- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] ubi: fastmap: wl: Schedule fm_work if wear-leveling pool is empty
by Wang Zhaolong 10 Mar '25

10 Mar '25

From: Zhihao Cheng <chengzhihao1(a)huawei.com> mainline inclusion from mainline-v6.13-rc1 commit c4595fe394a289927077e3da561db27811919ee0 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBS8G5 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Since commit 14072ee33d5a ("ubi: fastmap: Check wl_pool for free peb before wear leveling"), wear_leveling_worker() won't schedule fm_work if wear-leveling pool is empty, which could temporarily disable the wear-leveling until the fastmap is updated(eg. pool becomes empty). Fix it by scheduling fm_work if wl_pool is empty during wear-leveing. Fixes: 14072ee33d5a ("ubi: fastmap: Check wl_pool for free peb before wear leveling") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: Wang Zhaolong <wangzhaolong1(a)huawei.com> --- drivers/mtd/ubi/fastmap-wl.c | 19 ++++++++++++++++--- drivers/mtd/ubi/wl.c | 2 +- drivers/mtd/ubi/wl.h | 3 ++- 3 files changed, 19 insertions(+), 5 deletions(-) diff --git a/drivers/mtd/ubi/fastmap-wl.c b/drivers/mtd/ubi/fastmap-wl.c index 2a9cc9413c42..9bdb6525f128 100644 --- a/drivers/mtd/ubi/fastmap-wl.c +++ b/drivers/mtd/ubi/fastmap-wl.c @@ -344,18 +344,31 @@ int ubi_wl_get_peb(struct ubi_device *ubi) /** * next_peb_for_wl - returns next PEB to be used internally by the * WL sub-system. * * @ubi: UBI device description object + * @need_fill: whether to fill wear-leveling pool when no PEBs are found */ -static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi) +static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi, + bool need_fill) { struct ubi_fm_pool *pool = &ubi->fm_wl_pool; int pnum; - if (pool->used == pool->size) + if (pool->used == pool->size) { + if (need_fill && !ubi->fm_work_scheduled) { + /* + * We cannot update the fastmap here because this + * function is called in atomic context. + * Let's fail here and refill/update it as soon as + * possible. + */ + ubi->fm_work_scheduled = 1; + schedule_work(&ubi->fm_work); + } return NULL; + } pnum = pool->pebs[pool->used]; return ubi->lookuptbl[pnum]; } @@ -373,11 +386,11 @@ static bool need_wear_leveling(struct ubi_device *ubi) struct ubi_wl_entry *e; if (!ubi->used.rb_node) return false; - e = next_peb_for_wl(ubi); + e = next_peb_for_wl(ubi, false); if (!e) { if (!ubi->free.rb_node) return false; e = find_wl_entry(ubi, &ubi->free, WL_FREE_MAX_DIFF, 0); ec = e->ec; diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c index b60eea10f68f..97b86fab1466 100644 --- a/drivers/mtd/ubi/wl.c +++ b/drivers/mtd/ubi/wl.c @@ -681,11 +681,11 @@ static int wear_leveling_worker(struct ubi_device *ubi, struct ubi_work *wrk, spin_lock(&ubi->wl_lock); ubi_assert(!ubi->move_from && !ubi->move_to); ubi_assert(!ubi->move_to_put); #ifdef CONFIG_MTD_UBI_FASTMAP - if (!next_peb_for_wl(ubi) || + if (!next_peb_for_wl(ubi, true) || #else if (!ubi->free.rb_node || #endif (!ubi->used.rb_node && !ubi->scrub.rb_node)) { /* diff --git a/drivers/mtd/ubi/wl.h b/drivers/mtd/ubi/wl.h index 7b6715ef6d4a..a69169c35e31 100644 --- a/drivers/mtd/ubi/wl.h +++ b/drivers/mtd/ubi/wl.h @@ -3,11 +3,12 @@ #define UBI_WL_H #ifdef CONFIG_MTD_UBI_FASTMAP static void update_fastmap_work_fn(struct work_struct *wrk); static struct ubi_wl_entry *find_anchor_wl_entry(struct rb_root *root); static struct ubi_wl_entry *get_peb_for_wl(struct ubi_device *ubi); -static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi); +static struct ubi_wl_entry *next_peb_for_wl(struct ubi_device *ubi, + bool need_fill); static bool need_wear_leveling(struct ubi_device *ubi); static void ubi_fastmap_close(struct ubi_device *ubi); static inline void ubi_fastmap_init(struct ubi_device *ubi, int *count) { if (ubi->fm_disabled) -- 2.34.3

2 1

[PATCH OLK-5.10 0/2] CVE-2022-49513
by Zhang Kunbo 10 Mar '25

10 Mar '25

*** BLURB HERE *** Kevin Hao (2): cpufreq: Move to_gov_attr_set() to cpufreq.h cpufreq: governor: Use kobject release() method to free dbs_data drivers/cpufreq/cpufreq_governor.c | 20 +++++++++++++------- drivers/cpufreq/cpufreq_governor.h | 1 + drivers/cpufreq/cpufreq_governor_attr_set.c | 5 ----- include/linux/cpufreq.h | 5 +++++ 4 files changed, 19 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] CVE-2022-49513
by Zhang Kunbo 10 Mar '25

10 Mar '25

*** BLURB HERE *** Kevin Hao (2): cpufreq: Move to_gov_attr_set() to cpufreq.h cpufreq: governor: Use kobject release() method to free dbs_data drivers/cpufreq/cpufreq_governor.c | 20 +++++++++++++------- drivers/cpufreq/cpufreq_governor.h | 1 + drivers/cpufreq/cpufreq_governor_attr_set.c | 5 ----- include/linux/cpufreq.h | 5 +++++ 4 files changed, 19 insertions(+), 12 deletions(-) -- 2.34.1

2 3

[PATCH OLK-6.6] bpf: bpf_local_storage: Always use bpf_mem_alloc in PREEMPT_RT
by Tengda Wu 10 Mar '25

10 Mar '25

From: Martin KaFai Lau <martin.lau(a)kernel.org> stable inclusion from stable-v6.6.76 commit 3392fa605d7c5708c5fbe02e4fbdac547c3b7352 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBREBI CVE: CVE-2024-58070 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 8eef6ac4d70eb1f0099fff93321d90ce8fa49ee1 ] In PREEMPT_RT, kmalloc(GFP_ATOMIC) is still not safe in non preemptible context. bpf_mem_alloc must be used in PREEMPT_RT. This patch is to enforce bpf_mem_alloc in the bpf_local_storage when CONFIG_PREEMPT_RT is enabled. [ 35.118559] BUG: sleeping function called from invalid context at kernel/locking/spinlock_rt.c:48 [ 35.118566] in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 1832, name: test_progs [ 35.118569] preempt_count: 1, expected: 0 [ 35.118571] RCU nest depth: 1, expected: 1 [ 35.118577] INFO: lockdep is turned off. ... [ 35.118647] __might_resched+0x433/0x5b0 [ 35.118677] rt_spin_lock+0xc3/0x290 [ 35.118700] ___slab_alloc+0x72/0xc40 [ 35.118723] __kmalloc_noprof+0x13f/0x4e0 [ 35.118732] bpf_map_kzalloc+0xe5/0x220 [ 35.118740] bpf_selem_alloc+0x1d2/0x7b0 [ 35.118755] bpf_local_storage_update+0x2fa/0x8b0 [ 35.118784] bpf_sk_storage_get_tracing+0x15a/0x1d0 [ 35.118791] bpf_prog_9a118d86fca78ebb_trace_inet_sock_set_state+0x44/0x66 [ 35.118795] bpf_trace_run3+0x222/0x400 [ 35.118820] __bpf_trace_inet_sock_set_state+0x11/0x20 [ 35.118824] trace_inet_sock_set_state+0x112/0x130 [ 35.118830] inet_sk_state_store+0x41/0x90 [ 35.118836] tcp_set_state+0x3b3/0x640 There is no need to adjust the gfp_flags passing to the bpf_mem_cache_alloc_flags() which only honors the GFP_KERNEL. The verifier has ensured GFP_KERNEL is passed only in sleepable context. It has been an old issue since the first introduction of the bpf_local_storage ~5 years ago, so this patch targets the bpf-next. bpf_mem_alloc is needed to solve it, so the Fixes tag is set to the commit when bpf_mem_alloc was first used in the bpf_local_storage. Fixes: 08a7ce384e33 ("bpf: Use bpf_mem_cache_alloc/free in bpf_local_storage_elem") Reported-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Martin KaFai Lau <martin.lau(a)kernel.org> Link: https://lore.kernel.org/r/20241218193000.2084281-1-martin.lau@linux.dev Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Tengda Wu <wutengda2(a)huawei.com> --- kernel/bpf/bpf_local_storage.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/kernel/bpf/bpf_local_storage.c b/kernel/bpf/bpf_local_storage.c index e8d02212da70..b4c6b9b3cb42 100644 --- a/kernel/bpf/bpf_local_storage.c +++ b/kernel/bpf/bpf_local_storage.c @@ -823,8 +823,12 @@ bpf_local_storage_map_alloc(union bpf_attr *attr, smap->elem_size = offsetof(struct bpf_local_storage_elem, sdata.data[attr->value_size]); - smap->bpf_ma = bpf_ma; - if (bpf_ma) { + /* In PREEMPT_RT, kmalloc(GFP_ATOMIC) is still not safe in non + * preemptible context. Thus, enforce all storages to use + * bpf_mem_alloc when CONFIG_PREEMPT_RT is enabled. + */ + smap->bpf_ma = IS_ENABLED(CONFIG_PREEMPT_RT) ? true : bpf_ma; + if (smap->bpf_ma) { err = bpf_mem_alloc_init(&smap->selem_ma, smap->elem_size, false); if (err) goto free_smap; -- 2.34.1

2 1

[openeuler:OLK-5.10 2799/2799] block/bio.c:412: warning: Function parameter or member 'nr_iovecs_int' not described in 'bio_alloc_bioset'
by kernel test robot 10 Mar '25

10 Mar '25

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 2c111a42444b16dfa7f0081facc22e382988eacc commit: 6381672514c4d94637cd4db830b8644440abe99a [2799/2799] block: fix kabi broken config: x86_64-defconfig (https://download.01.org/0day-ci/archive/20250310/202503101424.uyjkGNSl-lkp@…) compiler: gcc-11 (Debian 11.3.0-12) 11.3.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250310/202503101424.uyjkGNSl-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202503101424.uyjkGNSl-lkp@intel.com/ All warnings (new ones prefixed by >>): >> block/bio.c:412: warning: Function parameter or member 'nr_iovecs_int' not described in 'bio_alloc_bioset' >> block/bio.c:412: warning: Excess function parameter 'nr_iovecs' description in 'bio_alloc_bioset' vim +412 block/bio.c df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 374 ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 375 /** ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 376 * bio_alloc_bioset - allocate a bio for I/O 519c8e9ffd86143 block/bio.c Randy Dunlap 2017-10-16 377 * @gfp_mask: the GFP_* mask given to the slab allocator ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 378 * @nr_iovecs: number of iovecs to pre-allocate db18efac0bd644e fs/bio.c Jaak Ristioja 2010-01-15 379 * @bs: the bio_set to allocate from. ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 380 * ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 381 * Description: 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 382 * If @bs is NULL, uses kmalloc() to allocate the bio; else the allocation is 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 383 * backed by the @bs's mempool. 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 384 * d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 385 * When @bs is not NULL, if %__GFP_DIRECT_RECLAIM is set then bio_alloc will d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 386 * always be able to allocate a bio. This is due to the mempool guarantees. d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 387 * To make this work, callers must never allocate more than 1 bio at a time d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 388 * from this pool. Callers that need to allocate more than 1 bio must always d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 389 * submit the previously allocated bio for IO before attempting to allocate d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 390 * a new one. Failure to do so can cause deadlocks under memory pressure. 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 391 * ed00aabd5eb9fb4 block/bio.c Christoph Hellwig 2020-07-01 392 * Note that when running under submit_bio_noacct() (i.e. any block df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 393 * driver), bios are not submitted until after you return - see the code in ed00aabd5eb9fb4 block/bio.c Christoph Hellwig 2020-07-01 394 * submit_bio_noacct() that converts recursion into iteration, to prevent df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 395 * stack overflows. df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 396 * df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 397 * This would normally mean allocating multiple bios under ed00aabd5eb9fb4 block/bio.c Christoph Hellwig 2020-07-01 398 * submit_bio_noacct() would be susceptible to deadlocks, but we have df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 399 * deadlock avoidance code that resubmits any blocked bios from a rescuer df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 400 * thread. df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 401 * df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 402 * However, we do not guarantee forward progress for allocations from other df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 403 * mempools. Doing multiple allocations from the same mempool under ed00aabd5eb9fb4 block/bio.c Christoph Hellwig 2020-07-01 404 * submit_bio_noacct() should be avoided - instead, use bio_set's front_pad df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 405 * for per bio allocations. df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 406 * 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 407 * RETURNS: 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 408 * Pointer to new bio on success, NULL on failure. 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 409 */ 6381672514c4d94 block/bio.c Li Lingfeng 2025-02-10 410 struct bio *bio_alloc_bioset(gfp_t gfp_mask, unsigned int nr_iovecs_int, 7a88fa191944589 block/bio.c Dan Carpenter 2017-03-23 411 struct bio_set *bs) ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 @412 { df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 413 gfp_t saved_gfp = gfp_mask; 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 414 unsigned front_pad; 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 415 unsigned inline_vecs; 34053979fb1d923 fs/bio.c Ingo Molnar 2009-02-21 416 struct bio_vec *bvl = NULL; 451a9ebf653d283 fs/bio.c Tejun Heo 2009-04-15 417 struct bio *bio; 451a9ebf653d283 fs/bio.c Tejun Heo 2009-04-15 418 void *p; 6381672514c4d94 block/bio.c Li Lingfeng 2025-02-10 419 unsigned short nr_iovecs = (unsigned short)nr_iovecs_int; 0a0d96b03a1f3bf fs/bio.c Jens Axboe 2008-09-11 420 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 421 if (!bs) { 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 422 if (nr_iovecs > UIO_MAXIOV) 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 423 return NULL; 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 424 1f4fe21cf45c799 block/bio.c Gustavo A. R. Silva 2020-06-19 425 p = kmalloc(struct_size(bio, bi_inline_vecs, nr_iovecs), gfp_mask); 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 426 front_pad = 0; 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 427 inline_vecs = nr_iovecs; 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 428 } else { d8f429e1669b970 block/bio.c Junichi Nomura 2014-10-03 429 /* should not use nobvec bioset for nr_iovecs > 0 */ 8aa6ba2f6e3deaf block/bio.c Kent Overstreet 2018-05-08 430 if (WARN_ON_ONCE(!mempool_initialized(&bs->bvec_pool) && 8aa6ba2f6e3deaf block/bio.c Kent Overstreet 2018-05-08 431 nr_iovecs > 0)) d8f429e1669b970 block/bio.c Junichi Nomura 2014-10-03 432 return NULL; df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 433 /* ed00aabd5eb9fb4 block/bio.c Christoph Hellwig 2020-07-01 434 * submit_bio_noacct() converts recursion to iteration; this df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 435 * means if we're running beneath it, any bios we allocate and df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 436 * submit will not be submitted (and thus freed) until after we df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 437 * return. df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 438 * df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 439 * This exposes us to a potential deadlock if we allocate df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 440 * multiple bios from the same bio_set() while running ed00aabd5eb9fb4 block/bio.c Christoph Hellwig 2020-07-01 441 * underneath submit_bio_noacct(). If we were to allocate df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 442 * multiple bios (say a stacking block driver that was splitting df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 443 * bios), we would deadlock if we exhausted the mempool's df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 444 * reserve. df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 445 * df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 446 * We solve this, and guarantee forward progress, with a rescuer df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 447 * workqueue per bio_set. If we go to allocate and there are df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 448 * bios on current->bio_list, we first try the allocation d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 449 * without __GFP_DIRECT_RECLAIM; if that fails, we punt those d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 450 * bios we would be blocking to the rescuer workqueue before d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 451 * we retry with the original gfp_flags. df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 452 */ df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 453 f5fe1b51905df7c block/bio.c NeilBrown 2017-03-10 454 if (current->bio_list && f5fe1b51905df7c block/bio.c NeilBrown 2017-03-10 455 (!bio_list_empty(&current->bio_list[0]) || 47e0fb461fca1a6 block/bio.c NeilBrown 2017-06-18 456 !bio_list_empty(&current->bio_list[1])) && 47e0fb461fca1a6 block/bio.c NeilBrown 2017-06-18 457 bs->rescue_workqueue) d0164adc89f6bb3 block/bio.c Mel Gorman 2015-11-06 458 gfp_mask &= ~__GFP_DIRECT_RECLAIM; df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 459 8aa6ba2f6e3deaf block/bio.c Kent Overstreet 2018-05-08 460 p = mempool_alloc(&bs->bio_pool, gfp_mask); df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 461 if (!p && gfp_mask != saved_gfp) { df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 462 punt_bios_to_rescuer(bs); df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 463 gfp_mask = saved_gfp; 8aa6ba2f6e3deaf block/bio.c Kent Overstreet 2018-05-08 464 p = mempool_alloc(&bs->bio_pool, gfp_mask); df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 465 } df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 466 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 467 front_pad = bs->front_pad; 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 468 inline_vecs = BIO_INLINE_VECS; 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 469 } 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 470 451a9ebf653d283 fs/bio.c Tejun Heo 2009-04-15 471 if (unlikely(!p)) 451a9ebf653d283 fs/bio.c Tejun Heo 2009-04-15 472 return NULL; ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 473 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 474 bio = p + front_pad; 3a83f4677539bce block/bio.c Ming Lei 2016-11-22 475 bio_init(bio, NULL, 0); 34053979fb1d923 fs/bio.c Ingo Molnar 2009-02-21 476 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 477 if (nr_iovecs > inline_vecs) { ed996a52c868b62 block/bio.c Christoph Hellwig 2016-07-19 478 958384da6a734eb block/bio.c Christoph Hellwig 2025-02-10 479 bvl = bvec_alloc(&bs->bvec_pool, &nr_iovecs, gfp_mask); df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 480 if (!bvl && gfp_mask != saved_gfp) { df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 481 punt_bios_to_rescuer(bs); df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 482 gfp_mask = saved_gfp; 958384da6a734eb block/bio.c Christoph Hellwig 2025-02-10 483 bvl = bvec_alloc(&bs->bvec_pool, &nr_iovecs, gfp_mask); df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 484 } df2cb6daa4cbc34 fs/bio.c Kent Overstreet 2012-09-10 485 34053979fb1d923 fs/bio.c Ingo Molnar 2009-02-21 486 if (unlikely(!bvl)) 34053979fb1d923 fs/bio.c Ingo Molnar 2009-02-21 487 goto err_free; a38352e0ac02dbb fs/bio.c Kent Overstreet 2012-05-25 488 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 489 } else if (nr_iovecs) { 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 490 bvl = bio->bi_inline_vecs; 392ddc32982a5c6 fs/bio.c Jens Axboe 2008-12-23 491 } 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 492 3f86a82aeb03e61 fs/bio.c Kent Overstreet 2012-09-06 493 bio->bi_pool = bs; 392ddc32982a5c6 fs/bio.c Jens Axboe 2008-12-23 494 bio->bi_max_vecs = nr_iovecs; ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 495 bio->bi_io_vec = bvl; ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 496 return bio; 34053979fb1d923 fs/bio.c Ingo Molnar 2009-02-21 497 34053979fb1d923 fs/bio.c Ingo Molnar 2009-02-21 498 err_free: 8aa6ba2f6e3deaf block/bio.c Kent Overstreet 2018-05-08 499 mempool_free(p, &bs->bio_pool); 34053979fb1d923 fs/bio.c Ingo Molnar 2009-02-21 500 return NULL; ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 501 } a112a71d45b5e40 fs/bio.c H Hartley Sweeten 2009-09-26 502 EXPORT_SYMBOL(bio_alloc_bioset); ^1da177e4c3f415 fs/bio.c Linus Torvalds 2005-04-16 503 :::::: The code at line 412 was first introduced by commit :::::: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Linux-2.6.12-rc2 :::::: TO: Linus Torvalds <torvalds(a)ppc970.osdl.org> :::::: CC: Linus Torvalds <torvalds(a)ppc970.osdl.org> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] ocfs2: handle a symlink read error correctly
by Luo Gengkun 10 Mar '25

10 Mar '25

From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org> mainline inclusion from mainline-v6.14-rc1 commit 2b4c2094da6d84e69b843dd3317902e977bf64bd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8H CVE: CVE-2024-58001 Reference: https://git.kernel.org/stable/c/2b4c2094da6d84e69b843dd3317902e977bf64bd -------------------------------- Patch series "Convert ocfs2 to use folios". Mark did a conversion of ocfs2 to use folios and sent it to me as a giant patch for review ;-) So I've redone it as individual patches, and credited Mark for the patches where his code is substantially the same. It's not a bad way to do it; his patch had some bugs and my patches had some bugs. Hopefully all our bugs were different from each other. And hopefully Mark likes all the changes I made to his code! This patch (of 23): If we can't read the buffer, be sure to unlock the page before returning. Link: https://lkml.kernel.org/r/20241205171653.3179945-1-willy@infradead.org Link: https://lkml.kernel.org/r/20241205171653.3179945-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Mark Tinguely <mark.tinguely(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- fs/ocfs2/symlink.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/ocfs2/symlink.c b/fs/ocfs2/symlink.c index 94cfacc9bad7..f3e80c00ca69 100644 --- a/fs/ocfs2/symlink.c +++ b/fs/ocfs2/symlink.c @@ -66,7 +66,7 @@ static int ocfs2_fast_symlink_readpage(struct file *unused, struct page *page) if (status < 0) { mlog_errno(status); - return status; + goto out; } fe = (struct ocfs2_dinode *) bh->b_data; @@ -77,9 +77,10 @@ static int ocfs2_fast_symlink_readpage(struct file *unused, struct page *page) memcpy(kaddr, link, len + 1); kunmap_atomic(kaddr); SetPageUptodate(page); +out: unlock_page(page); brelse(bh); - return 0; + return status; } const struct address_space_operations ocfs2_fast_symlink_aops = { -- 2.34.1

2 1

[PATCH OLK-5.10 0/7] Some bug fix patches for OLK-5.10 hns RoCE
by Junxian Huang 10 Mar '25

10 Mar '25

From: Xinghai Cen <cenxinghai(a)h-partners.com> Some bug fix patches for OLK-5.10 hns RoCE: Junxian Huang (5): RDMA/hns: Change mtr member to pointer in hns QP/CQ/MR/SRQ/EQ struct RDMA/hns: Move mtr_node into the mtr struct RDMA/hns: Fix delayed destruction of db not taking effect RDMA/hns: Fix delay-destruction mechanism not processing kernel db RDMA/hns: Fix soft lockup by adding cond_resched() to bt pages loop Xinghai Cen (1): RDMA/hns: Fix unmatched kmalloc and kvfree Yuyu Li (1): RDMA/hns: Fix ifnullfree static warning drivers/infiniband/hw/hns/hns_roce_cq.c | 35 ++--- drivers/infiniband/hw/hns/hns_roce_db.c | 86 +++++++---- drivers/infiniband/hw/hns/hns_roce_dca.c | 6 +- drivers/infiniband/hw/hns/hns_roce_device.h | 69 ++++----- drivers/infiniband/hw/hns/hns_roce_ext.c | 3 +- drivers/infiniband/hw/hns/hns_roce_hem.c | 17 ++- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 82 +++++----- drivers/infiniband/hw/hns/hns_roce_main.c | 14 +- drivers/infiniband/hw/hns/hns_roce_mr.c | 144 ++++++++---------- drivers/infiniband/hw/hns/hns_roce_qp.c | 35 ++--- drivers/infiniband/hw/hns/hns_roce_restrack.c | 4 +- drivers/infiniband/hw/hns/hns_roce_srq.c | 63 +++----- 12 files changed, 271 insertions(+), 287 deletions(-) -- 2.33.0

2 8

[PATCH OLK-5.10] NFC: nci: Add bounds checking in nci_hci_create_pipe()
by Yang Yingliang 10 Mar '25

10 Mar '25

From: Dan Carpenter <dan.carpenter(a)linaro.org> mainline inclusion from mainline-v6.14-rc1 commit 110b43ef05342d5a11284cc8b21582b698b4ef1c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8J CVE: CVE-2025-21735 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The "pipe" variable is a u8 which comes from the network. If it's more than 127, then it results in memory corruption in the caller, nci_hci_connect_gate(). Cc: stable(a)vger.kernel.org Fixes: a1b0b9415817 ("NFC: nci: Create pipe on specific gate in nci_hci_connect_gate") Signed-off-by: Dan Carpenter <dan.carpenter(a)linaro.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski(a)linaro.org> Link: https://patch.msgid.link/bcf5453b-7204-4297-9c20-4d8c7dacf586@stanley.mount… Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/nfc/nci/hci.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/nfc/nci/hci.c b/net/nfc/nci/hci.c index 4fe336ff2bfa..f8140488b08a 100644 --- a/net/nfc/nci/hci.c +++ b/net/nfc/nci/hci.c @@ -548,6 +548,8 @@ static u8 nci_hci_create_pipe(struct nci_dev *ndev, u8 dest_host, pr_debug("pipe created=%d\n", pipe); + if (pipe >= NCI_HCI_MAX_PIPES) + pipe = NCI_HCI_INVALID_PIPE; return pipe; } -- 2.25.1

2 1

[PATCH OLK-6.6] ocfs2: handle a symlink read error correctly
by Luo Gengkun 10 Mar '25

10 Mar '25

From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org> stable inclusion from stable-v6.6.78 commit b6833b38984d1e9f20dd80f9ec9050c10d687f30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8H CVE: CVE-2024-58001 Reference: https://git.kernel.org/stable/c/b6833b38984d1e9f20dd80f9ec9050c10d687f30 -------------------------------- commit 2b4c2094da6d84e69b843dd3317902e977bf64bd upstream. Patch series "Convert ocfs2 to use folios". Mark did a conversion of ocfs2 to use folios and sent it to me as a giant patch for review ;-) So I've redone it as individual patches, and credited Mark for the patches where his code is substantially the same. It's not a bad way to do it; his patch had some bugs and my patches had some bugs. Hopefully all our bugs were different from each other. And hopefully Mark likes all the changes I made to his code! This patch (of 23): If we can't read the buffer, be sure to unlock the page before returning. Link: https://lkml.kernel.org/r/20241205171653.3179945-1-willy@infradead.org Link: https://lkml.kernel.org/r/20241205171653.3179945-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Mark Tinguely <mark.tinguely(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- fs/ocfs2/symlink.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/ocfs2/symlink.c b/fs/ocfs2/symlink.c index d4c5fdcfa1e4..f5cf2255dc09 100644 --- a/fs/ocfs2/symlink.c +++ b/fs/ocfs2/symlink.c @@ -65,7 +65,7 @@ static int ocfs2_fast_symlink_read_folio(struct file *f, struct folio *folio) if (status < 0) { mlog_errno(status); - return status; + goto out; } fe = (struct ocfs2_dinode *) bh->b_data; @@ -76,9 +76,10 @@ static int ocfs2_fast_symlink_read_folio(struct file *f, struct folio *folio) memcpy(kaddr, link, len + 1); kunmap_atomic(kaddr); SetPageUptodate(page); +out: unlock_page(page); brelse(bh); - return 0; + return status; } const struct address_space_operations ocfs2_fast_symlink_aops = { -- 2.34.1

2 1

[PATCH OLK-5.10] ocfs2: handle a symlink read error correctly
by Luo Gengkun 10 Mar '25

10 Mar '25

From: "Matthew Wilcox (Oracle)" <willy(a)infradead.org> mainline inclusion from mainline-v6.14-rc1 commit b6833b38984d1e9f20dd80f9ec9050c10d687f30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBPC8H CVE: CVE-2024-58001 Reference: https://git.kernel.org/stable/c/b6833b38984d1e9f20dd80f9ec9050c10d687f30 -------------------------------- commit 2b4c2094da6d84e69b843dd3317902e977bf64bd upstream. Patch series "Convert ocfs2 to use folios". Mark did a conversion of ocfs2 to use folios and sent it to me as a giant patch for review ;-) So I've redone it as individual patches, and credited Mark for the patches where his code is substantially the same. It's not a bad way to do it; his patch had some bugs and my patches had some bugs. Hopefully all our bugs were different from each other. And hopefully Mark likes all the changes I made to his code! This patch (of 23): If we can't read the buffer, be sure to unlock the page before returning. Link: https://lkml.kernel.org/r/20241205171653.3179945-1-willy@infradead.org Link: https://lkml.kernel.org/r/20241205171653.3179945-2-willy@infradead.org Signed-off-by: Matthew Wilcox (Oracle) <willy(a)infradead.org> Reviewed-by: Joseph Qi <joseph.qi(a)linux.alibaba.com> Cc: Mark Fasheh <mark(a)fasheh.com> Cc: Joel Becker <jlbec(a)evilplan.org> Cc: Junxiao Bi <junxiao.bi(a)oracle.com> Cc: Changwei Ge <gechangwei(a)live.cn> Cc: Jun Piao <piaojun(a)huawei.com> Cc: Mark Tinguely <mark.tinguely(a)oracle.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Luo Gengkun <luogengkun2(a)huawei.com> --- fs/ocfs2/symlink.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/ocfs2/symlink.c b/fs/ocfs2/symlink.c index 94cfacc9bad7..f3e80c00ca69 100644 --- a/fs/ocfs2/symlink.c +++ b/fs/ocfs2/symlink.c @@ -66,7 +66,7 @@ static int ocfs2_fast_symlink_readpage(struct file *unused, struct page *page) if (status < 0) { mlog_errno(status); - return status; + goto out; } fe = (struct ocfs2_dinode *) bh->b_data; @@ -77,9 +77,10 @@ static int ocfs2_fast_symlink_readpage(struct file *unused, struct page *page) memcpy(kaddr, link, len + 1); kunmap_atomic(kaddr); SetPageUptodate(page); +out: unlock_page(page); brelse(bh); - return 0; + return status; } const struct address_space_operations ocfs2_fast_symlink_aops = { -- 2.34.1

2 1