- Kernel - mailweb.openeuler.org

[PATCH 0/6] arm64: Initial support for CVADP
by Yang Yingliang 09 Sep '20

09 Sep '20

ARMv8.5 introduces a DC CVADP instruction which cleans the data cache to the point of deep persistence. This series makes the instruction available to userspace and advertises the presence of this CPU feature. At present when CONFIG_ARM64_PMEM is enabled and the CVAP feature is present (ARMv8.2) the CVAP instruction is used (from memcpy_flushcache and arch_wb_cache_pmem). No changes have been made to use CVADP in these functions or similar. As we have moved beyond 32 capabilities we now begin using AT_HWCAP2 for userspace. Tested as follows: $ dmesg | grep "Deep" [ 0.166496] CPU features: detected: Data cache clean to Point of Deep Persistence $ LD_SHOW_AUXV=1 sleep 2>&1 | grep AT_HWCAP AT_HWCAP: ef91ff87 AT_HWCAP2: 0x1 Andrew Murray (6): arm64: HWCAP: add support for AT_HWCAP2 arm64: HWCAP: encapsulate elf_hwcap arm64: Handle trapped DC CVADP arm64: Expose DC CVADP to userspace arm64: add CVADP support to the cache maintenance helper arm64: Advertise ARM64_HAS_DCPODP cpu feature Documentation/arm64/elf_hwcaps.txt | 17 +++- arch/arm64/crypto/aes-ce-ccm-glue.c | 2 +- arch/arm64/crypto/aes-neonbs-glue.c | 2 +- arch/arm64/crypto/chacha20-neon-glue.c | 2 +- arch/arm64/crypto/ghash-ce-glue.c | 6 +- arch/arm64/crypto/sha256-glue.c | 4 +- arch/arm64/include/asm/assembler.h | 4 + arch/arm64/include/asm/cpucaps.h | 3 +- arch/arm64/include/asm/cpufeature.h | 21 ++--- arch/arm64/include/asm/esr.h | 3 +- arch/arm64/include/asm/hwcap.h | 54 +++++++++++- arch/arm64/include/uapi/asm/hwcap.h | 7 +- arch/arm64/kernel/cpufeature.c | 110 +++++++++++++++++-------- arch/arm64/kernel/cpuinfo.c | 3 +- arch/arm64/kernel/fpsimd.c | 4 +- arch/arm64/kernel/traps.c | 3 + drivers/clocksource/arm_arch_timer.c | 8 ++ 17 files changed, 186 insertions(+), 67 deletions(-) -- 2.25.1

1 6

[PATCH 1/3] mm/swap_state: fix a data race in swapin_nr_pages
by Yang Yingliang 09 Sep '20

09 Sep '20

From: Qian Cai <cai(a)lca.pw> mainline inclusion from mainline-v5.8-rc1 commit d6c1f098f2a7ba62627c9bc17cda28f534ef9e4a category: bugfix bugzilla: 35806 CVE: NA ------------------------------------------------- "prev_offset" is a static variable in swapin_nr_pages() that can be accessed concurrently with only mmap_sem held in read mode as noticed by KCSAN, BUG: KCSAN: data-race in swap_cluster_readahead / swap_cluster_readahead write to 0xffffffff92763830 of 8 bytes by task 14795 on cpu 17: swap_cluster_readahead+0x2a6/0x5e0 swapin_readahead+0x92/0x8dc do_swap_page+0x49b/0xf20 __handle_mm_fault+0xcfb/0xd70 handle_mm_fault+0xfc/0x2f0 do_page_fault+0x263/0x715 page_fault+0x34/0x40 1 lock held by (dnf)/14795: #0: ffff897bd2e98858 (&mm->mmap_sem#2){++++}-{3:3}, at: do_page_fault+0x143/0x715 do_user_addr_fault at arch/x86/mm/fault.c:1405 (inlined by) do_page_fault at arch/x86/mm/fault.c:1535 irq event stamp: 83493 count_memcg_event_mm+0x1a6/0x270 count_memcg_event_mm+0x119/0x270 __do_softirq+0x365/0x589 irq_exit+0xa2/0xc0 read to 0xffffffff92763830 of 8 bytes by task 1 on cpu 22: swap_cluster_readahead+0xfd/0x5e0 swapin_readahead+0x92/0x8dc do_swap_page+0x49b/0xf20 __handle_mm_fault+0xcfb/0xd70 handle_mm_fault+0xfc/0x2f0 do_page_fault+0x263/0x715 page_fault+0x34/0x40 1 lock held by systemd/1: #0: ffff897c38f14858 (&mm->mmap_sem#2){++++}-{3:3}, at: do_page_fault+0x143/0x715 irq event stamp: 43530289 count_memcg_event_mm+0x1a6/0x270 count_memcg_event_mm+0x119/0x270 __do_softirq+0x365/0x589 irq_exit+0xa2/0xc0 Signed-off-by: Qian Cai <cai(a)lca.pw> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Cc: Marco Elver <elver(a)google.com> Cc: Hugh Dickins <hughd(a)google.com> Link: http://lkml.kernel.org/r/20200402213748.2237-1-cai@lca.pw Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/swap_state.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mm/swap_state.c b/mm/swap_state.c index b776b472974c..2137e2d57196 100644 --- a/mm/swap_state.c +++ b/mm/swap_state.c @@ -548,10 +548,11 @@ static unsigned long swapin_nr_pages(unsigned long offset) return 1; hits = atomic_xchg(&swapin_readahead_hits, 0); - pages = __swapin_nr_pages(prev_offset, offset, hits, max_pages, + pages = __swapin_nr_pages(READ_ONCE(prev_offset), offset, hits, + max_pages, atomic_read(&last_readahead_pages)); if (!hits) - prev_offset = offset; + WRITE_ONCE(prev_offset, offset); atomic_set(&last_readahead_pages, pages); return pages; -- 2.25.1

1 2

[PATCH 0/4] arm64: perf: Add support for ARMv8.5-PMU
by Yang Yingliang 09 Sep '20

09 Sep '20

Backport perf support patches for ARMv8.5-PMU. Andrew Murray (3): arm64: cpufeature: Extract capped perfmon fields KVM: arm64: limit PMU version to PMUv3 for ARMv8.1 arm64: perf: Add support for ARMv8.5-PMU 64-bit counters Robin Murphy (1): arm64: perf: Clean up enable/disable calls arch/arm64/include/asm/cpufeature.h | 23 ++++ arch/arm64/include/asm/perf_event.h | 3 +- arch/arm64/include/asm/sysreg.h | 10 ++ arch/arm64/kernel/perf_event.c | 170 +++++++++++++++++----------- arch/arm64/kvm/sys_regs.c | 10 ++ include/linux/perf/arm_pmu.h | 1 + 6 files changed, 150 insertions(+), 67 deletions(-) -- 2.25.1

1 4

[PATCH 0/8] ARMv8.4 TTL feature
by Yang Yingliang 09 Sep '20

09 Sep '20

ARMv8.4 TTL feature. Catalin Marinas (1): arm64: Shift the __tlbi_level() indentation left Marc Zyngier (2): arm64: Detect the ARMv8.4 TTL feature arm64: Add level-hinted TLB invalidation helper Peter Zijlstra (Intel) (1): tlb: mmu_gather: add tlb_flush_*_range APIs Zhenyu Ye (4): arm64: Add tlbi_user_level TLB invalidation helper arm64: tlb: Set the TTL field in flush_tlb_range arm64: tlb: Set the TTL field in flush_*_tlb_range arm64: tlb: don't set the ttl value in flush_tlb_page_nosync arch/arm64/include/asm/cpucaps.h | 3 +- arch/arm64/include/asm/pgtable.h | 10 ++++ arch/arm64/include/asm/stage2_pgtable.h | 9 ++++ arch/arm64/include/asm/sysreg.h | 1 + arch/arm64/include/asm/tlb.h | 29 +++++++++++- arch/arm64/include/asm/tlbflush.h | 63 ++++++++++++++++++++++--- arch/arm64/kernel/cpufeature.c | 11 +++++ include/asm-generic/tlb.h | 55 +++++++++++++++------ 8 files changed, 158 insertions(+), 23 deletions(-) -- 2.25.1

1 8

BPF 新特性合入openEuler内核策略讨论
by 陆志浩 09 Sep '20

09 Sep '20

Hi： BPF 特性在上游内核社区非常活跃，该特性在网络、内核维护、容器、安全等方面都有使用价值，当前openEuler 4.19内核的BPF特性相较最新版本比较陈旧，不利于下游场景的一些价值场景的业务开发。我希望在openEuler 4.19内核版本逐步合入BPF最新特性，并且长期更新BPF最新特性及bugfix。 PS: 会上提供BPF新特性列表以及相关的文件列表范围，初步给出对周边模块的影响性。 by luzhihao

1 0

[PATCH] net: hns3: fix ping failed after S3 since removing HNAE3_RESTORE_CLIENT
by Yonglong Liu 09 Sep '20

09 Sep '20

commit: 412c29318f9b ("net: hns3: refactor the MAC address configure") removed the operation of HNAE3_RESTORE_CLIENT, so after S3 or S4, the MAC address is missing, then cause ping failed. According to the commit, need to assign a reset type to restore the MAC address. Signed-off-by: Yonglong Liu <liuyonglong(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index 823f161..ac1789e 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -3850,6 +3850,11 @@ static int hclge_resume(struct hnae3_ae_dev *ae_dev) rtnl_lock(); + memset(hdev->vlan_table, 0, sizeof(hdev->vlan_table)); + memset(hdev->vf_vlan_full, 0, sizeof(hdev->vf_vlan_full)); + bitmap_set(hdev->vport_config_block, 0, hdev->num_alloc_vport); + hclge_reset_umv_space(hdev); + ret = hclge_reset_ae_dev(hdev->ae_dev); if (ret) goto err_reset_lock; -- 2.8.1

1 0

[PATCH] net: hns3: fix ping failed after S3 since removing HNAE3_RESTORE_CLIENT
by Yonglong Liu 08 Sep '20

08 Sep '20

commit: 412c29318f9b ("net: hns3: refactor the MAC address configure") removed the operation of HNAE3_RESTORE_CLIENT, so after S3 or S4, the MAC address is missing, then cause ping failed. According to the commit, need to assign a reset type to restore the MAC address. Signed-off-by: Yonglong Liu <liuyonglong(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index 823f161..25aee93 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -3850,6 +3850,8 @@ static int hclge_resume(struct hnae3_ae_dev *ae_dev) rtnl_lock(); + hdev->reset_type = HNAE3_GLOBAL_RESET; + ret = hclge_reset_ae_dev(hdev->ae_dev); if (ret) goto err_reset_lock; -- 2.8.1

1 1

[PATCH 00/72] backport stable-4.19.142
by Yang Yingliang 08 Sep '20

08 Sep '20

Al Viro (1): do_epoll_ctl(): clean the failure exits up a bit Alex Williamson (1): vfio/type1: Add proper error unwind for vfio_iommu_replay() Bodo Stroesser (1): scsi: target: tcmu: Fix crash in tcmu_flush_dcache_range on ARM Charan Teja Reddy (1): mm, page_alloc: fix core hung in free_pcppages_bulk() Chris Wilson (1): drm/vgem: Replace opencoded version of drm_gem_dumb_map_offset() Chuck Lever (1): svcrdma: Fix another Receive buffer leak Chuhong Yuan (1): media: budget-core: Improve exception handling in budget_register() Cong Wang (1): bonding: fix a potential double-unregister Darrick J. Wong (1): xfs: fix inode quota reservation checks David Howells (1): afs: Fix NULL deref in afs_dynroot_depopulate() Dinghao Liu (1): ASoC: intel: Fix memleak in sst_media_open Doug Berger (1): mm: include CMA pages in lowmem_reserve at boot Eiichi Tsukata (1): xfs: Fix UBSAN null-ptr-deref in xfs_sysfs_init Eric Sandeen (1): ext4: fix potential negative array index in do_split() Evgeny Novikov (1): media: vpss: clean up resources in init Fugang Duan (1): net: fec: correct the error path for regulator disable in probe Gaurav Singh (1): tools/testing/selftests/cgroup/cgroup_util.c: cg_read_strcmp: fix null pointer dereference Greg Kroah-Hartman (1): Linux 4.19.142 Greg Ungerer (1): m68knommu: fix overwriting of bits in ColdFire V3 cache control Grzegorz Szczurek (1): i40e: Fix crash during removing i40e driver Haiyang Zhang (1): hv_netvsc: Fix the queue_mapping in netvsc_vf_xmit() Heiko Carstens (2): s390/runtime_instrumentation: fix storage key handling s390/ptrace: fix storage key handling Helge Deller (1): fs/signalfd.c: fix inconsistent return codes for signalfd4 Huacai Chen (1): rtc: goldfish: Enable interrupt in set_alarm() when necessary Hugh Dickins (2): khugepaged: khugepaged_test_exit() check mmget_still_valid() khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter() Jan Kara (1): ext4: fix checking of directory entry validity for inline directories Jann Horn (1): romfs: fix uninitialized memory leak in romfs_dev_read() Jarod Wilson (1): bonding: show saner speed for broadcast mode Javed Hasan (1): scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases Jim Mattson (2): kvm: x86: Toggling CR4.SMAP does not load PDPTEs in PAE mode kvm: x86: Toggling CR4.PKE does not load PDPTEs in PAE mode Jiri Wiesner (1): bonding: fix active-backup failover for current ARP slave Josef Bacik (2): btrfs: don't show full path of bind mounts in subvol= btrfs: sysfs: use NOFS for device creation Juergen Gross (2): efi: avoid error message when booting under Xen xen: don't reschedule in preemption off sections Krunoslav Kovac (1): drm/amd/display: fix pow() crashing when given base 0 Li Heng (1): efi: add missed destroy_workqueue when efisubsys_init fails Liang Chen (1): kthread: Do not preempt current task if it is going to call schedule() Luc Van Oostenryck (1): alpha: fix annotation of io{read,write}{16,32}be() Lukas Wunner (1): spi: Prevent adding devices below an unregistering controller Mao Wenan (1): virtio_ring: Avoid loop when vq is broken in virtqueue_poll Marc Zyngier (1): epoll: Keep a reference on files added to the check list Marcos Paulo de Souza (1): btrfs: export helpers for subvolume name/id resolution Masahiro Yamada (2): kconfig: qconf: do not limit the pop-up menu to the first row kconfig: qconf: fix signal connection to invalid slots Masami Hiramatsu (1): perf probe: Fix memory leakage when the probe point is not found Nikolay Borisov (1): btrfs: Move free_pages_out label in inline extent handling branch in compress_file_range Peter Xu (1): mm/hugetlb: fix calculation of adjust_range_if_pmd_sharing_possible Przemyslaw Patynowski (1): i40e: Set RX_ONLY mode for unicast promiscuous on VLAN Qu Wenruo (1): btrfs: inode: fix NULL pointer dereference if inode doesn't need compression Randy Dunlap (1): Fix build error when CONFIG_ACPI is not set/enabled: Selvin Xavier (1): RDMA/bnxt_re: Do not add user qps to flushlist Shay Agroskin (1): net: ena: Prevent reset after device destruction Srinivas Kandagatla (2): ASoC: q6routing: add dummy register read/write function ASoC: msm8916-wcd-analog: fix register Interrupt offset Srinivas Pandruvada (1): cpufreq: intel_pstate: Fix cpuinfo_max_freq when MSR_TURBO_RATIO_LIMIT is 0 Stanley Chu (1): scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices Steffen Maier (1): scsi: zfcp: Fix use-after-free in request timeout handlers Stephen Boyd (1): clk: Evict unregistered clks from parent caches Tom Rix (1): net: dsa: b53: check for timeout Vasant Hegde (1): powerpc/pseries: Do not initiate shutdown when system is running on UPS Wang Hai (1): net: gemini: Fix missing free_netdev() in error path of gemini_ethernet_port_probe() Wei Yongjun (1): kernel/relay.c: fix memleak on destroy relay channel Will Deacon (2): KVM: Pass MMU notifier range flags to kvm_unmap_hva_range() KVM: arm64: Only reschedule if MMU_NOTIFIER_RANGE_BLOCKABLE is not set Xiongfeng Wang (1): Input: psmouse - add a newline when printing 'proto' by sysfs Xiubo Li (1): ceph: fix use-after-free for fsc->mdsc Zhe Li (1): jffs2: fix UAF problem zhangyi (F) (1): jbd2: add the missing unlock_buffer() in the error path of jbd2_write_superblock() Makefile | 2 +- arch/alpha/include/asm/io.h | 8 +-- arch/arm/include/asm/kvm_host.h | 2 +- arch/arm64/include/asm/kvm_host.h | 2 +- arch/m68k/include/asm/m53xxacr.h | 6 +- arch/mips/include/asm/kvm_host.h | 2 +- arch/mips/kvm/mmu.c | 3 +- arch/powerpc/include/asm/kvm_host.h | 3 +- arch/powerpc/kvm/book3s.c | 3 +- arch/powerpc/kvm/e500_mmu_host.c | 3 +- arch/powerpc/platforms/pseries/ras.c | 1 - arch/s390/kernel/ptrace.c | 7 +- arch/s390/kernel/runtime_instr.c | 2 +- arch/x86/include/asm/kvm_host.h | 3 +- arch/x86/kvm/mmu.c | 3 +- arch/x86/kvm/x86.c | 2 +- arch/x86/pci/xen.c | 1 + drivers/clk/clk.c | 52 +++++++++++--- drivers/cpufreq/intel_pstate.c | 1 + drivers/firmware/efi/efi.c | 2 + .../gpu/drm/amd/display/include/fixed31_32.h | 3 + drivers/gpu/drm/vgem/vgem_drv.c | 27 ------- drivers/infiniband/hw/bnxt_re/main.c | 3 +- drivers/input/mouse/psmouse-base.c | 2 +- drivers/media/pci/ttpci/budget-core.c | 11 ++- drivers/media/platform/davinci/vpss.c | 20 ++++-- drivers/net/bonding/bond_main.c | 42 +++++++++-- drivers/net/dsa/b53/b53_common.c | 2 + drivers/net/ethernet/amazon/ena/ena_netdev.c | 19 ++--- drivers/net/ethernet/cortina/gemini.c | 4 +- drivers/net/ethernet/freescale/fec_main.c | 4 +- .../net/ethernet/intel/i40e/i40e_adminq_cmd.h | 2 +- drivers/net/ethernet/intel/i40e/i40e_common.c | 35 ++++++--- drivers/net/ethernet/intel/i40e/i40e_main.c | 3 + drivers/net/hyperv/netvsc_drv.c | 2 +- drivers/rtc/rtc-goldfish.c | 1 + drivers/s390/scsi/zfcp_fsf.c | 4 +- drivers/scsi/libfc/fc_disc.c | 12 +++- drivers/scsi/ufs/ufs_quirks.h | 1 + drivers/scsi/ufs/ufshcd.c | 2 + drivers/spi/Kconfig | 3 + drivers/spi/spi.c | 21 +++++- drivers/target/target_core_user.c | 2 +- drivers/vfio/vfio_iommu_type1.c | 71 +++++++++++++++++-- drivers/video/fbdev/efifb.c | 2 +- drivers/virtio/virtio_ring.c | 3 + drivers/xen/preempt.c | 2 +- fs/afs/dynroot.c | 20 +++--- fs/btrfs/ctree.h | 2 + fs/btrfs/export.c | 8 +-- fs/btrfs/export.h | 5 ++ fs/btrfs/inode.c | 23 +++--- fs/btrfs/super.c | 18 +++-- fs/btrfs/sysfs.c | 4 ++ fs/ceph/mds_client.c | 3 +- fs/eventpoll.c | 19 ++--- fs/ext4/namei.c | 22 ++++-- fs/jbd2/journal.c | 4 +- fs/jffs2/dir.c | 6 +- fs/romfs/storage.c | 4 +- fs/signalfd.c | 10 +-- fs/xfs/xfs_sysfs.h | 6 +- fs/xfs/xfs_trans_dquot.c | 2 +- kernel/kthread.c | 17 ++++- kernel/relay.c | 1 + mm/hugetlb.c | 24 +++---- mm/khugepaged.c | 7 +- mm/page_alloc.c | 7 +- net/sunrpc/xprtrdma/svc_rdma_recvfrom.c | 2 + scripts/kconfig/qconf.cc | 70 +++++++++--------- sound/soc/codecs/msm8916-wcd-analog.c | 4 +- sound/soc/intel/atom/sst-mfld-platform-pcm.c | 5 +- sound/soc/qcom/qdsp6/q6routing.c | 16 +++++ tools/perf/util/probe-finder.c | 2 +- tools/testing/selftests/cgroup/cgroup_util.c | 2 +- virt/kvm/arm/mmu.c | 18 +++-- virt/kvm/kvm_main.c | 2 +- 77 files changed, 508 insertions(+), 236 deletions(-) -- 2.25.1

1 72

[PATCH 1/6] can: j1939: fix kernel-infoleak in j1939_sk_sock2sockaddr_can()
by Yang Yingliang 08 Sep '20

08 Sep '20

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v5.9-rc2 commit 38ba8b9241f5848a49b80fddac9ab5f4692e434e category: bugfix bugzilla: 38684 CVE: NA --------------------------- syzbot found that at least 2 bytes of kernel information were leaked during getsockname() on AF_CAN CAN_J1939 socket. Since struct sockaddr_can has in fact two holes, simply clear the whole area before filling it with useful data. BUG: KMSAN: kernel-infoleak in kmsan_copy_to_user+0x81/0x90 mm/kmsan/kmsan_hooks.c:253 CPU: 0 PID: 8466 Comm: syz-executor511 Not tainted 5.8.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x21c/0x280 lib/dump_stack.c:118 kmsan_report+0xf7/0x1e0 mm/kmsan/kmsan_report.c:121 kmsan_internal_check_memory+0x238/0x3d0 mm/kmsan/kmsan.c:423 kmsan_copy_to_user+0x81/0x90 mm/kmsan/kmsan_hooks.c:253 instrument_copy_to_user include/linux/instrumented.h:91 [inline] _copy_to_user+0x18e/0x260 lib/usercopy.c:39 copy_to_user include/linux/uaccess.h:186 [inline] move_addr_to_user+0x3de/0x670 net/socket.c:237 __sys_getsockname+0x407/0x5e0 net/socket.c:1909 __do_sys_getsockname net/socket.c:1920 [inline] __se_sys_getsockname+0x91/0xb0 net/socket.c:1917 __x64_sys_getsockname+0x4a/0x70 net/socket.c:1917 do_syscall_64+0xad/0x160 arch/x86/entry/common.c:386 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x440219 Code: Bad RIP value. RSP: 002b:00007ffe5ee150c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000033 RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440219 RDX: 0000000020000240 RSI: 0000000020000100 RDI: 0000000000000003 RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401a20 R13: 0000000000401ab0 R14: 0000000000000000 R15: 0000000000000000 Local variable ----address@__sys_getsockname created at: __sys_getsockname+0x91/0x5e0 net/socket.c:1894 __sys_getsockname+0x91/0x5e0 net/socket.c:1894 Bytes 2-3 of 24 are uninitialized Memory access of size 24 starts at ffff8880ba2c7de8 Data copied to user address 0000000020000100 Fixes: 9d71dd0c7009 ("can: add support of SAE J1939 protocol") Signed-off-by: Eric Dumazet <edumazet(a)google.com> Reported-by: syzbot <syzkaller(a)googlegroups.com> Cc: Robin van der Gracht <robin(a)protonic.nl> Cc: Oleksij Rempel <o.rempel(a)pengutronix.de> Cc: Pengutronix Kernel Team <kernel(a)pengutronix.de> Cc: linux-can(a)vger.kernel.org Acked-by: Oleksij Rempel <o.rempel(a)pengutronix.de> Link: https://lore.kernel.org/r/20200813161834.4021638-1-edumazet@google.com Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/can/j1939/socket.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/can/j1939/socket.c b/net/can/j1939/socket.c index f7587428febdd..2f4e2142ef268 100644 --- a/net/can/j1939/socket.c +++ b/net/can/j1939/socket.c @@ -553,6 +553,11 @@ static int j1939_sk_connect(struct socket *sock, struct sockaddr *uaddr, static void j1939_sk_sock2sockaddr_can(struct sockaddr_can *addr, const struct j1939_sock *jsk, int peer) { + /* There are two holes (2 bytes and 3 bytes) to clear to avoid + * leaking kernel information to user space. + */ + memset(addr, 0, J1939_MIN_NAMELEN); + addr->can_family = AF_CAN; addr->can_ifindex = jsk->ifindex; addr->can_addr.j1939.pgn = jsk->addr.pgn; -- 2.25.1

1 5

[PATCH 0/4] Support Common Not Private
by Yang Yingliang 08 Sep '20

08 Sep '20

Cheng Jian (1): config: arm64: set defalut value of config CNP Vladimir Murzin (3): arm64: mm: Support Common Not Private translations arm64: KVM: Enable Common Not Private translations arm64: Introduce command line parameter to disable CNP .../admin-guide/kernel-parameters.txt | 4 ++ arch/arm/include/asm/kvm_arm.h | 1 + arch/arm/include/asm/kvm_mmu.h | 5 +++ arch/arm64/Kconfig | 14 ++++++ arch/arm64/configs/euleros_defconfig | 1 + arch/arm64/configs/hulk_defconfig | 1 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/configs/storage_ci_defconfig | 1 + arch/arm64/configs/syzkaller_defconfig | 1 + arch/arm64/include/asm/cpucaps.h | 3 +- arch/arm64/include/asm/cpufeature.h | 6 +++ arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_mmu.h | 5 +++ arch/arm64/include/asm/mmu_context.h | 17 +++++++- arch/arm64/include/asm/pgtable-hwdef.h | 2 + arch/arm64/kernel/cpufeature.c | 43 +++++++++++++++++++ arch/arm64/kernel/suspend.c | 4 ++ arch/arm64/kvm/hyp-init.S | 3 ++ arch/arm64/mm/context.c | 3 ++ arch/arm64/mm/proc.S | 11 +++-- virt/kvm/arm/arm.c | 4 +- 21 files changed, 123 insertions(+), 8 deletions(-) -- 2.25.1

1 4