- Kernel - mailweb.openeuler.org

[openeuler:openEuler-1.0-LTS 1231/1231] arch/arm64/kernel/mpam/mpam_ctrlmon.c:560:5: warning: no previous prototype for 'resctrl_group_mondata_show'
by kernel test robot 06 Nov '24

06 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: 6892e52d6ed229b7973aae9e1e98819867c34dd7 [1231/1231] arm64/mpam: Split header files into suitable location config: arm64-randconfig-001-20241029 (https://download.01.org/0day-ci/archive/20241106/202411062351.mcuwA9ll-lkp@…) compiler: aarch64-linux-gcc (GCC) 14.1.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411062351.mcuwA9ll-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411062351.mcuwA9ll-lkp@intel.com/ All warnings (new ones prefixed by >>): arch/arm64/kernel/mpam/mpam_ctrlmon.c: In function 'add_schema': arch/arm64/kernel/mpam/mpam_ctrlmon.c:54:37: warning: variable 'sc_hdl' set but not used [-Wunused-but-set-variable] 54 | struct resctrl_schema_ctrl *sc_hdl = NULL; | ^~~~~~ arch/arm64/kernel/mpam/mpam_ctrlmon.c:53:37: warning: variable 'sc_pri' set but not used [-Wunused-but-set-variable] 53 | struct resctrl_schema_ctrl *sc_pri = NULL; | ^~~~~~ arch/arm64/kernel/mpam/mpam_ctrlmon.c: At top level: >> arch/arm64/kernel/mpam/mpam_ctrlmon.c:560:5: warning: no previous prototype for 'resctrl_group_mondata_show' [-Wmissing-prototypes] 560 | int resctrl_group_mondata_show(struct seq_file *m, void *arg) | ^~~~~~~~~~~~~~~~~~~~~~~~~~ arch/arm64/kernel/mpam/mpam_ctrlmon.c: In function 'resctrl_mkdir_mondata_all_subdir': arch/arm64/kernel/mpam/mpam_ctrlmon.c:745:54: warning: variable 'rr' set but not used [-Wunused-but-set-variable] 745 | struct raw_resctrl_resource *rr; | ^~ arch/arm64/kernel/mpam/mpam_ctrlmon.c:430: warning: Function parameter or member 's' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:430: warning: Function parameter or member 'r' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:430: warning: Function parameter or member 'schema_name' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:430: warning: Function parameter or member 'type' not described in 'show_doms' arch/arm64/kernel/mpam/mpam_ctrlmon.c:430: warning: Function parameter or member 'closid' not described in 'show_doms' vim +/resctrl_group_mondata_show +560 arch/arm64/kernel/mpam/mpam_ctrlmon.c d157854c756daf4 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 559 b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 @560 int resctrl_group_mondata_show(struct seq_file *m, void *arg) b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 561 { b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 562 struct kernfs_open_file *of = m->private; b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 563 struct rdtgroup *rdtgrp; 594105ff55056b6 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 564 struct rdt_domain *d; 594105ff55056b6 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 565 struct resctrl_resource *r; f2a58a19ec564be arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 566 union mon_data_bits md; b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 567 int ret = 0; 0f4c524c39b330a arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 568 char *resname = get_resource_name(kernfs_node_name(of)); 594105ff55056b6 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 569 u64 usage; 75008419705983d arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 570 int pmg; 0f4c524c39b330a arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 571 0f4c524c39b330a arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 572 if (!resname) 0f4c524c39b330a arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 573 return -ENOMEM; b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 574 b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 575 rdtgrp = resctrl_group_kn_lock_live(of->kn); 0bf8b142ee73268 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 576 if (!rdtgrp) { 14405c9eb792d93 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-04-28 577 ret = -ENOENT; 14405c9eb792d93 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-04-28 578 goto out; 0bf8b142ee73268 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 579 } b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 580 f2a58a19ec564be arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 581 md.priv = of->kn->priv; b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 582 344e656b7d90e2c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 583 r = mpam_resctrl_get_resource(md.u.rid); 594105ff55056b6 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 584 b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 585 /* show monitor data */ 594105ff55056b6 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 586 d = mpam_find_domain(r, md.u.domid, NULL); 14405c9eb792d93 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-04-28 587 if (IS_ERR_OR_NULL(d)) { 594105ff55056b6 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 588 pr_warn("Could't find domain id %d\n", md.u.domid); 14405c9eb792d93 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-04-28 589 ret = -ENOENT; 14405c9eb792d93 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-04-28 590 goto out; 594105ff55056b6 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 591 } 594105ff55056b6 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 592 d157854c756daf4 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 593 usage = resctrl_dom_mon_data(r, d, md.priv); d157854c756daf4 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 594 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 595 /* 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 596 * if this rdtgroup is ctrlmon group, also collect it's 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 597 * mon groups' monitor data. 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 598 */ 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 599 if (rdtgrp->type == RDTCTRL_GROUP) { 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 600 struct list_head *head; 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 601 struct rdtgroup *entry; 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 602 hw_closid_t hw_closid; 0f728d63ce7a19f arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 603 hw_monid_t hw_monid; 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 604 enum resctrl_conf_type type = CDP_CODE; 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 605 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 606 resctrl_cdp_map(clos, rdtgrp->closid.reqpartid, 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 607 CDP_CODE, hw_closid); 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 608 /* CDP_CODE share the same closid with CDP_BOTH */ 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 609 if (md.u.partid != hw_closid_val(hw_closid)) 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 610 type = CDP_DATA; 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 611 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 612 head = &rdtgrp->mon.crdtgrp_list; 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 613 list_for_each_entry(entry, head, mon.crdtgrp_list) { 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 614 resctrl_cdp_map(clos, entry->closid.reqpartid, 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 615 type, hw_closid); 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 616 md.u.partid = hw_closid_val(hw_closid); 75008419705983d arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 617 75008419705983d arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 618 ret = mpam_rmid_to_partid_pmg(entry->mon.rmid, 75008419705983d arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 619 NULL, &pmg); 75008419705983d arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 620 if (ret) 75008419705983d arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 621 return ret; 75008419705983d arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 622 75008419705983d arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 623 md.u.pmg = pmg; 0f728d63ce7a19f arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 624 resctrl_cdp_map(mon, get_rmid_mon(entry->mon.rmid, 0f728d63ce7a19f arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 625 r->rid), type, hw_monid); 0f728d63ce7a19f arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 626 md.u.mon = hw_monid_val(hw_monid); 0f728d63ce7a19f arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 627 d157854c756daf4 arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 628 usage += resctrl_dom_mon_data(r, d, md.priv); 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 629 } 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 630 } 934c2350979693c arch/arm64/kernel/mpam/mpam_ctrlmon.c Wang ShaoBo 2021-02-24 631 594105ff55056b6 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 632 seq_printf(m, "%llu\n", usage); b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 633 14405c9eb792d93 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-04-28 634 out: 0f4c524c39b330a arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 635 put_resource_name(resname); b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 636 resctrl_group_kn_unlock(of->kn); b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 637 return ret; b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 638 } b4617397605d3b8 arch/arm64/kernel/mpam_ctrlmon.c Xie XiuQi 2019-01-29 639 :::::: The code at line 560 was first introduced by commit :::::: b4617397605d3b8842d9e39bb8921223eccc2f92 arm64/mpam: support mondata fields :::::: TO: Xie XiuQi <xiexiuqi(a)huawei.com> :::::: CC: Xie XiuQi <xiexiuqi(a)huawei.com> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[openeuler:openEuler-1.0-LTS 1225/1225] mm/cma.o: warning: objtool: cma_activate_area()+0x1a9: unreachable instruction
by kernel test robot 06 Nov '24

06 Nov '24

tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e33ed48bc600febcdca9e71e43cf224934dadc4f commit: 5f0e34d2aceec67c169be7599d82f0e8519c37f7 [1225/1225] mm/sparsemem: fix 'mem_section' will never be NULL gcc 12 warning config: x86_64-buildonly-randconfig-002-20241028 (https://download.01.org/0day-ci/archive/20241106/202411062106.mPTnywkZ-lkp@…) compiler: clang version 19.1.2 (https://github.com/llvm/llvm-project 7ba7d8e2f7b6445b60679da826210cdde29eaf8b) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241106/202411062106.mPTnywkZ-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202411062106.mPTnywkZ-lkp@intel.com/ All warnings (new ones prefixed by >>): >> mm/cma.o: warning: objtool: cma_activate_area()+0x1a9: unreachable instruction -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] RDMA/hns: Fix DCA mmap area PUAF
by Chengchang Tang 06 Nov '24

06 Nov '24

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB2DWH ---------------------------------------------------------------------- DCA mmap area would be freed after driver reseted or hot unplugged. At this time, the vma is still valid, which may lead to a PUAF. Using rdma_user_mmap_io() to remap this area to ensure the vma is zapped after dirver removal. Fixes: d3caaebdbfe9 ("RDMA/hns: Optimize user DCA perfermance by sharing DCA status") Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_dca.c | 3 +- drivers/infiniband/hw/hns/hns_roce_main.c | 39 ++++------------------- 2 files changed, 9 insertions(+), 33 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_dca.c b/drivers/infiniband/hw/hns/hns_roce_dca.c index 91b6b65c83df..65ed7666a826 100644 --- a/drivers/infiniband/hw/hns/hns_roce_dca.c +++ b/drivers/infiniband/hw/hns/hns_roce_dca.c @@ -1181,7 +1181,8 @@ static void init_udca_status(struct hns_roce_ucontext *uctx, int udca_max_qps, return; ctx->dca_mmap_entry = hns_roce_user_mmap_entry_insert(ib_uctx, - (u64)kaddr, size, HNS_ROCE_MMAP_TYPE_DCA); + (u64)virt_to_phys(kaddr), size, + HNS_ROCE_MMAP_TYPE_DCA); if (!ctx->dca_mmap_entry) { free_pages_exact(kaddr, size); return; diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index 27b723a40abe..3872e777c74b 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -674,36 +674,6 @@ static void hns_roce_dealloc_ucontext(struct ib_ucontext *ibcontext) ida_free(&hr_dev->uar_ida.ida, (int)context->uar.logic_idx); } -static int mmap_dca(struct ib_ucontext *context, struct vm_area_struct *vma) -{ - struct hns_roce_ucontext *uctx = to_hr_ucontext(context); - struct hns_roce_dca_ctx *ctx = &uctx->dca_ctx; - struct page **pages; - unsigned long num; - int ret; - - if ((vma->vm_end - vma->vm_start != (ctx->status_npage * PAGE_SIZE) || - return -EINVAL; - - if (!(vma->vm_flags & VM_WRITE) || (vma->vm_flags & VM_EXEC)) - return -EPERM; - - if (!ctx->buf_status) - return -EOPNOTSUPP; - - pages = kcalloc(ctx->status_npage, sizeof(struct page *), GFP_KERNEL); - if (!pages) - return -ENOMEM; - - for (num = 0; num < ctx->status_npage; num++) - pages[num] = virt_to_page(ctx->buf_status + num * PAGE_SIZE); - - ret = vm_insert_pages(vma, vma->vm_start, pages, &num); - kfree(pages); - return ret; -} - static int hns_roce_mmap(struct ib_ucontext *uctx, struct vm_area_struct *vma) { struct hns_roce_dev *hr_dev = to_hr_dev(uctx->device); @@ -728,8 +698,13 @@ static int hns_roce_mmap(struct ib_ucontext *uctx, struct vm_area_struct *vma) prot = pgprot_device(vma->vm_page_prot); break; case HNS_ROCE_MMAP_TYPE_DCA: - ret = mmap_dca(uctx, vma); - goto out; + if (!(vma->vm_flags & VM_WRITE) || (vma->vm_flags & VM_EXEC)) { + ret = -EPERM; + goto out; + } + vma->vm_flags |= VM_DONTEXPAND; + prot = vma->vm_page_prot; + break; case HNS_ROCE_MMAP_TYPE_RESET: if (vma->vm_flags & (VM_WRITE | VM_EXEC)) { ret = -EINVAL; -- 2.33.0

2 1

[PATCH OLK-6.6] RDMA/hns: Fix DCA mmap area PUAF
by Chengchang Tang 06 Nov '24

06 Nov '24

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IB2H4P ---------------------------------------------------------------------- DCA mmap area would be freed after driver reseted or hot unplugged. At this time, the vma is still valid, which may lead to a PUAF. Using rdma_user_mmap_io() to remap this area to ensure the vma is zapped after dirver removal. Fixes: d3caaebdbfe9 ("RDMA/hns: Optimize user DCA perfermance by sharing DCA status") Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> Signed-off-by: Xinghai Cen <cenxinghai(a)h-partners.com> --- drivers/infiniband/hw/hns/hns_roce_dca.c | 3 +- drivers/infiniband/hw/hns/hns_roce_main.c | 39 ++++------------------- 2 files changed, 9 insertions(+), 33 deletions(-) diff --git a/drivers/infiniband/hw/hns/hns_roce_dca.c b/drivers/infiniband/hw/hns/hns_roce_dca.c index 49adf43261d6..4cef41591795 100644 --- a/drivers/infiniband/hw/hns/hns_roce_dca.c +++ b/drivers/infiniband/hw/hns/hns_roce_dca.c @@ -1132,7 +1132,8 @@ static void init_udca_status(struct hns_roce_ucontext *uctx, int udca_max_qps, return; ctx->dca_mmap_entry = hns_roce_user_mmap_entry_insert(ib_uctx, - (u64)kaddr, size, HNS_ROCE_MMAP_TYPE_DCA); + (u64)virt_to_phys(kaddr), size, + HNS_ROCE_MMAP_TYPE_DCA); if (!ctx->dca_mmap_entry) { free_pages_exact(kaddr, size); return; diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index 1302c58c3937..85223d25995d 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -644,36 +644,6 @@ static void hns_roce_dealloc_ucontext(struct ib_ucontext *ibcontext) ida_free(&hr_dev->uar_ida.ida, (int)context->uar.logic_idx); } -static int mmap_dca(struct ib_ucontext *context, struct vm_area_struct *vma) -{ - struct hns_roce_ucontext *uctx = to_hr_ucontext(context); - struct hns_roce_dca_ctx *ctx = &uctx->dca_ctx; - struct page **pages; - unsigned long num; - int ret; - - if ((vma->vm_end - vma->vm_start != (ctx->status_npage * PAGE_SIZE) || - return -EINVAL; - - if (!(vma->vm_flags & VM_WRITE) || (vma->vm_flags & VM_EXEC)) - return -EPERM; - - if (!ctx->buf_status) - return -EOPNOTSUPP; - - pages = kcalloc(ctx->status_npage, sizeof(struct page *), GFP_KERNEL); - if (!pages) - return -ENOMEM; - - for (num = 0; num < ctx->status_npage; num++) - pages[num] = virt_to_page(ctx->buf_status + num * PAGE_SIZE); - - ret = vm_insert_pages(vma, vma->vm_start, pages, &num); - kfree(pages); - return ret; -} - static int hns_roce_mmap(struct ib_ucontext *uctx, struct vm_area_struct *vma) { struct hns_roce_dev *hr_dev = to_hr_dev(uctx->device); @@ -703,8 +673,13 @@ static int hns_roce_mmap(struct ib_ucontext *uctx, struct vm_area_struct *vma) prot = pgprot_device(vma->vm_page_prot); break; case HNS_ROCE_MMAP_TYPE_DCA: - ret = mmap_dca(uctx, vma); - goto out; + if (!(vma->vm_flags & VM_WRITE) || (vma->vm_flags & VM_EXEC)) { + ret = -EPERM; + goto out; + } + vma->vm_flags |= VM_DONTEXPAND; + prot = vma->vm_page_prot; + break; case HNS_ROCE_MMAP_TYPE_RESET: if (vma->vm_flags & (VM_WRITE | VM_EXEC)) { ret = -EINVAL; -- 2.33.0

2 1

[PATCH OLK-6.6] drm/amd/display: Fix index out of bounds in degamma hardware format translation
by Liu Chuang 06 Nov '24

06 Nov '24

From: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> stable inclusion from stable-v6.6.55 commit 122e3a7a8c7bcbe3aacddd6103f67f9f36bed473 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYR9A CVE: CVE-2024-49894 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b7e99058eb2e86aabd7a10761e76cae33d22b49f ] Fixes index out of bounds issue in `cm_helper_translate_curve_to_degamma_hw_format` function. The issue could occur when the index 'i' exceeds the number of transfer function points (TRANSFER_FUNC_POINTS). The fix adds a check to ensure 'i' is within bounds before accessing the transfer function points. If 'i' is out of bounds the function returns false to indicate an error. Reported by smatch: drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:594 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.red' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:595 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.green' 1025 <= s32max drivers/gpu/drm/amd/amdgpu/../display/dc/dcn10/dcn10_cm_common.c:596 cm_helper_translate_curve_to_degamma_hw_format() error: buffer overflow 'output_tf->tf_pts.blue' 1025 <= s32max Cc: Tom Chung <chiahsuan.chung(a)amd.com> Cc: Rodrigo Siqueira <Rodrigo.Siqueira(a)amd.com> Cc: Roman Li <roman.li(a)amd.com> Cc: Alex Hung <alex.hung(a)amd.com> Cc: Aurabindo Pillai <aurabindo.pillai(a)amd.com> Cc: Harry Wentland <harry.wentland(a)amd.com> Cc: Hamza Mahfooz <hamza.mahfooz(a)amd.com> Signed-off-by: Srinivasan Shanmugam <srinivasan.shanmugam(a)amd.com> Reviewed-by: Tom Chung <chiahsuan.chung(a)amd.com> Signed-off-by: Alex Deucher <alexander.deucher(a)amd.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Chuang <liuchuang40(a)huawei.com> --- drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c index c0372aa4ec83..684e30f9cf89 100644 --- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c +++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_cm_common.c @@ -571,6 +571,8 @@ bool cm_helper_translate_curve_to_degamma_hw_format( i += increment) { if (j == hw_points - 1) break; + if (i >= TRANSFER_FUNC_POINTS) + return false; rgb_resulted[j].red = output_tf->tf_pts.red[i]; rgb_resulted[j].green = output_tf->tf_pts.green[i]; rgb_resulted[j].blue = output_tf->tf_pts.blue[i]; -- 2.34.1

2 1

[Cancel] openEuler TC 临时会议
by openEuler conference 06 Nov '24

06 Nov '24

Sorry! The WeLink meeting will be held at 2024-11-09 10:00 scheduled by Kernel SIG has been cancelled.

1 0

[PATCH OLK-6.6] ksmbd: add refcnt to ksmbd_conn struct
by Long Li 06 Nov '24

06 Nov '24

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.10-rc2 commit ee426bfb9d09b29987369b897fe9b6485ac2be27 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAYRCR CVE: CVE-2024-49988 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When sending an oplock break request, opinfo->conn is used, But freed ->conn can be used on multichannel. This patch add a reference count to the ksmbd_conn struct so that it can be freed when it is no longer used. Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/smb/server/connection.c | 4 ++- fs/smb/server/connection.h | 1 + fs/smb/server/oplock.c | 55 +++++++++++--------------------------- fs/smb/server/vfs_cache.c | 3 +++ 4 files changed, 23 insertions(+), 40 deletions(-) diff --git a/fs/smb/server/connection.c b/fs/smb/server/connection.c index 7889df8112b4..cac80e7bfefc 100644 --- a/fs/smb/server/connection.c +++ b/fs/smb/server/connection.c @@ -39,7 +39,8 @@ void ksmbd_conn_free(struct ksmbd_conn *conn) xa_destroy(&conn->sessions); kvfree(conn->request_buf); kfree(conn->preauth_info); - kfree(conn); + if (atomic_dec_and_test(&conn->refcnt)) + kfree(conn); } /** @@ -68,6 +69,7 @@ struct ksmbd_conn *ksmbd_conn_alloc(void) conn->um = NULL; atomic_set(&conn->req_running, 0); atomic_set(&conn->r_count, 0); + atomic_set(&conn->refcnt, 1); conn->total_credits = 1; conn->outstanding_credits = 0; diff --git a/fs/smb/server/connection.h b/fs/smb/server/connection.h index b93e5437793e..82343afc8d04 100644 --- a/fs/smb/server/connection.h +++ b/fs/smb/server/connection.h @@ -106,6 +106,7 @@ struct ksmbd_conn { bool signing_negotiated; __le16 signing_algorithm; bool binding; + atomic_t refcnt; }; struct ksmbd_conn_ops { diff --git a/fs/smb/server/oplock.c b/fs/smb/server/oplock.c index e546ffa57b55..8ee86478287f 100644 --- a/fs/smb/server/oplock.c +++ b/fs/smb/server/oplock.c @@ -51,6 +51,7 @@ static struct oplock_info *alloc_opinfo(struct ksmbd_work *work, init_waitqueue_head(&opinfo->oplock_brk); atomic_set(&opinfo->refcount, 1); atomic_set(&opinfo->breaking_cnt, 0); + atomic_inc(&opinfo->conn->refcnt); return opinfo; } @@ -124,6 +125,8 @@ static void free_opinfo(struct oplock_info *opinfo) { if (opinfo->is_lease) free_lease(opinfo); + if (opinfo->conn && atomic_dec_and_test(&opinfo->conn->refcnt)) + kfree(opinfo->conn); kfree(opinfo); } @@ -163,9 +166,7 @@ static struct oplock_info *opinfo_get_list(struct ksmbd_inode *ci) !atomic_inc_not_zero(&opinfo->refcount)) opinfo = NULL; else { - atomic_inc(&opinfo->conn->r_count); if (ksmbd_conn_releasing(opinfo->conn)) { - atomic_dec(&opinfo->conn->r_count); atomic_dec(&opinfo->refcount); opinfo = NULL; } @@ -177,26 +178,11 @@ static struct oplock_info *opinfo_get_list(struct ksmbd_inode *ci) return opinfo; } -static void opinfo_conn_put(struct oplock_info *opinfo) +void opinfo_put(struct oplock_info *opinfo) { - struct ksmbd_conn *conn; - if (!opinfo) return; - conn = opinfo->conn; - /* - * Checking waitqueue to dropping pending requests on - * disconnection. waitqueue_active is safe because it - * uses atomic operation for condition. - */ - if (!atomic_dec_return(&conn->r_count) && waitqueue_active(&conn->r_count_q)) - wake_up(&conn->r_count_q); - opinfo_put(opinfo); -} - -void opinfo_put(struct oplock_info *opinfo) -{ if (!atomic_dec_and_test(&opinfo->refcount)) return; @@ -1127,14 +1113,11 @@ void smb_send_parent_lease_break_noti(struct ksmbd_file *fp, if (!atomic_inc_not_zero(&opinfo->refcount)) continue; - atomic_inc(&opinfo->conn->r_count); - if (ksmbd_conn_releasing(opinfo->conn)) { - atomic_dec(&opinfo->conn->r_count); + if (ksmbd_conn_releasing(opinfo->conn)) continue; - } oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE); - opinfo_conn_put(opinfo); + opinfo_put(opinfo); } } up_read(&p_ci->m_lock); @@ -1167,13 +1150,10 @@ void smb_lazy_parent_lease_break_close(struct ksmbd_file *fp) if (!atomic_inc_not_zero(&opinfo->refcount)) continue; - atomic_inc(&opinfo->conn->r_count); - if (ksmbd_conn_releasing(opinfo->conn)) { - atomic_dec(&opinfo->conn->r_count); + if (ksmbd_conn_releasing(opinfo->conn)) continue; - } oplock_break(opinfo, SMB2_OPLOCK_LEVEL_NONE); - opinfo_conn_put(opinfo); + opinfo_put(opinfo); } } up_read(&p_ci->m_lock); @@ -1252,7 +1232,7 @@ int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid, prev_opinfo = opinfo_get_list(ci); if (!prev_opinfo || (prev_opinfo->level == SMB2_OPLOCK_LEVEL_NONE && lctx)) { - opinfo_conn_put(prev_opinfo); + opinfo_put(prev_opinfo); goto set_lev; } prev_op_has_lease = prev_opinfo->is_lease; @@ -1262,19 +1242,19 @@ int smb_grant_oplock(struct ksmbd_work *work, int req_op_level, u64 pid, if (share_ret < 0 && prev_opinfo->level == SMB2_OPLOCK_LEVEL_EXCLUSIVE) { err = share_ret; - opinfo_conn_put(prev_opinfo); + opinfo_put(prev_opinfo); goto err_out; } if (prev_opinfo->level != SMB2_OPLOCK_LEVEL_BATCH && prev_opinfo->level != SMB2_OPLOCK_LEVEL_EXCLUSIVE) { - opinfo_conn_put(prev_opinfo); + opinfo_put(prev_opinfo); goto op_break_not_needed; } list_add(&work->interim_entry, &prev_opinfo->interim_list); err = oplock_break(prev_opinfo, SMB2_OPLOCK_LEVEL_II); - opinfo_conn_put(prev_opinfo); + opinfo_put(prev_opinfo); if (err == -ENOENT) goto set_lev; /* Check all oplock was freed by close */ @@ -1337,14 +1317,14 @@ static void smb_break_all_write_oplock(struct ksmbd_work *work, return; if (brk_opinfo->level != SMB2_OPLOCK_LEVEL_BATCH && brk_opinfo->level != SMB2_OPLOCK_LEVEL_EXCLUSIVE) { - opinfo_conn_put(brk_opinfo); + opinfo_put(brk_opinfo); return; } brk_opinfo->open_trunc = is_trunc; list_add(&work->interim_entry, &brk_opinfo->interim_list); oplock_break(brk_opinfo, SMB2_OPLOCK_LEVEL_II); - opinfo_conn_put(brk_opinfo); + opinfo_put(brk_opinfo); } /** @@ -1376,11 +1356,8 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp, if (!atomic_inc_not_zero(&brk_op->refcount)) continue; - atomic_inc(&brk_op->conn->r_count); - if (ksmbd_conn_releasing(brk_op->conn)) { - atomic_dec(&brk_op->conn->r_count); + if (ksmbd_conn_releasing(brk_op->conn)) continue; - } rcu_read_unlock(); if (brk_op->is_lease && (brk_op->o_lease->state & @@ -1411,7 +1388,7 @@ void smb_break_all_levII_oplock(struct ksmbd_work *work, struct ksmbd_file *fp, brk_op->open_trunc = is_trunc; oplock_break(brk_op, SMB2_OPLOCK_LEVEL_NONE); next: - opinfo_conn_put(brk_op); + opinfo_put(brk_op); rcu_read_lock(); } rcu_read_unlock(); diff --git a/fs/smb/server/vfs_cache.c b/fs/smb/server/vfs_cache.c index 8b2e37c8716e..271a23abc82f 100644 --- a/fs/smb/server/vfs_cache.c +++ b/fs/smb/server/vfs_cache.c @@ -710,6 +710,8 @@ static bool session_fd_check(struct ksmbd_tree_connect *tcon, list_for_each_entry_rcu(op, &ci->m_op_list, op_entry) { if (op->conn != conn) continue; + if (op->conn && atomic_dec_and_test(&op->conn->refcnt)) + kfree(op->conn); op->conn = NULL; } up_write(&ci->m_lock); @@ -807,6 +809,7 @@ int ksmbd_reopen_durable_fd(struct ksmbd_work *work, struct ksmbd_file *fp) if (op->conn) continue; op->conn = fp->conn; + atomic_inc(&op->conn->refcnt); } up_write(&ci->m_lock); -- 2.39.2

2 1

openEuler TC 临时会议
by openEuler conference 06 Nov '24

06 Nov '24

您好！ Kernel 邀请您参加 2024-11-09 10:00 召开的WeLink会议(自动录制) 会议主题：openEuler TC 临时会议会议链接：https://meeting.huaweicloud.com:36443/#/j/983087267 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 更多资讯尽在：https://www.openeuler.org/zh/ Hello! Kernel invites you to attend the WeLink conference(auto recording) will be held at 2024-11-09 10:00, The subject of the conference is openEuler TC 临时会议, You can join the meeting at https://meeting.huaweicloud.com:36443/#/j/983087267. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. More information: https://www.openeuler.org/en/

1 0

[PATCH v4 OLK-5.10 0/7] mm: support poison recover for more
by Wupeng Ma 06 Nov '24

06 Nov '24

From: Ma Wupeng <mawupeng1(a)huawei.com> Add machine check safe support for cow & migrate_pages. Avoid kernel panic during arm64_do_kernel_sea if no valid info is reported. Changelog since v3: - backport bugfix commit 88e4f525002b ("mm/hugetlb: add missing VM_FAULT_SET_HINDEX in hugetlb_wp") Changelog since v1: - fix incorrect patch format Kefeng Wang (2): mm: support poison recovery from copy_present_page() mm: support poison recovery from do_cow_fault() Liu Shixin (1): mm: hwpoison: support recovery from HugePage copy-on-write faults Ma Wupeng (2): arm64: mm: Add copy mc support for all migrate_page arm64: send sig fault for user task when apei_claim_sea fails Oscar Salvador (1): mm/hugetlb: add missing VM_FAULT_SET_HINDEX in hugetlb_wp Tong Tiangen (1): make copy_[user]_highpage_mc have return value arch/arm64/include/asm/page.h | 6 +-- arch/arm64/lib/copy_page_mc.S | 6 ++- arch/arm64/mm/copypage.c | 21 +++++--- arch/arm64/mm/fault.c | 17 +++++-- include/linux/highmem.h | 13 ++++- include/linux/mm.h | 8 ++-- mm/hugetlb.c | 7 ++- mm/memory.c | 90 +++++++++++++++++++++++------------ mm/migrate.c | 5 +- 9 files changed, 118 insertions(+), 55 deletions(-) -- 2.25.1

2 8

[PATCH OLK-6.6] sched/fair: Take the scheduling domain into account in select_idle_smt()
by Wenyu Huang 06 Nov '24

06 Nov '24

From: Keisuke Nishimura <keisuke.nishimura(a)inria.fr> stable inclusion from stable-v6.6.23 commit 495b7cb952003973ff1fe4f70639bf3df91fbfb1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IB2B23 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- [ Upstream commit 8aeaffef8c6eceab0e1498486fdd4f3dc3b7066c ] When picking a CPU on task wakeup, select_idle_smt() has to take into account the scheduling domain of @target. This is because the "isolcpus" kernel command line option can remove CPUs from the domain to isolate them from other SMT siblings. This fix checks if the candidate CPU is in the target scheduling domain. Commit: df3cb4ea1fb6 ("sched/fair: Fix wrong cpu selecting from isolated domain") ... originally introduced this fix by adding the check of the scheduling domain in the loop. However, commit: 3e6efe87cd5cc ("sched/fair: Remove redundant check in select_idle_smt()") ... accidentally removed the check. Bring it back. Fixes: 3e6efe87cd5c ("sched/fair: Remove redundant check in select_idle_smt()") Signed-off-by: Keisuke Nishimura <keisuke.nishimura(a)inria.fr> Signed-off-by: Julia Lawall <julia.lawall(a)inria.fr> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: Vincent Guittot <vincent.guittot(a)linaro.org> Link: https://lore.kernel.org/r/20240110131707.437301-1-keisuke.nishimura@inria.fr Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wenyu Huang <huangwenyu5(a)huawei.com> --- kernel/sched/fair.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 4ef95b2210b5e..d5ae744deb39d 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -8070,7 +8070,7 @@ static int select_idle_core(struct task_struct *p, int core, struct cpumask *cpu /* * Scan the local SMT mask for idle CPUs. */ -static int select_idle_smt(struct task_struct *p, int target) +static int select_idle_smt(struct task_struct *p, struct sched_domain *sd, int target) { int cpu; @@ -8081,6 +8081,12 @@ static int select_idle_smt(struct task_struct *p, int target) #endif if (cpu == target) continue; + /* + * Check if the CPU is in the LLC scheduling domain of @target. + * Due to isolcpus, there is no guarantee that all the siblings are in the domain. + */ + if (!cpumask_test_cpu(cpu, sched_domain_span(sd))) + continue; if (available_idle_cpu(cpu) || sched_idle_cpu(cpu)) return cpu; } @@ -8104,7 +8110,7 @@ static inline int select_idle_core(struct task_struct *p, int core, struct cpuma return __select_idle_cpu(core, p); } -static inline int select_idle_smt(struct task_struct *p, int target) +static inline int select_idle_smt(struct task_struct *p, struct sched_domain *sd, int target) { return -1; } @@ -8441,7 +8447,7 @@ static int select_idle_sibling(struct task_struct *p, int prev, int target) has_idle_core = test_idle_cores(target); if (!has_idle_core && cpus_share_cache(prev, target)) { - i = select_idle_smt(p, prev); + i = select_idle_smt(p, sd, prev); if ((unsigned int)i < nr_cpumask_bits) return i; } -- 2.34.1

2 1