一下这些SIG的运作，一些SIG是否需要保留或者合并请各位委员给出建议和意见。 > > 谢谢。 > > > > > _______________________________________________ > Tc mailing list -- tc(a)openeuler.org > To unsubscribe send an email to tc-leave(a)openeuler.org -- Regards Fred Li (李永乐)

1 0

re: How to get guaranteed TF for openeuler.org ?
by ETTA 27 Mar '20

27 Mar '20

Here is how, Guranteed TF above 20 or 30 http://www.str8-creative.io/product/trust-flow-seo-package/ That equals immediate higher rankings TF report attached Regards ETTA Unsubscribe option is available on the footer of our website

1 0

[PATCH] KYLIN: hns3: fix a compilation error
by Zhengyuan Liu 25 Mar '20

25 Mar '20

From: Zhengyuan Liu <liuzhengyuan(a)kylinos.cn> Make stack-protector-strong building flag depend on CONFIG_STACKPROTECTOR_STRONG, otherwise there could be a copmilation error: MODPOST 1532 modules ERROR: "__stack_chk_fail" [drivers/net/ethernet/hisilicon/hns3/hns3_cae.ko] undefined! ERROR: "__stack_chk_guard" [drivers/net/ethernet/hisilicon/hns3/hns3_cae.ko] undefined! ERROR: "__stack_chk_fail" [drivers/net/ethernet/hisilicon/hns3/hns3.ko] undefined! ERROR: "__stack_chk_guard" [drivers/net/ethernet/hisilicon/hns3/hns3.ko] undefined! ERROR: "__stack_chk_fail" [drivers/net/ethernet/hisilicon/hns3/hclgevf.ko] undefined! ERROR: "__stack_chk_guard" [drivers/net/ethernet/hisilicon/hns3/hclgevf.ko] undefined! ERROR: "__stack_chk_fail" [drivers/net/ethernet/hisilicon/hns3/hclge.ko] undefined! ERROR: "__stack_chk_guard" [drivers/net/ethernet/hisilicon/hns3/hclge.ko] undefined! make[1]: *** [scripts/Makefile.modpost:92: __modpost] Error 1 Signed-off-by: Zhengyuan Liu <liuzhengyuan(a)kylinos.cn> --- drivers/net/ethernet/hisilicon/hns3/Makefile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/Makefile b/drivers/net/ethernet/hisilicon/hns3/Makefile index 6653e81ede9a..f4952f46be7f 100644 --- a/drivers/net/ethernet/hisilicon/hns3/Makefile +++ b/drivers/net/ethernet/hisilicon/hns3/Makefile @@ -4,7 +4,9 @@ # # Add security options +ifdef CONFIG_STACKPROTECTOR_STRONG ccflags-y += -fstack-protector-strong +endif ccflags-y += -Wl,-z,relro,-z,now ccflags-y += -Wl,-z,noexecstack ccflags-y += -D_FORTIFY_SOURCE=2 -O2 -- 2.20.1

2 2

[PATCH 0/2] livepatch/core: support jump_label
by Cheng Jian 24 Mar '20

24 Mar '20

livepatch/core: support jump_label Cheng Jian (2): livepatch/core: support jump_label livepatch/core: fix kabi for klp_rel_state include/linux/jump_label.h | 1 + include/linux/module.h | 43 +++++++++++++++++++++++++++++++++++++++++++ kernel/jump_label.c | 16 ++++++++++++++++ kernel/livepatch/core.c | 7 +++++++ kernel/module.c | 5 ++++- 5 files changed, 71 insertions(+), 1 deletion(-) -- 2.7.4

1 2

Re: openEuler-1.0是否完整支持mpam功能
by Xie XiuQi 23 Mar '20

23 Mar '20

On 2020/3/23 9:56, haoxin wrote: > 非常感谢您的回复，谢谢，我还想问下，intel rdt resctrl挂载后下有很多配置文件，例如mon_data下的llc_occupancy、mbm_local_bytes、mbm_total_bytes等，这些是在后续会实现还是不再提供类似文件？ > 近期暂时还没有改动，后续支持鲲鹏930的版本可以考虑。当前如果有场景确实需要，以及有效果的话，也可以考虑提供。 > > > > > > 在 2020-03-23 09:38:58，"Xie XiuQi via Kernel" <kernel(a)openeuler.org> 写道： >> >> >>On 2020/3/23 9:15, haoxin wrote: >>> 您好： >>> 请问目前欧拉这块有关于mpam功能验证的测试方法或者手册吗？ >> >>有一个简单的操作说明，你可以针对场景做一下测试。有问题可以反馈。 >> >>----- >>1 背景 >>MPAM 特性是 ARM v8.4 引入的 Cache QoS, 和内存带宽 QoS 特性. 目前业界与之最接近的是 intel 的 RDT 特性. >>Intel RDT 在 Linux 内核中的使用接口是 resctrl。这是一个基于 kernfs 实现的操作接口。为支持 MPAM 特性, >>我们的目标也是实现类似 intel rdt 的 resctrl 用户接口。 >>社区当前还没有 ARM64 resctrl 接口的实现(arm公司在做, 还没有发开源社区). >> >>2 Quick Start >>Hi620 2P 为例, 其基本情况: >> >>2.1 linux kernel 使能 mpam 特性 >>openEuler 中 mpam 是 preview 特性, 当前版本暂没有商用, 默认没有使能. 如果想在鲲鹏920 2P 板子上验证 mpam 特性, 需要在启动参数中加 mpam 使能. >>openEuler 上使能 mpam, 需要在 /boot/grub2/grub.cfg 或 /boot/efi/EFI/euleros/grub.cfg 中添加 mpam 启动参数. >> >>2.2 挂载 resctrl >>系统启动后, 需要手动 mount resctrl 才能使用. >> >>mount -t resctrl resctrl /sys/fs/resctrl >>cd /sys/fs/resctrl >> >>2.3 配置和使用资源组 >>2.3.1 为 L3 Cache 的 PARTID 1 分配 4 个 Cache way >># 每个目录表示对于的 L3T >>cd /sys/fs/resctrl >> >># 先选择某个 PARTID, 在为其设定 mask, mask 就是对应的 cache way >># 这里选 partid=1, mask=f, 即为 partid 1 分了 0-3 计4条way (共15条way) >>mkdir p1 >>cd p1 >>echo "L3:0=f;1=f;2=f;3=f" > schemata >>cat schemata # 查看设置情况 >>cd .. # 返回上次目录 >> >># 更多的例子 >># partid = 2, N0 (way 5,6), N1 (way 5-8), N2 (way 5,6), N3 (way 5-15) >># mask 16进制 >>mkdir p2 >>cd p2 >>echo "L3:0=30;1=f0;2=30;3=f0" > schemata >>cat schemata # 查看设置情况 >>cd .. # 返回上次目录 >> >>Cache 和内存带宽的 partid 数量不同, 但是 resctrl 接口当前又是Cache和partid同时操作的, 所以当前实现时已最小的为准； >> >>2.3.2 为 Cache/memory bandwidth 设置 monitor, 并观察期使用情况 >>由于 monitor 数量较少, 所以在创建分组的时候没有默认开启, 需要手动开启. >> >># p1 分组已存在, 开启 monitor >>echo 1 > /sys/fs/resctrl/p1/ctrlmon >># 观察该组资源的使用情况 >># L3 Cache 的单位是 Bytes, 表明当前 Cache 被占用这么多; >># Memory Bandwidth 单位是MB/s (架构要求的是 MB/s, 鲲鹏920 看具体实现) >>grep . /sys/fs/resctrl/p1/mon_data/* >> >>2.3.3 为进程/线程分配分组(让进程/线程只使用某个 part 的资源) >># task 19 将使用 partid 1 限定的资源 (pmg 在监控的时候用, pmg 和 partid 都匹配, 才进行统计监控使用情况) >># 将 task 19 move 到 p1 资源组中 >># 新创建的子进程, 将继承父进程的 partid 和 pmg 信息 >># move 进程时, 已创建的子进程不影响 >>echo 19 > /sys/fs/resctrl/p1/tasks >> >># 设置当前 shell 使用那个组的Cache资源 ($$ 表示当前 shell 的 PID) >>echo $$ > /sys/fs/resctrl/p1/tasks >> >># 查看 task 的设置情况 >>cat /sys/fs/resctrl/p1/tasks >> >>2.3.4 为 cpu 分配分组(让指定的 cpu 只使用某个 part 的资源) >>即, 该 cpu 上发出的所有请求都是要改资源组限定的资源(cache, memory bandwidth) >> >># task 1 将使用 partid 2 限定的资源 (pmg 在监控的时候用, pmg 和 partid 都匹配, 才进行统计监控使用情况) >># 将 cpu 1 move 到 p2 资源组中 >>echo 1 > /sys/fs/resctrl/p2/cpus_list >> >># 查看 task 的设置情况 >>cat /sys/fs/resctrl/p2/cpus # 掩码方式显示 >>cat /sys/fs/resctrl/p2/cpus_list # 列表方式显示 >> >>2.4 内存带宽资源划分 >> >>2.4.1 为 PART 1 设置内存带宽的上限 >># PART 1, 最多使用约 50% 的带宽; >># 0,1,2,3 分别表示 4 个 numa node >># 带宽按照百分比进行设置, 最小粒度是 5% 对齐. >> >>echo "MB:0=50;1=50;2=50;3=50" > /sys/fs/resctrl/p1/schemata >> >>2.4.3 分配进程(pid)到资源分组 >>挂载 resctrl >>cache 资源划分 >>设置 monitor >>起测试程序 (假设 lat_mem_rd 程序在 /root 目录下面, 其他随便什么程序都一样) >># 挂载 mpamctrl >>mount -t resctrl resctrl /sys/fs/resctrl >>cd /sys/fs/resctrl >> >># 使用 part 1, 为其分配 4 个way (4 个 node 采用相同的设置) >># partid=1, mask=f >>mkdir p1 >>echo "L3:0=f;1=f;2=f;3=f" > schemata >> >># 使用 monitor 1 来监控 part 1 的 cache 使用情况 >># monitor=1, pmg=1, partid=1 >>echo 1 > p1/ctrlmon >> >># 设置当前 shell 进程使用 partid 1 (task 使用哪个 part, 在子进程创建时会继承父进程的) >># 两个 $$ 代表当前 shell 的pid >>echo $$ > p1/tasks >> >># 在后台跑测试程序, 测试结果记录到 result.log 中 >>cd /root >>/root/lat_mem_rd -P 1 -N 1 512M 64 > result.log 2 > &1 & >> >># lat_mem_rd 测试完成后查看结果. >>如果想再测 8 way 的情况, 则只需改 CPBM 的 mask 即可: >> >>echo "L3:0=ff;1=ff;2=ff;3=ff" > schemata >>测试过程中如果想观察 Cache 的使用情况 >> >>grep . /sys/fs/resctrl/p1/mon_data/L3* >> >>3.2 限制内存带宽的例子 >>步骤: >> >>挂载 resctrl >>限制资源划分 >>设置 monitor >>起测试程序 >>mount -t resctrl resctrl /sys/fs/resctrl >>cd /sys/fs/resctrl >> >># 0/100 表示不限制 >># 其他数值表示最大带宽设置的百分比(硬件限制的粒度是 1/64, 软件上近似对应成百分比, 最小按5%对齐). >>mkdir p1 >>echo "MB:0=30;1=30;2=30;3=30" > p1/schemata >>echo 1 > p1/ctrlmon >> >># 设置当前 shell 进程使用 partid 1 (task 使用哪个 part, 在子进程创建时会继承父进程的) >># 两个 $$ 代表当前 shell 的pid >>echo $$ > /sys/fs/resctrl/p1/tasks >># 在后台跑测试程序, 测试结果记录到 result.log 中 >>cd /root >>/root/bw_mem -P 1 -N 1 512M rd > result.log 2 > &1 & >> >># 观察monitor情况 >>cd /sys/fs/resctrl >># monitor=1 >>grep . /sys/fs/resctrl/p1/mon_data/MB* >> >> >>> >>> 此外目前resctrl挂载后和intel rdt进行了对比，发现很多文件都不存在，例如请问是代码还未完成还是做了简化？ >>> >>> 例如我在info目录下有L3_MON目录，按照intel rdt的处理，应该有下面一些子文件：但是在mpam下面就没有 >>> >>> “num_rmids”: >>> The number of RMIDs available. This is the upper bound for how many “CTRL_MON” + “MON” groups can be created. >>> “mon_features”: >>> Lists the monitoring events if monitoring is enabled for the resource. >>> “max_threshold_occupancy”: >>> Read/write file provides the largest value (in bytes) at which a previously used LLC_occupancy counter can be considered for re-use. >>> >>> >>> >>> >>> >>_______________________________________________ >>Kernel mailing list -- kernel(a)openeuler.org >>To unsubscribe send an email to kernel-leave(a)openeuler.org > > > > >

1 0

Re: openEuler-1.0是否完整支持mpam功能
by Xie XiuQi 23 Mar '20

23 Mar '20

On 2020/3/23 9:15, haoxin wrote: > 您好： > 请问目前欧拉这块有关于mpam功能验证的测试方法或者手册吗？有一个简单的操作说明，你可以针对场景做一下测试。有问题可以反馈。 ----- 1 背景 MPAM 特性是 ARM v8.4 引入的 Cache QoS, 和内存带宽 QoS 特性. 目前业界与之最接近的是 intel 的 RDT 特性. Intel RDT 在 Linux 内核中的使用接口是 resctrl。这是一个基于 kernfs 实现的操作接口。为支持 MPAM 特性, 我们的目标也是实现类似 intel rdt 的 resctrl 用户接口。社区当前还没有 ARM64 resctrl 接口的实现(arm公司在做, 还没有发开源社区). 2 Quick Start Hi620 2P 为例, 其基本情况: 2.1 linux kernel 使能 mpam 特性 openEuler 中 mpam 是 preview 特性, 当前版本暂没有商用, 默认没有使能. 如果想在鲲鹏920 2P 板子上验证 mpam 特性, 需要在启动参数中加 mpam 使能. openEuler 上使能 mpam, 需要在 /boot/grub2/grub.cfg 或 /boot/efi/EFI/euleros/grub.cfg 中添加 mpam 启动参数. 2.2 挂载 resctrl 系统启动后, 需要手动 mount resctrl 才能使用. mount -t resctrl resctrl /sys/fs/resctrl cd /sys/fs/resctrl 2.3 配置和使用资源组 2.3.1 为 L3 Cache 的 PARTID 1 分配 4 个 Cache way # 每个目录表示对于的 L3T cd /sys/fs/resctrl # 先选择某个 PARTID, 在为其设定 mask, mask 就是对应的 cache way # 这里选 partid=1, mask=f, 即为 partid 1 分了 0-3 计4条way (共15条way) mkdir p1 cd p1 echo "L3:0=f;1=f;2=f;3=f" > schemata cat schemata # 查看设置情况 cd .. # 返回上次目录 # 更多的例子 # partid = 2, N0 (way 5,6), N1 (way 5-8), N2 (way 5,6), N3 (way 5-15) # mask 16进制 mkdir p2 cd p2 echo "L3:0=30;1=f0;2=30;3=f0" > schemata cat schemata # 查看设置情况 cd .. # 返回上次目录 Cache 和内存带宽的 partid 数量不同, 但是 resctrl 接口当前又是Cache和partid同时操作的, 所以当前实现时已最小的为准； 2.3.2 为 Cache/memory bandwidth 设置 monitor, 并观察期使用情况由于 monitor 数量较少, 所以在创建分组的时候没有默认开启, 需要手动开启. # p1 分组已存在, 开启 monitor echo 1 > /sys/fs/resctrl/p1/ctrlmon # 观察该组资源的使用情况 # L3 Cache 的单位是 Bytes, 表明当前 Cache 被占用这么多; # Memory Bandwidth 单位是MB/s (架构要求的是 MB/s, 鲲鹏920 看具体实现) grep . /sys/fs/resctrl/p1/mon_data/* 2.3.3 为进程/线程分配分组(让进程/线程只使用某个 part 的资源) # task 19 将使用 partid 1 限定的资源 (pmg 在监控的时候用, pmg 和 partid 都匹配, 才进行统计监控使用情况) # 将 task 19 move 到 p1 资源组中 # 新创建的子进程, 将继承父进程的 partid 和 pmg 信息 # move 进程时, 已创建的子进程不影响 echo 19 > /sys/fs/resctrl/p1/tasks # 设置当前 shell 使用那个组的Cache资源 ($$ 表示当前 shell 的 PID) echo $$ > /sys/fs/resctrl/p1/tasks # 查看 task 的设置情况 cat /sys/fs/resctrl/p1/tasks 2.3.4 为 cpu 分配分组(让指定的 cpu 只使用某个 part 的资源) 即, 该 cpu 上发出的所有请求都是要改资源组限定的资源(cache, memory bandwidth) # task 1 将使用 partid 2 限定的资源 (pmg 在监控的时候用, pmg 和 partid 都匹配, 才进行统计监控使用情况) # 将 cpu 1 move 到 p2 资源组中 echo 1 > /sys/fs/resctrl/p2/cpus_list # 查看 task 的设置情况 cat /sys/fs/resctrl/p2/cpus # 掩码方式显示 cat /sys/fs/resctrl/p2/cpus_list # 列表方式显示 2.4 内存带宽资源划分 2.4.1 为 PART 1 设置内存带宽的上限 # PART 1, 最多使用约 50% 的带宽; # 0,1,2,3 分别表示 4 个 numa node # 带宽按照百分比进行设置, 最小粒度是 5% 对齐. echo "MB:0=50;1=50;2=50;3=50" > /sys/fs/resctrl/p1/schemata 2.4.3 分配进程(pid)到资源分组挂载 resctrl cache 资源划分设置 monitor 起测试程序 (假设 lat_mem_rd 程序在 /root 目录下面, 其他随便什么程序都一样) # 挂载 mpamctrl mount -t resctrl resctrl /sys/fs/resctrl cd /sys/fs/resctrl # 使用 part 1, 为其分配 4 个way (4 个 node 采用相同的设置) # partid=1, mask=f mkdir p1 echo "L3:0=f;1=f;2=f;3=f" > schemata # 使用 monitor 1 来监控 part 1 的 cache 使用情况 # monitor=1, pmg=1, partid=1 echo 1 > p1/ctrlmon # 设置当前 shell 进程使用 partid 1 (task 使用哪个 part, 在子进程创建时会继承父进程的) # 两个 $$ 代表当前 shell 的pid echo $$ > p1/tasks # 在后台跑测试程序, 测试结果记录到 result.log 中 cd /root /root/lat_mem_rd -P 1 -N 1 512M 64 > result.log 2 > &1 & # lat_mem_rd 测试完成后查看结果. 如果想再测 8 way 的情况, 则只需改 CPBM 的 mask 即可: echo "L3:0=ff;1=ff;2=ff;3=ff" > schemata 测试过程中如果想观察 Cache 的使用情况 grep . /sys/fs/resctrl/p1/mon_data/L3* 3.2 限制内存带宽的例子步骤: 挂载 resctrl 限制资源划分设置 monitor 起测试程序 mount -t resctrl resctrl /sys/fs/resctrl cd /sys/fs/resctrl # 0/100 表示不限制 # 其他数值表示最大带宽设置的百分比(硬件限制的粒度是 1/64, 软件上近似对应成百分比, 最小按5%对齐). mkdir p1 echo "MB:0=30;1=30;2=30;3=30" > p1/schemata echo 1 > p1/ctrlmon # 设置当前 shell 进程使用 partid 1 (task 使用哪个 part, 在子进程创建时会继承父进程的) # 两个 $$ 代表当前 shell 的pid echo $$ > /sys/fs/resctrl/p1/tasks # 在后台跑测试程序, 测试结果记录到 result.log 中 cd /root /root/bw_mem -P 1 -N 1 512M rd > result.log 2 > &1 & # 观察monitor情况 cd /sys/fs/resctrl # monitor=1 grep . /sys/fs/resctrl/p1/mon_data/MB* > > 此外目前resctrl挂载后和intel rdt进行了对比，发现很多文件都不存在，例如请问是代码还未完成还是做了简化？ > > 例如我在info目录下有L3_MON目录，按照intel rdt的处理，应该有下面一些子文件：但是在mpam下面就没有 > > “num_rmids”: > The number of RMIDs available. This is the upper bound for how many “CTRL_MON” + “MON” groups can be created. > “mon_features”: > Lists the monitoring events if monitoring is enabled for the resource. > “max_threshold_occupancy”: > Read/write file provides the largest value (in bytes) at which a previously used LLC_occupancy counter can be considered for re-use. > > > > >

1 0

[PATCH 0/2] update openeuler_defconfig
by Yang Yingliang 21 Mar '20

21 Mar '20

Xie XiuQi (1): x86/config: enable CONFIG_CFQ_GROUP_IOSCHED Xiongfeng Wang (1): x86/openeuler_config: disable CONFIG_EFI_VARS arch/x86/configs/openeuler_defconfig | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) -- 1.8.3

1 2

[PATCH] btrfs: don't use WARN_ON when ret is -ENOTENT in __btrfs_free_extent()
by Yang Yingliang 20 Mar '20

20 Mar '20

hulk inclusion category: bugfix bugzilla: 13690 CVE: CVE-2019-19039 ------------------------------------------------- Avoid register messages when ret is -ENOTENT. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/btrfs/extent-tree.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c index 47ca1eb..4bf9318 100644 --- a/fs/btrfs/extent-tree.c +++ b/fs/btrfs/extent-tree.c @@ -6793,7 +6793,7 @@ static int __btrfs_free_extent(struct btrfs_trans_handle *trans, } extent_slot = path->slots[0]; } - } else if (WARN_ON(ret == -ENOENT)) { + } else if (ret == -ENOENT) { btrfs_print_leaf(path->nodes[0]); btrfs_err(info, "unable to find ref byte nr %llu parent %llu root %llu owner %llu offset %llu", -- 1.8.3

1 0

[PATCH v2] cifs: fix panic in smb2_reconnect
by Yang Yingliang 20 Mar '20

20 Mar '20

From: Ronnie Sahlberg <lsahlber(a)redhat.com> mainline inclusion from mainline-5.2-rc6 commit 0ff2b018b02f category: bugfix bugzilla: 16811 CVE: NA https://gitee.com/src-openeuler/cifs-utils/issues/I1C1QY?from=project-issue ------------------------------------------------- RH Bugzilla: 1702264 We need to protect so that the call to smb2_reconnect() in smb2_reconnect_server() does not end up freeing the session because it can lead to a use after free and crash. Reviewed-by: Aurelien Aptel <aaptel(a)suse.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Ronnie Sahlberg <lsahlber(a)redhat.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Reviewed-by: Pavel Shilovsky <pshilov(a)microsoft.com> Conflicts: fs/cifs/cifsproto.h fs/cifs/connect.c [yyl: make cifs_put_smb_ses() extern] --- fs/cifs/cifsproto.h | 2 ++ fs/cifs/connect.c | 3 +-- fs/cifs/smb2pdu.c | 10 +++++++++- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h index d7ac75e..bd97f2a 100644 --- a/fs/cifs/cifsproto.h +++ b/fs/cifs/cifsproto.h @@ -526,6 +526,8 @@ extern int E_md4hash(const unsigned char *passwd, unsigned char *p16, extern int SMBencrypt(unsigned char *passwd, const unsigned char *c8, unsigned char *p24); +extern void cifs_put_smb_ses(struct cifs_ses *ses); + void cifs_readdata_release(struct kref *refcount); int cifs_async_readv(struct cifs_readdata *rdata); int cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid); diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 975f800..f031420 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -2733,8 +2733,7 @@ static int match_session(struct cifs_ses *ses, struct smb_vol *vol) return NULL; } -static void -cifs_put_smb_ses(struct cifs_ses *ses) +void cifs_put_smb_ses(struct cifs_ses *ses) { unsigned int rc, xid; struct TCP_Server_Info *server = ses->server; diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 99efb2b..76dfb4f 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -2920,9 +2920,14 @@ void smb2_reconnect_server(struct work_struct *work) tcon_exist = true; } } + /* + * IPC has the same lifetime as its session and uses its + * refcount. + */ if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) { list_add_tail(&ses->tcon_ipc->rlist, &tmp_list); tcon_exist = true; + ses->ses_count++; } } /* @@ -2941,7 +2946,10 @@ void smb2_reconnect_server(struct work_struct *work) else resched = true; list_del_init(&tcon->rlist); - cifs_put_tcon(tcon); + if (tcon->ipc) + cifs_put_smb_ses(tcon->ses); + else + cifs_put_tcon(tcon); } cifs_dbg(FYI, "Reconnecting tcons finished\n"); -- 1.8.3

1 0

[PATCH] fs/cifs: cifs fix panic in smb2_reconnect
by linfeilong 19 Mar '20

19 Mar '20

From: Ronnie Sahlberg <lsahlber(a)redhat.com> mainline inclusion from mainline-v5.1-rc1 commit 0ff2b018b02f89da26a616e0148582321a00fd99 category: bugfix bugzilla: 1702264 CVE: NA ------------------------------------------------- We need to protect so that the call to smb2_reconnect() in smb2_reconnect_server() does not end up freeing the session because it can lead to a use after free and crash. [ 397.787693] CIFS VFS: cifs_mount failed w/return code = -2 [ 403.671998] BUG: unable to handle kernel NULL pointer dereference at 0000000000000000 [ 403.672065] PGD 0 P4D 0 [ 403.672087] Oops: 0000 [#1] SMP PTI [ 403.672114] CPU: 3 PID: 47 Comm: kworker/3:1 Kdump: loaded Not tainted 4.19.90-2003.1.1.0033.oe1.x86_64 #1 [ 403.672173] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.10.2-0-g5f4c7b1-20181220_000000-szxrtosci10000 04/01/2014 [ 403.673038] Workqueue: cifsiod smb2_reconnect_server [cifs] [ 403.673746] RIP: 0010:__list_del_entry_valid+0x25/0x90 [ 403.674448] Code: c3 0f 1f 40 00 48 8b 07 48 b9 00 01 00 00 00 00 ad de 48 8b 57 08 48 39 c8 74 26 48 b9 00 02 00 00 00 00 ad de 48 39 ca 74 2e <48> 8b 32 48 39 fe 75 3a 48 8b 50 08 48 39 f2 75 48 b8 01 00 00 00 [ 403.675955] RSP: 0018:ffffbd48007c3e18 EFLAGS: 00010207 [ 403.676696] RAX: 0000000000000000 RBX: ffffbd48007c3e50 RCX: dead000000000200 [ 403.677447] RDX: 0000000000000000 RSI: 0000000000000206 RDI: ffff9bee27f65818 [ 403.678214] RBP: ffffbd48007c3e38 R08: ffff9bee3bba3038 R09: 00000000000002c2 [ 403.679001] R10: ffffbd48006a3d90 R11: 0000000000000000 R12: ffff9bee27f66818 [ 403.679811] R13: 0000000000000001 R14: ffff9bee27f65800 R15: ffff9bee27f65818 [ 403.680639] FS: 0000000000000000(0000) GS:ffff9bee3bb80000(0000) knlGS:0000000000000000 [ 403.681505] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 403.682391] CR2: 0000000000000000 CR3: 000000003040a005 CR4: 00000000003606e0 [ 403.683315] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 403.684247] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 403.685181] Call Trace: [ 403.686141] smb2_reconnect_server+0x17a/0x340 [cifs] [ 403.687118] process_one_work+0x195/0x3d0 [ 403.688102] worker_thread+0x30/0x390 [ 403.689096] ? process_one_work+0x3d0/0x3d0 [ 403.690111] kthread+0x113/0x130 [ 403.691132] ? kthread_create_worker_on_cpu+0x70/0x70 [ 403.692181] ret_from_fork+0x35/0x40 Reviewed-by: Aurelien Aptel <aaptel(a)suse.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Ronnie Sahlberg <lsahlber(a)redhat.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Reviewed-by: Pavel Shilovsky <pshilov(a)microsoft.com> Signed-off-by: Feilong Lin <linfeilong(a)huawei.com> --- fs/cifs/cifsproto.h | 2 ++ fs/cifs/connect.c | 3 +-- fs/cifs/smb2pdu.c | 10 +++++++++- 3 files changed, 12 insertions(+), 3 deletions(-) diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h index d7ac75e..bd97f2a 100644 --- a/fs/cifs/cifsproto.h +++ b/fs/cifs/cifsproto.h @@ -526,6 +526,8 @@ extern int E_md4hash(const unsigned char *passwd, unsigned char *p16, extern int SMBencrypt(unsigned char *passwd, const unsigned char *c8, unsigned char *p24); +extern void cifs_put_smb_ses(struct cifs_ses *ses); + void cifs_readdata_release(struct kref *refcount); int cifs_async_readv(struct cifs_readdata *rdata); int cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid); diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 7e85070..2e46a8a 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -2732,8 +2732,7 @@ cifs_find_smb_ses(struct TCP_Server_Info *server, struct smb_vol *vol) return NULL; } -static void -cifs_put_smb_ses(struct cifs_ses *ses) +void cifs_put_smb_ses(struct cifs_ses *ses) { unsigned int rc, xid; struct TCP_Server_Info *server = ses->server; diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c index 30417d4..97995b2 100644 --- a/fs/cifs/smb2pdu.c +++ b/fs/cifs/smb2pdu.c @@ -2914,9 +2914,14 @@ void smb2_reconnect_server(struct work_struct *work) tcon_exist = true; } } + /* + * IPC has the same lifetime as its session and uses its + * refcount. + */ if (ses->tcon_ipc && ses->tcon_ipc->need_reconnect) { list_add_tail(&ses->tcon_ipc->rlist, &tmp_list); tcon_exist = true; + ses->ses_count++; } } /* @@ -2935,7 +2940,10 @@ void smb2_reconnect_server(struct work_struct *work) else resched = true; list_del_init(&tcon->rlist); - cifs_put_tcon(tcon); + if (tcon->ipc) + cifs_put_smb_ses(tcon->ses); + else + cifs_put_tcon(tcon); } cifs_dbg(FYI, "Reconnecting tcons finished\n"); -- 1.8.3.1

1 0

[PATCH 1/2] xfs: always init fdblocks in mount
by Yang Yingliang 18 Mar '20

18 Mar '20

From: Zheng Bin <zhengbin13(a)huawei.com> hulk inclusion category: bugfix bugzilla: 31088 CVE: NA --------------------------- Use fuzz(hydra) to test XFS and automatically generate tmp.img(XFS v5 format, but some metadata is wrong) xfs_repair information(just one AG): agf_freeblks 0, counted 3224 in ag 0 agf_longest 0, counted 3224 in ag 0 sb_fdblocks 3228, counted 3224 Test as follows: mount tmp.img tmpdir cp file1M tmpdir sync In 4.19-stable, sync will stuck, while in linux-next, sync not stuck. The reason is same to commit d0c7feaf8767 ("xfs: add agf freeblocks verify in xfs_agf_verify"), cause agf_longest is 0, we can not block this in xfs_agf_verify. Make sure fdblocks is always inited in mount(also init ifree, icount). xfs_mountfs xfs_check_summary_counts xfs_initialize_perag_data Signed-off-by: Zheng Bin <zhengbin13(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/xfs/libxfs/xfs_ag_resv.c | 11 +++++++---- fs/xfs/xfs_mount.c | 33 --------------------------------- 2 files changed, 7 insertions(+), 37 deletions(-) diff --git a/fs/xfs/libxfs/xfs_ag_resv.c b/fs/xfs/libxfs/xfs_ag_resv.c index e2ba2a3..4f099fc 100644 --- a/fs/xfs/libxfs/xfs_ag_resv.c +++ b/fs/xfs/libxfs/xfs_ag_resv.c @@ -309,10 +309,13 @@ } #ifdef DEBUG - /* need to read in the AGF for the ASSERT below to work */ - error = xfs_alloc_pagf_init(pag->pag_mount, tp, pag->pag_agno, 0); - if (error) - return error; + if (!pag->pagf_init) { + /* need to read in the AGF for the ASSERT below to work */ + error = xfs_alloc_pagf_init(pag->pag_mount, tp, + pag->pag_agno, 0); + if (error) + return error; + } ASSERT(xfs_perag_resv(pag, XFS_AG_RESV_METADATA)->ar_reserved + xfs_perag_resv(pag, XFS_AG_RESV_RMAPBT)->ar_reserved <= diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c index 02d1509..3af91e2 100644 --- a/fs/xfs/xfs_mount.c +++ b/fs/xfs/xfs_mount.c @@ -624,39 +624,6 @@ return -EFSCORRUPTED; } - /* - * Now the log is mounted, we know if it was an unclean shutdown or - * not. If it was, with the first phase of recovery has completed, we - * have consistent AG blocks on disk. We have not recovered EFIs yet, - * but they are recovered transactionally in the second recovery phase - * later. - * - * If the log was clean when we mounted, we can check the summary - * counters. If any of them are obviously incorrect, we can recompute - * them from the AGF headers in the next step. - */ - if (XFS_LAST_UNMOUNT_WAS_CLEAN(mp) && - (mp->m_sb.sb_fdblocks > mp->m_sb.sb_dblocks || - !xfs_verify_icount(mp, mp->m_sb.sb_icount) || - mp->m_sb.sb_ifree > mp->m_sb.sb_icount)) - mp->m_flags |= XFS_MOUNT_BAD_SUMMARY; - - /* - * We can safely re-initialise incore superblock counters from the - * per-ag data. These may not be correct if the filesystem was not - * cleanly unmounted, so we waited for recovery to finish before doing - * this. - * - * If the filesystem was cleanly unmounted or the previous check did - * not flag anything weird, then we can trust the values in the - * superblock to be correct and we don't need to do anything here. - * Otherwise, recalculate the summary counters. - */ - if ((!xfs_sb_version_haslazysbcount(&mp->m_sb) || - XFS_LAST_UNMOUNT_WAS_CLEAN(mp)) && - !(mp->m_flags & XFS_MOUNT_BAD_SUMMARY)) - return 0; - return xfs_initialize_perag_data(mp, mp->m_sb.sb_agcount); } -- 1.8.3

1 1

[PATCH] xfs: devirtualize ->sf_entsize and ->sf_nextentry
by Yang Yingliang 18 Mar '20

18 Mar '20

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-5.5-rc1 commit 50f6bb6b7aea8177110e55355c455f18912a7a73 category: bugfix bugzilla: 31596 CVE: NA --------------------------- Just check for file-type enabled directories directly. Signed-off-by: Christoph Hellwig <hch(a)lst.de> Reviewed-by: Darrick J. Wong <darrick.wong(a)oracle.com> Signed-off-by: Darrick J. Wong <darrick.wong(a)oracle.com> Conflicts: fs/xfs/libxfs/xfs_dir2_priv.h fs/xfs/libxfs/xfs_dir2_sf.c fs/xfs/xfs_dir2_readdir.c [zb: since patch 84915e1bdddf, 707e0ddaf67e, e91ec882af21, 04df34ac6494 not merged, adjust code] Signed-off-by: Zheng Bin <zhengbin13(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/xfs/libxfs/xfs_da_format.c | 48 --------------------- fs/xfs/libxfs/xfs_dir2.h | 4 -- fs/xfs/libxfs/xfs_dir2_block.c | 2 +- fs/xfs/libxfs/xfs_dir2_priv.h | 2 + fs/xfs/libxfs/xfs_dir2_sf.c | 96 +++++++++++++++++++++++++----------------- fs/xfs/xfs_dir2_readdir.c | 7 +-- 6 files changed, 64 insertions(+), 95 deletions(-) diff --git a/fs/xfs/libxfs/xfs_da_format.c b/fs/xfs/libxfs/xfs_da_format.c index b39053d..39c2610 100644 --- a/fs/xfs/libxfs/xfs_da_format.c +++ b/fs/xfs/libxfs/xfs_da_format.c @@ -18,48 +18,6 @@ #include "xfs_dir2_priv.h" /* - * Shortform directory ops - */ -static int -xfs_dir2_sf_entsize( - struct xfs_dir2_sf_hdr *hdr, - int len) -{ - int count = sizeof(struct xfs_dir2_sf_entry); /* namelen + offset */ - - count += len; /* name */ - count += hdr->i8count ? XFS_INO64_SIZE : XFS_INO32_SIZE; /* ino # */ - return count; -} - -static int -xfs_dir3_sf_entsize( - struct xfs_dir2_sf_hdr *hdr, - int len) -{ - return xfs_dir2_sf_entsize(hdr, len) + sizeof(uint8_t); -} - -static struct xfs_dir2_sf_entry * -xfs_dir2_sf_nextentry( - struct xfs_dir2_sf_hdr *hdr, - struct xfs_dir2_sf_entry *sfep) -{ - return (struct xfs_dir2_sf_entry *) - ((char *)sfep + xfs_dir2_sf_entsize(hdr, sfep->namelen)); -} - -static struct xfs_dir2_sf_entry * -xfs_dir3_sf_nextentry( - struct xfs_dir2_sf_hdr *hdr, - struct xfs_dir2_sf_entry *sfep) -{ - return (struct xfs_dir2_sf_entry *) - ((char *)sfep + xfs_dir3_sf_entsize(hdr, sfep->namelen)); -} - - -/* * For filetype enabled shortform directories, the file type field is stored at * the end of the name. Because it's only a single byte, endian conversion is * not necessary. For non-filetype enable directories, the type is always @@ -692,8 +650,6 @@ } static const struct xfs_dir_ops xfs_dir2_ops = { - .sf_entsize = xfs_dir2_sf_entsize, - .sf_nextentry = xfs_dir2_sf_nextentry, .sf_get_ftype = xfs_dir2_sfe_get_ftype, .sf_put_ftype = xfs_dir2_sfe_put_ftype, .sf_get_ino = xfs_dir2_sfe_get_ino, @@ -742,8 +698,6 @@ }; static const struct xfs_dir_ops xfs_dir2_ftype_ops = { - .sf_entsize = xfs_dir3_sf_entsize, - .sf_nextentry = xfs_dir3_sf_nextentry, .sf_get_ftype = xfs_dir3_sfe_get_ftype, .sf_put_ftype = xfs_dir3_sfe_put_ftype, .sf_get_ino = xfs_dir3_sfe_get_ino, @@ -792,8 +746,6 @@ }; static const struct xfs_dir_ops xfs_dir3_ops = { - .sf_entsize = xfs_dir3_sf_entsize, - .sf_nextentry = xfs_dir3_sf_nextentry, .sf_get_ftype = xfs_dir3_sfe_get_ftype, .sf_put_ftype = xfs_dir3_sfe_put_ftype, .sf_get_ino = xfs_dir3_sfe_get_ino, diff --git a/fs/xfs/libxfs/xfs_dir2.h b/fs/xfs/libxfs/xfs_dir2.h index c3e3f6b..155bae5 100644 --- a/fs/xfs/libxfs/xfs_dir2.h +++ b/fs/xfs/libxfs/xfs_dir2.h @@ -30,10 +30,6 @@ * directory operations vector for encode/decode routines */ struct xfs_dir_ops { - int (*sf_entsize)(struct xfs_dir2_sf_hdr *hdr, int len); - struct xfs_dir2_sf_entry * - (*sf_nextentry)(struct xfs_dir2_sf_hdr *hdr, - struct xfs_dir2_sf_entry *sfep); uint8_t (*sf_get_ftype)(struct xfs_dir2_sf_entry *sfep); void (*sf_put_ftype)(struct xfs_dir2_sf_entry *sfep, uint8_t ftype); diff --git a/fs/xfs/libxfs/xfs_dir2_block.c b/fs/xfs/libxfs/xfs_dir2_block.c index 30ed591..fdcf6aa 100644 --- a/fs/xfs/libxfs/xfs_dir2_block.c +++ b/fs/xfs/libxfs/xfs_dir2_block.c @@ -1235,7 +1235,7 @@ static int xfs_dir2_block_lookup_int(xfs_da_args_t *args, struct xfs_buf **bpp, if (++i == sfp->count) sfep = NULL; else - sfep = dp->d_ops->sf_nextentry(sfp, sfep); + sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep); } /* Done with the temporary buffer */ kmem_free(sfp); diff --git a/fs/xfs/libxfs/xfs_dir2_priv.h b/fs/xfs/libxfs/xfs_dir2_priv.h index 59f9fb2..655fb33 100644 --- a/fs/xfs/libxfs/xfs_dir2_priv.h +++ b/fs/xfs/libxfs/xfs_dir2_priv.h @@ -108,6 +108,8 @@ extern int xfs_dir2_free_read(struct xfs_trans *tp, struct xfs_inode *dp, xfs_dablk_t fbno, struct xfs_buf **bpp); /* xfs_dir2_sf.c */ +struct xfs_dir2_sf_entry *xfs_dir2_sf_nextentry(struct xfs_mount *mp, + struct xfs_dir2_sf_hdr *hdr, struct xfs_dir2_sf_entry *sfep); extern int xfs_dir2_block_sfsize(struct xfs_inode *dp, struct xfs_dir2_data_hdr *block, struct xfs_dir2_sf_hdr *sfhp); extern int xfs_dir2_block_to_sf(struct xfs_da_args *args, struct xfs_buf *bp, diff --git a/fs/xfs/libxfs/xfs_dir2_sf.c b/fs/xfs/libxfs/xfs_dir2_sf.c index 585dfdb..716c8c5 100644 --- a/fs/xfs/libxfs/xfs_dir2_sf.c +++ b/fs/xfs/libxfs/xfs_dir2_sf.c @@ -40,6 +40,31 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, static void xfs_dir2_sf_toino4(xfs_da_args_t *args); static void xfs_dir2_sf_toino8(xfs_da_args_t *args); +static int +xfs_dir2_sf_entsize( + struct xfs_mount *mp, + struct xfs_dir2_sf_hdr *hdr, + int len) +{ + int count = len; + + count += sizeof(struct xfs_dir2_sf_entry); /* namelen + offset */ + count += hdr->i8count ? XFS_INO64_SIZE : XFS_INO32_SIZE; /* ino # */ + + if (xfs_sb_version_hasftype(&mp->m_sb)) + count += sizeof(uint8_t); + return count; +} + +struct xfs_dir2_sf_entry * +xfs_dir2_sf_nextentry( + struct xfs_mount *mp, + struct xfs_dir2_sf_hdr *hdr, + struct xfs_dir2_sf_entry *sfep) +{ + return (void *)sfep + xfs_dir2_sf_entsize(mp, hdr, sfep->namelen); +} + /* * Given a block directory (dp/block), calculate its size as a shortform (sf) * directory and a header for the sf directory, if it will fit it the @@ -222,7 +247,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, dp->d_ops->sf_put_ftype(sfep, dp->d_ops->data_get_ftype(dep)); - sfep = dp->d_ops->sf_nextentry(sfp, sfep); + sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep); } ptr += dp->d_ops->data_entsize(dep->namelen); } @@ -294,7 +319,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, /* * Compute entry (and change in) size. */ - incr_isize = dp->d_ops->sf_entsize(sfp, args->namelen); + incr_isize = xfs_dir2_sf_entsize(dp->i_mount, sfp, args->namelen); objchange = 0; /* @@ -367,18 +392,17 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, xfs_dir2_data_aoff_t offset, /* offset to use for new ent */ int new_isize) /* new directory size */ { + struct xfs_inode *dp = args->dp; + struct xfs_mount *mp = dp->i_mount; int byteoff; /* byte offset in sf dir */ - xfs_inode_t *dp; /* incore directory inode */ xfs_dir2_sf_hdr_t *sfp; /* shortform structure */ - dp = args->dp; - sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data; byteoff = (int)((char *)sfep - (char *)sfp); /* * Grow the in-inode space. */ - xfs_idata_realloc(dp, dp->d_ops->sf_entsize(sfp, args->namelen), + xfs_idata_realloc(dp, xfs_dir2_sf_entsize(mp, sfp, args->namelen), XFS_DATA_FORK); /* * Need to set up again due to realloc of the inode data. @@ -419,9 +443,10 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, int objchange, /* changing inode number size */ int new_isize) /* new directory size */ { + struct xfs_inode *dp = args->dp; + struct xfs_mount *mp = dp->i_mount; int add_datasize; /* data size need for new ent */ char *buf; /* buffer for old */ - xfs_inode_t *dp; /* incore directory inode */ int eof; /* reached end of old dir */ int nbytes; /* temp for byte copies */ xfs_dir2_data_aoff_t new_offset; /* next offset value */ @@ -435,8 +460,6 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, /* * Copy the old directory to the stack buffer. */ - dp = args->dp; - sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data; old_isize = (int)dp->i_d.di_size; buf = kmem_alloc(old_isize, KM_SLEEP); @@ -453,7 +476,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, eof = (char *)oldsfep == &buf[old_isize]; !eof; offset = new_offset + dp->d_ops->data_entsize(oldsfep->namelen), - oldsfep = dp->d_ops->sf_nextentry(oldsfp, oldsfep), + oldsfep = xfs_dir2_sf_nextentry(mp, oldsfp, oldsfep), eof = (char *)oldsfep == &buf[old_isize]) { new_offset = xfs_dir2_sf_get_offset(oldsfep); if (offset + add_datasize <= new_offset) @@ -491,7 +514,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, * If there's more left to copy, do that. */ if (!eof) { - sfep = dp->d_ops->sf_nextentry(sfp, sfep); + sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep); memcpy(sfep, oldsfep, old_isize - nbytes); } kmem_free(buf); @@ -513,7 +536,8 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, xfs_dir2_sf_entry_t **sfepp, /* out(1): new entry ptr */ xfs_dir2_data_aoff_t *offsetp) /* out(1): new offset */ { - xfs_inode_t *dp; /* incore directory inode */ + struct xfs_inode *dp = args->dp; + struct xfs_mount *mp = dp->i_mount; int holefit; /* found hole it will fit in */ int i; /* entry number */ xfs_dir2_data_aoff_t offset; /* data block offset */ @@ -522,8 +546,6 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, int size; /* entry's data size */ int used; /* data bytes used */ - dp = args->dp; - sfp = (xfs_dir2_sf_hdr_t *)dp->i_df.if_u1.if_data; size = dp->d_ops->data_entsize(args->namelen); offset = dp->d_ops->data_first_offset; @@ -539,7 +561,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, holefit = offset + size <= xfs_dir2_sf_get_offset(sfep); offset = xfs_dir2_sf_get_offset(sfep) + dp->d_ops->data_entsize(sfep->namelen); - sfep = dp->d_ops->sf_nextentry(sfp, sfep); + sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep); } /* * Calculate data bytes used excluding the new entry, if this @@ -598,7 +620,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, for (i = 0, sfep = xfs_dir2_sf_firstentry(sfp); i < sfp->count; - i++, sfep = dp->d_ops->sf_nextentry(sfp, sfep)) { + i++, sfep = xfs_dir2_sf_nextentry(dp->i_mount, sfp, sfep)) { ASSERT(xfs_dir2_sf_get_offset(sfep) >= offset); ino = dp->d_ops->sf_get_ino(sfp, sfep); i8count += ino > XFS_DIR2_MAX_SHORT_INUM; @@ -683,7 +705,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, * within the data buffer. The next entry starts after the * name component, so nextentry is an acceptable test. */ - next_sfep = dops->sf_nextentry(sfp, sfep); + next_sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep); if (endp < (char *)next_sfep) return __this_address; @@ -782,7 +804,8 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, xfs_dir2_sf_lookup( xfs_da_args_t *args) /* operation arguments */ { - xfs_inode_t *dp; /* incore directory inode */ + struct xfs_inode *dp = args->dp; + struct xfs_mount *mp = dp->i_mount; int i; /* entry index */ int error; xfs_dir2_sf_entry_t *sfep; /* shortform directory entry */ @@ -793,7 +816,6 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, trace_xfs_dir2_sf_lookup(args); xfs_dir2_sf_check(args); - dp = args->dp; ASSERT(dp->i_df.if_flags & XFS_IFINLINE); /* @@ -831,7 +853,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, */ ci_sfep = NULL; for (i = 0, sfep = xfs_dir2_sf_firstentry(sfp); i < sfp->count; - i++, sfep = dp->d_ops->sf_nextentry(sfp, sfep)) { + i++, sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep)) { /* * Compare name and if it's an exact match, return the inode * number. If it's the first case-insensitive match, store the @@ -867,8 +889,9 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, xfs_dir2_sf_removename( xfs_da_args_t *args) { + struct xfs_inode *dp = args->dp; + struct xfs_mount *mp = dp->i_mount; int byteoff; /* offset of removed entry */ - xfs_inode_t *dp; /* incore directory inode */ int entsize; /* this entry's size */ int i; /* shortform entry index */ int newsize; /* new inode size */ @@ -878,8 +901,6 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, trace_xfs_dir2_sf_removename(args); - dp = args->dp; - ASSERT(dp->i_df.if_flags & XFS_IFINLINE); oldsize = (int)dp->i_d.di_size; /* @@ -898,7 +919,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, * Find the one we're deleting. */ for (i = 0, sfep = xfs_dir2_sf_firstentry(sfp); i < sfp->count; - i++, sfep = dp->d_ops->sf_nextentry(sfp, sfep)) { + i++, sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep)) { if (xfs_da_compname(args, sfep->name, sfep->namelen) == XFS_CMP_EXACT) { ASSERT(dp->d_ops->sf_get_ino(sfp, sfep) == @@ -915,7 +936,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, * Calculate sizes. */ byteoff = (int)((char *)sfep - (char *)sfp); - entsize = dp->d_ops->sf_entsize(sfp, args->namelen); + entsize = xfs_dir2_sf_entsize(mp, sfp, args->namelen); newsize = oldsize - entsize; /* * Copy the part if any after the removed entry, sliding it down. @@ -954,7 +975,8 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, xfs_dir2_sf_replace( xfs_da_args_t *args) /* operation arguments */ { - xfs_inode_t *dp; /* incore directory inode */ + struct xfs_inode *dp = args->dp; + struct xfs_mount *mp = dp->i_mount; int i; /* entry index */ xfs_ino_t ino=0; /* entry old inode number */ int i8elevated; /* sf_toino8 set i8count=1 */ @@ -963,8 +985,6 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, trace_xfs_dir2_sf_replace(args); - dp = args->dp; - ASSERT(dp->i_df.if_flags & XFS_IFINLINE); /* * Bail out if the shortform directory is way too small. @@ -1020,7 +1040,7 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, */ else { for (i = 0, sfep = xfs_dir2_sf_firstentry(sfp); i < sfp->count; - i++, sfep = dp->d_ops->sf_nextentry(sfp, sfep)) { + i++, sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep)) { if (xfs_da_compname(args, sfep->name, sfep->namelen) == XFS_CMP_EXACT) { ino = dp->d_ops->sf_get_ino(sfp, sfep); @@ -1079,8 +1099,9 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, xfs_dir2_sf_toino4( xfs_da_args_t *args) /* operation arguments */ { + struct xfs_inode *dp = args->dp; + struct xfs_mount *mp = dp->i_mount; char *buf; /* old dir's buffer */ - xfs_inode_t *dp; /* incore directory inode */ int i; /* entry index */ int newsize; /* new inode size */ xfs_dir2_sf_entry_t *oldsfep; /* old sf entry */ @@ -1091,8 +1112,6 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, trace_xfs_dir2_sf_toino4(args); - dp = args->dp; - /* * Copy the old directory to the buffer. * Then nuke it from the inode, and add the new buffer to the inode. @@ -1126,8 +1145,8 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, for (i = 0, sfep = xfs_dir2_sf_firstentry(sfp), oldsfep = xfs_dir2_sf_firstentry(oldsfp); i < sfp->count; - i++, sfep = dp->d_ops->sf_nextentry(sfp, sfep), - oldsfep = dp->d_ops->sf_nextentry(oldsfp, oldsfep)) { + i++, sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep), + oldsfep = xfs_dir2_sf_nextentry(mp, oldsfp, oldsfep)) { sfep->namelen = oldsfep->namelen; memcpy(sfep->offset, oldsfep->offset, sizeof(sfep->offset)); memcpy(sfep->name, oldsfep->name, sfep->namelen); @@ -1152,8 +1171,9 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, xfs_dir2_sf_toino8( xfs_da_args_t *args) /* operation arguments */ { + struct xfs_inode *dp = args->dp; + struct xfs_mount *mp = dp->i_mount; char *buf; /* old dir's buffer */ - xfs_inode_t *dp; /* incore directory inode */ int i; /* entry index */ int newsize; /* new inode size */ xfs_dir2_sf_entry_t *oldsfep; /* old sf entry */ @@ -1164,8 +1184,6 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, trace_xfs_dir2_sf_toino8(args); - dp = args->dp; - /* * Copy the old directory to the buffer. * Then nuke it from the inode, and add the new buffer to the inode. @@ -1199,8 +1217,8 @@ static int xfs_dir2_sf_addname_pick(xfs_da_args_t *args, int objchange, for (i = 0, sfep = xfs_dir2_sf_firstentry(sfp), oldsfep = xfs_dir2_sf_firstentry(oldsfp); i < sfp->count; - i++, sfep = dp->d_ops->sf_nextentry(sfp, sfep), - oldsfep = dp->d_ops->sf_nextentry(oldsfp, oldsfep)) { + i++, sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep), + oldsfep = xfs_dir2_sf_nextentry(mp, oldsfp, oldsfep)) { sfep->namelen = oldsfep->namelen; memcpy(sfep->offset, oldsfep->offset, sizeof(sfep->offset)); memcpy(sfep->name, oldsfep->name, sfep->namelen); diff --git a/fs/xfs/xfs_dir2_readdir.c b/fs/xfs/xfs_dir2_readdir.c index 5142e64..2ae98c2 100644 --- a/fs/xfs/xfs_dir2_readdir.c +++ b/fs/xfs/xfs_dir2_readdir.c @@ -50,6 +50,7 @@ { int i; /* shortform entry number */ struct xfs_inode *dp = args->dp; /* incore directory inode */ + struct xfs_mount *mp = dp->i_mount; xfs_dir2_dataptr_t off; /* current entry's offset */ xfs_dir2_sf_entry_t *sfep; /* shortform directory entry */ xfs_dir2_sf_hdr_t *sfp; /* shortform structure */ @@ -111,7 +112,7 @@ xfs_dir2_sf_get_offset(sfep)); if (ctx->pos > off) { - sfep = dp->d_ops->sf_nextentry(sfp, sfep); + sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep); continue; } @@ -119,9 +120,9 @@ filetype = dp->d_ops->sf_get_ftype(sfep); ctx->pos = off & 0x7fffffff; if (!dir_emit(ctx, (char *)sfep->name, sfep->namelen, ino, - xfs_dir3_get_dtype(dp->i_mount, filetype))) + xfs_dir3_get_dtype(mp, filetype))) return 0; - sfep = dp->d_ops->sf_nextentry(sfp, sfep); + sfep = xfs_dir2_sf_nextentry(mp, sfp, sfep); } ctx->pos = xfs_dir2_db_off_to_dataptr(geo, geo->datablk + 1, 0) & -- 1.8.3

1 0

[PATCH 1/2] block: delete part_round_stats and switch to less precise counting
by Yang Yingliang 18 Mar '20

18 Mar '20

From: Mikulas Patocka <mpatocka(a)redhat.com> mainline inclusion from mainline-5.0-rc1 commit 5b18b5a737600fd20ba2045f320d5926ebbf341a category: bugfix bugzilla: 31388 CVE: NA --------------------------- We want to convert to per-cpu in_flight counters. The function part_round_stats needs the in_flight counter every jiffy, it would be too costly to sum all the percpu variables every jiffy, so it must be deleted. part_round_stats is used to calculate two counters - time_in_queue and io_ticks. time_in_queue can be calculated without part_round_stats, by adding the duration of the I/O when the I/O ends (the value is almost as exact as the previously calculated value, except that time for in-progress I/Os is not counted). io_ticks can be approximated by increasing the value when I/O is started or ended and the jiffies value has changed. If the I/Os take less than a jiffy, the value is as exact as the previously calculated value. If the I/Os take more than a jiffy, io_ticks can drift behind the previously calculated value. Signed-off-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)redhat.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflict: block/bio.c block/blk-core.c block/blk-merge.c block/genhd.c include/linux/genhd.h Signed-off-by: Yufen Yu <yuyufen(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/bio.c | 23 ++++++++++++++++++++--- block/blk-core.c | 6 ++++-- block/blk-merge.c | 1 - block/genhd.c | 4 ---- block/partition-generic.c | 4 ---- include/linux/genhd.h | 1 + 6 files changed, 25 insertions(+), 14 deletions(-) diff --git a/block/bio.c b/block/bio.c index 3d7570553..48a8cf5 100644 --- a/block/bio.c +++ b/block/bio.c @@ -1668,13 +1668,28 @@ void bio_check_pages_dirty(struct bio *bio) } EXPORT_SYMBOL_GPL(bio_check_pages_dirty); +void update_io_ticks(int cpu, struct hd_struct *part, unsigned long now) +{ + unsigned long stamp; +again: + stamp = READ_ONCE(part->stamp); + if (unlikely(stamp != now)) { + if (likely(cmpxchg(&part->stamp, stamp, now) == stamp)) + __part_stat_add(cpu, part, io_ticks, 1); + } + if (part->partno) { + part = &part_to_disk(part)->part0; + goto again; + } +} + void generic_start_io_acct(struct request_queue *q, int op, unsigned long sectors, struct hd_struct *part) { const int sgrp = op_stat_group(op); int cpu = part_stat_lock(); - part_round_stats(q, cpu, part); + update_io_ticks(cpu, part, jiffies); part_stat_inc(cpu, part, ios[sgrp]); part_stat_add(cpu, part, sectors[sgrp], sectors); part_inc_in_flight(q, part, op_is_write(op)); @@ -1686,12 +1701,14 @@ void generic_start_io_acct(struct request_queue *q, int op, void generic_end_io_acct(struct request_queue *q, int req_op, struct hd_struct *part, unsigned long start_time) { - unsigned long duration = jiffies - start_time; + unsigned long now = jiffies; + unsigned long duration = now - start_time; const int sgrp = op_stat_group(req_op); int cpu = part_stat_lock(); + update_io_ticks(cpu, part, now); part_stat_add(cpu, part, nsecs[sgrp], jiffies_to_nsecs(duration)); - part_round_stats(q, cpu, part); + part_stat_add(cpu, part, time_in_queue, duration); part_dec_in_flight(q, part, op_is_write(req_op)); part_stat_unlock(); diff --git a/block/blk-core.c b/block/blk-core.c index b64dec2..d9e3ee6 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -2740,9 +2740,10 @@ void blk_account_io_done(struct request *req, u64 now) cpu = part_stat_lock(); part = req->part; + update_io_ticks(cpu, part, jiffies); part_stat_inc(cpu, part, ios[sgrp]); part_stat_add(cpu, part, nsecs[sgrp], now - req->start_time_ns); - part_round_stats(req->q, cpu, part); + part_stat_add(cpu, part, time_in_queue, nsecs_to_jiffies64(now - req->start_time_ns)); part_dec_in_flight(req->q, part, rq_data_dir(req)); hd_struct_put(part); @@ -2790,11 +2791,12 @@ void blk_account_io_start(struct request *rq, bool new_io) part_stat_inc(cpu, part, merges[rw]); } else { part = disk_map_sector_rcu(rq->rq_disk, blk_rq_pos(rq)); - part_round_stats(rq->q, cpu, part); part_inc_in_flight(rq->q, part, rw); rq->part = part; } + update_io_ticks(cpu, part, jiffies); + part_stat_unlock(); } diff --git a/block/blk-merge.c b/block/blk-merge.c index 7efa8c3..044bff9 100644 --- a/block/blk-merge.c +++ b/block/blk-merge.c @@ -656,7 +656,6 @@ static void blk_account_io_merge(struct request *req) cpu = part_stat_lock(); part = req->part; - part_round_stats(req->q, cpu, part); part_dec_in_flight(req->q, part, rq_data_dir(req)); hd_struct_put(part); diff --git a/block/genhd.c b/block/genhd.c index ff9d46d..862a2f3 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -1342,7 +1342,6 @@ static int diskstats_show(struct seq_file *seqf, void *v) struct hd_struct *hd; char buf[BDEVNAME_SIZE]; unsigned int inflight[2]; - int cpu; /* if (&disk_to_dev(gp)->kobj.entry == block_class.devices.next) @@ -1354,9 +1353,6 @@ static int diskstats_show(struct seq_file *seqf, void *v) disk_part_iter_init(&piter, gp, DISK_PITER_INCL_EMPTY_PART0); while ((hd = disk_part_iter_next(&piter))) { - cpu = part_stat_lock(); - part_round_stats(gp->queue, cpu, hd); - part_stat_unlock(); part_in_flight(gp->queue, hd, inflight); seq_printf(seqf, "%4d %7d %s " "%lu %lu %lu %u " diff --git a/block/partition-generic.c b/block/partition-generic.c index 8ad6dca..d86d794 100644 --- a/block/partition-generic.c +++ b/block/partition-generic.c @@ -121,11 +121,7 @@ ssize_t part_stat_show(struct device *dev, struct hd_struct *p = dev_to_part(dev); struct request_queue *q = part_to_disk(p)->queue; unsigned int inflight[2]; - int cpu; - cpu = part_stat_lock(); - part_round_stats(q, cpu, p); - part_stat_unlock(); part_in_flight(q, p, inflight); return sprintf(buf, "%8lu %8lu %8llu %8u " diff --git a/include/linux/genhd.h b/include/linux/genhd.h index df0d01d..666b23a 100644 --- a/include/linux/genhd.h +++ b/include/linux/genhd.h @@ -422,6 +422,7 @@ static inline void free_part_info(struct hd_struct *part) /* block/blk-core.c */ extern void part_round_stats(struct request_queue *q, int cpu, struct hd_struct *part); +void update_io_ticks(int cpu, struct hd_struct *part, unsigned long now); /* block/genhd.c */ extern void device_add_disk(struct device *parent, struct gendisk *disk); -- 1.8.3

1 1

[PATCH] CIFS: Fix bug which the return value by asynchronous read is error
by Yang Yingliang 18 Mar '20

18 Mar '20

From: Yilu Lin <linyilu(a)huawei.com> hulk inclusion category: bugfix bugzilla: 31384 CVE: NA ------------------------------------------------- This patch is used to fix the bug in collect_uncached_read_data() that rc is automatically converted from a signed number to an unsigned number when the CIFS asynchronous read fails. It will cause ctx->rc is error. Example: Share a directory and create a file on the Windows OS. Mount the directory to the Linux OS using CIFS. On the CIFS client of the Linux OS, invoke the pread interface to deliver the read request. The size of the read length plus offset of the read request is greater than the maximum file size. In this case, the CIFS server on the Windows OS returns a failure message (for example, the return value of smb2.nt_status is STATUS_INVALID_PARAMETER). After receiving the response message, the CIFS client parses smb2.nt_status to STATUS_INVALID_PARAMETER and converts it to the Linux error code (rdata->result=-22). Then the CIFS client invokes the collect_uncached_read_data function to assign the value of rdata->result to rc, that is, rc=rdata->result=-22. The type of the ctx->total_len variable is unsigned integer, the type of the rc variable is integer, and the type of the ctx->rc variable is ssize_t. Therefore, during the ternary operation, the value of rc is automatically converted to an unsigned number. The final result is ctx->rc=4294967274. However, the expected result is ctx->rc=-22. https://patchwork.kernel.org/patch/11444477/ Signed-off-by: Yilu Lin <linyilu(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/cifs/file.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/cifs/file.c b/fs/cifs/file.c index e92513e..23b1098 100644 --- a/fs/cifs/file.c +++ b/fs/cifs/file.c @@ -3347,7 +3347,7 @@ ssize_t cifs_user_writev(struct kiocb *iocb, struct iov_iter *from) if (rc == -ENODATA) rc = 0; - ctx->rc = (rc == 0) ? ctx->total_len : rc; + ctx->rc = (rc == 0) ? (ssize_t)ctx->total_len : rc; mutex_unlock(&ctx->aio_mutex); -- 1.8.3

1 0

[PATCH 1/2] net/hinic: slove the problem that VF may be disconnected when vm reboot and receive lots of broadcast packets.
by Yang Yingliang 18 Mar '20

18 Mar '20

From: Shaozhengchao <shaozhengchao(a)huawei.com> driver inclusion category:bugfix bugzilla:4472 CVE:NA ----------------------------------------------------------------------- slove the problem that VF may be disconnected when vm reboot and receive lots of broadcast packets. When vm is rebooting, VF receives lots of broadcast packects and VF may be disconnected. VF receives broadcast packect and VF driver will clear INTR_ON flag in setting msix process. Then VF driver will not enable interrupt if INTR_ON flag is set. As a result, VF will not process any hadware interrpt. In order to solve this problem, VF driver should be enable the interrpt first and then set msix state. Signed-off-by: Shaozhengchao <shaozhengchao(a)huawei.com> Reviewed-by: Luoshaokai <luoshaokai(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/ethernet/huawei/hinic/hinic_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c index 9b53a6f..b6da9fe 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_main.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c @@ -759,6 +759,8 @@ static int hinic_qps_irq_init(struct hinic_nic_dev *nic_dev) goto req_tx_irq_err; } + set_bit(HINIC_INTR_ON, &irq_cfg->intr_flag); + err = hinic_request_irq(irq_cfg, q_id); if (err) { nicif_err(nic_dev, drv, nic_dev->netdev, "Failed to request Rx irq\n"); @@ -768,7 +770,6 @@ static int hinic_qps_irq_init(struct hinic_nic_dev *nic_dev) hinic_set_msix_state(nic_dev->hwdev, irq_cfg->msix_entry_idx, HINIC_MSIX_ENABLE); - set_bit(HINIC_INTR_ON, &irq_cfg->intr_flag); } INIT_DELAYED_WORK(&nic_dev->moderation_task, -- 1.8.3

1 1

[PATCH] openeuler/config: disable CONFIG_EFI_VARS
by Yang Yingliang 18 Mar '20

18 Mar '20

From: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> hulk inclusion category: config bugzilla: 31390 CVE: NA Accessing sysfs-efivars interface '/sys/firmware/efi/vars' may have some problem. We can access the new efivarfs interface '/sys/firmware/efi/efivars' instead. So disable CONFIG_EFI_VARS and keep CONFIG_EFIVAR_FS enabled. Link: https://gitee.com/openeuler/kernel/issues/I1BN57 Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index a024ce2..9e6f560 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -580,10 +580,8 @@ CONFIG_HAVE_ARM_SMCCC=y # # EFI (Extensible Firmware Interface) Support # -CONFIG_EFI_VARS=y +#CONFIG_EFI_VARS is not set CONFIG_EFI_ESRT=y -CONFIG_EFI_VARS_PSTORE=y -CONFIG_EFI_VARS_PSTORE_DEFAULT_DISABLE=y CONFIG_EFI_PARAMS_FROM_FDT=y CONFIG_EFI_RUNTIME_WRAPPERS=y CONFIG_EFI_ARMSTUB=y -- 1.8.3

1 0

[PATCH] pagecache: support percpu refcount to imporve performance
by Yang Yingliang 17 Mar '20

17 Mar '20

From: Yunfeng Ye <yeyunfeng(a)huawei.com> euleros inclusion category: feature feature: pagecache percpu refcount bugzilla: 31398 CVE: NA ------------------------------------------------- The pagecache manages the file physical pages, and the life cycle of page is managed by atomic counting. With the increasing number of cpu cores, the cost of atomic counting is very large when reading file pagecaches at large concurrent. For example, when running nginx http application, the biggest hotspot is found in the atomic operation of find_get_entry(): 11.94% [kernel] [k] find_get_entry 7.45% [kernel] [k] do_tcp_sendpages 6.12% [kernel] [k] generic_file_buffered_read So we using the percpu refcount mechanism to fix this problem. and the test result show that the read performance of nginx http can be improved by 100%： worker original(requests/sec) percpu(requests/sec) imporve 64 759656.87 1627088.95 114.2% Notes: we use page->lru to save percpu information, so the pages with percpu attribute will not be recycled by memory recycling process, we should avoid grow the file size unlimited. Signed-off-by: Yunfeng Ye <yeyunfeng(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/fcntl.c | 20 ++++++++++++ include/linux/mm.h | 23 +++++++++++++ include/linux/page-flags.h | 2 ++ include/linux/page_ref.h | 11 +++++++ include/linux/pagemap.h | 24 ++++++++++++++ include/trace/events/mmflags.h | 3 +- include/uapi/linux/fcntl.h | 2 ++ mm/filemap.c | 74 ++++++++++++++++++++++++++++++++++++++++-- mm/swap.c | 2 ++ 9 files changed, 158 insertions(+), 3 deletions(-) diff --git a/fs/fcntl.c b/fs/fcntl.c index 4137d96..0c70a8e 100644 --- a/fs/fcntl.c +++ b/fs/fcntl.c @@ -29,6 +29,7 @@ #include <linux/poll.h> #include <asm/siginfo.h> #include <linux/uaccess.h> +#include <linux/pagemap.h> #define SETFL_MASK (O_APPEND | O_NONBLOCK | O_NDELAY | O_DIRECT | O_NOATIME) @@ -319,6 +320,22 @@ static long fcntl_rw_hint(struct file *file, unsigned int cmd, } } +static long fcntl_mapping_percpu(struct file *filp, unsigned int cmd, + unsigned long arg) +{ + struct address_space *mapping = filp->f_mapping; + unsigned long flag = arg; + + if (!mapping) + return -EINVAL; + + if (flag) + mapping_set_percpu_ref(mapping); + else + mapping_clear_percpu_ref(mapping); + return 0; +} + static long do_fcntl(int fd, unsigned int cmd, unsigned long arg, struct file *filp) { @@ -426,6 +443,9 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg, case F_SET_FILE_RW_HINT: err = fcntl_rw_hint(filp, cmd, arg); break; + case F_MAPPING_PERCPU: + err = fcntl_mapping_percpu(filp, cmd, arg); + break; default: break; } diff --git a/include/linux/mm.h b/include/linux/mm.h index 65d91b1..0e173a4 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -528,6 +528,10 @@ static inline int pgd_devmap(pgd_t pgd) static inline int put_page_testzero(struct page *page) { VM_BUG_ON_PAGE(page_ref_count(page) == 0, page); + if (PagePercpuRef(page)) { + percpu_ref_put(page_percpu_ref(page)); + return 0; + } return page_ref_dec_and_test(page); } @@ -539,6 +543,10 @@ static inline int put_page_testzero(struct page *page) */ static inline int get_page_unless_zero(struct page *page) { + if (PagePercpuRef(page)) { + percpu_ref_get(page_percpu_ref(page)); + return true; + } return page_ref_add_unless(page, 1, 0); } @@ -928,6 +936,11 @@ static inline bool is_device_public_page(const struct page *page) static inline void get_page(struct page *page) { page = compound_head(page); + + if (PagePercpuRef(page)) { + percpu_ref_get(page_percpu_ref(page)); + return; + } /* * Getting a normal page or the head of a compound page * requires to already have an elevated page->_refcount. @@ -939,6 +952,11 @@ static inline void get_page(struct page *page) static inline __must_check bool try_get_page(struct page *page) { page = compound_head(page); + + if (PagePercpuRef(page)) { + percpu_ref_get(page_percpu_ref(page)); + return true; + } if (WARN_ON_ONCE(page_ref_count(page) <= 0)) return false; page_ref_inc(page); @@ -949,6 +967,11 @@ static inline void put_page(struct page *page) { page = compound_head(page); + if (PagePercpuRef(page)) { + percpu_ref_put(page_percpu_ref(page)); + return; + } + /* * For devmap managed pages we need to catch refcount transition from * 2 to 1, when refcount reach one it means the page is free and we diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h index 3f066ce..7eb776a 100644 --- a/include/linux/page-flags.h +++ b/include/linux/page-flags.h @@ -101,6 +101,7 @@ enum pageflags { PG_young, PG_idle, #endif + PG_percpu_ref, __NR_PAGEFLAGS, /* Filesystems */ @@ -385,6 +386,7 @@ static inline bool set_hwpoison_free_buddy_page(struct page *page) TESTCLEARFLAG(Young, young, PF_ANY) PAGEFLAG(Idle, idle, PF_ANY) #endif +PAGEFLAG(PercpuRef, percpu_ref, PF_ANY) /* * On an anonymous page mapped into a user virtual memory area, diff --git a/include/linux/page_ref.h b/include/linux/page_ref.h index 14d14be..3deab40 100644 --- a/include/linux/page_ref.h +++ b/include/linux/page_ref.h @@ -180,4 +180,15 @@ static inline void page_ref_unfreeze(struct page *page, int count) __page_ref_unfreeze(page, count); } +static inline struct percpu_ref *page_percpu_ref(struct page *page) +{ + return *(struct percpu_ref **)&page->lru; +} + +static inline void page_set_percpu_ref(struct page *page, + struct percpu_ref *ref) +{ + *(struct percpu_ref **)&page->lru = ref; +} + #endif diff --git a/include/linux/pagemap.h b/include/linux/pagemap.h index 520627f..e889d99 100644 --- a/include/linux/pagemap.h +++ b/include/linux/pagemap.h @@ -29,6 +29,7 @@ enum mapping_flags { AS_EXITING = 4, /* final truncate in progress */ /* writeback related tags are not used */ AS_NO_WRITEBACK_TAGS = 5, + AS_PERCPU_REF = 6, /* percpu ref counter for special inode */ }; /** @@ -97,6 +98,21 @@ static inline int mapping_use_writeback_tags(struct address_space *mapping) return !test_bit(AS_NO_WRITEBACK_TAGS, &mapping->flags); } +static inline void mapping_set_percpu_ref(struct address_space *mapping) +{ + set_bit(AS_PERCPU_REF, &mapping->flags); +} + +static inline void mapping_clear_percpu_ref(struct address_space *mapping) +{ + clear_bit(AS_PERCPU_REF, &mapping->flags); +} + +static inline int mapping_percpu_ref(struct address_space *mapping) +{ + return test_bit(AS_PERCPU_REF, &mapping->flags); +} + static inline gfp_t mapping_gfp_mask(struct address_space * mapping) { return mapping->gfp_mask; @@ -170,6 +186,10 @@ static inline int page_cache_get_speculative(struct page *page) # ifdef CONFIG_PREEMPT_COUNT VM_BUG_ON(!in_atomic() && !irqs_disabled()); # endif + if (PagePercpuRef(page)) { + percpu_ref_get(page_percpu_ref(page)); + return 1; + } /* * Preempt must be disabled here - we rely on rcu_read_lock doing * this for us. @@ -183,6 +203,10 @@ static inline int page_cache_get_speculative(struct page *page) page_ref_inc(page); #else + if (PagePercpuRef(page)) { + percpu_ref_get(page_percpu_ref(page)); + return 1; + } if (unlikely(!get_page_unless_zero(page))) { /* * Either the page has been freed, or will be freed. diff --git a/include/trace/events/mmflags.h b/include/trace/events/mmflags.h index a81cffb..2994f1c 100644 --- a/include/trace/events/mmflags.h +++ b/include/trace/events/mmflags.h @@ -104,7 +104,8 @@ IF_HAVE_PG_UNCACHED(PG_uncached, "uncached" ) \ IF_HAVE_PG_HWPOISON(PG_hwpoison, "hwpoison" ) \ IF_HAVE_PG_IDLE(PG_young, "young" ) \ -IF_HAVE_PG_IDLE(PG_idle, "idle" ) +IF_HAVE_PG_IDLE(PG_idle, "idle"), \ + {1UL << PG_percpu_ref, "percpu_ref" } #define show_page_flags(flags) \ (flags) ? __print_flags(flags, "|", \ diff --git a/include/uapi/linux/fcntl.h b/include/uapi/linux/fcntl.h index 6448cdd..6dcddf7 100644 --- a/include/uapi/linux/fcntl.h +++ b/include/uapi/linux/fcntl.h @@ -53,6 +53,8 @@ #define F_GET_FILE_RW_HINT (F_LINUX_SPECIFIC_BASE + 13) #define F_SET_FILE_RW_HINT (F_LINUX_SPECIFIC_BASE + 14) +#define F_MAPPING_PERCPU (F_LINUX_SPECIFIC_BASE + 15) + /* * Valid hint values for F_{GET,SET}_RW_HINT. 0 is "not set", or can be * used to clear any hints previously set. diff --git a/mm/filemap.c b/mm/filemap.c index c56c419..8a8bf78 100644 --- a/mm/filemap.c +++ b/mm/filemap.c @@ -48,6 +48,66 @@ #include <asm/mman.h> +struct percpu_page { + struct percpu_ref ref; + struct page *page; +}; + +static void free_page_ref(struct percpu_ref *ref) +{ + struct percpu_page *p = (struct percpu_page *)ref; + struct page *page = p->page; + + percpu_ref_exit(ref); + kfree(page_percpu_ref(page)); + page_set_percpu_ref(page, NULL); + + ClearPagePercpuRef(page); + /* really free the page */ + put_page(page); +} + +static void page_cache_init(struct address_space *mapping, struct page *page) +{ + struct percpu_page *p; + + if (!mapping_percpu_ref(mapping)) + return; + + p = kzalloc(sizeof(struct percpu_page), GFP_KERNEL); + if (!p) + return; + if (percpu_ref_init(&p->ref, free_page_ref, 0, GFP_KERNEL)) + goto err; + + p->page = page; + page_set_percpu_ref(page, &p->ref); + SetPagePercpuRef(page); + get_page(page); + return; +err: + kfree(p); +} + +static void page_cache_exit(struct page *page) +{ + if (!PagePercpuRef(page)) + return; + + put_page(page); + ClearPagePercpuRef(page); + percpu_ref_exit(page_percpu_ref(page)); + kfree(page_percpu_ref(page)); + page_set_percpu_ref(page, NULL); +} + +static void page_cache_kill(struct page *page) +{ + if (!PagePercpuRef(page)) + return; + percpu_ref_kill(page_percpu_ref(page)); +} + /* * Shared mappings implemented 30.11.1994. It's not fully working yet, * though. @@ -264,6 +324,7 @@ void __delete_from_page_cache(struct page *page, void *shadow) unaccount_page_cache_page(mapping, page); page_cache_tree_delete(mapping, page, shadow); + page_cache_kill(page); } static void page_cache_free_page(struct address_space *mapping, @@ -384,8 +445,10 @@ void delete_from_page_cache_batch(struct address_space *mapping, page_cache_tree_delete_batch(mapping, pvec); xa_unlock_irqrestore(&mapping->i_pages, flags); - for (i = 0; i < pagevec_count(pvec); i++) + for (i = 0; i < pagevec_count(pvec); i++) { + page_cache_kill(pvec->pages[i]); page_cache_free_page(mapping, pvec->pages[i]); + } } int filemap_check_errors(struct address_space *mapping) @@ -966,7 +1029,8 @@ int add_to_page_cache_lru(struct page *page, struct address_space *mapping, workingset_activation(page); } else ClearPageActive(page); - lru_cache_add(page); + if (!PagePercpuRef(page)) + lru_cache_add(page); } return ret; } @@ -1630,8 +1694,10 @@ struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset, if (fgp_flags & FGP_ACCESSED) __SetPageReferenced(page); + page_cache_init(mapping, page); err = add_to_page_cache_lru(page, mapping, offset, gfp_mask); if (unlikely(err)) { + page_cache_exit(page); put_page(page); page = NULL; if (err == -EEXIST) @@ -2320,9 +2386,11 @@ static ssize_t generic_file_buffered_read(struct kiocb *iocb, error = -ENOMEM; goto out; } + page_cache_init(mapping, page); error = add_to_page_cache_lru(page, mapping, index, mapping_gfp_constraint(mapping, GFP_KERNEL)); if (error) { + page_cache_exit(page); put_page(page); if (error == -EEXIST) { error = 0; @@ -2837,8 +2905,10 @@ static struct page *do_read_cache_page(struct address_space *mapping, page = __page_cache_alloc(gfp); if (!page) return ERR_PTR(-ENOMEM); + page_cache_init(mapping, page); err = add_to_page_cache_lru(page, mapping, index, gfp); if (unlikely(err)) { + page_cache_exit(page); put_page(page); if (err == -EEXIST) goto repeat; diff --git a/mm/swap.c b/mm/swap.c index 45fdbfb..320ac35 100644 --- a/mm/swap.c +++ b/mm/swap.c @@ -372,6 +372,8 @@ static void __lru_cache_activate_page(struct page *page) void mark_page_accessed(struct page *page) { page = compound_head(page); + if (PagePercpuRef(page)) + return; if (!PageActive(page) && !PageUnevictable(page) && PageReferenced(page)) { -- 1.8.3

1 0

[PATCH] arm64: mm: support setting page attributes for debugging
by Yang Yingliang 17 Mar '20

17 Mar '20

From: Yunfeng Ye <yeyunfeng(a)huawei.com> euleros inclusion category: feature feature: Memory debug feature ------------------------------------------------- When pagealloc debug is enabled, block mappings or contiguous hints are no longer used for linear address area. Therefore, support setting page attributes in this case is useful for debugging memory corruption problems. Signed-off-by: Yunfeng Ye <yeyunfeng(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- arch/arm64/mm/pageattr.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/arch/arm64/mm/pageattr.c b/arch/arm64/mm/pageattr.c index a5635937..3e398d0 100644 --- a/arch/arm64/mm/pageattr.c +++ b/arch/arm64/mm/pageattr.c @@ -87,8 +87,16 @@ static int change_memory_common(unsigned long addr, int numpages, area = find_vm_area((void *)addr); if (!area || end > (unsigned long)area->addr + area->size || - !(area->flags & VM_ALLOC)) + !(area->flags & VM_ALLOC)) { + /* + * When pagealloc debug is enabled, the linear address is + * mapped with NO_BLOCK_MAPPINGS and NO_CONT_MAPPINGS flags. + */ + if (numpages && debug_pagealloc_enabled()) + return __change_memory_common(start, size, + set_mask, clear_mask); return -EINVAL; + } if (!numpages) return 0; -- 1.8.3

1 0

[PATCH] staging: android: ashmem: Disallow ashmem memory from being remapped
by Yang Yingliang 16 Mar '20

16 Mar '20

From: Suren Baghdasaryan <surenb(a)google.com> commit 6d67b0290b4b84c477e6a2fc6e005e174d3c7786 upstream. When ashmem file is mmapped, the resulting vma->vm_file points to the backing shmem file with the generic fops that do not check ashmem permissions like fops of ashmem do. If an mremap is done on the ashmem region, then the permission checks will be skipped. Fix that by disallowing mapping operation on the backing shmem file. Reported-by: Jann Horn <jannh(a)google.com> Signed-off-by: Suren Baghdasaryan <surenb(a)google.com> Cc: stable <stable(a)vger.kernel.org> # 4.4,4.9,4.14,4.18,5.4 Signed-off-by: Todd Kjos <tkjos(a)google.com> Reviewed-by: Joel Fernandes (Google) <joel(a)joelfernandes.org> Link: https://lore.kernel.org/r/20200127235616.48920-1-tkjos@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/staging/android/ashmem.c | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c index be81533..e3df4bf 100644 --- a/drivers/staging/android/ashmem.c +++ b/drivers/staging/android/ashmem.c @@ -350,8 +350,23 @@ static inline vm_flags_t calc_vm_may_flags(unsigned long prot) _calc_vm_trans(prot, PROT_EXEC, VM_MAYEXEC); } +static int ashmem_vmfile_mmap(struct file *file, struct vm_area_struct *vma) +{ + /* do not allow to mmap ashmem backing shmem file directly */ + return -EPERM; +} + +static unsigned long +ashmem_vmfile_get_unmapped_area(struct file *file, unsigned long addr, + unsigned long len, unsigned long pgoff, + unsigned long flags) +{ + return current->mm->get_unmapped_area(file, addr, len, pgoff, flags); +} + static int ashmem_mmap(struct file *file, struct vm_area_struct *vma) { + static struct file_operations vmfile_fops; struct ashmem_area *asma = file->private_data; int ret = 0; @@ -392,6 +407,19 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma) } vmfile->f_mode |= FMODE_LSEEK; asma->file = vmfile; + /* + * override mmap operation of the vmfile so that it can't be + * remapped which would lead to creation of a new vma with no + * asma permission checks. Have to override get_unmapped_area + * as well to prevent VM_BUG_ON check for f_ops modification. + */ + if (!vmfile_fops.mmap) { + vmfile_fops = *vmfile->f_op; + vmfile_fops.mmap = ashmem_vmfile_mmap; + vmfile_fops.get_unmapped_area = + ashmem_vmfile_get_unmapped_area; + } + vmfile->f_op = &vmfile_fops; } get_file(asma->file); -- 1.8.3

1 0

[PATCH 0/2] more fixes about CVE-2020-8648
by Yang Yingliang 16 Mar '20

16 Mar '20

Jiri Slaby (2): vt: selection, push console lock down vt: selection, push sel_lock up drivers/tty/vt/selection.c | 27 ++++++++++++++++++--------- drivers/tty/vt/vt.c | 2 -- 2 files changed, 18 insertions(+), 11 deletions(-) -- 1.8.3

1 2

[PATCH] mm/resource: Return real error codes from walk failures
by Yang Yingliang 16 Mar '20

16 Mar '20

From: Dave Hansen <dave.hansen(a)linux.intel.com> mainline inclusion from mainline-v5.1-rc1 commit 5cd401ace914dc68556c6d2fcae0c349444d5f86 category: bugfix bugzilla: 17339 CVE: NA ------------------------------------------------- walk_system_ram_range() can return an error code either becuase *it* failed, or because the 'func' that it calls returned an error. The memory hotplug does the following: ret = walk_system_ram_range(..., func); if (ret) return ret; and 'ret' makes it out to userspace, eventually. The problem s, walk_system_ram_range() failues that result from *it* failing (as opposed to 'func') return -1. That leads to a very odd -EPERM (-1) return code out to userspace. Make walk_system_ram_range() return -EINVAL for internal failures to keep userspace less confused. This return code is compatible with all the callers that I audited. Signed-off-by: Dave Hansen <dave.hansen(a)linux.intel.com> Reviewed-by: Bjorn Helgaas <bhelgaas(a)google.com> Acked-by: Michael Ellerman <mpe(a)ellerman.id.au> (powerpc) Cc: Dan Williams <dan.j.williams(a)intel.com> Cc: Dave Jiang <dave.jiang(a)intel.com> Cc: Ross Zwisler <zwisler(a)kernel.org> Cc: Vishal Verma <vishal.l.verma(a)intel.com> Cc: Tom Lendacky <thomas.lendacky(a)amd.com> Cc: Andrew Morton <akpm(a)linux-foundation.org> Cc: Michal Hocko <mhocko(a)suse.com> Cc: linux-nvdimm(a)lists.01.org Cc: linux-kernel(a)vger.kernel.org Cc: linux-mm(a)kvack.org Cc: Huang Ying <ying.huang(a)intel.com> Cc: Fengguang Wu <fengguang.wu(a)intel.com> Cc: Borislav Petkov <bp(a)suse.de> Cc: Yaowei Bai <baiyaowei(a)cmss.chinamobile.com> Cc: Takashi Iwai <tiwai(a)suse.de> Cc: Jerome Glisse <jglisse(a)redhat.com> Cc: Benjamin Herrenschmidt <benh(a)kernel.crashing.org> Cc: Paul Mackerras <paulus(a)samba.org> Cc: linuxppc-dev(a)lists.ozlabs.org Cc: Keith Busch <keith.busch(a)intel.com> Signed-off-by: Dan Williams <dan.j.williams(a)intel.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> --- kernel/resource.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/kernel/resource.c b/kernel/resource.c index bce773c..7dd11c7 100644 --- a/kernel/resource.c +++ b/kernel/resource.c @@ -377,7 +377,7 @@ static int __walk_iomem_res_desc(resource_size_t start, resource_size_t end, int (*func)(struct resource *, void *)) { struct resource res; - int ret = -1; + int ret = -EINVAL; while (start < end && !find_next_iomem_res(start, end, flags, desc, @@ -456,7 +456,7 @@ int walk_system_ram_range(unsigned long start_pfn, unsigned long nr_pages, unsigned long flags; struct resource res; unsigned long pfn, end_pfn; - int ret = -1; + int ret = -EINVAL; start = (u64) start_pfn << PAGE_SHIFT; end = ((u64)(start_pfn + nr_pages) << PAGE_SHIFT) - 1; -- 1.8.3

1 0

[PATCH 0/2] fixes CVE-2020-1749
by Yang Yingliang 16 Mar '20

16 Mar '20

1 2

[PATCH] openeuler/config: enable CONFIG_FCOE
by Cheng Jian 14 Mar '20

14 Mar '20

hulk inclusion category: config bugzilla: 28204 CVE: NA The fcoe service failed to start because we did not enable CONFIG_FCOE just enable it. Link: https://gitee.com/open_euler/dashboard?issue_id=I1B9O9 Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- arch/x86/configs/openeuler_defconfig | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 6717b7b..3e0e9a3 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -2124,7 +2124,7 @@ CONFIG_SCSI_SMARTPQI=m # CONFIG_SCSI_HPTIOP is not set CONFIG_LIBFC=m CONFIG_LIBFCOE=m -# CONFIG_FCOE is not set +CONFIG_FCOE=m # CONFIG_SCSI_SNIC is not set # CONFIG_SCSI_DMX3191D is not set # CONFIG_SCSI_IPS is not set diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index f5579a2..4dd4540 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -2181,7 +2181,7 @@ CONFIG_VMWARE_PVSCSI=m CONFIG_HYPERV_STORAGE=m CONFIG_LIBFC=m CONFIG_LIBFCOE=m -# CONFIG_FCOE is not set +CONFIG_FCOE=m CONFIG_FCOE_FNIC=m # CONFIG_SCSI_SNIC is not set # CONFIG_SCSI_DMX3191D is not set -- 2.7.4

1 0

[PATCH hulk-4.19-next] openeuler/config: enable CONFIG_FCOE
by Cheng Jian 14 Mar '20

14 Mar '20

hulk inclusion category: config bugzilla: 28204 CVE: NA The fcoe service failed to start because we did not enable CONFIG_FCOE just enable it. Link: https://gitee.com/open_euler/dashboard?issue_id=I1B9O9 Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 6717b7b..3e0e9a3 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -2124,7 +2124,7 @@ CONFIG_SCSI_SMARTPQI=m # CONFIG_SCSI_HPTIOP is not set CONFIG_LIBFC=m CONFIG_LIBFCOE=m -# CONFIG_FCOE is not set +CONFIG_FCOE=m # CONFIG_SCSI_SNIC is not set # CONFIG_SCSI_DMX3191D is not set # CONFIG_SCSI_IPS is not set -- 2.7.4

1 0

[PATCH] openeuler/config: disable unused debug config
by Cheng Jian 14 Mar '20

14 Mar '20

hulk inclusion category: config bugzilla: 28204 CVE: NA Two config option confirmations are not needed. CONFIG_VIDEO_ADV_DEBUG CONFIG_INFINIBAND_IPOIB_DEBUG So removed them from openeuler config Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 6717b7b..3b94cfa 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -3693,7 +3693,7 @@ CONFIG_MEDIA_CONTROLLER=y CONFIG_VIDEO_DEV=m CONFIG_VIDEO_V4L2_SUBDEV_API=y CONFIG_VIDEO_V4L2=m -CONFIG_VIDEO_ADV_DEBUG=y +# CONFIG_VIDEO_ADV_DEBUG is not set CONFIG_VIDEO_FIXED_MINOR_RANGES=y # CONFIG_V4L2_FLASH_LED_CLASS is not set @@ -4630,7 +4630,7 @@ CONFIG_INFINIBAND_HNS_HIP08=m # CONFIG_INFINIBAND_HNS_TEST is not set CONFIG_INFINIBAND_IPOIB=m CONFIG_INFINIBAND_IPOIB_CM=y -CONFIG_INFINIBAND_IPOIB_DEBUG=y +# CONFIG_INFINIBAND_IPOIB_DEBUG is not set # CONFIG_INFINIBAND_IPOIB_DEBUG_DATA is not set CONFIG_INFINIBAND_SRP=m CONFIG_INFINIBAND_SRPT=m -- 2.7.4

1 0

[PATCH 0/4] update hns3 driver
by Yang Yingliang 14 Mar '20

14 Mar '20

shenhao (4): net: hns3: adds support for extended VLAN mode and 'QOS' in vlan 802.1Q protocol. net: hns3: Increase vlan tag0 when close the port_base_vlan net: hns3: add dumping vlan filter config in debugfs net: hns3: update the number of version drivers/net/ethernet/hisilicon/hns3/hnae3.h | 6 +- .../hisilicon/hns3/hns3_cae/hns3_cae_version.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c | 1 + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 3 + drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 3 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 2 + .../ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c | 57 ++++ .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 288 ++++++++++++++++----- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 11 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 9 - .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 5 + .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 2 +- 13 files changed, 311 insertions(+), 80 deletions(-) -- 1.8.3

1 4

[PATCH hulk-4.19-next] openeuler/config: disable unused debug config
by Cheng Jian 14 Mar '20

14 Mar '20

hulk inclusion category: config bugzilla: 28204 CVE: NA Two config option confirmations are not needed. CONFIG_VIDEO_ADV_DEBUG CONFIG_INFINIBAND_IPOIB_DEBUG So removed them from openeuler config Signed-off-by: Cheng Jian <cj.chengjian(a)huawei.com> --- arch/arm64/configs/openeuler_defconfig | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 6717b7b..3b94cfa 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -3693,7 +3693,7 @@ CONFIG_MEDIA_CONTROLLER=y CONFIG_VIDEO_DEV=m CONFIG_VIDEO_V4L2_SUBDEV_API=y CONFIG_VIDEO_V4L2=m -CONFIG_VIDEO_ADV_DEBUG=y +# CONFIG_VIDEO_ADV_DEBUG is not set CONFIG_VIDEO_FIXED_MINOR_RANGES=y # CONFIG_V4L2_FLASH_LED_CLASS is not set @@ -4630,7 +4630,7 @@ CONFIG_INFINIBAND_HNS_HIP08=m # CONFIG_INFINIBAND_HNS_TEST is not set CONFIG_INFINIBAND_IPOIB=m CONFIG_INFINIBAND_IPOIB_CM=y -CONFIG_INFINIBAND_IPOIB_DEBUG=y +# CONFIG_INFINIBAND_IPOIB_DEBUG is not set # CONFIG_INFINIBAND_IPOIB_DEBUG_DATA is not set CONFIG_INFINIBAND_SRP=m CONFIG_INFINIBAND_SRPT=m -- 2.7.4

1 0

[PATCH] net/hinic: driver code compliance rectification
by Yang Yingliang 12 Mar '20

12 Mar '20

From: Shaozhengchao <shaozhengchao(a)huawei.com> driver inclusion category:bugfix bugzilla:4472 CVE:NA ----------------------------------------------------------------------- hinic driver code compliance rectification. 1.Process return value of snprintf and sscanf function. 2.Modify devil number. Signed-off-by: Shaozhengchao <shaozhengchao(a)huawei.com> Reviewed-by: Luoshaokai <luoshaokai(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- .../net/ethernet/huawei/hinic/hinic_dbgtool_knl.c | 4 +- drivers/net/ethernet/huawei/hinic/hinic_eqs.c | 24 +++++++--- drivers/net/ethernet/huawei/hinic/hinic_ethtool.c | 56 +++++++++++++++++----- drivers/net/ethernet/huawei/hinic/hinic_hwdev.c | 53 ++++++++++++++------ drivers/net/ethernet/huawei/hinic/hinic_lld.c | 48 ++++++++++++++----- drivers/net/ethernet/huawei/hinic/hinic_main.c | 11 ++++- drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c | 8 +++- drivers/net/ethernet/huawei/hinic/hinic_nictool.c | 12 +++-- 8 files changed, 165 insertions(+), 51 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c b/drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c index 1c9c469..535f41a 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_dbgtool_knl.c @@ -768,7 +768,7 @@ int dbgtool_knl_init(void *vhwdev, void *chip_node) sema_init(&dbgtool_info->dbgtool_sem, 1); ret = sscanf(chip_info->chip_name, HINIC_CHIP_NAME "%d", &id); - if (ret < 0) { + if (ret <= 0) { pr_err("Failed to get hinic id\n"); goto sscanf_chdev_fail; } @@ -874,7 +874,7 @@ void dbgtool_knl_deinit(void *vhwdev, void *chip_node) return; err = sscanf(chip_info->chip_name, HINIC_CHIP_NAME "%d", &id); - if (err < 0) + if (err <= 0) pr_err("Failed to get hinic id\n"); g_card_node_array[id] = NULL; diff --git a/drivers/net/ethernet/huawei/hinic/hinic_eqs.c b/drivers/net/ethernet/huawei/hinic/hinic_eqs.c index 4b2b0c0..3fee9fb 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_eqs.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_eqs.c @@ -1133,15 +1133,27 @@ static int init_eq(struct hinic_eq *eq, struct hinic_hwdev *hwdev, u16 q_id, } if (type == HINIC_AEQ) { - snprintf(eq->irq_name, sizeof(eq->irq_name), - "hinic_aeq%d@pci:%s", eq->q_id, - pci_name(hwdev->pcidev_hdl)); + err = snprintf(eq->irq_name, sizeof(eq->irq_name), + "hinic_aeq%d@pci:%s", eq->q_id, + pci_name(hwdev->pcidev_hdl)); + if (err <= 0 || err >= (int)sizeof(eq->irq_name)) { + pr_err("Failed snprintf irq_name, function return(%d) and dest_len(%d)\n", + err, (int)sizeof(eq->irq_name)); + err = -EINVAL; + goto req_irq_err; + } err = request_irq(entry->irq_id, aeq_interrupt, 0UL, eq->irq_name, eq); } else { - snprintf(eq->irq_name, sizeof(eq->irq_name), - "hinic_ceq%d@pci:%s", eq->q_id, - pci_name(hwdev->pcidev_hdl)); + err = snprintf(eq->irq_name, sizeof(eq->irq_name), + "hinic_ceq%d@pci:%s", eq->q_id, + pci_name(hwdev->pcidev_hdl)); + if (err <= 0 || err >= (int)sizeof(eq->irq_name)) { + pr_err("Failed snprintf irq_name, function return(%d) and dest_len(%d)\n", + err, (int)sizeof(eq->irq_name)); + err = -EINVAL; + goto req_irq_err; + } err = request_irq(entry->irq_id, ceq_interrupt, 0UL, eq->irq_name, eq); } diff --git a/drivers/net/ethernet/huawei/hinic/hinic_ethtool.c b/drivers/net/ethernet/huawei/hinic/hinic_ethtool.c index 37d8d38..ac711da 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_ethtool.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_ethtool.c @@ -294,12 +294,15 @@ u32 hinic_get_io_stats_size(struct hinic_nic_dev *nic_dev) } #define QUEUE_STATS_PACK(items, item_idx, array, stats_ptr, qid) { \ - int j; \ + int j, err; \ for (j = 0; j < ARRAY_LEN(array); j++) { \ memcpy((items)[item_idx].name, (array)[j].name, \ HINIC_SHOW_ITEM_LEN); \ - snprintf((items)[item_idx].name, HINIC_SHOW_ITEM_LEN, \ + err = snprintf((items)[item_idx].name, HINIC_SHOW_ITEM_LEN,\ (array)[j].name, (qid)); \ + if (err <= 0 || err >= HINIC_SHOW_ITEM_LEN) \ + pr_err("Failed snprintf: func_ret(%d), dest_len(%d)\n",\ + err, HINIC_SHOW_ITEM_LEN); \ (items)[item_idx].hexadecimal = 0; \ (items)[item_idx].value = \ GET_VALUE_OF_PTR((array)[j].size, \ @@ -335,6 +338,8 @@ void hinic_get_io_stats(struct hinic_nic_dev *nic_dev, #define LP_DEFAULT_TIME (5) /* seconds */ #define LP_PKT_LEN (1514) +#define OBJ_STR_MAX_LEN (32) +#define SET_LINK_STR_MAX_LEN (128) #define PORT_DOWN_ERR_IDX 0 enum diag_test_index { @@ -743,16 +748,28 @@ static int hinic_set_settings_to_hw(struct hinic_nic_dev *nic_dev, struct net_device *netdev = nic_dev->netdev; struct hinic_link_ksettings settings = {0}; enum nic_speed_level speed_level = 0; - char set_link_str[128] = {0}; + char set_link_str[SET_LINK_STR_MAX_LEN] = {0}; int err = 0; - snprintf(set_link_str, sizeof(set_link_str), "%s", - (set_settings & HILINK_LINK_SET_AUTONEG) ? - (autoneg ? "autong enable " : "autong disable ") : ""); + err = snprintf(set_link_str, sizeof(set_link_str), "%s", + (set_settings & HILINK_LINK_SET_AUTONEG) ? + (autoneg ? "autong enable " : "autong disable ") : ""); + if (err < 0 || err >= SET_LINK_STR_MAX_LEN) { + nicif_err(nic_dev, drv, netdev, + "Failed snprintf link state, function return(%d) and dest_len(%d)\n", + err, SET_LINK_STR_MAX_LEN); + return -EFAULT; + } if (set_settings & HILINK_LINK_SET_SPEED) { speed_level = hinic_ethtool_to_hw_speed_level(speed); - snprintf(set_link_str, sizeof(set_link_str), - "%sspeed %d ", set_link_str, speed); + err = snprintf(set_link_str, sizeof(set_link_str), + "%sspeed %d ", set_link_str, speed); + if (err <= 0 || err >= SET_LINK_STR_MAX_LEN) { + nicif_err(nic_dev, drv, netdev, + "Failed snprintf link speed, function return(%d) and dest_len(%d)\n", + err, SET_LINK_STR_MAX_LEN); + return -EFAULT; + } } settings.valid_bitmap = set_settings; @@ -883,7 +900,12 @@ static void hinic_get_drvinfo(struct net_device *netdev, return; } - snprintf(info->fw_version, sizeof(info->fw_version), "%s", mgmt_ver); + err = snprintf(info->fw_version, sizeof(info->fw_version), + "%s", mgmt_ver); + if (err <= 0 || err >= (int)sizeof(info->fw_version)) + nicif_err(nic_dev, drv, netdev, + "Failed snprintf fw_version, function return(%d) and dest_len(%d)\n", + err, (int)sizeof(info->fw_version)); } static u32 hinic_get_msglevel(struct net_device *netdev) @@ -1429,10 +1451,22 @@ static int __hinic_set_coalesce(struct net_device *netdev, if (queue == COALESCE_ALL_QUEUE) { ori_intr_coal = &nic_dev->intr_coalesce[0]; - snprintf(obj_str, sizeof(obj_str), "for netdev"); + err = snprintf(obj_str, sizeof(obj_str), "for netdev"); + if (err <= 0 || err >= OBJ_STR_MAX_LEN) { + nicif_err(nic_dev, drv, netdev, + "Failed snprintf string, function return(%d) and dest_len(%d)\n", + err, OBJ_STR_MAX_LEN); + return -EFAULT; + } } else { ori_intr_coal = &nic_dev->intr_coalesce[queue]; - snprintf(obj_str, sizeof(obj_str), "for queue %d", queue); + err = snprintf(obj_str, sizeof(obj_str), "for queue %d", queue); + if (err <= 0 || err >= OBJ_STR_MAX_LEN) { + nicif_err(nic_dev, drv, netdev, + "Failed snprintf string, function return(%d) and dest_len(%d)\n", + err, OBJ_STR_MAX_LEN); + return -EFAULT; + } } CHECK_COALESCE_CHANGED(coal, rx_coalesce_usecs, COALESCE_TIMER_CFG_UNIT, ori_intr_coal->coalesce_timer_cfg, obj_str); diff --git a/drivers/net/ethernet/huawei/hinic/hinic_hwdev.c b/drivers/net/ethernet/huawei/hinic/hinic_hwdev.c index a31bb6c..c2454f6 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_hwdev.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_hwdev.c @@ -519,6 +519,9 @@ static inline void __set_heartbeat_ehd_detect_delay(struct hinic_hwdev *hwdev, #define HINIC_QUEUE_MAX_DEPTH 12 #define HINIC_MAX_RX_BUFFER_SIZE 15 +#define CAP_INFO_MAC_LEN 512 +#define VENDOR_MAX_LEN 17 + static bool check_root_ctxt(struct hinic_hwdev *hwdev, u16 func_idx, void *buf_in, u16 in_size) { @@ -3891,6 +3894,7 @@ static void __print_cable_info(struct hinic_hwdev *hwdev, char tmp_vendor[17] = {0}; char *port_type = "Unknown port type"; int i; + int err = 0; if (info->cable_absent) { sdk_info(hwdev->dev_hdl, "Cable unpresent\n"); @@ -3918,24 +3922,45 @@ static void __print_cable_info(struct hinic_hwdev *hwdev, memcpy(tmp_vendor, info->vendor_name, sizeof(info->vendor_name)); - snprintf(tmp_str, sizeof(tmp_str) - 1, - "Vendor: %s, %s, length: %um, max_speed: %uGbps", - tmp_vendor, port_type, info->cable_length, - info->cable_max_speed); + err = snprintf(tmp_str, sizeof(tmp_str), + "Vendor: %s, %s, length: %um, max_speed: %uGbps", + tmp_vendor, port_type, info->cable_length, + info->cable_max_speed); + if (err <= 0 || err >= CAP_INFO_MAC_LEN) { + sdk_err(hwdev->dev_hdl, + "Failed snprintf cable vendor info, function return(%d) and dest_len(%d)\n", + err, CAP_INFO_MAC_LEN); + return; + } + if (info->port_type == LINK_PORT_FIBRE || info->port_type == LINK_PORT_AOC) { - snprintf(tmp_str, sizeof(tmp_str) - 1, - "%s, %s, Temperature: %u", tmp_str, - info->sfp_type ? "SFP" : "QSFP", info->cable_temp); + err = snprintf(tmp_str, sizeof(tmp_str), + "%s, %s, Temperature: %u", tmp_str, + info->sfp_type ? "SFP" : "QSFP", + info->cable_temp); + if (err <= 0 || err >= CAP_INFO_MAC_LEN) { + sdk_err(hwdev->dev_hdl, + "Failed snprintf cable Temp, function return(%d) and dest_len(%d)\n", + err, CAP_INFO_MAC_LEN); + return; + } + if (info->sfp_type) { - snprintf(tmp_str, sizeof(tmp_str) - 1, - "%s, rx power: %uuW, tx power: %uuW", - tmp_str, info->power[0], info->power[1]); + err = snprintf(tmp_str, sizeof(tmp_str), + "%s, rx power: %uuW, tx power: %uuW", + tmp_str, info->power[0], info->power[1]); } else { - snprintf(tmp_str, sizeof(tmp_str) - 1, - "%s, rx power: %uuw %uuW %uuW %uuW", - tmp_str, info->power[0], info->power[1], - info->power[2], info->power[3]); + err = snprintf(tmp_str, sizeof(tmp_str), + "%s, rx power: %uuw %uuW %uuW %uuW", + tmp_str, info->power[0], info->power[1], + info->power[2], info->power[3]); + } + if (err <= 0 || err >= CAP_INFO_MAC_LEN) { + sdk_err(hwdev->dev_hdl, + "Failed snprintf power info, function return(%d) and dest_len(%d)\n", + err, CAP_INFO_MAC_LEN); + return; } } diff --git a/drivers/net/ethernet/huawei/hinic/hinic_lld.c b/drivers/net/ethernet/huawei/hinic/hinic_lld.c index 357e050..8a2f280 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_lld.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_lld.c @@ -629,6 +629,7 @@ static void hinic_ignore_minor_version(char *version) { char ver_split[MAX_VER_SPLIT_NUM][MAX_VER_FIELD_LEN] = { {0} }; int max_ver_len, split_num = 0; + int err; __version_split(version, &split_num, ver_split); if (split_num != MAX_VER_SPLIT_NUM) @@ -637,8 +638,11 @@ static void hinic_ignore_minor_version(char *version) max_ver_len = (int)strlen(version) + 1; memset(version, 0, max_ver_len); - snprintf(version, max_ver_len, "%s.%s.%s.0", - ver_split[0], ver_split[1], ver_split[2]); + err = snprintf(version, max_ver_len, "%s.%s.%s.0", + ver_split[0], ver_split[1], ver_split[2]); + if (err <= 0 || err >= max_ver_len) + pr_err("Failed snprintf version, function return(%d) and dest_len(%d)\n", + err, max_ver_len); } static int hinic_detect_version_compatible(struct hinic_pcidev *pcidev) @@ -1152,7 +1156,7 @@ void hinic_get_all_chip_id(void *id_info) lld_dev_hold(); list_for_each_entry(chip_node, &g_hinic_chip_list, node) { err = sscanf(chip_node->chip_name, HINIC_CHIP_NAME "%d", &id); - if (err < 0) + if (err <= 0) pr_err("Failed to get hinic id\n"); card_id->id[i] = id; @@ -1895,6 +1899,7 @@ static int alloc_chip_node(struct hinic_pcidev *pci_adapter) struct card_node *chip_node; unsigned char i; unsigned char parent_bus_number = 0; + int err; if (!pci_is_root_bus(pci_adapter->pcidev->bus)) parent_bus_number = pci_adapter->pcidev->bus->parent->number; @@ -1931,27 +1936,39 @@ static int alloc_chip_node(struct hinic_pcidev *pci_adapter) chip_node = kzalloc(sizeof(*chip_node), GFP_KERNEL); if (!chip_node) { - card_bit_map = CLEAR_BIT(card_bit_map, i); sdk_err(&pci_adapter->pcidev->dev, "Failed to alloc chip node\n"); - return -ENOMEM; + goto alloc_chip_err; } chip_node->dbgtool_attr_file.name = kzalloc(IFNAMSIZ, GFP_KERNEL); if (!(chip_node->dbgtool_attr_file.name)) { - kfree(chip_node); - card_bit_map = CLEAR_BIT(card_bit_map, i); sdk_err(&pci_adapter->pcidev->dev, "Failed to alloc dbgtool attr file name\n"); - return -ENOMEM; + goto alloc_dbgtool_attr_file_err; } /* parent bus number */ chip_node->dp_bus_num = parent_bus_number; - snprintf(chip_node->chip_name, IFNAMSIZ, "%s%d", HINIC_CHIP_NAME, i); - snprintf((char *)chip_node->dbgtool_attr_file.name, - IFNAMSIZ, "%s%d", HINIC_CHIP_NAME, i); + err = snprintf(chip_node->chip_name, IFNAMSIZ, "%s%d", + HINIC_CHIP_NAME, i); + if (err <= 0 || err >= IFNAMSIZ) { + sdk_err(&pci_adapter->pcidev->dev, + "Failed snprintf chip_name, function return(%d) and dest_len(%d)\n", + err, IFNAMSIZ); + goto alloc_dbgtool_attr_file_err; + } + + err = snprintf((char *)chip_node->dbgtool_attr_file.name, + IFNAMSIZ, "%s%d", HINIC_CHIP_NAME, i); + if (err <= 0 || err >= IFNAMSIZ) { + sdk_err(&pci_adapter->pcidev->dev, + "Failed snprintf dbgtool_attr_file_name, function return(%d) and dest_len(%d)\n", + err, IFNAMSIZ); + goto alloc_dbgtool_attr_file_err; + } + sdk_info(&pci_adapter->pcidev->dev, "Add new chip %s to global list succeed\n", chip_node->chip_name); @@ -1962,6 +1979,13 @@ static int alloc_chip_node(struct hinic_pcidev *pci_adapter) pci_adapter->chip_node = chip_node; return 0; + +alloc_dbgtool_attr_file_err: + kfree(chip_node); + +alloc_chip_err: + card_bit_map = CLEAR_BIT(card_bit_map, i); + return -ENOMEM; } static void free_chip_node(struct hinic_pcidev *pci_adapter) @@ -1976,7 +2000,7 @@ static void free_chip_node(struct hinic_pcidev *pci_adapter) "Delete chip %s from global list succeed\n", chip_node->chip_name); err = sscanf(chip_node->chip_name, HINIC_CHIP_NAME "%u", &id); - if (err < 0) + if (err <= 0) sdk_err(&pci_adapter->pcidev->dev, "Failed to get hinic id\n"); card_bit_map = CLEAR_BIT(card_bit_map, id); diff --git a/drivers/net/ethernet/huawei/hinic/hinic_main.c b/drivers/net/ethernet/huawei/hinic/hinic_main.c index 5960603..9b53a6f 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_main.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_main.c @@ -750,8 +750,15 @@ static int hinic_qps_irq_init(struct hinic_nic_dev *nic_dev) cpumask_set_cpu(local_cpu, &irq_cfg->affinity_mask); } - snprintf(irq_cfg->irq_name, sizeof(irq_cfg->irq_name), - "%s_qp%d", nic_dev->netdev->name, q_id); + err = snprintf(irq_cfg->irq_name, sizeof(irq_cfg->irq_name), + "%s_qp%d", nic_dev->netdev->name, q_id); + if (err <= 0 || err >= (int)sizeof(irq_cfg->irq_name)) { + nic_err(&pdev->dev, + "Failed snprintf irq_name, function return(%d) and dest_len(%d)\n", + err, (int)sizeof(irq_cfg->irq_name)); + goto req_tx_irq_err; + } + err = hinic_request_irq(irq_cfg, q_id); if (err) { nicif_err(nic_dev, drv, nic_dev->netdev, "Failed to request Rx irq\n"); diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c b/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c index 8d89d30..cac0cdb 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nic_cfg.c @@ -2175,7 +2175,13 @@ int hinic_get_mgmt_version(void *hwdev, u8 *mgmt_ver) return -EINVAL; } - snprintf(mgmt_ver, HINIC_MGMT_VERSION_MAX_LEN, "%s", up_ver.ver); + err = snprintf(mgmt_ver, HINIC_MGMT_VERSION_MAX_LEN, "%s", up_ver.ver); + if (err <= 0 || err >= HINIC_MGMT_VERSION_MAX_LEN) { + nic_err(dev->dev_hdl, + "Failed snprintf fw version, function return(%d) and dest_len(%d)\n", + err, HINIC_MGMT_VERSION_MAX_LEN); + return -EINVAL; + } return 0; } diff --git a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c index 9a2cb00..46dd9ec 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_nictool.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_nictool.c @@ -1179,14 +1179,20 @@ static int get_drv_version(void *hwdev, void *buf_in, u32 in_size, { struct drv_version_info *ver_info; char ver_str[MAX_VER_INFO_LEN] = {0}; + int err; if (*out_size != sizeof(*ver_info)) { pr_err("Unexpect out buf size from user :%d, expect: %lu\n", *out_size, sizeof(*ver_info)); return -EFAULT; } - snprintf(ver_str, sizeof(ver_str), "%s [compiled with the kernel]", - HINIC_DRV_VERSION); + err = snprintf(ver_str, sizeof(ver_str), + "%s [compiled with the kernel]", HINIC_DRV_VERSION); + if (err <= 0 || err >= MAX_VER_INFO_LEN) { + pr_err("Failed snprintf driver version, function return(%d) and dest_len(%d)\n", + err, MAX_VER_INFO_LEN); + return -EFAULT; + } ver_info = (struct drv_version_info *)buf_out; memcpy(ver_info->ver, ver_str, sizeof(ver_str)); @@ -1420,7 +1426,7 @@ static int get_card_func_info(char *dev_name, struct msg_module *nt_msg) } err = sscanf(dev_name, HINIC_CHIP_NAME "%d", &id); - if (err < 0) { + if (err <= 0) { pr_err("Failed to get hinic id\n"); return err; } -- 1.8.3

1 0

[PATCH 0/3] update hinic and hns3 driver
by Yang Yingliang 12 Mar '20

12 Mar '20

Shaozhengchao (1): net/hinic: Solve the problem that the network card hangs when receiving the skb which frag_size=0 Shengzui You (2): net: hns3: update hns3 version to 1.9.37.1 net: hns3: adds support for reading module eeprom info drivers/net/ethernet/hisilicon/hns3/hnae3.h | 6 +- .../hisilicon/hns3/hns3_cae/hns3_cae_version.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 2 +- drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 79 ++++++++++++++++ .../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 15 +++ .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 102 +++++++++++++++++++++ .../ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 2 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 2 +- drivers/net/ethernet/hisilicon/hns3/kcompat.h | 10 ++ drivers/net/ethernet/huawei/hinic/hinic_ethtool.c | 1 + drivers/net/ethernet/huawei/hinic/hinic_tx.c | 65 ++++++++++--- drivers/net/ethernet/huawei/hinic/hinic_tx.h | 2 + 12 files changed, 269 insertions(+), 19 deletions(-) -- 1.8.3

1 3

[PATCH 0/5] fixes some CVE and bug
by Yang Yingliang 12 Mar '20

12 Mar '20

Cengiz Can (1): blktrace: fix dereference after null check Jan Kara (1): blktrace: Protect q->blk_trace with RCU Qu Wenruo (1): btrfs: tree-checker: Remove comprehensive root owner check Zhang Xiaoxu (1): vgacon: Fix a UAF in vgacon_invert_region Zheng Bin (1): xfs: add agf freeblocks verify in xfs_agf_verify drivers/video/console/vgacon.c | 3 ++ fs/btrfs/tree-checker.c | 24 --------- fs/xfs/libxfs/xfs_alloc.c | 16 ++++++ include/linux/blkdev.h | 2 +- include/linux/blktrace_api.h | 18 +++++-- kernel/trace/blktrace.c | 120 ++++++++++++++++++++++++++++++----------- 6 files changed, 122 insertions(+), 61 deletions(-) -- 1.8.3

1 5

[PATCH] vgacon: Fix a UAF in vgacon_invert_region
by Yang Yingliang 11 Mar '20

11 Mar '20

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> mainline inclusion from mainline-v5.6-rc4 commit 513dc792d6060d5ef572e43852683097a8420f56 category: bugfix bugzilla: 13690 CVE: CVE-2020-8647, CVE-2020-8649 ------------------------------------------------- When syzkaller tests, there is a UAF: BUG: KASan: use after free in vgacon_invert_region+0x9d/0x110 at addr ffff880000100000 Read of size 2 by task syz-executor.1/16489 page:ffffea0000004000 count:0 mapcount:-127 mapping: (null) index:0x0 page flags: 0xfffff00000000() page dumped because: kasan: bad access detected CPU: 1 PID: 16489 Comm: syz-executor.1 Not tainted Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org 04/01/2014 Call Trace: [<ffffffffb119f309>] dump_stack+0x1e/0x20 [<ffffffffb04af957>] kasan_report+0x577/0x950 [<ffffffffb04ae652>] __asan_load2+0x62/0x80 [<ffffffffb090f26d>] vgacon_invert_region+0x9d/0x110 [<ffffffffb0a39d95>] invert_screen+0xe5/0x470 [<ffffffffb0a21dcb>] set_selection+0x44b/0x12f0 [<ffffffffb0a3bfae>] tioclinux+0xee/0x490 [<ffffffffb0a1d114>] vt_ioctl+0xff4/0x2670 [<ffffffffb0a0089a>] tty_ioctl+0x46a/0x1a10 [<ffffffffb052db3d>] do_vfs_ioctl+0x5bd/0xc40 [<ffffffffb052e2f2>] SyS_ioctl+0x132/0x170 [<ffffffffb11c9b1b>] system_call_fastpath+0x22/0x27 Memory state around the buggy address: ffff8800000fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8800000fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff880000100000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff It can be reproduce in the linux mainline by the program: #include <stdio.h> #include <stdlib.h> #include <unistd.h> #include <fcntl.h> #include <sys/types.h> #include <sys/stat.h> #include <sys/ioctl.h> #include <linux/vt.h> struct tiocl_selection { unsigned short xs; /* X start */ unsigned short ys; /* Y start */ unsigned short xe; /* X end */ unsigned short ye; /* Y end */ unsigned short sel_mode; /* selection mode */ }; #define TIOCL_SETSEL 2 struct tiocl { unsigned char type; unsigned char pad; struct tiocl_selection sel; }; int main() { int fd = 0; const char *dev = "/dev/char/4:1"; struct vt_consize v = {0}; struct tiocl tioc = {0}; fd = open(dev, O_RDWR, 0); v.v_rows = 3346; ioctl(fd, VT_RESIZEX, &v); tioc.type = TIOCL_SETSEL; ioctl(fd, TIOCLINUX, &tioc); return 0; } When resize the screen, update the 'vc->vc_size_row' to the new_row_size, but when 'set_origin' in 'vgacon_set_origin', vgacon use 'vga_vram_base' for 'vc_origin' and 'vc_visible_origin', not 'vc_screenbuf'. It maybe smaller than 'vc_screenbuf'. When TIOCLINUX, use the new_row_size to calc the offset, it maybe larger than the vga_vram_size in vgacon driver, then bad access. Also, if set an larger screenbuf firstly, then set an more larger screenbuf, when copy old_origin to new_origin, a bad access may happen. So, If the screen size larger than vga_vram, resize screen should be failed. This alse fix CVE-2020-8649 and CVE-2020-8647. Linus pointed out that overflow checking seems absent. We're saved by the existing bounds checks in vc_do_resize() with rather strict limits: if (cols > VC_RESIZE_MAXCOL || lines > VC_RESIZE_MAXROW) return -EINVAL; Fixes: 0aec4867dca14 ("[PATCH] SVGATextMode fix") Reference: CVE-2020-8647 and CVE-2020-8649 Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> [danvet: augment commit message to point out overflow safety] Cc: stable(a)vger.kernel.org Signed-off-by: Daniel Vetter <daniel.vetter(a)ffwll.ch> Link: https://patchwork.freedesktop.org/patch/msgid/20200304022429.37738-1-zhangx… Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/video/console/vgacon.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c index c6b3bdb..bfaa9ec 100644 --- a/drivers/video/console/vgacon.c +++ b/drivers/video/console/vgacon.c @@ -1316,6 +1316,9 @@ static int vgacon_font_get(struct vc_data *c, struct console_font *font) static int vgacon_resize(struct vc_data *c, unsigned int width, unsigned int height, unsigned int user) { + if ((width << 1) * height > vga_vram_size) + return -EINVAL; + if (width % 2 || width > screen_info.orig_video_cols || height > (screen_info.orig_video_lines * vga_default_font_height)/ c->vc_font.height) -- 1.8.3

1 0

[PATCH] can, slip: Protect tty->disc_data in write_wakeup and close with RCU
by Yang Yingliang 10 Mar '20

10 Mar '20

From: Richard Palethorpe <rpalethorpe(a)suse.com> [ Upstream commit 0ace17d56824165c7f4c68785d6b58971db954dd ] write_wakeup can happen in parallel with close/hangup where tty->disc_data is set to NULL and the netdevice is freed thus also freeing disc_data. write_wakeup accesses disc_data so we must prevent close from freeing the netdev while write_wakeup has a non-NULL view of tty->disc_data. We also need to make sure that accesses to disc_data are atomic. Which can all be done with RCU. This problem was found by Syzkaller on SLCAN, but the same issue is reproducible with the SLIP line discipline using an LTP test based on the Syzkaller reproducer. A fix which didn't use RCU was posted by Hillf Danton. Fixes: 661f7fda21b1 ("slip: Fix deadlock in write_wakeup") Fixes: a8e83b17536a ("slcan: Port write_wakeup deadlock fix from slip") Reported-by: syzbot+017e491ae13c0068598a(a)syzkaller.appspotmail.com Signed-off-by: Richard Palethorpe <rpalethorpe(a)suse.com> Cc: Wolfgang Grandegger <wg(a)grandegger.com> Cc: Marc Kleine-Budde <mkl(a)pengutronix.de> Cc: "David S. Miller" <davem(a)davemloft.net> Cc: Tyler Hall <tylerwhall(a)gmail.com> Cc: linux-can(a)vger.kernel.org Cc: netdev(a)vger.kernel.org Cc: linux-kernel(a)vger.kernel.org Cc: syzkaller(a)googlegroups.com Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/can/slcan.c | 12 ++++++++++-- drivers/net/slip/slip.c | 12 ++++++++++-- 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c index cf0769a..b2e5bca 100644 --- a/drivers/net/can/slcan.c +++ b/drivers/net/can/slcan.c @@ -343,9 +343,16 @@ static void slcan_transmit(struct work_struct *work) */ static void slcan_write_wakeup(struct tty_struct *tty) { - struct slcan *sl = tty->disc_data; + struct slcan *sl; + + rcu_read_lock(); + sl = rcu_dereference(tty->disc_data); + if (!sl) + goto out; schedule_work(&sl->tx_work); +out: + rcu_read_unlock(); } /* Send a can_frame to a TTY queue. */ @@ -640,10 +647,11 @@ static void slcan_close(struct tty_struct *tty) return; spin_lock_bh(&sl->lock); - tty->disc_data = NULL; + rcu_assign_pointer(tty->disc_data, NULL); sl->tty = NULL; spin_unlock_bh(&sl->lock); + synchronize_rcu(); flush_work(&sl->tx_work); /* Flush network side */ diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c index 77207f9..93f303e 100644 --- a/drivers/net/slip/slip.c +++ b/drivers/net/slip/slip.c @@ -452,9 +452,16 @@ static void slip_transmit(struct work_struct *work) */ static void slip_write_wakeup(struct tty_struct *tty) { - struct slip *sl = tty->disc_data; + struct slip *sl; + + rcu_read_lock(); + sl = rcu_dereference(tty->disc_data); + if (!sl) + goto out; schedule_work(&sl->tx_work); +out: + rcu_read_unlock(); } static void sl_tx_timeout(struct net_device *dev) @@ -882,10 +889,11 @@ static void slip_close(struct tty_struct *tty) return; spin_lock_bh(&sl->lock); - tty->disc_data = NULL; + rcu_assign_pointer(tty->disc_data, NULL); sl->tty = NULL; spin_unlock_bh(&sl->lock); + synchronize_rcu(); flush_work(&sl->tx_work); /* VSV = very important to remove timers */ -- 1.8.3

1 0

[PATCH] relay: handle alloc_percpu returning NULL in relay_open
by Yang Yingliang 10 Mar '20

10 Mar '20

hulk inclusion category: bugfix bugzilla: 13690 CVE: CVE-2019-19462 ------------------------------------------------- alloc_percpu() may return NULL, which means chan->buf may be set to NULL. In that case, when we do *per_cpu_ptr(chan->buf, ...), we dereference an invalid pointer: BUG: Unable to handle kernel data access at 0x7dae0000 Faulting instruction address: 0xc0000000003f3fec ... NIP [c0000000003f3fec] relay_open+0x29c/0x600 LR [c0000000003f3fc0] relay_open+0x270/0x600 Call Trace: [c000000054353a70] [c0000000003f3fb4] relay_open+0x264/0x600 (unreliable) [c000000054353b00] [c000000000451764] __blk_trace_setup+0x254/0x600 [c000000054353bb0] [c000000000451b78] blk_trace_setup+0x68/0xa0 [c000000054353c10] [c0000000010da77c] sg_ioctl+0x7bc/0x2e80 [c000000054353cd0] [c000000000758cbc] do_vfs_ioctl+0x13c/0x1300 [c000000054353d90] [c000000000759f14] ksys_ioctl+0x94/0x130 [c000000054353de0] [c000000000759ff8] sys_ioctl+0x48/0xb0 [c000000054353e20] [c00000000000bcd0] system_call+0x5c/0x68 Check if alloc_percpu returns NULL. This was found by syzkaller both on x86 and powerpc, and the reproducer it found on powerpc is capable of hitting the issue as an unprivileged user. https://lore.kernel.org/lkml/20191219121256.26480-1-dja%40axtens.net/ Fixes: 017c59c042d0 ("relay: Use per CPU constructs for the relay channel buffer pointers") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/relay.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/relay.c b/kernel/relay.c index 9e0f523..078f733 100644 --- a/kernel/relay.c +++ b/kernel/relay.c @@ -581,6 +581,10 @@ struct rchan *relay_open(const char *base_filename, return NULL; chan->buf = alloc_percpu(struct rchan_buf *); + if (!chan->buf) { + kfree(chan); + return NULL; + } chan->version = RELAYFS_CHANNEL_VERSION; chan->n_subbufs = n_subbufs; chan->subbuf_size = subbuf_size; -- 1.8.3

1 0

[PATCH] drm/radeon: check the alloc_workqueue return value
by Yang Yingliang 10 Mar '20

10 Mar '20

hulk inclusion category: bugfix bugzilla: 13690 CVE: CVE-2019-16230 ------------------------------------------------- check the alloc_workqueue return value in radeon_crtc_init() to avoid null-ptr-deref. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/gpu/drm/radeon/radeon_display.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c index d8e2d7b..09522b9 100644 --- a/drivers/gpu/drm/radeon/radeon_display.c +++ b/drivers/gpu/drm/radeon/radeon_display.c @@ -672,11 +672,16 @@ static void radeon_crtc_init(struct drm_device *dev, int index) if (radeon_crtc == NULL) return; + radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0); + if (!radeon_crtc->flip_queue) { + kfree(radeon_crtc); + return; + } + drm_crtc_init(dev, &radeon_crtc->base, &radeon_crtc_funcs); drm_mode_crtc_set_gamma_size(&radeon_crtc->base, 256); radeon_crtc->crtc_id = index; - radeon_crtc->flip_queue = alloc_workqueue("radeon-crtc", WQ_HIGHPRI, 0); rdev->mode_info.crtcs[index] = radeon_crtc; if (rdev->family >= CHIP_BONAIRE) { -- 1.8.3

1 0

[PATCH] apparmor: Fix use-after-free in aa_audit_rule_init
by Yang Yingliang 10 Mar '20

10 Mar '20

From: Navid Emamdoost <navid.emamdoost(a)gmail.com> hulk inclusion category: bugfix bugzilla: NA CVE: CVE-2019-18814 --------------------------- In the implementation of aa_audit_rule_init(), when aa_label_parse() fails the allocated memory for rule is released using aa_audit_rule_free(). But after this release, the return statement tries to access the label field of the rule which results in use-after-free. Before releasing the rule, copy errNo and return it after release. Fixes: 52e8c38001d8 ("apparmor: Fix memory leak of rule on error exit path") Signed-off-by: Navid Emamdoost <navid.emamdoost(a)gmail.com> Reviewed-by: Tyler Hicks <tyhicks(a)canonical.com> Signed-off-by: Jason Yan <yanaijie(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- security/apparmor/audit.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/security/apparmor/audit.c b/security/apparmor/audit.c index eeaddfe..70b9730 100644 --- a/security/apparmor/audit.c +++ b/security/apparmor/audit.c @@ -201,8 +201,9 @@ int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule) rule->label = aa_label_parse(&root_ns->unconfined->label, rulestr, GFP_KERNEL, true, false); if (IS_ERR(rule->label)) { + int err = PTR_ERR(rule->label); aa_audit_rule_free(rule); - return PTR_ERR(rule->label); + return err; } *vrule = rule; -- 1.8.3

1 0

[PATCH] can, slip: Protect tty->disc_data in write_wakeup and close with RCU
by Xiongfeng Wang 09 Mar '20

09 Mar '20

From: Richard Palethorpe <rpalethorpe(a)suse.com> [ Upstream commit 0ace17d56824165c7f4c68785d6b58971db954dd ] write_wakeup can happen in parallel with close/hangup where tty->disc_data is set to NULL and the netdevice is freed thus also freeing disc_data. write_wakeup accesses disc_data so we must prevent close from freeing the netdev while write_wakeup has a non-NULL view of tty->disc_data. We also need to make sure that accesses to disc_data are atomic. Which can all be done with RCU. This problem was found by Syzkaller on SLCAN, but the same issue is reproducible with the SLIP line discipline using an LTP test based on the Syzkaller reproducer. A fix which didn't use RCU was posted by Hillf Danton. Fixes: 661f7fda21b1 ("slip: Fix deadlock in write_wakeup") Fixes: a8e83b17536a ("slcan: Port write_wakeup deadlock fix from slip") Reported-by: syzbot+017e491ae13c0068598a(a)syzkaller.appspotmail.com Signed-off-by: Richard Palethorpe <rpalethorpe(a)suse.com> Cc: Wolfgang Grandegger <wg(a)grandegger.com> Cc: Marc Kleine-Budde <mkl(a)pengutronix.de> Cc: "David S. Miller" <davem(a)davemloft.net> Cc: Tyler Hall <tylerwhall(a)gmail.com> Cc: linux-can(a)vger.kernel.org Cc: netdev(a)vger.kernel.org Cc: linux-kernel(a)vger.kernel.org Cc: syzkaller(a)googlegroups.com Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/net/can/slcan.c | 12 ++++++++++-- drivers/net/slip/slip.c | 12 ++++++++++-- 2 files changed, 20 insertions(+), 4 deletions(-) diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c index cf0769a..b2e5bca 100644 --- a/drivers/net/can/slcan.c +++ b/drivers/net/can/slcan.c @@ -343,9 +343,16 @@ static void slcan_transmit(struct work_struct *work) */ static void slcan_write_wakeup(struct tty_struct *tty) { - struct slcan *sl = tty->disc_data; + struct slcan *sl; + + rcu_read_lock(); + sl = rcu_dereference(tty->disc_data); + if (!sl) + goto out; schedule_work(&sl->tx_work); +out: + rcu_read_unlock(); } /* Send a can_frame to a TTY queue. */ @@ -640,10 +647,11 @@ static void slcan_close(struct tty_struct *tty) return; spin_lock_bh(&sl->lock); - tty->disc_data = NULL; + rcu_assign_pointer(tty->disc_data, NULL); sl->tty = NULL; spin_unlock_bh(&sl->lock); + synchronize_rcu(); flush_work(&sl->tx_work); /* Flush network side */ diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c index 77207f9..93f303e 100644 --- a/drivers/net/slip/slip.c +++ b/drivers/net/slip/slip.c @@ -452,9 +452,16 @@ static void slip_transmit(struct work_struct *work) */ static void slip_write_wakeup(struct tty_struct *tty) { - struct slip *sl = tty->disc_data; + struct slip *sl; + + rcu_read_lock(); + sl = rcu_dereference(tty->disc_data); + if (!sl) + goto out; schedule_work(&sl->tx_work); +out: + rcu_read_unlock(); } static void sl_tx_timeout(struct net_device *dev) @@ -882,10 +889,11 @@ static void slip_close(struct tty_struct *tty) return; spin_lock_bh(&sl->lock); - tty->disc_data = NULL; + rcu_assign_pointer(tty->disc_data, NULL); sl->tty = NULL; spin_unlock_bh(&sl->lock); + synchronize_rcu(); flush_work(&sl->tx_work); /* VSV = very important to remove timers */ -- 1.7.12.4

1 0

[PATCH 0/5] livepatch without ftrace for x86_64
by Yang Yingliang 03 Mar '20

03 Mar '20

Cheng Jian (5): livepatch/x86: support livepatch without ftrace livepatch/x86: check active func in consistency stack checking livepatch/arm64: check active func in consistency stack checking livepatch/x86: enable livepatch config for hulk livepatch/x86: enable livepatch config openeuler arch/arm64/kernel/livepatch.c | 84 ++++++---- arch/x86/Kconfig | 1 + arch/x86/configs/hulk_defconfig | 54 +++--- arch/x86/configs/openeuler_defconfig | 18 +- arch/x86/configs/syzkaller_defconfig | 53 +++--- arch/x86/include/asm/livepatch.h | 33 +++- arch/x86/kernel/livepatch.c | 307 +++++++++++++++++++++++++++++++++++ kernel/livepatch/core.c | 13 ++ 8 files changed, 492 insertions(+), 71 deletions(-) -- 1.8.3

1 5

[PATCH 0/5] livepatch without ftrace for x86_64
by Yang Yingliang 03 Mar '20

03 Mar '20

Cheng Jian (5): livepatch/x86: support livepatch without ftrace livepatch/x86: check active func in consistency stack checking livepatch/arm64: check active func in consistency stack checking livepatch/x86: enable livepatch config for hulk livepatch/x86: enable livepatch config openeuler arch/arm64/kernel/livepatch.c | 84 ++++++---- arch/x86/Kconfig | 1 + arch/x86/configs/hulk_defconfig | 54 +++--- arch/x86/configs/openeuler_defconfig | 18 +- arch/x86/configs/syzkaller_defconfig | 53 +++--- arch/x86/include/asm/livepatch.h | 33 +++- arch/x86/kernel/livepatch.c | 307 +++++++++++++++++++++++++++++++++++ kernel/livepatch/core.c | 13 ++ 8 files changed, 492 insertions(+), 71 deletions(-) -- 1.8.3

1 0

[PATCH 0/3] fixes CVE-2020-2732
by Yang Yingliang 03 Mar '20

03 Mar '20

Oliver Upton (2): KVM: nVMX: Refactor IO bitmap checks into helper function KVM: nVMX: Check IO instruction VM-exit conditions Paolo Bonzini (1): KVM: nVMX: Don't emulate instructions in guest mode arch/x86/kvm/vmx.c | 99 +++++++++++++++++++++++++++++++++++++++++++----------- 1 file changed, 79 insertions(+), 20 deletions(-) -- 1.8.3

1 3

[PATCH] floppy: check FDC index for errors before assigning it
by Yang Yingliang 03 Mar '20

03 Mar '20

From: Linus Torvalds <torvalds(a)linux-foundation.org> commit 2e90ca68b0d2f5548804f22f0dd61145516171e3 upstream. Jordy Zomer reported a KASAN out-of-bounds read in the floppy driver in wait_til_ready(). Which on the face of it can't happen, since as Willy Tarreau points out, the function does no particular memory access. Except through the FDCS macro, which just indexes a static allocation through teh current fdc, which is always checked against N_FDC. Except the checking happens after we've already assigned the value. The floppy driver is a disgrace (a lot of it going back to my original horrd "design"), and has no real maintainer. Nobody has the hardware, and nobody really cares. But it still gets used in virtual environment because it's one of those things that everybody supports. The whole thing should be re-written, or at least parts of it should be seriously cleaned up. The 'current fdc' index, which is used by the FDCS macro, and which is often shadowed by a local 'fdc' variable, is a prime example of how not to write code. But because nobody has the hardware or the motivation, let's just fix up the immediate problem with a nasty band-aid: test the fdc index before actually assigning it to the static 'fdc' variable. Reported-by: Jordy Zomer <jordy(a)simplyhacker.com> Cc: Willy Tarreau <w(a)1wt.eu> Cc: Dan Carpenter <dan.carpenter(a)oracle.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/block/floppy.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c index e71589e..bf222c4 100644 --- a/drivers/block/floppy.c +++ b/drivers/block/floppy.c @@ -852,14 +852,17 @@ static void reset_fdc_info(int mode) /* selects the fdc and drive, and enables the fdc's input/dma. */ static void set_fdc(int drive) { + unsigned int new_fdc = fdc; + if (drive >= 0 && drive < N_DRIVE) { - fdc = FDC(drive); + new_fdc = FDC(drive); current_drive = drive; } - if (fdc != 1 && fdc != 0) { + if (new_fdc >= N_FDC) { pr_info("bad fdc value\n"); return; } + fdc = new_fdc; set_dor(fdc, ~0, 8); #if N_FDC > 1 set_dor(1 - fdc, ~8, 0); -- 1.8.3

1 0