- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6] HID: core: Harden s32ton() against conversion to 0 bits
by Wang Wensheng 02 Feb '26

02 Feb '26

From: Alan Stern <stern(a)rowland.harvard.edu> mainline inclusion from mainline-v6.17-rc1 commit a6b87bfc2ab5bccb7ad953693c85d9062aef3fdd category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/9186 CVE: CVE-2025-38556 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Testing by the syzbot fuzzer showed that the HID core gets a shift-out-of-bounds exception when it tries to convert a 32-bit quantity to a 0-bit quantity. Ideally this should never occur, but there are buggy devices and some might have a report field with size set to zero; we shouldn't reject the report or the device just because of that. Instead, harden the s32ton() routine so that it returns a reasonable result instead of crashing when it is called with the number of bits set to 0 -- the same as what snto32() does. Signed-off-by: Alan Stern <stern(a)rowland.harvard.edu> Reported-by: syzbot+b63d677d63bcac06cf90(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-usb/68753a08.050a0220.33d347.0008.GAE@google.… Tested-by: syzbot+b63d677d63bcac06cf90(a)syzkaller.appspotmail.com Fixes: dde5845a529f ("[PATCH] Generic HID layer - code split") Cc: stable(a)vger.kernel.org Link: https://patch.msgid.link/613a66cd-4309-4bce-a4f7-2905f9bce0c9@rowland.harva… Signed-off-by: Benjamin Tissoires <bentiss(a)kernel.org> Conflicts: drivers/hid/hid-core.c [Only context conflict because of commit c653ffc283404 is not applied] Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- drivers/hid/hid-core.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index 266cd56dec50..d8fda282d049 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -1351,7 +1351,12 @@ EXPORT_SYMBOL_GPL(hid_snto32); static u32 s32ton(__s32 value, unsigned n) { - s32 a = value >> (n - 1); + s32 a; + + if (!value || !n) + return 0; + + a = value >> (n - 1); if (a && a != -1) return value < 0 ? 1 << (n - 1) : (1 << (n - 1)) - 1; return value & ((1 << n) - 1); -- 2.22.0

2 1

[PATCH OLK-6.6] iommu: Fix two issues in iommu_copy_struct_from_user()
by Wang Wensheng 02 Feb '26

02 Feb '26

From: Nicolin Chen <nicolinc(a)nvidia.com> mainline inclusion from mainline-v6.15-rc5 commit 30a3f2f3e4bd6335b727c83c08a982d969752bc1 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/10084 CVE: CVE-2025-37900 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In the review for iommu_copy_struct_to_user() helper, Matt pointed out that a NULL pointer should be rejected prior to dereferencing it: https://lore.kernel.org/all/86881827-8E2D-461C-BDA3-FA8FD14C343C@nvidia.com And Alok pointed out a typo at the same time: https://lore.kernel.org/all/480536af-6830-43ce-a327-adbd13dc3f1d@oracle.com Since both issues were copied from iommu_copy_struct_from_user(), fix them first in the current header. Fixes: e9d36c07bb78 ("iommu: Add iommu_copy_struct_from_user helper") Cc: stable(a)vger.kernel.org Signed-off-by: Nicolin Chen <nicolinc(a)nvidia.com> Reviewed-by: Kevin Tian <kevin.tian(a)intel.com> Acked-by: Alok Tiwari <alok.a.tiwari(a)oracle.com> Reviewed-by: Matthew R. Ochs <mochs(a)nvidia.com> Link: https://lore.kernel.org/r/20250414191635.450472-1-nicolinc@nvidia.com Signed-off-by: Joerg Roedel <jroedel(a)suse.de> Signed-off-by: Wang Wensheng <wangwensheng4(a)huawei.com> --- include/linux/iommu.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/include/linux/iommu.h b/include/linux/iommu.h index ceecbc5ba759..974c3b94365f 100644 --- a/include/linux/iommu.h +++ b/include/linux/iommu.h @@ -517,10 +517,10 @@ static inline int __iommu_copy_struct_from_user( void *dst_data, const struct iommu_user_data *src_data, unsigned int data_type, size_t data_len, size_t min_len) { - if (src_data->type != data_type) - return -EINVAL; if (WARN_ON(!dst_data || !src_data)) return -EINVAL; + if (src_data->type != data_type) + return -EINVAL; if (src_data->len < min_len || data_len < src_data->len) return -EINVAL; return copy_struct_from_user(dst_data, data_len, src_data->uptr, @@ -533,8 +533,8 @@ static inline int __iommu_copy_struct_from_user( * include/uapi/linux/iommufd.h * @user_data: Pointer to a struct iommu_user_data for user space data info * @data_type: The data type of the @kdst. Must match with @user_data->type - * @min_last: The last memember of the data structure @kdst points in the - * initial version. + * @min_last: The last member of the data structure @kdst points in the initial + * version. * Return 0 for success, otherwise -error. */ #define iommu_copy_struct_from_user(kdst, user_data, data_type, min_last) \ -- 2.22.0

2 1

[PATCH OLK-6.6] scsi: leapraid: add RAID disk hide/show events and fix misc issues
by haodongdong 02 Feb '26

02 Feb '26

LeapIO inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8462 ------------------------------------------ This change introduces RAID disk hide/show events to allow dynamic visibility control of RAID devices. It also updates the MSI-X vector count retrieval logic and unifies driver naming from LeapRaid to LeapRAID for consistency. In addition, fix an issue where the fw_log workqueue was not properly released during system shutdown, which could lead to resource leaks. Signed-off-by: haodongdong <doubled(a)leap-io.com> --- drivers/scsi/leapraid/leapraid.h | 2 + drivers/scsi/leapraid/leapraid_func.c | 104 ++++++++++++++++++++++---- drivers/scsi/leapraid/leapraid_func.h | 47 ++++++------ drivers/scsi/leapraid/leapraid_os.c | 2 +- 4 files changed, 116 insertions(+), 39 deletions(-) diff --git a/drivers/scsi/leapraid/leapraid.h b/drivers/scsi/leapraid/leapraid.h index 842810d41542..77bb93b79254 100644 --- a/drivers/scsi/leapraid/leapraid.h +++ b/drivers/scsi/leapraid/leapraid.h @@ -310,6 +310,8 @@ #define LEAPRAID_EVT_IR_RC_PD_UNHIDDEN_TO_DELETE 0x04 #define LEAPRAID_EVT_IR_RC_PD_CREATED_TO_HIDE 0x05 #define LEAPRAID_EVT_IR_RC_PD_DELETED_TO_EXPOSE 0x06 +#define LEAPRAID_EVT_IR_RC_VOLUME_HIDE 0x0A +#define LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE 0x0B /* sas topology change event */ #define LEAPRAID_EVT_SAS_TOPO_ES_NO_EXPANDER 0x00 diff --git a/drivers/scsi/leapraid/leapraid_func.c b/drivers/scsi/leapraid/leapraid_func.c index 2fc142fff982..ad8aee40e2c1 100644 --- a/drivers/scsi/leapraid/leapraid_func.c +++ b/drivers/scsi/leapraid/leapraid_func.c @@ -4132,6 +4132,66 @@ static void leapraid_sas_pd_expose( } } +static void leapraid_sas_vol_visibility(struct leapraid_adapter *adapter, + struct leapraid_evt_data_ir_change *evt_data) +{ + struct leapraid_raid_volume *raid_volume = NULL; + struct scsi_device *sdev = NULL; + u16 hdl = 0; + unsigned long flags; + u8 rc = 0; + u8 reprobe_flg = 0; + + hdl = le16_to_cpu(evt_data->vol_dev_hdl); + rc = evt_data->reason_code; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); + if (!raid_volume) { + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + dev_warn(&adapter->pdev->dev, + "%s:%d: volume handle 0x%x not found\n", + __func__, __LINE__, hdl); + return; + } + + reprobe_flg = 0; + sdev = raid_volume->sdev; + if (sdev) { + if (sdev->no_uld_attach) { + if (rc == LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE) { + sdev->no_uld_attach = 0; + reprobe_flg = 1; + } + } else { + if (rc == LEAPRAID_EVT_IR_RC_VOLUME_HIDE) { + sdev->no_uld_attach = 1; + reprobe_flg = 1; + } + } + + if (reprobe_flg) { + if (sdev->no_uld_attach) + sdev_printk(KERN_INFO, sdev, "hide vol\n"); + else + sdev_printk(KERN_INFO, sdev, "unhide vol\n"); + + WARN_ON(scsi_device_reprobe(sdev)); + } else { + dev_warn(&adapter->pdev->dev, + "%s:rc(0x%x):request matches, skipping.\n", + __func__, rc); + } + + } else { + dev_warn(&adapter->pdev->dev, + "%s:%d: volume handle 0x%x has no sdev\n", + __func__, __LINE__, hdl); + } + + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); +} + static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { @@ -4250,6 +4310,10 @@ static void leapraid_sas_ir_chg_evt(struct leapraid_adapter *adapter, case LEAPRAID_EVT_IR_RC_PD_DELETED_TO_EXPOSE: leapraid_sas_pd_expose(adapter, evt_data); break; + case LEAPRAID_EVT_IR_RC_VOLUME_HIDE: + case LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE: + leapraid_sas_vol_visibility(adapter, evt_data); + break; default: break; } @@ -6397,6 +6461,8 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) le16_to_cpu(leap_mpi_rep.hp_slot); adapter->adapter_attr.features.adapter_caps = le32_to_cpu(leap_mpi_rep.adapter_caps); + adapter->adapter_attr.features.max_msix_vectors = + leap_mpi_rep.max_msix_vectors; adapter->adapter_attr.features.max_volumes = leap_mpi_rep.max_volumes; if (!adapter->adapter_attr.features.max_volumes) @@ -6754,11 +6820,15 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) goto legacy_int; msix_cnt = leapraid_msix_cnt(adapter->pdev); - if (msix_cnt <= 0) { + if (msix_cnt <= 0 || + adapter->adapter_attr.features.max_msix_vectors == 0) { dev_info(&adapter->pdev->dev, "msix unsupported!\n"); goto legacy_int; } + msix_cnt = min_t(int, msix_cnt, + adapter->adapter_attr.features.max_msix_vectors); + if (reset_devices) adapter->adapter_attr.rq_cnt = 1; else @@ -6859,11 +6929,15 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) goto legacy_int1; msi_cnt = leapraid_msi_cnt(adapter->pdev); - if (msi_cnt <= 0) { - dev_info(&adapter->pdev->dev, "msix unsupported!\n"); + if (msi_cnt <= 0 || + adapter->adapter_attr.features.max_msix_vectors == 0) { + dev_info(&adapter->pdev->dev, "msi unsupported!\n"); goto legacy_int1; } + msi_cnt = min_t(int, msi_cnt, + adapter->adapter_attr.features.max_msix_vectors); + if (reset_devices) adapter->adapter_attr.rq_cnt = 1; else @@ -7015,6 +7089,18 @@ int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) leapraid_mask_int(adapter); + rc = leapraid_make_adapter_ready(adapter, PART_RESET); + if (rc) { + dev_err(&adapter->pdev->dev, "make adapter ready failure\n"); + goto out_fail; + } + + rc = leapraid_get_adapter_features(adapter); + if (rc) { + dev_err(&adapter->pdev->dev, "get adapter feature failure\n"); + goto out_fail; + } + rc = leapraid_set_notification(adapter); if (rc) goto out_fail; @@ -8185,18 +8271,6 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) PCI_EXP_DEVCTL_EXT_TAG); } - rc = leapraid_make_adapter_ready(adapter, PART_RESET); - if (rc) { - dev_err(&adapter->pdev->dev, "make adapter ready failure\n"); - goto out_free_resources; - } - - rc = leapraid_get_adapter_features(adapter); - if (rc) { - dev_err(&adapter->pdev->dev, "get adapter feature failure\n"); - goto out_free_resources; - } - rc = leapraid_fw_log_init(adapter); if (rc) { dev_err(&adapter->pdev->dev, "fw log init failure\n"); diff --git a/drivers/scsi/leapraid/leapraid_func.h b/drivers/scsi/leapraid/leapraid_func.h index 2c51ef359b7e..f7072d078315 100644 --- a/drivers/scsi/leapraid/leapraid_func.h +++ b/drivers/scsi/leapraid/leapraid_func.h @@ -46,15 +46,15 @@ #define LEAPRAID_SYS_LOG_BUF_RESERVE 0x1000 /* Driver version and name */ -#define LEAPRAID_DRIVER_NAME "LeapRaid" +#define LEAPRAID_DRIVER_NAME "LeapRAID" #define LEAPRAID_NAME_LENGTH 48 #define LEAPRAID_AUTHOR "LeapIO Inc." -#define LEAPRAID_DESCRIPTION "LeapRaid Driver" -#define LEAPRAID_DRIVER_VERSION "2.00.00.05" +#define LEAPRAID_DESCRIPTION "LeapRAID Driver" +#define LEAPRAID_DRIVER_VERSION "2.00.00.06" #define LEAPRAID_MAJOR_VERSION 2 #define LEAPRAID_MINOR_VERSION 00 #define LEAPRAID_BUILD_VERSION 00 -#define LEAPRAID_RELEASE_VERSION 05 +#define LEAPRAID_RELEASE_VERSION 06 /* Device ID */ #define LEAPRAID_VENDOR_ID 0xD405 @@ -243,6 +243,7 @@ struct leapraid_adapter_features { u16 hp_slot; u32 adapter_caps; u32 fw_version; + u8 max_msix_vectors; u8 max_volumes; u16 max_dev_handle; u16 min_dev_handle; @@ -349,7 +350,7 @@ struct leapraid_rep_desc_seg_maint { }; /** - * struct leapraid_mem_desc - Memory descriptor for LeapRaid adapter + * struct leapraid_mem_desc - Memory descriptor for LeapRAID adapter * * @task_desc: Pointer to task descriptor * @task_desc_dma: DMA address of task descriptor @@ -395,7 +396,7 @@ struct leapraid_mem_desc { #define LEAPRAID_CMD_RESET 0x0008 /** - * enum LEAPRAID_CB_INDEX - Callback index for LeapRaid driver + * enum LEAPRAID_CB_INDEX - Callback index for LeapRAID driver * * @LEAPRAID_SCAN_DEV_CB_IDX: Scan device callback index * @LEAPRAID_CONFIG_CB_IDX: Configuration callback index @@ -513,7 +514,7 @@ struct leapraid_dynamic_task_desc { * struct leapraid_fw_evt_work - Firmware event work structure * * @list: Linked list node for queuing the work - * @adapter: Pointer to the associated LeapRaid adapter + * @adapter: Pointer to the associated LeapRAID adapter * @work: Work structure used by the kernel workqueue * @refcnt: Reference counter for managing the lifetime of this work * @evt_data: Pointer to firmware event data @@ -554,9 +555,9 @@ struct leapraid_fw_evt_struct { }; /** - * struct leapraid_rq - Represents a LeapRaid request queue + * struct leapraid_rq - Represents a LeapRAID request queue * - * @adapter: Pointer to the associated LeapRaid adapter + * @adapter: Pointer to the associated LeapRAID adapter * @msix_idx: MSI-X vector index used by this queue * @rep_post_host_idx: Index of the last processed reply descriptor * @rep_desc: Pointer to the reply descriptor associated with this queue @@ -576,7 +577,7 @@ struct leapraid_rq { * struct leapraid_int_rq - Internal request queue for a CPU * * @affinity_hint: CPU affinity mask for the queue - * @rq: Underlying LeapRaid request queue structure + * @rq: Underlying LeapRAID request queue structure */ struct leapraid_int_rq { cpumask_var_t affinity_hint; @@ -584,11 +585,11 @@ struct leapraid_int_rq { }; /** - * struct leapraid_blk_mq_poll_rq - Polling request for LeapRaid blk-mq + * struct leapraid_blk_mq_poll_rq - Polling request for LeapRAID blk-mq * * @busy: Atomic flag indicating request is being processed * @pause: Atomic flag to temporarily suspend polling - * @rq: The underlying LeapRaid request structure + * @rq: The underlying LeapRAID request structure */ struct leapraid_blk_mq_poll_rq { atomic_t busy; @@ -598,7 +599,7 @@ struct leapraid_blk_mq_poll_rq { /** * struct leapraid_notification_desc - Notification - * descriptor for LeapRaid + * descriptor for LeapRAID * * @iopoll_qdex: Index of the I/O polling queue * @iopoll_qcnt: Count of I/O polling queues @@ -621,7 +622,7 @@ struct leapraid_notification_desc { }; /** - * struct leapraid_reset_desc - Reset descriptor for LeapRaid + * struct leapraid_reset_desc - Reset descriptor for LeapRAID * * @fault_reset_wq: Workqueue for fault reset operations * @fault_reset_work: Delayed work structure for fault reset @@ -651,7 +652,7 @@ struct leapraid_reset_desc { /** * struct leapraid_scan_dev_desc - Scan device descriptor - * for LeapRaid + * for LeapRAID * * @wait_scan_dev_done: Flag indicating if scan device operation is done * @driver_loading: Flag indicating if driver is loading @@ -670,7 +671,7 @@ struct leapraid_scan_dev_desc { }; /** - * struct leapraid_access_ctrl - Access control structure for LeapRaid + * struct leapraid_access_ctrl - Access control structure for LeapRAID * * @pci_access_lock: Mutex for PCI access control * @adapter_thermal_alert: Flag indicating if adapter thermal alert is active @@ -687,7 +688,7 @@ struct leapraid_access_ctrl { }; /** - * struct leapraid_fw_log_desc - Firmware log descriptor for LeapRaid + * struct leapraid_fw_log_desc - Firmware log descriptor for LeapRAID * * @fw_log_buffer: Buffer for firmware log data * @fw_log_buffer_dma: DMA address of the firmware log buffer @@ -711,7 +712,7 @@ struct leapraid_fw_log_desc { #define LEAPRAID_CARD_PORT_FLG_NEW 0x02 #define LEAPRAID_DISABLE_MP_PORT_ID 0xFF /** - * struct leapraid_card_port - Card port structure for LeapRaid + * struct leapraid_card_port - Card port structure for LeapRAID * * @list: List head for card port * @vphys_list: List head for virtual phy list @@ -732,7 +733,7 @@ struct leapraid_card_port { }; /** - * struct leapraid_card_phy - Card phy structure for LeapRaid + * struct leapraid_card_phy - Card phy structure for LeapRAID * * @port_siblings: List head for port siblings * @card_port: Pointer to the card port @@ -759,7 +760,7 @@ struct leapraid_card_phy { }; /** - * struct leapraid_topo_node - SAS topology node for LeapRaid + * struct leapraid_topo_node - SAS topology node for LeapRAID * * @list: List head for linking nodes * @sas_port_list: List of SAS ports @@ -792,7 +793,7 @@ struct leapraid_topo_node { }; /** - * struct leapraid_dev_topo - LeapRaid device topology management structure + * struct leapraid_dev_topo - LeapRAID device topology management structure * * @topo_node_lock: Spinlock for protecting topology node operations * @sas_dev_lock: Spinlock for SAS device list access @@ -832,7 +833,7 @@ struct leapraid_dev_topo { }; /** - * struct leapraid_boot_dev - Boot device structure for LeapRaid + * struct leapraid_boot_dev - Boot device structure for LeapRAID * * @dev: Device pointer * @chnl: Channel number @@ -871,7 +872,7 @@ struct leapraid_smart_poll_desc { }; /** - * struct leapraid_adapter - Main LeapRaid adapter structure + * struct leapraid_adapter - Main LeapRAID adapter structure * @list: List head for adapter management * @shost: SCSI host structure * @pdev: PCI device structure diff --git a/drivers/scsi/leapraid/leapraid_os.c b/drivers/scsi/leapraid/leapraid_os.c index be0f7cbb6684..f8354c68ab71 100644 --- a/drivers/scsi/leapraid/leapraid_os.c +++ b/drivers/scsi/leapraid/leapraid_os.c @@ -2124,7 +2124,7 @@ static void leapraid_shutdown(struct pci_dev *pdev) adapter->access_ctrl.host_removing = true; leapraid_wait_cmds_done(adapter); leapraid_clean_active_fw_evt(adapter); - + leapraid_fw_log_stop(adapter); spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); wq = adapter->fw_evt_s.fw_evt_thread; adapter->fw_evt_s.fw_evt_thread = NULL; -- 2.25.1

2 2

[PATCH OLK-5.10] scsi: leapraid: add RAID disk hide/show events and fix misc issues
by haodongdong 02 Feb '26

02 Feb '26

LeapIO inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8463 ------------------------------------------ This change introduces RAID disk hide/show events to allow dynamic visibility control of RAID devices. It also updates the MSI-X vector count retrieval logic and unifies driver naming from LeapRaid to LeapRAID for consistency. In addition, fix an issue where the fw_log workqueue was not properly released during system shutdown, which could lead to resource leaks. Signed-off-by: haodongdong <doubled(a)leap-io.com> --- drivers/scsi/leapraid/leapraid.h | 2 + drivers/scsi/leapraid/leapraid_func.c | 104 ++++++++++++++++++++++---- drivers/scsi/leapraid/leapraid_func.h | 47 ++++++------ drivers/scsi/leapraid/leapraid_os.c | 2 +- 4 files changed, 116 insertions(+), 39 deletions(-) diff --git a/drivers/scsi/leapraid/leapraid.h b/drivers/scsi/leapraid/leapraid.h index 842810d41542..77bb93b79254 100644 --- a/drivers/scsi/leapraid/leapraid.h +++ b/drivers/scsi/leapraid/leapraid.h @@ -310,6 +310,8 @@ #define LEAPRAID_EVT_IR_RC_PD_UNHIDDEN_TO_DELETE 0x04 #define LEAPRAID_EVT_IR_RC_PD_CREATED_TO_HIDE 0x05 #define LEAPRAID_EVT_IR_RC_PD_DELETED_TO_EXPOSE 0x06 +#define LEAPRAID_EVT_IR_RC_VOLUME_HIDE 0x0A +#define LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE 0x0B /* sas topology change event */ #define LEAPRAID_EVT_SAS_TOPO_ES_NO_EXPANDER 0x00 diff --git a/drivers/scsi/leapraid/leapraid_func.c b/drivers/scsi/leapraid/leapraid_func.c index c83c30f56805..5dfe95a8dd84 100644 --- a/drivers/scsi/leapraid/leapraid_func.c +++ b/drivers/scsi/leapraid/leapraid_func.c @@ -4117,6 +4117,66 @@ static void leapraid_sas_pd_expose( } } +static void leapraid_sas_vol_visibility(struct leapraid_adapter *adapter, + struct leapraid_evt_data_ir_change *evt_data) +{ + struct leapraid_raid_volume *raid_volume = NULL; + struct scsi_device *sdev = NULL; + u16 hdl = 0; + unsigned long flags; + u8 rc = 0; + u8 reprobe_flg = 0; + + hdl = le16_to_cpu(evt_data->vol_dev_hdl); + rc = evt_data->reason_code; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); + if (!raid_volume) { + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + dev_warn(&adapter->pdev->dev, + "%s:%d: volume handle 0x%x not found\n", + __func__, __LINE__, hdl); + return; + } + + reprobe_flg = 0; + sdev = raid_volume->sdev; + if (sdev) { + if (sdev->no_uld_attach) { + if (rc == LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE) { + sdev->no_uld_attach = 0; + reprobe_flg = 1; + } + } else { + if (rc == LEAPRAID_EVT_IR_RC_VOLUME_HIDE) { + sdev->no_uld_attach = 1; + reprobe_flg = 1; + } + } + + if (reprobe_flg) { + if (sdev->no_uld_attach) + sdev_printk(KERN_INFO, sdev, "hide vol\n"); + else + sdev_printk(KERN_INFO, sdev, "unhide vol\n"); + + WARN_ON(scsi_device_reprobe(sdev)); + } else { + dev_warn(&adapter->pdev->dev, + "%s:rc(0x%x):request matches, skipping.\n", + __func__, rc); + } + + } else { + dev_warn(&adapter->pdev->dev, + "%s:%d: volume handle 0x%x has no sdev\n", + __func__, __LINE__, hdl); + } + + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); +} + static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { @@ -4235,6 +4295,10 @@ static void leapraid_sas_ir_chg_evt(struct leapraid_adapter *adapter, case LEAPRAID_EVT_IR_RC_PD_DELETED_TO_EXPOSE: leapraid_sas_pd_expose(adapter, evt_data); break; + case LEAPRAID_EVT_IR_RC_VOLUME_HIDE: + case LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE: + leapraid_sas_vol_visibility(adapter, evt_data); + break; default: break; } @@ -6382,6 +6446,8 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) le16_to_cpu(leap_mpi_rep.hp_slot); adapter->adapter_attr.features.adapter_caps = le32_to_cpu(leap_mpi_rep.adapter_caps); + adapter->adapter_attr.features.max_msix_vectors = + leap_mpi_rep.max_msix_vectors; adapter->adapter_attr.features.max_volumes = leap_mpi_rep.max_volumes; if (!adapter->adapter_attr.features.max_volumes) @@ -6741,11 +6807,15 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) goto legacy_int; msix_cnt = leapraid_msix_cnt(adapter->pdev); - if (msix_cnt <= 0) { + if (msix_cnt <= 0 || + adapter->adapter_attr.features.max_msix_vectors == 0) { dev_info(&adapter->pdev->dev, "msix unsupported!\n"); goto legacy_int; } + msix_cnt = min_t(int, msix_cnt, + adapter->adapter_attr.features.max_msix_vectors); + if (reset_devices) adapter->adapter_attr.rq_cnt = 1; else @@ -6839,11 +6909,15 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) goto legacy_int1; msi_cnt = leapraid_msi_cnt(adapter->pdev); - if (msi_cnt <= 0) { - dev_info(&adapter->pdev->dev, "msix unsupported!\n"); + if (msi_cnt <= 0 || + adapter->adapter_attr.features.max_msix_vectors == 0) { + dev_info(&adapter->pdev->dev, "msi unsupported!\n"); goto legacy_int1; } + msi_cnt = min_t(int, msi_cnt, + adapter->adapter_attr.features.max_msix_vectors); + if (reset_devices) adapter->adapter_attr.rq_cnt = 1; else @@ -6988,6 +7062,18 @@ int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) leapraid_mask_int(adapter); + rc = leapraid_make_adapter_ready(adapter, PART_RESET); + if (rc) { + dev_err(&adapter->pdev->dev, "make adapter ready failure\n"); + goto out_fail; + } + + rc = leapraid_get_adapter_features(adapter); + if (rc) { + dev_err(&adapter->pdev->dev, "get adapter feature failure\n"); + goto out_fail; + } + rc = leapraid_set_notification(adapter); if (rc) goto out_fail; @@ -8185,18 +8271,6 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) PCI_EXP_DEVCTL_EXT_TAG); } - rc = leapraid_make_adapter_ready(adapter, PART_RESET); - if (rc) { - dev_err(&adapter->pdev->dev, "make adapter ready failure\n"); - goto out_free_resources; - } - - rc = leapraid_get_adapter_features(adapter); - if (rc) { - dev_err(&adapter->pdev->dev, "get adapter feature failure\n"); - goto out_free_resources; - } - rc = leapraid_fw_log_init(adapter); if (rc) { dev_err(&adapter->pdev->dev, "fw log init failure\n"); diff --git a/drivers/scsi/leapraid/leapraid_func.h b/drivers/scsi/leapraid/leapraid_func.h index 9f42763bda72..15293922aefa 100644 --- a/drivers/scsi/leapraid/leapraid_func.h +++ b/drivers/scsi/leapraid/leapraid_func.h @@ -45,15 +45,15 @@ #define LEAPRAID_SYS_LOG_BUF_RESERVE 0x1000 /* Driver version and name */ -#define LEAPRAID_DRIVER_NAME "LeapRaid" +#define LEAPRAID_DRIVER_NAME "LeapRAID" #define LEAPRAID_NAME_LENGTH 48 #define LEAPRAID_AUTHOR "LeapIO Inc." -#define LEAPRAID_DESCRIPTION "LeapRaid Driver" -#define LEAPRAID_DRIVER_VERSION "2.00.00.05" +#define LEAPRAID_DESCRIPTION "LeapRAID Driver" +#define LEAPRAID_DRIVER_VERSION "2.00.00.06" #define LEAPRAID_MAJOR_VERSION 2 #define LEAPRAID_MINOR_VERSION 00 #define LEAPRAID_BUILD_VERSION 00 -#define LEAPRAID_RELEASE_VERSION 05 +#define LEAPRAID_RELEASE_VERSION 06 /* Device ID */ #define LEAPRAID_VENDOR_ID 0xD405 @@ -242,6 +242,7 @@ struct leapraid_adapter_features { u16 hp_slot; u32 adapter_caps; u32 fw_version; + u8 max_msix_vectors; u8 max_volumes; u16 max_dev_handle; u16 min_dev_handle; @@ -348,7 +349,7 @@ struct leapraid_rep_desc_seg_maint { }; /** - * struct leapraid_mem_desc - Memory descriptor for LeapRaid adapter + * struct leapraid_mem_desc - Memory descriptor for LeapRAID adapter * * @task_desc: Pointer to task descriptor * @task_desc_dma: DMA address of task descriptor @@ -394,7 +395,7 @@ struct leapraid_mem_desc { #define LEAPRAID_CMD_RESET 0x0008 /** - * enum LEAPRAID_CB_INDEX - Callback index for LeapRaid driver + * enum LEAPRAID_CB_INDEX - Callback index for LeapRAID driver * * @LEAPRAID_SCAN_DEV_CB_IDX: Scan device callback index * @LEAPRAID_CONFIG_CB_IDX: Configuration callback index @@ -512,7 +513,7 @@ struct leapraid_dynamic_task_desc { * struct leapraid_fw_evt_work - Firmware event work structure * * @list: Linked list node for queuing the work - * @adapter: Pointer to the associated LeapRaid adapter + * @adapter: Pointer to the associated LeapRAID adapter * @work: Work structure used by the kernel workqueue * @refcnt: Reference counter for managing the lifetime of this work * @evt_data: Pointer to firmware event data @@ -553,9 +554,9 @@ struct leapraid_fw_evt_struct { }; /** - * struct leapraid_rq - Represents a LeapRaid request queue + * struct leapraid_rq - Represents a LeapRAID request queue * - * @adapter: Pointer to the associated LeapRaid adapter + * @adapter: Pointer to the associated LeapRAID adapter * @msix_idx: MSI-X vector index used by this queue * @rep_post_host_idx: Index of the last processed reply descriptor * @rep_desc: Pointer to the reply descriptor associated with this queue @@ -575,7 +576,7 @@ struct leapraid_rq { * struct leapraid_int_rq - Internal request queue for a CPU * * @affinity_hint: CPU affinity mask for the queue - * @rq: Underlying LeapRaid request queue structure + * @rq: Underlying LeapRAID request queue structure */ struct leapraid_int_rq { cpumask_var_t affinity_hint; @@ -583,11 +584,11 @@ struct leapraid_int_rq { }; /** - * struct leapraid_blk_mq_poll_rq - Polling request for LeapRaid blk-mq + * struct leapraid_blk_mq_poll_rq - Polling request for LeapRAID blk-mq * * @busy: Atomic flag indicating request is being processed * @pause: Atomic flag to temporarily suspend polling - * @rq: The underlying LeapRaid request structure + * @rq: The underlying LeapRAID request structure */ struct leapraid_blk_mq_poll_rq { atomic_t busy; @@ -597,7 +598,7 @@ struct leapraid_blk_mq_poll_rq { /** * struct leapraid_notification_desc - Notification - * descriptor for LeapRaid + * descriptor for LeapRAID * * @iopoll_qdex: Index of the I/O polling queue * @iopoll_qcnt: Count of I/O polling queues @@ -620,7 +621,7 @@ struct leapraid_notification_desc { }; /** - * struct leapraid_reset_desc - Reset descriptor for LeapRaid + * struct leapraid_reset_desc - Reset descriptor for LeapRAID * * @fault_reset_wq: Workqueue for fault reset operations * @fault_reset_work: Delayed work structure for fault reset @@ -650,7 +651,7 @@ struct leapraid_reset_desc { /** * struct leapraid_scan_dev_desc - Scan device descriptor - * for LeapRaid + * for LeapRAID * * @wait_scan_dev_done: Flag indicating if scan device operation is done * @driver_loading: Flag indicating if driver is loading @@ -669,7 +670,7 @@ struct leapraid_scan_dev_desc { }; /** - * struct leapraid_access_ctrl - Access control structure for LeapRaid + * struct leapraid_access_ctrl - Access control structure for LeapRAID * * @pci_access_lock: Mutex for PCI access control * @adapter_thermal_alert: Flag indicating if adapter thermal alert is active @@ -686,7 +687,7 @@ struct leapraid_access_ctrl { }; /** - * struct leapraid_fw_log_desc - Firmware log descriptor for LeapRaid + * struct leapraid_fw_log_desc - Firmware log descriptor for LeapRAID * * @fw_log_buffer: Buffer for firmware log data * @fw_log_buffer_dma: DMA address of the firmware log buffer @@ -710,7 +711,7 @@ struct leapraid_fw_log_desc { #define LEAPRAID_CARD_PORT_FLG_NEW 0x02 #define LEAPRAID_DISABLE_MP_PORT_ID 0xFF /** - * struct leapraid_card_port - Card port structure for LeapRaid + * struct leapraid_card_port - Card port structure for LeapRAID * * @list: List head for card port * @vphys_list: List head for virtual phy list @@ -731,7 +732,7 @@ struct leapraid_card_port { }; /** - * struct leapraid_card_phy - Card phy structure for LeapRaid + * struct leapraid_card_phy - Card phy structure for LeapRAID * * @port_siblings: List head for port siblings * @card_port: Pointer to the card port @@ -758,7 +759,7 @@ struct leapraid_card_phy { }; /** - * struct leapraid_topo_node - SAS topology node for LeapRaid + * struct leapraid_topo_node - SAS topology node for LeapRAID * * @list: List head for linking nodes * @sas_port_list: List of SAS ports @@ -791,7 +792,7 @@ struct leapraid_topo_node { }; /** - * struct leapraid_dev_topo - LeapRaid device topology management structure + * struct leapraid_dev_topo - LeapRAID device topology management structure * * @topo_node_lock: Spinlock for protecting topology node operations * @sas_dev_lock: Spinlock for SAS device list access @@ -831,7 +832,7 @@ struct leapraid_dev_topo { }; /** - * struct leapraid_boot_dev - Boot device structure for LeapRaid + * struct leapraid_boot_dev - Boot device structure for LeapRAID * * @dev: Device pointer * @chnl: Channel number @@ -870,7 +871,7 @@ struct leapraid_smart_poll_desc { }; /** - * struct leapraid_adapter - Main LeapRaid adapter structure + * struct leapraid_adapter - Main LeapRAID adapter structure * @list: List head for adapter management * @shost: SCSI host structure * @pdev: PCI device structure diff --git a/drivers/scsi/leapraid/leapraid_os.c b/drivers/scsi/leapraid/leapraid_os.c index 44ec2615648f..6635e74fd8ff 100644 --- a/drivers/scsi/leapraid/leapraid_os.c +++ b/drivers/scsi/leapraid/leapraid_os.c @@ -2029,7 +2029,7 @@ static void leapraid_shutdown(struct pci_dev *pdev) adapter->access_ctrl.host_removing = true; leapraid_wait_cmds_done(adapter); leapraid_clean_active_fw_evt(adapter); - + leapraid_fw_log_stop(adapter); spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); wq = adapter->fw_evt_s.fw_evt_thread; adapter->fw_evt_s.fw_evt_thread = NULL; -- 2.25.1

2 2

[PATCH OLK-6.6] scsi: leapraid: add RAID disk hide/show events and fix misc issues
by haodongdong 02 Feb '26

02 Feb '26

LeapIO inclusion category: feature bugzilla: https://atomgit.com/openeuler/kernel/issues/8462 This change introduces RAID disk hide/show events to allow dynamic visibility control of RAID devices. It also updates the MSI-X vector count retrieval logic and unifies driver naming from LeapRaid to LeapRAID for consistency. In addition, fix an issue where the fw_log workqueue was not properly released during system shutdown, which could lead to resource leaks. Signed-off-by: haodongdong <doubled(a)leap-io.com> --- drivers/scsi/leapraid/leapraid.h | 2 + drivers/scsi/leapraid/leapraid_func.c | 104 ++++++++++++++++++++++---- drivers/scsi/leapraid/leapraid_func.h | 47 ++++++------ drivers/scsi/leapraid/leapraid_os.c | 2 +- 4 files changed, 116 insertions(+), 39 deletions(-) diff --git a/drivers/scsi/leapraid/leapraid.h b/drivers/scsi/leapraid/leapraid.h index 842810d41542..77bb93b79254 100644 --- a/drivers/scsi/leapraid/leapraid.h +++ b/drivers/scsi/leapraid/leapraid.h @@ -310,6 +310,8 @@ #define LEAPRAID_EVT_IR_RC_PD_UNHIDDEN_TO_DELETE 0x04 #define LEAPRAID_EVT_IR_RC_PD_CREATED_TO_HIDE 0x05 #define LEAPRAID_EVT_IR_RC_PD_DELETED_TO_EXPOSE 0x06 +#define LEAPRAID_EVT_IR_RC_VOLUME_HIDE 0x0A +#define LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE 0x0B /* sas topology change event */ #define LEAPRAID_EVT_SAS_TOPO_ES_NO_EXPANDER 0x00 diff --git a/drivers/scsi/leapraid/leapraid_func.c b/drivers/scsi/leapraid/leapraid_func.c index 2fc142fff982..ad8aee40e2c1 100644 --- a/drivers/scsi/leapraid/leapraid_func.c +++ b/drivers/scsi/leapraid/leapraid_func.c @@ -4132,6 +4132,66 @@ static void leapraid_sas_pd_expose( } } +static void leapraid_sas_vol_visibility(struct leapraid_adapter *adapter, + struct leapraid_evt_data_ir_change *evt_data) +{ + struct leapraid_raid_volume *raid_volume = NULL; + struct scsi_device *sdev = NULL; + u16 hdl = 0; + unsigned long flags; + u8 rc = 0; + u8 reprobe_flg = 0; + + hdl = le16_to_cpu(evt_data->vol_dev_hdl); + rc = evt_data->reason_code; + spin_lock_irqsave(&adapter->dev_topo.raid_volume_lock, flags); + raid_volume = leapraid_raid_volume_find_by_hdl(adapter, hdl); + if (!raid_volume) { + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, + flags); + dev_warn(&adapter->pdev->dev, + "%s:%d: volume handle 0x%x not found\n", + __func__, __LINE__, hdl); + return; + } + + reprobe_flg = 0; + sdev = raid_volume->sdev; + if (sdev) { + if (sdev->no_uld_attach) { + if (rc == LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE) { + sdev->no_uld_attach = 0; + reprobe_flg = 1; + } + } else { + if (rc == LEAPRAID_EVT_IR_RC_VOLUME_HIDE) { + sdev->no_uld_attach = 1; + reprobe_flg = 1; + } + } + + if (reprobe_flg) { + if (sdev->no_uld_attach) + sdev_printk(KERN_INFO, sdev, "hide vol\n"); + else + sdev_printk(KERN_INFO, sdev, "unhide vol\n"); + + WARN_ON(scsi_device_reprobe(sdev)); + } else { + dev_warn(&adapter->pdev->dev, + "%s:rc(0x%x):request matches, skipping.\n", + __func__, rc); + } + + } else { + dev_warn(&adapter->pdev->dev, + "%s:%d: volume handle 0x%x has no sdev\n", + __func__, __LINE__, hdl); + } + + spin_unlock_irqrestore(&adapter->dev_topo.raid_volume_lock, flags); +} + static void leapraid_sas_volume_add(struct leapraid_adapter *adapter, struct leapraid_evt_data_ir_change *evt_data) { @@ -4250,6 +4310,10 @@ static void leapraid_sas_ir_chg_evt(struct leapraid_adapter *adapter, case LEAPRAID_EVT_IR_RC_PD_DELETED_TO_EXPOSE: leapraid_sas_pd_expose(adapter, evt_data); break; + case LEAPRAID_EVT_IR_RC_VOLUME_HIDE: + case LEAPRAID_EVT_IR_RC_VOLUME_UNHIDE: + leapraid_sas_vol_visibility(adapter, evt_data); + break; default: break; } @@ -6397,6 +6461,8 @@ static int leapraid_get_adapter_features(struct leapraid_adapter *adapter) le16_to_cpu(leap_mpi_rep.hp_slot); adapter->adapter_attr.features.adapter_caps = le32_to_cpu(leap_mpi_rep.adapter_caps); + adapter->adapter_attr.features.max_msix_vectors = + leap_mpi_rep.max_msix_vectors; adapter->adapter_attr.features.max_volumes = leap_mpi_rep.max_volumes; if (!adapter->adapter_attr.features.max_volumes) @@ -6754,11 +6820,15 @@ static int leapraid_set_msix(struct leapraid_adapter *adapter) goto legacy_int; msix_cnt = leapraid_msix_cnt(adapter->pdev); - if (msix_cnt <= 0) { + if (msix_cnt <= 0 || + adapter->adapter_attr.features.max_msix_vectors == 0) { dev_info(&adapter->pdev->dev, "msix unsupported!\n"); goto legacy_int; } + msix_cnt = min_t(int, msix_cnt, + adapter->adapter_attr.features.max_msix_vectors); + if (reset_devices) adapter->adapter_attr.rq_cnt = 1; else @@ -6859,11 +6929,15 @@ static int leapraid_set_msi(struct leapraid_adapter *adapter) goto legacy_int1; msi_cnt = leapraid_msi_cnt(adapter->pdev); - if (msi_cnt <= 0) { - dev_info(&adapter->pdev->dev, "msix unsupported!\n"); + if (msi_cnt <= 0 || + adapter->adapter_attr.features.max_msix_vectors == 0) { + dev_info(&adapter->pdev->dev, "msi unsupported!\n"); goto legacy_int1; } + msi_cnt = min_t(int, msi_cnt, + adapter->adapter_attr.features.max_msix_vectors); + if (reset_devices) adapter->adapter_attr.rq_cnt = 1; else @@ -7015,6 +7089,18 @@ int leapraid_set_pcie_and_notification(struct leapraid_adapter *adapter) leapraid_mask_int(adapter); + rc = leapraid_make_adapter_ready(adapter, PART_RESET); + if (rc) { + dev_err(&adapter->pdev->dev, "make adapter ready failure\n"); + goto out_fail; + } + + rc = leapraid_get_adapter_features(adapter); + if (rc) { + dev_err(&adapter->pdev->dev, "get adapter feature failure\n"); + goto out_fail; + } + rc = leapraid_set_notification(adapter); if (rc) goto out_fail; @@ -8185,18 +8271,6 @@ int leapraid_ctrl_init(struct leapraid_adapter *adapter) PCI_EXP_DEVCTL_EXT_TAG); } - rc = leapraid_make_adapter_ready(adapter, PART_RESET); - if (rc) { - dev_err(&adapter->pdev->dev, "make adapter ready failure\n"); - goto out_free_resources; - } - - rc = leapraid_get_adapter_features(adapter); - if (rc) { - dev_err(&adapter->pdev->dev, "get adapter feature failure\n"); - goto out_free_resources; - } - rc = leapraid_fw_log_init(adapter); if (rc) { dev_err(&adapter->pdev->dev, "fw log init failure\n"); diff --git a/drivers/scsi/leapraid/leapraid_func.h b/drivers/scsi/leapraid/leapraid_func.h index 2c51ef359b7e..f7072d078315 100644 --- a/drivers/scsi/leapraid/leapraid_func.h +++ b/drivers/scsi/leapraid/leapraid_func.h @@ -46,15 +46,15 @@ #define LEAPRAID_SYS_LOG_BUF_RESERVE 0x1000 /* Driver version and name */ -#define LEAPRAID_DRIVER_NAME "LeapRaid" +#define LEAPRAID_DRIVER_NAME "LeapRAID" #define LEAPRAID_NAME_LENGTH 48 #define LEAPRAID_AUTHOR "LeapIO Inc." -#define LEAPRAID_DESCRIPTION "LeapRaid Driver" -#define LEAPRAID_DRIVER_VERSION "2.00.00.05" +#define LEAPRAID_DESCRIPTION "LeapRAID Driver" +#define LEAPRAID_DRIVER_VERSION "2.00.00.06" #define LEAPRAID_MAJOR_VERSION 2 #define LEAPRAID_MINOR_VERSION 00 #define LEAPRAID_BUILD_VERSION 00 -#define LEAPRAID_RELEASE_VERSION 05 +#define LEAPRAID_RELEASE_VERSION 06 /* Device ID */ #define LEAPRAID_VENDOR_ID 0xD405 @@ -243,6 +243,7 @@ struct leapraid_adapter_features { u16 hp_slot; u32 adapter_caps; u32 fw_version; + u8 max_msix_vectors; u8 max_volumes; u16 max_dev_handle; u16 min_dev_handle; @@ -349,7 +350,7 @@ struct leapraid_rep_desc_seg_maint { }; /** - * struct leapraid_mem_desc - Memory descriptor for LeapRaid adapter + * struct leapraid_mem_desc - Memory descriptor for LeapRAID adapter * * @task_desc: Pointer to task descriptor * @task_desc_dma: DMA address of task descriptor @@ -395,7 +396,7 @@ struct leapraid_mem_desc { #define LEAPRAID_CMD_RESET 0x0008 /** - * enum LEAPRAID_CB_INDEX - Callback index for LeapRaid driver + * enum LEAPRAID_CB_INDEX - Callback index for LeapRAID driver * * @LEAPRAID_SCAN_DEV_CB_IDX: Scan device callback index * @LEAPRAID_CONFIG_CB_IDX: Configuration callback index @@ -513,7 +514,7 @@ struct leapraid_dynamic_task_desc { * struct leapraid_fw_evt_work - Firmware event work structure * * @list: Linked list node for queuing the work - * @adapter: Pointer to the associated LeapRaid adapter + * @adapter: Pointer to the associated LeapRAID adapter * @work: Work structure used by the kernel workqueue * @refcnt: Reference counter for managing the lifetime of this work * @evt_data: Pointer to firmware event data @@ -554,9 +555,9 @@ struct leapraid_fw_evt_struct { }; /** - * struct leapraid_rq - Represents a LeapRaid request queue + * struct leapraid_rq - Represents a LeapRAID request queue * - * @adapter: Pointer to the associated LeapRaid adapter + * @adapter: Pointer to the associated LeapRAID adapter * @msix_idx: MSI-X vector index used by this queue * @rep_post_host_idx: Index of the last processed reply descriptor * @rep_desc: Pointer to the reply descriptor associated with this queue @@ -576,7 +577,7 @@ struct leapraid_rq { * struct leapraid_int_rq - Internal request queue for a CPU * * @affinity_hint: CPU affinity mask for the queue - * @rq: Underlying LeapRaid request queue structure + * @rq: Underlying LeapRAID request queue structure */ struct leapraid_int_rq { cpumask_var_t affinity_hint; @@ -584,11 +585,11 @@ struct leapraid_int_rq { }; /** - * struct leapraid_blk_mq_poll_rq - Polling request for LeapRaid blk-mq + * struct leapraid_blk_mq_poll_rq - Polling request for LeapRAID blk-mq * * @busy: Atomic flag indicating request is being processed * @pause: Atomic flag to temporarily suspend polling - * @rq: The underlying LeapRaid request structure + * @rq: The underlying LeapRAID request structure */ struct leapraid_blk_mq_poll_rq { atomic_t busy; @@ -598,7 +599,7 @@ struct leapraid_blk_mq_poll_rq { /** * struct leapraid_notification_desc - Notification - * descriptor for LeapRaid + * descriptor for LeapRAID * * @iopoll_qdex: Index of the I/O polling queue * @iopoll_qcnt: Count of I/O polling queues @@ -621,7 +622,7 @@ struct leapraid_notification_desc { }; /** - * struct leapraid_reset_desc - Reset descriptor for LeapRaid + * struct leapraid_reset_desc - Reset descriptor for LeapRAID * * @fault_reset_wq: Workqueue for fault reset operations * @fault_reset_work: Delayed work structure for fault reset @@ -651,7 +652,7 @@ struct leapraid_reset_desc { /** * struct leapraid_scan_dev_desc - Scan device descriptor - * for LeapRaid + * for LeapRAID * * @wait_scan_dev_done: Flag indicating if scan device operation is done * @driver_loading: Flag indicating if driver is loading @@ -670,7 +671,7 @@ struct leapraid_scan_dev_desc { }; /** - * struct leapraid_access_ctrl - Access control structure for LeapRaid + * struct leapraid_access_ctrl - Access control structure for LeapRAID * * @pci_access_lock: Mutex for PCI access control * @adapter_thermal_alert: Flag indicating if adapter thermal alert is active @@ -687,7 +688,7 @@ struct leapraid_access_ctrl { }; /** - * struct leapraid_fw_log_desc - Firmware log descriptor for LeapRaid + * struct leapraid_fw_log_desc - Firmware log descriptor for LeapRAID * * @fw_log_buffer: Buffer for firmware log data * @fw_log_buffer_dma: DMA address of the firmware log buffer @@ -711,7 +712,7 @@ struct leapraid_fw_log_desc { #define LEAPRAID_CARD_PORT_FLG_NEW 0x02 #define LEAPRAID_DISABLE_MP_PORT_ID 0xFF /** - * struct leapraid_card_port - Card port structure for LeapRaid + * struct leapraid_card_port - Card port structure for LeapRAID * * @list: List head for card port * @vphys_list: List head for virtual phy list @@ -732,7 +733,7 @@ struct leapraid_card_port { }; /** - * struct leapraid_card_phy - Card phy structure for LeapRaid + * struct leapraid_card_phy - Card phy structure for LeapRAID * * @port_siblings: List head for port siblings * @card_port: Pointer to the card port @@ -759,7 +760,7 @@ struct leapraid_card_phy { }; /** - * struct leapraid_topo_node - SAS topology node for LeapRaid + * struct leapraid_topo_node - SAS topology node for LeapRAID * * @list: List head for linking nodes * @sas_port_list: List of SAS ports @@ -792,7 +793,7 @@ struct leapraid_topo_node { }; /** - * struct leapraid_dev_topo - LeapRaid device topology management structure + * struct leapraid_dev_topo - LeapRAID device topology management structure * * @topo_node_lock: Spinlock for protecting topology node operations * @sas_dev_lock: Spinlock for SAS device list access @@ -832,7 +833,7 @@ struct leapraid_dev_topo { }; /** - * struct leapraid_boot_dev - Boot device structure for LeapRaid + * struct leapraid_boot_dev - Boot device structure for LeapRAID * * @dev: Device pointer * @chnl: Channel number @@ -871,7 +872,7 @@ struct leapraid_smart_poll_desc { }; /** - * struct leapraid_adapter - Main LeapRaid adapter structure + * struct leapraid_adapter - Main LeapRAID adapter structure * @list: List head for adapter management * @shost: SCSI host structure * @pdev: PCI device structure diff --git a/drivers/scsi/leapraid/leapraid_os.c b/drivers/scsi/leapraid/leapraid_os.c index be0f7cbb6684..f8354c68ab71 100644 --- a/drivers/scsi/leapraid/leapraid_os.c +++ b/drivers/scsi/leapraid/leapraid_os.c @@ -2124,7 +2124,7 @@ static void leapraid_shutdown(struct pci_dev *pdev) adapter->access_ctrl.host_removing = true; leapraid_wait_cmds_done(adapter); leapraid_clean_active_fw_evt(adapter); - + leapraid_fw_log_stop(adapter); spin_lock_irqsave(&adapter->fw_evt_s.fw_evt_lock, flags); wq = adapter->fw_evt_s.fw_evt_thread; adapter->fw_evt_s.fw_evt_thread = NULL; -- 2.25.1

2 1

[PATCH OLK-6.6] interference: Fix uninitialized ifs_clock compiling issue
by Pu Lehui 02 Feb '26

02 Feb '26

hulk inclusion category: bugfix bugzilla: https://atomgit.com/openeuler/kernel/issues/7429 -------------------------------- When compiling with clang, it will occur the warning: 623 | if (__mutex_trylock(lock)) { | ^~~~~~~~~~~~~~~~~~~~~ kernel/locking/mutex.c:725:24: note: uninitialized use occurs here 725 | cgroup_ifs_leave_lock(ifs_clock, IFS_MUTEX); | ^~~~~~~~~ kernel/locking/mutex.c:623:2: note: remove the 'if' if its condition is always false 623 | if (__mutex_trylock(lock)) { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~ 624 | if (ww_ctx) | ~~~~~~~~~~~ 625 | __ww_mutex_check_waiters(lock, ww_ctx); | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 626 | 627 | goto skip_wait; | ~~~~~~~~~~~~~~~ 628 | } | ~ kernel/locking/mutex.c:576:15: note: initialize the variable 'ifs_clock' to silence this warning 576 | u64 ifs_clock; | ^ | = 0 2 warnings generated. Let's fix it by zero initialize ifs_clock. Fixes: a1ad9b2ed459 ("interference: Add mutex interference track support") Signed-off-by: Pu Lehui <pulehui(a)huawei.com> --- include/linux/cgroup.h | 3 +++ kernel/locking/mutex.c | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h index 05a9cef2edac..d4f69e89b3fb 100644 --- a/include/linux/cgroup.h +++ b/include/linux/cgroup.h @@ -1000,6 +1000,9 @@ static inline void cgroup_ifs_leave_lock(u64 clock, enum ifs_types t) if (!cgroup_ifs_enabled()) return; + if (unlikely(!clock)) + return; + ifs = current_ifs(); if (ifs) { ifsc = this_cpu_ptr(ifs->pcpu); diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c index 1003afe8dd74..038c6fb9d71d 100644 --- a/kernel/locking/mutex.c +++ b/kernel/locking/mutex.c @@ -573,7 +573,7 @@ __mutex_lock_common(struct mutex *lock, unsigned int state, unsigned int subclas { struct mutex_waiter waiter; struct ww_mutex *ww; - u64 ifs_clock; + u64 ifs_clock = 0; int ret; if (!use_ww_ctx) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] usb: typec: altmodes/displayport: fix pin_assignment_show
by Yin Tirui 02 Feb '26

02 Feb '26

From: Badhri Jagan Sridharan <badhri(a)google.com> stable inclusion from stable-v4.19.284 commit 0e61a7432fcd4bca06f05b7f1c7d7cb461880fe2 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13216 CVE: CVE-2023-54186 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d8f28269dd4bf9b55c3fb376ae31512730a96fce upstream. This patch fixes negative indexing of buf array in pin_assignment_show when get_current_pin_assignments returns 0 i.e. no compatible pin assignments are found. BUG: KASAN: use-after-free in pin_assignment_show+0x26c/0x33c ... Call trace: dump_backtrace+0x110/0x204 dump_stack_lvl+0x84/0xbc print_report+0x358/0x974 kasan_report+0x9c/0xfc __do_kernel_fault+0xd4/0x2d4 do_bad_area+0x48/0x168 do_tag_check_fault+0x24/0x38 do_mem_abort+0x6c/0x14c el1_abort+0x44/0x68 el1h_64_sync_handler+0x64/0xa4 el1h_64_sync+0x78/0x7c pin_assignment_show+0x26c/0x33c dev_attr_show+0x50/0xc0 Fixes: 0e3bb7d6894d ("usb: typec: Add driver for DisplayPort alternate mode") Cc: stable(a)vger.kernel.org Signed-off-by: Badhri Jagan Sridharan <badhri(a)google.com> Reviewed-by: Heikki Krogerus <heikki.krogerus(a)linux.intel.com> Link: https://lore.kernel.org/r/20230508214443.893436-1-badhri@google.com Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yin Tirui <yintirui(a)huawei.com> --- drivers/usb/typec/altmodes/displayport.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/usb/typec/altmodes/displayport.c b/drivers/usb/typec/altmodes/displayport.c index 90bb0baed624..3be3a1942b5f 100644 --- a/drivers/usb/typec/altmodes/displayport.c +++ b/drivers/usb/typec/altmodes/displayport.c @@ -495,6 +495,10 @@ static ssize_t pin_assignment_show(struct device *dev, mutex_unlock(&dp->lock); + /* get_current_pin_assignments can return 0 when no matching pin assignments are found */ + if (len == 0) + len++; + buf[len - 1] = '\n'; return len; } -- 2.43.0

2 1

[PATCH OLK-6.6] rcu: Protect ->defer_qs_iw_pending from data race
by Jiacheng Yu 02 Feb '26

02 Feb '26

From: "Paul E. McKenney" <paulmck(a)kernel.org> stable inclusion from stable-v6.6.103 commit b55947b725f190396f475d5d0c59aa855a4d8895 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/8987 CVE: CVE-2025-39749 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 90c09d57caeca94e6f3f87c49e96a91edd40cbfd ] On kernels built with CONFIG_IRQ_WORK=y, when rcu_read_unlock() is invoked within an interrupts-disabled region of code [1], it will invoke rcu_read_unlock_special(), which uses an irq-work handler to force the system to notice when the RCU read-side critical section actually ends. That end won't happen until interrupts are enabled at the soonest. In some kernels, such as those booted with rcutree.use_softirq=y, the irq-work handler is used unconditionally. The per-CPU rcu_data structure's ->defer_qs_iw_pending field is updated by the irq-work handler and is both read and updated by rcu_read_unlock_special(). This resulted in the following KCSAN splat: ------------------------------------------------------------------------ BUG: KCSAN: data-race in rcu_preempt_deferred_qs_handler / rcu_read_unlock_special read to 0xffff96b95f42d8d8 of 1 bytes by task 90 on cpu 8: rcu_read_unlock_special+0x175/0x260 __rcu_read_unlock+0x92/0xa0 rt_spin_unlock+0x9b/0xc0 __local_bh_enable+0x10d/0x170 __local_bh_enable_ip+0xfb/0x150 rcu_do_batch+0x595/0xc40 rcu_cpu_kthread+0x4e9/0x830 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30 write to 0xffff96b95f42d8d8 of 1 bytes by task 88 on cpu 8: rcu_preempt_deferred_qs_handler+0x1e/0x30 irq_work_single+0xaf/0x160 run_irq_workd+0x91/0xc0 smpboot_thread_fn+0x24d/0x3b0 kthread+0x3bd/0x410 ret_from_fork+0x35/0x40 ret_from_fork_asm+0x1a/0x30 no locks held by irq_work/8/88. irq event stamp: 200272 hardirqs last enabled at (200272): [<ffffffffb0f56121>] finish_task_switch+0x131/0x320 hardirqs last disabled at (200271): [<ffffffffb25c7859>] __schedule+0x129/0xd70 softirqs last enabled at (0): [<ffffffffb0ee093f>] copy_process+0x4df/0x1cc0 softirqs last disabled at (0): [<0000000000000000>] 0x0 ------------------------------------------------------------------------ The problem is that irq-work handlers run with interrupts enabled, which means that rcu_preempt_deferred_qs_handler() could be interrupted, and that interrupt handler might contain an RCU read-side critical section, which might invoke rcu_read_unlock_special(). In the strict KCSAN mode of operation used by RCU, this constitutes a data race on the ->defer_qs_iw_pending field. This commit therefore disables interrupts across the portion of the rcu_preempt_deferred_qs_handler() that updates the ->defer_qs_iw_pending field. This suffices because this handler is not a fast path. Signed-off-by: Paul E. McKenney <paulmck(a)kernel.org> Reviewed-by: Frederic Weisbecker <frederic(a)kernel.org> Signed-off-by: Neeraj Upadhyay (AMD) <neeraj.upadhyay(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jiacheng Yu <yujiacheng3(a)huawei.com> --- kernel/rcu/tree_plugin.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h index 94b715139f52..de727f2568bf 100644 --- a/kernel/rcu/tree_plugin.h +++ b/kernel/rcu/tree_plugin.h @@ -612,10 +612,13 @@ notrace void rcu_preempt_deferred_qs(struct task_struct *t) */ static void rcu_preempt_deferred_qs_handler(struct irq_work *iwp) { + unsigned long flags; struct rcu_data *rdp; rdp = container_of(iwp, struct rcu_data, defer_qs_iw); + local_irq_save(flags); rdp->defer_qs_iw_pending = false; + local_irq_restore(flags); } /* -- 2.43.0

2 1

[PATCH OLK-6.6] f2fs: fix to avoid potential deadlock
by Pan Taixi 31 Jan '26

31 Jan '26

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v6.6.120 commit 8bd6dff8b801abaa362272894bda795bf0cf1307 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13377/ CVE: CVE-2025-71065 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ca8b201f28547e28343a6f00a6e91fa8c09572fe ] As Jiaming Zhang and syzbot reported, there is potential deadlock in f2fs as below: Chain exists of: &sbi->cp_rwsem --> fs_reclaim --> sb_internal#2 Possible unsafe locking scenario: CPU0 CPU1 ---- ---- rlock(sb_internal#2); lock(fs_reclaim); lock(sb_internal#2); rlock(&sbi->cp_rwsem); *** DEADLOCK *** 3 locks held by kswapd0/73: #0: ffffffff8e247a40 (fs_reclaim){+.+.}-{0:0}, at: balance_pgdat mm/vmscan.c:7015 [inline] #0: ffffffff8e247a40 (fs_reclaim){+.+.}-{0:0}, at: kswapd+0x951/0x2800 mm/vmscan.c:7389 #1: ffff8880118400e0 (&type->s_umount_key#50){.+.+}-{4:4}, at: super_trylock_shared fs/super.c:562 [inline] #1: ffff8880118400e0 (&type->s_umount_key#50){.+.+}-{4:4}, at: super_cache_scan+0x91/0x4b0 fs/super.c:197 #2: ffff888011840610 (sb_internal#2){.+.+}-{0:0}, at: f2fs_evict_inode+0x8d9/0x1b60 fs/f2fs/inode.c:890 stack backtrace: CPU: 0 UID: 0 PID: 73 Comm: kswapd0 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_circular_bug+0x2ee/0x310 kernel/locking/lockdep.c:2043 check_noncircular+0x134/0x160 kernel/locking/lockdep.c:2175 check_prev_add kernel/locking/lockdep.c:3165 [inline] check_prevs_add kernel/locking/lockdep.c:3284 [inline] validate_chain+0xb9b/0x2140 kernel/locking/lockdep.c:3908 __lock_acquire+0xab9/0xd20 kernel/locking/lockdep.c:5237 lock_acquire+0x120/0x360 kernel/locking/lockdep.c:5868 down_read+0x46/0x2e0 kernel/locking/rwsem.c:1537 f2fs_down_read fs/f2fs/f2fs.h:2278 [inline] f2fs_lock_op fs/f2fs/f2fs.h:2357 [inline] f2fs_do_truncate_blocks+0x21c/0x10c0 fs/f2fs/file.c:791 f2fs_truncate_blocks+0x10a/0x300 fs/f2fs/file.c:867 f2fs_truncate+0x489/0x7c0 fs/f2fs/file.c:925 f2fs_evict_inode+0x9f2/0x1b60 fs/f2fs/inode.c:897 evict+0x504/0x9c0 fs/inode.c:810 f2fs_evict_inode+0x1dc/0x1b60 fs/f2fs/inode.c:853 evict+0x504/0x9c0 fs/inode.c:810 dispose_list fs/inode.c:852 [inline] prune_icache_sb+0x21b/0x2c0 fs/inode.c:1000 super_cache_scan+0x39b/0x4b0 fs/super.c:224 do_shrink_slab+0x6ef/0x1110 mm/shrinker.c:437 shrink_slab_memcg mm/shrinker.c:550 [inline] shrink_slab+0x7ef/0x10d0 mm/shrinker.c:628 shrink_one+0x28a/0x7c0 mm/vmscan.c:4955 shrink_many mm/vmscan.c:5016 [inline] lru_gen_shrink_node mm/vmscan.c:5094 [inline] shrink_node+0x315d/0x3780 mm/vmscan.c:6081 kswapd_shrink_node mm/vmscan.c:6941 [inline] balance_pgdat mm/vmscan.c:7124 [inline] kswapd+0x147c/0x2800 mm/vmscan.c:7389 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> The root cause is deadlock among four locks as below: kswapd - fs_reclaim --- Lock A - shrink_one - evict - f2fs_evict_inode - sb_start_intwrite --- Lock B - iput - evict - f2fs_evict_inode - sb_start_intwrite --- Lock B - f2fs_truncate - f2fs_truncate_blocks - f2fs_do_truncate_blocks - f2fs_lock_op --- Lock C ioctl - f2fs_ioc_commit_atomic_write - f2fs_lock_op --- Lock C - __f2fs_commit_atomic_write - __replace_atomic_write_block - f2fs_get_dnode_of_data - __get_node_folio - f2fs_check_nid_range - f2fs_handle_error - f2fs_record_errors - f2fs_down_write --- Lock D open - do_open - do_truncate - security_inode_need_killpriv - f2fs_getxattr - lookup_all_xattrs - f2fs_handle_error - f2fs_record_errors - f2fs_down_write --- Lock D - f2fs_commit_super - read_mapping_folio - filemap_alloc_folio_noprof - prepare_alloc_pages - fs_reclaim_acquire --- Lock A In order to avoid such deadlock, we need to avoid grabbing sb_lock in f2fs_handle_error(), so, let's use asynchronous method instead: - remove f2fs_handle_error() implementation - rename f2fs_handle_error_async() to f2fs_handle_error() - spread f2fs_handle_error() Fixes: 95fa90c9e5a7 ("f2fs: support recording errors into superblock") Cc: stable(a)kernel.org Reported-by: syzbot+14b90e1156b9f6fc1266(a)syzkaller.appspotmail.com Closes: https://lore.kernel.org/linux-f2fs-devel/68eae49b.050a0220.ac43.0001.GAE@go… Reported-by: Jiaming Zhang <r772577952(a)gmail.com> Closes: https://lore.kernel.org/lkml/CANypQFa-Gy9sD-N35o3PC+FystOWkNuN8pv6S75HLT0ga… Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: fs/f2fs/super.c [Context conflicts due to ummerged commit: 0b8eb814e058 ("f2fs: use f2fs_err_ratelimited() to avoid redundant logs")] Signed-off-by: Pan Taixi <pantaixi1(a)huawei.com> --- fs/f2fs/compress.c | 5 +---- fs/f2fs/f2fs.h | 1 - fs/f2fs/super.c | 40 ---------------------------------------- 3 files changed, 1 insertion(+), 45 deletions(-) diff --git a/fs/f2fs/compress.c b/fs/f2fs/compress.c index 1dd043330b00..89890f54e781 100644 --- a/fs/f2fs/compress.c +++ b/fs/f2fs/compress.c @@ -755,10 +755,7 @@ void f2fs_decompress_cluster(struct decompress_io_ctx *dic, bool in_task) ret = -EFSCORRUPTED; /* Avoid f2fs_commit_super in irq context */ - if (!in_task) - f2fs_handle_error_async(sbi, ERROR_FAIL_DECOMPRESSION); - else - f2fs_handle_error(sbi, ERROR_FAIL_DECOMPRESSION); + f2fs_handle_error(sbi, ERROR_FAIL_DECOMPRESSION); goto out_release; } diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h index fa9d1b3efcce..df30000e7f18 100644 --- a/fs/f2fs/f2fs.h +++ b/fs/f2fs/f2fs.h @@ -3633,7 +3633,6 @@ void f2fs_quota_off_umount(struct super_block *sb); void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag); void f2fs_handle_critical_error(struct f2fs_sb_info *sbi, unsigned char reason); void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error); -void f2fs_handle_error_async(struct f2fs_sb_info *sbi, unsigned char error); int f2fs_commit_super(struct f2fs_sb_info *sbi, bool recover); int f2fs_sync_fs(struct super_block *sb, int sync); int f2fs_sanity_check_ckpt(struct f2fs_sb_info *sbi); diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c index 92a3b592e936..2981d11ed2e8 100644 --- a/fs/f2fs/super.c +++ b/fs/f2fs/super.c @@ -4083,47 +4083,7 @@ void f2fs_save_errors(struct f2fs_sb_info *sbi, unsigned char flag) spin_unlock_irqrestore(&sbi->error_lock, flags); } -static bool f2fs_update_errors(struct f2fs_sb_info *sbi) -{ - unsigned long flags; - bool need_update = false; - - spin_lock_irqsave(&sbi->error_lock, flags); - if (sbi->error_dirty) { - memcpy(F2FS_RAW_SUPER(sbi)->s_errors, sbi->errors, - MAX_F2FS_ERRORS); - sbi->error_dirty = false; - need_update = true; - } - spin_unlock_irqrestore(&sbi->error_lock, flags); - - return need_update; -} - -static void f2fs_record_errors(struct f2fs_sb_info *sbi, unsigned char error) -{ - int err; - - f2fs_down_write(&sbi->sb_lock); - - if (!f2fs_update_errors(sbi)) - goto out_unlock; - - err = f2fs_commit_super(sbi, false); - if (err) - f2fs_err(sbi, "f2fs_commit_super fails to record errors:%u, err:%d", - error, err); -out_unlock: - f2fs_up_write(&sbi->sb_lock); -} - void f2fs_handle_error(struct f2fs_sb_info *sbi, unsigned char error) -{ - f2fs_save_errors(sbi, error); - f2fs_record_errors(sbi, error); -} - -void f2fs_handle_error_async(struct f2fs_sb_info *sbi, unsigned char error) { f2fs_save_errors(sbi, error); -- 2.34.1

2 1

[PATCH OLK-6.6] svcrdma: bound check rq_pages index in inline path
by Li Xiasong 31 Jan '26

31 Jan '26

From: Joshua Rogers <linux(a)joshua.hu> stable inclusion from stable-v6.6.120 commit 7ba826aae1d43212f3baa53a2175ad949e21926e category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/13379 CVE: CVE-2025-71068 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d1bea0ce35b6095544ee82bb54156fc62c067e58 ] svc_rdma_copy_inline_range indexed rqstp->rq_pages[rc_curpage] without verifying rc_curpage stays within the allocated page array. Add guards before the first use and after advancing to a new page. Fixes: d7cc73972661 ("svcrdma: support multiple Read chunks per RPC") Cc: stable(a)vger.kernel.org Signed-off-by: Joshua Rogers <linux(a)joshua.hu> Signed-off-by: Chuck Lever <chuck.lever(a)oracle.com> [ adapted rc_curpage and rq_maxpages fields to ri_pageno and RPCSVC_MAXPAGES constant ] Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Li Xiasong <lixiasong1(a)huawei.com> --- net/sunrpc/xprtrdma/svc_rdma_rw.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c index e460e25a1d6d..249a17c7e82b 100644 --- a/net/sunrpc/xprtrdma/svc_rdma_rw.c +++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c @@ -815,6 +815,9 @@ static int svc_rdma_copy_inline_range(struct svc_rdma_read_info *info, for (page_no = 0; page_no < numpages; page_no++) { unsigned int page_len; + if (info->ri_pageno >= RPCSVC_MAXPAGES) + return -EINVAL; + page_len = min_t(unsigned int, remaining, PAGE_SIZE - info->ri_pageoff); -- 2.34.1

2 1