March 2022 - Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 00/55] linux stable inclusion
by Laibin Qiu 14 Mar '22

14 Mar '22

form Linux 4.19.222 to Linux 4.19.227. some patch with conflicts haven't inclusion yet: 8a8908cb82568 fuse: fix live lock in fuse_iget() 1e1bb4933f1fa fuse: fix bad inode bd6e97e2b6f59 veth: Do not record rx queue hint in veth_xmit 1c3564fca0e7b xfs: map unwritten blocks in XFS_IOC_{ALLOC,FREE}SP just like fallocate f9dfa44be0fb5 f2fs: fix to do sanity check on last xattr entry in __f2fs_setxattr() 9c6159ee8fc9d net: accept UFOv6 packages in virtio_net_hdr_to_skb 57f93eaff49df block, bfq: fix use after free in bfq_bfqq_expire 99ada24490c34 block, bfq: fix queue removal from weights tree 7d0efcc69c75a block, bfq: fix decrement of num_active_groups e867d620470af block, bfq: fix asymmetric scenarios detection e4cd53c650bef block, bfq: improve asymmetric scenarios detection they will be sent with fixed conflicts by the analyser. Andrew Cooper (1): x86/pkey: Fix undefined behaviour with PKRU_WD_BIT Andrey Ryabinin (1): cputime, cpuacct: Include guest time in user time in cpuacct.stat Antoine Tenart (1): net-sysfs: update the queue counts in the unregistration path Antony Antony (2): xfrm: interface with if_id 0 should return error xfrm: state and policy should fail if XFRMA_IF_ID 0 Arnd Bergmann (1): dmaengine: pxa/mmp: stop referencing config->slave_id Bart Van Assche (1): scsi: ufs: Fix race conditions related to driver data Chen Jun (1): tpm: add request_locality before write TPM_INT_ENABLE Chengfeng Ye (1): crypto: qce - fix uaf on qce_ahash_register_one Christoph Hellwig (1): scsi: sr: Don't use GFP_DMA Coco Li (1): udp: using datalen to cap ipv6 udp max gso segments David Ahern (4): ipv6: Check attribute length for RTA_GATEWAY in multipath route ipv6: Check attribute length for RTA_GATEWAY when deleting multipath route ipv6: Continue processing multipath route even if gateway attribute is invalid ipv6: Do cleanup if attribute validation fails in multipath route Doyle, Patrick (1): mtd: nand: bbt: Fix corner case in bad block table handling Eric Dumazet (3): xfrm: fix a small bug in xfrm_sa_len() af_unix: annote lockless accesses to unix_tot_inflight & gc_in_progress netns: add schedule point in ops_exit_list() Fernando Fernandez Mancera (1): bonding: fix ad_actor_system option setting to default Florian Westphal (1): netfilter: bridge: add support for pppoe filtering Gang Li (1): shmem: fix a race between shmem_unused_huge_shrink and shmem_evict_inode Hector Martin (1): iommu/io-pgtable-arm: Fix table descriptor paddr formatting Jan Kara (4): ext4: avoid trim error on fs with small groups ext4: make sure to reset inode lockdep class when quota enabling fails ext4: make sure quota gets properly shutdown on error select: Fix indefinitely sleeping task in poll_schedule_timeout() Joe Thornber (2): dm btree: add a defensive bounds check to insert_at() dm space map common: add bounds check to sm_ll_lookup_bitmap() Kyeong Yoo (1): jffs2: GC deadlock reading a page that is used in jffs2_write_begin() Li Hua (1): sched/rt: Try to restart rt period timer when rt runtime exceeded Lino Sanfilippo (1): serial: amba-pl011: do not request memory region twice Lixiaokeng (1): scsi: libiscsi: Fix UAF in iscsi_conn_get_param()/iscsi_conn_teardown() Lizhi Hou (1): tty: serial: uartlite: allow 64 bit address Lukas Wunner (1): serial: Fix incorrect rs485 polarity on uart open Luís Henriques (1): ext4: set csum seed in tmp inode while migrating to extents Marek Vasut (1): crypto: stm32/crc32 - Fix kernel BUG triggered in probe() Muchun Song (1): net: fix use-after-free in tw_timer_handler Naveen N. Rao (2): tracing: Fix check for trace_percpu_buffer validity in get_trace_buf() tracing: Tag trace_percpu_buffer as a percpu pointer Nicolas Toromanoff (1): crypto: stm32/cryp - fix double pm exit Paolo Abeni (1): bpf: Do not WARN in bpf_warn_invalid_xdp_action() Pavel Skripkin (1): net: mcs7830: handle usb read errors properly Rafael J. Wysocki (2): ACPICA: Utilities: Avoid deleting the same object twice in a row ACPICA: Executer: Fix the REFCLASS_REFOF case in acpi_ex_opcode_1A_0T_1R() Suresh Kumar (1): net: bonding: debug: avoid printing debug logs when bond is not notifying peers Thadeu Lima de Souza Cascardo (2): ipmi: bail out if init_srcu_struct fails ipmi: fix initialization when workqueue allocation fails Theodore Ts'o (1): ext4: don't use the orphan list when migrating an inode Thomas Gleixner (1): can: bcm: switch timer to HRTIMER_MODE_SOFT and remove hrtimer_tasklet Tom Rix (1): selinux: initialize proto variable in selinux_ip_postroute_compat() Willem de Bruijn (1): net: skip virtio_net_hdr_set_proto if protocol already set William Zhao (1): ip6_vti: initialize __ip6_tnl_parm struct in vti6_siocdevprivate Wu Bo (1): ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler module Xin Xiong (1): netfilter: ipt_CLUSTERIP: fix refcount leak in clusterip_tg_check() Documentation/networking/bonding.txt | 11 +- arch/x86/include/asm/pgtable.h | 4 +- drivers/acpi/acpica/exoparg1.c | 3 +- drivers/acpi/acpica/utdelete.c | 1 + drivers/char/ipmi/ipmi_msghandler.c | 21 ++- drivers/char/tpm/tpm_tis_core.c | 8 + drivers/crypto/qce/sha.c | 2 +- drivers/crypto/stm32/stm32-cryp.c | 2 - drivers/crypto/stm32/stm32_crc32.c | 4 +- drivers/dma/mmp_pdma.c | 6 - drivers/dma/pxa_dma.c | 7 - drivers/iommu/io-pgtable-arm.c | 9 +- drivers/md/persistent-data/dm-btree.c | 8 +- .../md/persistent-data/dm-space-map-common.c | 5 + drivers/mtd/nand/bbt.c | 2 +- drivers/net/bonding/bond_main.c | 6 +- drivers/net/bonding/bond_options.c | 2 +- drivers/net/usb/mcs7830.c | 12 +- drivers/scsi/libiscsi.c | 6 +- drivers/scsi/sr.c | 2 +- drivers/scsi/sr_vendor.c | 4 +- drivers/scsi/ufs/tc-dwc-g210-pci.c | 1 - drivers/scsi/ufs/ufshcd-pltfrm.c | 2 - drivers/scsi/ufs/ufshcd.c | 7 + drivers/tty/serial/amba-pl011.c | 27 +-- drivers/tty/serial/serial_core.c | 4 +- drivers/tty/serial/uartlite.c | 2 +- fs/ext4/ioctl.c | 2 - fs/ext4/mballoc.c | 8 + fs/ext4/migrate.c | 23 ++- fs/ext4/super.c | 23 ++- fs/jffs2/file.c | 40 +++-- fs/select.c | 63 +++---- include/linux/virtio_net.h | 3 + kernel/sched/cputime.c | 4 +- kernel/sched/rt.c | 23 ++- kernel/trace/trace.c | 6 +- mm/shmem.c | 37 +++-- net/bridge/br_netfilter_hooks.c | 7 +- net/can/bcm.c | 156 ++++++------------ net/core/filter.c | 6 +- net/core/net-sysfs.c | 3 + net/core/net_namespace.c | 4 +- net/ipv4/af_inet.c | 10 +- net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 +- net/ipv6/ip6_vti.c | 2 + net/ipv6/route.c | 28 +++- net/ipv6/udp.c | 2 +- net/unix/garbage.c | 14 +- net/unix/scm.c | 6 +- net/xfrm/xfrm_interface.c | 14 +- net/xfrm/xfrm_user.c | 23 ++- security/selinux/hooks.c | 2 +- 53 files changed, 375 insertions(+), 307 deletions(-) -- 2.22.0

1 55

subscribe
by chinayanlei2002 12 Mar '22

12 Mar '22

1 0

[PATCH openEuler-5.10 1/3] net/hinic: Fix null pointer dereference in hinic_physical_port_id
by Zheng Zengkai 11 Mar '22

11 Mar '22

From: Chiqijun <chiqijun(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I4XF98 CVE: NA ----------------------------------------------------------------------- The hinic driver currently generates a NULL pointer dereference when performing the hinicadm tool command during device probe. This is because the hinicadm process accesses the NULL hwif pointer in the hwdev which have not been allocated in probe. Fix this by checking the initialization state of device before accessing it. Signed-off-by: Chiqijun <chiqijun(a)huawei.com> Reviewed-by: Wangxiaoyun <cloud.wangxiaoyun(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/net/ethernet/huawei/hinic/hinic_lld.c | 30 ++++++++++++++----- 1 file changed, 22 insertions(+), 8 deletions(-) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_lld.c b/drivers/net/ethernet/huawei/hinic/hinic_lld.c index bea0c7ef51e8..9d39da0c76d4 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_lld.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_lld.c @@ -801,8 +801,7 @@ static bool __is_pcidev_match_chip_name(const char *ifname, if (dev->init_state < HINIC_INIT_STATE_HW_PART_INITED) return false; } else { - if (dev->init_state >= - HINIC_INIT_STATE_HW_PART_INITED && + if (dev->init_state < HINIC_INIT_STATE_HW_PART_INITED || hinic_func_type(dev->hwdev) != type) return false; } @@ -1153,6 +1152,10 @@ void *hinic_get_ppf_hwdev_by_pdev(struct pci_dev *pdev) chip_node = pci_adapter->chip_node; lld_dev_hold(); list_for_each_entry(dev, &chip_node->func_list, node) { + if (test_bit(HINIC_FUNC_IN_REMOVE, &dev->flag) || + dev->init_state < HINIC_INIT_STATE_HW_IF_INITED) + continue; + if (dev->hwdev && hinic_func_type(dev->hwdev) == TYPE_PPF) { lld_dev_put(); return dev->hwdev; @@ -1365,6 +1368,10 @@ int hinic_get_pf_id(void *hwdev, u32 port_id, u32 *pf_id, u32 *isvalid) lld_dev_hold(); list_for_each_entry(dev, &chip_node->func_list, node) { + if (test_bit(HINIC_FUNC_IN_REMOVE, &dev->flag) || + dev->init_state < HINIC_INIT_STATE_HWDEV_INITED) + continue; + if (hinic_physical_port_id(dev->hwdev) == port_id) { *pf_id = hinic_global_func_id(dev->hwdev); *isvalid = 1; @@ -1852,7 +1859,8 @@ static void send_event_to_all_pf(struct hinic_pcidev *dev, lld_dev_hold(); list_for_each_entry(des_dev, &dev->chip_node->func_list, node) { - if (test_bit(HINIC_FUNC_IN_REMOVE, &des_dev->flag)) + if (test_bit(HINIC_FUNC_IN_REMOVE, &des_dev->flag) || + des_dev->init_state < HINIC_INIT_STATE_HW_IF_INITED) continue; if (hinic_func_type(des_dev->hwdev) == TYPE_VF) @@ -1870,7 +1878,8 @@ static void send_event_to_dst_pf(struct hinic_pcidev *dev, u16 func_id, lld_dev_hold(); list_for_each_entry(des_dev, &dev->chip_node->func_list, node) { - if (test_bit(HINIC_FUNC_IN_REMOVE, &des_dev->flag)) + if (test_bit(HINIC_FUNC_IN_REMOVE, &des_dev->flag) || + des_dev->init_state < HINIC_INIT_STATE_HW_IF_INITED) continue; if (hinic_func_type(des_dev->hwdev) == TYPE_VF) @@ -2637,8 +2646,11 @@ static void slave_host_init_delay_work(struct work_struct *work) /* Make sure the PPF must be the first one */ lld_dev_hold(); list_for_each_entry(ppf_pcidev, &chip_node->func_list, node) { - if (ppf_pcidev && - hinic_func_type(ppf_pcidev->hwdev) == TYPE_PPF) { + if (test_bit(HINIC_FUNC_IN_REMOVE, &ppf_pcidev->flag) || + ppf_pcidev->init_state < HINIC_INIT_STATE_HW_IF_INITED) + continue; + + if (hinic_func_type(ppf_pcidev->hwdev) == TYPE_PPF) { found = 1; break; } @@ -2872,7 +2884,8 @@ int hinic_register_micro_log(struct hinic_micro_log_info *micro_log_info) lld_dev_hold(); list_for_each_entry(chip_node, &g_hinic_chip_list, node) { list_for_each_entry(dev, &chip_node->func_list, node) { - if (test_bit(HINIC_FUNC_IN_REMOVE, &dev->flag)) + if (test_bit(HINIC_FUNC_IN_REMOVE, &dev->flag) || + dev->init_state < HINIC_INIT_STATE_HW_IF_INITED) continue; if (hinic_func_type(dev->hwdev) == TYPE_PPF) { @@ -2902,7 +2915,8 @@ void hinic_unregister_micro_log(struct hinic_micro_log_info *micro_log_info) lld_dev_hold(); list_for_each_entry(chip_node, &g_hinic_chip_list, node) { list_for_each_entry(dev, &chip_node->func_list, node) { - if (test_bit(HINIC_FUNC_IN_REMOVE, &dev->flag)) + if (test_bit(HINIC_FUNC_IN_REMOVE, &dev->flag) || + dev->init_state < HINIC_INIT_STATE_HW_IF_INITED) continue; if (hinic_func_type(dev->hwdev) == TYPE_PPF) -- 2.20.1

1 2

[PATCH openEuler-1.0-LTS 1/3] net: hns3: fix pf vlan filter out of work after self test
by Laibin Qiu 11 Mar '22

11 Mar '22

From: Yonglong Liu <liuyonglong(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4W90Z CVE: NA ---------------------------- After a self test, the vlan filter of PF is wrongly closed, cause the vlan filter out of work. The second parameter of enable_vlan_filter() must pass true, and in enable_vlan_filter(), it will decide whether to open or keep the status of vlan filter. Fixes: 79549957e66f ("Revert: net: hns3: adds support for extended VLAN mode and 'QOS' in vlan 802.1Q protocol.") Signed-off-by: Yonglong Liu <liuyonglong(a)huawei.com> Reviewed-by: li yongxin <liyongxin1(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c index ef870da7a8a4..be771c75e37e 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c @@ -395,8 +395,7 @@ static void hns3_self_test(struct net_device *ndev, #if IS_ENABLED(CONFIG_VLAN_8021Q) if (dis_vlan_filter) - h->ae_algo->ops->enable_vlan_filter(h, - ndev->flags & IFF_PROMISC); + h->ae_algo->ops->enable_vlan_filter(h, true); #endif if (if_running) -- 2.22.0

1 2

[PATCH openEuler-1.0-LTS] arm64: acpi: fix UBSAN warning
by Laibin Qiu 11 Mar '22

11 Mar '22

From: Nick Desaulniers <ndesaulniers(a)google.com> mainline inclusion from mainline-v5.8-rc1 commit a194c33f45f83068ef13bf1d16e26d4ca3ecc098 category: bugfix bugzilla: 89150 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Will reported a UBSAN warning: UBSAN: null-ptr-deref in arch/arm64/kernel/smp.c:596:6 member access within null pointer of type 'struct acpi_madt_generic_interrupt' CPU: 0 PID: 0 Comm: swapper Not tainted 5.7.0-rc6-00124-g96bc42ff0a82 #1 Call trace: dump_backtrace+0x0/0x384 show_stack+0x28/0x38 dump_stack+0xec/0x174 handle_null_ptr_deref+0x134/0x174 __ubsan_handle_type_mismatch_v1+0x84/0xa4 acpi_parse_gic_cpu_interface+0x60/0xe8 acpi_parse_entries_array+0x288/0x498 acpi_table_parse_entries_array+0x178/0x1b4 acpi_table_parse_madt+0xa4/0x110 acpi_parse_and_init_cpus+0x38/0x100 smp_init_cpus+0x74/0x258 setup_arch+0x350/0x3ec start_kernel+0x98/0x6f4 This is from the use of the ACPI_OFFSET in arch/arm64/include/asm/acpi.h. Replace its use with offsetof from include/linux/stddef.h which should implement the same logic using __builtin_offsetof, so that UBSAN wont warn. Reported-by: Will Deacon <will(a)kernel.org> Suggested-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Nick Desaulniers <ndesaulniers(a)google.com> Reviewed-by: Jeremy Linton <jeremy.linton(a)arm.com> Acked-by: Lorenzo Pieralisi <lorenzo.pieralisi(a)arm.com> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/lkml/20200521100952.GA5360@willie-the-truck/ Link: https://lore.kernel.org/r/20200608203818.189423-1-ndesaulniers@google.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: linyujun <linyujun809(a)huawei.com> Reviewed-by: chenlifu <chenlifu(a)huawei.com> Reviewed-by: He Ying <heying24(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- arch/arm64/include/asm/acpi.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/arch/arm64/include/asm/acpi.h b/arch/arm64/include/asm/acpi.h index f364115ac2ef..348f12447ecd 100644 --- a/arch/arm64/include/asm/acpi.h +++ b/arch/arm64/include/asm/acpi.h @@ -15,6 +15,7 @@ #include <linux/efi.h> #include <linux/memblock.h> #include <linux/psci.h> +#include <linux/stddef.h> #include <asm/cputype.h> #include <asm/io.h> @@ -33,14 +34,14 @@ * is therefore used to delimit the MADT GICC structure minimum length * appropriately. */ -#define ACPI_MADT_GICC_MIN_LENGTH ACPI_OFFSET( \ +#define ACPI_MADT_GICC_MIN_LENGTH offsetof( \ struct acpi_madt_generic_interrupt, efficiency_class) #define BAD_MADT_GICC_ENTRY(entry, end) \ (!(entry) || (entry)->header.length < ACPI_MADT_GICC_MIN_LENGTH || \ (unsigned long)(entry) + (entry)->header.length > (end)) -#define ACPI_MADT_GICC_SPE (ACPI_OFFSET(struct acpi_madt_generic_interrupt, \ +#define ACPI_MADT_GICC_SPE (offsetof(struct acpi_madt_generic_interrupt, \ spe_interrupt) + sizeof(u16)) /* Basic configuration for ACPI */ -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS] sched: Fix sleeping in atomic context at cpu_qos_write()
by Laibin Qiu 11 Mar '22

11 Mar '22

From: Zhang Qiao <zhangqiao22(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4WOPM CVE: NA -------------------------------- cfs_bandwidth_usage_inc() need hold jump_label_mutex and might sleep, so we can not call it in atomic context. Fix this by moving cfs_bandwidth_usage_{inc,dec}() out of rcu read critical section. Fixes: f7b390cd929 ("sched: Change cgroup task scheduler policy") Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> Reviewed-by: Chen Hui <judy.chenhui(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- kernel/sched/core.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index b36a3b4c60e9..496ce71f93a7 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -6981,13 +6981,10 @@ static int tg_change_scheduler(struct task_group *tg, void *data) struct cgroup_subsys_state *css = &tg->css; tg->qos_level = qos_level; - if (qos_level == -1) { + if (qos_level == -1) policy = SCHED_IDLE; - cfs_bandwidth_usage_inc(); - } else { + else policy = SCHED_NORMAL; - cfs_bandwidth_usage_dec(); - } param.sched_priority = 0; css_task_iter_start(css, 0, &it); @@ -7015,6 +7012,13 @@ static int cpu_qos_write(struct cgroup_subsys_state *css, if (tg->qos_level == -1 && qos_level == 0) return -EINVAL; + cpus_read_lock(); + if (qos_level == -1) + cfs_bandwidth_usage_inc(); + else + cfs_bandwidth_usage_dec(); + cpus_read_unlock(); + rcu_read_lock(); walk_tg_tree_from(tg, tg_change_scheduler, tg_nop, (void *)(&qos_level)); rcu_read_unlock(); -- 2.22.0

1 0

[PATCH openEuler-1.0-LTS 0/5] io_uring: fix request endless wait because of resources
by Laibin Qiu 11 Mar '22

11 Mar '22

bugzaila: 186136, https://gitee.com/openeuler/kernel/issues/I4RM1D Colin Ian King (1): io_uring: remove redundant initialization of variable ret Jens Axboe (3): io_uring: re-issue block requests that failed because of resources io_uring: don't double complete failed reissue request io_uring: don't re-setup vecs/iter in io_resumit_prep() is already there Pavel Begunkov (1): block: don't ignore REQ_NOWAIT for direct IO fs/block_dev.c | 5 +++ fs/io_uring.c | 100 ++++++++++++++++++++++++++++++++++++++++++++++++- 2 files changed, 104 insertions(+), 1 deletion(-) -- 2.22.0

1 5

[PATCH openEuler-5.10 01/48] Revert "blk-mq, elevator: Count requests per hctx to improve performance"
by Zheng Zengkai 11 Mar '22

11 Mar '22

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-5.12-rc1 commit 5ac83c644f5fb924f0b2c09102ab82fc788f8411 category: perf bugzilla: https://gitee.com/openeuler/kernel/issues/I4SW26 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- This reverts commit b445547ec1bbd3e7bf4b1c142550942f70527d95. Since both mq-deadline and BFQ completely ignore hctx they are passed to their dispatch function and dispatch whatever request they deem fit checking whether any request for a particular hctx is queued is just pointless since we'll very likely get a request from a different hctx anyway. In the following commit we'll deal with lock contention in these IO schedulers in presence of multiple HW queues in a different way. Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/bfq-iosched.c Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/bfq-iosched.c | 5 ----- block/blk-mq.c | 1 - block/mq-deadline.c | 6 ------ include/linux/blk-mq.h | 4 ---- 4 files changed, 16 deletions(-) diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c index 70f2aeadd21c..2247db842985 100644 --- a/block/bfq-iosched.c +++ b/block/bfq-iosched.c @@ -4651,9 +4651,6 @@ static bool bfq_has_work(struct blk_mq_hw_ctx *hctx) { struct bfq_data *bfqd = hctx->queue->elevator->elevator_data; - if (!atomic_read(&hctx->elevator_queued)) - return false; - /* * Avoiding lock: a race on bfqd->busy_queues should cause at * most a call to dispatch for nothing @@ -5570,7 +5567,6 @@ static void bfq_insert_requests(struct blk_mq_hw_ctx *hctx, rq = list_first_entry(list, struct request, queuelist); list_del_init(&rq->queuelist); bfq_insert_request(hctx, rq, at_head); - atomic_inc(&hctx->elevator_queued); } } @@ -5935,7 +5931,6 @@ static void bfq_finish_requeue_request(struct request *rq) bfq_update_inject_limit(bfqd, bfqq); bfq_completed_request(bfqq, bfqd); - atomic_dec(&rq->mq_hctx->elevator_queued); } bfq_finish_requeue_request_body(bfqq); spin_unlock_irqrestore(&bfqd->lock, flags); diff --git a/block/blk-mq.c b/block/blk-mq.c index b8cf684030dc..8428624ac42f 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -2748,7 +2748,6 @@ blk_mq_alloc_hctx(struct request_queue *q, struct blk_mq_tag_set *set, goto free_hctx; atomic_set(&hctx->nr_active, 0); - atomic_set(&hctx->elevator_queued, 0); if (node == NUMA_NO_NODE) node = set->numa_node; hctx->numa_node = node; diff --git a/block/mq-deadline.c b/block/mq-deadline.c index 43994cce1eb2..42b6e9dbe7c7 100644 --- a/block/mq-deadline.c +++ b/block/mq-deadline.c @@ -386,8 +386,6 @@ static struct request *dd_dispatch_request(struct blk_mq_hw_ctx *hctx) spin_lock(&dd->lock); rq = __dd_dispatch_request(dd); spin_unlock(&dd->lock); - if (rq) - atomic_dec(&rq->mq_hctx->elevator_queued); return rq; } @@ -539,7 +537,6 @@ static void dd_insert_requests(struct blk_mq_hw_ctx *hctx, rq = list_first_entry(list, struct request, queuelist); list_del_init(&rq->queuelist); dd_insert_request(hctx, rq, at_head); - atomic_inc(&hctx->elevator_queued); } spin_unlock(&dd->lock); } @@ -586,9 +583,6 @@ static bool dd_has_work(struct blk_mq_hw_ctx *hctx) { struct deadline_data *dd = hctx->queue->elevator->elevator_data; - if (!atomic_read(&hctx->elevator_queued)) - return false; - return !list_empty_careful(&dd->dispatch) || !list_empty_careful(&dd->fifo_list[0]) || !list_empty_careful(&dd->fifo_list[1]); diff --git a/include/linux/blk-mq.h b/include/linux/blk-mq.h index 3134aaf9032a..adcbef9705ca 100644 --- a/include/linux/blk-mq.h +++ b/include/linux/blk-mq.h @@ -141,10 +141,6 @@ struct blk_mq_hw_ctx { * shared across request queues. */ atomic_t nr_active; - /** - * @elevator_queued: Number of queued requests on hctx. - */ - atomic_t elevator_queued; /** @cpuhp_online: List to store request if CPU is going to die */ struct hlist_node cpuhp_online; -- 2.20.1

2 48

[PATCH OLK-5.10] net/hinic: Fix double free issue
by Zheng Zengkai 10 Mar '22

10 Mar '22

From: Chiqijun <chiqijun(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I4WWH4 CVE: NA ----------------------------------------------------------------------- When hinic_remove is executed concurrently, chip_node is double freed. Signed-off-by: Chiqijun <chiqijun(a)huawei.com> Reviewed-by: Wangxiaoyun <cloud.wangxiaoyun(a)huawei.com> Acked-by: Xie XiuQi <xiexiuqi(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/net/ethernet/huawei/hinic/hinic_lld.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/ethernet/huawei/hinic/hinic_lld.c b/drivers/net/ethernet/huawei/hinic/hinic_lld.c index 6c960cecf101..bea0c7ef51e8 100644 --- a/drivers/net/ethernet/huawei/hinic/hinic_lld.c +++ b/drivers/net/ethernet/huawei/hinic/hinic_lld.c @@ -119,6 +119,7 @@ struct hinic_pcidev { bool nic_des_enable; struct timer_list syncfw_time_timer; + int card_id; }; #define HINIC_EVENT_PROCESS_TIMEOUT 10000 @@ -2099,6 +2100,9 @@ static void free_chip_node(struct hinic_pcidev *pci_adapter) u32 id; int err; + if (!(card_bit_map & BIT(pci_adapter->card_id))) + return; + if (list_empty(&chip_node->func_list)) { list_del(&chip_node->node); sdk_info(&pci_adapter->pcidev->dev, @@ -2701,6 +2705,9 @@ static int hinic_probe(struct pci_dev *pdev, const struct pci_device_id *id) goto alloc_chip_node_fail; } + sscanf(pci_adapter->chip_node->chip_name, HINIC_CHIP_NAME "%d", + &pci_adapter->card_id); + err = nictool_k_init(); if (err) { sdk_warn(&pdev->dev, "Failed to init nictool"); -- 2.20.1

1 0

[PATCH openEuler-1.0-LTS] sched: Fix sleeping in atomic context at cpu_qos_write()
by Yang Yingliang 10 Mar '22

10 Mar '22

From: Zhang Qiao <zhangqiao22(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4WOPM CVE: NA -------------------------------- cfs_bandwidth_usage_inc() need hold jump_label_mutex and might sleep, so we can not call it in atomic context. Fix this by moving cfs_bandwidth_usage_{inc,dec}() out of rcu read critical section. Fixes: f7b390cd929 ("sched: Change cgroup task scheduler policy") Signed-off-by: Zhang Qiao <zhangqiao22(a)huawei.com> Reviewed-by: Chen Hui <judy.chenhui(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- kernel/sched/core.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index b36a3b4c60e9c..496ce71f93a7a 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -6981,13 +6981,10 @@ static int tg_change_scheduler(struct task_group *tg, void *data) struct cgroup_subsys_state *css = &tg->css; tg->qos_level = qos_level; - if (qos_level == -1) { + if (qos_level == -1) policy = SCHED_IDLE; - cfs_bandwidth_usage_inc(); - } else { + else policy = SCHED_NORMAL; - cfs_bandwidth_usage_dec(); - } param.sched_priority = 0; css_task_iter_start(css, 0, &it); @@ -7015,6 +7012,13 @@ static int cpu_qos_write(struct cgroup_subsys_state *css, if (tg->qos_level == -1 && qos_level == 0) return -EINVAL; + cpus_read_lock(); + if (qos_level == -1) + cfs_bandwidth_usage_inc(); + else + cfs_bandwidth_usage_dec(); + cpus_read_unlock(); + rcu_read_lock(); walk_tg_tree_from(tg, tg_change_scheduler, tg_nop, (void *)(&qos_level)); rcu_read_unlock(); -- 2.25.1

1 0