May 2024 - Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 v3 00/45] Backport folio feature and bugfix
by Liu Shixin 11 May '24

11 May '24

Folio feature: 1. Patch series "Split a folio to any lower order folios", v5. 2. arm64: mm: swap: support THP_SWAP on hardware with MTE 3. Patch series "support multi-size THP numa balancing", v2. 4. Patch series "Swap-out mTHP without splitting", v7. Other improve and bugfix: 1. mm: fix draining remote pageset 2. Patch series "Address some contpte nits". 3. Patch series "mm: page_alloc: fixes for high atomic reserve caluculations", v3. 4. Patch series "Fix I/O high when memory almost met memcg limit", v2. 5. mm, oom:dump_tasks add rss detailed information printing 6. mm: ratelimit stat flush from workingset shrinker 7. mm: madvise: pageout: ignore references rather than clearing young 8. mm: use memalloc_nofs_save() in page_cache_ra_order() 9. mm/vmalloc: fix return value of vb_alloc if size is 0 10. mm: remove struct page from get_shadow_from_swap_cache Baolin Wang (2): mm: factor out the numa mapping rebuilding into a new helper mm: support multi-size THP numa balancing Barry Song (5): mm: madvise: pageout: ignore references rather than clearing young arm64: mm: swap: support THP_SWAP on hardware with MTE madvise:madvise_cold_or_pageout_pte_range(): allow split while folio_estimated_sharers = 0 mm: hold PTL from the first PTE while reclaiming a large folio mm: alloc_anon_folio: avoid doing vma_thp_gfp_mask in fallback cases Charan Teja Kalla (2): mm: page_alloc: correct high atomic reserve calculations mm: page_alloc: enforce minimum zone size to do high atomic reserves David Hildenbrand (1): mm: convert folio_estimated_sharers() to folio_likely_mapped_shared() Hailong.Liu (1): mm/vmalloc: fix return value of vb_alloc if size is 0 Huang Ying (1): mm: fix draining remote pageset Jiexun Wang (1): mm/madvise: add cond_resched() in madvise_cold_or_pageout_pte_range() John Hubbard (1): huge_memory.c: document huge page splitting rules more thoroughly Kefeng Wang (2): mm: use memalloc_nofs_save() in page_cache_ra_order() mm: huge_memory: use more folio api in __split_huge_page_tail() Liu Shixin (2): mm/readahead: break read-ahead loop if filemap_add_folio return -ENOMEM mm/filemap: don't decrease mmap_miss when folio has workingset flag Matthew Wilcox (Oracle) (4): mm: support order-1 folios in the page cache XArray: set the marks correctly when splitting an entry mm: remove struct page from get_shadow_from_swap_cache mm: remove PageAnonExclusive assertions in unuse_pte() Muhammad Usama Anjum (2): selftests/mm: split_huge_page_test: conform test to TAP format output selftests: mm: fix unused and uninitialized variable warning Ryan Roberts (9): arm64/mm: export contpte symbols only to GPL users arm64/mm: improve comment in contpte_ptep_get_lockless() mm: swap: remove CLUSTER_FLAG_HUGE from swap_cluster_info:flags mm: swap: free_swap_and_cache_nr() as batched free_swap_and_cache() mm: swap: simplify struct percpu_cluster mm: swap: update get_swap_pages() to take folio order mm: swap: allow storage of all mTHP orders mm: vmscan: avoid split during shrink_folio_list() mm: madvise: avoid split during MADV_PAGEOUT and MADV_COLD Sergey Senozhatsky (1): mm/madvise: don't forget to leave lazy MMU mode in madvise_cold_or_pageout_pte_range() Shakeel Butt (1): mm: ratelimit stat flush from workingset shrinker Yong Wang (1): mm, oom:dump_tasks add rss detailed information printing Zi Yan (9): mm/huge_memory: only split PMD mapping when necessary in unmap_folio() mm/memcg: use order instead of nr in split_page_memcg() mm/page_owner: use order instead of nr in split_page_owner() mm: memcg: make memcg huge page split support any order split mm: page_owner: add support for splitting to any order in split page_owner mm: thp: split huge page to any lower order pages mm: huge_memory: enable debugfs to split huge pages to any order mm/huge_memory: check new folio order when split a folio mm/migrate: split source folio if it is on deferred split list arch/arm64/include/asm/pgtable.h | 19 +- arch/arm64/mm/contpte.c | 46 +-- arch/arm64/mm/mteswap.c | 45 +++ fs/proc/etmem_swap.c | 2 +- include/linux/huge_mm.h | 31 +- include/linux/memcontrol.h | 4 +- include/linux/mm.h | 48 ++- include/linux/page_owner.h | 14 +- include/linux/pgtable.h | 61 +++- include/linux/swap.h | 40 ++- lib/test_xarray.c | 14 +- lib/xarray.c | 23 +- mm/damon/paddr.c | 2 +- mm/etmem.c | 2 +- mm/filemap.c | 16 +- mm/huge_memory.c | 206 ++++++++--- mm/internal.h | 93 ++++- mm/madvise.c | 123 ++++--- mm/memcontrol.c | 10 +- mm/memory.c | 100 ++++-- mm/mempolicy.c | 14 +- mm/migrate.c | 31 +- mm/mprotect.c | 3 +- mm/oom_kill.c | 7 +- mm/page_alloc.c | 16 +- mm/page_io.c | 2 +- mm/page_owner.c | 6 +- mm/readahead.c | 15 +- mm/shmem.c | 2 +- mm/swap_slots.c | 8 +- mm/swap_state.c | 8 +- mm/swapfile.c | 331 ++++++++++-------- mm/vmalloc.c | 2 +- mm/vmscan.c | 46 ++- mm/vmstat.c | 4 +- mm/workingset.c | 2 +- tools/testing/selftests/mm/run_vmtests.sh | 22 +- .../selftests/mm/split_huge_page_test.c | 323 ++++++++++++----- 38 files changed, 1207 insertions(+), 534 deletions(-) -- 2.25.1

2 46

[PATCH OLK-6.6 v2 00/45] Backport folio feature and bugfix
by Liu Shixin 11 May '24

11 May '24

Folio feature: 1. Patch series "Split a folio to any lower order folios", v5. 2. arm64: mm: swap: support THP_SWAP on hardware with MTE 3. Patch series "support multi-size THP numa balancing", v2. 4. Patch series "Swap-out mTHP without splitting", v7. Other improve and bugfix: 1. mm: fix draining remote pageset 2. Patch series "Address some contpte nits". 3. Patch series "mm: page_alloc: fixes for high atomic reserve caluculations", v3. 4. Patch series "Fix I/O high when memory almost met memcg limit", v2. 5. mm, oom:dump_tasks add rss detailed information printing 6. mm: ratelimit stat flush from workingset shrinker 7. mm: madvise: pageout: ignore references rather than clearing young 8. mm: use memalloc_nofs_save() in page_cache_ra_order() 9. mm/vmalloc: fix return value of vb_alloc if size is 0 10. mm: remove struct page from get_shadow_from_swap_cache Baolin Wang (2): mm: factor out the numa mapping rebuilding into a new helper mm: support multi-size THP numa balancing Barry Song (5): mm: madvise: pageout: ignore references rather than clearing young arm64: mm: swap: support THP_SWAP on hardware with MTE madvise:madvise_cold_or_pageout_pte_range(): allow split while folio_estimated_sharers = 0 mm: hold PTL from the first PTE while reclaiming a large folio mm: alloc_anon_folio: avoid doing vma_thp_gfp_mask in fallback cases Charan Teja Kalla (2): mm: page_alloc: correct high atomic reserve calculations mm: page_alloc: enforce minimum zone size to do high atomic reserves David Hildenbrand (1): mm: convert folio_estimated_sharers() to folio_likely_mapped_shared() Hailong.Liu (1): mm/vmalloc: fix return value of vb_alloc if size is 0 Huang Ying (1): mm: fix draining remote pageset Jiexun Wang (1): mm/madvise: add cond_resched() in madvise_cold_or_pageout_pte_range() John Hubbard (1): huge_memory.c: document huge page splitting rules more thoroughly Kefeng Wang (2): mm: use memalloc_nofs_save() in page_cache_ra_order() mm: huge_memory: use more folio api in __split_huge_page_tail() Liu Shixin (2): mm/readahead: break read-ahead loop if filemap_add_folio return -ENOMEM mm/filemap: don't decrease mmap_miss when folio has workingset flag Matthew Wilcox (Oracle) (4): mm: support order-1 folios in the page cache XArray: set the marks correctly when splitting an entry mm: remove struct page from get_shadow_from_swap_cache mm: remove PageAnonExclusive assertions in unuse_pte() Muhammad Usama Anjum (2): selftests/mm: split_huge_page_test: conform test to TAP format output selftests: mm: fix unused and uninitialized variable warning Ryan Roberts (9): arm64/mm: export contpte symbols only to GPL users arm64/mm: improve comment in contpte_ptep_get_lockless() mm: swap: remove CLUSTER_FLAG_HUGE from swap_cluster_info:flags mm: swap: free_swap_and_cache_nr() as batched free_swap_and_cache() mm: swap: simplify struct percpu_cluster mm: swap: update get_swap_pages() to take folio order mm: swap: allow storage of all mTHP orders mm: vmscan: avoid split during shrink_folio_list() mm: madvise: avoid split during MADV_PAGEOUT and MADV_COLD Sergey Senozhatsky (1): mm/madvise: don't forget to leave lazy MMU mode in madvise_cold_or_pageout_pte_range() Shakeel Butt (1): mm: ratelimit stat flush from workingset shrinker Yong Wang (1): mm, oom:dump_tasks add rss detailed information printing Zi Yan (9): mm/huge_memory: only split PMD mapping when necessary in unmap_folio() mm/memcg: use order instead of nr in split_page_memcg() mm/page_owner: use order instead of nr in split_page_owner() mm: memcg: make memcg huge page split support any order split mm: page_owner: add support for splitting to any order in split page_owner mm: thp: split huge page to any lower order pages mm: huge_memory: enable debugfs to split huge pages to any order mm/huge_memory: check new folio order when split a folio mm/migrate: split source folio if it is on deferred split list arch/arm64/include/asm/pgtable.h | 19 +- arch/arm64/mm/contpte.c | 46 +-- arch/arm64/mm/mteswap.c | 45 +++ fs/proc/etmem_swap.c | 2 +- include/linux/huge_mm.h | 31 +- include/linux/memcontrol.h | 4 +- include/linux/mm.h | 48 ++- include/linux/page_owner.h | 14 +- include/linux/pgtable.h | 61 +++- include/linux/swap.h | 40 ++- lib/test_xarray.c | 14 +- lib/xarray.c | 23 +- mm/damon/paddr.c | 2 +- mm/etmem.c | 2 +- mm/filemap.c | 16 +- mm/huge_memory.c | 206 ++++++++--- mm/internal.h | 93 ++++- mm/madvise.c | 123 ++++--- mm/memcontrol.c | 10 +- mm/memory.c | 100 ++++-- mm/mempolicy.c | 14 +- mm/migrate.c | 31 +- mm/mprotect.c | 3 +- mm/oom_kill.c | 7 +- mm/page_alloc.c | 16 +- mm/page_io.c | 2 +- mm/page_owner.c | 6 +- mm/readahead.c | 15 +- mm/shmem.c | 2 +- mm/swap_slots.c | 8 +- mm/swap_state.c | 8 +- mm/swapfile.c | 331 ++++++++++-------- mm/vmalloc.c | 2 +- mm/vmscan.c | 46 ++- mm/vmstat.c | 4 +- mm/workingset.c | 2 +- tools/testing/selftests/mm/run_vmtests.sh | 22 +- .../selftests/mm/split_huge_page_test.c | 323 ++++++++++++----- 38 files changed, 1207 insertions(+), 534 deletions(-) -- 2.25.1

2 46

[PATCH openEuler-1.0-LTS] s390/dasd: fix double module refcount decrement
by Chen Zhongjin 11 May '24

11 May '24

From: Miroslav Franc <mfranc(a)suse.cz> mainline inclusion from mainline-v6.9-rc1 commit c3116e62ddeff79cae342147753ce596f01fcf06 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9NF CVE: CVE-2024-27054 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Once the discipline is associated with the device, deleting the device takes care of decrementing the module's refcount. Doing it manually on this error path causes refcount to artificially decrease on each error while it should just stay the same. Fixes: c020d722b110 ("s390/dasd: fix panic during offline processing") Signed-off-by: Miroslav Franc <mfranc(a)suse.cz> Signed-off-by: Jan Höppner <hoeppner(a)linux.ibm.com> Signed-off-by: Stefan Haberland <sth(a)linux.ibm.com> Link: https://lore.kernel.org/r/20240209124522.3697827-3-sth@linux.ibm.com Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: drivers/s390/block/dasd.c [fix context conflicts] Signed-off-by: Chen Zhongjin <chenzhongjin(a)huawei.com> --- drivers/s390/block/dasd.c | 5 +---- 1 file changed, 1 insertion(+), 4 deletions(-) diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c index a23e7d394a0ad..433651225fca6 100644 --- a/drivers/s390/block/dasd.c +++ b/drivers/s390/block/dasd.c @@ -3501,12 +3501,11 @@ int dasd_generic_set_online(struct ccw_device *cdev, dasd_delete_device(device); return -EINVAL; } + device->base_discipline = base_discipline; if (!try_module_get(discipline->owner)) { - module_put(base_discipline->owner); dasd_delete_device(device); return -EINVAL; } - device->base_discipline = base_discipline; device->discipline = discipline; /* check_device will allocate block device if necessary */ @@ -3514,8 +3513,6 @@ int dasd_generic_set_online(struct ccw_device *cdev, if (rc) { pr_warn("%s Setting the DASD online with discipline %s failed with rc=%i\n", dev_name(&cdev->dev), discipline->name, rc); - module_put(discipline->owner); - module_put(base_discipline->owner); dasd_delete_device(device); return rc; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/6] CVE-2024-26921
by Ziyang Xuan 11 May '24

11 May '24

Patchset of CVE-2024-26921. Florian Westphal (1): inet: inet_defrag: prevent sk release while still in use Guillaume Nault (1): inet: frags: re-introduce skb coalescing for local delivery Vasily Averin (2): skbuff: introduce skb_expand_head() skb_expand_head() adjust skb->truesize incorrectly Ziyang Xuan (2): net: Fix KABI break for introducing is_skb_wmem() sk_buff: Fix KABI break for the modification of struct sk_buff include/linux/skbuff.h | 1 + include/net/inet_frag.h | 2 +- include/net/tcp.h | 2 +- include/net/tcp_ext.h | 14 +++ net/core/skbuff.c | 52 +++++++++++ net/ipv4/inet_fragment.c | 109 ++++++++++++++++++------ net/ipv4/ip_fragment.c | 10 ++- net/ipv6/netfilter/nf_conntrack_reasm.c | 4 +- net/ipv6/reassembly.c | 2 +- 9 files changed, 165 insertions(+), 31 deletions(-) create mode 100644 include/net/tcp_ext.h -- 2.25.1

2 7

[PATCH OLK-6.6 00/45] Backport folio feature and bugfix
by Liu Shixin 11 May '24

11 May '24

folio feature: 1. Patch series "Split a folio to any lower order folios", v5. 2. arm64: mm: swap: support THP_SWAP on hardware with MTE 3. Patch series "support multi-size THP numa balancing", v2. 4. Patch series "Swap-out mTHP without splitting", v7. Some bugfix: 1. mm: fix draining remote pageset 2. Patch series "Address some contpte nits". 3. Patch series "mm: page_alloc: fixes for high atomic reserve caluculations", v3. 4. Patch series "Fix I/O high when memory almost met memcg limit", v2. 5. mm, oom:dump_tasks add rss detailed information printing 6. mm: ratelimit stat flush from workingset shrinker 7. mm: madvise: pageout: ignore references rather than clearing young 8. mm: use memalloc_nofs_save() in page_cache_ra_order() 9. mm/vmalloc: fix return value of vb_alloc if size is 0 10. mm: remove struct page from get_shadow_from_swap_cache Baolin Wang (2): [Backport] mm: factor out the numa mapping rebuilding into a new helper [Backport] mm: support multi-size THP numa balancing Barry Song (5): [Backport] mm: madvise: pageout: ignore references rather than clearing young [Backport] arm64: mm: swap: support THP_SWAP on hardware with MTE [Backport] madvise:madvise_cold_or_pageout_pte_range(): allow split while folio_estimated_sharers = 0 [Backport] mm: hold PTL from the first PTE while reclaiming a large folio [Backport] mm: alloc_anon_folio: avoid doing vma_thp_gfp_mask in fallback cases Charan Teja Kalla (2): [Backport] mm: page_alloc: correct high atomic reserve calculations [Backport] mm: page_alloc: enforce minimum zone size to do high atomic reserves David Hildenbrand (1): [Backport] mm: convert folio_estimated_sharers() to folio_likely_mapped_shared() Hailong.Liu (1): [Backport] mm/vmalloc: fix return value of vb_alloc if size is 0 Huang Ying (1): [Backport] mm: fix draining remote pageset Jiexun Wang (1): [Backport] mm/madvise: add cond_resched() in madvise_cold_or_pageout_pte_range() John Hubbard (1): [Backport] huge_memory.c: document huge page splitting rules more thoroughly Kefeng Wang (2): [Backport] mm: use memalloc_nofs_save() in page_cache_ra_order() [Backport] mm: huge_memory: use more folio api in __split_huge_page_tail() Liu Shixin (2): [Backport] mm/readahead: break read-ahead loop if filemap_add_folio return -ENOMEM [Backport] mm/filemap: don't decrease mmap_miss when folio has workingset flag Matthew Wilcox (Oracle) (4): [Backport] mm: support order-1 folios in the page cache [Backport] XArray: set the marks correctly when splitting an entry [Backport] mm: remove struct page from get_shadow_from_swap_cache [Backport] mm: remove PageAnonExclusive assertions in unuse_pte() Muhammad Usama Anjum (2): [Backport] selftests/mm: split_huge_page_test: conform test to TAP format output [Backport] selftests: mm: fix unused and uninitialized variable warning Ryan Roberts (9): [Backport] arm64/mm: export contpte symbols only to GPL users [Backport] arm64/mm: improve comment in contpte_ptep_get_lockless() [Backport] mm: swap: remove CLUSTER_FLAG_HUGE from swap_cluster_info:flags [Backport] mm: swap: free_swap_and_cache_nr() as batched free_swap_and_cache() [Backport] mm: swap: simplify struct percpu_cluster [Backport] mm: swap: update get_swap_pages() to take folio order [Backport] mm: swap: allow storage of all mTHP orders [Backport] mm: vmscan: avoid split during shrink_folio_list() [Backport] mm: madvise: avoid split during MADV_PAGEOUT and MADV_COLD Sergey Senozhatsky (1): [Backport] mm/madvise: don't forget to leave lazy MMU mode in madvise_cold_or_pageout_pte_range() Shakeel Butt (1): [Backport] mm: ratelimit stat flush from workingset shrinker Yong Wang (1): [Backport] mm, oom:dump_tasks add rss detailed information printing Zi Yan (9): [Backport] mm/huge_memory: only split PMD mapping when necessary in unmap_folio() [Backport] mm/memcg: use order instead of nr in split_page_memcg() [Backport] mm/page_owner: use order instead of nr in split_page_owner() [Backport] mm: memcg: make memcg huge page split support any order split [Backport] mm: page_owner: add support for splitting to any order in split page_owner [Backport] mm: thp: split huge page to any lower order pages [Backport] mm: huge_memory: enable debugfs to split huge pages to any order [Backport] mm/huge_memory: check new folio order when split a folio [Backport] mm/migrate: split source folio if it is on deferred split list arch/arm64/include/asm/pgtable.h | 19 +- arch/arm64/mm/contpte.c | 46 +-- arch/arm64/mm/mteswap.c | 45 +++ fs/proc/etmem_swap.c | 2 +- include/linux/huge_mm.h | 31 +- include/linux/memcontrol.h | 4 +- include/linux/mm.h | 48 ++- include/linux/page_owner.h | 14 +- include/linux/pgtable.h | 61 +++- include/linux/swap.h | 40 ++- lib/test_xarray.c | 14 +- lib/xarray.c | 23 +- mm/damon/paddr.c | 2 +- mm/etmem.c | 2 +- mm/filemap.c | 16 +- mm/huge_memory.c | 206 ++++++++--- mm/internal.h | 93 ++++- mm/madvise.c | 123 ++++--- mm/memcontrol.c | 10 +- mm/memory.c | 100 ++++-- mm/mempolicy.c | 14 +- mm/migrate.c | 31 +- mm/mprotect.c | 3 +- mm/oom_kill.c | 7 +- mm/page_alloc.c | 16 +- mm/page_io.c | 2 +- mm/page_owner.c | 6 +- mm/readahead.c | 15 +- mm/shmem.c | 2 +- mm/swap_slots.c | 8 +- mm/swap_state.c | 8 +- mm/swapfile.c | 331 ++++++++++-------- mm/vmalloc.c | 2 +- mm/vmscan.c | 46 ++- mm/vmstat.c | 4 +- mm/workingset.c | 2 +- tools/testing/selftests/mm/run_vmtests.sh | 22 +- .../selftests/mm/split_huge_page_test.c | 323 ++++++++++++----- 38 files changed, 1207 insertions(+), 534 deletions(-) -- 2.25.1

2 46

[PATCH openEuler-20.03-LTS-SP3] Revert "arm64: head.S: always initialize PSTATE"
by Li Zetao 11 May '24

11 May '24

This reverts commit 7f5917da48dd9f50ca7170356efbdb4cadf3c47c. --- arch/arm64/include/asm/ptrace.h | 5 ----- arch/arm64/kernel/head.S | 25 +++++++++---------------- 2 files changed, 9 insertions(+), 21 deletions(-) diff --git a/arch/arm64/include/asm/ptrace.h b/arch/arm64/include/asm/ptrace.h index 408bc4719f3b2..f1662df255caf 100644 --- a/arch/arm64/include/asm/ptrace.h +++ b/arch/arm64/include/asm/ptrace.h @@ -27,11 +27,6 @@ #define CurrentEL_EL1 (1 << 2) #define CurrentEL_EL2 (2 << 2) -#define INIT_PSTATE_EL1 \ - (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL1h) -#define INIT_PSTATE_EL2 \ - (PSR_D_BIT | PSR_A_BIT | PSR_I_BIT | PSR_F_BIT | PSR_MODE_EL2h) - /* * PMR values used to mask/unmask interrupts. * diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S index 04dc533ea8b60..9f083b11efe25 100644 --- a/arch/arm64/kernel/head.S +++ b/arch/arm64/kernel/head.S @@ -465,24 +465,19 @@ ENTRY(kimage_vaddr) * If we're fortunate enough to boot at EL2, ensure that the world is * sane before dropping to EL1. * - * Since we cannot always rely on ERET synchronizing writes to sysregs (e.g. if - * SCTLR_ELx.EOS is clear), we place an ISB prior to ERET. - * * Returns either BOOT_CPU_MODE_EL1 or BOOT_CPU_MODE_EL2 in w0 if * booted in EL1 or EL2 respectively. */ ENTRY(el2_setup) + msr SPsel, #1 // We want to use SP_EL{1,2} mrs x0, CurrentEL cmp x0, #CurrentEL_EL2 b.eq 1f mov_q x0, (SCTLR_EL1_RES1 | ENDIAN_SET_EL1) msr sctlr_el1, x0 + mov w0, #BOOT_CPU_MODE_EL1 // This cpu booted in EL1 isb - mov_q x0, INIT_PSTATE_EL1 - msr spsr_el1, x0 - msr elr_el1, lr - mov w0, #BOOT_CPU_MODE_EL1 - eret + ret 1: mov_q x0, (SCTLR_EL2_RES1 | ENDIAN_SET_EL2) msr sctlr_el2, x0 @@ -593,12 +588,9 @@ set_hcr: cbz x2, install_el2_stub + mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 isb - mov_q x0, INIT_PSTATE_EL2 - msr spsr_el2, x0 - msr elr_el2, lr - mov w0, #BOOT_CPU_MODE_EL2 - eret + ret install_el2_stub: /* @@ -630,11 +622,12 @@ install_el2_stub: 7: adr_l x0, __hyp_stub_vectors msr vbar_el2, x0 - isb - mov x0, #INIT_PSTATE_EL1 + /* spsr */ + mov x0, #(PSR_F_BIT | PSR_I_BIT | PSR_A_BIT | PSR_D_BIT |\ + PSR_MODE_EL1h) msr spsr_el2, x0 msr elr_el2, lr - mov w0, #BOOT_CPU_MODE_EL2 + mov w0, #BOOT_CPU_MODE_EL2 // This CPU booted in EL2 eret ENDPROC(el2_setup) -- 2.34.1

3 2

[PATCH openEuler-1.0-LTS] NTB: fix possible name leak in ntb_register_device()
by Zeng Heng 11 May '24

11 May '24

From: Yang Yingliang <yangyingliang(a)huawei.com> mainline inclusion from mainline-v6.9-rc1 commit aebfdfe39b9327a3077d0df8db3beb3160c9bdd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9IV CVE: CVE-2023-52652 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If device_register() fails in ntb_register_device(), the device name allocated by dev_set_name() should be freed. As per the comment in device_register(), callers should use put_device() to give up the reference in the error path. So fix this by calling put_device() in the error path so that the name can be freed in kobject_cleanup(). As a result of this, put_device() in the error path of ntb_register_device() is removed and the actual error is returned. Fixes: a1bd3baeb2f1 ("NTB: Add NTB hardware abstraction layer") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Link: https://lore.kernel.org/r/20231201033057.1399131-1-yangyingliang@huaweiclou… [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Conflicts: drivers/ntb/core.c drivers/pci/endpoint/functions/pci-epf-vntb.c [The version does not include the pci-epf-vntb.c source file, and ntb_register_device() function is located in drivers/ntb/ntb.c.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/ntb/ntb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/ntb/ntb.c b/drivers/ntb/ntb.c index 2581ab724c34..3305a2fbea4e 100644 --- a/drivers/ntb/ntb.c +++ b/drivers/ntb/ntb.c @@ -100,6 +100,8 @@ EXPORT_SYMBOL(ntb_unregister_client); int ntb_register_device(struct ntb_dev *ntb) { + int ret; + if (!ntb) return -EINVAL; if (!ntb->pdev) @@ -120,7 +122,11 @@ int ntb_register_device(struct ntb_dev *ntb) ntb->ctx_ops = NULL; spin_lock_init(&ntb->ctx_lock); - return device_register(&ntb->dev); + ret = device_register(&ntb->dev); + if (ret) + put_device(&ntb->dev); + + return ret; } EXPORT_SYMBOL(ntb_register_device); -- 2.25.1

2 1

[PATCH OLK-6.6 0/3] entry: inline syscall enter/exit functions
by liwei 11 May '24

11 May '24

This patchset moves the entry and exit function to entry-common.h, so non inlined code gets only called when there is some work pending. Reference: https://lore.kernel.org/all/20231218074520.1998026-1-svens@linux.ibm.com/ Sven Schnelle (3): entry: Move exit to usermode functions to header file entry: Move enter_from_user_mode() to header file entry: Move syscall_enter_from_user_mode() to header file include/linux/entry-common.h | 95 ++++++++++++++++++++++++++++-- kernel/entry/common.c | 108 ++++------------------------------- 2 files changed, 103 insertions(+), 100 deletions(-) -- 2.25.1

2 4

[PATCH OLK-5.10] NTB: fix possible name leak in ntb_register_device()
by Zeng Heng 11 May '24

11 May '24

From: Yang Yingliang <yangyingliang(a)huawei.com> mainline inclusion from mainline-v6.9-rc1 commit aebfdfe39b9327a3077d0df8db3beb3160c9bdd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9IV CVE: CVE-2023-52652 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If device_register() fails in ntb_register_device(), the device name allocated by dev_set_name() should be freed. As per the comment in device_register(), callers should use put_device() to give up the reference in the error path. So fix this by calling put_device() in the error path so that the name can be freed in kobject_cleanup(). As a result of this, put_device() in the error path of ntb_register_device() is removed and the actual error is returned. Fixes: a1bd3baeb2f1 ("NTB: Add NTB hardware abstraction layer") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Link: https://lore.kernel.org/r/20231201033057.1399131-1-yangyingliang@huaweiclou… [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Conflicts: drivers/pci/endpoint/functions/pci-epf-vntb.c [The version does not include the pci-epf-vntb.c source file.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/ntb/core.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/ntb/core.c b/drivers/ntb/core.c index f8f75a504a58..c423c91a617e 100644 --- a/drivers/ntb/core.c +++ b/drivers/ntb/core.c @@ -100,6 +100,8 @@ EXPORT_SYMBOL(ntb_unregister_client); int ntb_register_device(struct ntb_dev *ntb) { + int ret; + if (!ntb) return -EINVAL; if (!ntb->pdev) @@ -120,7 +122,11 @@ int ntb_register_device(struct ntb_dev *ntb) ntb->ctx_ops = NULL; spin_lock_init(&ntb->ctx_lock); - return device_register(&ntb->dev); + ret = device_register(&ntb->dev); + if (ret) + put_device(&ntb->dev); + + return ret; } EXPORT_SYMBOL(ntb_register_device); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] NTB: fix possible name leak in ntb_register_device()
by Zeng Heng 11 May '24

11 May '24

From: Yang Yingliang <yangyingliang(a)huawei.com> mainline inclusion from mainline-v6.9-rc1 commit aebfdfe39b9327a3077d0df8db3beb3160c9bdd0 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9L9IV CVE: CVE-2023-52652 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- If device_register() fails in ntb_register_device(), the device name allocated by dev_set_name() should be freed. As per the comment in device_register(), callers should use put_device() to give up the reference in the error path. So fix this by calling put_device() in the error path so that the name can be freed in kobject_cleanup(). As a result of this, put_device() in the error path of ntb_register_device() is removed and the actual error is returned. Fixes: a1bd3baeb2f1 ("NTB: Add NTB hardware abstraction layer") Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen(a)linux.intel.com> Reviewed-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Reviewed-by: Dave Jiang <dave.jiang(a)intel.com> Link: https://lore.kernel.org/r/20231201033057.1399131-1-yangyingliang@huaweiclou… [mani: reworded commit message] Signed-off-by: Manivannan Sadhasivam <manivannan.sadhasivam(a)linaro.org> Conflicts: drivers/pci/endpoint/functions/pci-epf-vntb.c [The version does not include the pci-epf-vntb.c source file.] Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- drivers/ntb/ntb.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/ntb/ntb.c b/drivers/ntb/ntb.c index 2581ab724c34..3305a2fbea4e 100644 --- a/drivers/ntb/ntb.c +++ b/drivers/ntb/ntb.c @@ -100,6 +100,8 @@ EXPORT_SYMBOL(ntb_unregister_client); int ntb_register_device(struct ntb_dev *ntb) { + int ret; + if (!ntb) return -EINVAL; if (!ntb->pdev) @@ -120,7 +122,11 @@ int ntb_register_device(struct ntb_dev *ntb) ntb->ctx_ops = NULL; spin_lock_init(&ntb->ctx_lock); - return device_register(&ntb->dev); + ret = device_register(&ntb->dev); + if (ret) + put_device(&ntb->dev); + + return ret; } EXPORT_SYMBOL(ntb_register_device); -- 2.25.1

2 1