March 2022 - Kernel - mailweb.openeuler.org

[PATCH openEuler-5.10] mm/dynamic_hugetlb: only compile PG_pool on X86_64 and ARM64
by Zheng Zengkai 22 Mar '22

22 Mar '22

From: Liu Shixin <liushixin2(a)huawei.com> hulk inclusion category: bugfix bugzilla: 46904, https://gitee.com/openeuler/kernel/issues/I4YXOA -------------------------------- When building with defconfig on arm32, we got a compile error: ./include/linux/page-flags-layout.h:95:2: error: #error "Not enough bits in page flags" 95 | #error "Not enough bits in page flags" | ^~~~~ Limit PG_pool to compile only on X86_64 and ARM64 to resolve this issue. Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- fs/proc/page.c | 2 ++ include/linux/page-flags.h | 6 ++++++ include/trace/events/mmflags.h | 10 ++++++++-- 3 files changed, 16 insertions(+), 2 deletions(-) diff --git a/fs/proc/page.c b/fs/proc/page.c index d00c23d543fe..4c5bef99ec10 100644 --- a/fs/proc/page.c +++ b/fs/proc/page.c @@ -220,7 +220,9 @@ u64 stable_page_flags(struct page *page) #ifdef CONFIG_64BIT u |= kpf_copy_bit(k, KPF_ARCH_2, PG_arch_2); #endif +#if defined(CONFIG_X86_64) || defined(CONFIG_ARM64) u |= kpf_copy_bit(k, KPF_POOL, PG_pool); +#endif return u; }; diff --git a/include/linux/page-flags.h b/include/linux/page-flags.h index eb2fe22bc0e9..e1af0a6c8165 100644 --- a/include/linux/page-flags.h +++ b/include/linux/page-flags.h @@ -139,7 +139,9 @@ enum pageflags { #ifdef CONFIG_64BIT PG_arch_2, #endif +#if defined(CONFIG_X86_64) || defined(CONFIG_ARM64) PG_pool, /* Used to track page allocated from dynamic hugetlb pool */ +#endif #ifdef CONFIG_PIN_MEMORY PG_hotreplace, #endif @@ -474,7 +476,11 @@ __PAGEFLAG(Reported, reported, PF_NO_COMPOUND) /* * PagePool() is used to track page allocated from hpool. */ +#if defined(CONFIG_X86_64) || defined(CONFIG_ARM64) PAGEFLAG(Pool, pool, PF_NO_TAIL) +#else +PAGEFLAG_FALSE(Pool) +#endif /* * On an anonymous page mapped into a user virtual memory area, diff --git a/include/trace/events/mmflags.h b/include/trace/events/mmflags.h index dc1805fbf893..b50012bea1ef 100644 --- a/include/trace/events/mmflags.h +++ b/include/trace/events/mmflags.h @@ -87,6 +87,12 @@ #define IF_HAVE_PG_ARCH_2(flag,string) #endif +#if defined(CONFIG_X86_64) || defined(CONFIG_ARM64) +#define IF_HAVE_PG_POOL(flag,string) ,{1UL << flag, string} +#else +#define IF_HAVE_PG_POOL(flag,string) +#endif + #ifdef CONFIG_PIN_MEMORY #define IF_HAVE_PG_HOTREPLACE(flag, string) ,{1UL << flag, string} #else @@ -114,14 +120,14 @@ {1UL << PG_mappedtodisk, "mappedtodisk" }, \ {1UL << PG_reclaim, "reclaim" }, \ {1UL << PG_swapbacked, "swapbacked" }, \ - {1UL << PG_unevictable, "unevictable" }, \ - {1UL << PG_pool, "pool" } \ + {1UL << PG_unevictable, "unevictable" } \ IF_HAVE_PG_MLOCK(PG_mlocked, "mlocked" ) \ IF_HAVE_PG_UNCACHED(PG_uncached, "uncached" ) \ IF_HAVE_PG_HWPOISON(PG_hwpoison, "hwpoison" ) \ IF_HAVE_PG_IDLE(PG_young, "young" ) \ IF_HAVE_PG_IDLE(PG_idle, "idle" ) \ IF_HAVE_PG_ARCH_2(PG_arch_2, "arch_2" ) \ +IF_HAVE_PG_POOL(PG_pool, "pool" ) \ IF_HAVE_PG_HOTREPLACE(PG_hotreplace, "hotreplace" ), \ {1UL << PG_reserve_pgflag_0, "reserve_pgflag_0"}, \ {1UL << PG_reserve_pgflag_1, "reserve_pgflag_1"} -- 2.20.1

1 0

[PATCH openEuler-22.03-LTS] Fix CWE-457 bug-1
by yan 22 Mar '22

22 Mar '22

2 5

[PATCH openEuler-5.10 1/2] fuse: fix pipe buffer lifetime for direct_io
by Zheng Zengkai 21 Mar '22

21 Mar '22

From: Miklos Szeredi <mszeredi(a)redhat.com> mainline inclusion from mainline-v5.17-rc8 commit 0c4bcfdecb1ac0967619ee7ff44871d93c08c909 category: bugfix bugzilla: 186448, https://gitee.com/openeuler/kernel/issues/I4YS7O CVE: CVE-2022-1011 -------------------------------- In FOPEN_DIRECT_IO mode, fuse_file_write_iter() calls fuse_direct_write_iter(), which normally calls fuse_direct_io(), which then imports the write buffer with fuse_get_user_pages(), which uses iov_iter_get_pages() to grab references to userspace pages instead of actually copying memory. On the filesystem device side, these pages can then either be read to userspace (via fuse_dev_read()), or splice()d over into a pipe using fuse_dev_splice_read() as pipe buffers with &nosteal_pipe_buf_ops. This is wrong because after fuse_dev_do_read() unlocks the FUSE request, the userspace filesystem can mark the request as completed, causing write() to return. At that point, the userspace filesystem should no longer have access to the pipe buffer. Fix by copying pages coming from the user address space to new pipe buffers. Reported-by: Jann Horn <jannh(a)google.com> Fixes: c3021629a0d8 ("fuse: support splice() reading from fuse device") Cc: <stable(a)vger.kernel.org> Signed-off-by: Miklos Szeredi <mszeredi(a)redhat.com> Signed-off-by: Zhang Wensheng <zhangwensheng5(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- fs/fuse/dev.c | 12 +++++++++++- fs/fuse/file.c | 1 + fs/fuse/fuse_i.h | 1 + 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index d100b5dfedbd..8ac91ba05d6d 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -945,7 +945,17 @@ static int fuse_copy_page(struct fuse_copy_state *cs, struct page **pagep, while (count) { if (cs->write && cs->pipebufs && page) { - return fuse_ref_page(cs, page, offset, count); + /* + * Can't control lifetime of pipe buffers, so always + * copy user pages. + */ + if (cs->req->args->user_pages) { + err = fuse_copy_fill(cs); + if (err) + return err; + } else { + return fuse_ref_page(cs, page, offset, count); + } } else if (!cs->len) { if (cs->move_pages && page && offset == 0 && count == PAGE_SIZE) { diff --git a/fs/fuse/file.c b/fs/fuse/file.c index e63ce8443c96..a869c3a527a8 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -1433,6 +1433,7 @@ static int fuse_get_user_pages(struct fuse_args_pages *ap, struct iov_iter *ii, (PAGE_SIZE - ret) & (PAGE_SIZE - 1); } + ap->args.user_pages = true; if (write) ap->args.in_pages = true; else diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index d31fc48c6afa..0686788e4283 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -266,6 +266,7 @@ struct fuse_args { bool nocreds:1; bool in_pages:1; bool out_pages:1; + bool user_pages:1; bool out_argvar:1; bool page_zeroing:1; bool page_replace:1; -- 2.20.1

1 1

[PATCH openEuler-5.10 1/4] blk-mq: add exception handling when srcu->sda alloc failed
by Zheng Zengkai 21 Mar '22

21 Mar '22

From: Laibin Qiu <qiulaibin(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186352, https://gitee.com/openeuler/kernel/issues/I4YADX CVE: NA -------------------------------- In case of BLK_MQ_F_BLOCKING, per-hctx srcu is used to protect dispatch critical area. But the current process is not aware when memory of srcu allocation failed in blk_mq_alloc_hctx, which will leads to illegal address BUG. Add return value validation to avoid this problem. Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/blk-mq.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index c3beaca1f4fb..9ae1663348ac 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2852,12 +2852,16 @@ blk_mq_alloc_hctx(struct request_queue *q, struct blk_mq_tag_set *set, if (!hctx->fq) goto free_bitmap; - if (hctx->flags & BLK_MQ_F_BLOCKING) - init_srcu_struct(hctx->srcu); + if (hctx->flags & BLK_MQ_F_BLOCKING) { + if (init_srcu_struct(hctx->srcu) != 0) + goto free_flush_queue; + } blk_mq_hctx_kobj_init(hctx); return hctx; + free_flush_queue: + blk_free_flush_queue(hctx->fq); free_bitmap: sbitmap_free(&hctx->ctx_map); free_ctxs: -- 2.20.1

1 3

openEuler-22.03-LTS KABI whitelist update
by Zhengzengkai 20 Mar '22

20 Mar '22

Update openEuler-22.03-LTS KABI whitelists.

1 0

[PATCH openEuler-5.10 0/9] dynamic hugetlb bugfix and enhancement
by Zheng Zengkai 20 Mar '22

20 Mar '22

Patch 1 fixes a bug found in earlier version. Patch 2,3,4 are potential vulnerability discovered during code analysis. Patch 5 is an optimization. Patch 7 is a feature limitation. Patch 6,8,9 are three bugfix discovered during code analysis. Liu Shixin (9): mm/dynamic_hugetlb: check free_pages_prepares when split pages mm/dynamic_hugetlb: improve the initialization of huge pages mm/dynamic_hugetlb: use pfn to traverse subpages mm/dynamic_hugetlb: check page using check_new_page mm/dynamic_hugetlb: use mem_cgroup_force_empty to reclaim pages mm/dynamic_hugetlb: hold the lock until pages back to hugetlb mm/dynamic_hugetlb: only support to merge 2M dynamicly mm/dynamic_hugetlb: set/clear HPageFreed mm/dynamic_hugetlb: initialize subpages before merging include/linux/memcontrol.h | 2 + mm/dynamic_hugetlb.c | 156 ++++++++++++++++++++++++------------- mm/internal.h | 1 + mm/memcontrol.c | 2 +- mm/page_alloc.c | 2 +- 5 files changed, 109 insertions(+), 54 deletions(-) -- 2.20.1

1 9

[PATCH openEuler-1.0-LTS] blk-mq: add exception handling when srcu->sda alloc failed
by Laibin Qiu 18 Mar '22

18 Mar '22

hulk inclusion category: bugfix bugzilla: 186352, https://gitee.com/openeuler/kernel/issues/I4YADX DTS: DTS2022031707143 CVE: NA -------------------------------- In case of BLK_MQ_F_BLOCKING, per-hctx srcu is used to protect dispatch critical area. But the current process is not aware when memory of srcu allocation failed in blk_mq_alloc_hctx, which will leads to illegal address BUG. Add return value validation to avoid this problem. Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> --- block/blk-mq.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index 0732bcc65f88..9604d2b39745 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2459,12 +2459,16 @@ blk_mq_alloc_hctx(struct request_queue *q, struct blk_mq_tag_set *set, if (!hctx->fq) goto free_bitmap; - if (hctx->flags & BLK_MQ_F_BLOCKING) - init_srcu_struct(hctx->srcu); + if (hctx->flags & BLK_MQ_F_BLOCKING) { + if (init_srcu_struct(hctx->srcu) != 0) + goto free_flush_queue; + } blk_mq_hctx_kobj_init(hctx); return hctx; + free_flush_queue: + blk_free_flush_queue(hctx->fq); free_bitmap: sbitmap_free(&hctx->ctx_map); free_ctxs: -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS] irqchip/gic-phytium-2500: Fix issue that interrupts are concentrated in one cpu
by Laibin Qiu 18 Mar '22

18 Mar '22

From: Mao HongBo <maohongbo(a)phytium.com.cn> Phytium inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I41AUQ CVE: NA ------------------------------------------------- Fix the issue that interrupts are concentrated in one cpu for Phytium S2500 server. Signed-off-by: Mao HongBo <maohongbo(a)phytium.com.cn> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- drivers/irqchip/irq-gic-phytium-2500-its.c | 3 +-- drivers/irqchip/irq-gic-phytium-2500.c | 3 +-- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/irqchip/irq-gic-phytium-2500-its.c b/drivers/irqchip/irq-gic-phytium-2500-its.c index fff1c8546d23..dd24af3793ca 100644 --- a/drivers/irqchip/irq-gic-phytium-2500-its.c +++ b/drivers/irqchip/irq-gic-phytium-2500-its.c @@ -1181,8 +1181,7 @@ static int its_cpumask_select(struct its_device *its_dev, } cpu = cpumask_any_and(mask_val, cpu_mask); - if ((cpu > cpus) && (cpu < (cpus + skt_cpu_cnt[skt_id]))) - cpus = cpu; + cpus = cpus + cpu % skt_cpu_cnt[skt_id]; if (is_kdump_kernel()) { skt = (cpu_logical_map(cpu) >> 16) & 0xff; diff --git a/drivers/irqchip/irq-gic-phytium-2500.c b/drivers/irqchip/irq-gic-phytium-2500.c index 8674463a08c6..103e97f5855e 100644 --- a/drivers/irqchip/irq-gic-phytium-2500.c +++ b/drivers/irqchip/irq-gic-phytium-2500.c @@ -1123,8 +1123,7 @@ static int gic_cpumask_select(struct irq_data *d, const struct cpumask *mask_val } cpu = cpumask_any_and(mask_val, cpu_online_mask); - if ((cpu > cpus) && (cpu < (cpus + skt_cpu_cnt[irq_skt]))) - cpus = cpu; + cpus = cpus + cpu % skt_cpu_cnt[irq_skt]; if (is_kdump_kernel()) { skt = (cpu_logical_map(cpu) >> 16) & 0xff; -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS 1/3] veth: Do not record rx queue hint in veth_xmit
by Laibin Qiu 17 Mar '22

17 Mar '22

From: Daniel Borkmann <daniel(a)iogearbox.net> stable inclusion from linux-4.19.226 commit bd6e97e2b6f59a19894c7032a83f03ad38ede28e -------------------------------- commit 710ad98c363a66a0cd8526465426c5c5f8377ee0 upstream. Laurent reported that they have seen a significant amount of TCP retransmissions at high throughput from applications residing in network namespaces talking to the outside world via veths. The drops were seen on the qdisc layer (fq_codel, as per systemd default) of the phys device such as ena or virtio_net due to all traffic hitting a _single_ TX queue _despite_ multi-queue device. (Note that the setup was _not_ using XDP on veths as the issue is generic.) More specifically, after edbea9220251 ("veth: Store queue_mapping independently of XDP prog presence") which made it all the way back to v4.19.184+, skb_record_rx_queue() would set skb->queue_mapping to 1 (given 1 RX and 1 TX queue by default for veths) instead of leaving at 0. This is eventually retained and callbacks like ena_select_queue() will also pick single queue via netdev_core_pick_tx()'s ndo_select_queue() once all the traffic is forwarded to that device via upper stack or other means. Similarly, for others not implementing ndo_select_queue() if XPS is disabled, netdev_pick_tx() might call into the skb_tx_hash() and check for prior skb_rx_queue_recorded() as well. In general, it is a _bad_ idea for virtual devices like veth to mess around with queue selection [by default]. Given dev->real_num_tx_queues is by default 1, the skb->queue_mapping was left untouched, and so prior to edbea9220251 the netdev_core_pick_tx() could do its job upon __dev_queue_xmit() on the phys device. Unbreak this and restore prior behavior by removing the skb_record_rx_queue() from veth_xmit() altogether. If the veth peer has an XDP program attached, then it would return the first RX queue index in xdp_md->rx_queue_index (unless configured in non-default manner). However, this is still better than breaking the generic case. Fixes: edbea9220251 ("veth: Store queue_mapping independently of XDP prog presence") Fixes: 638264dc9022 ("veth: Support per queue XDP ring") Reported-by: Laurent Bernaille <laurent.bernaille(a)datadoghq.com> Signed-off-by: Daniel Borkmann <daniel(a)iogearbox.net> Cc: Maciej Fijalkowski <maciej.fijalkowski(a)intel.com> Cc: Toshiaki Makita <toshiaki.makita1(a)gmail.com> Cc: Eric Dumazet <eric.dumazet(a)gmail.com> Cc: Paolo Abeni <pabeni(a)redhat.com> Cc: John Fastabend <john.fastabend(a)gmail.com> Cc: Willem de Bruijn <willemb(a)google.com> Acked-by: John Fastabend <john.fastabend(a)gmail.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Toshiaki Makita <toshiaki.makita1(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/net/veth.c Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- drivers/net/veth.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/drivers/net/veth.c b/drivers/net/veth.c index 41a00cd76955..749faa6fcd82 100644 --- a/drivers/net/veth.c +++ b/drivers/net/veth.c @@ -197,8 +197,6 @@ static netdev_tx_t veth_xmit(struct sk_buff *skb, struct net_device *dev) if (rxq < rcv->real_num_rx_queues) { rq = &rcv_priv->rq[rxq]; rcv_xdp = rcu_access_pointer(rq->xdp_prog); - if (rcv_xdp) - skb_record_rx_queue(skb, rxq); } if (likely(veth_forward_skb(rcv, skb, rq, rcv_xdp) == NET_RX_SUCCESS)) { -- 2.22.0

1 2

[PATCH openEuler-5.10] irqchip/gic-phytium-2500: Fix issue that interrupts are concentrated in one cpu
by Zheng Zengkai 17 Mar '22

17 Mar '22

From: Mao HongBo <maohongbo(a)phytium.com.cn> Phytium inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I41AUQ CVE: NA ------------------------------------------------- Fix the issue that interrupts are concentrated in one cpu for Phytium S2500 server. Signed-off-by: Mao HongBo <maohongbo(a)phytium.com.cn> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/irqchip/irq-gic-phytium-2500-its.c | 4 +--- drivers/irqchip/irq-gic-phytium-2500.c | 4 +--- 2 files changed, 2 insertions(+), 6 deletions(-) diff --git a/drivers/irqchip/irq-gic-phytium-2500-its.c b/drivers/irqchip/irq-gic-phytium-2500-its.c index 4d2758fbad22..cb9962c4debb 100644 --- a/drivers/irqchip/irq-gic-phytium-2500-its.c +++ b/drivers/irqchip/irq-gic-phytium-2500-its.c @@ -1675,9 +1675,7 @@ static int its_cpumask_select(struct its_device *its_dev, } cpu = cpumask_any_and(mask_val, cpu_mask); - if ((cpu > cpus) && (cpu < (cpus + skt_cpu_cnt[skt_id]))) { - cpus = cpu; - } + cpus = cpus + cpu % skt_cpu_cnt[skt_id]; if (is_kdump_kernel()) { skt = (cpu_logical_map(cpu) >> 16) & 0xff; diff --git a/drivers/irqchip/irq-gic-phytium-2500.c b/drivers/irqchip/irq-gic-phytium-2500.c index dbdb778b5b4b..a0c622fb2039 100644 --- a/drivers/irqchip/irq-gic-phytium-2500.c +++ b/drivers/irqchip/irq-gic-phytium-2500.c @@ -1345,9 +1345,7 @@ static int gic_cpumask_select(struct irq_data *d, const struct cpumask *mask_val } cpu = cpumask_any_and(mask_val, cpu_online_mask); - if ((cpu > cpus) && (cpu < (cpus + skt_cpu_cnt[irq_skt]))) { - cpus = cpu; - } + cpus = cpus + cpu % skt_cpu_cnt[irq_skt]; if (is_kdump_kernel()) { skt = (cpu_logical_map(cpu) >> 16) & 0xff; -- 2.20.1

1 0