- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 V3 00/12] Add SDEI Watchdog Support
by Xiongfeng Wang 05 Dec '23

05 Dec '23

Xiongfeng Wang (12): firmware: arm_sdei: add interrupt binding api firmware: arm_sdei: make 'sdei_api_event_disable/enable' public lockup_detector: init lockup detector after all the init_calls watchdog: add nmi_watchdog support for arm64 based on SDEI sdei_watchdog: clear EOI of the secure timer before kdump sdei_watchdog: set secure timer period base on 'watchdog_thresh' sdei_watchdog: avoid possible false hardlockup init: only move down lockup_detector_init() when sdei_watchdog is enabled kprobes/arm64: Blacklist sdei watchdog callback functions openeuler_defconfig: Enable SDEI Watchdog stop_machine: mask sdei before running the callback arm64: kexec: only clear EOI for SDEI in NMI context arch/arm64/configs/openeuler_defconfig | 3 +- arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/machine_kexec.c | 11 ++ arch/arm64/kernel/watchdog_sdei.c | 151 +++++++++++++++++++++++++ drivers/firmware/arm_sdei.c | 26 ++++- include/linux/arm_sdei.h | 5 + include/linux/nmi.h | 8 ++ include/uapi/linux/arm_sdei.h | 2 + init/main.c | 7 +- kernel/stop_machine.c | 10 ++ kernel/watchdog.c | 3 + lib/Kconfig.debug | 9 ++ 12 files changed, 232 insertions(+), 4 deletions(-) create mode 100644 arch/arm64/kernel/watchdog_sdei.c -- 2.20.1

2 13

[PATCH OLK-6.6] exec: Remove redundant check in do_open_execat/uselib
by Zhihao Cheng 05 Dec '23

05 Dec '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LX53 CVE: NA -------------------------------- There is a false positive WARNON happening in execve(2)/uselib(2) syscalls with concurrent noexec-remount. execveat remount do_open_execat(path/bin) do_filp_open path_openat do_open may_open path_noexec() // PASS remount(path->mnt, MS_NOEXEC) WARNON(path_noexec(&file->f_path)) // path_noexec() checks fail Since may_open() has already checked the same conditions, fix it by removing 'S_ISREG' and 'path_noexec' check in do_open_execat()/uselib(2). Fixes: 0fd338b2d2cdf8 ("exec: move path_noexec() check earlier") Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- fs/exec.c | 22 +--------------------- 1 file changed, 1 insertion(+), 21 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index 6518e33ea813..73b833e8b548 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -142,16 +142,6 @@ SYSCALL_DEFINE1(uselib, const char __user *, library) if (IS_ERR(file)) goto out; - /* - * may_open() has already checked for this, so it should be - * impossible to trip now. But we need to be extra cautious - * and check again at the very end too. - */ - error = -EACCES; - if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode) || - path_noexec(&file->f_path))) - goto exit; - error = -ENOEXEC; read_lock(&binfmt_lock); @@ -168,7 +158,7 @@ SYSCALL_DEFINE1(uselib, const char __user *, library) break; } read_unlock(&binfmt_lock); -exit: + fput(file); out: return error; @@ -925,16 +915,6 @@ static struct file *do_open_execat(int fd, struct filename *name, int flags) if (IS_ERR(file)) goto out; - /* - * may_open() has already checked for this, so it should be - * impossible to trip now. But we need to be extra cautious - * and check again at the very end too. - */ - err = -EACCES; - if (WARN_ON_ONCE(!S_ISREG(file_inode(file)->i_mode) || - path_noexec(&file->f_path))) - goto exit; - err = deny_write_access(file); if (err) goto exit; -- 2.31.1

2 1

[OLK-5.10 00/13] crypto: some bugfixs and cleanup
by Weili Qian 05 Dec '23

05 Dec '23

From: JiangShui Yang <yangjiangshui(a)h-partners.com> Chenghai Huang (3): crypto: hisilicon/qm - delete a dbg function vfio/migration - delete a dbg function crypto: hisilicon/sec2 - optimize the error return process JiangShui Yang (1): crypto: hisilicon/qm - increase the maximum waiting timeout interval of the moilbox. Weili Qian (8): crypto: hisilicon/sec2: fix memory use-after-free issue crypto: hisilicon/qm - modify interrupt resource application process crypto: hisilicon/hpre - mask cluster timeout error crypto: hisilicon/qm - support get deivce state crypto: hisilicon/qm - dump important registers values before resetting crypto: hisilicon/qm - remove duplicate configurations crypto: hisilicon/qm - add stop function by hardware crypto: hisilicon/qm - reset device before enabling it Wenkai Lin (1): crypto: hisilicon/qm - add size check in qm set algs Documentation/ABI/testing/debugfs-hisi-hpre | 7 + Documentation/ABI/testing/debugfs-hisi-sec | 7 + Documentation/ABI/testing/debugfs-hisi-zip | 7 + drivers/crypto/hisilicon/debugfs.c | 53 +++ drivers/crypto/hisilicon/hpre/hpre_main.c | 58 ++-- .../hisilicon/migration/acc_vf_migration.c | 3 - drivers/crypto/hisilicon/qm.c | 328 ++++++++++++------ drivers/crypto/hisilicon/sec2/sec.h | 2 - drivers/crypto/hisilicon/sec2/sec_crypto.c | 57 +-- drivers/crypto/hisilicon/sec2/sec_main.c | 23 +- drivers/crypto/hisilicon/zip/zip_main.c | 25 +- include/linux/hisi_acc_qm.h | 5 +- 12 files changed, 362 insertions(+), 213 deletions(-) -- 2.33.0

1 13

[PATCH OLK-6.6] blk-throttle: enable hierarchical throttle in cgroup v1
by Yu Kuai 05 Dec '23

05 Dec '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4R7RE CVE: NA ----------------------------------------------- blkio subsytem is not under default hierarchy in cgroup v1 by default, which means configurations will only be effective on current cgroup for io throttle. This patch introduces a new feature that enable default hierarchy for io throttle, which means configurations will be effective on child cgroups. Such feature is disabled by default, and can be enabled by adding "blkcg_global_limit=1" or "blkcg_global_limit=Y" or "blkcg_global_limit=y" in boot cmd. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Tao Hou <houtao1(a)huawei.com> --- block/blk-throttle.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/block/blk-throttle.c b/block/blk-throttle.c index 13e4377a8b28..c3bd159163d7 100644 --- a/block/blk-throttle.c +++ b/block/blk-throttle.c @@ -41,6 +41,19 @@ /* A workqueue to queue throttle related work */ static struct workqueue_struct *kthrotld_workqueue; +/* True if global limit is enabled in cgroup v1 */ +static bool global_limit; + +static int __init setup_global_limit(char *str) +{ + if (!strcmp(str, "1") || !strcmp(str, "Y") || !strcmp(str, "y")) + global_limit = true; + + return 1; +} + +__setup("blkcg_global_limit=", setup_global_limit); + #define rb_entry_tg(node) rb_entry((node), struct throtl_grp, rb_node) /* We measure latency for request size from <= 4k to >= 1M */ @@ -405,7 +418,8 @@ static void throtl_pd_init(struct blkg_policy_data *pd) * regardless of the position of the group in the hierarchy. */ sq->parent_sq = &td->service_queue; - if (cgroup_subsys_on_dfl(io_cgrp_subsys) && blkg->parent) + if ((cgroup_subsys_on_dfl(io_cgrp_subsys) || global_limit) && + blkg->parent) sq->parent_sq = &blkg_to_tg(blkg->parent)->service_queue; tg->td = td; } -- 2.39.2

2 1

[PATCH OLK-5.10 v2 0/2] Two bugfix patch about memcg swap qos
by Liu Shixin 05 Dec '23

05 Dec '23

Two bugfix patch about memcg swap qos. Liu Shixin (2): mm/swap_slots: fix out-of-bounds access of percpu area memcg: fix use-after-free of mm_struct mm/memcontrol.c | 6 ++++++ mm/swap_slots.c | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) -- 2.25.1

2 3

[PATCH OLK-6.6] Revert "dm space maps: don't reset space map allocation cursor when committing"
by Li Lingfeng 05 Dec '23

05 Dec '23

From: Luo Meng <luomeng12(a)huawei.com> hulk inclusion category: bugfix bugzilla: 185894, https://gitee.com/openeuler/kernel/issues/I4SJ8H?from=project-issue CVE: NA ----------------------------------------------- This reverts commit b0d9aeb41d5d5e90601fdf89834eba0a0613291c. This commit b0d9aeb41d5d ("dm space maps: don't reset space map allocation cursor when committing") change the way to find free block. But when use ramdisk(not support discard) for thin-pool,and storage over-commitment. Then constantly create and delete file, can find block in thin-pool, but can't find block in ramdisk. So need revert this patch. Signed-off-by: Luo Meng <luomeng12(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Conflicts: drivers/md/persistent-data/dm-space-map-disk.c commit 2d0f25cbc0d9 ("dm: remove unnecessary braces from single statement blocks") removes some braces; commit d6db294fd819 ("dm space map disk: remove redundant calls to sm_disk_get_nr_free()") removes calls to sm_disk_get_nr_free(). Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/persistent-data/dm-space-map-disk.c | 8 +------- drivers/md/persistent-data/dm-space-map-metadata.c | 9 +-------- 2 files changed, 2 insertions(+), 15 deletions(-) diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c index f4241f54e20e..8d98bdd58db8 100644 --- a/drivers/md/persistent-data/dm-space-map-disk.c +++ b/drivers/md/persistent-data/dm-space-map-disk.c @@ -137,13 +137,6 @@ static int sm_disk_new_block(struct dm_space_map *sm, dm_block_t *b) * Any block we allocate has to be free in both the old and current ll. */ r = sm_ll_find_common_free_block(&smd->old_ll, &smd->ll, smd->begin, smd->ll.nr_blocks, b); - if (r == -ENOSPC) - /* - * There's no free block between smd->begin and the end of the metadata device. - * We search before smd->begin in case something has been freed. - */ - r = sm_ll_find_common_free_block(&smd->old_ll, &smd->ll, 0, smd->begin, b); - if (r) return r; @@ -165,6 +158,7 @@ static int sm_disk_commit(struct dm_space_map *sm) return r; memcpy(&smd->old_ll, &smd->ll, sizeof(smd->old_ll)); + smd->begin = 0; smd->nr_allocated_this_transaction = 0; return 0; diff --git a/drivers/md/persistent-data/dm-space-map-metadata.c b/drivers/md/persistent-data/dm-space-map-metadata.c index 04698fd03e60..b59191649cff 100644 --- a/drivers/md/persistent-data/dm-space-map-metadata.c +++ b/drivers/md/persistent-data/dm-space-map-metadata.c @@ -456,14 +456,6 @@ static int sm_metadata_new_block_(struct dm_space_map *sm, dm_block_t *b) * Any block we allocate has to be free in both the old and current ll. */ r = sm_ll_find_common_free_block(&smm->old_ll, &smm->ll, smm->begin, smm->ll.nr_blocks, b); - if (r == -ENOSPC) { - /* - * There's no free block between smm->begin and the end of the metadata device. - * We search before smm->begin in case something has been freed. - */ - r = sm_ll_find_common_free_block(&smm->old_ll, &smm->ll, 0, smm->begin, b); - } - if (r) return r; @@ -516,6 +508,7 @@ static int sm_metadata_commit(struct dm_space_map *sm) return r; memcpy(&smm->old_ll, &smm->ll, sizeof(smm->old_ll)); + smm->begin = 0; smm->allocated_this_transaction = 0; return 0; -- 2.31.1

2 1

[OLK-5.10 0/4 v2] A set of patchs for openEuler
by Chengchang Tang 05 Dec '23

05 Dec '23

From: Juan Zhou <zhoujuan51(a)h-partners.com> The first two patches support more netdev speed, the third adds check for resource values and adjusts the invalid ones, and last patch renames the RoCE interrupts. Chengchang Tang (2): RDMA/hns: Fix port active speed RDMA/hns: Rename the interrupts Haoyue Xu (1): RDMA/core:Add support more netdev speed Junxian Huang (1): RDMA/hns: Add check and adjust for function resource values drivers/infiniband/core/verbs.c | 13 ++- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 123 +++++++++++++++++++-- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 37 +++++++ drivers/infiniband/hw/hns/hns_roce_main.c | 7 +- 4 files changed, 168 insertions(+), 12 deletions(-) -- 2.30.0

1 4

[PATCH openEuler-1.0-LTS] regmap: fix NULL deref on lookup
by Zhang Zekun 05 Dec '23

05 Dec '23

From: Johan Hovold <johan+linaro(a)kernel.org> stable inclusion from stable-v4.19.135 commit 7219c6b8fa24ec55a19d7a5ea58fb09151e37950 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LTOI CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------- commit c6df843348d6b71ea986266c12831cb60c2cf325 upstream. Not all regmaps have a name so make sure to check for that to avoid dereferencing a NULL pointer when dev_get_regmap() is used to lookup a named regmap. Fixes: e84861fec32d ("regmap: dev_get_regmap_match(): fix string comparison") Cc: stable(a)vger.kernel.org # 5.8 Cc: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Johan Hovold <johan+linaro(a)kernel.org> Link: https://lore.kernel.org/r/20231006082104.16707-1-johan+linaro@kernel.org Signed-off-by: Mark Brown <broonie(a)kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/base/regmap/regmap.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c index 6c9f6988bc09..3315bd1ddf30 100644 --- a/drivers/base/regmap/regmap.c +++ b/drivers/base/regmap/regmap.c @@ -1350,7 +1350,7 @@ static int dev_get_regmap_match(struct device *dev, void *res, void *data) /* If the user didn't specify a name match any */ if (data) - return (*r)->name == data; + return (*r)->name && !strcmp((*r)->name, data); else return 1; } -- 2.17.1

2 1

[PATCH OLK-6.6] dm btree spine: show warning if node_check failed in node_prep_for_write()
by Li Lingfeng 05 Dec '23

05 Dec '23

From: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5JCAH -------------------------------- The BUG_ON is unneed Since f73e2e70ec48 ("dm btree spine: remove paranoid node_check call in node_prep_for_write()") merged in v5.13. For debug reason, we also want to know the data on disk is corrupted by write or disk fault. So also add check and print some info when data corrupted. Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> Reviewed-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/md/persistent-data/dm-btree-spine.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/md/persistent-data/dm-btree-spine.c b/drivers/md/persistent-data/dm-btree-spine.c index 7540383b7cf3..418cac548ce6 100644 --- a/drivers/md/persistent-data/dm-btree-spine.c +++ b/drivers/md/persistent-data/dm-btree-spine.c @@ -27,6 +27,8 @@ static void node_prepare_for_write(struct dm_block_validator *v, h->csum = cpu_to_le32(dm_bm_checksum(&h->flags, block_size - sizeof(__le32), BTREE_CSUM_XOR)); + if (node_check(v, b, 4096)) + DMWARN_LIMIT("%s node_check failed", __func__); } static int node_check(struct dm_block_validator *v, -- 2.31.1

2 1

[PATCH OLK-6.6] loop: Add parm check in loop_control_ioctl
by Li Lingfeng 05 Dec '23

05 Dec '23

From: Zhong Jinghua <zhongjinghua(a)huawei.com> hulk inclusion category: bugfix bugzilla: 188586, https://gitee.com/openeuler/kernel/issues/I6TFPJ CVE: NA ---------------------------------------- We found that in loop_control_ioctl, the kernel panic can be easily caused: 1. syscall(__NR_ioctl, r[1], 0x4c80, 0x80000200000ul); Create a loop device 0x80000200000ul. In fact, in the code, it is used as the first_minor number, and the first_minor number is 0. So the created loop device number is 7:0. 2. syscall(__NR_ioctl, r[2], 0x4c80, 0ul); Create a loop device 0x0ul. Since the 7:0 device has been created in 1, add_disk will fail because the major and first_minor numbers are consistent. 3. syscall(__NR_ioctl, r[5], 0x4c81, 0ul); Delete the device that failed to create, the kernel panics. Panic like below: BUG: KASAN: null-ptr-deref in device_del+0xb3/0x840 drivers/base/core.c:3107 Call Trace: kill_device drivers/base/core.c:3079 [inline] device_del+0xb3/0x840 drivers/base/core.c:3107 del_gendisk+0x463/0x5f0 block/genhd.c:971 loop_remove drivers/block/loop.c:2190 [inline] loop_control_ioctl drivers/block/loop.c:2289 [inline] The stack like below: Create loop device: loop_control_ioctl loop_add add_disk device_add_disk bdi_register bdi_register_va device_create device_create_groups_vargs device_add kfree(dev->p); dev->p = NULL; Remove loop device: loop_control_ioctl loop_remove del_gendisk device_del kill_device if (dev->p->dead) // p is null Fix it by adding a check for parm. Fixes: 770fe30a46a1 ("loop: add management interface for on-demand device allocation") Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Reviewed-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> Conflict: drivers/block/loop.c Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/block/loop.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/block/loop.c b/drivers/block/loop.c index 9f2d412fc560..631bc2543d74 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c @@ -1992,6 +1992,17 @@ static int loop_add(int i) struct gendisk *disk; int err; + /* + * i << part_shift is actually used as the first_minor. + * So here should avoid i << part_shift overflow. + * And, MKDEV() expect that the max bits of + * first_minor is 20. + */ + if (i > 0 && i > MINORMASK >> part_shift) { + err = -EINVAL; + goto out; + } + err = -ENOMEM; lo = kzalloc(sizeof(*lo), GFP_KERNEL); if (!lo) @@ -2011,7 +2022,8 @@ static int loop_add(int i) if (err == -ENOSPC) err = -EEXIST; } else { - err = idr_alloc(&loop_index_idr, lo, 0, 0, GFP_KERNEL); + err = idr_alloc(&loop_index_idr, lo, 0, + (MINORMASK >> part_shift) + 1, GFP_KERNEL); } mutex_unlock(&loop_ctl_mutex); if (err < 0) -- 2.31.1

2 1