- Kernel - mailweb.openeuler.org

[PATCH OLK-6.6 0/6] Adding Huawei BMA driver
by Zheng Zengkai 12 Mar '24

12 Mar '24

From: Huajingjing <huajingjing1(a)huawei.com> This patch set contains 5 communication drivers for Huawei BMA software. The BMA software is a system management software. It supports the status monitoring, performance monitoring, and event monitoring of various components, including server CPUs, memory, hard disks, NICs, IB cards, PCIe cards, RAID controller cards, and optical modules. These 5 drivers are used to send/receive message through PCIe channel in different ways by BMA software. Huajingjing (6): Huawei BMA: Adding Huawei BMA driver: host_edma_drv Huawei BMA: Adding Huawei BMA driver: host_cdev_drv Huawei BMA: Adding Huawei BMA driver: host_veth_drv Huawei BMA: Adding Huawei BMA driver: host_kbox_drv Huawei BMA: Adding Huawei BMA driver: cdev_veth_drv configs: add config BMA to config files arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/net/ethernet/huawei/Kconfig | 1 + drivers/net/ethernet/huawei/Makefile | 1 + drivers/net/ethernet/huawei/bma/Kconfig | 10 + drivers/net/ethernet/huawei/bma/Makefile | 9 + .../net/ethernet/huawei/bma/cdev_drv/Makefile | 2 + .../ethernet/huawei/bma/cdev_drv/bma_cdev.c | 369 +++ .../huawei/bma/cdev_veth_drv/Makefile | 2 + .../bma/cdev_veth_drv/virtual_cdev_eth_net.c | 1864 ++++++++++++ .../bma/cdev_veth_drv/virtual_cdev_eth_net.h | 299 ++ .../net/ethernet/huawei/bma/edma_drv/Makefile | 2 + .../huawei/bma/edma_drv/bma_devintf.c | 621 ++++ .../huawei/bma/edma_drv/bma_devintf.h | 40 + .../huawei/bma/edma_drv/bma_include.h | 116 + .../ethernet/huawei/bma/edma_drv/bma_pci.c | 533 ++++ .../ethernet/huawei/bma/edma_drv/bma_pci.h | 98 + .../ethernet/huawei/bma/edma_drv/edma_host.c | 1462 ++++++++++ .../ethernet/huawei/bma/edma_drv/edma_host.h | 351 +++ .../huawei/bma/include/bma_ker_intf.h | 94 + .../net/ethernet/huawei/bma/kbox_drv/Makefile | 5 + .../ethernet/huawei/bma/kbox_drv/kbox_dump.c | 121 + .../ethernet/huawei/bma/kbox_drv/kbox_dump.h | 33 + .../ethernet/huawei/bma/kbox_drv/kbox_hook.c | 102 + .../ethernet/huawei/bma/kbox_drv/kbox_hook.h | 33 + .../huawei/bma/kbox_drv/kbox_include.h | 40 + .../ethernet/huawei/bma/kbox_drv/kbox_main.c | 176 ++ .../ethernet/huawei/bma/kbox_drv/kbox_main.h | 23 + .../ethernet/huawei/bma/kbox_drv/kbox_mce.c | 264 ++ .../ethernet/huawei/bma/kbox_drv/kbox_mce.h | 23 + .../ethernet/huawei/bma/kbox_drv/kbox_panic.c | 187 ++ .../ethernet/huawei/bma/kbox_drv/kbox_panic.h | 25 + .../huawei/bma/kbox_drv/kbox_printk.c | 363 +++ .../huawei/bma/kbox_drv/kbox_printk.h | 33 + .../huawei/bma/kbox_drv/kbox_ram_drive.c | 188 ++ .../huawei/bma/kbox_drv/kbox_ram_drive.h | 31 + .../huawei/bma/kbox_drv/kbox_ram_image.c | 135 + .../huawei/bma/kbox_drv/kbox_ram_image.h | 84 + .../huawei/bma/kbox_drv/kbox_ram_op.c | 986 +++++++ .../huawei/bma/kbox_drv/kbox_ram_op.h | 77 + .../net/ethernet/huawei/bma/veth_drv/Makefile | 2 + .../ethernet/huawei/bma/veth_drv/veth_hb.c | 2504 +++++++++++++++++ .../ethernet/huawei/bma/veth_drv/veth_hb.h | 440 +++ 43 files changed, 11751 insertions(+) create mode 100644 drivers/net/ethernet/huawei/bma/Kconfig create mode 100644 drivers/net/ethernet/huawei/bma/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/cdev_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/cdev_drv/bma_cdev.c create mode 100644 drivers/net/ethernet/huawei/bma/cdev_veth_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.c create mode 100644 drivers/net/ethernet/huawei/bma/cdev_veth_drv/virtual_cdev_eth_net.h create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.c create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_devintf.h create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_include.h create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.c create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/bma_pci.h create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/edma_host.c create mode 100644 drivers/net/ethernet/huawei/bma/edma_drv/edma_host.h create mode 100644 drivers/net/ethernet/huawei/bma/include/bma_ker_intf.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_dump.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_dump.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_hook.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_hook.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_include.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_main.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_mce.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_panic.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_panic.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_printk.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_printk.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_drive.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_drive.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_image.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_image.h create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.c create mode 100644 drivers/net/ethernet/huawei/bma/kbox_drv/kbox_ram_op.h create mode 100644 drivers/net/ethernet/huawei/bma/veth_drv/Makefile create mode 100644 drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.c create mode 100644 drivers/net/ethernet/huawei/bma/veth_drv/veth_hb.h -- 2.27.0

2 7

[PATCH OLK-5.10] nfc: nci: assert requested protocol is valid
by Liu Jian 12 Mar '24

12 Mar '24

From: Jeremy Cline <jeremy(a)jcline.org> stable inclusion from stable-v5.10.199 commit a424807d860ba816aaafc3064b46b456361c0802 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1K CVE: CVE-2023-52507 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 354a6e707e29cb0c007176ee5b8db8be7bd2dee0 ] The protocol is used in a bit mask to determine if the protocol is supported. Assert the provided protocol is less than the maximum defined so it doesn't potentially perform a shift-out-of-bounds and provide a clearer error for undefined protocols vs unsupported ones. Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Reported-and-tested-by: syzbot+0839b78e119aae1fec78(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0839b78e119aae1fec78 Signed-off-by: Jeremy Cline <jeremy(a)jcline.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20231009200054.82557-1-jeremy@jcline.org Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/nfc/nci/core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c index ed9019d807c7..4c931bd1c174 100644 --- a/net/nfc/nci/core.c +++ b/net/nfc/nci/core.c @@ -894,6 +894,11 @@ static int nci_activate_target(struct nfc_dev *nfc_dev, return -EINVAL; } + if (protocol >= NFC_PROTO_MAX) { + pr_err("the requested nfc protocol is invalid\n"); + return -EINVAL; + } + if (!(nci_target->supported_protocols & (1 << protocol))) { pr_err("target does not support the requested protocol 0x%x\n", protocol); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] nfc: nci: assert requested protocol is valid
by Liu Jian 12 Mar '24

12 Mar '24

From: Jeremy Cline <jeremy(a)jcline.org> stable inclusion from stable-v4.19.297 commit a686f84101680b8442181a8846fbd3c934653729 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1K CVE: CVE-2023-52507 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 354a6e707e29cb0c007176ee5b8db8be7bd2dee0 ] The protocol is used in a bit mask to determine if the protocol is supported. Assert the provided protocol is less than the maximum defined so it doesn't potentially perform a shift-out-of-bounds and provide a clearer error for undefined protocols vs unsupported ones. Fixes: 6a2968aaf50c ("NFC: basic NCI protocol implementation") Reported-and-tested-by: syzbot+0839b78e119aae1fec78(a)syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=0839b78e119aae1fec78 Signed-off-by: Jeremy Cline <jeremy(a)jcline.org> Reviewed-by: Simon Horman <horms(a)kernel.org> Link: https://lore.kernel.org/r/20231009200054.82557-1-jeremy@jcline.org Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/nfc/nci/core.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c index 75017a345b5a..6ba0cdbf8c4a 100644 --- a/net/nfc/nci/core.c +++ b/net/nfc/nci/core.c @@ -902,6 +902,11 @@ static int nci_activate_target(struct nfc_dev *nfc_dev, return -EINVAL; } + if (protocol >= NFC_PROTO_MAX) { + pr_err("the requested nfc protocol is invalid\n"); + return -EINVAL; + } + if (!(nci_target->supported_protocols & (1 << protocol))) { pr_err("target does not support the requested protocol 0x%x\n", protocol); -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS 0/2] arm64/mpam: Fix use-after-free when deleting resource groups
by Zeng Heng 12 Mar '24

12 Mar '24

Wang ShaoBo (1): arm64/mpam: remove kernfs_get() calls() and add kernfs_put() calls to prevent refcount leak Zeng Heng (1): arm64/mpam: Fix use-after-free when deleting resource groups arch/arm64/include/asm/resctrl.h | 18 +++++++++++++ arch/arm64/kernel/mpam/mpam_ctrlmon.c | 8 ------ arch/arm64/kernel/mpam/mpam_resctrl.c | 2 +- fs/resctrlfs.c | 37 ++++++++++----------------- 4 files changed, 32 insertions(+), 33 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS] RDMA/srp: Do not call scsi_done() from srp_abort()
by Liu Jian 12 Mar '24

12 Mar '24

From: Bart Van Assche <bvanassche(a)acm.org> stable inclusion from stable-v5.10.199 commit 26788a5b48d9d5cd3283d777d238631c8cd7495a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1O CVE: CVE-2023-52515 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e193b7955dfad68035b983a0011f4ef3590c85eb ] After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is returned. Cc: Bob Pearson <rpearsonhpe(a)gmail.com> Cc: Shinichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Fixes: d8536670916a ("IB/srp: Avoid having aborted requests hang") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://lore.kernel.org/r/20230823205727.505681-1-bvanassche@acm.org Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/infiniband/ulp/srp/ib_srp.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index 6dcdc42ed081..ec54cd687ef1 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -2917,7 +2917,6 @@ static int srp_abort(struct scsi_cmnd *scmnd) u32 tag; u16 ch_idx; struct srp_rdma_ch *ch; - int ret; shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n"); @@ -2933,19 +2932,14 @@ static int srp_abort(struct scsi_cmnd *scmnd) shost_printk(KERN_ERR, target->scsi_host, "Sending SRP abort for tag %#x\n", tag); if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun, - SRP_TSK_ABORT_TASK, NULL) == 0) - ret = SUCCESS; - else if (target->rport->state == SRP_RPORT_LOST) - ret = FAST_IO_FAIL; - else - ret = FAILED; - if (ret == SUCCESS) { + SRP_TSK_ABORT_TASK, NULL) == 0) { srp_free_req(ch, req, scmnd, 0); - scmnd->result = DID_ABORT << 16; - scmnd->scsi_done(scmnd); + return SUCCESS; } + if (target->rport->state == SRP_RPORT_LOST) + return FAST_IO_FAIL; - return ret; + return FAILED; } static int srp_reset_device(struct scsi_cmnd *scmnd) -- 2.34.1

2 1

[PATCH OLK-5.10] RDMA/srp: Do not call scsi_done() from srp_abort()
by Liu Jian 12 Mar '24

12 Mar '24

From: Bart Van Assche <bvanassche(a)acm.org> stable inclusion from stable-v5.10.199 commit 26788a5b48d9d5cd3283d777d238631c8cd7495a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I95B1O CVE: CVE-2023-52515 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit e193b7955dfad68035b983a0011f4ef3590c85eb ] After scmd_eh_abort_handler() has called the SCSI LLD eh_abort_handler callback, it performs one of the following actions: * Call scsi_queue_insert(). * Call scsi_finish_command(). * Call scsi_eh_scmd_add(). Hence, SCSI abort handlers must not call scsi_done(). Otherwise all the above actions would trigger a use-after-free. Hence remove the scsi_done() call from srp_abort(). Keep the srp_free_req() call before returning SUCCESS because we may not see the command again if SUCCESS is returned. Cc: Bob Pearson <rpearsonhpe(a)gmail.com> Cc: Shinichiro Kawasaki <shinichiro.kawasaki(a)wdc.com> Fixes: d8536670916a ("IB/srp: Avoid having aborted requests hang") Signed-off-by: Bart Van Assche <bvanassche(a)acm.org> Link: https://lore.kernel.org/r/20230823205727.505681-1-bvanassche@acm.org Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- drivers/infiniband/ulp/srp/ib_srp.c | 16 +++++----------- 1 file changed, 5 insertions(+), 11 deletions(-) diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c index 9b9b9557ae74..11f9cb222bdc 100644 --- a/drivers/infiniband/ulp/srp/ib_srp.c +++ b/drivers/infiniband/ulp/srp/ib_srp.c @@ -2803,7 +2803,6 @@ static int srp_abort(struct scsi_cmnd *scmnd) u32 tag; u16 ch_idx; struct srp_rdma_ch *ch; - int ret; shost_printk(KERN_ERR, target->scsi_host, "SRP abort called\n"); @@ -2819,19 +2818,14 @@ static int srp_abort(struct scsi_cmnd *scmnd) shost_printk(KERN_ERR, target->scsi_host, "Sending SRP abort for tag %#x\n", tag); if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun, - SRP_TSK_ABORT_TASK, NULL) == 0) - ret = SUCCESS; - else if (target->rport->state == SRP_RPORT_LOST) - ret = FAST_IO_FAIL; - else - ret = FAILED; - if (ret == SUCCESS) { + SRP_TSK_ABORT_TASK, NULL) == 0) { srp_free_req(ch, req, scmnd, 0); - scmnd->result = DID_ABORT << 16; - scmnd->scsi_done(scmnd); + return SUCCESS; } + if (target->rport->state == SRP_RPORT_LOST) + return FAST_IO_FAIL; - return ret; + return FAILED; } static int srp_reset_device(struct scsi_cmnd *scmnd) -- 2.34.1

2 1

[PATCH OLK-5.10] arm64/mpam: Remove warning about no msc corresponding to the online cpu
by Zeng Heng 12 Mar '24

12 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I96YK9 CVE: NA ----------------------------- It's fine that the associated msc is not found when the CPU comes online. For example, the device platform does not support L3 cache and there is no any L3 cache msc indeed. Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_setup.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_setup.c b/arch/arm64/kernel/mpam/mpam_setup.c index 4d0ec0052133..0cfb3cd21858 100644 --- a/arch/arm64/kernel/mpam/mpam_setup.c +++ b/arch/arm64/kernel/mpam/mpam_setup.c @@ -78,9 +78,11 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, } } - /* cpu with unknown exported component? */ - if (WARN_ON_ONCE(!comp)) + if (!comp) { + pr_info_once("There is no msc corresponding to CPU%d.\n", cpu); return 0; + } + dom = kzalloc_node(sizeof(*dom), GFP_KERNEL, cpu_to_node(cpu)); if (!dom) @@ -168,9 +170,10 @@ int mpam_resctrl_cpu_offline(unsigned int cpu) for_each_supported_resctrl_exports(res) { d = resctrl_get_domain_from_cpu(cpu, &res->resctrl_res); - /* cpu with unknown exported component? */ - if (WARN_ON_ONCE(!d)) + if (!d) { + pr_info_once("There is no msc corresponding to CPU%d.\n", cpu); continue; + } cpumask_clear_cpu(cpu, &d->cpu_mask); -- 2.25.1

2 1

[PATCH OLK-5.10] arm64/mpam: Expand the monitor number of the resctrl root
by Zeng Heng 12 Mar '24

12 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I97GSW ----------------------------- Expand the monitor number of the resctrl root to 1023, instead of 255. Fixes: 0b16164dc7a9 ("arm64/mpam: Remap reqpartid,pmg to rmid and intpartid to closid") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/resctrlfs.c | 32 ++++++++++++++------------------ 1 file changed, 14 insertions(+), 18 deletions(-) diff --git a/fs/resctrlfs.c b/fs/resctrlfs.c index 3f650eafccd0..0bbe0c50f4f9 100644 --- a/fs/resctrlfs.c +++ b/fs/resctrlfs.c @@ -672,26 +672,22 @@ static int find_rdtgrp_allocable_rmid(struct resctrl_group *rdtgrp) struct list_head *head; prgrp = rdtgrp->mon.parent; - if (prgrp == &resctrl_group_default) { - rmid = rmid_alloc(-1); - if (rmid < 0) - return rmid; - } else { - do { - rmid = rmid_alloc(prgrp->closid.reqpartid); + + do { + rmid = rmid_alloc(prgrp->closid.reqpartid); + if (rmid >= 0) + break; + + head = &prgrp->mon.crdtgrp_list; + list_for_each_entry(entry, head, mon.crdtgrp_list) { + if (entry == rdtgrp) + continue; + + rmid = rmid_alloc(entry->closid.reqpartid); if (rmid >= 0) break; - - head = &prgrp->mon.crdtgrp_list; - list_for_each_entry(entry, head, mon.crdtgrp_list) { - if (entry == rdtgrp) - continue; - rmid = rmid_alloc(entry->closid.reqpartid); - if (rmid >= 0) - break; - } - } while (0); - } + } + } while (0); if (rmid < 0) rmid = rmid_alloc(-1); -- 2.25.1

2 1

[openeuler:OLK-5.10 9183/30000] mm/share_pool.c:4221:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'?
by kernel test robot 12 Mar '24

12 Mar '24

tree: https://gitee.com/openeuler/kernel.git OLK-5.10 head: 2ad5d68f167008a56711bd61c282768420796602 commit: c533562a2802206135467a06384ba33cff42b18a [9183/30000] share_pool: Use sharepool_no_page to alloc hugepage config: arm64-randconfig-003-20240312 (https://download.01.org/0day-ci/archive/20240312/202403121009.nJzCAN1u-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240312/202403121009.nJzCAN1u-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202403121009.nJzCAN1u-lkp@intel.com/ All errors (new ones prefixed by >>): mm/share_pool.c: In function 'mg_sp_group_id_by_pid': mm/share_pool.c:858:29: warning: ordered comparison of pointer with integer zero [-Wextra] 858 | if (!spg_ids || num <= 0) | ^~ mm/share_pool.c: In function 'sp_hugetlb_entry': mm/share_pool.c:3014:21: error: implicit declaration of function 'huge_ptep_get' [-Werror=implicit-function-declaration] 3014 | pte_t pte = huge_ptep_get(ptep); | ^~~~~~~~~~~~~ mm/share_pool.c:3014:21: error: invalid initializer mm/share_pool.c: In function 'sp_unshare_kva': mm/share_pool.c:3394:14: warning: variable 'is_hugepage' set but not used [-Wunused-but-set-variable] 3394 | bool is_hugepage = true; | ^~~~~~~~~~~ mm/share_pool.c: At top level: mm/share_pool.c:3691:6: warning: no previous prototype for 'sp_proc_stat_drop' [-Wmissing-prototypes] 3691 | void sp_proc_stat_drop(struct sp_proc_stat *stat) | ^~~~~~~~~~~~~~~~~ mm/share_pool.c:3922:6: warning: no previous prototype for 'spa_overview_show' [-Wmissing-prototypes] 3922 | void spa_overview_show(struct seq_file *seq) | ^~~~~~~~~~~~~~~~~ mm/share_pool.c:4004:6: warning: no previous prototype for 'spg_overview_show' [-Wmissing-prototypes] 4004 | void spg_overview_show(struct seq_file *seq) | ^~~~~~~~~~~~~~~~~ mm/share_pool.c: In function 'sharepool_no_page': >> mm/share_pool.c:4221:30: error: implicit declaration of function 'huge_pte_none'; did you mean 'huge_pte_lock'? [-Werror=implicit-function-declaration] 4221 | if (!huge_pte_none(huge_ptep_get(ptep))) { | ^~~~~~~~~~~~~ | huge_pte_lock >> mm/share_pool.c:4234:23: error: implicit declaration of function 'huge_add_to_page_cache'; did you mean 'add_to_page_cache'? [-Werror=implicit-function-declaration] 4234 | err = huge_add_to_page_cache(page, mapping, idx); | ^~~~~~~~~~~~~~~~~~~~~~ | add_to_page_cache >> mm/share_pool.c:4256:9: error: implicit declaration of function 'set_huge_pte_at'; did you mean 'set_huge_swap_pte_at'? [-Werror=implicit-function-declaration] 4256 | set_huge_pte_at(mm, haddr, ptep, new_pte); | ^~~~~~~~~~~~~~~ | set_huge_swap_pte_at >> mm/share_pool.c:4258:9: error: implicit declaration of function 'hugetlb_count_add'; did you mean 'hugetlb_count_sub'? [-Werror=implicit-function-declaration] 4258 | hugetlb_count_add(pages_per_huge_page(h), mm); | ^~~~~~~~~~~~~~~~~ | hugetlb_count_sub cc1: some warnings being treated as errors vim +4221 mm/share_pool.c 4179 4180 vm_fault_t sharepool_no_page(struct mm_struct *mm, 4181 struct vm_area_struct *vma, 4182 struct address_space *mapping, pgoff_t idx, 4183 unsigned long address, pte_t *ptep, unsigned int flags) 4184 { 4185 struct hstate *h = hstate_vma(vma); 4186 vm_fault_t ret = VM_FAULT_SIGBUS; 4187 unsigned long size; 4188 struct page *page; 4189 pte_t new_pte; 4190 spinlock_t *ptl; 4191 unsigned long haddr = address & huge_page_mask(h); 4192 bool new_page = false; 4193 int err; 4194 int node_id; 4195 struct sp_area *spa; 4196 4197 spa = __find_sp_area(vma->vm_start); 4198 if (!spa) { 4199 pr_err("share pool: vma is invalid, not from sp mmap\n"); 4200 return ret; 4201 } 4202 node_id = spa->node_id; 4203 __sp_area_drop(spa); 4204 4205 retry: 4206 page = find_lock_page(mapping, idx); 4207 if (!page) { 4208 size = i_size_read(mapping->host) >> huge_page_shift(h); 4209 if (idx >= size) 4210 goto out; 4211 4212 page = alloc_huge_page(vma, haddr, 0); 4213 if (IS_ERR(page)) { 4214 page = alloc_huge_page_nodemask(hstate_file(vma->vm_file), 4215 node_id, NULL, GFP_KERNEL); 4216 if (!page) 4217 page = ERR_PTR(-ENOMEM); 4218 } 4219 if (IS_ERR(page)) { 4220 ptl = huge_pte_lock(h, mm, ptep); > 4221 if (!huge_pte_none(huge_ptep_get(ptep))) { 4222 ret = 0; 4223 spin_unlock(ptl); 4224 goto out; 4225 } 4226 spin_unlock(ptl); 4227 ret = vmf_error(PTR_ERR(page)); 4228 goto out; 4229 } 4230 __SetPageUptodate(page); 4231 new_page = true; 4232 4233 /* sharepool pages are all shared */ > 4234 err = huge_add_to_page_cache(page, mapping, idx); 4235 if (err) { 4236 put_page(page); 4237 if (err == -EEXIST) 4238 goto retry; 4239 goto out; 4240 } 4241 } 4242 4243 4244 ptl = huge_pte_lock(h, mm, ptep); 4245 size = i_size_read(mapping->host) >> huge_page_shift(h); 4246 if (idx >= size) 4247 goto backout; 4248 4249 ret = 0; 4250 if (!huge_pte_none(huge_ptep_get(ptep))) 4251 goto backout; 4252 4253 page_dup_rmap(page, true); 4254 new_pte = make_huge_pte(vma, page, ((vma->vm_flags & VM_WRITE) 4255 && (vma->vm_flags & VM_SHARED))); > 4256 set_huge_pte_at(mm, haddr, ptep, new_pte); 4257 > 4258 hugetlb_count_add(pages_per_huge_page(h), mm); 4259 4260 spin_unlock(ptl); 4261 4262 if (new_page) { 4263 SetPagePrivate(&page[1]); 4264 } 4265 4266 unlock_page(page); 4267 out: 4268 return ret; 4269 4270 backout: 4271 spin_unlock(ptl); 4272 unlock_page(page); 4273 put_page(page); 4274 goto out; 4275 } 4276 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] arm64/mpam: Fix use-after-free when deleting resource groups
by Zeng Heng 12 Mar '24

12 Mar '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I97KAV -------------------------------- Refer to the below commit: commit b8511ccc75c0 ("x86/resctrl: Fix use-after-free when deleting resource groups") Before removing rdtgroup, we need to refer to waitcount counter, otherwise when unmounting the resctrl file system or deleting ctrl_mon groups, and there were a waiter on resctrl system, then a use-after-free issue would occurs. Fix that by removing rdtgroup after checking the waitcount. Fixes: 3b856c03b36a ("arm64/mpam: remove kernfs_get() calls() and add kernfs_put() calls to prevent refcount leak") Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- fs/resctrlfs.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/fs/resctrlfs.c b/fs/resctrlfs.c index e02e4769edc0..3f650eafccd0 100644 --- a/fs/resctrlfs.c +++ b/fs/resctrlfs.c @@ -485,7 +485,10 @@ static void free_all_child_rdtgrp(struct resctrl_group *rdtgrp) /* rmid may not be used */ rmid_free(sentry->mon.rmid); list_del(&sentry->mon.crdtgrp_list); - rdtgroup_remove(sentry); + if (atomic_read(&sentry->waitcount) != 0) + sentry->flags = RDT_DELETED; + else + rdtgroup_remove(sentry); } } @@ -519,7 +522,10 @@ static void rmdir_all_sub(void) kernfs_remove(rdtgrp->kn); list_del(&rdtgrp->resctrl_group_list); - rdtgroup_remove(rdtgrp); + if (atomic_read(&rdtgrp->waitcount) != 0) + rdtgrp->flags = RDT_DELETED; + else + rdtgroup_remove(rdtgrp); } /* Notify online CPUs to update per cpu storage and PQR_ASSOC MSR */ update_closid_rmid(cpu_online_mask, &resctrl_group_default); -- 2.25.1

2 1