- Kernel - mailweb.openeuler.org

[RESEND OLK-5.10] irqchip/gicv3-its: Add workaround for hip09 ITS erratum 162100801
by chenxiang 12 Jun '23

12 Jun '23

From: Xiang Chen <chenxiang66(a)hisilicon.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7C103 ------------------------------------------------ When enabled GICv4.1 in hip09, there are some invalid vPE configurations in configuration table for some situations, which will cause some vSGI interrupts lost. To fix the issue, need to send vinvall command after vmovp. Signed-off-by: t00358190 <tangnianyao(a)huawei.com> Signed-off-by: Xiang Chen <chenxiang66(a)hisilicon.com> Signed-off-by: caijian <caijian11(a)h-partners.com> --- Documentation/arm64/silicon-errata.rst | 2 ++ arch/arm64/Kconfig | 11 +++++++ arch/arm64/configs/openeuler_defconfig | 1 + drivers/irqchip/irq-gic-v3-its.c | 40 ++++++++++++++++++++------ 4 files changed, 46 insertions(+), 8 deletions(-) diff --git a/Documentation/arm64/silicon-errata.rst b/Documentation/arm64/silicon-errata.rst index b72fbbfe3fcb..2305def38396 100644 --- a/Documentation/arm64/silicon-errata.rst +++ b/Documentation/arm64/silicon-errata.rst @@ -149,6 +149,8 @@ stable kernels. +----------------+-----------------+-----------------+-----------------------------+ | Hisilicon | TSV{110,200} | #1980005 | HISILICON_ERRATUM_1980005 | +----------------+-----------------+-----------------+-----------------------------+ +| Hisilicon | Hip09 | #162100801 | HISILICON_ERRATUM_162100801 | ++----------------+-----------------+-----------------+-----------------------------+ +----------------+-----------------+-----------------+-----------------------------+ | Qualcomm Tech. | Kryo/Falkor v1 | E1003 | QCOM_FALKOR_ERRATUM_1003 | +----------------+-----------------+-----------------+-----------------------------+ diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig index 3dcf96f37a3c..766356f04abc 100644 --- a/arch/arm64/Kconfig +++ b/arch/arm64/Kconfig @@ -802,6 +802,17 @@ config HISILICON_ERRATUM_1980005 If unsure, say N. +config HISILICON_ERRATUM_162100801 + bool "Hip09 162100801 erratum support" + default y + help + When enabled GICv4.1 in hip09, there are some invalid vPE config + in configuration tables for some situation, which will cause vSGI + interrupts lost. So fix it by sending vinvall commands after vmovp. + + If unsure, say Y. + + config QCOM_FALKOR_ERRATUM_1003 bool "Falkor E1003: Incorrect translation due to ASID change" default y diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 8261f11b54fd..1b633c835279 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -390,6 +390,7 @@ CONFIG_QCOM_FALKOR_ERRATUM_E1041=y CONFIG_SOCIONEXT_SYNQUACER_PREITS=y CONFIG_HISILICON_ERRATUM_HIP08_RU_PREFETCH=y # CONFIG_HISILICON_HIP08_RU_PREFETCH_DEFAULT_OFF is not set +CONFIG_HISILICON_ERRATUM_162100801=y # end of ARM errata workarounds via the alternatives framework CONFIG_ARM64_4K_PAGES=y diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c index 99fcc5601ea4..db8219d65e7c 100644 --- a/drivers/irqchip/irq-gic-v3-its.c +++ b/drivers/irqchip/irq-gic-v3-its.c @@ -46,6 +46,7 @@ #define ITS_FLAGS_CMDQ_NEEDS_FLUSHING (1ULL << 0) #define ITS_FLAGS_WORKAROUND_CAVIUM_22375 (1ULL << 1) #define ITS_FLAGS_WORKAROUND_CAVIUM_23144 (1ULL << 2) +#define ITS_FLAGS_WORKAROUND_HISILICON_162100801 (1ULL << 3) #define RDIST_FLAGS_PROPBASE_NEEDS_FLUSHING (1 << 0) #define RDIST_FLAGS_RD_TABLES_PREALLOCATED (1 << 1) @@ -1294,6 +1295,14 @@ static void its_send_vmapp(struct its_node *its, its_send_single_vcommand(its, its_build_vmapp_cmd, &desc); } +static void its_send_vinvall(struct its_node *its, struct its_vpe *vpe) +{ + struct its_cmd_desc desc; + + desc.its_vinvall_cmd.vpe = vpe; + its_send_single_vcommand(its, its_build_vinvall_cmd, &desc); +} + static void its_send_vmovp(struct its_vpe *vpe) { struct its_cmd_desc desc = {}; @@ -1307,6 +1316,10 @@ static void its_send_vmovp(struct its_vpe *vpe) its = list_first_entry(&its_nodes, struct its_node, entry); desc.its_vmovp_cmd.col = &its->collections[col_id]; its_send_single_vcommand(its, its_build_vmovp_cmd, &desc); + if (is_v4_1(its) && (its->flags & + ITS_FLAGS_WORKAROUND_HISILICON_162100801)) + its_send_vinvall(its, vpe); + return; } @@ -1333,19 +1346,14 @@ static void its_send_vmovp(struct its_vpe *vpe) desc.its_vmovp_cmd.col = &its->collections[col_id]; its_send_single_vcommand(its, its_build_vmovp_cmd, &desc); + if (is_v4_1(its) && (its->flags & + ITS_FLAGS_WORKAROUND_HISILICON_162100801)) + its_send_vinvall(its, vpe); } raw_spin_unlock_irqrestore(&vmovp_lock, flags); } -static void its_send_vinvall(struct its_node *its, struct its_vpe *vpe) -{ - struct its_cmd_desc desc; - - desc.its_vinvall_cmd.vpe = vpe; - its_send_single_vcommand(its, its_build_vinvall_cmd, &desc); -} - static void its_send_vinv(struct its_device *dev, u32 event_id) { struct its_cmd_desc desc; @@ -4963,6 +4971,14 @@ static bool __maybe_unused its_enable_quirk_hip07_161600802(void *data) return true; } +static bool __maybe_unused its_enable_quirk_hip09_162100801(void *data) +{ + struct its_node *its = data; + + its->flags |= ITS_FLAGS_WORKAROUND_HISILICON_162100801; + return true; +} + static const struct gic_quirk its_quirks[] = { #ifdef CONFIG_CAVIUM_ERRATUM_22375 { @@ -5008,6 +5024,14 @@ static const struct gic_quirk its_quirks[] = { .mask = 0xffffffff, .init = its_enable_quirk_hip07_161600802, }, +#endif +#ifdef CONFIG_HISILICON_ERRATUM_162100801 + { + .desc = "ITS: Hip09 erratum 162100801", + .iidr = 0x00051736, + .mask = 0xffffffff, + .init = its_enable_quirk_hip09_162100801, + }, #endif { } -- 2.30.0

1 0

Re: [PATCH v2 OLK-5.10 4/6] mm: swap_slots: add per-type slot cache
by Liu Shixin 12 Jun '23

12 Jun '23

On 2023/6/12 9:58, Kefeng Wang wrote: > 之前的问题，底噪增加了多少静态和运行态 > > On 2023/6/10 18:07, Liu Shixin wrote: >> +static DEFINE_PER_CPU(struct swap_slots_cache [MAX_SWAPFILES], swp_type_slots); > . > 一个swap_slots_cache是80字节，MAX_SWAPFILES是32，按128核算，增长就是320K(80*32*128)。每个swap_slots_cache里会挂128个swp_entry，每个8字节，MAX_SWAPFILES是32，按128核算，增长就是4M(128*8*32*128)。这个swp_entry如果动态申请，每增加一个swap设备，就增长128K。

1 0

[PATCH openEuler-1.0-LTS] media: dvb-core: Fix kernel WARNING for blocking operation in wait_event*()
by Yongqiang Liu 12 Jun '23

12 Jun '23

From: Takashi Iwai <tiwai(a)suse.de> mainline inclusion from mainline-v6.4-rc3 commit b8c75e4a1b325ea0a9433fa8834be97b5836b946 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6YKXB CVE: CVE-2023-31084 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Using a semaphore in the wait_event*() condition is no good idea. It hits a kernel WARN_ON() at prepare_to_wait_event() like: do not call blocking ops when !TASK_RUNNING; state=1 set at prepare_to_wait_event+0x6d/0x690 For avoiding the potential deadlock, rewrite to an open-coded loop instead. Unlike the loop in wait_event*(), this uses wait_woken() after the condition check, hence the task state stays consistent. CVE-2023-31084 was assigned to this bug. Link: https://lore.kernel.org/r/CA+UBctCu7fXn4q41O_3=id1+OdyQ85tZY1x+TkT-6OVBL6KA… Link: https://lore.kernel.org/linux-media/20230512151800.1874-1-tiwai@suse.de Reported-by: Yu Hao <yhao016(a)ucr.edu> Closes: https://nvd.nist.gov/vuln/detail/CVE-2023-31084 Signed-off-by: Takashi Iwai <tiwai(a)suse.de> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: Chen Jiahao <chenjiahao16(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Liao Chang <liaochang1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/media/dvb-core/dvb_frontend.c | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c index 8a61150ee249..3a0c794f7b80 100644 --- a/drivers/media/dvb-core/dvb_frontend.c +++ b/drivers/media/dvb-core/dvb_frontend.c @@ -304,14 +304,22 @@ static int dvb_frontend_get_event(struct dvb_frontend *fe, } if (events->eventw == events->eventr) { - int ret; + struct wait_queue_entry wait; + int ret = 0; if (flags & O_NONBLOCK) return -EWOULDBLOCK; - ret = wait_event_interruptible(events->wait_queue, - dvb_frontend_test_event(fepriv, events)); - + init_waitqueue_entry(&wait, current); + add_wait_queue(&events->wait_queue, &wait); + while (!dvb_frontend_test_event(fepriv, events)) { + wait_woken(&wait, TASK_INTERRUPTIBLE, 0); + if (signal_pending(current)) { + ret = -ERESTARTSYS; + break; + } + } + remove_wait_queue(&events->wait_queue, &wait); if (ret < 0) return ret; } -- 2.25.1

1 0

[PATCH openEuler-22.03-LTS-SP2 0/9] some backport bugfix for sockmap
by Liu Jian 11 Jun '23

11 Jun '23

some backport bugfix for sockmap Cong Wang (1): bpf, sock_map: Move cancel_work_sync() out of sock lock Eric Dumazet (1): net: deal with most data-races in sk_wait_event() Jakub Sitnicki (2): bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself Pengcheng Yang (3): bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data bpf, sockmap: Fix missing BPF_F_INGRESS flag when using apply_bytes bpf, sockmap: Fix data loss caused by using apply_bytes on ingress redirect Wang Yufen (1): bpf, sockmap: Fix the sk->sk_forward_alloc warning of sk_stream_kill_queues zhangmingyi (1): bpf: fix bpf_tcp_ingress addr use after free include/linux/skmsg.h | 3 +- include/linux/util_macros.h | 12 ++++++++ include/net/tcp.h | 4 +-- net/core/skmsg.c | 16 +++++----- net/core/sock_map.c | 60 +++++++++++++++++++++---------------- net/core/stream.c | 12 ++++---- net/ipv4/tcp_bpf.c | 36 +++++++++++++--------- net/llc/af_llc.c | 8 +++-- net/smc/smc_close.c | 4 +-- net/smc/smc_rx.c | 4 +-- net/smc/smc_tx.c | 4 +-- net/tipc/socket.c | 4 +-- net/tls/tls_main.c | 3 +- net/tls/tls_sw.c | 6 ++-- 14 files changed, 105 insertions(+), 71 deletions(-) -- 2.34.1

1 9

[PATCH OLK-5.10 0/6] Per-memcg swap control
by Liu Shixin 10 Jun '23

10 Jun '23

This series patches add swap control for memory cgroup. Patch[1] add page type in memory.reclaim interface to support reclaim anon pages. Patch[2] add memory.force_swapin interface to support swap back pages proactively. Patch[3-5] add memory.swapfile interface to limit available swap device for memory cgroup. Patch[6] add memory.swap.max interface to limit usage of swap for memory cgroup. Liu Shixin (6): memcg: add page type to memory.reclaim interface memcg: introduce per-memcg swapin interface mm/swapfile: introduce per-memcg swapfile control mm: swap_slots: add per-type slot cache mm: swap_slots: allocate per-type slot cache when online swap device memcg: add restrict to swap to cgroup1 .../admin-guide/cgroup-v1/memory.rst | 2 + Documentation/admin-guide/cgroup-v2.rst | 9 +- include/linux/memcontrol.h | 27 ++ include/linux/mm.h | 1 + include/linux/swap.h | 10 +- include/linux/swap_slots.h | 2 +- mm/Kconfig | 8 + mm/madvise.c | 19 ++ mm/memcontrol.c | 297 +++++++++++++++++- mm/swap_slots.c | 136 +++++++- mm/swapfile.c | 88 +++++- mm/vmscan.c | 17 + 12 files changed, 590 insertions(+), 26 deletions(-) -- 2.25.1

2 7

[PATCH OLK-5.10 1/6] memcg: add page type to memory.reclaim interface
by Liu Shixin 10 Jun '23

10 Jun '23

Add anon/file to memory.reclaim interface to limit only reclaim one type pages. The lru algorithm can reclaim cold pages and balance between file and anon. But it didn't consider the speed of backend device. For example, if there is zram device, reclaim anon pages might has less impact on performance. So extend memory.reclaim interface to reclaim one type pages. Usage: "echo <size> type=anon > memory.reclaim" "echo <size> type=file > memory.reclaim" Also compatible with the previous format. Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- Documentation/admin-guide/cgroup-v2.rst | 9 ++++--- include/linux/swap.h | 4 +++ mm/memcontrol.c | 36 ++++++++++++++++++++++--- mm/vmscan.c | 17 ++++++++++++ 4 files changed, 59 insertions(+), 7 deletions(-) diff --git a/Documentation/admin-guide/cgroup-v2.rst b/Documentation/admin-guide/cgroup-v2.rst index 5d9b7e552fb0..a04ca490f58c 100644 --- a/Documentation/admin-guide/cgroup-v2.rst +++ b/Documentation/admin-guide/cgroup-v2.rst @@ -1196,15 +1196,16 @@ PAGE_SIZE multiple when read back. target cgroup. This file accepts a single key, the number of bytes to reclaim. - No nested keys are currently supported. Example:: echo "1G" > memory.reclaim - The interface can be later extended with nested keys to - configure the reclaim behavior. For example, specify the - type of memory to reclaim from (anon, file, ..). + This file also accepts nested keys, the number of bytes to reclaim + with the type of memory to reclaim. + + Example:: + echo "1G type=file" > memory.reclaim Please note that the kernel can over or under reclaim from the target cgroup. If less bytes are reclaimed than the diff --git a/include/linux/swap.h b/include/linux/swap.h index 7f49964f27d2..b98b4c9df622 100644 --- a/include/linux/swap.h +++ b/include/linux/swap.h @@ -380,6 +380,10 @@ extern unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *memcg, unsigned long nr_pages, gfp_t gfp_mask, bool may_swap); +extern unsigned long __try_to_free_mem_cgroup_pages(struct mem_cgroup *memcg, + unsigned long nr_pages, + gfp_t gfp_mask, + bool may_swap, bool only_swap); extern unsigned long mem_cgroup_shrink_node(struct mem_cgroup *mem, gfp_t gfp_mask, bool noswap, pg_data_t *pgdat, diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 662c7859b7f1..8f796b651baa 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -5263,16 +5263,46 @@ static int memcg_events_local_show(struct seq_file *m, void *v) return 0; } +static int reclaim_param_parse(char *buf, unsigned long *nr_pages, + bool *anon, bool *file) +{ + char *endp; + u64 bytes; + + if (!strcmp(buf, "")) { + *nr_pages = PAGE_COUNTER_MAX; + return 0; + } + + bytes = memparse(buf, &endp); + if (*endp == ' ') { + buf = endp + 1; + buf = strim(buf); + if (!strcmp(buf, "type=anon")) + *file = false; + else if (!strcmp(buf, "type=file")) + *anon = false; + else + return -EINVAL; + } else if (*endp != '\0') + return -EINVAL; + + *nr_pages = min(bytes / PAGE_SIZE, (u64)PAGE_COUNTER_MAX); + + return 0; +} + static ssize_t memory_reclaim(struct kernfs_open_file *of, char *buf, size_t nbytes, loff_t off) { struct mem_cgroup *memcg = mem_cgroup_from_css(of_css(of)); unsigned int nr_retries = MAX_RECLAIM_RETRIES; unsigned long nr_to_reclaim, nr_reclaimed = 0; + bool anon = true, file = true; int err; buf = strstrip(buf); - err = page_counter_memparse(buf, "", &nr_to_reclaim); + err = reclaim_param_parse(buf, &nr_to_reclaim, &anon, &file); if (err) return err; @@ -5293,9 +5323,9 @@ static ssize_t memory_reclaim(struct kernfs_open_file *of, char *buf, if (!nr_retries) lru_add_drain_all(); - reclaimed = try_to_free_mem_cgroup_pages(memcg, + reclaimed = __try_to_free_mem_cgroup_pages(memcg, nr_to_reclaim - nr_reclaimed, - GFP_KERNEL, true); + GFP_KERNEL, anon, !file); if (!reclaimed && !nr_retries--) return -EAGAIN; diff --git a/mm/vmscan.c b/mm/vmscan.c index a8412c5d4eda..2fce47af0e83 100644 --- a/mm/vmscan.c +++ b/mm/vmscan.c @@ -102,6 +102,8 @@ struct scan_control { /* Can pages be swapped as part of reclaim? */ unsigned int may_swap:1; + /* Only swap anon pages */ + unsigned int only_swap:1; /* * Cgroup memory below memory.low is protected as long as we @@ -2461,6 +2463,11 @@ static void get_scan_count(struct lruvec *lruvec, struct scan_control *sc, unsigned long ap, fp; enum lru_list lru; + if (sc->only_swap) { + scan_balance = SCAN_ANON; + goto out; + } + /* If we have no swap space, do not bother scanning anon pages. */ if (!sc->may_swap || mem_cgroup_get_nr_swap_pages(memcg) <= 0) { scan_balance = SCAN_FILE; @@ -3563,6 +3570,15 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *memcg, unsigned long nr_pages, gfp_t gfp_mask, bool may_swap) +{ + return __try_to_free_mem_cgroup_pages(memcg, nr_pages, gfp_mask, + may_swap, false); +} + +unsigned long __try_to_free_mem_cgroup_pages(struct mem_cgroup *memcg, + unsigned long nr_pages, + gfp_t gfp_mask, + bool may_swap, bool only_swap) { unsigned long nr_reclaimed; unsigned int noreclaim_flag; @@ -3576,6 +3592,7 @@ unsigned long try_to_free_mem_cgroup_pages(struct mem_cgroup *memcg, .may_writepage = !laptop_mode, .may_unmap = 1, .may_swap = may_swap, + .only_swap = only_swap, }; /* * Traverse the ZONELIST_FALLBACK zonelist of the current node to put -- 2.25.1

1 5

[PATCH OLK-5.10 0/6] Per-memcg swap control
by Liu Shixin 10 Jun '23

10 Jun '23

This series patches add swap control for memory cgroup. Patch[1] add page type in memory.reclaim interface to support reclaim anon pages. Patch[2] add memory.force_swapin interface to support swap back pages proactively. Patch[3-5] add memory.swapfile interface to limit available swap device for memory cgroup. Patch[6] add memory.swap.max interface to limit usage of swap for memory cgroup. Liu Shixin (6): memcg: add page type to memory.reclaim interface memcg: introduce per-memcg swapin interface mm/swapfile: introduce per-memcg swapfile control mm: swap_slots: add per-type slot cache mm: swap_slots: allocate per-type slot cache when online swap device memcg: add restrict to swap to cgroup1 .../admin-guide/cgroup-v1/memory.rst | 2 + Documentation/admin-guide/cgroup-v2.rst | 9 +- include/linux/memcontrol.h | 27 ++ include/linux/mm.h | 1 + include/linux/swap.h | 10 +- include/linux/swap_slots.h | 2 +- mm/Kconfig | 8 + mm/madvise.c | 19 ++ mm/memcontrol.c | 297 +++++++++++++++++- mm/swap_slots.c | 136 +++++++- mm/swapfile.c | 88 +++++- mm/vmscan.c | 17 + 12 files changed, 590 insertions(+), 26 deletions(-) -- 2.25.1

2 7

[PATCH OLK-5.10 00/18] A series of CVE fix patches and related
by ZhaoLong Wang 10 Jun '23

10 Jun '23

CVE fixes: CVE-2023-32255 CVE-2023-32248 CVE-2023-32250 CVE-2023-32252 CVE-2023-32257 CVE-2023-32247 CVE-2023-32251 CVE-2023-32253 CVE-2023-32249 CVE-2023-32254 CVE-2023-32246 CVE-2023-32256 CVE-2023-32258 Chih-Yen Chang (3): ksmbd: fix wrong UserName check in session_user ksmbd: allocate one more byte for implied bcc[0] ksmbd: fix global-out-of-bounds in smb2_find_context_vals Colin Ian King (1): ksmbd: Fix spelling mistake "excceed" -> "exceeded" Dawei Li (1): ksmbd: Implements sess->ksmbd_chann_list as xarray Gustav Johansson (1): ksmbd: smb2: Allow messages padded to 8byte boundary Namjae Jeon (12): ksmbd: fix memleak in session setup ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem() ksmbd: limit pdu length size according to connection status ksmbd: fix racy issue from session setup and logoff ksmbd: destroy expired sessions ksmbd: block asynchronous requests when making a delay on session setup ksmbd: fix deadlock in ksmbd_find_crypto_ctx() ksmbd: not allow guest user on multichannel ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix racy issue from smb2 close and logoff with multichannel ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length fs/ksmbd/auth.c | 19 ++-- fs/ksmbd/connection.c | 84 +++++++++++++----- fs/ksmbd/connection.h | 58 +++++++++---- fs/ksmbd/mgmt/tree_connect.c | 13 ++- fs/ksmbd/mgmt/tree_connect.h | 3 + fs/ksmbd/mgmt/user_session.c | 138 ++++++++++++++++------------- fs/ksmbd/mgmt/user_session.h | 5 +- fs/ksmbd/oplock.c | 5 +- fs/ksmbd/oplock.h | 2 +- fs/ksmbd/server.c | 4 +- fs/ksmbd/smb2misc.c | 24 +++--- fs/ksmbd/smb2pdu.c | 162 +++++++++++++++++++---------------- fs/ksmbd/smb2pdu.h | 7 +- fs/ksmbd/transport_tcp.c | 2 +- 14 files changed, 322 insertions(+), 204 deletions(-) -- 2.31.1

2 19

[PATCH 00/18] kambd: A series of CVE fix patches and related
by ZhaoLong Wang 10 Jun '23

10 Jun '23

CVE fixes: CVE-2023-32255 CVE-2023-32248 CVE-2023-32250 CVE-2023-32252 CVE-2023-32257 CVE-2023-32247 CVE-2023-32251 CVE-2023-32253 CVE-2023-32249 CVE-2023-32254 CVE-2023-32246 CVE-2023-32256 CVE-2023-32258 CVE-2023-2593 Chih-Yen Chang (3): ksmbd: fix wrong UserName check in session_user ksmbd: allocate one more byte for implied bcc[0] ksmbd: fix global-out-of-bounds in smb2_find_context_vals Colin Ian King (1): ksmbd: Fix spelling mistake "excceed" -> "exceeded" Dawei Li (1): ksmbd: Implements sess->ksmbd_chann_list as xarray Gustav Johansson (1): ksmbd: smb2: Allow messages padded to 8byte boundary Namjae Jeon (12): ksmbd: fix memleak in session setup ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem() ksmbd: limit pdu length size according to connection status ksmbd: fix racy issue from session setup and logoff ksmbd: destroy expired sessions ksmbd: block asynchronous requests when making a delay on session setup ksmbd: fix deadlock in ksmbd_find_crypto_ctx() ksmbd: not allow guest user on multichannel ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix racy issue from smb2 close and logoff with multichannel ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length fs/ksmbd/auth.c | 19 ++-- fs/ksmbd/connection.c | 84 +++++++++++++----- fs/ksmbd/connection.h | 58 +++++++++---- fs/ksmbd/mgmt/tree_connect.c | 13 ++- fs/ksmbd/mgmt/tree_connect.h | 3 + fs/ksmbd/mgmt/user_session.c | 138 ++++++++++++++++------------- fs/ksmbd/mgmt/user_session.h | 5 +- fs/ksmbd/oplock.c | 5 +- fs/ksmbd/oplock.h | 2 +- fs/ksmbd/server.c | 4 +- fs/ksmbd/smb2misc.c | 24 +++--- fs/ksmbd/smb2pdu.c | 162 +++++++++++++++++++---------------- fs/ksmbd/smb2pdu.h | 7 +- fs/ksmbd/transport_tcp.c | 2 +- 14 files changed, 322 insertions(+), 204 deletions(-) -- 2.31.1

1 18

[PATCH 00/18] kambd: A series of CVE fix patches and related
by ZhaoLong Wang 10 Jun '23

10 Jun '23

CVE fixes: CVE-2023-32255 CVE-2023-32248 CVE-2023-32250 CVE-2023-32252 CVE-2023-32257 CVE-2023-32247 CVE-2023-32251 CVE-2023-32253 CVE-2023-32249 CVE-2023-32254 CVE-2023-32246 CVE-2023-32256 CVE-2023-32258 CVE-2023-2593 Chih-Yen Chang (3): ksmbd: fix wrong UserName check in session_user ksmbd: allocate one more byte for implied bcc[0] ksmbd: fix global-out-of-bounds in smb2_find_context_vals Colin Ian King (1): ksmbd: Fix spelling mistake "excceed" -> "exceeded" Dawei Li (1): ksmbd: Implements sess->ksmbd_chann_list as xarray Gustav Johansson (1): ksmbd: smb2: Allow messages padded to 8byte boundary Namjae Jeon (12): ksmbd: fix memleak in session setup ksmbd: fix NULL pointer dereference in smb2_get_info_filesystem() ksmbd: limit pdu length size according to connection status ksmbd: fix racy issue from session setup and logoff ksmbd: destroy expired sessions ksmbd: block asynchronous requests when making a delay on session setup ksmbd: fix deadlock in ksmbd_find_crypto_ctx() ksmbd: not allow guest user on multichannel ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix racy issue from smb2 close and logoff with multichannel ksmbd: do not allow the actual frame length to be smaller than the rfc1002 length fs/ksmbd/auth.c | 19 ++-- fs/ksmbd/connection.c | 84 +++++++++++++----- fs/ksmbd/connection.h | 58 +++++++++---- fs/ksmbd/mgmt/tree_connect.c | 13 ++- fs/ksmbd/mgmt/tree_connect.h | 3 + fs/ksmbd/mgmt/user_session.c | 138 ++++++++++++++++------------- fs/ksmbd/mgmt/user_session.h | 5 +- fs/ksmbd/oplock.c | 5 +- fs/ksmbd/oplock.h | 2 +- fs/ksmbd/server.c | 4 +- fs/ksmbd/smb2misc.c | 24 +++--- fs/ksmbd/smb2pdu.c | 162 +++++++++++++++++++---------------- fs/ksmbd/smb2pdu.h | 7 +- fs/ksmbd/transport_tcp.c | 2 +- 14 files changed, 322 insertions(+), 204 deletions(-) -- 2.31.1

1 18