- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 V3 00/12] Add SDEI Watchdog Support
by Xiongfeng Wang 05 Dec '23

05 Dec '23

Xiongfeng Wang (12): firmware: arm_sdei: add interrupt binding api firmware: arm_sdei: make 'sdei_api_event_disable/enable' public lockup_detector: init lockup detector after all the init_calls watchdog: add nmi_watchdog support for arm64 based on SDEI sdei_watchdog: clear EOI of the secure timer before kdump sdei_watchdog: set secure timer period base on 'watchdog_thresh' sdei_watchdog: avoid possible false hardlockup init: only move down lockup_detector_init() when sdei_watchdog is enabled kprobes/arm64: Blacklist sdei watchdog callback functions openeuler_defconfig: Enable SDEI Watchdog stop_machine: mask sdei before running the callback arm64: kexec: only clear EOI for SDEI in NMI context arch/arm64/configs/openeuler_defconfig | 3 +- arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/machine_kexec.c | 11 ++ arch/arm64/kernel/watchdog_sdei.c | 151 +++++++++++++++++++++++++ drivers/firmware/arm_sdei.c | 26 ++++- include/linux/arm_sdei.h | 5 + include/linux/nmi.h | 8 ++ include/uapi/linux/arm_sdei.h | 2 + init/main.c | 7 +- kernel/stop_machine.c | 10 ++ kernel/watchdog.c | 3 + lib/Kconfig.debug | 9 ++ 12 files changed, 232 insertions(+), 4 deletions(-) create mode 100644 arch/arm64/kernel/watchdog_sdei.c -- 2.20.1

2 13

[PATCH OLK-6.6] nbd: get config_lock before sock_shutdown
by Li Lingfeng 05 Dec '23

05 Dec '23

From: Zhong Jinghua <zhongjinghua(a)huawei.com> hulk inclusion category: bugfix bugzilla: 188799, https://gitee.com/openeuler/kernel/issues/I79QWO CVE: NA ---------------------------------------- Config->socks in sock_shutdown may trigger a UAF problem. The reason is that sock_shutdown does not hold the config_lock, so that nbd_ioctl can release config->socks at this time. T0: NBD_SET_SOCK T1: NBD_DO_IT T0 T1 nbd_ioctl mutex_lock(&nbd->config_lock) // get lock __nbd_ioctl nbd_start_device_ioctl nbd_start_device mutex_unlock(&nbd->config_lock) // relase lock wait_event_interruptible (kill, enter sock_shutdown) sock_shutdown nbd_ioctl mutex_lock(&nbd->config_lock) // get lock __nbd_ioctl nbd_add_socket krealloc kfree(p) //config->socks is NULL nbd_sock *nsock = config->socks // error Fix it by moving config_lock up before sock_shutdown. Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/block/nbd.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c index 855fdf5c3b4e..9f03cdcb86c7 100644 --- a/drivers/block/nbd.c +++ b/drivers/block/nbd.c @@ -1417,13 +1417,18 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd) mutex_unlock(&nbd->config_lock); ret = wait_event_interruptible(config->recv_wq, atomic_read(&config->recv_threads) == 0); + + /* + * recv_work in flush_workqueue will not get this lock, because nbd_open + * will hold nbd->config_refs + */ + mutex_lock(&nbd->config_lock); if (ret) { sock_shutdown(nbd); nbd_clear_que(nbd); } flush_workqueue(nbd->recv_workq); - mutex_lock(&nbd->config_lock); nbd_bdev_reset(nbd); /* user requested, ignore socket errors */ if (test_bit(NBD_RT_DISCONNECT_REQUESTED, &config->runtime_flags)) -- 2.31.1

2 1

[PATCH OLK-5.10] drivers/perf: hisi: Fix some event id for HiSilicon UC pmu
by Junhao He 05 Dec '23

05 Dec '23

maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LSBA CVE: NA Reference: https://lore.kernel.org/lkml/20231204110425.20354-1-hejunhao3@huawei.com/ -------------------------------- Some event id of HiSilicon uncore UC PMU driver is incorrect, fix them. Fixes: 312eca95e28d ("drivers/perf: hisi: Add support for HiSilicon UC PMU driver") Signed-off-by: Junhao He <hejunhao3(a)huawei.com> --- drivers/perf/hisilicon/hisi_uncore_uc_pmu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c b/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c index 63da05e5831c..636fb79647c8 100644 --- a/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c +++ b/drivers/perf/hisilicon/hisi_uncore_uc_pmu.c @@ -383,8 +383,8 @@ static struct attribute *hisi_uc_pmu_events_attr[] = { HISI_PMU_EVENT_ATTR(cpu_rd, 0x10), HISI_PMU_EVENT_ATTR(cpu_rd64, 0x17), HISI_PMU_EVENT_ATTR(cpu_rs64, 0x19), - HISI_PMU_EVENT_ATTR(cpu_mru, 0x1a), - HISI_PMU_EVENT_ATTR(cycles, 0x9c), + HISI_PMU_EVENT_ATTR(cpu_mru, 0x1c), + HISI_PMU_EVENT_ATTR(cycles, 0x95), HISI_PMU_EVENT_ATTR(spipe_hit, 0xb3), HISI_PMU_EVENT_ATTR(hpipe_hit, 0xdb), HISI_PMU_EVENT_ATTR(cring_rxdat_cnt, 0xfa), -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS v2] net: prevent rewrite of msg_name in sock_sendmsg()
by Lu Wei 05 Dec '23

05 Dec '23

From: Jordan Rife <jrife(a)google.com> stable inclusion from stable-v4.19.297 commit 3d62f2577c7414e5b94e4baad6eb621165960f30 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8EZY4 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 86a7e0b69bd5b812e48a20c66c2161744f3caa16 ] Callers of sock_sendmsg(), and similarly kernel_sendmsg(), in kernel space may observe their value of msg_name change in cases where BPF sendmsg hooks rewrite the send address. This has been confirmed to break NFS mounts running in UDP mode and has the potential to break other systems. This patch: 1) Creates a new function called __sock_sendmsg() with same logic as the old sock_sendmsg() function. 2) Replaces calls to sock_sendmsg() made by __sys_sendto() and __sys_sendmsg() with __sock_sendmsg() to avoid an unnecessary copy, as these system calls are already protected. 3) Modifies sock_sendmsg() so that it makes a copy of msg_name if present before passing it down the stack to insulate callers from changes to the send address. Link: https://lore.kernel.org/netdev/20230912013332.2048422-1-jrife@google.com/ Fixes: 1cedee13d25a ("bpf: Hooks for sys_sendmsg") Cc: stable(a)vger.kernel.org Reviewed-by: Willem de Bruijn <willemb(a)google.com> Signed-off-by: Jordan Rife <jrife(a)google.com> Reviewed-by: Simon Horman <horms(a)kernel.org> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> conflict: net/socket.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/socket.c | 25 +++++++++++++++++++++---- 1 file changed, 21 insertions(+), 4 deletions(-) diff --git a/net/socket.c b/net/socket.c index 3d3632fe4a34..691dd9fb5d1f 100644 --- a/net/socket.c +++ b/net/socket.c @@ -653,13 +653,30 @@ static inline int sock_sendmsg_nosec(struct socket *sock, struct msghdr *msg) return ret; } -int sock_sendmsg(struct socket *sock, struct msghdr *msg) +static int __sock_sendmsg(struct socket *sock, struct msghdr *msg) { int err = security_socket_sendmsg(sock, msg, msg_data_left(msg)); return err ?: sock_sendmsg_nosec(sock, msg); } + +int sock_sendmsg(struct socket *sock, struct msghdr *msg) +{ + struct sockaddr_storage *save_addr = (struct sockaddr_storage *)msg->msg_name; + struct sockaddr_storage address; + int ret; + + if (msg->msg_name) { + memcpy(&address, msg->msg_name, msg->msg_namelen); + msg->msg_name = &address; + } + + ret = __sock_sendmsg(sock, msg); + msg->msg_name = save_addr; + + return ret; +} EXPORT_SYMBOL(sock_sendmsg); /** @@ -963,7 +980,7 @@ static ssize_t sock_write_iter(struct kiocb *iocb, struct iov_iter *from) if (sock->type == SOCK_SEQPACKET) msg.msg_flags |= MSG_EOR; - res = sock_sendmsg(sock, &msg); + res = __sock_sendmsg(sock, &msg); *from = msg.msg_iter; return res; } @@ -1940,7 +1957,7 @@ int __sys_sendto(int fd, void __user *buff, size_t len, unsigned int flags, if (sock->file->f_flags & O_NONBLOCK) flags |= MSG_DONTWAIT; msg.msg_flags = flags; - err = sock_sendmsg(sock, &msg); + err = __sock_sendmsg(sock, &msg); out_put: fput_light(sock->file, fput_needed); @@ -2272,7 +2289,7 @@ static int ____sys_sendmsg(struct socket *sock, struct msghdr *msg_sys, err = sock_sendmsg_nosec(sock, msg_sys); goto out_freectl; } - err = sock_sendmsg(sock, msg_sys); + err = __sock_sendmsg(sock, msg_sys); /* * If this is sendmmsg() and sending to current destination address was * successful, remember it. -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] fs: don't audit the capability check in simple_xattr_list()
by Zizhi Wo 04 Dec '23

04 Dec '23

From: Ondrej Mosnacek <omosnace(a)redhat.com> mainline inclusion from mainline-v6.2-rc1 commit e7eda157c4071cd1e69f4b1687b0fbe1ae5e6f46 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8LQI5?from=project-issue CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The check being unconditional may lead to unwanted denials reported by LSMs when a process has the capability granted by DAC, but denied by an LSM. In the case of SELinux such denials are a problem, since they can't be effectively filtered out via the policy and when not silenced, they produce noise that may hide a true problem or an attack. Checking for the capability only if any trusted xattr is actually present wouldn't really address the issue, since calling listxattr(2) on such node on its own doesn't indicate an explicit attempt to see the trusted xattrs. Additionally, it could potentially leak the presence of trusted xattrs to an unprivileged user if they can check for the denials (e.g. through dmesg). Therefore, it's best (and simplest) to keep the check unconditional and instead use ns_capable_noaudit() that will silence any associated LSM denials. Fixes: 38f38657444d ("xattr: extract simple_xattr code from tmpfs") Reported-by: Martin Pitt <mpitt(a)redhat.com> Suggested-by: Christian Brauner (Microsoft) <brauner(a)kernel.org> Signed-off-by: Ondrej Mosnacek <omosnace(a)redhat.com> Reviewed-by: Christian Brauner (Microsoft) <brauner(a)kernel.org> Reviewed-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Christian Brauner (Microsoft) <brauner(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/xattr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/xattr.c b/fs/xattr.c index 470ee0af3200..5c3407e18e15 100644 --- a/fs/xattr.c +++ b/fs/xattr.c @@ -1012,7 +1012,7 @@ static int xattr_list_one(char **buffer, ssize_t *remaining_size, ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs, char *buffer, size_t size) { - bool trusted = capable(CAP_SYS_ADMIN); + bool trusted = ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN); struct simple_xattr *xattr; ssize_t remaining_size = size; int err = 0; -- 2.39.2

2 1

[PATCH OLK-6.6 V3 00/12] Add SDEI Watchdog Support
by Xiongfeng Wang 04 Dec '23

04 Dec '23

Xiongfeng Wang (12): firmware: arm_sdei: add interrupt binding api firmware: arm_sdei: make 'sdei_api_event_disable/enable' public lockup_detector: init lockup detector after all the init_calls watchdog: add nmi_watchdog support for arm64 based on SDEI sdei_watchdog: clear EOI of the secure timer before kdump sdei_watchdog: set secure timer period base on 'watchdog_thresh' sdei_watchdog: avoid possible false hardlockup init: only move down lockup_detector_init() when sdei_watchdog is enabled kprobes/arm64: Blacklist sdei watchdog callback functions openeuler_defconfig: Enable SDEI Watchdog stop_machine: mask sdei before running the callback arm64: kexec: only clear EOI for SDEI in NMI context arch/arm64/configs/openeuler_defconfig | 3 +- arch/arm64/kernel/Makefile | 1 + arch/arm64/kernel/machine_kexec.c | 11 ++ arch/arm64/kernel/watchdog_sdei.c | 151 +++++++++++++++++++++++++ drivers/firmware/arm_sdei.c | 26 ++++- include/linux/arm_sdei.h | 5 + include/linux/nmi.h | 8 ++ include/uapi/linux/arm_sdei.h | 2 + init/main.c | 7 +- kernel/stop_machine.c | 10 ++ kernel/watchdog.c | 3 + lib/Kconfig.debug | 9 ++ 12 files changed, 232 insertions(+), 4 deletions(-) create mode 100644 arch/arm64/kernel/watchdog_sdei.c -- 2.20.1

1 12

[PATCH OLK-5.10 0/6] bring mc support to page eject
by Wupeng Ma 04 Dec '23

04 Dec '23

From: Ma Wupeng <mawupeng1(a)huawei.com> During page eject, machine check safe is enhanced as follow: During soft offline page, page is copied to new page in kernel. If the origin page has UCE, there will lead to kernel panic. In order to solve this problem, use machine check safe to catch this error which can be achieved by using copy_mc_to_kernel to replace copy_page. Signal SIGBUS will be send to user task if this UCE is consumed by this situation to avoid kernel panic. Jiaqi Yan (1): mm/hwpoison: introduce copy_mc_highpage Ma Wupeng (5): mm/hwpoison: arm64: introduce copy_mc_highpage mm/hwpoison: introduce copy_mc_highpages mm/hwpoison: add migrate_page_mc_extra() mm: Update PF_COREDUMP_MCS to PF_MCS mm: page_eject: Add mc support during offline page arch/arm64/include/asm/page.h | 1 + arch/arm64/mm/copypage.c | 13 ++++++ drivers/ras/page_eject.c | 5 +++ fs/coredump.c | 4 +- include/linux/highmem.h | 52 +++++++++++++++++++++++ include/linux/sched.h | 2 +- lib/iov_iter.c | 2 +- mm/migrate.c | 77 +++++++++++++++++++++++++++++++---- 8 files changed, 143 insertions(+), 13 deletions(-) -- 2.25.1

2 7

[PATCH OLK-6.6 00/19] Add sharepool support
by Wang Wensheng 04 Dec '23

04 Dec '23

This patch series migrates share pool features from OLK-5.10 to OLK-6.6. We don't want to do this work patch by patch since there are hundreds of patches in OLK-5.10 including bugfix and small features generation. Instead we just take the final version and split it into a few small patches, each of which contains one feature at the final version. The share pool features is a big feature, it is mainly used to share user virtual memory for different processes in the same group. It could be used by this steps: Process A create a new group which is owned by process A. Process A add process B to the group. Process A add process C to the same group. Process B alloc a new memory VA, and write something in it. The VA was send to the process C by IPC, then process C got it. The process C access the VA and got the data directly. The process A could add more processes in the group to share the memory. Fix the memory by use the free function or exit the group. The new features is enabled both by CONFIG_SHARE_POOL and the enable_ascend_share_pool bootarg, it would not affect anything if disabled. Wang Wensheng (19): mm/hugetlb: Introduce hugetlb_insert_hugepage_pte[_by_pa] mm/vmalloc: Extend vmalloc usage about hugepage mm: Extend mmap assocated functions to accept mm_struct mm/sharepool: Add base framework for share_pool mm/sharepool: Add sp_area management code mm/sharepool: Reserve the va space for share_pool mm/sharepool: Implement mg_sp_make_share_u2k() mm/sharepool: Implement mg_sp_unshare_kva mm/sharepool: Implement mg_sp_walk_page_range() mm/sharepool: Implement mg_sp_free() mm/sharepool: Implement mg_sp_alloc() mm/sharepool: Implement mg_sp_make_share_k2u() mm/sharepool: Implement mg_sp_group_add_task() mm/sharepool: Implement mg_sp_group_id_by_pid() mm/sharepool: Implement mg_sp_id_of_current() mm/sharepool: Implement mg_sp_config_dvpp_range() mm/sharepool: Add proc interfaces to show sp info mm/sharepool: support fork() and exit() to handle the mm mm/sharepool: Protect the va reserved for sharepool include/linux/hugetlb.h | 32 + include/linux/mempolicy.h | 11 + include/linux/mm.h | 17 + include/linux/mm_types.h | 6 + include/linux/share_pool.h | 277 +++ include/linux/vmalloc.h | 18 + kernel/fork.c | 3 + mm/Kconfig | 34 + mm/Makefile | 1 + mm/gup.c | 23 +- mm/hugetlb.c | 78 + mm/mempolicy.c | 12 +- mm/mmap.c | 50 +- mm/mremap.c | 4 + mm/share_pool.c | 3450 ++++++++++++++++++++++++++++++++++++ mm/util.c | 4 + mm/vmalloc.c | 205 ++- 17 files changed, 4204 insertions(+), 21 deletions(-) create mode 100644 include/linux/share_pool.h create mode 100644 mm/share_pool.c -- 2.17.1

3 22

[PATCH OLK-5.10 0/6] bring mc support to page eject
by Wupeng Ma 04 Dec '23

04 Dec '23

From: Ma Wupeng <mawupeng1(a)huawei.com> During page eject, machine check safe is enhanced as follow: During soft offline page, page is copied to new page in kernel. If the origin page has UCE, there will lead to kernel panic. In order to solve this problem, use machine check safe to catch this error which can be achieved by using copy_mc_to_kernel to replace copy_page. Signal SIGBUS will be send to user task if this UCE is consumed by this situation to avoid kernel panic. Jiaqi Yan (1): mm/hwpoison: introduce copy_mc_highpage Ma Wupeng (5): mm/hwpoison: arm64: introduce copy_mc_highpage mm/hwpoison: introduce copy_mc_highpages mm/hwpoison: add migrate_page_mc_extra() mm: Update PF_COREDUMP_MCS to PF_MCS mm: page_eject: Add mc support during offline page arch/arm64/include/asm/page.h | 1 + arch/arm64/mm/copypage.c | 13 ++++++ drivers/ras/page_eject.c | 5 +++ fs/coredump.c | 4 +- include/linux/highmem.h | 52 +++++++++++++++++++++++ include/linux/sched.h | 2 +- lib/iov_iter.c | 2 +- mm/migrate.c | 77 +++++++++++++++++++++++++++++++---- 8 files changed, 143 insertions(+), 13 deletions(-) -- 2.25.1

1 6

[PATCH OLK-5.10 00/15] Some fixes and optimizations for hisi_sas
by Yihang Li 04 Dec '23

04 Dec '23

From: xiabing <xiabing12(a)h-partners.com> This patchset includes some changes for hisi_sas: - Fix NULL pointer issue when removing debugfs. - Directly calling register snapshot instead of workqueue. - Allocate debugfs memory during triggering debugfs dump. - Fix issue that device is not found because .phy_attached is not set. - Replace with standard error code return value. - Check the variable slot before use it. - Clear HISI_SAS_RESET_BIT, release hisi_hba semaphore, unblock the scsi host, clear HISI_SAS_REJECT_CMD_BIT if FLR failed. - Use the correct number of registers when reading register information. - Fix warnings detected by sparse - Handle the NCQ error returned by D2H frame Xiang Chen (1): scsi: hisi_sas: Remove unused variable and check in hisi_sas_send_ata_reset_each_phy() Xingui Yang (3): scsi: hisi_sas: Fix normally completed I/O analysed as failed scsi: hisi_sas: Fix warnings detected by sparse scsi: hisi_sas: Handle the NCQ error returned by D2H frame Yihang Li (11): scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs scsi: hisi_sas: Directly call register snapshot instead of using workqueue scsi: hisi_sas: Allocate DFX memory during dump trigger scsi: hisi_sas: Remove redundant checks for automatic debugfs dump scsi: hisi_sas: Set .phy_attached before notifing phyup event HISI_PHYE_PHY_UP_PM scsi: hisi_sas: Replace with standard error code return value scsi: hisi_sas: Check before using pointer variables scsi: hisi_sas: Rollback some operations if FLR failed scsi: hisi_sas: Correct the number of global debugfs registers scsi: hisi_sas: Fix the deadlock issue that occurs during automatic dump scsi: hisi_sas: Check whether debugfs is enabled before removing or releasing it drivers/scsi/hisi_sas/hisi_sas.h | 3 +- drivers/scsi/hisi_sas/hisi_sas_main.c | 37 ++++-- drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 11 +- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 164 +++++++++++++------------ 4 files changed, 120 insertions(+), 95 deletions(-) -- 2.30.0

1 15