- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] ubi: Fix return value overwrite issue in try_write_vid_and_data()
by ZhaoLong Wang 08 Jul '23

08 Jul '23

From: Wang YanQing <udknight(a)gmail.com> mainline inclusion from mainline-v6.2-rc1 commit 31a149d5c13c4cbcf97de3435817263a2d8c9d6e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7JO2R CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… ---------------------------------------- The commit 2d78aee426d8 ("UBI: simplify LEB write and atomic LEB change code") adds helper function, try_write_vid_and_data(), to simplify the code, but this helper function has bug, it will return 0 (success) when ubi_io_write_vid_hdr() or the ubi_io_write_data() return error number (-EIO, etc), because the return value of ubi_wl_put_peb() will overwrite the original return value. This issue will cause unexpected data loss issue, because the caller of this function and UBIFS willn't know the data is lost. Fixes: 2d78aee426d8 ("UBI: simplify LEB write and atomic LEB change code") Cc: stable(a)vger.kernel.org Signed-off-by: Wang YanQing <udknight(a)gmail.com> Reviewed-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Signed-off-by: Richard Weinberger <richard(a)nod.at> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> --- drivers/mtd/ubi/eba.c | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c index 0edecfdbd01f..b4cdf2351cac 100644 --- a/drivers/mtd/ubi/eba.c +++ b/drivers/mtd/ubi/eba.c @@ -947,7 +947,7 @@ static int try_write_vid_and_data(struct ubi_volume *vol, int lnum, int offset, int len) { struct ubi_device *ubi = vol->ubi; - int pnum, opnum, err, vol_id = vol->vol_id; + int pnum, opnum, err, err2, vol_id = vol->vol_id; pnum = ubi_wl_get_peb(ubi); if (pnum < 0) { @@ -982,10 +982,19 @@ static int try_write_vid_and_data(struct ubi_volume *vol, int lnum, out_put: up_read(&ubi->fm_eba_sem); - if (err && pnum >= 0) - err = ubi_wl_put_peb(ubi, vol_id, lnum, pnum, 1); - else if (!err && opnum >= 0) - err = ubi_wl_put_peb(ubi, vol_id, lnum, opnum, 0); + if (err && pnum >= 0) { + err2 = ubi_wl_put_peb(ubi, vol_id, lnum, pnum, 1); + if (err2) { + ubi_warn(ubi, "failed to return physical eraseblock %d, error %d", + pnum, err2); + } + } else if (!err && opnum >= 0) { + err2 = ubi_wl_put_peb(ubi, vol_id, lnum, opnum, 0); + if (err2) { + ubi_warn(ubi, "failed to return physical eraseblock %d, error %d", + opnum, err2); + } + } return err; } -- 2.31.1

2 1

[PATCH OLK-5.10 0/2] ubifs mainline bugfix patch backport
by ZhaoLong Wang 08 Jul '23

08 Jul '23

ISSUE: https://gitee.com/openeuler/kernel/issues/I7JO0G 1. ubifs: Fix memory leak in do_rename 2. ubifs: Free memory for tmpfile name Mårten Lindahl (2): ubifs: Free memory for tmpfile name ubifs: Fix memory leak in do_rename fs/ubifs/dir.c | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) -- 2.31.1

2 3

[PATCH OLK-5.10] [Backport] SUNRPC: Ensure that the gssproxy client can start in a connected state
by Wang Hai 08 Jul '23

08 Jul '23

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> mainline inclusion from mainline-v5.18-rc7 commit fd13359f54ee854f00134abc6be32da94ec53dbf category: bugfix bugzilla: 186837 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Ensure that the gssproxy client connects to the server from the gssproxy daemon process context so that the AF_LOCAL socket connection is done using the correct path and namespaces. Fixes: 1d658336b05f ("SUNRPC: Add RPC based upcall mechanism for RPCGSS auth") Cc: stable(a)vger.kernel.org Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> conflict: net/sunrpc/clnt.c Signed-off-by: Wang Hai <wanghai38(a)huawei.com> --- include/linux/sunrpc/clnt.h | 1 + net/sunrpc/auth_gss/gss_rpc_upcall.c | 1 + net/sunrpc/clnt.c | 33 ++++++++++++++++++++++++++++ 3 files changed, 35 insertions(+) diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h index a28300e18fe3..b7b1abe3e048 100644 --- a/include/linux/sunrpc/clnt.h +++ b/include/linux/sunrpc/clnt.h @@ -164,6 +164,7 @@ struct rpc_add_xprt_test { #define RPC_CLNT_CREATE_NO_RETRANS_TIMEOUT (1UL << 9) #define RPC_CLNT_CREATE_SOFTERR (1UL << 10) #define RPC_CLNT_CREATE_REUSEPORT (1UL << 11) +#define RPC_CLNT_CREATE_CONNECTED (1UL << 12) struct rpc_clnt *rpc_create(struct rpc_create_args *args); struct rpc_clnt *rpc_bind_new_program(struct rpc_clnt *, diff --git a/net/sunrpc/auth_gss/gss_rpc_upcall.c b/net/sunrpc/auth_gss/gss_rpc_upcall.c index af9c7f43859c..366968f5b619 100644 --- a/net/sunrpc/auth_gss/gss_rpc_upcall.c +++ b/net/sunrpc/auth_gss/gss_rpc_upcall.c @@ -98,6 +98,7 @@ static int gssp_rpc_create(struct net *net, struct rpc_clnt **_clnt) * done without the correct namespace: */ .flags = RPC_CLNT_CREATE_NOPING | + RPC_CLNT_CREATE_CONNECTED | RPC_CLNT_CREATE_NO_IDLE_TIMEOUT }; struct rpc_clnt *clnt; diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c index 78c6648af782..6fe8cb84638f 100644 --- a/net/sunrpc/clnt.c +++ b/net/sunrpc/clnt.c @@ -75,6 +75,7 @@ static int rpc_encode_header(struct rpc_task *task, static int rpc_decode_header(struct rpc_task *task, struct xdr_stream *xdr); static int rpc_ping(struct rpc_clnt *clnt); +static int rpc_ping_noreply(struct rpc_clnt *clnt); static void rpc_check_timeout(struct rpc_task *task); static void rpc_register_client(struct rpc_clnt *clnt) @@ -479,6 +480,12 @@ static struct rpc_clnt *rpc_create_xprt(struct rpc_create_args *args, rpc_shutdown_client(clnt); return ERR_PTR(err); } + } else if (args->flags & RPC_CLNT_CREATE_CONNECTED) { + int err = rpc_ping_noreply(clnt); + if (err != 0) { + rpc_shutdown_client(clnt); + return ERR_PTR(err); + } } clnt->cl_softrtry = 1; @@ -2674,6 +2681,10 @@ static const struct rpc_procinfo rpcproc_null = { .p_decode = rpcproc_decode_null, }; +static const struct rpc_procinfo rpcproc_null_noreply = { + .p_encode = rpcproc_encode_null, +}; + static int rpc_ping(struct rpc_clnt *clnt) { struct rpc_message msg = { @@ -2685,6 +2696,28 @@ static int rpc_ping(struct rpc_clnt *clnt) return err; } +static int rpc_ping_noreply(struct rpc_clnt *clnt) +{ + struct rpc_message msg = { + .rpc_proc = &rpcproc_null_noreply, + }; + struct rpc_task_setup task_setup_data = { + .rpc_client = clnt, + .rpc_message = &msg, + .callback_ops = &rpc_default_ops, + .flags = RPC_TASK_SOFT | RPC_TASK_SOFTCONN | RPC_TASK_NULLCREDS, + }; + struct rpc_task *task; + int status; + + task = rpc_run_task(&task_setup_data); + if (IS_ERR(task)) + return PTR_ERR(task); + status = task->tk_status; + rpc_put_task(task); + return status; +} + static struct rpc_task *rpc_call_null_helper(struct rpc_clnt *clnt, struct rpc_xprt *xprt, struct rpc_cred *cred, int flags, -- 2.33.0

2 1

[PATCH OLK-5.10] dm thin: fix deadlock when swapping to thin device
by Li Lingfeng 08 Jul '23

08 Jul '23

From: Coly Li <colyli(a)suse.de> mainline inclusion from mainline-v6.3-rc4 commit 9bbf5feecc7eab2c370496c1c161bbfe62084028 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7JLUM CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------- This is an already known issue that dm-thin volume cannot be used as swap, otherwise a deadlock may happen when dm-thin internal memory demand triggers swap I/O on the dm-thin volume itself. But thanks to commit a666e5c05e7c ("dm: fix deadlock when swapping to encrypted device"), the limit_swap_bios target flag can also be used for dm-thin to avoid the recursive I/O when it is used as swap. Fix is to simply set ti->limit_swap_bios to true in both pool_ctr() and thin_ctr(). In my test, I create a dm-thin volume /dev/vg/swap and use it as swap device. Then I run fio on another dm-thin volume /dev/vg/main and use large --blocksize to trigger swap I/O onto /dev/vg/swap. The following fio command line is used in my test, fio --name recursive-swap-io --lockmem 1 --iodepth 128 \ --ioengine libaio --filename /dev/vg/main --rw randrw \ --blocksize 1M --numjobs 32 --time_based --runtime=12h Without this fix, the whole system can be locked up within 15 seconds. With this fix, there is no any deadlock or hung task observed after 2 hours of running fio. Furthermore, if blocksize is changed from 1M to 128M, after around 30 seconds fio has no visible I/O, and the out-of-memory killer message shows up in kernel message. After around 20 minutes all fio processes are killed and the whole system is back to being alive. This is exactly what is expected when recursive I/O happens on dm-thin volume when it is used as swap. Depends-on: a666e5c05e7c ("dm: fix deadlock when swapping to encrypted device") Cc: stable(a)vger.kernel.org Signed-off-by: Coly Li <colyli(a)suse.de> Acked-by: Mikulas Patocka <mpatocka(a)redhat.com> Signed-off-by: Mike Snitzer <snitzer(a)kernel.org> Conflict: drivers/md/dm-thin.c Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/dm-thin.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c index e837839e4def..83ea80774676 100644 --- a/drivers/md/dm-thin.c +++ b/drivers/md/dm-thin.c @@ -3379,6 +3379,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv) pt->low_water_blocks = low_water_blocks; pt->adjusted_pf = pt->requested_pf = pf; ti->num_flush_bios = 1; + ti->limit_swap_bios = true; /* * Only need to enable discards if the pool should pass @@ -4256,6 +4257,7 @@ static int thin_ctr(struct dm_target *ti, unsigned argc, char **argv) goto bad; ti->num_flush_bios = 1; + ti->limit_swap_bios = true; ti->flush_supported = true; ti->per_io_data_size = sizeof(struct dm_thin_endio_hook); -- 2.31.1

2 1

[PATCH OLK-5.10] block: don't set GD_NEED_PART_SCAN if scan partition failed
by Li Lingfeng 08 Jul '23

08 Jul '23

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.3-rc6 commit 3723091ea1884d599cc8b8bf719d6f42e8d4d8b1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7F7J3 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently if disk_scan_partitions() failed, GD_NEED_PART_SCAN will still set, and partition scan will be proceed again when blkdev_get_by_dev() is called. However, this will cause a problem that re-assemble partitioned raid device will creat partition for underlying disk. Test procedure: mdadm -CR /dev/md0 -l 1 -n 2 /dev/sda /dev/sdb -e 1.0 sgdisk -n 0:0:+100MiB /dev/md0 blockdev --rereadpt /dev/sda blockdev --rereadpt /dev/sdb mdadm -S /dev/md0 mdadm -A /dev/md0 /dev/sda /dev/sdb Test result: underlying disk partition and raid partition can be observed at the same time Note that this can still happen in come corner cases that GD_NEED_PART_SCAN can be set for underlying disk while re-assemble raid device. Fixes: e5cfefa97bcc ("block: fix scan partition for exclusively open device again") Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/genhd.c Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- block/genhd.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/block/genhd.c b/block/genhd.c index 3c34dd011585..83f407e1563a 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -770,6 +770,13 @@ int disk_scan_partitions(struct gendisk *disk, fmode_t mode) else blkdev_put(bdev, mode & ~FMODE_EXCL); + /* + * If blkdev_get_by_dev() failed early, GD_NEED_PART_SCAN is still set, + * and this will cause that re-assemble partitioned raid device will + * creat partition for underlying disk. + */ + clear_bit(GD_NEED_PART_SCAN, &disk->state); + if (!(mode & FMODE_EXCL)) { bd_abort_claiming(claim, claim, disk_scan_partitions); bdput(claim); -- 2.31.1

2 1

[PATCH 4.19 00/22] linux-4.19.y inclusion part2
by Yongqiang Liu 07 Jul '23

07 Jul '23

Benedict Wong (1): xfrm: Check if_id in inbound policy/secpath match Cambda Zhu (1): tcp: Return user_mss for TCP_MAXSEG in CLOSE/LISTEN state if user_mss set Eric Dumazet (7): netlink: annotate accesses to nlk->cb_running net: annotate sk->sk_err write from do_recvmmsg() net: datagram: fix data-races in datagram_poll() vlan: fix a potential uninit-value in vlan_dev_hard_start_xmit() af_packet: do not use READ_ONCE() in packet_bind() rfs: annotate lockless accesses to sk->sk_rxhash rfs: annotate lockless accesses to RFS sock flow table Gavrilov Ilia (1): ipv6: Fix out-of-bounds access in ipv6_find_tlv() Guillaume Nault (1): ping6: Fix send to link-local addresses with VRF. Hangyu Hua (1): net: sched: fix possible refcount leak in tc_chain_tmplt_add() Kuniyuki Iwashima (4): af_unix: Fix a data race of sk->sk_receive_queue->qlen. af_unix: Fix data races around sk->sk_shutdown. udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). af_packet: Fix data-races of pkt_sk(sk)->num. Nick Child (1): net: Catch invalid index in XPS mapping Nicolas Dichtel (1): ipv{4,6}/raw: fix output xfrm lookup wrt protocol Paolo Abeni (1): tcp: factor out __tcp_close() helper Pratyush Yadav (1): net: fix skb leak in __skb_tstamp_tx() Tobias Brunner (1): af_key: Reject optional tunnel/BEET mode templates in outbound policies Vladislav Efanov (1): udp6: Fix race condition in udp6_sendmsg & connect include/linux/netdevice.h | 7 +++++-- include/net/ip.h | 2 ++ include/net/sock.h | 18 +++++++++++++----- include/net/tcp.h | 1 + include/uapi/linux/in.h | 2 ++ net/8021q/vlan_dev.c | 4 ++-- net/core/datagram.c | 15 ++++++++++----- net/core/dev.c | 8 ++++++-- net/core/skbuff.c | 4 +++- net/core/sock.c | 2 +- net/ipv4/ip_sockglue.c | 12 +++++++++++- net/ipv4/raw.c | 5 ++++- net/ipv4/tcp.c | 12 +++++++++--- net/ipv4/udplite.c | 2 ++ net/ipv6/exthdrs_core.c | 2 ++ net/ipv6/ping.c | 3 ++- net/ipv6/raw.c | 3 ++- net/ipv6/udplite.c | 2 ++ net/key/af_key.c | 12 ++++++++---- net/netlink/af_netlink.c | 8 ++++---- net/packet/af_packet.c | 8 +++++--- net/packet/diag.c | 2 +- net/sched/cls_api.c | 1 + net/socket.c | 2 +- net/unix/af_unix.c | 22 +++++++++++++--------- net/xfrm/xfrm_policy.c | 11 ++++++----- 26 files changed, 118 insertions(+), 52 deletions(-) -- 2.25.1

1 22

[PATCH openEuler-23.09 v1 0/2] Add initial openeuler_defconfig
by Wei Li 07 Jul '23

07 Jul '23

Add initial openeuler_defconfig of arm64 and x86_64, inheritted from openEuler-22.03-LTS-SP2. Wei Li (2): config: arm64: Add initial openeuler_defconfig config: x86_64: Add initial openeuler_defconfig arch/arm64/configs/openeuler_defconfig | 7815 ++++++++++++++++++++ arch/x86/configs/openeuler_defconfig | 9053 ++++++++++++++++++++++++ 2 files changed, 16868 insertions(+) create mode 100644 arch/arm64/configs/openeuler_defconfig create mode 100644 arch/x86/configs/openeuler_defconfig -- 2.25.1

1 2

[PATCH 4.19 1/7] quota: avoid increasing DQST_LOOKUPS when iterating over dirty/inuse list
by Yongqiang Liu 07 Jul '23

07 Jul '23

From: Chengguang Xu <cgxu519(a)zoho.com.cn> mainline inclusion from mainline-v5.5-rc1 commit 05848db2083d4f232e84e385845dcd98d5c511b2 category: bugfix bugzilla: 188812,https://gitee.com/openeuler/kernel/issues/I7E0YR CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- It is meaningless to increase DQST_LOOKUPS number while iterating over dirty/inuse list, so just avoid it. Link: https://lore.kernel.org/r/20190926083408.4269-1-cgxu519@zoho.com.cn Signed-off-by: Chengguang Xu <cgxu519(a)zoho.com.cn> Signed-off-by: Jan Kara <jack(a)suse.cz> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Yang Erkun <yangerkun(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/quota/dquot.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c index 316f49cbc032..3b02d68d9522 100644 --- a/fs/quota/dquot.c +++ b/fs/quota/dquot.c @@ -589,7 +589,6 @@ int dquot_scan_active(struct super_block *sb, /* Now we have active dquot so we can just increase use count */ atomic_inc(&dquot->dq_count); spin_unlock(&dq_list_lock); - dqstats_inc(DQST_LOOKUPS); dqput(old_dquot); old_dquot = dquot; /* @@ -644,7 +643,6 @@ int dquot_writeback_dquots(struct super_block *sb, int type) * use count */ dqgrab(dquot); spin_unlock(&dq_list_lock); - dqstats_inc(DQST_LOOKUPS); err = sb->dq_op->write_dquot(dquot); if (err) { /* -- 2.25.1

1 6

[PATCH 4.19 00/12] linux-4.19.y inclusion part1
by Yongqiang Liu 07 Jul '23

07 Jul '23

Armin Wolf (1): ACPI: EC: Fix oops when removing custom query handlers Ben Hutchings (1): lib: cpu_rmap: Fix potential use-after-free in irq_cpu_rmap_release() Damien Le Moal (1): scsi: core: Improve scsi_vpd_inquiry() checks Dave Hansen (1): x86/mm: Avoid incomplete Global INVLPG flushes Eli Cohen (1): lib: cpu_rmap: Avoid use after free on rmap->obj array entries Josh Poimboeuf (1): sched: Fix KCSAN noinstr violation Lukas Wunner (1): PCI: pciehp: Fix AB-BA deadlock between reset_lock and device_lock Min-Hua Chen (1): arm64/mm: mark private VM_FAULT_X defines as vm_fault_t Nathan Chancellor (1): kernel/extable.c: use address-of operator on section symbols Theodore Ts'o (1): ext4: improve error recovery code paths in __ext4_remount() Tony Lindgren (1): serial: 8250: Reinit port->pm on port specific driver unbind void0red (1): ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects arch/arm64/mm/fault.c | 4 ++-- arch/x86/include/asm/intel-family.h | 5 +++++ arch/x86/mm/init.c | 25 +++++++++++++++++++++++++ drivers/acpi/acpica/dbnames.c | 3 +++ drivers/acpi/ec.c | 1 + drivers/pci/hotplug/pciehp_pci.c | 15 +++++++++++++++ drivers/scsi/scsi.c | 11 +++++++++-- drivers/tty/serial/8250/8250_core.c | 1 + fs/ext4/super.c | 14 +++++++++++--- include/linux/sched/task_stack.h | 2 +- kernel/extable.c | 3 ++- lib/cpu_rmap.c | 5 ++++- 12 files changed, 79 insertions(+), 10 deletions(-) -- 2.25.1

1 12

[PATCH 4.19 0/9] mainline bugfixes backport
by Yongqiang Liu 07 Jul '23

07 Jul '23

Christoph Hellwig (1): block: return -EBUSY when there are open partitions in blkdev_reread_part Eric Biggers (1): random: fix data race on crng_node_pool Salman Qazi (1): block: Limit number of items taken from the I/O scheduler in one go Sebastian Andrzej Siewior (1): crypto: cryptd - Protect per-CPU resource by disabling BH. Siddh Raman Pant (1): loop: Check for overflow while configuring loop Yu Kuai (2): blk-wbt: make enable_state more accurate block: don't set GD_NEED_PART_SCAN if scan partition failed Zhong Jinghua (2): Revert "loop: Check for overflow while configuring loop" loop: loop_set_status_from_info() check before assignment block/blk-mq-sched.c | 66 ++++++++++++++++++++++++++++++++++--------- block/blk-wbt.c | 7 ++++- block/blk-wbt.h | 12 ++++---- block/genhd.c | 6 ++++ block/ioctl.c | 4 +++ crypto/cryptd.c | 23 ++++++++------- drivers/block/loop.c | 10 +++---- drivers/char/random.c | 42 ++++++++++++++------------- 8 files changed, 113 insertions(+), 57 deletions(-) -- 2.25.1

1 9