- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1231/1231] arch/arm64/kernel/mpam/mpam_ctrlmon.c:201: warning: Function parameter or member 'rdtgrp' not described in 'resctrl_group_resync_domain_ctrls'
by kernel test robot 07 Nov '24

07 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: bafa65a8c91fb9c99706d2d22210690199f95779 commit: 273a0966b93355cd69473db4ab13e2f727623a0e [1231/1231] mpam: update monitor rmid and group configuration config: arm64-randconfig-001-20241029 (https://download.01.org/0day-ci/archive/20241107/202411071854.JMBS7gBz-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241107/202411071854.JMBS7gBz-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411071854.JMBS7gBz-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/arm64/kernel/mpam/mpam_ctrlmon.c:596:5: warning: no previous prototype for 'resctrl_group_mondata_show' [-Wmissing-prototypes] 596 | int resctrl_group_mondata_show(struct seq_file *m, void *arg) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_ctrlmon.c: In function 'resctrl_mkdir_mondata_all_subdir': arch/arm64/kernel/mpam/mpam_ctrlmon.c:786:54: warning: variable 'rr' set but not used [-Wunused-but-set-variable] 786 | struct raw_resctrl_resource *rr; | ^~ >> arch/arm64/kernel/mpam/mpam_ctrlmon.c:201: warning: Function parameter or member 'rdtgrp' not described in 'resctrl_group_resync_domain_ctrls' >> arch/arm64/kernel/mpam/mpam_ctrlmon.c:201: warning: Function parameter or member 'r' not described in 'resctrl_group_resync_domain_ctrls' >> arch/arm64/kernel/mpam/mpam_ctrlmon.c:201: warning: Function parameter or member 'dom' not described in 'resctrl_group_resync_domain_ctrls' arch/arm64/kernel/mpam/mpam_ctrlmon.c:472: warning: Function parameter or member 's' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:472: warning: Function parameter or member 'r' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:472: warning: Function parameter or member 'schema_name' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:472: warning: Function parameter or member 'type' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:472: warning: Function parameter or member 'closid' not described in 'show_doms' vim +201 arch/arm64/kernel/mpam/mpam_ctrlmon.c 191 192 /** 193 * Resync resctrl group domain ctrls, use rdtgrp->resync to indicate 194 * whether the resync procedure will be called. When resync==1, all 195 * domain ctrls of this group be synchronized again. This happens 196 * when rmid of this group is changed, and all configurations need to 197 * be remapped again accordingly. 198 */ 199 static void resctrl_group_resync_domain_ctrls(struct rdtgroup *rdtgrp, 200 struct resctrl_resource *r, struct rdt_domain *dom) > 201 { 202 int i; 203 int staged_start, staged_end; 204 struct resctrl_staged_config *cfg; 205 struct sd_closid closid; 206 struct list_head *head; 207 struct rdtgroup *entry; 208 struct msr_param para; 209 bool cdp_both_ctrl; 210 211 cfg = dom->staged_cfg; 212 para.closid = &closid; 213 214 staged_start = (r->cdp_enable) ? CDP_CODE : CDP_BOTH; 215 staged_end = (r->cdp_enable) ? CDP_DATA : CDP_BOTH; 216 217 for (i = staged_start; i <= staged_end; i++) { 218 cdp_both_ctrl = cfg[i].cdp_both_ctrl; 219 /* 220 * for ctrl group configuration, hw_closid of cfg[i] equals 221 * to rdtgrp->closid.intpartid. 222 */ 223 closid.intpartid = hw_closid_val(cfg[i].hw_closid); 224 resctrl_cdp_mpamid_map_val(rdtgrp->closid.reqpartid, 225 cfg[i].conf_type, closid.reqpartid); 226 resctrl_dom_ctrl_config(cdp_both_ctrl, r, dom, &para); 227 228 /* 229 * we should synchronize all child mon groups' 230 * configuration from this ctrl rdtgrp 231 */ 232 head = &rdtgrp->mon.crdtgrp_list; 233 list_for_each_entry(entry, head, mon.crdtgrp_list) { 234 resctrl_cdp_mpamid_map_val(entry->closid.reqpartid, 235 cfg[i].conf_type, closid.reqpartid); 236 resctrl_dom_ctrl_config(cdp_both_ctrl, r, dom, &para); 237 } 238 } 239 } 240 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-6.6] RDMA/hns: Fix DCA mmap area PUAF
by Chengchang Tang 07 Nov '24

07 Nov '24

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB2H4P ---------------------------------------------------------------------- DCA mmap area would be freed after driver reseted or hot unplugged. At this time, the vma is still valid, which may lead to a PUAF. Using rdma_user_mmap_io() to remap this area to ensure the vma is zapped after dirver removal. Fixes: d3caaebdbfe9 ("RDMA/hns: Optimize user DCA perfermance by sharing DCA status") Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_dca.c | 3 +- drivers/infiniband/hw/hns/hns_roce_main.c | 39 ++++------------------- 2 files changed, 9 insertions(+), 33 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_dca.c b/drivers/infiniband/hw/hns/hns_roce_dca.c index 49adf43261d6..4cef41591795 100644 --- a/drivers/infiniband/hw/hns/hns_roce_dca.c +++ b/drivers/infiniband/hw/hns/hns_roce_dca.c @@ -1132,7 +1132,8 @@ static void init_udca_status(struct hns_roce_ucontext *uctx, int udca_max_qps, return; ctx->dca_mmap_entry = hns_roce_user_mmap_entry_insert(ib_uctx, - (u64)kaddr, size, HNS_ROCE_MMAP_TYPE_DCA); + (u64)virt_to_phys(kaddr), size, + HNS_ROCE_MMAP_TYPE_DCA); if (!ctx->dca_mmap_entry) { free_pages_exact(kaddr, size); return; diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index 1302c58c3937..d488c3d5986f 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -644,36 +644,6 @@ static void hns_roce_dealloc_ucontext(struct ib_ucontext *ibcontext) ida_free(&hr_dev->uar_ida.ida, (int)context->uar.logic_idx); } -static int mmap_dca(struct ib_ucontext *context, struct vm_area_struct *vma) -{ - struct hns_roce_ucontext *uctx = to_hr_ucontext(context); - struct hns_roce_dca_ctx *ctx = &uctx->dca_ctx; - struct page **pages; - unsigned long num; - int ret; - - if ((vma->vm_end - vma->vm_start != (ctx->status_npage * PAGE_SIZE) || - !(vma->vm_flags & VM_SHARED))) - return -EINVAL; - - if (!(vma->vm_flags & VM_WRITE) || (vma->vm_flags & VM_EXEC)) - return -EPERM; - - if (!ctx->buf_status) - return -EOPNOTSUPP; - - pages = kcalloc(ctx->status_npage, sizeof(struct page *), GFP_KERNEL); - if (!pages) - return -ENOMEM; - - for (num = 0; num < ctx->status_npage; num++) - pages[num] = virt_to_page(ctx->buf_status + num * PAGE_SIZE); - - ret = vm_insert_pages(vma, vma->vm_start, pages, &num); - kfree(pages); - return ret; -} - static int hns_roce_mmap(struct ib_ucontext *uctx, struct vm_area_struct *vma) { struct hns_roce_dev *hr_dev = to_hr_dev(uctx->device); @@ -703,8 +673,13 @@ static int hns_roce_mmap(struct ib_ucontext *uctx, struct vm_area_struct *vma) prot = pgprot_device(vma->vm_page_prot); break; case HNS_ROCE_MMAP_TYPE_DCA: - ret = mmap_dca(uctx, vma); - goto out; + if (!(vma->vm_flags & VM_WRITE) || (vma->vm_flags & VM_EXEC)) { + ret = -EPERM; + goto out; + } + vm_flags_set(vma, VM_DONTEXPAND); + prot = vma->vm_page_prot; + break; case HNS_ROCE_MMAP_TYPE_RESET: if (vma->vm_flags & (VM_WRITE | VM_EXEC)) { ret = -EINVAL; -- 2.33.0

2 1

[PATCH OLK-6.6] nfsd: cancel nfsd_shrinker_work using sync mode in nfs4_state_shutdown_net
by Li Lingfeng 07 Nov '24

07 Nov '24

From: Yang Erkun <yangerkun(a)huaweicloud.com> stable inclusion from stable-v6.6.59 commit f965dc0f099a54fca100acf6909abe52d0c85328 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2Q1N CVE: CVE-2024-50121 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d5ff2fb2e7167e9483846e34148e60c0c016a1f6 ] In the normal case, when we excute `echo 0 > /proc/fs/nfsd/threads`, the function `nfs4_state_destroy_net` in `nfs4_state_shutdown_net` will release all resources related to the hashed `nfs4_client`. If the `nfsd_client_shrinker` is running concurrently, the `expire_client` function will first unhash this client and then destroy it. This can lead to the following warning. Additionally, numerous use-after-free errors may occur as well. nfsd_client_shrinker echo 0 > /proc/fs/nfsd/threads expire_client nfsd_shutdown_net unhash_client ... nfs4_state_shutdown_net /* won't wait shrinker exit */ /* cancel_work(&nn->nfsd_shrinker_work) * nfsd_file for this /* won't destroy unhashed client1 */ * client1 still alive nfs4_state_destroy_net */ nfsd_file_cache_shutdown /* trigger warning */ kmem_cache_destroy(nfsd_file_slab) kmem_cache_destroy(nfsd_file_mark_slab) /* release nfsd_file and mark */ __destroy_client ==================================================================== BUG nfsd_file (Not tainted): Objects remaining in nfsd_file on __kmem_cache_shutdown() -------------------------------------------------------------------- CPU: 4 UID: 0 PID: 764 Comm: sh Not tainted 6.12.0-rc3+ #1 dump_stack_lvl+0x53/0x70 slab_err+0xb0/0xf0 __kmem_cache_shutdown+0x15c/0x310 kmem_cache_destroy+0x66/0x160 nfsd_file_cache_shutdown+0xac/0x210 [nfsd] nfsd_destroy_serv+0x251/0x2a0 [nfsd] nfsd_svc+0x125/0x1e0 [nfsd] write_threads+0x16a/0x2a0 [nfsd] nfsctl_transaction_write+0x74/0xa0 [nfsd] vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e ==================================================================== BUG nfsd_file_mark (Tainted: G B W ): Objects remaining nfsd_file_mark on __kmem_cache_shutdown() -------------------------------------------------------------------- dump_stack_lvl+0x53/0x70 slab_err+0xb0/0xf0 __kmem_cache_shutdown+0x15c/0x310 kmem_cache_destroy+0x66/0x160 nfsd_file_cache_shutdown+0xc8/0x210 [nfsd] nfsd_destroy_serv+0x251/0x2a0 [nfsd] nfsd_svc+0x125/0x1e0 [nfsd] write_threads+0x16a/0x2a0 [nfsd] nfsctl_transaction_write+0x74/0xa0 [nfsd] vfs_write+0x1a5/0x6d0 ksys_write+0xc1/0x160 do_syscall_64+0x5f/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7e To resolve this issue, cancel `nfsd_shrinker_work` using synchronous mode in nfs4_state_shutdown_net. Fixes: 7c24fa225081 ("NFSD: replace delayed_work with work_struct for nfsd_client_shrinker") Signed-off-by: Yang Erkun <yangerkun(a)huaweicloud.com> Reviewed-by: Jeff Layton <jlayton(a)kernel.org> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/nfsd/nfs4state.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c index 7390322242d7..901fc68636cd 100644 --- a/fs/nfsd/nfs4state.c +++ b/fs/nfsd/nfs4state.c @@ -8255,7 +8255,7 @@ nfs4_state_shutdown_net(struct net *net) struct nfsd_net *nn = net_generic(net, nfsd_net_id); unregister_shrinker(&nn->nfsd_client_shrinker); - cancel_work(&nn->nfsd_shrinker_work); + cancel_work_sync(&nn->nfsd_shrinker_work); cancel_delayed_work_sync(&nn->laundromat_work); locks_end_grace(&nn->nfsd4_manager); -- 2.31.1

2 1

[PATCH OLK-6.6 0/1] CVE-2024-50133
by Lin Yujun 07 Nov '24

07 Nov '24

Thomas Weißschuh (1): LoongArch: Don't crash in stack_top() for tasks without vDSO arch/loongarch/kernel/process.c | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-50133
by Lin Yujun 07 Nov '24

07 Nov '24

Thomas Weißschuh (1): LoongArch: Don't crash in stack_top() for tasks without vDSO arch/loongarch/kernel/process.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-50133
by Lin Yujun 07 Nov '24

07 Nov '24

Thomas Weißschuh (1): LoongArch: Don't crash in stack_top() for tasks without vDSO arch/loongarch/kernel/process.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) -- 2.34.1

2 2

[PATCH 0/2] Some bug fix patches for OLK-5.10 perf
by Yushan Wang 07 Nov '24

07 Nov '24

From: zhangqz <14294317+zhangqizhi3(a)user.noreply.gitee.com> Some bug fix patches for OLK-5.10 perf John Garry (2): perf metricgroup: Fix for metrics containing duration_time perf metricgroup: Fix system PMU metrics tools/perf/util/metricgroup.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) -- 2.33.0

1 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-49878
by Yongqiang Liu 07 Nov '24

07 Nov '24

Huang Ying (1): resource: fix region_intersects() vs add_memory_driver_managed() kernel/resource.c | 58 ++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 50 insertions(+), 8 deletions(-) -- 2.25.1

2 2

[PATCH OLK-5.10 0/1] CVE-2024-49878
by Yongqiang Liu 07 Nov '24

07 Nov '24

Huang Ying (1): resource: fix region_intersects() vs add_memory_driver_managed() kernel/resource.c | 58 ++++++++++++++++++++++++++++++++++++++++------- 1 file changed, 50 insertions(+), 8 deletions(-) -- 2.25.1

2 2

[PATCH openEuler-22.03-LTS-SP1] thunderbolt: Mark XDomain as unplugged when router is removed
by Zhang Zekun 07 Nov '24

07 Nov '24

From: Mika Westerberg <mika.westerberg(a)linux.intel.com> stable inclusion from stable-v5.10.225 commit 747bc154577de6e6af4bc99abfa859b8419bb4d8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAR5FZ CVE: CVE-2024-46702 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------------------------------------------- commit e2006140ad2e01a02ed0aff49cc2ae3ceeb11f8d upstream. I noticed that when we do discrete host router NVM upgrade and it gets hot-removed from the PCIe side as a result of NVM firmware authentication, if there is another host connected with enabled paths we hang in tearing them down. This is due to fact that the Thunderbolt networking driver also tries to cleanup the paths and ends up blocking in tb_disconnect_xdomain_paths() waiting for the domain lock. However, at this point we already cleaned the paths in tb_stop() so there is really no need for tb_disconnect_xdomain_paths() to do that anymore. Furthermore it already checks if the XDomain is unplugged and bails out early so take advantage of that and mark the XDomain as unplugged when we remove the parent router. Cc: stable(a)vger.kernel.org Signed-off-by: Mika Westerberg <mika.westerberg(a)linux.intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/thunderbolt/switch.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c index b13a944eb462..f6580d11c0fe 100644 --- a/drivers/thunderbolt/switch.c +++ b/drivers/thunderbolt/switch.c @@ -2584,6 +2584,7 @@ void tb_switch_remove(struct tb_switch *sw) tb_switch_remove(port->remote->sw); port->remote = NULL; } else if (port->xdomain) { + port->xdomain->is_unplugged = true; tb_xdomain_remove(port->xdomain); port->xdomain = NULL; } -- 2.17.1

2 1