- Kernel - mailweb.openeuler.org

[PATCH] files_cgroup: Fix soft lockup when refcnt overflow.
by Yang Yingliang 26 Feb '20

26 Feb '20

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> hulk inclusion category: bugfix bugzilla: 31087 DTS: DTS2020022609725 CVE: NA --------------------- There is a soft lockup call trace as below: CPU: 0 PID: 1360 Comm: imapsvcd Kdump: loaded Tainted: G OE task: ffff8a7296e1eeb0 ti: ffff8a7296aa0000 task.ti: ffff8a7296aa0000 RIP: 0010:[<ffffffffb691ecb4>] [<ffffffffb691ecb4>] __css_tryget+0x24/0x50 RSP: 0018:ffff8a7296aa3db8 EFLAGS: 00000a87 RAX: 0000000080000000 RBX: ffff8a7296aa3df8 RCX: ffff8a72820d9a08 RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff8a72820d9a00 RBP: ffff8a7296aa3db8 R08: 000000000001c360 R09: ffffffffb6a478f4 R10: ffffffffb6935e83 R11: ffffffffffffffd0 R12: 0000000057d35cd8 R13: 000000d000000002 R14: ffffffffb6892fbe R15: 000000d000000002 FS: 0000000000000000(0000) GS:ffff8a72fec00000(0063) knlGS:00000000c6e65b40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 0000000057d35cd8 CR3: 00000007e8008000 CR4: 00000000003607f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: [<ffffffffb6a93578>] files_cgroup_assign+0x48/0x60 [<ffffffffb6a47972>] dup_fd+0xb2/0x2f0 [<ffffffffb6935e83>] ? audit_alloc+0xe3/0x180 [<ffffffffb6893a03>] copy_process+0xbd3/0x1a40 [<ffffffffb6894a21>] do_fork+0x91/0x320 [<ffffffffb6f329e6>] ? trace_do_page_fault+0x56/0x150 [<ffffffffb6894d36>] SyS_clone+0x16/0x20 [<ffffffffb6f3bf8c>] ia32_ptregs_common+0x4c/0xfc code: 1f 84 00 00 00 00 00 0f 1f 44 00 00 55 48 8d 4f 08 48 89 e5 8b 47 08 8d 90 00 00 00 80 85 c0 0f 49 d0 8d 72 01 89 d0 f0 0f b1 When the child process exit, we doesn't call dec refcnt, so, the refcnt maybe overflow. Then the 'task_get_css' will dead loop because the 'css_refcnt' will return an unbias refcnt, if the refcnt is negitave, '__css_tryget' always return false, then 'task_get_css' dead looped. The child process always call 'close_files' when exit, add dec refcnt in it. Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/file.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/file.c b/fs/file.c index 6b9ad66..5b191c3 100644 --- a/fs/file.c +++ b/fs/file.c @@ -423,6 +423,9 @@ static struct fdtable *close_files(struct files_struct * files) set >>= 1; } } +#ifdef CONFIG_CGROUP_FILES + files_cgroup_remove(files); +#endif return fdt; } -- 1.8.3

1 0

[PATCH 0/2] fixes CVE-2020-8648
by Yang Yingliang 25 Feb '20

25 Feb '20

Jiri Slaby (2): vt: selection, handle pending signals in paste_selection vt: selection, close sel_buffer race drivers/tty/vt/selection.c | 32 +++++++++++++++++++++++++------- 1 file changed, 25 insertions(+), 7 deletions(-) -- 1.8.3

1 2

[PATCH 00/10] fix compile error and implenting NUMA affinity for order workqueue
by Yang Yingliang 24 Feb '20

24 Feb '20

Biaoxiang Ye (2): workqueue: implement NUMA affinity for single thread workqueue iscsi: use dynamic single thread workqueue to improve performance Gao Xun (1): RDMA/hns: Compilation Configuration update Yang Yingliang (5): Revert "PCI: fix kabi change in struct pci_bus" Revert "membarrier/kabi: fix kabi for membarrier_state" Revert "bdi: fix kabi for struct backing_dev_info" Revert "debugfs: fix kabi for function debugfs_remove_recursive" iscsi: add member for NUMA aware order workqueue zhangyi (F) (2): jbd2: move the clearing of b_modified flag to the journal_unmap_buffer() jbd2: do not clear the BH_Mapped flag when forgetting a metadata buffer .../infiniband/hw/hns/roce-customer/rdfx_entry.c | 3 +- .../infiniband/hw/hns/roce-customer/rdfx_intf.c | 4 +- drivers/scsi/iscsi_tcp.c | 8 ++++ drivers/scsi/libiscsi.c | 15 +++++-- fs/debugfs/inode.c | 6 --- fs/jbd2/commit.c | 46 ++++++++++++---------- fs/jbd2/transaction.c | 10 +++-- include/linux/backing-dev-defs.h | 4 -- include/linux/debugfs.h | 2 +- include/linux/mm_types.h | 20 +++++----- include/linux/pci.h | 6 +-- include/linux/workqueue.h | 1 + include/scsi/libiscsi.h | 1 + kernel/sched/sched.h | 11 ++---- kernel/workqueue.c | 15 ++++--- 15 files changed, 84 insertions(+), 68 deletions(-) -- 1.8.3

1 10

[PATCH 0/7] Some fixes for kernel
by Yang Yingliang 20 Feb '20

20 Feb '20

Boris Ostrovsky (1): x86/kvm: Be careful not to clear KVM_VCPU_FLUSH_TLB bit Li Bin (1): iommu/iova: avoid softlockup in fq_flush_timeout Xiongfeng Wang (1): sysrq: avoid concurrently info printing by 'sysrq-trigger' Yang Yingliang (1): timer_list: avoid other cpu soft lockup when printing timer list Yufen Yu (2): bdi: fix memleak in bdi_register_va() bdi: get device name under rcu protect Zhang Xiaoxu (1): files_cgroup: fix error pointer when kvm_vm_worker_thread arch/x86/kvm/x86.c | 3 +++ block/bfq-iosched.c | 7 +++++-- block/blk-core.c | 4 +++- drivers/iommu/iova.c | 31 +++++++++++++++++++++---------- drivers/tty/sysrq.c | 6 ++++++ fs/filescontrol.c | 8 +++++++- fs/fs-writeback.c | 4 +++- include/linux/backing-dev.h | 15 +++++++++++++++ include/linux/iova.h | 1 + include/trace/events/wbt.h | 12 ++++-------- include/trace/events/writeback.h | 18 ++++++++---------- kernel/time/timer_list.c | 8 ++++++-- mm/backing-dev.c | 4 ++-- 13 files changed, 84 insertions(+), 37 deletions(-) -- 1.8.3

1 7

[PATCH 00/82] Some fixes and cleanup for drivers
by Yang Yingliang 20 Feb '20

20 Feb '20

Bohong Lin (2): net: hns3: cae clear warnings net: hns3: change version to 1.9.35.0 Colin Ian King (1): net: hns3: make array spec_opcode static const, makes object smaller Gao Xun (1): RDMA/hns:security review update Greg Kroah-Hartman (1): net: hns3: no need to check return value of debugfs_create functions Guangbin Huang (21): net: hns3: delete blank lines and space for cleanup net: hns: modify print function used in hclge_init_ae_dev() net: hns: remove unnecessary newline net: hns3: optimize code of hclge_init_kdump_kernel_config() function net: hns3: optimize local variable of hclge_set_loopback() function net: hns3: optimize code of hns3_parse_vlan_tag() function net: hns: replace goto with return in function hclge_set_vf_uc_mac_addr net: hns3: modify print format in hns3_set_ringpa() net: hns3: replace goto with return in function hns3_set_ringparam() net: hns3: modify code of hclge_mac_phy_link_status_wait() function net: hns3: add error process in hclge_mac_link_status_wait() function net: hns3: support query vf ring and vector map relation net: hns3: modify error process of hclge_phy_link_status_wait() net: hns3: move struct hclge_mdio_cfg_cmd declaration net: hns3: rename variable flag in hnae3_unregister_client() net: hns3: modify return value in hns3_dbg_cmd_write net: hns: replace space with tab for cleanup net: hns3: delete unnecessary judgement in hns3_get_stats() net: hns3: optimize parameter of hclge_phy_link_status_wait() function net: hns3: optimize parameter of hclge_set_phy_loopback() function net: hns3: modify timing of reading register in hclge_reset_wait() Guojia Liao (6): net: hns3: opmitize the table entry restore when resetting net: hns3: delete some useless function and definication net: hns3: delete some useless repeated printing net: hns3: fix bug that PF set VF mac didn't work net: hns3: do not schedule the periodical task when reset fail net: hns3: fix port base vlan add fail when concurrent with reset Huazhong Tan (10): net: hns3: sync some code from net-next part1 net: hns3: split hclge_reset() into preparing and rebuilding part net: hns3: split hclgevf_reset() into preparing and rebuilding part net: hns3: refactor the precedure of PF FLR net: hns3: enlarge HCLGE_RESET_WAIT_CNT net: hns3: modify hclge_func_reset_sync_vf()'s return type to void net: hns3: refactor the procedure of VF FLR net: hns3: refactor the notification scheme of PF reset net: hns3: modify the location of updating the hardware reset done counter net: hns3: set VF's default reset_type to HNAE3_NONE_RESET Jian Shen (5): net: hns3: refine mac address configure for PF net: hns3: use mutex vport_lock intead of spin lock umv_lock net: hns3: refine mac address configure for VF net: hns3: refactor the promisc mode setting net: hns3: skip mac speed and duplex modification checking for fibre port support autoneg Junxin Chen (5): net: fix bug and change version to 1.9.33.0 net: hns3: add protect for parameters and remove unused functions net: hns3: fix bug when parameter check net: hns3: fix compile error when CONFIG_HNS3_DCB is not set net: hns3: clear devil number for hns3_cae Shengzui You (2): net: hns3: update hns3 version to 1.9.35.1 net: hns3: Remove the function of vf check mac address Yonglong Liu (4): net: hns3: modify the irq name of tqp vectors net: hns3: modify the irq name of misc vectors net: hns3: add enabled tc numbers and dwrr weight info in debugfs net: hns3: fix missing help info for qs shaper in debugfs Yu'an Wang (12): hac: sec: add initial configuration in sec_engine_init acc: Remove uacce mode 1 logic below hisilicon uacce: Remove uacce mode 1 relatives qm: fix wrong number of sg elements after dma map zip: use offset fields in sqe to avoid SG_SPLIT qm: remove invalid addr print hpre: optimize key process before free hpre: add likely and unlikey in result judgement sec: change sec_control reg config rde: optimize debug regs clear logic qm: fixup compilation dependency qm: fix the way judge whether q stop in user space Yufeng Mo (1): net: hns3: support of dump mac id and loopback status in debugfs Zhao Weibo (6): RDMA/hns:remove useless header in cmd RDMA/hns: handle device err after device state to UNIT RDMA/hns: avoid potential overflow of RDMA/hns: Add roce dfx of arm_cnt RDMA/hns: fix the bug of out-of-bonds-read in post send RDMA/hns: some robust optimize in rdfx fengsheng (2): drivers : sysctl remove rcu_lock drivers : sysctl fixup some param dont check the legitimacy gaoxun (1): net: hns3: cae security review liuzhongzhu (1): net: hns3: Add "mac table" information query function zhuweijia (1): net: hns3: cae io_param definition updated drivers/crypto/hisilicon/Kconfig | 1 - drivers/crypto/hisilicon/hpre/hpre_crypto.c | 96 +- drivers/crypto/hisilicon/hpre/hpre_main.c | 64 +- drivers/crypto/hisilicon/qm.c | 513 +++---- drivers/crypto/hisilicon/qm.h | 1 - drivers/crypto/hisilicon/rde/rde_main.c | 217 ++- drivers/crypto/hisilicon/sec2/sec_main.c | 54 +- drivers/crypto/hisilicon/sgl.c | 29 +- drivers/crypto/hisilicon/zip/zip_crypto.c | 102 +- drivers/crypto/hisilicon/zip/zip_main.c | 50 +- drivers/infiniband/hw/hns/Makefile | 9 +- drivers/infiniband/hw/hns/hns_roce_cmd.c | 1 - drivers/infiniband/hw/hns/hns_roce_device.h | 4 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 53 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 2 +- drivers/infiniband/hw/hns/hns_roce_main.c | 10 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 14 +- .../hw/hns/roce-customer/hns_hw_v2_test.c | 61 - .../hw/hns/roce-customer/hns_hw_v2_test.h | 10 - .../hw/hns/roce-customer/hns_roce_test.c | 18 - .../hw/hns/roce-customer/hns_roce_test.h | 8 - .../infiniband/hw/hns/roce-customer/rdfx_common.h | 2 +- .../infiniband/hw/hns/roce-customer/rdfx_entry.c | 8 +- .../infiniband/hw/hns/roce-customer/rdfx_hw_v2.c | 16 +- .../infiniband/hw/hns/roce-customer/rdfx_intf.c | 7 +- .../infiniband/hw/hns/roce-customer/rdfx_main.c | 22 +- .../infiniband/hw/hns/roce-customer/rdfx_sysfs.c | 39 +- drivers/net/ethernet/hisilicon/hns3/Makefile | 27 +- drivers/net/ethernet/hisilicon/hns3/hclge_mbx.h | 6 + drivers/net/ethernet/hisilicon/hns3/hnae3.c | 6 +- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 26 +- .../hisilicon/hns3/hns-customer/hns3_ext.c | 603 --------- .../hisilicon/hns3/hns-customer/hns3_ext.h | 102 -- .../hisilicon/hns3/hns-customer/hns3pf/hclge_ext.c | 996 -------------- .../hisilicon/hns3/hns-customer/hns3pf/hclge_ext.h | 142 -- .../hns3/hns-customer/hns3pf/hclge_main_it.c | 20 +- .../hns3/hns-customer/hns3pf/hclge_main_it.h | 2 - .../hisilicon/hns3/hns3_cae/hns3_cae_checksum.c | 19 +- .../hisilicon/hns3/hns3_cae/hns3_cae_checksum.h | 5 +- .../hisilicon/hns3/hns3_cae/hns3_cae_cmd.c | 4 +- .../hisilicon/hns3/hns3_cae/hns3_cae_common.c | 116 -- .../hisilicon/hns3/hns3_cae/hns3_cae_common.h | 25 - .../hisilicon/hns3/hns3_cae/hns3_cae_dcb.c | 62 +- .../hisilicon/hns3/hns3_cae/hns3_cae_dcb.h | 36 +- .../hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.c | 17 +- .../hisilicon/hns3/hns3_cae/hns3_cae_dcqcn.h | 7 +- .../hisilicon/hns3/hns3_cae/hns3_cae_dfx.c | 40 +- .../hisilicon/hns3/hns3_cae/hns3_cae_dfx.h | 9 +- .../hisilicon/hns3/hns3_cae/hns3_cae_ext.c | 426 ------ .../hisilicon/hns3/hns3_cae/hns3_cae_ext.h | 68 - .../ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.c | 56 +- .../ethernet/hisilicon/hns3/hns3_cae/hns3_cae_fd.h | 5 +- .../hisilicon/hns3/hns3_cae/hns3_cae_gro.c | 24 +- .../hisilicon/hns3/hns3_cae/hns3_cae_gro.h | 7 +- .../hns3/hns3_cae/hns3_cae_hilink_param.c | 16 +- .../hns3/hns3_cae/hns3_cae_hilink_param.h | 2 +- .../hisilicon/hns3/hns3_cae/hns3_cae_init.c | 35 +- .../hisilicon/hns3/hns3_cae/hns3_cae_irq.c | 16 +- .../hisilicon/hns3/hns3_cae/hns3_cae_irq.h | 5 +- .../hisilicon/hns3/hns3_cae/hns3_cae_lamp.c | 35 - .../hisilicon/hns3/hns3_cae/hns3_cae_lamp.h | 36 - .../hisilicon/hns3/hns3_cae/hns3_cae_led.c | 8 +- .../hisilicon/hns3/hns3_cae/hns3_cae_led.h | 5 +- .../hisilicon/hns3/hns3_cae/hns3_cae_lib.c | 71 +- .../hisilicon/hns3/hns3_cae/hns3_cae_lib.h | 7 +- .../hisilicon/hns3/hns3_cae/hns3_cae_mac.c | 20 +- .../hisilicon/hns3/hns3_cae/hns3_cae_mac.h | 2 +- .../hisilicon/hns3/hns3_cae/hns3_cae_mactbl.c | 63 - .../hisilicon/hns3/hns3_cae/hns3_cae_mactbl.h | 30 - .../hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.c | 45 +- .../hisilicon/hns3/hns3_cae/hns3_cae_pfc_storm.h | 5 +- .../hisilicon/hns3/hns3_cae/hns3_cae_pkt.c | 741 ---------- .../hisilicon/hns3/hns3_cae/hns3_cae_pkt.h | 67 - .../hisilicon/hns3/hns3_cae/hns3_cae_port.c | 22 +- .../hisilicon/hns3/hns3_cae/hns3_cae_port.h | 2 +- .../hisilicon/hns3/hns3_cae/hns3_cae_promisc.c | 40 +- .../hisilicon/hns3/hns3_cae/hns3_cae_promisc.h | 2 +- .../hisilicon/hns3/hns3_cae/hns3_cae_qinfo.c | 43 +- .../hisilicon/hns3/hns3_cae/hns3_cae_qinfo.h | 10 +- .../hisilicon/hns3/hns3_cae/hns3_cae_qos.c | 138 +- .../hisilicon/hns3/hns3_cae/hns3_cae_qos.h | 19 +- .../hisilicon/hns3/hns3_cae/hns3_cae_qres.c | 35 +- .../hisilicon/hns3/hns3_cae/hns3_cae_qres.h | 2 +- .../hisilicon/hns3/hns3_cae/hns3_cae_reset.c | 27 +- .../hisilicon/hns3/hns3_cae/hns3_cae_reset.h | 7 +- .../hisilicon/hns3/hns3_cae/hns3_cae_rss.c | 47 +- .../hisilicon/hns3/hns3_cae/hns3_cae_rss.h | 2 +- .../hisilicon/hns3/hns3_cae/hns3_cae_stat.c | 48 +- .../hisilicon/hns3/hns3_cae/hns3_cae_stat.h | 4 +- .../ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.c | 235 ++-- .../ethernet/hisilicon/hns3/hns3_cae/hns3_cae_tm.h | 24 +- .../hisilicon/hns3/hns3_cae/hns3_cae_version.c | 34 +- .../hisilicon/hns3/hns3_cae/hns3_cae_version.h | 9 +- .../hisilicon/hns3/hns3_cae/hns3_cae_vlan.c | 20 +- .../hisilicon/hns3/hns3_cae/hns3_cae_vlan.h | 2 +- .../hisilicon/hns3/hns3_cae/hns3_cae_xsfp.c | 28 +- .../hisilicon/hns3/hns3_cae/hns3_cae_xsfp.h | 4 +- drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c | 24 +- drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 243 +--- drivers/net/ethernet/hisilicon/hns3/hns3_enet.h | 12 +- drivers/net/ethernet/hisilicon/hns3/hns3_ethtool.c | 14 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h | 2 + .../ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.c | 240 +++- .../ethernet/hisilicon/hns3/hns3pf/hclge_debugfs.h | 17 + .../net/ethernet/hisilicon/hns3/hns3pf/hclge_err.c | 2 +- .../ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 1424 ++++++++++++++------ .../ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 58 +- .../net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 226 +++- .../ethernet/hisilicon/hns3/hns3pf/hclge_mdio.c | 11 + .../ethernet/hisilicon/hns3/hns3pf/hclge_mdio.h | 11 - .../net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 2 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_cmd.c | 2 +- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.c | 474 +++++-- .../ethernet/hisilicon/hns3/hns3vf/hclgevf_main.h | 32 +- drivers/soc/hisilicon/sysctl/sysctl_drv.c | 2 +- drivers/soc/hisilicon/sysctl/sysctl_local_ras.c | 31 +- drivers/uacce/dummy_drv/dummy_wd_dev.c | 1 - drivers/uacce/dummy_drv/dummy_wd_v2.c | 1 - drivers/uacce/uacce.c | 512 +------ include/linux/uacce.h | 10 +- include/uapi/linux/uacce.h | 6 +- 121 files changed, 3192 insertions(+), 6445 deletions(-) delete mode 100644 drivers/infiniband/hw/hns/roce-customer/hns_hw_v2_test.c delete mode 100644 drivers/infiniband/hw/hns/roce-customer/hns_hw_v2_test.h delete mode 100644 drivers/infiniband/hw/hns/roce-customer/hns_roce_test.c delete mode 100644 drivers/infiniband/hw/hns/roce-customer/hns_roce_test.h delete mode 100644 drivers/net/ethernet/hisilicon/hns3/hns-customer/hns3_ext.c delete mode 100644 drivers/net/ethernet/hisilicon/hns3/hns-customer/hns3_ext.h delete mode 100644 drivers/net/ethernet/hisilicon/hns3/hns-customer/hns3pf/hclge_ext.c delete mode 100644 drivers/net/ethernet/hisilicon/hns3/hns-customer/hns3pf/hclge_ext.h delete mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_common.c delete mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_common.h delete mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_ext.c delete mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_ext.h delete mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lamp.c delete mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_lamp.h delete mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_mactbl.c delete mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_mactbl.h delete mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pkt.c delete mode 100644 drivers/net/ethernet/hisilicon/hns3/hns3_cae/hns3_cae_pkt.h -- 1.8.3

1 82

[PATCH 00/35] Fixes some CVEs and kernel bugs
by Yang Yingliang 20 Feb '20

20 Feb '20

Al Viro (2): do_last(): fetch directory ->i_mode and ->i_uid before it's too late vfs: fix do_last() regression Amir Goldstein (1): debugfs: simplify __debugfs_remove_file() Jan Kara (23): jbd2: Fixup stale comment in commit code jbd2: Completely fill journal descriptor blocks ext4: Move marking of handle as sync to ext4_add_nondir() ext4: Do not iput inode under running transaction ext4: Fix ext4_should_journal_data() for EA inodes ext4: Use ext4_journal_extend() instead of jbd2_journal_extend() ext4: Avoid unnecessary revokes in ext4_alloc_branch() ext4: Provide function to handle transaction restarts ext4, jbd2: Provide accessor function for handle credits ocfs2: Use accessor function for h_buffer_credits jbd2: Reorganize jbd2_journal_stop() jbd2: Drop pointless check from jbd2_journal_stop() jbd2: Drop pointless wakeup from jbd2_journal_stop() jbd2: Factor out common parts of stopping and restarting a handle jbd2: Account descriptor blocks into t_outstanding_credits jbd2: Drop jbd2_space_needed() jbd2: Reserve space for revoke descriptor blocks jbd2: Rename h_buffer_credits to h_total_credits jbd2: Make credit checking more strict ext4: Reserve revoke credits for freed blocks jbd2: Provide trace event for handle restarts jbd2: Fine tune estimate of necessary descriptor blocks jbd2: make jbd2_handle_buffer_credits() handle reserved handles Liu Song (1): jbd2: remove repeated assignments in __jbd2_log_wait_for_space() Shijie Luo (1): ext4: add cond_resched() to ext4_protect_reserved_inode Wen Huang (1): libertas: Fix two buffer overflows at parsing bss descriptor Yufen Yu (2): bdi: fix use-after-free for the bdi device bdi: fix kabi for struct backing_dev_info yangerkun (1): ext4: reserve revoke credits in __ext4_new_inode yu kuai (3): block: rename 'q->debugfs_dir' and 'q->blk_trace->dir' in blk_unregister_queue() simple_recursive_removal(): kernel-side rm -rf for ramfs-style filesystems debugfs: fix kabi for function debugfs_remove_recursive block/blk-cgroup.c | 7 +- block/blk-sysfs.c | 44 +++++ drivers/net/wireless/marvell/libertas/cfg.c | 16 +- fs/debugfs/inode.c | 126 +++----------- fs/ext4/block_validity.c | 1 + fs/ext4/ext4.h | 4 +- fs/ext4/ext4_jbd2.c | 32 +++- fs/ext4/ext4_jbd2.h | 106 ++++++++++-- fs/ext4/extents.c | 89 ++++++---- fs/ext4/ialloc.c | 4 +- fs/ext4/indirect.c | 125 ++++++++------ fs/ext4/inode.c | 31 +--- fs/ext4/migrate.c | 103 +++++------ fs/ext4/namei.c | 39 +++-- fs/ext4/resize.c | 46 ++--- fs/ext4/xattr.c | 94 ++++------ fs/jbd2/checkpoint.c | 3 +- fs/jbd2/commit.c | 9 +- fs/jbd2/journal.c | 35 +++- fs/jbd2/revoke.c | 6 + fs/jbd2/transaction.c | 254 ++++++++++++++++------------ fs/libfs.c | 65 +++++++ fs/namei.c | 17 +- fs/ocfs2/alloc.c | 32 ++-- fs/ocfs2/journal.c | 8 +- fs/tracefs/inode.c | 111 ++---------- include/linux/backing-dev-defs.h | 7 + include/linux/device.h | 5 + include/linux/fs.h | 2 + include/linux/jbd2.h | 87 ++++++---- include/linux/tracefs.h | 1 - include/trace/events/ext4.h | 13 +- include/trace/events/jbd2.h | 16 +- kernel/trace/trace.c | 4 +- kernel/trace/trace_events.c | 6 +- kernel/trace/trace_hwlat.c | 2 +- mm/backing-dev.c | 49 +++++- 37 files changed, 894 insertions(+), 705 deletions(-) -- 1.8.3

1 35

[PATCH] drm/i915/gen9: Clear residual context state on context switch
by Yang Yingliang 07 Feb '20

07 Feb '20

From: Akeem G Abodunrin <akeem.g.abodunrin(a)intel.com> commit bc8a76a152c5f9ef3b48104154a65a68a8b76946 upstream. Intel ID: PSIRT-TA-201910-001 CVEID: CVE-2019-14615 Intel GPU Hardware prior to Gen11 does not clear EU state during a context switch. This can result in information leakage between contexts. For Gen8 and Gen9, hardware provides a mechanism for fast cleardown of the EU state, by issuing a PIPE_CONTROL with bit 27 set. We can use this in a context batch buffer to explicitly cleardown the state on every context switch. As this workaround is already in place for gen8, we can borrow the code verbatim for Gen9. Signed-off-by: Mika Kuoppala <mika.kuoppala(a)linux.intel.com> Signed-off-by: Akeem G Abodunrin <akeem.g.abodunrin(a)intel.com> Cc: Kumar Valsan Prathap <prathap.kumar.valsan(a)intel.com> Cc: Chris Wilson <chris.p.wilson(a)intel.com> Cc: Balestrieri Francesco <francesco.balestrieri(a)intel.com> Cc: Bloomfield Jon <jon.bloomfield(a)intel.com> Cc: Dutt Sudeep <sudeep.dutt(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/gpu/drm/i915/intel_lrc.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c index 6937ef0b..13e97fa 100644 --- a/drivers/gpu/drm/i915/intel_lrc.c +++ b/drivers/gpu/drm/i915/intel_lrc.c @@ -1562,6 +1562,15 @@ static u32 *gen9_init_indirectctx_bb(struct intel_engine_cs *engine, u32 *batch) /* WaFlushCoherentL3CacheLinesAtContextSwitch:skl,bxt,glk */ batch = gen8_emit_flush_coherentl3_wa(engine, batch); + /* WaClearSlmSpaceAtContextSwitch:skl,bxt,kbl,glk,cfl */ + batch = gen8_emit_pipe_control(batch, + PIPE_CONTROL_FLUSH_L3 | + PIPE_CONTROL_GLOBAL_GTT_IVB | + PIPE_CONTROL_CS_STALL | + PIPE_CONTROL_QW_WRITE, + i915_ggtt_offset(engine->scratch) + + 2 * CACHELINE_BYTES); + batch = emit_lri(batch, lri, ARRAY_SIZE(lri)); /* WaClearSlmSpaceAtContextSwitch:kbl */ -- 1.8.3

1 0

[PATCH 00/14] Some bug and CVE fixes
by Yang Yingliang 05 Feb '20

05 Feb '20

Cheng Jian (2): membarrier/kabi: fix kabi for membarrier_state selftest/membarrier: fix build error Mathieu Desnoyers (5): sched/membarrier: Remove redundant check sched/membarrier: Fix p->mm->membarrier_state racy load selftests, sched/membarrier: Add multi-threaded test sched/membarrier: Skip IPIs when mm->mm_users == 1 sched/membarrier: Return -ENOMEM to userspace on memory allocation failure Peter Zijlstra (2): sched: Clean up active_mm reference counting membarrier: Fix RCU locking bug caused by faulty merge Tyler Hicks (1): drm/i915: Fix use-after-free when destroying GEM context Xiongfeng Wang (2): PCI: add a member in 'struct pci_bus' to record the original 'pci_ops' PCI: fix kabi change in struct pci_bus Ying Fang (2): KVM: arm/arm64: use esr_ec as trace field of kvm_exit tracepoint KVM: tools/kvm_stat: Fix kvm_exit filter name drivers/gpu/drm/i915/i915_gem_context.c | 13 +- drivers/pci/probe.c | 7 +- fs/exec.c | 2 +- include/linux/mm_types.h | 8 + include/linux/pci.h | 5 +- include/linux/sched/mm.h | 8 +- kernel/sched/core.c | 49 ++-- kernel/sched/membarrier.c | 236 +++++++++------ kernel/sched/sched.h | 37 +++ tools/kvm/kvm_stat/kvm_stat | 8 +- tools/testing/selftests/membarrier/.gitignore | 3 +- tools/testing/selftests/membarrier/Makefile | 4 +- .../testing/selftests/membarrier/membarrier_test.c | 312 -------------------- .../selftests/membarrier/membarrier_test_impl.h | 317 +++++++++++++++++++++ .../membarrier/membarrier_test_multi_thread.c | 72 +++++ .../membarrier/membarrier_test_single_thread.c | 23 ++ virt/kvm/arm/arm.c | 2 +- virt/kvm/arm/trace.h | 14 +- 18 files changed, 678 insertions(+), 442 deletions(-) delete mode 100644 tools/testing/selftests/membarrier/membarrier_test.c create mode 100644 tools/testing/selftests/membarrier/membarrier_test_impl.h create mode 100644 tools/testing/selftests/membarrier/membarrier_test_multi_thread.c create mode 100644 tools/testing/selftests/membarrier/membarrier_test_single_thread.c -- 1.8.3

1 14

[PATCH] PCI/AER: increments pci bus reference count in aer-inject process
by Yang Yingliang 19 Jan '20

19 Jan '20

From: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> hulk inclusion category: bugfix bugzilla: 28335 CVE: NA ------------------------------------------------- When I test 'aer-inject' with the following procedures: 1. inject a fatal error into a PCI device 2. remove the parent device by sysfs 3. execute command 'rmmod aer-inject' I came across the following use-after-free. [ 297.581524] ================================================================== [ 297.581543] BUG: KASAN: use-after-free in pci_bus_set_ops+0xb4/0xb8 [ 297.581545] Read of size 8 at addr ffff802edbde80e0 by task rmmod/21839 [ 297.581552] CPU: 119 PID: 21839 Comm: rmmod Kdump: loaded Not tainted 4.19.36 #1 [ 297.581554] Hardware name: Huawei TaiShan 2280 V2/BC82AMDD, BIOS 1.05 09/18/2019 [ 297.581556] Call trace: [ 297.581561] dump_backtrace+0x0/0x360 [ 297.581563] show_stack+0x24/0x30 [ 297.581569] dump_stack+0xd8/0x104 [ 297.581576] print_address_description+0x68/0x278 [ 297.581578] kasan_report+0x204/0x330 [ 297.581580] __asan_report_load8_noabort+0x30/0x40 [ 297.581582] pci_bus_set_ops+0xb4/0xb8 [ 297.581591] aer_inject_exit+0x198/0x334 [aer_inject] [ 297.581595] __arm64_sys_delete_module+0x310/0x490 [ 297.581601] el0_svc_common+0xfc/0x278 [ 297.581603] el0_svc_handler+0x50/0xc0 [ 297.581605] el0_svc+0x8/0xc [ 297.581608] Allocated by task 1: [ 297.581611] kasan_kmalloc+0xe0/0x190 [ 297.581614] kmem_cache_alloc_trace+0x104/0x218 [ 297.581616] pci_alloc_bus+0x50/0x2e0 [ 297.581618] pci_add_new_bus+0xa8/0xe08 [ 297.581620] pci_scan_bridge_extend+0x884/0xb28 [ 297.581623] pci_scan_child_bus_extend+0x350/0x628 [ 297.581625] pci_scan_child_bus+0x24/0x30 [ 297.581627] pci_scan_bridge_extend+0x3b8/0xb28 [ 297.581629] pci_scan_child_bus_extend+0x350/0x628 [ 297.581631] pci_scan_child_bus+0x24/0x30 [ 297.581635] acpi_pci_root_create+0x558/0x888 [ 297.581640] pci_acpi_scan_root+0x198/0x330 [ 297.581641] acpi_pci_root_add+0x7bc/0xbb0 [ 297.581646] acpi_bus_attach+0x2f4/0x728 [ 297.581647] acpi_bus_attach+0x1b0/0x728 [ 297.581649] acpi_bus_attach+0x1b0/0x728 [ 297.581651] acpi_bus_scan+0xa0/0x110 [ 297.581657] acpi_scan_init+0x20c/0x500 [ 297.581659] acpi_init+0x54c/0x5d4 [ 297.581661] do_one_initcall+0xbc/0x480 [ 297.581665] kernel_init_freeable+0x5fc/0x6ac [ 297.581670] kernel_init+0x18/0x128 [ 297.581671] ret_from_fork+0x10/0x18 [ 297.581673] Freed by task 19270: [ 297.581675] __kasan_slab_free+0x120/0x228 [ 297.581677] kasan_slab_free+0x10/0x18 [ 297.581678] kfree+0x80/0x1f8 [ 297.581680] release_pcibus_dev+0x54/0x68 [ 297.581686] device_release+0xd4/0x1c0 [ 297.581689] kobject_put+0x12c/0x400 [ 297.581691] device_unregister+0x30/0xc0 [ 297.581693] pci_remove_bus+0xe8/0x1c0 [ 297.581695] pci_remove_bus_device+0xd0/0x2f0 [ 297.581697] pci_stop_and_remove_bus_device_locked+0x2c/0x40 [ 297.581701] remove_store+0x1b8/0x1d0 [ 297.581703] dev_attr_store+0x60/0x80 [ 297.581708] sysfs_kf_write+0x104/0x170 [ 297.581710] kernfs_fop_write+0x23c/0x430 [ 297.581713] __vfs_write+0xec/0x4e0 [ 297.581714] vfs_write+0x12c/0x3d0 [ 297.581715] ksys_write+0xd0/0x190 [ 297.581716] __arm64_sys_write+0x70/0xa0 [ 297.581718] el0_svc_common+0xfc/0x278 [ 297.581720] el0_svc_handler+0x50/0xc0 [ 297.581721] el0_svc+0x8/0xc [ 297.581724] The buggy address belongs to the object at ffff802edbde8000 which belongs to the cache kmalloc-2048 of size 2048 [ 297.581726] The buggy address is located 224 bytes inside of 2048-byte region [ffff802edbde8000, ffff802edbde8800) [ 297.581727] The buggy address belongs to the page: [ 297.581730] page:ffff7e00bb6f7a00 count:1 mapcount:0 mapping:ffff8026de810780 index:0x0 compound_mapcount: 0 [ 297.591520] flags: 0x2ffffe0000008100(slab|head) [ 297.596121] raw: 2ffffe0000008100 ffff7e00bb6f5008 ffff7e00bb6ff608 ffff8026de810780 [ 297.596123] raw: 0000000000000000 00000000000f000f 00000001ffffffff 0000000000000000 [ 297.596124] page dumped because: kasan: bad access detected [ 297.596126] Memory state around the buggy address: [ 297.596128] ffff802edbde7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 297.596129] ffff802edbde8000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.596131] >ffff802edbde8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.596132] ^ [ 297.596133] ffff802edbde8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.596135] ffff802edbde8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 297.596135] ================================================================== It is because when we unload the module and restore the member 'pci_ops' of 'pci_bus', the 'pci_bus' has been freed. This patch increments the reference count of 'pci_bus' when we modify its member 'pci_ops' and decrements the reference count after we have restored its member. Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/pci/pcie/aer_inject.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/pci/pcie/aer_inject.c b/drivers/pci/pcie/aer_inject.c index 48024a8..03ee265 100644 --- a/drivers/pci/pcie/aer_inject.c +++ b/drivers/pci/pcie/aer_inject.c @@ -304,6 +304,13 @@ static int pci_bus_set_aer_ops(struct pci_bus *bus) spin_lock_irqsave(&inject_lock, flags); if (ops == &aer_inj_pci_ops) goto out; + /* + * increments the reference count of the pci bus. Otherwise, when we + * restore the 'pci_ops' in 'aer_inject_exit', the 'pci_bus' may have + * been freed. + */ + pci_bus_get(bus); + pci_bus_ops_init(bus_ops, bus, ops); list_add(&bus_ops->list, &pci_bus_ops_list); bus_ops = NULL; @@ -543,6 +550,7 @@ static void __exit aer_inject_exit(void) while ((bus_ops = pci_bus_ops_pop())) { pci_bus_set_ops(bus_ops->bus, bus_ops->ops); + pci_bus_put(bus_ops->bus); kfree(bus_ops); } -- 1.8.3

1 0

[PATCH 0/2] Its support hibernation
by Yang Yingliang 19 Jan '20

19 Jan '20

Currently, if we test hibernation, it will fails at the ITS driver, because its can't resume and suspend successuly during the phase of hibernation. Add its herbinate state to support its resume correctly. Hongbo Yao (2): PM / hibernate: introduce system_in_hibernation irqchip/gic-v3-its: its support herbination drivers/irqchip/irq-gic-v3-its.c | 19 +++++++++++++++++-- include/linux/suspend.h | 2 ++ kernel/power/hibernate.c | 11 +++++++++++ 3 files changed, 30 insertions(+), 2 deletions(-) -- 1.8.3

1 2