November 2022 - Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] x86/tsc: use topology_max_packages() in tsc watchdog check
by Yongqiang Liu 27 Nov '22

27 Nov '22

From: Feng Tang <feng.tang(a)intel.com> hulk inclusion category: bugfix bugzilla: 187942, https://gitee.com/openeuler/kernel/issues/I5U037 CVE: NA ------------------------------- Commit b50db7095fe0 ("x86/tsc: Disable clocksource watchdog for TSC on qualified platorms") was introduced to solve problem that sometimes TSC clocksource is wrongly judged as unstable by watchdog like 'jiffies', HPET, etc. In it, the hardware socket number is a key factor for judging whether to disable the watchdog for TSC, and 'nr_online_nodes' was chosen as an estimation due to it is needed in early boot phase before registering 'tsc-early' clocksource, where all none-boot CPUs are not brought up yet. In recent patch review, Dave Hansen pointed out there are many cases that 'nr_online_nodes' could have issue, like: * numa emulation (numa=fake=4 etc.) * numa=off * platforms with CPU+DRAM nodes, CPU-less HBM nodes, CPU-less persistent memory nodes. Peter Zijlstra suggested to use logical package ids, but it is only usable after smp_init() and all CPUs are initialized. One solution is to skip the watchdog for 'tsc-early' clocksource, and move the check after smp_init(), while before 'tsc' clocksoure is registered, where topology_max_packages() could be used as a much more accurate socket number. Signed-off-by: Feng Tang <feng.tang(a)intel.com> Conflict: arch/x86/kernel/tsc.c Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/x86/kernel/tsc.c | 20 +++++++++++++++----- 1 file changed, 15 insertions(+), 5 deletions(-) diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c index b1ae78bdba50..a7f447c30089 100644 --- a/arch/x86/kernel/tsc.c +++ b/arch/x86/kernel/tsc.c @@ -1095,8 +1095,7 @@ static struct clocksource clocksource_tsc_early = { .rating = 299, .read = read_tsc, .mask = CLOCKSOURCE_MASK(64), - .flags = CLOCK_SOURCE_IS_CONTINUOUS | - CLOCK_SOURCE_MUST_VERIFY, + .flags = CLOCK_SOURCE_IS_CONTINUOUS, .archdata = { .vclock_mode = VCLOCK_TSC }, .resume = tsc_resume, .mark_unstable = tsc_cs_mark_unstable, @@ -1353,6 +1352,20 @@ static int __init init_tsc_clocksource(void) if (boot_cpu_has(X86_FEATURE_NONSTOP_TSC_S3)) clocksource_tsc.flags |= CLOCK_SOURCE_SUSPEND_NONSTOP; + /* + * Disable the clocksource watchdog when the system has: + * - TSC running at constant frequency + * - TSC which does not stop in C-States + * - the TSC_ADJUST register which allows to detect even minimal + * modifications + * - not more than four sockets. + */ + if (boot_cpu_has(X86_FEATURE_CONSTANT_TSC) && + boot_cpu_has(X86_FEATURE_NONSTOP_TSC) && + boot_cpu_has(X86_FEATURE_TSC_ADJUST) && + topology_max_packages() <= 4) + clocksource_tsc.flags &= ~CLOCK_SOURCE_MUST_VERIFY; + /* * When TSC frequency is known (retrieved via MSR or CPUID), we skip * the refined calibration and directly register it as a clocksource. @@ -1483,9 +1496,6 @@ void __init tsc_init(void) return; } - if (tsc_clocksource_reliable) - clocksource_tsc_early.flags &= ~CLOCK_SOURCE_MUST_VERIFY; - clocksource_register_khz(&clocksource_tsc_early, tsc_khz); detect_art(); } -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 000/151] Backport 5.10.138 LTS patches
by Zheng Zengkai 26 Nov '22

26 Nov '22

Backport 5.10.138 LTS patches from upstream. git cherry-pick v5.10.137..v5.10.138~1 -s Already merged(-5): 0e28678a770d devlink: Fix use-after-free after a failed reload 38ddccbda5e8 vsock: Fix memory leak in vsock_connect() a0ae122e9aec atm: idt77252: fix use-after-free bugs caused by tst_timer a220ff343396 can: j1939: j1939_session_destroy(): fix memory leak of skbs 3527e3cbb84d bpf: Fix KASAN use-after-free Read in compute_effective_progs Context conflict： 63671b2bdf5f watchdog: export lockup_detector_reconfigure Defered for performance degradation(-1): 823280a8fba3 locking/atomic: Make test_and_*_bit() ordered on failure Total patches: 157 - 5 - 1 = 151 Aaron Lu (1): x86/mm: Use proper mask when setting PUD mapping Al Viro (6): nios2: page fault et.al. are *not* restartable syscalls... nios2: don't leave NULLs in sys_call_table[] nios2: traced syscall does need to check the syscall number nios2: fix syscall restart checks nios2: restarts apply only to the first sigframe we build... nios2: add force_successful_syscall_return() Alan Brady (1): i40e: Fix to stop tx_timeout recovery if GLOBR fails Amadeusz Sławiński (1): ALSA: info: Fix llseek return value when using callback Amelie Delaunay (1): usb: dwc2: gadget: remove D+ pull-up while no vbus with usb-role-switch Andrew Donnellan (1): gcc-plugins: Undefine LATENT_ENTROPY_PLUGIN when plugin disabled for a file Andy Shevchenko (1): pinctrl: intel: Check against matching data instead of ACPI companion Arun Ramadoss (1): net: dsa: microchip: ksz9477: fix fdb_dump last invalid entry Bard Liao (1): ASoC: SOF: intel: move sof_intel_dsp_desc() forward Bob Pearson (1): RDMA/rxe: Limit the number of calls to each tasklet Celeste Liu (1): riscv: mmap with PROT_WRITE but no PROT_READ is invalid Chao Yu (2): f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page() f2fs: fix to do sanity check on segment type in build_sit_entries() Chen Lin (1): dpaa2-eth: trace the allocated address instead of page struct Chia-Lin Kao (AceLan) (1): net: atlantic: fix aq_vec index out of range error Christoffer Sandberg (1): ALSA: hda/realtek: Add quirk for Clevo NS50PU, NS70PU Christophe JAILLET (6): mmc: pxamci: Fix another error handling path in pxamci_probe() mmc: pxamci: Fix an error handling path in pxamci_probe() mmc: meson-gx: Fix an error handling path in meson_mmc_probe() perf probe: Fix an error handling path in 'parse_perf_probe_command()' stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove() cxl: Fix a memory leak in an error handling path Christophe Leroy (1): powerpc/32: Don't always pass -mcpu=powerpc to the compiler Csókás Bence (1): fec: Fix timer capture timing in `fec_ptp_enable_pps()` Damien Le Moal (1): ata: libata-eh: Add missing command name Dan Aloni (1): sunrpc: fix expiry of auth creds Dan Carpenter (3): NTB: ntb_tool: uninitialized heap data in tool_fn_write() xen/xenbus: fix return type in xenbus_file_read() netfilter: nftables: fix a warning message in nf_tables_commit_audit_collect() Dmitry Baryshkov (1): dt-bindings: clock: qcom,gcc-msm8996: add more GCC clock sources Dongliang Mu (1): netfilter: nf_tables: fix audit memory leak in nf_tables_commit Fedor Pchelkin (1): can: j1939: j1939_sk_queue_activate_next_locked(): replace WARN_ON_ONCE with netdev_warn_once() Filipe Manana (1): btrfs: fix lost error handling when looking up extended ref on log replay Florian Westphal (1): plip: avoid rcu debug splat Frank Li (1): usb: cdns3 fix use-after-free at workaround 2 Frieder Schrempf (1): regulator: pca9450: Remove restrictions for regulator-name Grzegorz Siwik (1): ice: Ignore EEXIST when setting promisc mode Guenter Roeck (1): lib/list_debug.c: Detect uninitialized lists Helge Deller (1): modules: Ensure natural alignment for .altinstructions and __bug_table sections Hou Tao (5): bpf: Acquire map uref in .init_seq_private for array map iterator bpf: Acquire map uref in .init_seq_private for hash map iterator bpf: Acquire map uref in .init_seq_private for sock local storage map iterator bpf: Acquire map uref in .init_seq_private for sock{map,hash} iterator bpf: Check the validity of max_rdwr_access for sock local storage map iterator Huacai Chen (1): PCI/ACPI: Guard ARM64-specific mcfg_quirks Jakub Kicinski (1): net: genl: fix error path memory leak in policy dumping James Smart (1): scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input Jason A. Donenfeld (1): um: add "noreboot" command line option for PANIC_TIMEOUT=-1 setups Jean-Philippe Brucker (1): uacce: Handle parent device removal or parent driver module rmmod Jeff Layton (1): ceph: don't leak snap_rwsem in handle_cap_grant Jens Wiklander (1): tee: fix memory leak in tee_shm_register() Jianhua Lu (1): pinctrl: qcom: sm8250: Fix PDC map John Johansen (5): apparmor: fix quiet_denied for file rules apparmor: fix absroot causing audited secids to begin with = apparmor: Fix failed mount permission check error message apparmor: fix setting unconfined mode on a loaded profile apparmor: fix overlapping attachment computation Jozef Martiniak (1): gadgetfs: ep_io - wait until IRQ finishes Keith Busch (1): PCI/ERR: Retain status from error notification Kiselev, Oleg (1): ext4: avoid resizing to a partial cluster size Krzysztof Kozlowski (1): dt-bindings: arm: qcom: fix MSM8916 MTP compatibles Laurent Dufour (1): watchdog: export lockup_detector_reconfigure Liang He (5): drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors() usb: host: ohci-ppc-of: Fix refcount leak bug usb: renesas: Fix refcount leak bug tty: serial: Fix refcount leak bug in ucc_uart.c mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start Liao Chang (1): csky/kprobe: reclaim insn_slot on kprobe unregistration Lin Ma (1): igb: Add lock to avoid data race Logan Gunthorpe (1): md: Notify sysfs sync_completed in md_reap_sync_thread() Luís Henriques (1): ceph: use correct index when encoding client supported features Marc Kleine-Budde (1): can: ems_usb: fix clang's -Wunaligned-access warning Martin Povišer (4): ASoC: tas2770: Set correct FSYNC polarity ASoC: tas2770: Allow mono streams ASoC: tas2770: Drop conflicting set_bias_level power setting ASoC: tas2770: Fix handling of mute/unmute Masahiro Yamada (1): kbuild: fix the modules order between drivers and libs Matthew Wilcox (Oracle) (1): qrtr: Convert qrtr_ports from IDR to XArray Matthias May (3): geneve: do not use RT_TOS for IPv6 flowlabel ipv6: do not use RT_TOS for IPv6 flowlabel geneve: fix TOS inheriting for ipv4 Miaoqian Lin (1): pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map Michael Ellerman (1): powerpc/pci: Fix get_phb_number() locking Michael Grzeschik (1): usb: gadget: uvc: call uvc uvcg_warn on completed status instead of uvcg_info Mikulas Patocka (1): rds: add missing barrier to release_refill Nathan Chancellor (1): MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0 Neil Armstrong (1): spi: meson-spicc: add local pow2 clock ops to preserve rate between messages Nikita Travkin (1): pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed Ondrej Mosnacek (1): kbuild: dummy-tools: avoid tmpdir leak in dummy gcc Pablo Neira Ayuso (5): netfilter: nf_tables: really skip inactive sets when allocating name netfilter: nf_tables: validate NFTA_SET_ELEM_OBJREF based on NFT_SET_OBJECT flag netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is specified netfilter: nftables: add helper function to set the base sequence number netfilter: add helper function to set up the nfnetlink header and use it Pascal Terjan (1): vboxguest: Do not use devm for irq Pavan Chebbi (1): PCI: Add ACS quirk for Broadcom BCM5750x NICs Peilin Ye (1): vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout() Przemyslaw Patynowski (1): iavf: Fix adminq error handling Qifu Zhang (1): Documentation: ACPI: EINJ: Fix obsolete example Richard Guy Briggs (1): audit: log nftables configuration change events once per table Robert Marko (1): clk: qcom: ipq8074: dont disable gcc_sleep_clk_src Roberto Sassu (1): tools build: Switch to new openssl API for test-libcrypto Rustam Subkhankulov (1): net: dsa: sja1105: fix buffer overflow in sja1105_setup_devlink_regions() Sagi Grimberg (1): nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue teardown Sai Prakash Ranjan (2): irqchip/tegra: Fix overflow implicit truncation warnings drm/meson: Fix overflow implicit truncation warnings Sakari Ailus (1): ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool Samuel Holland (2): pinctrl: sunxi: Add I/O bias setting for H6 R-PIO drm/sun4i: dsi: Prevent underflow when computing packet sizes Sandor Bodo-Merle (1): net: bgmac: Fix a BUG triggered by wrong bytes_compl Schspa Shi (1): vfio: Clear the caps->buf to NULL after free Sebastian Würl (1): can: mcp251x: Fix race condition on receive interrupt Sergei Antonov (2): net: dsa: mv88e6060: prevent crash on an unused port net: moxa: pass pdev instead of ndev to DMA functions Sergey Senozhatsky (1): zram: do not lookup algorithm in backends table Steve French (1): smb3: check xattr value length earlier Steven Rostedt (Google) (3): tracing: Have filter accept "common_cpu" to be consistent selftests/kprobe: Do not test for GRP/ without event failures tracing/probes: Have kprobes and uprobes use $COMM too Takashi Iwai (4): ALSA: usb-audio: More comprehensive mixer map for ASUS ROG Zenith II ALSA: core: Add async signal helpers ALSA: timer: Use deferred fasync helper ALSA: control: Use deferred fasync helper Tom Rix (1): apparmor: fix aa_label_asxprint return check Tony Lindgren (1): clk: ti: Stop using legacy clkctrl names for omap4 and 5 Trond Myklebust (5): NFSv4.1: Don't decrease the value of seq_nr_highest_sent NFSv4.1: Handle NFS4ERR_DELAY replies to OP_SEQUENCE correctly NFSv4: Fix races in the legacy idmapper upcall NFSv4/pnfs: Fix a use-after-free bug in open SUNRPC: Reinitialise the backchannel request buffers before reuse Tzung-Bi Shih (1): platform/chrome: cros_ec_proto: don't show MKBP version if unsupported Uwe Kleine-König (2): i2c: imx: Make sure to unregister adapter on remove() dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync() failed Vladimir Oltean (1): net: dsa: felix: fix ethtool 256-511 and 512-1023 TX packet counters Vladimir Zapolskiy (1): clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description Wentao_Liang (1): drivers:md:fix a potential use-after-free bug Xianting Tian (1): RISC-V: Add fast call path of crash_kexec() Xin Xiong (1): apparmor: fix reference count leak in aa_pivotroot() Xiu Jianfeng (1): apparmor: Fix memleak in aa_simple_write_to_buffer() Xuan Zhuo (1): virtio_net: fix memory leak inside XPD_TX with mergeable Ye Bin (1): ext4: avoid remove directory when directory is corrupted Yu Xiao (1): nfp: ethtool: fix the display error of `ethtool -m DEVNAME` Yuanzheng Song (1): tools/vm/slabinfo: use alphabetic order when two values are equal Zhang Xianwei (1): NFSv4.1: RECLAIM_COMPLETE must handle EACCES Zheyu Ma (1): video: fbdev: i740fb: Check the argument of i740_calc_vclk() Zhouyi Zhou (1): powerpc/64: Init jump labels before parse_early_param() .../devicetree/bindings/arm/qcom.yaml | 2 +- .../bindings/clock/qcom,gcc-msm8996.yaml | 16 + .../regulator/nxp,pca9450-regulator.yaml | 11 - .../firmware-guide/acpi/apei/einj.rst | 2 +- Makefile | 6 +- arch/csky/kernel/probes/kprobes.c | 4 + arch/mips/cavium-octeon/octeon-platform.c | 3 +- arch/mips/mm/tlbex.c | 4 +- arch/nios2/include/asm/entry.h | 3 +- arch/nios2/include/asm/ptrace.h | 2 + arch/nios2/kernel/entry.S | 22 +- arch/nios2/kernel/signal.c | 3 +- arch/nios2/kernel/syscall_table.c | 1 + arch/powerpc/Makefile | 26 +- arch/powerpc/kernel/pci-common.c | 16 +- arch/powerpc/kernel/prom.c | 7 + arch/powerpc/platforms/Kconfig.cputype | 21 +- arch/riscv/kernel/sys_riscv.c | 5 +- arch/riscv/kernel/traps.c | 4 + arch/um/os-Linux/skas/process.c | 17 +- arch/x86/mm/init_64.c | 2 +- drivers/acpi/pci_mcfg.c | 3 + drivers/acpi/property.c | 8 +- drivers/ata/libata-eh.c | 1 + drivers/block/zram/zcomp.c | 11 +- drivers/clk/qcom/clk-alpha-pll.c | 2 +- drivers/clk/qcom/gcc-ipq8074.c | 1 + drivers/clk/ti/clk-44xx.c | 210 +++++------ drivers/clk/ti/clk-54xx.c | 160 ++++----- drivers/clk/ti/clkctrl.c | 4 - drivers/dma/sprd-dma.c | 5 +- drivers/gpu/drm/meson/meson_drv.c | 5 +- drivers/gpu/drm/meson/meson_viu.c | 22 +- drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 10 +- drivers/i2c/busses/i2c-imx.c | 20 +- drivers/infiniband/sw/rxe/rxe_param.h | 6 + drivers/infiniband/sw/rxe/rxe_task.c | 16 +- drivers/irqchip/irq-tegra.c | 10 +- drivers/md/md.c | 1 + drivers/md/raid5.c | 2 +- drivers/misc/cxl/irq.c | 1 + drivers/misc/uacce/uacce.c | 133 ++++--- drivers/mmc/host/meson-gx-mmc.c | 6 +- drivers/mmc/host/pxamci.c | 4 +- drivers/net/can/spi/mcp251x.c | 18 +- drivers/net/can/usb/ems_usb.c | 2 +- drivers/net/dsa/microchip/ksz9477.c | 3 + drivers/net/dsa/mv88e6060.c | 3 + drivers/net/dsa/ocelot/felix_vsc9959.c | 3 +- drivers/net/dsa/sja1105/sja1105_devlink.c | 2 +- .../net/ethernet/aquantia/atlantic/aq_nic.c | 21 +- drivers/net/ethernet/broadcom/bgmac.c | 2 +- .../net/ethernet/freescale/dpaa2/dpaa2-eth.c | 4 +- drivers/net/ethernet/freescale/fec_ptp.c | 6 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 4 +- drivers/net/ethernet/intel/iavf/iavf_adminq.c | 15 +- drivers/net/ethernet/intel/ice/ice_switch.c | 2 +- drivers/net/ethernet/intel/igb/igb.h | 2 + drivers/net/ethernet/intel/igb/igb_main.c | 12 +- drivers/net/ethernet/moxa/moxart_ether.c | 20 +- .../ethernet/netronome/nfp/nfp_net_ethtool.c | 2 + .../net/ethernet/stmicro/stmmac/dwmac-intel.c | 1 + drivers/net/geneve.c | 15 +- drivers/net/plip/plip.c | 2 +- drivers/net/virtio_net.c | 5 +- drivers/ntb/test/ntb_tool.c | 8 +- drivers/nvme/target/tcp.c | 3 +- drivers/pci/pcie/err.c | 3 +- drivers/pci/quirks.c | 3 + drivers/pinctrl/intel/pinctrl-intel.c | 14 +- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 4 +- drivers/pinctrl/qcom/pinctrl-msm8916.c | 4 +- drivers/pinctrl/qcom/pinctrl-sm8250.c | 2 +- drivers/pinctrl/sunxi/pinctrl-sun50i-h6-r.c | 1 + drivers/pinctrl/sunxi/pinctrl-sunxi.c | 7 +- drivers/platform/chrome/cros_ec_proto.c | 8 +- drivers/scsi/lpfc/lpfc_debugfs.c | 20 +- drivers/spi/spi-meson-spicc.c | 129 +++++-- drivers/tee/tee_core.c | 3 + drivers/tee/tee_shm.c | 3 - drivers/tty/serial/ucc_uart.c | 2 + drivers/usb/cdns3/gadget.c | 2 +- drivers/usb/dwc2/gadget.c | 3 +- drivers/usb/gadget/function/uvc_video.c | 2 +- drivers/usb/gadget/legacy/inode.c | 1 + drivers/usb/host/ohci-ppc-of.c | 1 + drivers/usb/renesas_usbhs/rza.c | 4 + drivers/vfio/vfio.c | 1 + drivers/video/fbdev/i740fb.c | 9 +- drivers/virt/vboxguest/vboxguest_linux.c | 9 +- drivers/xen/xenbus/xenbus_dev_frontend.c | 4 +- fs/btrfs/tree-log.c | 4 +- fs/ceph/caps.c | 27 +- fs/ceph/mds_client.c | 7 +- fs/ceph/mds_client.h | 6 - fs/cifs/smb2ops.c | 5 +- fs/ext4/namei.c | 7 +- fs/ext4/resize.c | 10 + fs/f2fs/node.c | 6 +- fs/f2fs/segment.c | 13 + fs/nfs/nfs4idmap.c | 46 +-- fs/nfs/nfs4proc.c | 20 +- include/linux/netfilter/nfnetlink.h | 27 ++ include/linux/nmi.h | 2 + include/linux/uacce.h | 6 +- include/sound/control.h | 2 +- include/sound/core.h | 8 + kernel/bpf/arraymap.c | 6 + kernel/bpf/hashtab.c | 2 + kernel/trace/trace_events.c | 1 + kernel/trace/trace_probe.c | 5 +- kernel/watchdog.c | 21 +- lib/list_debug.c | 12 +- net/can/j1939/socket.c | 5 +- net/core/bpf_sk_storage.c | 12 +- net/core/sock_map.c | 20 +- net/ipv6/ip6_output.c | 3 +- net/netfilter/ipset/ip_set_core.c | 17 +- net/netfilter/nf_conntrack_netlink.c | 77 ++--- net/netfilter/nf_tables_api.c | 325 +++++++++--------- net/netfilter/nf_tables_trace.c | 9 +- net/netfilter/nfnetlink_acct.c | 11 +- net/netfilter/nfnetlink_cthelper.c | 11 +- net/netfilter/nfnetlink_cttimeout.c | 22 +- net/netfilter/nfnetlink_log.c | 11 +- net/netfilter/nfnetlink_queue.c | 12 +- net/netfilter/nft_compat.c | 11 +- net/netlink/genetlink.c | 6 +- net/netlink/policy.c | 14 +- net/qrtr/qrtr.c | 42 +-- net/rds/ib_recv.c | 1 + net/sunrpc/auth.c | 2 +- net/sunrpc/backchannel_rqst.c | 14 + net/vmw_vsock/af_vsock.c | 1 + scripts/Makefile.gcc-plugins | 2 +- scripts/dummy-tools/gcc | 8 +- scripts/module.lds.S | 2 + security/apparmor/apparmorfs.c | 2 +- security/apparmor/audit.c | 2 +- security/apparmor/domain.c | 2 +- security/apparmor/include/lib.h | 5 + security/apparmor/include/policy.h | 2 +- security/apparmor/label.c | 13 +- security/apparmor/mount.c | 8 +- security/apparmor/policy_unpack.c | 12 +- sound/core/control.c | 7 +- sound/core/info.c | 6 +- sound/core/misc.c | 94 +++++ sound/core/timer.c | 11 +- sound/pci/hda/patch_realtek.c | 1 + sound/soc/codecs/tas2770.c | 98 +++--- sound/soc/codecs/tas2770.h | 5 + sound/soc/sof/intel/hda.c | 22 +- sound/usb/card.c | 8 + sound/usb/mixer_maps.c | 34 +- tools/build/feature/test-libcrypto.c | 15 +- tools/perf/util/probe-event.c | 6 +- .../test.d/kprobe/kprobe_syntax_errors.tc | 1 - tools/vm/slabinfo.c | 32 +- 159 files changed, 1459 insertions(+), 1020 deletions(-) -- 2.20.1

1 151

[PATCH openEuler-1.0-LTS 1/2] ext4: fix bug in extents parsing when eh_entries == 0 and eh_depth > 0
by Yongqiang Liu 26 Nov '22

26 Nov '22

From: Luís Henriques <lhenriques(a)suse.de> mainline inclusion from mainline-v6.0-rc7 commit 29a5b8a137ac8eb410cc823653a29ac0e7b7e1b0 category: bugfix bugzilla: 187444, https://gitee.com/openeuler/kernel/issues/I6261Z CVE: NA -------------------------------- When walking through an inode extents, the ext4_ext_binsearch_idx() function assumes that the extent header has been previously validated. However, there are no checks that verify that the number of entries (eh->eh_entries) is non-zero when depth is > 0. And this will lead to problems because the EXT_FIRST_INDEX() and EXT_LAST_INDEX() will return garbage and result in this: [ 135.245946] ------------[ cut here ]------------ [ 135.247579] kernel BUG at fs/ext4/extents.c:2258! [ 135.249045] invalid opcode: 0000 [#1] PREEMPT SMP [ 135.250320] CPU: 2 PID: 238 Comm: tmp118 Not tainted 5.19.0-rc8+ #4 [ 135.252067] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.15.0-0-g2dd4b9b-rebuilt.opensuse.org 04/01/2014 [ 135.255065] RIP: 0010:ext4_ext_map_blocks+0xc20/0xcb0 [ 135.256475] Code: [ 135.261433] RSP: 0018:ffffc900005939f8 EFLAGS: 00010246 [ 135.262847] RAX: 0000000000000024 RBX: ffffc90000593b70 RCX: 0000000000000023 [ 135.264765] RDX: ffff8880038e5f10 RSI: 0000000000000003 RDI: ffff8880046e922c [ 135.266670] RBP: ffff8880046e9348 R08: 0000000000000001 R09: ffff888002ca580c [ 135.268576] R10: 0000000000002602 R11: 0000000000000000 R12: 0000000000000024 [ 135.270477] R13: 0000000000000000 R14: 0000000000000024 R15: 0000000000000000 [ 135.272394] FS: 00007fdabdc56740(0000) GS:ffff88807dd00000(0000) knlGS:0000000000000000 [ 135.274510] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 135.276075] CR2: 00007ffc26bd4f00 CR3: 0000000006261004 CR4: 0000000000170ea0 [ 135.277952] Call Trace: [ 135.278635] <TASK> [ 135.279247] ? preempt_count_add+0x6d/0xa0 [ 135.280358] ? percpu_counter_add_batch+0x55/0xb0 [ 135.281612] ? _raw_read_unlock+0x18/0x30 [ 135.282704] ext4_map_blocks+0x294/0x5a0 [ 135.283745] ? xa_load+0x6f/0xa0 [ 135.284562] ext4_mpage_readpages+0x3d6/0x770 [ 135.285646] read_pages+0x67/0x1d0 [ 135.286492] ? folio_add_lru+0x51/0x80 [ 135.287441] page_cache_ra_unbounded+0x124/0x170 [ 135.288510] filemap_get_pages+0x23d/0x5a0 [ 135.289457] ? path_openat+0xa72/0xdd0 [ 135.290332] filemap_read+0xbf/0x300 [ 135.291158] ? _raw_spin_lock_irqsave+0x17/0x40 [ 135.292192] new_sync_read+0x103/0x170 [ 135.293014] vfs_read+0x15d/0x180 [ 135.293745] ksys_read+0xa1/0xe0 [ 135.294461] do_syscall_64+0x3c/0x80 [ 135.295284] entry_SYSCALL_64_after_hwframe+0x46/0xb0 This patch simply adds an extra check in __ext4_ext_check(), verifying that eh_entries is not 0 when eh_depth is > 0. Link: https://bugzilla.kernel.org/show_bug.cgi?id=215941 Link: https://bugzilla.kernel.org/show_bug.cgi?id=216283 Cc: Baokun Li <libaokun1(a)huawei.com> Cc: stable(a)kernel.org Signed-off-by: Luís Henriques <lhenriques(a)suse.de> Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Baokun Li <libaokun1(a)huawei.com> Link: https://lore.kernel.org/r/20220822094235.2690-1-lhenriques@suse.de Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/extents.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c index 578769f10906..6edab0ef28fd 100644 --- a/fs/ext4/extents.c +++ b/fs/ext4/extents.c @@ -508,6 +508,10 @@ static int __ext4_ext_check(const char *function, unsigned int line, error_msg = "invalid eh_entries"; goto corrupted; } + if (unlikely((eh->eh_entries == 0) && (depth > 0))) { + error_msg = "eh_entries is 0 but eh_depth is > 0"; + goto corrupted; + } if (!ext4_valid_extent_entries(inode, eh, lblk, &pblk, depth)) { error_msg = "invalid extent entries"; goto corrupted; -- 2.25.1

1 1

[PATCH openEuler-5.10-LTS 1/2] Bluetooth: L2CAP: Fix attempting to access uninitialized memory
by Zheng Zengkai 23 Nov '22

23 Nov '22

From: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> stable inclusion from stable-v5.10.154 commit 26ca2ac091b49281d73df86111d16e5a76e43bd7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5ZNRS CVE: CVE-2022-42895 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit b1a2cd50c0357f243b7435a732b4e62ba3157a2e upstream. On l2cap_parse_conf_req the variable efs is only initialized if remote_efs has been set. CVE: CVE-2022-42895 CC: stable(a)vger.kernel.org Reported-by: Tamás Koczka <poprdi(a)google.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Reviewed-by: Tedd Ho-Jeong An <tedd.an(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> --- net/bluetooth/l2cap_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 584a9deb8c80..d35b168e7793 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -3758,7 +3758,8 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), (unsigned long) &rfc, endptr - ptr); - if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) { + if (remote_efs && + test_bit(FLAG_EFS_ENABLE, &chan->flags)) { chan->remote_id = efs.id; chan->remote_stype = efs.stype; chan->remote_msdu = le16_to_cpu(efs.msdu); -- 2.20.1

1 1

[PATCH OLK-5.10 v4] mm: Fix kabi change caused by saved_auxv[] in mm_struct for x86_64
by Zheng Zengkai 23 Nov '22

23 Nov '22

openeuler inclusion category: bugfix bugzilla: https://gitee.com/openeuler/intel-kernel/issues/I5RQLJ CVE: NA Intel-SIG: mm: Fix kabi change caused by saved_auxv[] in mm_struct for x86_64. -------------------------------- Use the KABI_DEPRECATE and KABI_USE macro to fix kabi change caused by commit 1c33bb050750 ("x86/elf: Support a new ELF aux vector AT_MINSIGSTKSZ"). The extended saved_auxv[] causes the kabi breakage, move the saved_auxv[] to the end of struct mm_struct. To avoid introducing too many size increase of mm_struct, use a pointer to indirectly reference the relocated saved_auxv[], then adapt the code where mm->saved_auxv is used. Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Lin Wang <lin.x.wang(a)intel.com> Signed-off-by: Aichun Shi <aichun.shi(a)intel.com> --- arch/x86/include/uapi/asm/auxvec.h | 2 ++ fs/binfmt_elf.c | 12 ++++---- fs/binfmt_elf_fdpic.c | 2 +- fs/proc/base.c | 6 ++-- include/linux/mm_types.h | 30 ++++++++++++++++++++ kernel/fork.c | 44 ++++++++++++++++++++++++++---- kernel/sys.c | 10 +++---- 7 files changed, 86 insertions(+), 20 deletions(-) diff --git a/arch/x86/include/uapi/asm/auxvec.h b/arch/x86/include/uapi/asm/auxvec.h index 6beb55bbefa4..6be5f6584119 100644 --- a/arch/x86/include/uapi/asm/auxvec.h +++ b/arch/x86/include/uapi/asm/auxvec.h @@ -13,8 +13,10 @@ /* entries in ARCH_DLINFO: */ #if defined(CONFIG_IA32_EMULATION) || !defined(CONFIG_X86_64) # define AT_VECTOR_SIZE_ARCH 3 +# define ORIG_AT_VECTOR_SIZE_ARCH 2 #else /* else it's non-compat x86-64 */ # define AT_VECTOR_SIZE_ARCH 2 +# define ORIG_AT_VECTOR_SIZE_ARCH 1 #endif #endif /* _ASM_X86_AUXVEC_H */ diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c index ed507d27034b..8e56bb649f0e 100644 --- a/fs/binfmt_elf.c +++ b/fs/binfmt_elf.c @@ -236,7 +236,7 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, return -EFAULT; /* Create the ELF interpreter info */ - elf_info = (elf_addr_t *)mm->saved_auxv; + elf_info = (elf_addr_t *)MM_SAVED_AUXV(mm); /* update AT_VECTOR_SIZE_BASE if the number of NEW_AUX_ENT() changes */ #define NEW_AUX_ENT(id, val) \ do { \ @@ -285,13 +285,13 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, } #undef NEW_AUX_ENT /* AT_NULL is zero; clear the rest too */ - memset(elf_info, 0, (char *)mm->saved_auxv + - sizeof(mm->saved_auxv) - (char *)elf_info); + memset(elf_info, 0, (char *)MM_SAVED_AUXV(mm) + + sizeof(MM_SAVED_AUXV(mm)) - (char *)elf_info); /* And advance past the AT_NULL entry. */ elf_info += 2; - ei_index = elf_info - (elf_addr_t *)mm->saved_auxv; + ei_index = elf_info - (elf_addr_t *)MM_SAVED_AUXV(mm); sp = STACK_ADD(p, ei_index); items = (argc + 1) + (envc + 1) + 1; @@ -352,7 +352,7 @@ create_elf_tables(struct linux_binprm *bprm, const struct elfhdr *exec, mm->env_end = p; /* Put the elf_info on the stack in the right place. */ - if (copy_to_user(sp, mm->saved_auxv, ei_index * sizeof(elf_addr_t))) + if (copy_to_user(sp, MM_SAVED_AUXV(mm), ei_index * sizeof(elf_addr_t))) return -EFAULT; return 0; } @@ -1586,7 +1586,7 @@ static int fill_psinfo(struct elf_prpsinfo *psinfo, struct task_struct *p, static void fill_auxv_note(struct memelfnote *note, struct mm_struct *mm) { - elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv; + elf_addr_t *auxv = (elf_addr_t *) MM_SAVED_AUXV(mm); int i = 0; do i += 2; diff --git a/fs/binfmt_elf_fdpic.c b/fs/binfmt_elf_fdpic.c index be4062b8ba75..06d45339676f 100644 --- a/fs/binfmt_elf_fdpic.c +++ b/fs/binfmt_elf_fdpic.c @@ -1550,7 +1550,7 @@ static int elf_fdpic_core_dump(struct coredump_params *cprm) fill_note(&psinfo_note, "CORE", NT_PRPSINFO, sizeof(*psinfo), psinfo); thread_status_size += notesize(&psinfo_note); - auxv = (elf_addr_t *) current->mm->saved_auxv; + auxv = (elf_addr_t *) current->MM_SAVED_AUXV(mm); i = 0; do i += 2; diff --git a/fs/proc/base.c b/fs/proc/base.c index cc1fdff2e136..fe2633176ed5 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -1038,9 +1038,9 @@ static ssize_t auxv_read(struct file *file, char __user *buf, return 0; do { nwords += 2; - } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */ - return simple_read_from_buffer(buf, count, ppos, mm->saved_auxv, - nwords * sizeof(mm->saved_auxv[0])); + } while (MM_SAVED_AUXV(mm)[nwords - 2] != 0); /* AT_NULL */ + return simple_read_from_buffer(buf, count, ppos, MM_SAVED_AUXV(mm), + nwords * sizeof(MM_SAVED_AUXV(mm)[0])); } static const struct file_operations proc_auxv_operations = { diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h index 15ff1e20f5ca..ba69c5ecd4ce 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h @@ -24,6 +24,21 @@ #endif #define AT_VECTOR_SIZE (2*(AT_VECTOR_SIZE_ARCH + AT_VECTOR_SIZE_BASE + 1)) +#define _MM_STRUCT_SIZE (sizeof(struct mm_struct) + cpumask_size()) + +#if defined(CONFIG_X86_64) + #define ORIG_AT_VECTOR_SIZE (2*(ORIG_AT_VECTOR_SIZE_ARCH + AT_VECTOR_SIZE_BASE + 1)) + #define MM_SAVED_AUXV(mm) mm->mm_extend->saved_auxv + #define MM_STRUCT_SIZE (_MM_STRUCT_SIZE + sizeof(struct mm_struct_extend)) + #define OFFSET_OF_MM_SAVED_AUXV (_MM_STRUCT_SIZE + offsetof(struct mm_struct_extend, saved_auxv)) + #define SIZE_OF_MM_SAVED_AUXV sizeof_field(struct mm_struct_extend, saved_auxv) +#else + #define MM_SAVED_AUXV(mm) mm->saved_auxv + #define MM_STRUCT_SIZE _MM_STRUCT_SIZE + #define OFFSET_OF_MM_SAVED_AUXV offsetof(struct mm_struct, saved_auxv) + #define SIZE_OF_MM_SAVED_AUXV sizeof_field(struct mm_struct, saved_auxv) +#endif + #define INIT_PASID 0 struct address_space; @@ -394,6 +409,13 @@ struct core_state { }; struct kioctx_table; + +#if defined(CONFIG_X86_64) +struct mm_struct_extend { + unsigned long saved_auxv[AT_VECTOR_SIZE]; /* for /proc/PID/auxv */ +}; +#endif + struct mm_struct { struct { struct vm_area_struct *mmap; /* list of VMAs */ @@ -508,7 +530,11 @@ struct mm_struct { unsigned long start_brk, brk, start_stack; unsigned long arg_start, arg_end, env_start, env_end; +#if defined(CONFIG_X86_64) + KABI_DEPRECATE(unsigned long, saved_auxv[ORIG_AT_VECTOR_SIZE]) +#else unsigned long saved_auxv[AT_VECTOR_SIZE]; /* for /proc/PID/auxv */ +#endif /* * Special counters, in some configurations protected by the @@ -592,7 +618,11 @@ struct mm_struct { #endif } __randomize_layout; +#if defined(CONFIG_X86_64) + KABI_USE(1, struct mm_struct_extend *mm_extend) +#else KABI_RESERVE(1) +#endif KABI_RESERVE(2) KABI_RESERVE(3) KABI_RESERVE(4) diff --git a/kernel/fork.c b/kernel/fork.c index 8a40bfda35e1..c2f13f635135 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -1088,6 +1088,21 @@ static struct mm_struct *mm_init(struct mm_struct *mm, struct task_struct *p, return NULL; } +static inline void mm_struct_clear(struct mm_struct *mm) +{ + memset(mm, 0, sizeof(*mm)); + +#if (defined(CONFIG_X86_64)) + /* + * init the mm_struct_extend extra area at the bottom of + * the allocated mm struct and reset mm->mm_extend accordingly. + */ + memset((void *)((unsigned long) mm + _MM_STRUCT_SIZE), + 0, sizeof(struct mm_struct_extend)); + mm->mm_extend = (struct mm_struct_extend *)((unsigned long) mm + _MM_STRUCT_SIZE); +#endif +} + /* * Allocate and initialize an mm_struct. */ @@ -1099,7 +1114,8 @@ struct mm_struct *mm_alloc(void) if (!mm) return NULL; - memset(mm, 0, sizeof(*mm)); + mm_struct_clear(mm); + return mm_init(mm, current, current_user_ns()); } @@ -1382,6 +1398,24 @@ void exec_mm_release(struct task_struct *tsk, struct mm_struct *mm) mm_release(tsk, mm); } +static inline void mm_struct_copy(struct mm_struct *mm, struct mm_struct *oldmm) +{ + memcpy(mm, oldmm, sizeof(*mm)); + +#if defined(CONFIG_X86_64) + /* + * copy the mm_struct_extend extra area at the bottom of + * the oldmm slab object over to the newly allocated mm struct, + * and reset mm->mm_extend accordingly. + */ + memcpy((void *)((unsigned long) mm + _MM_STRUCT_SIZE), + (void *)((unsigned long) oldmm + _MM_STRUCT_SIZE), + sizeof(struct mm_struct_extend)); + + mm->mm_extend = (struct mm_struct_extend *)((unsigned long) mm + _MM_STRUCT_SIZE); +#endif +} + /** * dup_mm() - duplicates an existing mm structure * @tsk: the task_struct with which the new mm will be associated. @@ -1402,7 +1436,7 @@ static struct mm_struct *dup_mm(struct task_struct *tsk, if (!mm) goto fail_nomem; - memcpy(mm, oldmm, sizeof(*mm)); + mm_struct_copy(mm, oldmm); if (!mm_init(mm, tsk, mm->user_ns)) goto fail_nomem; @@ -2872,13 +2906,13 @@ void __init proc_caches_init(void) * dynamically sized based on the maximum CPU number this system * can have, taking hotplug into account (nr_cpu_ids). */ - mm_size = sizeof(struct mm_struct) + cpumask_size(); + mm_size = MM_STRUCT_SIZE; mm_cachep = kmem_cache_create_usercopy("mm_struct", mm_size, ARCH_MIN_MMSTRUCT_ALIGN, SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_ACCOUNT, - offsetof(struct mm_struct, saved_auxv), - sizeof_field(struct mm_struct, saved_auxv), + OFFSET_OF_MM_SAVED_AUXV, + SIZE_OF_MM_SAVED_AUXV, NULL); vm_area_cachep = KMEM_CACHE(vm_area_struct, SLAB_PANIC|SLAB_ACCOUNT); mmap_init(); diff --git a/kernel/sys.c b/kernel/sys.c index c8a31e1037be..10c5a6d2acdc 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -1962,7 +1962,7 @@ static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data struct mm_struct *mm = current->mm; int error; - BUILD_BUG_ON(sizeof(user_auxv) != sizeof(mm->saved_auxv)); + BUILD_BUG_ON(sizeof(user_auxv) != sizeof(MM_SAVED_AUXV(mm))); BUILD_BUG_ON(sizeof(struct prctl_mm_map) > 256); if (opt == PR_SET_MM_MAP_SIZE) @@ -1984,7 +1984,7 @@ static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data * Someone is trying to cheat the auxv vector. */ if (!prctl_map.auxv || - prctl_map.auxv_size > sizeof(mm->saved_auxv)) + prctl_map.auxv_size > sizeof(MM_SAVED_AUXV(mm))) return -EINVAL; memset(user_auxv, 0, sizeof(user_auxv)); @@ -2056,7 +2056,7 @@ static int prctl_set_mm_map(int opt, const void __user *addr, unsigned long data * more complex. */ if (prctl_map.auxv_size) - memcpy(mm->saved_auxv, user_auxv, sizeof(user_auxv)); + memcpy(MM_SAVED_AUXV(mm), user_auxv, sizeof(user_auxv)); mmap_read_unlock(mm); return 0; @@ -2084,10 +2084,10 @@ static int prctl_set_auxv(struct mm_struct *mm, unsigned long addr, user_auxv[AT_VECTOR_SIZE - 2] = 0; user_auxv[AT_VECTOR_SIZE - 1] = 0; - BUILD_BUG_ON(sizeof(user_auxv) != sizeof(mm->saved_auxv)); + BUILD_BUG_ON(sizeof(user_auxv) != sizeof(MM_SAVED_AUXV(mm))); task_lock(current); - memcpy(mm->saved_auxv, user_auxv, len); + memcpy(MM_SAVED_AUXV(mm), user_auxv, len); task_unlock(current); return 0; -- 2.20.1

1 0

[PATCH openEuler-5.10 01/81] Revert "block/wbt: fix negative inflight counter when remove scsi device"
by Zheng Zengkai 21 Nov '22

21 Nov '22

From: Li Nan <linan122(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187584, https://gitee.com/openeuler/kernel/issues/I5QW2R CVE: NA -------------------------------- This reverts commit 37838982c0e97898780682980aaf10755625630e. There are two wbt_enable_default() in bfq_exit_queue(). Although it will not lead to no fault, revert one. Signed-off-by: Li Nan <linan122(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/bfq-iosched.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c index 4bfea5e5354e..1aec01c0a707 100644 --- a/block/bfq-iosched.c +++ b/block/bfq-iosched.c @@ -6418,8 +6418,6 @@ static void bfq_exit_queue(struct elevator_queue *e) spin_unlock_irq(&bfqd->lock); #endif - wbt_enable_default(bfqd->queue); - kfree(bfqd); /* Re-enable throttling in case elevator disabled it */ -- 2.20.1

1 80

[openEuler-5.10 000/150] Backport 5.10.138 LTS
by Zheng Zengkai 21 Nov '22

21 Nov '22

Backport 5.10.138 LTS patches from upstream. git cherry-pick v5.10.137..v5.10.138~1 -s Already merged(-6): 0e28678a770d devlink: Fix use-after-free after a failed reload 38ddccbda5e8 vsock: Fix memory leak in vsock_connect() a0ae122e9aec atm: idt77252: fix use-after-free bugs caused by tst_timer a220ff343396 can: j1939: j1939_session_destroy(): fix memory leak of skbs 3527e3cbb84d bpf: Fix KASAN use-after-free Read in compute_effective_progs 1daa7629d2a2 PCI/ERR: Retain status from error notification Context conflict： 63671b2bdf5f watchdog: export lockup_detector_reconfigure Defered for performance degradation(-1): 823280a8fba3 locking/atomic: Make test_and_*_bit() ordered on failure Total patches: 157 - 6 - 1 = 150 Aaron Lu (1): x86/mm: Use proper mask when setting PUD mapping Al Viro (6): nios2: page fault et.al. are *not* restartable syscalls... nios2: don't leave NULLs in sys_call_table[] nios2: traced syscall does need to check the syscall number nios2: fix syscall restart checks nios2: restarts apply only to the first sigframe we build... nios2: add force_successful_syscall_return() Alan Brady (1): i40e: Fix to stop tx_timeout recovery if GLOBR fails Amadeusz Sławiński (1): ALSA: info: Fix llseek return value when using callback Amelie Delaunay (1): usb: dwc2: gadget: remove D+ pull-up while no vbus with usb-role-switch Andrew Donnellan (1): gcc-plugins: Undefine LATENT_ENTROPY_PLUGIN when plugin disabled for a file Andy Shevchenko (1): pinctrl: intel: Check against matching data instead of ACPI companion Arun Ramadoss (1): net: dsa: microchip: ksz9477: fix fdb_dump last invalid entry Bard Liao (1): ASoC: SOF: intel: move sof_intel_dsp_desc() forward Bob Pearson (1): RDMA/rxe: Limit the number of calls to each tasklet Celeste Liu (1): riscv: mmap with PROT_WRITE but no PROT_READ is invalid Chao Yu (2): f2fs: fix to avoid use f2fs_bug_on() in f2fs_new_node_page() f2fs: fix to do sanity check on segment type in build_sit_entries() Chen Lin (1): dpaa2-eth: trace the allocated address instead of page struct Chia-Lin Kao (AceLan) (1): net: atlantic: fix aq_vec index out of range error Christoffer Sandberg (1): ALSA: hda/realtek: Add quirk for Clevo NS50PU, NS70PU Christophe JAILLET (6): mmc: pxamci: Fix another error handling path in pxamci_probe() mmc: pxamci: Fix an error handling path in pxamci_probe() mmc: meson-gx: Fix an error handling path in meson_mmc_probe() perf probe: Fix an error handling path in 'parse_perf_probe_command()' stmmac: intel: Add a missing clk_disable_unprepare() call in intel_eth_pci_remove() cxl: Fix a memory leak in an error handling path Christophe Leroy (1): powerpc/32: Don't always pass -mcpu=powerpc to the compiler Csókás Bence (1): fec: Fix timer capture timing in `fec_ptp_enable_pps()` Damien Le Moal (1): ata: libata-eh: Add missing command name Dan Aloni (1): sunrpc: fix expiry of auth creds Dan Carpenter (3): NTB: ntb_tool: uninitialized heap data in tool_fn_write() xen/xenbus: fix return type in xenbus_file_read() netfilter: nftables: fix a warning message in nf_tables_commit_audit_collect() Dmitry Baryshkov (1): dt-bindings: clock: qcom,gcc-msm8996: add more GCC clock sources Dongliang Mu (1): netfilter: nf_tables: fix audit memory leak in nf_tables_commit Fedor Pchelkin (1): can: j1939: j1939_sk_queue_activate_next_locked(): replace WARN_ON_ONCE with netdev_warn_once() Filipe Manana (1): btrfs: fix lost error handling when looking up extended ref on log replay Florian Westphal (1): plip: avoid rcu debug splat Frank Li (1): usb: cdns3 fix use-after-free at workaround 2 Frieder Schrempf (1): regulator: pca9450: Remove restrictions for regulator-name Grzegorz Siwik (1): ice: Ignore EEXIST when setting promisc mode Guenter Roeck (1): lib/list_debug.c: Detect uninitialized lists Helge Deller (1): modules: Ensure natural alignment for .altinstructions and __bug_table sections Hou Tao (5): bpf: Acquire map uref in .init_seq_private for array map iterator bpf: Acquire map uref in .init_seq_private for hash map iterator bpf: Acquire map uref in .init_seq_private for sock local storage map iterator bpf: Acquire map uref in .init_seq_private for sock{map,hash} iterator bpf: Check the validity of max_rdwr_access for sock local storage map iterator Huacai Chen (1): PCI/ACPI: Guard ARM64-specific mcfg_quirks Jakub Kicinski (1): net: genl: fix error path memory leak in policy dumping James Smart (1): scsi: lpfc: Prevent buffer overflow crashes in debugfs with malformed user input Jason A. Donenfeld (1): um: add "noreboot" command line option for PANIC_TIMEOUT=-1 setups Jean-Philippe Brucker (1): uacce: Handle parent device removal or parent driver module rmmod Jeff Layton (1): ceph: don't leak snap_rwsem in handle_cap_grant Jens Wiklander (1): tee: fix memory leak in tee_shm_register() Jianhua Lu (1): pinctrl: qcom: sm8250: Fix PDC map John Johansen (5): apparmor: fix quiet_denied for file rules apparmor: fix absroot causing audited secids to begin with = apparmor: Fix failed mount permission check error message apparmor: fix setting unconfined mode on a loaded profile apparmor: fix overlapping attachment computation Jozef Martiniak (1): gadgetfs: ep_io - wait until IRQ finishes Kiselev, Oleg (1): ext4: avoid resizing to a partial cluster size Krzysztof Kozlowski (1): dt-bindings: arm: qcom: fix MSM8916 MTP compatibles Laurent Dufour (1): watchdog: export lockup_detector_reconfigure Liang He (5): drm/meson: Fix refcount bugs in meson_vpu_has_available_connectors() usb: host: ohci-ppc-of: Fix refcount leak bug usb: renesas: Fix refcount leak bug tty: serial: Fix refcount leak bug in ucc_uart.c mips: cavium-octeon: Fix missing of_node_put() in octeon2_usb_clocks_start Liao Chang (1): csky/kprobe: reclaim insn_slot on kprobe unregistration Lin Ma (1): igb: Add lock to avoid data race Logan Gunthorpe (1): md: Notify sysfs sync_completed in md_reap_sync_thread() Luís Henriques (1): ceph: use correct index when encoding client supported features Marc Kleine-Budde (1): can: ems_usb: fix clang's -Wunaligned-access warning Martin Povišer (4): ASoC: tas2770: Set correct FSYNC polarity ASoC: tas2770: Allow mono streams ASoC: tas2770: Drop conflicting set_bias_level power setting ASoC: tas2770: Fix handling of mute/unmute Masahiro Yamada (1): kbuild: fix the modules order between drivers and libs Matthew Wilcox (Oracle) (1): qrtr: Convert qrtr_ports from IDR to XArray Matthias May (3): geneve: do not use RT_TOS for IPv6 flowlabel ipv6: do not use RT_TOS for IPv6 flowlabel geneve: fix TOS inheriting for ipv4 Miaoqian Lin (1): pinctrl: nomadik: Fix refcount leak in nmk_pinctrl_dt_subnode_to_map Michael Ellerman (1): powerpc/pci: Fix get_phb_number() locking Michael Grzeschik (1): usb: gadget: uvc: call uvc uvcg_warn on completed status instead of uvcg_info Mikulas Patocka (1): rds: add missing barrier to release_refill Nathan Chancellor (1): MIPS: tlbex: Explicitly compare _PAGE_NO_EXEC against 0 Neil Armstrong (1): spi: meson-spicc: add local pow2 clock ops to preserve rate between messages Nikita Travkin (1): pinctrl: qcom: msm8916: Allow CAMSS GP clocks to be muxed Ondrej Mosnacek (1): kbuild: dummy-tools: avoid tmpdir leak in dummy gcc Pablo Neira Ayuso (5): netfilter: nf_tables: really skip inactive sets when allocating name netfilter: nf_tables: validate NFTA_SET_ELEM_OBJREF based on NFT_SET_OBJECT flag netfilter: nf_tables: check NFT_SET_CONCAT flag if field_count is specified netfilter: nftables: add helper function to set the base sequence number netfilter: add helper function to set up the nfnetlink header and use it Pascal Terjan (1): vboxguest: Do not use devm for irq Pavan Chebbi (1): PCI: Add ACS quirk for Broadcom BCM5750x NICs Peilin Ye (1): vsock: Set socket state back to SS_UNCONNECTED in vsock_connect_timeout() Przemyslaw Patynowski (1): iavf: Fix adminq error handling Qifu Zhang (1): Documentation: ACPI: EINJ: Fix obsolete example Richard Guy Briggs (1): audit: log nftables configuration change events once per table Robert Marko (1): clk: qcom: ipq8074: dont disable gcc_sleep_clk_src Roberto Sassu (1): tools build: Switch to new openssl API for test-libcrypto Rustam Subkhankulov (1): net: dsa: sja1105: fix buffer overflow in sja1105_setup_devlink_regions() Sagi Grimberg (1): nvmet-tcp: fix lockdep complaint on nvmet_tcp_wq flush during queue teardown Sai Prakash Ranjan (2): irqchip/tegra: Fix overflow implicit truncation warnings drm/meson: Fix overflow implicit truncation warnings Sakari Ailus (1): ACPI: property: Return type of acpi_add_nondev_subnodes() should be bool Samuel Holland (2): pinctrl: sunxi: Add I/O bias setting for H6 R-PIO drm/sun4i: dsi: Prevent underflow when computing packet sizes Sandor Bodo-Merle (1): net: bgmac: Fix a BUG triggered by wrong bytes_compl Schspa Shi (1): vfio: Clear the caps->buf to NULL after free Sebastian Würl (1): can: mcp251x: Fix race condition on receive interrupt Sergei Antonov (2): net: dsa: mv88e6060: prevent crash on an unused port net: moxa: pass pdev instead of ndev to DMA functions Sergey Senozhatsky (1): zram: do not lookup algorithm in backends table Steve French (1): smb3: check xattr value length earlier Steven Rostedt (Google) (3): tracing: Have filter accept "common_cpu" to be consistent selftests/kprobe: Do not test for GRP/ without event failures tracing/probes: Have kprobes and uprobes use $COMM too Takashi Iwai (4): ALSA: usb-audio: More comprehensive mixer map for ASUS ROG Zenith II ALSA: core: Add async signal helpers ALSA: timer: Use deferred fasync helper ALSA: control: Use deferred fasync helper Tom Rix (1): apparmor: fix aa_label_asxprint return check Tony Lindgren (1): clk: ti: Stop using legacy clkctrl names for omap4 and 5 Trond Myklebust (5): NFSv4.1: Don't decrease the value of seq_nr_highest_sent NFSv4.1: Handle NFS4ERR_DELAY replies to OP_SEQUENCE correctly NFSv4: Fix races in the legacy idmapper upcall NFSv4/pnfs: Fix a use-after-free bug in open SUNRPC: Reinitialise the backchannel request buffers before reuse Tzung-Bi Shih (1): platform/chrome: cros_ec_proto: don't show MKBP version if unsupported Uwe Kleine-König (2): i2c: imx: Make sure to unregister adapter on remove() dmaengine: sprd: Cleanup in .remove() after pm_runtime_get_sync() failed Vladimir Oltean (1): net: dsa: felix: fix ethtool 256-511 and 512-1023 TX packet counters Vladimir Zapolskiy (1): clk: qcom: clk-alpha-pll: fix clk_trion_pll_configure description Wentao_Liang (1): drivers:md:fix a potential use-after-free bug Xianting Tian (1): RISC-V: Add fast call path of crash_kexec() Xin Xiong (1): apparmor: fix reference count leak in aa_pivotroot() Xiu Jianfeng (1): apparmor: Fix memleak in aa_simple_write_to_buffer() Xuan Zhuo (1): virtio_net: fix memory leak inside XPD_TX with mergeable Ye Bin (1): ext4: avoid remove directory when directory is corrupted Yu Xiao (1): nfp: ethtool: fix the display error of `ethtool -m DEVNAME` Yuanzheng Song (1): tools/vm/slabinfo: use alphabetic order when two values are equal Zhang Xianwei (1): NFSv4.1: RECLAIM_COMPLETE must handle EACCES Zheyu Ma (1): video: fbdev: i740fb: Check the argument of i740_calc_vclk() Zhouyi Zhou (1): powerpc/64: Init jump labels before parse_early_param() .../devicetree/bindings/arm/qcom.yaml | 2 +- .../bindings/clock/qcom,gcc-msm8996.yaml | 16 + .../regulator/nxp,pca9450-regulator.yaml | 11 - .../firmware-guide/acpi/apei/einj.rst | 2 +- Makefile | 6 +- arch/csky/kernel/probes/kprobes.c | 4 + arch/mips/cavium-octeon/octeon-platform.c | 3 +- arch/mips/mm/tlbex.c | 4 +- arch/nios2/include/asm/entry.h | 3 +- arch/nios2/include/asm/ptrace.h | 2 + arch/nios2/kernel/entry.S | 22 +- arch/nios2/kernel/signal.c | 3 +- arch/nios2/kernel/syscall_table.c | 1 + arch/powerpc/Makefile | 26 +- arch/powerpc/kernel/pci-common.c | 16 +- arch/powerpc/kernel/prom.c | 7 + arch/powerpc/platforms/Kconfig.cputype | 21 +- arch/riscv/kernel/sys_riscv.c | 5 +- arch/riscv/kernel/traps.c | 4 + arch/um/os-Linux/skas/process.c | 17 +- arch/x86/mm/init_64.c | 2 +- drivers/acpi/pci_mcfg.c | 3 + drivers/acpi/property.c | 8 +- drivers/ata/libata-eh.c | 1 + drivers/block/zram/zcomp.c | 11 +- drivers/clk/qcom/clk-alpha-pll.c | 2 +- drivers/clk/qcom/gcc-ipq8074.c | 1 + drivers/clk/ti/clk-44xx.c | 210 +++++------ drivers/clk/ti/clk-54xx.c | 160 ++++----- drivers/clk/ti/clkctrl.c | 4 - drivers/dma/sprd-dma.c | 5 +- drivers/gpu/drm/meson/meson_drv.c | 5 +- drivers/gpu/drm/meson/meson_viu.c | 22 +- drivers/gpu/drm/sun4i/sun6i_mipi_dsi.c | 10 +- drivers/i2c/busses/i2c-imx.c | 20 +- drivers/infiniband/sw/rxe/rxe_param.h | 6 + drivers/infiniband/sw/rxe/rxe_task.c | 16 +- drivers/irqchip/irq-tegra.c | 10 +- drivers/md/md.c | 1 + drivers/md/raid5.c | 2 +- drivers/misc/cxl/irq.c | 1 + drivers/misc/uacce/uacce.c | 133 ++++--- drivers/mmc/host/meson-gx-mmc.c | 6 +- drivers/mmc/host/pxamci.c | 4 +- drivers/net/can/spi/mcp251x.c | 18 +- drivers/net/can/usb/ems_usb.c | 2 +- drivers/net/dsa/microchip/ksz9477.c | 3 + drivers/net/dsa/mv88e6060.c | 3 + drivers/net/dsa/ocelot/felix_vsc9959.c | 3 +- drivers/net/dsa/sja1105/sja1105_devlink.c | 2 +- .../net/ethernet/aquantia/atlantic/aq_nic.c | 21 +- drivers/net/ethernet/broadcom/bgmac.c | 2 +- .../net/ethernet/freescale/dpaa2/dpaa2-eth.c | 4 +- drivers/net/ethernet/freescale/fec_ptp.c | 6 +- drivers/net/ethernet/intel/i40e/i40e_main.c | 4 +- drivers/net/ethernet/intel/iavf/iavf_adminq.c | 15 +- drivers/net/ethernet/intel/ice/ice_switch.c | 2 +- drivers/net/ethernet/intel/igb/igb.h | 2 + drivers/net/ethernet/intel/igb/igb_main.c | 12 +- drivers/net/ethernet/moxa/moxart_ether.c | 20 +- .../ethernet/netronome/nfp/nfp_net_ethtool.c | 2 + .../net/ethernet/stmicro/stmmac/dwmac-intel.c | 1 + drivers/net/geneve.c | 15 +- drivers/net/plip/plip.c | 2 +- drivers/net/virtio_net.c | 5 +- drivers/ntb/test/ntb_tool.c | 8 +- drivers/nvme/target/tcp.c | 3 +- drivers/pci/quirks.c | 3 + drivers/pinctrl/intel/pinctrl-intel.c | 14 +- drivers/pinctrl/nomadik/pinctrl-nomadik.c | 4 +- drivers/pinctrl/qcom/pinctrl-msm8916.c | 4 +- drivers/pinctrl/qcom/pinctrl-sm8250.c | 2 +- drivers/pinctrl/sunxi/pinctrl-sun50i-h6-r.c | 1 + drivers/pinctrl/sunxi/pinctrl-sunxi.c | 7 +- drivers/platform/chrome/cros_ec_proto.c | 8 +- drivers/scsi/lpfc/lpfc_debugfs.c | 20 +- drivers/spi/spi-meson-spicc.c | 129 +++++-- drivers/tee/tee_core.c | 3 + drivers/tee/tee_shm.c | 3 - drivers/tty/serial/ucc_uart.c | 2 + drivers/usb/cdns3/gadget.c | 2 +- drivers/usb/dwc2/gadget.c | 3 +- drivers/usb/gadget/function/uvc_video.c | 2 +- drivers/usb/gadget/legacy/inode.c | 1 + drivers/usb/host/ohci-ppc-of.c | 1 + drivers/usb/renesas_usbhs/rza.c | 4 + drivers/vfio/vfio.c | 1 + drivers/video/fbdev/i740fb.c | 9 +- drivers/virt/vboxguest/vboxguest_linux.c | 9 +- drivers/xen/xenbus/xenbus_dev_frontend.c | 4 +- fs/btrfs/tree-log.c | 4 +- fs/ceph/caps.c | 27 +- fs/ceph/mds_client.c | 7 +- fs/ceph/mds_client.h | 6 - fs/cifs/smb2ops.c | 5 +- fs/ext4/namei.c | 7 +- fs/ext4/resize.c | 10 + fs/f2fs/node.c | 6 +- fs/f2fs/segment.c | 13 + fs/nfs/nfs4idmap.c | 46 +-- fs/nfs/nfs4proc.c | 20 +- include/linux/netfilter/nfnetlink.h | 27 ++ include/linux/nmi.h | 2 + include/linux/uacce.h | 6 +- include/sound/control.h | 2 +- include/sound/core.h | 8 + kernel/bpf/arraymap.c | 6 + kernel/bpf/hashtab.c | 2 + kernel/trace/trace_events.c | 1 + kernel/trace/trace_probe.c | 5 +- kernel/watchdog.c | 21 +- lib/list_debug.c | 12 +- net/can/j1939/socket.c | 5 +- net/core/bpf_sk_storage.c | 12 +- net/core/sock_map.c | 20 +- net/ipv6/ip6_output.c | 3 +- net/netfilter/ipset/ip_set_core.c | 17 +- net/netfilter/nf_conntrack_netlink.c | 77 ++--- net/netfilter/nf_tables_api.c | 325 +++++++++--------- net/netfilter/nf_tables_trace.c | 9 +- net/netfilter/nfnetlink_acct.c | 11 +- net/netfilter/nfnetlink_cthelper.c | 11 +- net/netfilter/nfnetlink_cttimeout.c | 22 +- net/netfilter/nfnetlink_log.c | 11 +- net/netfilter/nfnetlink_queue.c | 12 +- net/netfilter/nft_compat.c | 11 +- net/netlink/genetlink.c | 6 +- net/netlink/policy.c | 14 +- net/qrtr/qrtr.c | 42 +-- net/rds/ib_recv.c | 1 + net/sunrpc/auth.c | 2 +- net/sunrpc/backchannel_rqst.c | 14 + net/vmw_vsock/af_vsock.c | 1 + scripts/Makefile.gcc-plugins | 2 +- scripts/dummy-tools/gcc | 8 +- scripts/module.lds.S | 2 + security/apparmor/apparmorfs.c | 2 +- security/apparmor/audit.c | 2 +- security/apparmor/domain.c | 2 +- security/apparmor/include/lib.h | 5 + security/apparmor/include/policy.h | 2 +- security/apparmor/label.c | 13 +- security/apparmor/mount.c | 8 +- security/apparmor/policy_unpack.c | 12 +- sound/core/control.c | 7 +- sound/core/info.c | 6 +- sound/core/misc.c | 94 +++++ sound/core/timer.c | 11 +- sound/pci/hda/patch_realtek.c | 1 + sound/soc/codecs/tas2770.c | 98 +++--- sound/soc/codecs/tas2770.h | 5 + sound/soc/sof/intel/hda.c | 22 +- sound/usb/card.c | 8 + sound/usb/mixer_maps.c | 34 +- tools/build/feature/test-libcrypto.c | 15 +- tools/perf/util/probe-event.c | 6 +- .../test.d/kprobe/kprobe_syntax_errors.tc | 1 - tools/vm/slabinfo.c | 32 +- 158 files changed, 1458 insertions(+), 1018 deletions(-) -- 2.20.1

1 150

[PATCH openEuler-1.0-LTS] svm: Delete unused ioctl command
by Yongqiang Liu 21 Nov '22

21 Nov '22

From: Wang Wensheng <wangwensheng4(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I61RA3 CVE: NA ------------------------------- The following two ioctl commands are not in used at all. Delete those implementation. SVM_IOCTL_SET_RC SVM_IOCTL_REMAP_PROC Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> Reviewed-by: chenweilong <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/char/svm.c | 196 ++------------------------------------------- 1 file changed, 5 insertions(+), 191 deletions(-) diff --git a/drivers/char/svm.c b/drivers/char/svm.c index 6b44026252e4..4cd04ca378ff 100644 --- a/drivers/char/svm.c +++ b/drivers/char/svm.c @@ -1484,186 +1484,6 @@ int svm_get_pasid(pid_t vpid, int dev_id __maybe_unused) } EXPORT_SYMBOL_GPL(svm_get_pasid); -static int svm_set_rc(unsigned long __user *arg) -{ - unsigned long addr, size, rc; - unsigned long end, page_size, offset; - pte_t *pte = NULL; - struct mm_struct *mm = current->mm; - - if (acpi_disabled) - return -EPERM; - - if (arg == NULL) - return -EINVAL; - - if (get_user(addr, arg)) - return -EFAULT; - - if (get_user(size, arg + 1)) - return -EFAULT; - - if (get_user(rc, arg + 2)) - return -EFAULT; - - end = addr + size; - if (addr >= end) - return -EINVAL; - - down_read(&mm->mmap_sem); - while (addr < end) { - pte = svm_walk_pt(addr, &page_size, &offset); - if (!pte) { - up_read(&mm->mmap_sem); - return -ESRCH; - } - pte->pte |= (rc & (u64)0x0f) << 59; - addr += page_size - offset; - } - up_read(&mm->mmap_sem); - - return 0; -} - -static long svm_remap_get_phys(struct mm_struct *mm, struct vm_area_struct *vma, - unsigned long addr, unsigned long *phys, - unsigned long *page_size, unsigned long *offset) -{ - long err = -EINVAL; - pgd_t *pgd = NULL; - pud_t *pud = NULL; - pte_t *pte = NULL; - - if (mm == NULL || vma == NULL || phys == NULL || - page_size == NULL || offset == NULL) - return err; - - pgd = pgd_offset(mm, addr); - if (pgd_none(*pgd)) - return err; - - pud = pud_offset(pgd, addr); - if (pud_none(*pud)) - return err; - - pte = svm_get_pte(vma, pud, addr, page_size, offset); - if (pte && pte_present(*pte)) { - *phys = PFN_PHYS(pte_pfn(*pte)); - return 0; - } - - return err; -} - -static long svm_remap_proc(unsigned long __user *arg) -{ - long ret = -EINVAL; - struct svm_proc_mem pmem; - struct task_struct *ptask = NULL; - struct mm_struct *pmm = NULL, *mm = current->mm; - struct vm_area_struct *pvma = NULL, *vma = NULL; - unsigned long end, vaddr, phys, buf, offset, pagesize; - - if (!acpi_disabled) - return -EPERM; - - if (arg == NULL) { - pr_err("arg is invalid.\n"); - return ret; - } - - ret = copy_from_user(&pmem, (void __user *)arg, sizeof(pmem)); - if (ret) { - pr_err("failed to copy args from user space.\n"); - return -EFAULT; - } - - if (pmem.buf & (PAGE_SIZE - 1)) { - pr_err("address is not aligned with page size, addr:%pK.\n", - (void *)pmem.buf); - return -EINVAL; - } - - if (pmem.pid) { - ptask = find_get_task_by_vpid(pmem.pid); - if (!ptask) { - pr_err("No task for this pid\n"); - return -EINVAL; - } - } else { - rcu_read_lock(); - ptask = current; - get_task_struct(ptask); - rcu_read_unlock(); - } - - pmm = ptask->mm; - - down_read(&mm->mmap_sem); - down_read(&pmm->mmap_sem); - - pvma = find_vma(pmm, pmem.vaddr); - if (pvma == NULL) { - ret = -ESRCH; - goto err; - } - - vma = find_vma(mm, pmem.buf); - if (vma == NULL) { - ret = -ESRCH; - goto err; - } - - if (pmem.len > SVM_REMAP_MEM_LEN_MAX) { - ret = -EINVAL; - pr_err("too large length of memory.\n"); - goto err; - } - vaddr = pmem.vaddr; - end = vaddr + pmem.len; - buf = pmem.buf; - vma->vm_flags |= VM_SHARED; - if (end > pvma->vm_end || end < vaddr) { - ret = -EINVAL; - pr_err("memory length is out of range, vaddr:%pK, len:%u.\n", - (void *)vaddr, pmem.len); - goto err; - } - - do { - ret = svm_remap_get_phys(pmm, pvma, vaddr, - &phys, &pagesize, &offset); - if (ret) { - ret = -EINVAL; - goto err; - } - - vaddr += pagesize - offset; - - do { - if (remap_pfn_range(vma, buf, phys >> PAGE_SHIFT, - PAGE_SIZE, - __pgprot(vma->vm_page_prot.pgprot | - PTE_DIRTY))) { - - ret = -ESRCH; - goto err; - } - - offset += PAGE_SIZE; - buf += PAGE_SIZE; - phys += PAGE_SIZE; - } while (offset < pagesize); - - } while (vaddr < end); - -err: - up_read(&pmm->mmap_sem); - up_read(&mm->mmap_sem); - put_task_struct(ptask); - return ret; -} - static int svm_proc_load_flag(int __user *arg) { static atomic_t l2buf_load_flag = ATOMIC_INIT(0); @@ -1897,18 +1717,12 @@ static long svm_ioctl(struct file *file, unsigned int cmd, case SVM_IOCTL_GET_PHYS: err = svm_get_phys((unsigned long __user *)arg); break; - case SVM_IOCTL_SET_RC: - err = svm_set_rc((unsigned long __user *)arg); - break; case SVM_IOCTL_PIN_MEMORY: err = svm_pin_memory((unsigned long __user *)arg); break; case SVM_IOCTL_UNPIN_MEMORY: err = svm_unpin_memory((unsigned long __user *)arg); break; - case SVM_IOCTL_REMAP_PROC: - err = svm_remap_proc((unsigned long __user *)arg); - break; case SVM_IOCTL_LOAD_FLAG: err = svm_proc_load_flag((int __user *)arg); break; @@ -1922,12 +1736,12 @@ static long svm_ioctl(struct file *file, unsigned int cmd, err = svm_sp_free_mem((unsigned long __user *)arg); break; default: - err = -EINVAL; - } + err = -EINVAL; + } - if (err) - dev_err(sdev->dev, "%s: %s failed err = %d\n", __func__, - svm_cmd_to_string(cmd), err); + if (err) + dev_err(sdev->dev, "%s: %s failed err = %d\n", __func__, + svm_cmd_to_string(cmd), err); return err; } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] Revert "posix-cpu-timers: Make timespec to nsec conversion safe"
by Yongqiang Liu 19 Nov '22

19 Nov '22

From: Yuyao Lin <linyuyao1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I61XP8 CVE: NA -------------------------------- This reverts commit 098b0e01a91c42aaaf0425605cd126b03fcb0bcf. Function timespec64_to_ns() Add the upper and lower limits check in commit c0b527413194 ("time: Prevent undefined behaviour in timespec64_to_ns()"), timespec64_to_ktime() only check the upper limits, so revert this patch can fix overflow. Signed-off-by: Yuyao Lin <linyuyao1(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/time/posix-cpu-timers.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c index bfaa44a80c03..5ea7ccfb62b8 100644 --- a/kernel/time/posix-cpu-timers.c +++ b/kernel/time/posix-cpu-timers.c @@ -584,11 +584,7 @@ static int posix_cpu_timer_set(struct k_itimer *timer, int timer_flags, if (WARN_ON_ONCE(!p)) return -EINVAL; - /* - * Use the to_ktime conversion because that clamps the maximum - * value to KTIME_MAX and avoid multiplication overflows. - */ - new_expires = ktime_to_ns(timespec64_to_ktime(new->it_value)); + new_expires = timespec64_to_ns(&new->it_value); /* * Protect against sighand release/switch in exit/exec and p->cpu_timers -- 2.25.1

1 0

[PATCH] Revert "posix-cpu-timers: Make timespec to nsec conversion safe"
by Laibin Qiu 19 Nov '22

19 Nov '22

From: Yuyao Lin <linyuyao1(a)huawei.com> Offering: HULK hulk inclusion category: bugfix bugzilla: 186339 -------------------------------- This reverts commit 098b0e01a91c42aaaf0425605cd126b03fcb0bcf. Function timespec64_to_ns() Add the upper and lower limits check in commit c0b527413194 ("time: Prevent undefined behaviour in timespec64_to_ns()"), timespec64_to_ktime() only check the upper limits, so revert this patch can fix overflow. Signed-off-by: Yuyao Lin <linyuyao1(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- kernel/time/posix-cpu-timers.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c index bfaa44a80c03..5ea7ccfb62b8 100644 --- a/kernel/time/posix-cpu-timers.c +++ b/kernel/time/posix-cpu-timers.c @@ -584,11 +584,7 @@ static int posix_cpu_timer_set(struct k_itimer *timer, int timer_flags, if (WARN_ON_ONCE(!p)) return -EINVAL; - /* - * Use the to_ktime conversion because that clamps the maximum - * value to KTIME_MAX and avoid multiplication overflows. - */ - new_expires = ktime_to_ns(timespec64_to_ktime(new->it_value)); + new_expires = timespec64_to_ns(&new->it_value); /* * Protect against sighand release/switch in exit/exec and p->cpu_timers -- 2.25.1

1 0