- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 0/7] cpumask: cleanup nr_cpu_ids vs nr_cpumask_bits mess
by Lu Jialin 13 Dec '23

13 Dec '23

From: Zheng Zucheng <zhengzucheng(a)huawei.com> cpumask subsystem uses nr_cpu_ids and nr_cpumask_bits interchangeably despite that the variables have different meaning and purpose. It makes some cpumask functions broken. This series cleans that mess and adds new config FORCE_NR_CPUS that allows to optimize cpumask subsystem if the number of CPUs is known at compile-time. After some testing I found build broken when SMP is on and NR_CPUS == 1. This is addressed in a new patch #1, and in the following patch #2 that now declares set_nr_cpu_ids in cpumask.h (was in smp.h). Yury Norov (6): smp: don't declare nr_cpu_ids if NR_CPUS == 1 smp: add set_nr_cpu_ids() lib/cpumask: delete misleading comment lib/cpumask: deprecate nr_cpumask_bits lib/cpumask: add FORCE_NR_CPUS config option powerpc/64: don't refer nr_cpu_ids in asm code when it's undefined Zheng Zucheng (1): config: Add FORCE_NR_CPUS to openeuler_defconfig arch/arm64/configs/openeuler_defconfig | 1 + arch/loongarch/kernel/setup.c | 2 +- arch/mips/kernel/setup.c | 2 +- arch/powerpc/kernel/head_64.S | 4 ++++ arch/x86/configs/openeuler_defconfig | 1 + arch/x86/kernel/smpboot.c | 4 ++-- arch/x86/xen/smp_pv.c | 2 +- include/linux/cpumask.h | 22 +++++++++++----------- kernel/smp.c | 6 ++++-- lib/Kconfig | 9 +++++++++ 10 files changed, 35 insertions(+), 18 deletions(-) -- 2.34.1

2 8

[PATCH OLK-6.6] x86/ioapic: add an interface for driver to sync hardware data into memory
by Lin Yujun 13 Dec '23

13 Dec '23

From: Hongbo Yao <yaohongbo(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8NV1E -------------------------------- The default interrupt trigger mode of Pci driver is Level, however, some pci drivers want to change irq trigger mode to edge by writing hardware register directly. In current kernel, this kind of driver needs to sync entry data which has already been reservd in memory. This patch provides an interface for the driver to sync entry data in memory. Signed-off-by: Hongbo Yao <yaohongbo(a)huawei.com> Signed-off-by: Lin Yujun <linyujun809(a)huawei.com> --- arch/x86/include/asm/io_apic.h | 1 + arch/x86/kernel/apic/io_apic.c | 25 +++++++++++++++++++++++++ 2 files changed, 26 insertions(+) diff --git a/arch/x86/include/asm/io_apic.h b/arch/x86/include/asm/io_apic.h index 51c782600e02..435ae723a238 100644 --- a/arch/x86/include/asm/io_apic.h +++ b/arch/x86/include/asm/io_apic.h @@ -174,6 +174,7 @@ extern void clear_IO_APIC(void); extern void restore_boot_irq_mode(void); extern int IO_APIC_get_PCI_irq_vector(int bus, int devfn, int pin); extern void print_IO_APICs(void); +extern void ioapic_sync_hardware_data(int irq); #else /* !CONFIG_X86_IO_APIC */ #define IO_APIC_IRQ(x) 0 diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c index 00da6cf6b07d..d256e0b57e94 100644 --- a/arch/x86/kernel/apic/io_apic.c +++ b/arch/x86/kernel/apic/io_apic.c @@ -1202,6 +1202,31 @@ int IO_APIC_get_PCI_irq_vector(int bus, int slot, int pin) } EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector); +/* + * The function is only provided for Drivers to keep the data value in + * memory consistent with the value of the register, and these drivers + * must use it carefully. + * + * The correct step should be: + * Change register ---> ioapic_sync_hardware_data ---> request_irq + */ +void ioapic_sync_hardware_data(int irq) +{ + struct IO_APIC_route_entry entry; + struct mp_chip_data *data; + struct irq_pin_list *pin_list; + + data = irq_get_chip_data(irq); + for_each_irq_pin(pin_list, data->irq_2_pin) { + entry = ioapic_read_entry(pin_list->apic, pin_list->pin); + data->entry.trigger = entry.trigger; + data->entry.polarity = entry.polarity; + pr_debug("irq[%d] update trigger[%d] polarity[%d]\n", + irq, entry.trigger, entry.polarity); + } +} +EXPORT_SYMBOL(ioapic_sync_hardware_data); + static struct irq_chip ioapic_chip, ioapic_ir_chip; static void __init setup_IO_APIC_irqs(void) -- 2.34.1

2 1

[PATCH OLK-6.6 v4 0/8] memcg reclaim and cgroup kill
by Lu Jialin 13 Dec '23

13 Dec '23

Lu Jialin (8): cgroup: Export cgroup.kill from cgroupv2 to cgroupv1 memcg: Export memcg.{min/low} from cgroupv2 to cgroupv1 memcg: Export memcg.high from cgroupv2 to cgroupv1 memcg: Export memory.events{local} from cgroupv2 to cgroupv1 memcg: enable memcg async reclaim memcg: export high_async_ratio to userland memcg: introduce per-memcg reclaim interface config: enable CONFIG_MEMCG_V1_RECLAIM and CONFIG_CGROUP_V1_KILL arch/arm64/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + include/linux/memcontrol.h | 24 +++- init/Kconfig | 10 ++ kernel/cgroup/cgroup-internal.h | 3 + kernel/cgroup/cgroup-v1.c | 7 + kernel/cgroup/cgroup.c | 4 +- mm/memcontrol.c | 183 ++++++++++++++++++++++++- 8 files changed, 228 insertions(+), 7 deletions(-) -- 2.34.1

2 9

[PATCH OLK-5.10 0/5] cpumask: cleanup nr_cpu_ids vs nr_cpumask_bits mess
by Lu Jialin 13 Dec '23

13 Dec '23

From: Zheng Zucheng <zhengzucheng(a)huawei.com> cpumask subsystem uses nr_cpu_ids and nr_cpumask_bits interchangeably despite that the variables have different meaning and purpose. It makes some cpumask functions broken. This series cleans that mess and adds new config FORCE_NR_CPUS that allows to optimize cpumask subsystem if the number of CPUs is known at compile-time. After some testing I found build broken when SMP is on and NR_CPUS == 1. This is addressed in a new patch #1, and in the following patch #2 that now declares set_nr_cpu_ids in cpumask.h (was in smp.h). Yury Norov (5): smp: don't declare nr_cpu_ids if NR_CPUS == 1 smp: add set_nr_cpu_ids() lib/cpumask: delete misleading comment lib/cpumask: deprecate nr_cpumask_bits lib/cpumask: add FORCE_NR_CPUS config option arch/loongarch/kernel/setup.c | 2 +- arch/mips/kernel/setup.c | 2 +- arch/x86/kernel/smpboot.c | 4 ++-- arch/x86/xen/smp_pv.c | 2 +- include/linux/cpumask.h | 22 +++++++++++----------- kernel/smp.c | 6 ++++-- lib/Kconfig | 9 +++++++++ 7 files changed, 29 insertions(+), 18 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6] x86/ioapic: add an interface for driver to sync hardware data into memory
by Lin Yujun 13 Dec '23

13 Dec '23

From: Hongbo Yao <yaohongbo(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8NV1E -------------------------------- The default interrupt trigger mode of Pci driver is Level, however, some pci drivers want to change irq trigger mode to edge by writing hardware register directly. In current kernel, this kind of driver needs to sync entry data which has already been reservd in memory. This patch provides an interface for the driver to sync entry data in memory. Signed-off-by: Hongbo Yao <yaohongbo(a)huawei.com> Signed-off-by: Lin Yujun <linyujun809(a)huawei.com> --- arch/x86/include/asm/io_apic.h | 1 + arch/x86/kernel/apic/io_apic.c | 25 +++++++++++++++++++++++++ 2 files changed, 26 insertions(+) diff --git a/arch/x86/include/asm/io_apic.h b/arch/x86/include/asm/io_apic.h index 51c782600e02..435ae723a238 100644 --- a/arch/x86/include/asm/io_apic.h +++ b/arch/x86/include/asm/io_apic.h @@ -174,6 +174,7 @@ extern void clear_IO_APIC(void); extern void restore_boot_irq_mode(void); extern int IO_APIC_get_PCI_irq_vector(int bus, int devfn, int pin); extern void print_IO_APICs(void); +extern void ioapic_sync_hardware_data(int irq); #else /* !CONFIG_X86_IO_APIC */ #define IO_APIC_IRQ(x) 0 diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c index 00da6cf6b07d..d256e0b57e94 100644 --- a/arch/x86/kernel/apic/io_apic.c +++ b/arch/x86/kernel/apic/io_apic.c @@ -1202,6 +1202,31 @@ int IO_APIC_get_PCI_irq_vector(int bus, int slot, int pin) } EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector); +/* + * The function is only provided for Drivers to keep the data value in + * memory consistent with the value of the register, and these drivers + * must use it carefully. + * + * The correct step should be: + * Change register ---> ioapic_sync_hardware_data ---> request_irq + */ +void ioapic_sync_hardware_data(int irq) +{ + struct IO_APIC_route_entry entry; + struct mp_chip_data *data; + struct irq_pin_list *pin_list; + + data = irq_get_chip_data(irq); + for_each_irq_pin(pin_list, data->irq_2_pin) { + entry = ioapic_read_entry(pin_list->apic, pin_list->pin); + data->entry.trigger = entry.trigger; + data->entry.polarity = entry.polarity; + pr_debug("irq[%d] update trigger[%d] polarity[%d]\n", + irq, entry.trigger, entry.polarity); + } +} +EXPORT_SYMBOL(ioapic_sync_hardware_data); + static struct irq_chip ioapic_chip, ioapic_ir_chip; static void __init setup_IO_APIC_irqs(void) -- 2.34.1

2 1

[PATCH OLK-6.6] ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
by Zhengchao Shao 13 Dec '23

13 Dec '23

mainline inclusion from mainline-v6.7-rc2 commit e2b706c691905fe78468c361aaabc719d0a496f1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8K0N2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When I perform the following test operations: 1.ip link add br0 type bridge 2.brctl addif br0 eth0 3.ip addr add 239.0.0.1/32 dev eth0 4.ip addr add 239.0.0.1/32 dev br0 5.ip addr add 224.0.0.1/32 dev br0 6.while ((1)) do ifconfig br0 up ifconfig br0 down done 7.send IGMPv2 query packets to port eth0 continuously. For example, ./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00 1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00" The preceding tests may trigger the refcnt uaf issue of the mc list. The stack is as follows: refcount_t: addition on 0; use-after-free. WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25) CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty #80 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 RIP: 0010:refcount_warn_saturate (lib/refcount.c:25) RSP: 0018:ffffb68f00657910 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908 RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900 RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680 R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00 FS: 0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0 Call Trace: <TASK> igmp_heard_query (net/ipv4/igmp.c:1068) igmp_rcv (net/ipv4/igmp.c:1132) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205) ip_local_deliver_finish (net/ipv4/ip_input.c:234) __netif_receive_skb_one_core (net/core/dev.c:5529) netif_receive_skb_internal (net/core/dev.c:5729) netif_receive_skb (net/core/dev.c:5788) br_handle_frame_finish (net/bridge/br_input.c:216) nf_hook_bridge_pre (net/bridge/br_input.c:294) __netif_receive_skb_core (net/core/dev.c:5423) __netif_receive_skb_list_core (net/core/dev.c:5606) __netif_receive_skb_list (net/core/dev.c:5674) netif_receive_skb_list_internal (net/core/dev.c:5764) napi_gro_receive (net/core/gro.c:609) e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467) e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805) __napi_poll (net/core/dev.c:6533) net_rx_action (net/core/dev.c:6735) __do_softirq (kernel/softirq.c:554) run_ksoftirqd (kernel/softirq.c:913) smpboot_thread_fn (kernel/smpboot.c:164) kthread (kernel/kthread.c:388) ret_from_fork (arch/x86/kernel/process.c:153) ret_from_fork_asm (arch/x86/entry/entry_64.S:250) </TASK> The root causes are as follows: Thread A Thread B ... netif_receive_skb br_dev_stop ... br_multicast_leave_snoopers ... __ip_mc_dec_group ... __igmp_group_dropped igmp_rcv igmp_stop_timer igmp_heard_query //ref = 1 ip_ma_put igmp_mod_timer refcount_dec_and_test igmp_start_timer //ref = 0 ... refcount_inc //ref increases from 0 When the device receives an IGMPv2 Query message, it starts the timer immediately, regardless of whether the device is running. If the device is down and has left the multicast group, it will cause the mc list refcount uaf issue. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Hangbin Liu <liuhangbin(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> --- net/ipv4/igmp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index 418e5fb58fd3..d515881d02a6 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -216,8 +216,10 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay) int tv = get_random_u32_below(max_delay); im->tm_running = 1; - if (!mod_timer(&im->timer, jiffies+tv+2)) - refcount_inc(&im->refcnt); + if (refcount_inc_not_zero(&im->refcnt)) { + if (mod_timer(&im->timer, jiffies + tv + 2)) + ip_ma_put(im); + } } static void igmp_gq_start_timer(struct in_device *in_dev) -- 2.34.1

2 1

[PATCH OLK-6.6] x86/ioapic: add an interface for driver to sync hardware data into memory
by Lin Yujun 12 Dec '23

12 Dec '23

From: Hongbo Yao <yaohongbo(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8NV1E -------------------------------- The default interrupt trigger mode of Pci driver is Level, however, some pci drivers want to change irq trigger mode to edge by writing hardware register directly. In current kernel, this kind of driver needs to sync entry data which has already been reservd in memory. This patch provides an interface for the driver to sync entry data in memory. Signed-off-by: Hongbo Yao <yaohongbo(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: zhangyi (F) <yi.zhang(a)huawei.com> Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Liao Chang <liaochang1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Lin Yujun <linyujun809(a)huawei.com> --- arch/x86/include/asm/io_apic.h | 1 + arch/x86/kernel/apic/io_apic.c | 25 +++++++++++++++++++++++++ 2 files changed, 26 insertions(+) diff --git a/arch/x86/include/asm/io_apic.h b/arch/x86/include/asm/io_apic.h index 51c782600e02..435ae723a238 100644 --- a/arch/x86/include/asm/io_apic.h +++ b/arch/x86/include/asm/io_apic.h @@ -174,6 +174,7 @@ extern void clear_IO_APIC(void); extern void restore_boot_irq_mode(void); extern int IO_APIC_get_PCI_irq_vector(int bus, int devfn, int pin); extern void print_IO_APICs(void); +extern void ioapic_sync_hardware_data(int irq); #else /* !CONFIG_X86_IO_APIC */ #define IO_APIC_IRQ(x) 0 diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c index 00da6cf6b07d..d256e0b57e94 100644 --- a/arch/x86/kernel/apic/io_apic.c +++ b/arch/x86/kernel/apic/io_apic.c @@ -1202,6 +1202,31 @@ int IO_APIC_get_PCI_irq_vector(int bus, int slot, int pin) } EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector); +/* + * The function is only provided for Drivers to keep the data value in + * memory consistent with the value of the register, and these drivers + * must use it carefully. + * + * The correct step should be: + * Change register ---> ioapic_sync_hardware_data ---> request_irq + */ +void ioapic_sync_hardware_data(int irq) +{ + struct IO_APIC_route_entry entry; + struct mp_chip_data *data; + struct irq_pin_list *pin_list; + + data = irq_get_chip_data(irq); + for_each_irq_pin(pin_list, data->irq_2_pin) { + entry = ioapic_read_entry(pin_list->apic, pin_list->pin); + data->entry.trigger = entry.trigger; + data->entry.polarity = entry.polarity; + pr_debug("irq[%d] update trigger[%d] polarity[%d]\n", + irq, entry.trigger, entry.polarity); + } +} +EXPORT_SYMBOL(ioapic_sync_hardware_data); + static struct irq_chip ioapic_chip, ioapic_ir_chip; static void __init setup_IO_APIC_irqs(void) -- 2.34.1

2 1

[PATCH OLK-5.10 0/5] cpumask: cleanup nr_cpu_ids vs nr_cpumask_bits mess
by Lu Jialin 12 Dec '23

12 Dec '23

From: Zheng Zucheng <zhengzucheng(a)huawei.com> Yury Norov (5): mainline inclusion from mainline-v6.1-rc1 commit 53fc190cc6771c5494d782210334d4ebb50c7103 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8KQBZ CVE: NA mainline inclusion from mainline-v6.1-rc1 commit 38bef8e57f2149acd2c910a98f57dd6291d2e0ec category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8KQBZ CVE: NA mainline inclusion from mainline-v6.1-rc1 commit 7102b3bb070fdf4580a05cbfc5ad3c0691dc4bf9 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8KQBZ CVE: NA mainline inclusion from mainline-v6.1-rc1 commit aa47a7c215e79a2ade6916f163c5a17b561bce4f category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8KQBZ CVE: NA mainline inclusion from mainline-v6.1-rc1 commit 6f9c07be9d020489326098801f0661f754c7c865 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8KQBZ CVE: NA arch/loongarch/kernel/setup.c | 2 +- arch/mips/kernel/setup.c | 2 +- arch/x86/kernel/smpboot.c | 4 ++-- arch/x86/xen/smp_pv.c | 2 +- include/linux/cpumask.h | 22 +++++++++++----------- kernel/smp.c | 6 ++++-- lib/Kconfig | 9 +++++++++ 7 files changed, 29 insertions(+), 18 deletions(-) -- 2.34.1

2 6

[PATCH OLK-6.6 v5 0/6] Ascend features
by Yuan Can 12 Dec '23

12 Dec '23

Navid Emamdoost (1): nbd_genl_status: null check for nla_nest_start Weilong Chen (2): ACPI / APEI: Notify all ras err to driver arm64/ascend: Add new enable_oom_killer interface for oom contrl Xu Qiang (2): irq-gic-v3: Add support to init ts core GICR irq-gic-v3-its: It can't be initialized when the GICR had been cut Yuan Can (1): ascend: export interfaces required by ascend drivers arch/arm64/configs/openeuler_defconfig | 1 + drivers/acpi/apei/Kconfig | 7 + drivers/acpi/apei/ghes.c | 8 +- drivers/block/nbd.c | 6 + drivers/irqchip/Kconfig | 7 + drivers/irqchip/irq-gic-v3-its.c | 254 ++++++++++++++++++++++++- drivers/irqchip/irq-gic-v3.c | 101 +++++++++- include/linux/irqchip/arm-gic-v3.h | 5 + include/linux/oom.h | 24 +++ kernel/power/autosleep.c | 1 + kernel/workqueue.c | 3 + mm/Kconfig | 10 + mm/memcontrol.c | 20 ++ mm/oom_kill.c | 58 ++++++ mm/util.c | 2 + mm/vmalloc.c | 2 + 16 files changed, 500 insertions(+), 9 deletions(-) -- 2.17.1

2 7

[PATCH OLK-6.6 v2 0/4] xfs: fix some misc issue
by Long Li 12 Dec '23

12 Dec '23

his patch set fix some mics xfs issue: Long Li (4): xfs: fix a UAF when inode item push xfs: fix a UAF in xfs_iflush_abort_clean xfs: don't verify agf length when log recovery xfs: xfs_trans_cancel() path must check for log shutdown fs/xfs/libxfs/xfs_alloc.c | 3 ++- fs/xfs/xfs_buf.c | 5 +++++ fs/xfs/xfs_inode_item.c | 8 +++++++- fs/xfs/xfs_trans.c | 2 +- 4 files changed, 15 insertions(+), 3 deletions(-) -- 2.31.1

2 5