- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/2] Fix CVE-2023-5717
by Yang Jihong 26 Oct '23

26 Oct '23

Peter Zijlstra (1): perf: Disallow mis-matched inherited group reads Yang Jihong (1): perf: Fix kabi breakage in struct perf_event include/linux/perf_event.h | 4 ++++ kernel/events/core.c | 40 ++++++++++++++++++++++++++++++++------ 2 files changed, 38 insertions(+), 6 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 1/2] perf: Disallow mis-matched inherited group reads
by Yang Jihong 26 Oct '23

26 Oct '23

From: Peter Zijlstra <peterz(a)infradead.org> stable inclusion from stable-v4.19.297 commit a714491fa92d2068358dd603cc50bf2062517bd8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I8B1X3 CVE: CVE-2023-5717 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- commit 32671e3799ca2e4590773fd0e63aaa4229e50c06 upstream. Because group consistency is non-atomic between parent (filedesc) and children (inherited) events, it is possible for PERF_FORMAT_GROUP read() to try and sum non-matching counter groups -- with non-sensical results. Add group_generation to distinguish the case where a parent group removes and adds an event and thus has the same number, but a different configuration of events as inherited groups. This became a problem when commit fa8c269353d5 ("perf/core: Invert perf_read_group() loops") flipped the order of child_list and sibling_list. Previously it would iterate the group (sibling_list) first, and for each sibling traverse the child_list. In this order, only the group composition of the parent is relevant. By flipping the order the group composition of the child (inherited) events becomes an issue and the mis-match in group composition becomes evident. That said; even prior to this commit, while reading of a group that is not equally inherited was not broken, it still made no sense. (Ab)use ECHILD as error return to indicate issues with child process group composition. Fixes: fa8c269353d5 ("perf/core: Invert perf_read_group() loops") Reported-by: Budimir Markovic <markovicbudimir(a)gmail.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20231018115654.GK33217@noisy.programming.kicks-as… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Jihong <yangjihong1(a)huawei.com> --- include/linux/perf_event.h | 1 + kernel/events/core.c | 40 ++++++++++++++++++++++++++++++++------ 2 files changed, 35 insertions(+), 6 deletions(-) diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h index 514962a49c62..a4bee4a4ae13 100644 --- a/include/linux/perf_event.h +++ b/include/linux/perf_event.h @@ -622,6 +622,7 @@ struct perf_event { /* The cumulative AND of all event_caps for events in this group. */ int group_caps; + unsigned int group_generation; struct perf_event *group_leader; struct pmu *pmu; void *pmu_private; diff --git a/kernel/events/core.c b/kernel/events/core.c index 5407c5ef7da8..a49860879777 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -1843,6 +1843,7 @@ static void perf_group_attach(struct perf_event *event) list_add_tail(&event->sibling_list, &group_leader->sibling_list); group_leader->nr_siblings++; + group_leader->group_generation++; perf_event__header_size(group_leader); @@ -1934,6 +1935,7 @@ static void perf_group_detach(struct perf_event *event) if (leader != event) { list_del_init(&event->sibling_list); event->group_leader->nr_siblings--; + event->group_leader->group_generation++; goto out; } @@ -4761,7 +4763,7 @@ static int __perf_read_group_add(struct perf_event *leader, u64 read_format, u64 *values) { struct perf_event_context *ctx = leader->ctx; - struct perf_event *sub; + struct perf_event *sub, *parent; unsigned long flags; int n = 1; /* skip @nr */ int ret; @@ -4771,6 +4773,33 @@ static int __perf_read_group_add(struct perf_event *leader, return ret; raw_spin_lock_irqsave(&ctx->lock, flags); + /* + * Verify the grouping between the parent and child (inherited) + * events is still in tact. + * + * Specifically: + * - leader->ctx->lock pins leader->sibling_list + * - parent->child_mutex pins parent->child_list + * - parent->ctx->mutex pins parent->sibling_list + * + * Because parent->ctx != leader->ctx (and child_list nests inside + * ctx->mutex), group destruction is not atomic between children, also + * see perf_event_release_kernel(). Additionally, parent can grow the + * group. + * + * Therefore it is possible to have parent and child groups in a + * different configuration and summing over such a beast makes no sense + * what so ever. + * + * Reject this. + */ + parent = leader->parent; + if (parent && + (parent->group_generation != leader->group_generation || + parent->nr_siblings != leader->nr_siblings)) { + ret = -ECHILD; + goto unlock; + } /* * Since we co-schedule groups, {enabled,running} times of siblings @@ -4800,8 +4829,9 @@ static int __perf_read_group_add(struct perf_event *leader, values[n++] = primary_event_id(sub); } +unlock: raw_spin_unlock_irqrestore(&ctx->lock, flags); - return 0; + return ret; } static int perf_read_group(struct perf_event *event, @@ -4820,10 +4850,6 @@ static int perf_read_group(struct perf_event *event, values[0] = 1 + leader->nr_siblings; - /* - * By locking the child_mutex of the leader we effectively - * lock the child list of all siblings.. XXX explain how. - */ mutex_lock(&leader->child_mutex); ret = __perf_read_group_add(leader, read_format, values); @@ -11679,6 +11705,8 @@ static int inherit_group(struct perf_event *parent_event, if (IS_ERR(child_ctr)) return PTR_ERR(child_ctr); } + if (leader) + leader->group_generation = parent_event->group_generation; return 0; } -- 2.34.1

2 3

[PATCH v5] libhns: Skip resolving MAC for RDMA over UBLink
by Chengchang Tang 26 Oct '23

26 Oct '23

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8AL44 For RDMA over UBLink, MAC Layer if replaced by UBLink, and thus the MAC addr is not nedded. So skip the MAC addr resolving for this mode. Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> Signed-off-by: Haoyue Xu <xuhaoyue1(a)hisilicon.com> Signed-off-by: Junxian Huang <huangjunxian6(a)hisilicon.com> --- providers/hns/hns_roce_u.c | 37 +++++++++++++++++++++++++++++++- providers/hns/hns_roce_u.h | 9 ++++---- providers/hns/hns_roce_u_hw_v2.c | 2 +- providers/hns/hns_roce_u_verbs.c | 3 ++- 4 files changed, 44 insertions(+), 7 deletions(-) diff --git a/providers/hns/hns_roce_u.c b/providers/hns/hns_roce_u.c index 02ad880..cef64ec 100644 --- a/providers/hns/hns_roce_u.c +++ b/providers/hns/hns_roce_u.c @@ -56,6 +56,7 @@ static const struct verbs_match_ent hca_table[] = { VERBS_PCI_MATCH(PCI_VENDOR_ID_HUAWEI, 0xA22C, &hns_roce_u_hw_v2), VERBS_PCI_MATCH(PCI_VENDOR_ID_HUAWEI, 0xA22D, &hns_roce_u_hw_v2), VERBS_PCI_MATCH(PCI_VENDOR_ID_HUAWEI, 0xA22F, &hns_roce_u_hw_v2), + VERBS_PCI_MATCH(PCI_VENDOR_ID_HUAWEI, 0xA26A, &hns_roce_u_hw_v2), {} }; @@ -95,6 +96,23 @@ static const struct verbs_context_ops hns_common_ops = { .alloc_parent_domain = hns_roce_u_alloc_pad, }; +static struct { + uint32_t device_id; + enum hns_device_link_type link_type; +} device_link_types[] = { + {0xA222, HNS_DEV_LINK_TYPE_ETH}, + {0xA223, HNS_DEV_LINK_TYPE_ETH}, + {0xA224, HNS_DEV_LINK_TYPE_ETH}, + {0xA225, HNS_DEV_LINK_TYPE_ETH}, + {0xA226, HNS_DEV_LINK_TYPE_ETH}, + {0xA228, HNS_DEV_LINK_TYPE_ETH}, + {0xA22F, HNS_DEV_LINK_TYPE_ETH}, + {0xA227, HNS_DEV_LINK_TYPE_HCCS}, + {0xA22C, HNS_DEV_LINK_TYPE_HCCS}, + {0xA22D, HNS_DEV_LINK_TYPE_HCCS}, + {0xA26A, HNS_DEV_LINK_TYPE_UB} +}; + static int mmap_dca(struct hns_roce_context *ctx, int cmd_fd, int page_size, size_t size, uint64_t mmap_key) { @@ -256,6 +274,21 @@ static int hns_roce_mmap(struct hns_roce_device *hr_dev, return 0; } +static int get_link_type(uint32_t device_id, + enum hns_device_link_type *link_type) +{ + int i; + + for (i = 0; i < ARRAY_SIZE(device_link_types); i++) { + if (device_id == device_link_types[i].device_id) { + *link_type = device_link_types[i].link_type; + return 0; + } + } + + return ENOENT; +} + static uint32_t calc_table_shift(uint32_t entry_count, uint32_t size_shift) { uint32_t count_shift = hr_ilog32(entry_count); @@ -302,7 +335,6 @@ static struct verbs_context *hns_roce_alloc_context(struct ibv_device *ibdev, &resp.ibv_resp, sizeof(resp))) goto err_free; - hr_dev->mac_type = resp.mac_type; hr_dev->congest_type = resp.congest_type; if (!resp.cqe_size) @@ -338,6 +370,9 @@ static struct verbs_context *hns_roce_alloc_context(struct ibv_device *ibdev, goto err_free; hr_dev->hw_version = dev_attrs.hw_ver; + if (get_link_type(dev_attrs.vendor_part_id, &hr_dev->link_type)) + hr_dev->link_type = resp.mac_type; + context->max_qp_wr = dev_attrs.max_qp_wr; context->max_sge = dev_attrs.max_sge; context->max_cqe = dev_attrs.max_cqe; diff --git a/providers/hns/hns_roce_u.h b/providers/hns/hns_roce_u.h index 3491097..e7313c2 100644 --- a/providers/hns/hns_roce_u.h +++ b/providers/hns/hns_roce_u.h @@ -161,9 +161,10 @@ enum { #define HNS_ROCE_SRQ_TABLE_BITS 8 #define HNS_ROCE_SRQ_TABLE_SIZE BIT(HNS_ROCE_SRQ_TABLE_BITS) -enum { - HNAE3_MAC_ETH, - HNAE3_MAC_ROH, +enum hns_device_link_type { + HNS_DEV_LINK_TYPE_ETH, + HNS_DEV_LINK_TYPE_HCCS, + HNS_DEV_LINK_TYPE_UB, }; struct hns_roce_device { @@ -171,7 +172,7 @@ struct hns_roce_device { int page_size; const struct hns_roce_u_hw *u_hw; int hw_version; - uint8_t mac_type; + enum hns_device_link_type link_type; uint8_t congest_type; }; diff --git a/providers/hns/hns_roce_u_hw_v2.c b/providers/hns/hns_roce_u_hw_v2.c index 61c4981..fe7e1ac 100644 --- a/providers/hns/hns_roce_u_hw_v2.c +++ b/providers/hns/hns_roce_u_hw_v2.c @@ -1431,7 +1431,7 @@ static int set_ud_wqe(void *wqe, struct hns_roce_qp *qp, struct ibv_send_wr *wr, if (ret) return ret; - if (hr_dev->mac_type == HNAE3_MAC_ROH) + if (hr_dev->link_type == HNS_DEV_LINK_TYPE_HCCS) ud_sq_wqe->dmac[0] = 0xFF; ret = fill_ud_data_seg(ud_sq_wqe, qp, wr, sge_info); diff --git a/providers/hns/hns_roce_u_verbs.c b/providers/hns/hns_roce_u_verbs.c index b9be376..abeb1ab 100644 --- a/providers/hns/hns_roce_u_verbs.c +++ b/providers/hns/hns_roce_u_verbs.c @@ -2018,7 +2018,8 @@ struct ibv_ah *hns_roce_u_create_ah(struct ibv_pd *pd, struct ibv_ah_attr *attr) if (ibv_cmd_create_ah(pd, &ah->ibv_ah, attr, &resp.ibv_resp, sizeof(resp))) goto err; - if (ibv_resolve_eth_l2_from_gid(pd->context, attr, ah->av.mac, NULL)) + if (hr_dev->link_type != HNS_DEV_LINK_TYPE_UB && + ibv_resolve_eth_l2_from_gid(pd->context, attr, ah->av.mac, NULL)) goto err; if (resp.tc_mode == HNS_ROCE_TC_MAP_MODE_DSCP) -- 2.30.0

1 2

[PATCH OLK-5.10] LoongArch: default IPMI related defconfig to m
by Hongchen Zhang 26 Oct '23

26 Oct '23

LoongArch inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I8B19Y ------------------------------------------ Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> --- arch/loongarch/configs/loongson3_defconfig | 14 ++++++-------- 1 file changed, 6 insertions(+), 8 deletions(-) diff --git a/arch/loongarch/configs/loongson3_defconfig b/arch/loongarch/configs/loongson3_defconfig index ec53e95bf30d..d2beed31ab74 100644 --- a/arch/loongarch/configs/loongson3_defconfig +++ b/arch/loongarch/configs/loongson3_defconfig @@ -512,8 +512,6 @@ CONFIG_NET_CLS_FW=m CONFIG_NET_CLS_U32=m CONFIG_CLS_U32_PERF=y CONFIG_CLS_U32_MARK=y -CONFIG_NET_CLS_RSVP=m -CONFIG_NET_CLS_RSVP6=m CONFIG_NET_CLS_FLOW=m CONFIG_NET_CLS_CGROUP=y CONFIG_NET_CLS_BPF=m @@ -1143,14 +1141,13 @@ CONFIG_NOZOMI=m CONFIG_PRINTER=m CONFIG_PPDEV=m CONFIG_VIRTIO_CONSOLE=y -CONFIG_IPMI_HANDLER=y +CONFIG_IPMI_HANDLER=m CONFIG_IPMI_PANIC_EVENT=y CONFIG_IPMI_PANIC_STRING=y -CONFIG_IPMI_DEVICE_INTERFACE=y -CONFIG_IPMI_SI=y -CONFIG_IPMI_SSIF=y -CONFIG_IPMI_WATCHDOG=y -CONFIG_IPMI_POWEROFF=y +CONFIG_IPMI_DEVICE_INTERFACE=m +CONFIG_IPMI_SSIF=m +CONFIG_IPMI_WATCHDOG=m +CONFIG_IPMI_POWEROFF=m CONFIG_HW_RANDOM=y CONFIG_HW_RANDOM_TIMERIOMEM=m CONFIG_HW_RANDOM_VIRTIO=m @@ -1510,6 +1507,7 @@ CONFIG_DRM_CIRRUS_QEMU=m CONFIG_FB_TILEBLITTING=y CONFIG_FB_EFI=y CONFIG_FB_RADEON=y +CONFIG_FB_SIMPLE=y CONFIG_FB_LS2K500=m CONFIG_LCD_CLASS_DEVICE=m CONFIG_LCD_PLATFORM=m -- 2.33.0

2 1

[PATCH v3 OLK-5.10 00/28] Introduce some vdpa ops to support vdpa device live migrate
by Jiang Dongxu 26 Oct '23

26 Oct '23

From: jiangdongxu <jiangdongxu1(a)huawei.com> Patch 1-17: some bugfix and ops intruduced by upstream Patch 18-19: introduce vdpa device logging ops Patch 20-21: introduce vdpa device state ops Patch 22-23: introduce vdpa device migrate state ops Patch 24: introduce new vhost feature BYTEPMAPLOG Patch 25: export iommu_get_resv_regions/iommu_set_resv_regions Patch 26-27: some optimization about vhost-vdpa Patch 28: add vdpa/vhost-vdpa build config Arnaldo Carvalho de Melo (1): tools include UAPI: Sync linux/vhost.h with the kernel sources Cindy Lu (2): vhost_vdpa: fix the crash in unmap a large memory vhost_vdpa: fix unmap process in no-batch mode Eugenio Pérez (1): vdpa: add get_backend_features vdpa operation Gautam Dawar (1): vhost-vdpa: free iommu domain after last use during cleanup Greg Kroah-Hartman (1): vhost-vdpa: vhost_vdpa_alloc_domain() should be using a const struct bus_type * Jason Gunthorpe (1): PCI/IOV: Add pci_iov_vf_id() to get VF index Sebastien Boeuf (3): vdpa: Add resume operation vhost-vdpa: Introduce RESUME backend feature bit vhost-vdpa: uAPI to resume the device Shannon Nelson (2): vhost_vdpa: tell vqs about the negotiated vhost_vdpa: support PACKED when setting-getting vring_base Shunsuke Mie (1): virtio: fix virtio transitional ids Stefano Garzarella (3): vhost-vdpa: fix an iotlb memory leak vdpa: add bind_mm/unbind_mm callbacks vhost-vdpa: use bind_mm/unbind_mm device callbacks Zhu Lingshan (1): virtio: update virtio id table, add transitional ids jiangdongxu (11): vdpa: add log operations vhost-vdpa: add uAPI for logging vdpa: add device state operations vhost-vdpa: add uAPI for device buffer vdpa: add vdpa device migration status ops vhost-vdpa: add uAPI for device migration status vhost: add VHOST feature VHOST_BACKEND_F_BYTEMAPLOG export iommu_get_resv_regions and iommu_set_resv_regions vhost-vdpa: Allow transparent MSI IOV vhost-vdpa: fix msi irq request err arm64: openeuler_defconfig: add VDPA config arch/arm64/configs/openeuler_defconfig | 6 +- drivers/iommu/iommu.c | 2 + drivers/pci/iov.c | 14 + drivers/vhost/vdpa.c | 385 ++++++++++++++++++++++--- include/linux/pci.h | 8 +- include/linux/vdpa.h | 60 +++- include/uapi/linux/vhost.h | 20 ++ include/uapi/linux/vhost_types.h | 21 ++ include/uapi/linux/virtio_ids.h | 12 + tools/include/uapi/linux/vhost.h | 8 + 10 files changed, 490 insertions(+), 46 deletions(-) -- 2.27.0

2 29

[PATCH openEuler-1.0-LTS] media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
by Peng Zhang 26 Oct '23

26 Oct '23

From: Hyunwoo Kim <v4bel(a)theori.io> mainline inclusion from mainline-v6.4-rc3 commit 280a8ab81733da8bc442253c700a52c4c0886ffd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I63D3C CVE: CVE-2022-45919 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- If the device node of dvb_ca_en50221 is open() and the device is disconnected, a UAF may occur when calling close() on the device node. The root cause is that wake_up() and wait_event() for dvbdev->wait_queue are not implemented. So implement wait_event() function in dvb_ca_en50221_release() and add 'remove_mutex' which prevents race condition for 'ca->exit'. [mchehab: fix a checkpatch warning] Link: https://lore.kernel.org/linux-media/20221121063308.GA33821@ubuntu Signed-off-by: Hyunwoo Kim <v4bel(a)theori.io> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/media/dvb-core/dvb_ca_en50221.c | 37 ++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c index 4d371cea0d5d..fe152007c963 100644 --- a/drivers/media/dvb-core/dvb_ca_en50221.c +++ b/drivers/media/dvb-core/dvb_ca_en50221.c @@ -162,6 +162,12 @@ struct dvb_ca_private { /* mutex serializing ioctls */ struct mutex ioctl_mutex; + + /* A mutex used when a device is disconnected */ + struct mutex remove_mutex; + + /* Whether the device is disconnected */ + int exit; }; static void dvb_ca_private_free(struct dvb_ca_private *ca) @@ -1717,12 +1723,22 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) dprintk("%s\n", __func__); - if (!try_module_get(ca->pub->owner)) + mutex_lock(&ca->remove_mutex); + + if (ca->exit) { + mutex_unlock(&ca->remove_mutex); + return -ENODEV; + } + + if (!try_module_get(ca->pub->owner)) { + mutex_unlock(&ca->remove_mutex); return -EIO; + } err = dvb_generic_open(inode, file); if (err < 0) { module_put(ca->pub->owner); + mutex_unlock(&ca->remove_mutex); return err; } @@ -1747,6 +1763,7 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) dvb_ca_private_get(ca); + mutex_unlock(&ca->remove_mutex); return 0; } @@ -1766,6 +1783,8 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) dprintk("%s\n", __func__); + mutex_lock(&ca->remove_mutex); + /* mark the CA device as closed */ ca->open = 0; dvb_ca_en50221_thread_update_delay(ca); @@ -1776,6 +1795,13 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) dvb_ca_private_put(ca); + if (dvbdev->users == 1 && ca->exit == 1) { + mutex_unlock(&ca->remove_mutex); + wake_up(&dvbdev->wait_queue); + } else { + mutex_unlock(&ca->remove_mutex); + } + return err; } @@ -1900,6 +1926,7 @@ int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter, } mutex_init(&ca->ioctl_mutex); + mutex_init(&ca->remove_mutex); if (signal_pending(current)) { ret = -EINTR; @@ -1942,6 +1969,14 @@ void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca) dprintk("%s\n", __func__); + mutex_lock(&ca->remove_mutex); + ca->exit = 1; + mutex_unlock(&ca->remove_mutex); + + if (ca->dvbdev->users < 1) + wait_event(ca->dvbdev->wait_queue, + ca->dvbdev->users == 1); + /* shutdown the thread if there was one */ kthread_stop(ca->thread); -- 2.25.1

2 1

[PATCH OLK-5.10] media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
by Peng Zhang 26 Oct '23

26 Oct '23

From: Hyunwoo Kim <v4bel(a)theori.io> mainline inclusion from mainline-v6.4-rc3 commit 280a8ab81733da8bc442253c700a52c4c0886ffd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I63D3C CVE: CVE-2022-45919 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- If the device node of dvb_ca_en50221 is open() and the device is disconnected, a UAF may occur when calling close() on the device node. The root cause is that wake_up() and wait_event() for dvbdev->wait_queue are not implemented. So implement wait_event() function in dvb_ca_en50221_release() and add 'remove_mutex' which prevents race condition for 'ca->exit'. [mchehab: fix a checkpatch warning] Link: https://lore.kernel.org/linux-media/20221121063308.GA33821@ubuntu Signed-off-by: Hyunwoo Kim <v4bel(a)theori.io> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/media/dvb-core/dvb_ca_en50221.c | 37 ++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c index fd476536d32e..a8b4247cb5e4 100644 --- a/drivers/media/dvb-core/dvb_ca_en50221.c +++ b/drivers/media/dvb-core/dvb_ca_en50221.c @@ -151,6 +151,12 @@ struct dvb_ca_private { /* mutex serializing ioctls */ struct mutex ioctl_mutex; + + /* A mutex used when a device is disconnected */ + struct mutex remove_mutex; + + /* Whether the device is disconnected */ + int exit; }; static void dvb_ca_private_free(struct dvb_ca_private *ca) @@ -1706,12 +1712,22 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) dprintk("%s\n", __func__); - if (!try_module_get(ca->pub->owner)) + mutex_lock(&ca->remove_mutex); + + if (ca->exit) { + mutex_unlock(&ca->remove_mutex); + return -ENODEV; + } + + if (!try_module_get(ca->pub->owner)) { + mutex_unlock(&ca->remove_mutex); return -EIO; + } err = dvb_generic_open(inode, file); if (err < 0) { module_put(ca->pub->owner); + mutex_unlock(&ca->remove_mutex); return err; } @@ -1736,6 +1752,7 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) dvb_ca_private_get(ca); + mutex_unlock(&ca->remove_mutex); return 0; } @@ -1755,6 +1772,8 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) dprintk("%s\n", __func__); + mutex_lock(&ca->remove_mutex); + /* mark the CA device as closed */ ca->open = 0; dvb_ca_en50221_thread_update_delay(ca); @@ -1765,6 +1784,13 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) dvb_ca_private_put(ca); + if (dvbdev->users == 1 && ca->exit == 1) { + mutex_unlock(&ca->remove_mutex); + wake_up(&dvbdev->wait_queue); + } else { + mutex_unlock(&ca->remove_mutex); + } + return err; } @@ -1888,6 +1914,7 @@ int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter, } mutex_init(&ca->ioctl_mutex); + mutex_init(&ca->remove_mutex); if (signal_pending(current)) { ret = -EINTR; @@ -1930,6 +1957,14 @@ void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca) dprintk("%s\n", __func__); + mutex_lock(&ca->remove_mutex); + ca->exit = 1; + mutex_unlock(&ca->remove_mutex); + + if (ca->dvbdev->users < 1) + wait_event(ca->dvbdev->wait_queue, + ca->dvbdev->users == 1); + /* shutdown the thread if there was one */ kthread_stop(ca->thread); -- 2.25.1

2 3

[PATCH OLK-5.10 v3 0/8] Synchronize coresight driver bugfix patches to openEuler
by Junhao He 26 Oct '23

26 Oct '23

1. Fix memory leak coresight: Fix memory leak in acpi_buffer->pointer 2. Fix TRBE bug coresight: trbe: Fix TRBE potential sleep in atomic context coresight: trbe: Allocate platform data per device coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() 3. Fix ETR bug coresight: Fix run time warnings while reusing ETR buffer coresight: tmc-etr: Disable warnings for allocation failures 4. acpi: Ignore the absence of graph coresight: platform: acpi: Ignore the absence of graph Revert "coresight: Return the pointer of @pdata when not "fwnode"" Junhao He (3): Revert "coresight: Return the pointer of @pdata when not "fwnode"" coresight: Fix memory leak in acpi_buffer->pointer coresight: trbe: Fix TRBE potential sleep in atomic context Linu Cherian (1): coresight: Fix run time warnings while reusing ETR buffer Suzuki K Poulose (3): coresight: trbe: Allocate platform data per device coresight: platform: acpi: Ignore the absence of graph coresight: tmc-etr: Disable warnings for allocation failures Wei Yongjun (1): coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() .../hwtracing/coresight/coresight-platform.c | 56 ++++++++++++------- .../hwtracing/coresight/coresight-tmc-etr.c | 23 ++++---- drivers/hwtracing/coresight/coresight-trbe.c | 41 +++++++------- 3 files changed, 69 insertions(+), 51 deletions(-) -- 2.33.0

2 9

openEuler Kernel SIG双周例会
by openEuler conference 26 Oct '23

26 Oct '23

您好！ Kernel SIG 邀请您参加 2023-10-27 14:00 召开的WeLink会议(自动录制) 会议主题：openEuler Kernel SIG双周例会会议内容： 1. 进展update 2. 议题征集中（有新增议题可直接回复邮件申报，或录入会议看板）会议链接：https://bmeeting.huaweicloud.com:36443/#/j/965660880 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the WeLink conference(auto recording) will be held at 2023-10-27 14:00, The subject of the conference is openEuler Kernel SIG双周例会, Summary: 1. 进展update 2. 议题征集中（有新增议题可直接回复邮件申报，或录入会议看板） You can join the meeting at https://bmeeting.huaweicloud.com:36443/#/j/965660880. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH OLK-5.10] media: dvb-core: Fix use-after-free due to race condition at dvb_ca_en50221
by Peng Zhang 26 Oct '23

26 Oct '23

From: Hyunwoo Kim <v4bel(a)theori.io> mainline inclusion from mainline-v6.4-rc3 commit 280a8ab81733da8bc442253c700a52c4c0886ffd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I63D3C CVE: CVE-2022-45919 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- If the device node of dvb_ca_en50221 is open() and the device is disconnected, a UAF may occur when calling close() on the device node. The root cause is that wake_up() and wait_event() for dvbdev->wait_queue are not implemented. So implement wait_event() function in dvb_ca_en50221_release() and add 'remove_mutex' which prevents race condition for 'ca->exit'. [mchehab: fix a checkpatch warning] Link: https://lore.kernel.org/linux-media/20221121063308.GA33821@ubuntu Signed-off-by: Hyunwoo Kim <v4bel(a)theori.io> Signed-off-by: Mauro Carvalho Chehab <mchehab(a)kernel.org> Signed-off-by: ZhangPeng <zhangpeng362(a)huawei.com> --- drivers/media/dvb-core/dvb_ca_en50221.c | 37 ++++++++++++++++++++++++- 1 file changed, 36 insertions(+), 1 deletion(-) diff --git a/drivers/media/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb-core/dvb_ca_en50221.c index fd476536d32e..a8b4247cb5e4 100644 --- a/drivers/media/dvb-core/dvb_ca_en50221.c +++ b/drivers/media/dvb-core/dvb_ca_en50221.c @@ -151,6 +151,12 @@ struct dvb_ca_private { /* mutex serializing ioctls */ struct mutex ioctl_mutex; + + /* A mutex used when a device is disconnected */ + struct mutex remove_mutex; + + /* Whether the device is disconnected */ + int exit; }; static void dvb_ca_private_free(struct dvb_ca_private *ca) @@ -1706,12 +1712,22 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) dprintk("%s\n", __func__); - if (!try_module_get(ca->pub->owner)) + mutex_lock(&ca->remove_mutex); + + if (ca->exit) { + mutex_unlock(&ca->remove_mutex); + return -ENODEV; + } + + if (!try_module_get(ca->pub->owner)) { + mutex_unlock(&ca->remove_mutex); return -EIO; + } err = dvb_generic_open(inode, file); if (err < 0) { module_put(ca->pub->owner); + mutex_unlock(&ca->remove_mutex); return err; } @@ -1736,6 +1752,7 @@ static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file) dvb_ca_private_get(ca); + mutex_unlock(&ca->remove_mutex); return 0; } @@ -1755,6 +1772,8 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) dprintk("%s\n", __func__); + mutex_lock(&ca->remove_mutex); + /* mark the CA device as closed */ ca->open = 0; dvb_ca_en50221_thread_update_delay(ca); @@ -1765,6 +1784,13 @@ static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file) dvb_ca_private_put(ca); + if (dvbdev->users == 1 && ca->exit == 1) { + mutex_unlock(&ca->remove_mutex); + wake_up(&dvbdev->wait_queue); + } else { + mutex_unlock(&ca->remove_mutex); + } + return err; } @@ -1888,6 +1914,7 @@ int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter, } mutex_init(&ca->ioctl_mutex); + mutex_init(&ca->remove_mutex); if (signal_pending(current)) { ret = -EINTR; @@ -1930,6 +1957,14 @@ void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca) dprintk("%s\n", __func__); + mutex_lock(&ca->remove_mutex); + ca->exit = 1; + mutex_unlock(&ca->remove_mutex); + + if (ca->dvbdev->users < 1) + wait_event(ca->dvbdev->wait_queue, + ca->dvbdev->users == 1); + /* shutdown the thread if there was one */ kthread_stop(ca->thread); -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP2 0/3] Fix cgroup psi poll UAF
by Lu Jialin 26 Oct '23

26 Oct '23

Arnd Bergmann (1): kernfs: add stub helper for kernfs_generic_poll() Randy Dunlap (1): sched/psi: Select KERNFS as needed Suren Baghdasaryan (1): sched/psi: use kernfs polling functions for PSI trigger polling include/linux/kernfs.h | 4 ++++ include/linux/psi.h | 5 +++-- include/linux/psi_types.h | 3 +++ init/Kconfig | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/sched/psi.c | 29 +++++++++++++++++++++-------- 6 files changed, 33 insertions(+), 11 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] xen/events: replace evtchn_rwlock with RCU
by Liu Shixin 26 Oct '23

26 Oct '23

From: Juergen Gross <jgross(a)suse.com> stable inclusion from stable-v5.10.198 commit 660627c71bc1098aa94e5f208f14748b105b73bc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I896EC CVE: CVE-2023-34324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 87797fad6cce28ec9be3c13f031776ff4f104cfc upstream. In unprivileged Xen guests event handling can cause a deadlock with Xen console handling. The evtchn_rwlock and the hvc_lock are taken in opposite sequence in __hvc_poll() and in Xen console IRQ handling. Normally this is no problem, as the evtchn_rwlock is taken as a reader in both paths, but as soon as an event channel is being closed, the lock will be taken as a writer, which will cause read_lock() to block: CPU0 CPU1 CPU2 (IRQ handling) (__hvc_poll()) (closing event channel) read_lock(evtchn_rwlock) spin_lock(hvc_lock) write_lock(evtchn_rwlock) [blocks] spin_lock(hvc_lock) [blocks] read_lock(evtchn_rwlock) [blocks due to writer waiting, and not in_interrupt()] This issue can be avoided by replacing evtchn_rwlock with RCU in xen_free_irq(). Note that RCU is used only to delay freeing of the irq_info memory. There is no RCU based dereferencing or replacement of pointers involved. In order to avoid potential races between removing the irq_info reference and handling of interrupts, set the irq_info pointer to NULL only when freeing its memory. The IRQ itself must be freed at that time, too, as otherwise the same IRQ number could be allocated again before handling of the old instance would have been finished. This is XSA-441 / CVE-2023-34324. Fixes: 54c9de89895e ("xen/events: add a new "late EOI" evtchn framework") Reported-by: Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com> Signed-off-by: Juergen Gross <jgross(a)suse.com> Reviewed-by: Julien Grall <jgrall(a)amazon.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/xen/events/events_base.c | 87 +++++++++++++++++--------------- 1 file changed, 46 insertions(+), 41 deletions(-) diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c index fba78daee449a..52891546e6973 100644 --- a/drivers/xen/events/events_base.c +++ b/drivers/xen/events/events_base.c @@ -33,6 +33,7 @@ #include <linux/slab.h> #include <linux/irqnr.h> #include <linux/pci.h> +#include <linux/rcupdate.h> #include <linux/spinlock.h> #include <linux/cpuhotplug.h> #include <linux/atomic.h> @@ -94,6 +95,7 @@ enum xen_irq_type { struct irq_info { struct list_head list; struct list_head eoi_list; + struct rcu_work rwork; short refcnt; short spurious_cnt; short type; /* type */ @@ -141,23 +143,13 @@ const struct evtchn_ops *evtchn_ops; */ static DEFINE_MUTEX(irq_mapping_update_lock); -/* - * Lock protecting event handling loop against removing event channels. - * Adding of event channels is no issue as the associated IRQ becomes active - * only after everything is setup (before request_[threaded_]irq() the handler - * can't be entered for an event, as the event channel will be unmasked only - * then). - */ -static DEFINE_RWLOCK(evtchn_rwlock); - /* * Lock hierarchy: * * irq_mapping_update_lock - * evtchn_rwlock - * IRQ-desc lock - * percpu eoi_list_lock - * irq_info->lock + * IRQ-desc lock + * percpu eoi_list_lock + * irq_info->lock */ static LIST_HEAD(xen_irq_list_head); @@ -272,6 +264,22 @@ static void set_info_for_irq(unsigned int irq, struct irq_info *info) irq_set_chip_data(irq, info); } +static void delayed_free_irq(struct work_struct *work) +{ + struct irq_info *info = container_of(to_rcu_work(work), struct irq_info, + rwork); + unsigned int irq = info->irq; + + /* Remove the info pointer only now, with no potential users left. */ + set_info_for_irq(irq, NULL); + + kfree(info); + + /* Legacy IRQ descriptors are managed by the arch. */ + if (irq >= nr_legacy_irqs()) + irq_free_desc(irq); +} + /* Constructors for packed IRQ information. */ static int xen_irq_info_common_setup(struct irq_info *info, unsigned irq, @@ -606,33 +614,36 @@ static void xen_irq_lateeoi_worker(struct work_struct *work) eoi = container_of(to_delayed_work(work), struct lateeoi_work, delayed); - read_lock_irqsave(&evtchn_rwlock, flags); + rcu_read_lock(); while (true) { - spin_lock(&eoi->eoi_list_lock); + spin_lock_irqsave(&eoi->eoi_list_lock, flags); info = list_first_entry_or_null(&eoi->eoi_list, struct irq_info, eoi_list); - if (info == NULL || now < info->eoi_time) { - spin_unlock(&eoi->eoi_list_lock); + if (info == NULL) + break; + + if (now < info->eoi_time) { + mod_delayed_work_on(info->eoi_cpu, system_wq, + &eoi->delayed, + info->eoi_time - now); break; } list_del_init(&info->eoi_list); - spin_unlock(&eoi->eoi_list_lock); + spin_unlock_irqrestore(&eoi->eoi_list_lock, flags); info->eoi_time = 0; xen_irq_lateeoi_locked(info, false); } - if (info) - mod_delayed_work_on(info->eoi_cpu, system_wq, - &eoi->delayed, info->eoi_time - now); + spin_unlock_irqrestore(&eoi->eoi_list_lock, flags); - read_unlock_irqrestore(&evtchn_rwlock, flags); + rcu_read_unlock(); } static void xen_cpu_init_eoi(unsigned int cpu) @@ -647,16 +658,15 @@ static void xen_cpu_init_eoi(unsigned int cpu) void xen_irq_lateeoi(unsigned int irq, unsigned int eoi_flags) { struct irq_info *info; - unsigned long flags; - read_lock_irqsave(&evtchn_rwlock, flags); + rcu_read_lock(); info = info_for_irq(irq); if (info) xen_irq_lateeoi_locked(info, eoi_flags & XEN_EOI_FLAG_SPURIOUS); - read_unlock_irqrestore(&evtchn_rwlock, flags); + rcu_read_unlock(); } EXPORT_SYMBOL_GPL(xen_irq_lateeoi); @@ -675,6 +685,7 @@ static void xen_irq_init(unsigned irq) info->type = IRQT_UNBOUND; info->refcnt = -1; + INIT_RCU_WORK(&info->rwork, delayed_free_irq); set_info_for_irq(irq, info); @@ -727,31 +738,18 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi) static void xen_free_irq(unsigned irq) { struct irq_info *info = info_for_irq(irq); - unsigned long flags; if (WARN_ON(!info)) return; - write_lock_irqsave(&evtchn_rwlock, flags); - if (!list_empty(&info->eoi_list)) lateeoi_list_del(info); list_del(&info->list); - set_info_for_irq(irq, NULL); - WARN_ON(info->refcnt > 0); - write_unlock_irqrestore(&evtchn_rwlock, flags); - - kfree(info); - - /* Legacy IRQ descriptors are managed by the arch. */ - if (irq < nr_legacy_irqs()) - return; - - irq_free_desc(irq); + queue_rcu_work(system_wq, &info->rwork); } static void xen_evtchn_close(evtchn_port_t port) @@ -1639,7 +1637,14 @@ static void __xen_evtchn_do_upcall(void) int cpu = smp_processor_id(); struct evtchn_loop_ctrl ctrl = { 0 }; - read_lock(&evtchn_rwlock); + /* + * When closing an event channel the associated IRQ must not be freed + * until all cpus have left the event handling loop. This is ensured + * by taking the rcu_read_lock() while handling events, as freeing of + * the IRQ is handled via queue_rcu_work() _after_ closing the event + * channel. + */ + rcu_read_lock(); do { vcpu_info->evtchn_upcall_pending = 0; @@ -1652,7 +1657,7 @@ static void __xen_evtchn_do_upcall(void) } while (vcpu_info->evtchn_upcall_pending); - read_unlock(&evtchn_rwlock); + rcu_read_unlock(); /* * Increment irq_epoch only now to defer EOIs only for -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/3] Fix cgroup poll UAF
by Lu Jialin 26 Oct '23

26 Oct '23

Arnd Bergmann (1): kernfs: add stub helper for kernfs_generic_poll() Randy Dunlap (1): sched/psi: Select KERNFS as needed Suren Baghdasaryan (1): sched/psi: use kernfs polling functions for PSI trigger polling include/linux/kernfs.h | 4 ++++ include/linux/psi.h | 5 +++-- include/linux/psi_types.h | 3 +++ init/Kconfig | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/sched/psi.c | 29 +++++++++++++++++++++-------- 6 files changed, 33 insertions(+), 11 deletions(-) -- 2.34.1

2 4

[PATCH OLK-5.10] integrity: Fix possible multiple allocation in integrity_inode_get()
by felix 26 Oct '23

26 Oct '23

From: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> mainline inclusion from mainline-v6.5-rc1 commit 9df6a4870dc371136e90330cfbbc51464ee66993 category: bugfix bugzilla: 189204 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When integrity_inode_get() is querying and inserting the cache, there is a conditional race in the concurrent environment. The race condition is the result of not properly implementing "double-checked locking". In this case, it first checks to see if the iint cache record exists before taking the lock, but doesn't check again after taking the integrity_iint_lock. Fixes: bf2276d10ce5 ("ima: allocating iint improvements") Signed-off-by: Tianjia Zhang <tianjia.zhang(a)linux.alibaba.com> Cc: Dmitry Kasatkin <dmitry.kasatkin(a)gmail.com> Cc: <stable(a)vger.kernel.org> # v3.10+ Signed-off-by: Mimi Zohar <zohar(a)linux.ibm.com> Signed-off-by: felix <fuzhen5(a)huawei.com> --- security/integrity/iint.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/security/integrity/iint.c b/security/integrity/iint.c index 1668cfbeb671..2428037d9e14 100644 --- a/security/integrity/iint.c +++ b/security/integrity/iint.c @@ -43,12 +43,10 @@ static struct integrity_iint_cache *__integrity_iint_find(struct inode *inode) else if (inode > iint->inode) n = n->rb_right; else - break; + return iint; } - if (!n) - return NULL; - return iint; + return NULL; } /* @@ -111,10 +109,15 @@ struct integrity_iint_cache *integrity_inode_get(struct inode *inode) parent = *p; test_iint = rb_entry(parent, struct integrity_iint_cache, rb_node); - if (inode < test_iint->inode) + if (inode < test_iint->inode) { p = &(*p)->rb_left; - else + } else if (inode > test_iint->inode) { p = &(*p)->rb_right; + } else { + write_unlock(&integrity_iint_lock); + kmem_cache_free(iint_cache, iint); + return test_iint; + } } iint->inode = inode; -- 2.34.1

2 1

[PATCH openEuler-22.03-LTS 0/3] fix cgroup poll UAF
by Lu Jialin 25 Oct '23

25 Oct '23

Arnd Bergmann (1): kernfs: add stub helper for kernfs_generic_poll() Randy Dunlap (1): sched/psi: Select KERNFS as needed Suren Baghdasaryan (1): sched/psi: use kernfs polling functions for PSI trigger polling include/linux/kernfs.h | 4 ++++ include/linux/psi.h | 5 +++-- include/linux/psi_types.h | 3 +++ init/Kconfig | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/sched/psi.c | 29 +++++++++++++++++++++-------- 6 files changed, 33 insertions(+), 11 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-1.0-LTS 0/4] ACPI for MPAM 2.0
by Yu Liao 25 Oct '23

25 Oct '23

Erik Kaneda (1): ACPICA: ACPI 6.4: PPTT: add new version of subtable type 1 Hesham Almatary (1): ACPICA: Add support for Arm's MPAM ACPI table version 2 Yu Liao (2): ACPI / PPTT: Find PPTT processor node by cache id ACPI/MPAM: Adapt to Arm's MPAM ACPI table version 2 arch/arm64/kernel/mpam/mpam_device.c | 2 +- drivers/acpi/arm64/Makefile | 2 +- drivers/acpi/arm64/mpam.c | 21 +++- drivers/acpi/arm64/mpam_v2.c | 175 +++++++++++++++++++++++++++ drivers/acpi/pptt.c | 55 +++++++++ include/acpi/actbl2.h | 118 ++++++++++++++++++ include/linux/acpi.h | 5 + include/linux/arm_mpam.h | 2 +- 8 files changed, 373 insertions(+), 7 deletions(-) create mode 100644 drivers/acpi/arm64/mpam_v2.c -- 2.25.1

2 5

[PATCH openEuler-1.0-LTS 0/2] support CPU turbo for
by Yu Liao 25 Oct '23

25 Oct '23

Xiongfeng Wang (2): cpufreq: change '.set_boost' to act on one policy cpufreq: CPPC: add SW BOOST support drivers/cpufreq/acpi-cpufreq.c | 14 ++++---- drivers/cpufreq/cppc_cpufreq.c | 35 ++++++++++++++++++-- drivers/cpufreq/cpufreq.c | 58 +++++++++++++++++++--------------- include/linux/cpufreq.h | 2 +- 4 files changed, 75 insertions(+), 34 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 v2 0/8] Synchronize coresight driver bugfix patches to openEuler
by Junhao He 25 Oct '23

25 Oct '23

1. Fix memory leak coresight: Fix memory leak in acpi_buffer->pointer 2. Fix TRBE bug coresight: trbe: Fix TRBE potential sleep in atomic context coresight: trbe: Allocate platform data per device coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() 3. Fix ETR bug coresight: Fix run time warnings while reusing ETR buffer coresight: tmc-etr: Disable warnings for allocation failures 4. acpi: Ignore the absence of graph coresight: platform: acpi: Ignore the absence of graph Revert "coresight: Return the pointer of @pdata when not "fwnode"" Junhao He (3): Revert "coresight: Return the pointer of @pdata when not "fwnode"" coresight: Fix memory leak in acpi_buffer->pointer coresight: trbe: Fix TRBE potential sleep in atomic context Linu Cherian (1): coresight: Fix run time warnings while reusing ETR buffer Suzuki K Poulose (3): coresight: trbe: Allocate platform data per device coresight: platform: acpi: Ignore the absence of graph coresight: tmc-etr: Disable warnings for allocation failures Wei Yongjun (1): coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() .../hwtracing/coresight/coresight-platform.c | 56 ++++++++++++------- .../hwtracing/coresight/coresight-tmc-etr.c | 23 ++++---- drivers/hwtracing/coresight/coresight-trbe.c | 42 +++++++------- 3 files changed, 70 insertions(+), 51 deletions(-) -- 2.33.0

2 9

[PATCH OLK-5.10 0/7] add sample sockmap code for redis
by Liu Jian 25 Oct '23

25 Oct '23

Hengqi Chen (1): libbpf: Support uniform BTF-defined key/value specification across all BPF maps Liu Jian (4): cgroup: make cgroup_bpf_prog_attach work when cgroup2 is not mounted net: let sockops can use bpf_get_current_comm() net: add local_skb parameter to identify local tcp connection tools: add sample sockmap code for redis Xu Kuohai (1): bpf, sockmap: Fix map type error in sock_map_del_link Yosry Ahmed (1): cgroup: add cgroup_v1v2_get_from_[fd/file]() include/linux/cgroup.h | 2 + include/linux/filter.h | 1 + include/linux/skbuff.h | 3 + include/uapi/linux/bpf.h | 1 + kernel/bpf/cgroup.c | 8 +- kernel/cgroup/cgroup.c | 73 +++++++- net/core/filter.c | 9 + net/core/sock_map.c | 10 +- net/ipv4/tcp_input.c | 4 +- net/ipv4/tcp_output.c | 5 + tools/include/uapi/linux/bpf.h | 1 + tools/lib/bpf/libbpf.c | 24 +++ tools/netacc/Makefile | 24 +++ tools/netacc/bpf_sockmap.h | 167 +++++++++++++++++++ tools/netacc/net-acc | 35 ++++ tools/netacc/netacc.c | 294 +++++++++++++++++++++++++++++++++ tools/netacc/netaccsockmap.c | 176 ++++++++++++++++++++ 17 files changed, 822 insertions(+), 15 deletions(-) create mode 100644 tools/netacc/Makefile create mode 100644 tools/netacc/bpf_sockmap.h create mode 100755 tools/netacc/net-acc create mode 100644 tools/netacc/netacc.c create mode 100644 tools/netacc/netaccsockmap.c -- 2.34.1

2 8

[PATCH openEuler-22.03-LTS] USB: ene_usb6250: Allocate enough memory for full object
by Yipeng Zou 25 Oct '23

25 Oct '23

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.6-rc2 commit ce33e64c1788912976b61314b56935abd4bc97ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I885FJ CVE: CVE-2023-45862 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The allocation of PageBuffer is 512 bytes in size, but the dereferencing of struct ms_bootblock_idi (also size 512) happens at a calculated offset within the allocation, which means the object could potentially extend beyond the end of the allocation. Avoid this case by just allocating enough space to catch any accesses beyond the end. Seen with GCC 13: ../drivers/usb/storage/ene_ub6250.c: In function 'ms_lib_process_bootblock': ../drivers/usb/storage/ene_ub6250.c:1050:44: warning: array subscript 'struct ms_bootblock_idi[0]' is partly outside array bounds of 'unsigned char[512]' [-Warray-bounds=] 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~ ../include/uapi/linux/byteorder/little_endian.h:37:51: note: in definition of macro '__le16_to_cpu' 37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x)) | ^ ../drivers/usb/storage/ene_ub6250.c:1050:29: note: in expansion of macro 'le16_to_cpu' 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~~~~~~~~~~ In file included from ../drivers/usb/storage/ene_ub6250.c:5: In function 'kmalloc', inlined from 'ms_lib_process_bootblock' at ../drivers/usb/storage/ene_ub6250.c:942:15: ../include/linux/slab.h:580:24: note: at offset [256, 512] into object of size 512 allocated by 'kmalloc_trace' 580 | return kmalloc_trace( | ^~~~~~~~~~~~~~ 581 | kmalloc_caches[kmalloc_type(flags)][index], | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 582 | flags, size); | ~~~~~~~~~~~~ Cc: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Kees Cook <keescook(a)chromium.org> Link: https://lore.kernel.org/r/20230204183546.never.849-kees@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/usb/storage/ene_ub6250.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c index c9ce1c25c80c..737398f1b896 100644 --- a/drivers/usb/storage/ene_ub6250.c +++ b/drivers/usb/storage/ene_ub6250.c @@ -938,7 +938,7 @@ static int ms_lib_process_bootblock(struct us_data *us, u16 PhyBlock, u8 *PageDa struct ms_lib_type_extdat ExtraData; struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; - PageBuffer = kmalloc(MS_BYTES_PER_PAGE, GFP_KERNEL); + PageBuffer = kzalloc(MS_BYTES_PER_PAGE * 2, GFP_KERNEL); if (PageBuffer == NULL) return (u32)-1; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
by Wang Yufen 25 Oct '23

25 Oct '23

From: "Lee, Chun-Yi" <joeyli.kernel(a)gmail.com> mainline inclusion from mainline-v6.6-rc1 commit 9c33663af9ad115f90c076a1828129a3fbadea98 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6YOAU CVE: CVE-2023-31083 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This patch adds code to check HCI_UART_PROTO_READY flag before accessing hci_uart->proto. It fixes the race condition in hci_uart_tty_ioctl() between HCIUARTSETPROTO and HCIUARTGETPROTO. This issue bug found by Yu Hao and Weiteng Chen: BUG: general protection fault in hci_uart_tty_ioctl [1] The information of C reproducer can also reference the link [2] Reported-by: Yu Hao <yhao016(a)ucr.edu> Closes: https://lore.kernel.org/all/CA+UBctC3p49aTgzbVgkSZ2+TQcqq4fPDO7yZitFT5uBPDe… [1] Reported-by: Weiteng Chen <wchen130(a)ucr.edu> Closes: https://lore.kernel.org/lkml/CA+UBctDPEvHdkHMwD340=n02rh+jNRJNNQ5LBZNA+Wm4K… [2] Signed-off-by: "Lee, Chun-Yi" <jlee(a)suse.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> --- drivers/bluetooth/hci_ldisc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c index efeb813..73ba297 100644 --- a/drivers/bluetooth/hci_ldisc.c +++ b/drivers/bluetooth/hci_ldisc.c @@ -772,7 +772,8 @@ static int hci_uart_tty_ioctl(struct tty_struct *tty, struct file *file, break; case HCIUARTGETPROTO: - if (test_bit(HCI_UART_PROTO_SET, &hu->flags)) + if (test_bit(HCI_UART_PROTO_SET, &hu->flags) && + test_bit(HCI_UART_PROTO_READY, &hu->flags)) err = hu->proto->id; else err = -EUNATCH; -- 1.8.3.1

2 1

[PATCH v2 openEuler-22.03-LTS 0/9] scsi: mpt3sas: Driver patch set for openEuler-22.03
by Hao Zhang 25 Oct '23

25 Oct '23

Get patch set from upstream 5.10 LTS stable branch Ranjan Kumar (1): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 Sreekanth Reddy (4): scsi: mpt3sas: Fix use-after-free warning scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: re-do lost mpt3sas DMA mask fix scsi: mpt3sas: Remove usage of dma_get_required_mask() API Suganath Prabu S (1): scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 222 ++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 2 + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +- 4 files changed, 175 insertions(+), 67 deletions(-) -- 2.33.0

2 10

[PATCH OLK-5.10] USB: ene_usb6250: Allocate enough memory for full object
by Yipeng Zou 25 Oct '23

25 Oct '23

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.6-rc2 commit ce33e64c1788912976b61314b56935abd4bc97ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I885FJ CVE: CVE-2023-45862 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The allocation of PageBuffer is 512 bytes in size, but the dereferencing of struct ms_bootblock_idi (also size 512) happens at a calculated offset within the allocation, which means the object could potentially extend beyond the end of the allocation. Avoid this case by just allocating enough space to catch any accesses beyond the end. Seen with GCC 13: ../drivers/usb/storage/ene_ub6250.c: In function 'ms_lib_process_bootblock': ../drivers/usb/storage/ene_ub6250.c:1050:44: warning: array subscript 'struct ms_bootblock_idi[0]' is partly outside array bounds of 'unsigned char[512]' [-Warray-bounds=] 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~ ../include/uapi/linux/byteorder/little_endian.h:37:51: note: in definition of macro '__le16_to_cpu' 37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x)) | ^ ../drivers/usb/storage/ene_ub6250.c:1050:29: note: in expansion of macro 'le16_to_cpu' 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~~~~~~~~~~ In file included from ../drivers/usb/storage/ene_ub6250.c:5: In function 'kmalloc', inlined from 'ms_lib_process_bootblock' at ../drivers/usb/storage/ene_ub6250.c:942:15: ../include/linux/slab.h:580:24: note: at offset [256, 512] into object of size 512 allocated by 'kmalloc_trace' 580 | return kmalloc_trace( | ^~~~~~~~~~~~~~ 581 | kmalloc_caches[kmalloc_type(flags)][index], | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 582 | flags, size); | ~~~~~~~~~~~~ Cc: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Kees Cook <keescook(a)chromium.org> Link: https://lore.kernel.org/r/20230204183546.never.849-kees@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/usb/storage/ene_ub6250.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c index c9ce1c25c80c..737398f1b896 100644 --- a/drivers/usb/storage/ene_ub6250.c +++ b/drivers/usb/storage/ene_ub6250.c @@ -938,7 +938,7 @@ static int ms_lib_process_bootblock(struct us_data *us, u16 PhyBlock, u8 *PageDa struct ms_lib_type_extdat ExtraData; struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; - PageBuffer = kmalloc(MS_BYTES_PER_PAGE, GFP_KERNEL); + PageBuffer = kzalloc(MS_BYTES_PER_PAGE * 2, GFP_KERNEL); if (PageBuffer == NULL) return (u32)-1; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
by Wang Yufen 25 Oct '23

25 Oct '23

From: "Lee, Chun-Yi" <joeyli.kernel(a)gmail.com> mainline inclusion from mainline-v6.6-rc1 commit 9c33663af9ad115f90c076a1828129a3fbadea98 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6YOAU CVE: CVE-2023-31083 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- This patch adds code to check HCI_UART_PROTO_READY flag before accessing hci_uart->proto. It fixes the race condition in hci_uart_tty_ioctl() between HCIUARTSETPROTO and HCIUARTGETPROTO. This issue bug found by Yu Hao and Weiteng Chen: BUG: general protection fault in hci_uart_tty_ioctl [1] The information of C reproducer can also reference the link [2] Reported-by: Yu Hao <yhao016(a)ucr.edu> Closes: https://lore.kernel.org/all/CA+UBctC3p49aTgzbVgkSZ2+TQcqq4fPDO7yZitFT5uBPDe… [1] Reported-by: Weiteng Chen <wchen130(a)ucr.edu> Closes: https://lore.kernel.org/lkml/CA+UBctDPEvHdkHMwD340=n02rh+jNRJNNQ5LBZNA+Wm4K… [2] Signed-off-by: "Lee, Chun-Yi" <jlee(a)suse.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> --- drivers/bluetooth/hci_ldisc.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c index efeb813..73ba297 100644 --- a/drivers/bluetooth/hci_ldisc.c +++ b/drivers/bluetooth/hci_ldisc.c @@ -772,7 +772,8 @@ static int hci_uart_tty_ioctl(struct tty_struct *tty, struct file *file, break; case HCIUARTGETPROTO: - if (test_bit(HCI_UART_PROTO_SET, &hu->flags)) + if (test_bit(HCI_UART_PROTO_SET, &hu->flags) && + test_bit(HCI_UART_PROTO_READY, &hu->flags)) err = hu->proto->id; else err = -EUNATCH; -- 1.8.3.1

2 1

[PATCH v2 OLK-5.10 00/27] Introduce some vdpa ops to support vdpa device live migrate
by Jiang Dongxu 25 Oct '23

25 Oct '23

From: jiangdongxu1 <jiangdongxu1(a)huawei.com> Patch 1-16: some bugfix and ops intruduced by upstream Patch 17-18: introduce vdpa device logging ops Patch 19-20: introduce vdpa device state ops Patch 21-22: introduce vdpa device migrate state ops Patch 23: introduce new vhost feature BYTEPMAPLOG Patch 24: export iommu_get_resv_regions/iommu_set_resv_regions Patch 25-26: some optimization about vhost-vdpa Patch 27: add vdpa/vhost-vdpa build config Cindy Lu (2): vhost_vdpa: fix the crash in unmap a large memory vhost_vdpa: fix unmap process in no-batch mode Eugenio Pérez (1): vdpa: add get_backend_features vdpa operation Gautam Dawar (1): vhost-vdpa: free iommu domain after last use during cleanup Greg Kroah-Hartman (1): vhost-vdpa: vhost_vdpa_alloc_domain() should be using a const struct bus_type * Jason Gunthorpe (1): PCI/IOV: Add pci_iov_vf_id() to get VF index Sebastien Boeuf (3): vdpa: Add resume operation vhost-vdpa: Introduce RESUME backend feature bit vhost-vdpa: uAPI to resume the device Shannon Nelson (2): vhost_vdpa: tell vqs about the negotiated vhost_vdpa: support PACKED when setting-getting vring_base Shunsuke Mie (1): virtio: fix virtio transitional ids Stefano Garzarella (3): vhost-vdpa: fix an iotlb memory leak vdpa: add bind_mm/unbind_mm callbacks vhost-vdpa: use bind_mm/unbind_mm device callbacks Zhu Lingshan (1): virtio: update virtio id table, add transitional ids jiangdongxu1 (11): vdpa: add log operations vhost-vdpa: add uAPI for logging vdpa: add device state operations vhost-vdpa: add uAPI for device buffer vdpa: add vdpa device migration status ops vhost-vdpa: add uAPI for device migration status vhost: add VHOST feature VHOST_BACKEND_F_BYTEMAPLOG export iommu_get_resv_regions and iommu_set_resv_regions vhost-vdpa: Allow transparent MSI IOV vhost-vdpa: fix msi irq request err arm64: openeuler_defconfig: add VDPA config arch/arm64/configs/openeuler_defconfig | 6 +- drivers/iommu/iommu.c | 2 + drivers/pci/iov.c | 14 + drivers/vhost/vdpa.c | 385 ++++++++++++++++++++++--- include/linux/pci.h | 8 +- include/linux/vdpa.h | 60 +++- include/uapi/linux/vhost.h | 20 ++ include/uapi/linux/vhost_types.h | 21 ++ include/uapi/linux/virtio_ids.h | 12 + 9 files changed, 482 insertions(+), 46 deletions(-) -- 2.33.0

2 28

[PATCH openEuler-22.03-LTS 0/9] scsi: mpt3sas: Driver patch set for openEuler-22.03-LTS
by Hao Zhang 25 Oct '23

25 Oct '23

Get patch set from upstream 5.10 LTS stable branch Ranjan Kumar (1): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 Sreekanth Reddy (4): scsi: mpt3sas: Fix use-after-free warning scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: re-do lost mpt3sas DMA mask fix scsi: mpt3sas: Remove usage of dma_get_required_mask() API Suganath Prabu S (1): scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 222 ++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 2 + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +- 4 files changed, 175 insertions(+), 67 deletions(-) -- 2.33.0

2 10

[PATCH openEuler-22.03-LTS 0/9] scsi: mpt3sas: Driver patch set for openEuler-22.03-LTS
by Hao Zhang 25 Oct '23

25 Oct '23

Get patch set from upstream 5.10 LTS stable branch Ranjan Kumar (1): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 Sreekanth Reddy (4): scsi: mpt3sas: Fix use-after-free warning scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: re-do lost mpt3sas DMA mask fix scsi: mpt3sas: Remove usage of dma_get_required_mask() API Suganath Prabu S (1): scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 222 ++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 2 + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +- 4 files changed, 175 insertions(+), 67 deletions(-) -- 2.33.0

2 10

[PATCH openEuler-1.0-LTS 0/4] Avoid spin or livelock during panic
by Ye Weihua 25 Oct '23

25 Oct '23

Stephen Brennan (4): printk: Add panic_in_progress helper printk: disable optimistic spin during panic printk: Avoid livelock with heavy printk during panic printk: Drop console_sem during panic kernel/printk/printk.c | 55 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 54 insertions(+), 1 deletion(-) -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] xen/events: replace evtchn_rwlock with RCU
by Liu Shixin 25 Oct '23

25 Oct '23

From: Juergen Gross <jgross(a)suse.com> stable inclusion from stable-v4.19.296 commit 3fdf2be9089b5096a28e76376656c60ce410ac4a category: bugfix bugzilla: 189304, https://gitee.com/src-openeuler/kernel/issues/I896EC CVE: CVE-2023-34324 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 87797fad6cce28ec9be3c13f031776ff4f104cfc upstream. In unprivileged Xen guests event handling can cause a deadlock with Xen console handling. The evtchn_rwlock and the hvc_lock are taken in opposite sequence in __hvc_poll() and in Xen console IRQ handling. Normally this is no problem, as the evtchn_rwlock is taken as a reader in both paths, but as soon as an event channel is being closed, the lock will be taken as a writer, which will cause read_lock() to block: CPU0 CPU1 CPU2 (IRQ handling) (__hvc_poll()) (closing event channel) read_lock(evtchn_rwlock) spin_lock(hvc_lock) write_lock(evtchn_rwlock) [blocks] spin_lock(hvc_lock) [blocks] read_lock(evtchn_rwlock) [blocks due to writer waiting, and not in_interrupt()] This issue can be avoided by replacing evtchn_rwlock with RCU in xen_free_irq(). Note that RCU is used only to delay freeing of the irq_info memory. There is no RCU based dereferencing or replacement of pointers involved. In order to avoid potential races between removing the irq_info reference and handling of interrupts, set the irq_info pointer to NULL only when freeing its memory. The IRQ itself must be freed at that time, too, as otherwise the same IRQ number could be allocated again before handling of the old instance would have been finished. This is XSA-441 / CVE-2023-34324. Fixes: 54c9de89895e ("xen/events: add a new "late EOI" evtchn framework") Reported-by: Marek Marczykowski-Górecki <marmarek(a)invisiblethingslab.com> Signed-off-by: Juergen Gross <jgross(a)suse.com> Reviewed-by: Julien Grall <jgrall(a)amazon.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Conflicts: drivers/xen/events/events_base.c drivers/xen/events/events_internal.h [ Replace set_info_for_irq() with irq_set_handler_data() ] Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> --- drivers/xen/events/events_base.c | 84 ++++++++++++++-------------- drivers/xen/events/events_internal.h | 2 + 2 files changed, 45 insertions(+), 41 deletions(-) diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c index 1cb2bf5e5e5b6..9c0ade529ec3f 100644 --- a/drivers/xen/events/events_base.c +++ b/drivers/xen/events/events_base.c @@ -82,22 +82,12 @@ const struct evtchn_ops *evtchn_ops; */ static DEFINE_MUTEX(irq_mapping_update_lock); -/* - * Lock protecting event handling loop against removing event channels. - * Adding of event channels is no issue as the associated IRQ becomes active - * only after everything is setup (before request_[threaded_]irq() the handler - * can't be entered for an event, as the event channel will be unmasked only - * then). - */ -static DEFINE_RWLOCK(evtchn_rwlock); - /* * Lock hierarchy: * * irq_mapping_update_lock - * evtchn_rwlock - * IRQ-desc lock - * percpu eoi_list_lock + * IRQ-desc lock + * percpu eoi_list_lock */ static LIST_HEAD(xen_irq_list_head); @@ -191,6 +181,22 @@ struct irq_info *info_for_irq(unsigned irq) return irq_get_handler_data(irq); } +static void delayed_free_irq(struct work_struct *work) +{ + struct irq_info *info = container_of(to_rcu_work(work), struct irq_info, + rwork); + unsigned int irq = info->irq; + + /* Remove the info pointer only now, with no potential users left. */ + irq_set_handler_data(irq, NULL); + + kfree(info); + + /* Legacy IRQ descriptors are managed by the arch. */ + if (irq >= nr_legacy_irqs()) + irq_free_desc(irq); +} + /* Constructors for packed IRQ information. */ static int xen_irq_info_common_setup(struct irq_info *info, unsigned irq, @@ -474,33 +480,36 @@ static void xen_irq_lateeoi_worker(struct work_struct *work) eoi = container_of(to_delayed_work(work), struct lateeoi_work, delayed); - read_lock_irqsave(&evtchn_rwlock, flags); + rcu_read_lock(); while (true) { - spin_lock(&eoi->eoi_list_lock); + spin_lock_irqsave(&eoi->eoi_list_lock, flags); info = list_first_entry_or_null(&eoi->eoi_list, struct irq_info, eoi_list); - if (info == NULL || now < info->eoi_time) { - spin_unlock(&eoi->eoi_list_lock); + if (info == NULL) + break; + + if (now < info->eoi_time) { + mod_delayed_work_on(info->eoi_cpu, system_wq, + &eoi->delayed, + info->eoi_time - now); break; } list_del_init(&info->eoi_list); - spin_unlock(&eoi->eoi_list_lock); + spin_unlock_irqrestore(&eoi->eoi_list_lock, flags); info->eoi_time = 0; xen_irq_lateeoi_locked(info); } - if (info) - mod_delayed_work_on(info->eoi_cpu, system_wq, - &eoi->delayed, info->eoi_time - now); + spin_unlock_irqrestore(&eoi->eoi_list_lock, flags); - read_unlock_irqrestore(&evtchn_rwlock, flags); + rcu_read_unlock(); } static void xen_cpu_init_eoi(unsigned int cpu) @@ -515,16 +524,15 @@ static void xen_cpu_init_eoi(unsigned int cpu) void xen_irq_lateeoi(unsigned int irq, unsigned int eoi_flags) { struct irq_info *info; - unsigned long flags; - read_lock_irqsave(&evtchn_rwlock, flags); + rcu_read_lock(); info = info_for_irq(irq); if (info) xen_irq_lateeoi_locked(info); - read_unlock_irqrestore(&evtchn_rwlock, flags); + rcu_read_unlock(); } EXPORT_SYMBOL_GPL(xen_irq_lateeoi); @@ -543,6 +551,7 @@ static void xen_irq_init(unsigned irq) info->type = IRQT_UNBOUND; info->refcnt = -1; + INIT_RCU_WORK(&info->rwork, delayed_free_irq); irq_set_handler_data(irq, info); @@ -595,31 +604,18 @@ static int __must_check xen_allocate_irq_gsi(unsigned gsi) static void xen_free_irq(unsigned irq) { struct irq_info *info = irq_get_handler_data(irq); - unsigned long flags; if (WARN_ON(!info)) return; - write_lock_irqsave(&evtchn_rwlock, flags); - if (!list_empty(&info->eoi_list)) lateeoi_list_del(info); list_del(&info->list); - irq_set_handler_data(irq, NULL); - WARN_ON(info->refcnt > 0); - write_unlock_irqrestore(&evtchn_rwlock, flags); - - kfree(info); - - /* Legacy IRQ descriptors are managed by the arch. */ - if (irq < nr_legacy_irqs()) - return; - - irq_free_desc(irq); + queue_rcu_work(system_wq, &info->rwork); } static void xen_evtchn_close(unsigned int port) @@ -1521,7 +1517,14 @@ static void __xen_evtchn_do_upcall(void) struct evtchn_loop_ctrl ctrl = { 0 }; unsigned count; - read_lock(&evtchn_rwlock); + /* + * When closing an event channel the associated IRQ must not be freed + * until all cpus have left the event handling loop. This is ensured + * by taking the rcu_read_lock() while handling events, as freeing of + * the IRQ is handled via queue_rcu_work() _after_ closing the event + * channel. + */ + rcu_read_lock(); do { vcpu_info->evtchn_upcall_pending = 0; @@ -1538,8 +1541,7 @@ static void __xen_evtchn_do_upcall(void) } while (count != 1 || vcpu_info->evtchn_upcall_pending); out: - - read_unlock(&evtchn_rwlock); + rcu_read_unlock(); /* * Increment irq_epoch only now to defer EOIs only for diff --git a/drivers/xen/events/events_internal.h b/drivers/xen/events/events_internal.h index 2cb9c2d2c5c0f..72e13f1638a36 100644 --- a/drivers/xen/events/events_internal.h +++ b/drivers/xen/events/events_internal.h @@ -8,6 +8,7 @@ */ #ifndef __EVENTS_INTERNAL_H__ #define __EVENTS_INTERNAL_H__ +#include <linux/rcupdate.h> /* Interrupt types. */ enum xen_irq_type { @@ -33,6 +34,7 @@ enum xen_irq_type { struct irq_info { struct list_head list; struct list_head eoi_list; + struct rcu_work rwork; int refcnt; enum xen_irq_type type; /* type */ unsigned irq; -- 2.25.1

2 1

[PATCH OLK-5.10 0/7] Synchronize coresight driver bugfix patches to openEuler
by Junhao He 25 Oct '23

25 Oct '23

1. Fix memory leak coresight: core: fix memory leak in dict->fwnode_list coresight: Fix memory leak in acpi_buffer->pointer 2. Fix TRBE bug coresight: trbe: Fix TRBE potential sleep in atomic context coresight: trbe: Allocate platform data per device coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() 3. Fix ETR bug coresight: Fix run time warnings while reusing ETR buffer 4. acpi: Ignore the absence of graph coresight: platform: acpi: Ignore the absence of graph Revert "coresight: Return the pointer of @pdata when not "fwnode"" Junhao He (3): Revert "coresight: Return the pointer of @pdata when not "fwnode"" coresight: Fix memory leak in acpi_buffer->pointer coresight: trbe: Fix TRBE potential sleep in atomic context Linu Cherian (1): coresight: Fix run time warnings while reusing ETR buffer Suzuki K Poulose (2): coresight: trbe: Allocate platform data per device coresight: platform: acpi: Ignore the absence of graph Wei Yongjun (1): coresight: trbe: Fix return value check in arm_trbe_register_coresight_cpu() .../hwtracing/coresight/coresight-platform.c | 56 ++++++++++++------- .../hwtracing/coresight/coresight-tmc-etr.c | 20 +++---- drivers/hwtracing/coresight/coresight-trbe.c | 42 +++++++------- 3 files changed, 68 insertions(+), 50 deletions(-) -- 2.33.0

2 8

[PATCH openEuler-22.03-LTS 0/9] scsi: mpt3sas: Driver patch set for openEuler-22.03-LTS
by Hao Zhang 25 Oct '23

25 Oct '23

Get patch set from upstream 5.10 LTS stable branch Ranjan Kumar (1): scsi: mpt3sas: Perform additional retries if doorbell read returns 0 Sreekanth Reddy (4): scsi: mpt3sas: Fix use-after-free warning scsi: mpt3sas: Don't change DMA mask while reallocating pools scsi: mpt3sas: re-do lost mpt3sas DMA mask fix scsi: mpt3sas: Remove usage of dma_get_required_mask() API Suganath Prabu S (1): scsi: mpt3sas: Force PCIe scatterlist allocations to be within same 4 GB region Tomas Henzl (1): scsi: mpt3sas: Fix a memory leak Wenchao Hao (1): scsi: mpt3sas: Fix NULL pointer access in mpt3sas_transport_port_add() Yang Yingliang (1): scsi: mpt3sas: Fix possible resource leaks in mpt3sas_transport_port_add() drivers/scsi/mpt3sas/mpt3sas_base.c | 222 ++++++++++++++++------- drivers/scsi/mpt3sas/mpt3sas_base.h | 2 + drivers/scsi/mpt3sas/mpt3sas_scsih.c | 2 +- drivers/scsi/mpt3sas/mpt3sas_transport.c | 16 +- 4 files changed, 175 insertions(+), 67 deletions(-) -- 2.33.0

2 10

[PATCH OLK-5.10] perf auxtrace: Record whether an auxtrace mmap is needed
by Junhao He 25 Oct '23

25 Oct '23

From: Qi Liu <liuqi115(a)huawei.com> mainline inclusion from mainline-v6.1-rc1 commit 057381a7ece1b2726509ce47cdb9c1a111acfce9 category: Bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7HI80 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- Remove ->idx() per_cpu parameter because it isn't needed. Add a flag needs_auxtrace_mmap to record whether an auxtrace mmap is needed, in preparation for correctly determining whether or not an auxtrace mmap is needed. Reviewed-by: Leo Yan <leo.yan(a)linaro.org> Signed-off-by: Qi Liu <liuqi115(a)huawei.com> Signed-off-by: Yicong Yang <yangyicong(a)hisilicon.com> Acked-by: John Garry <john.garry(a)huawei.com> Link: https://lore.kernel.org/r/20220927081400.14364-3-yangyicong@huawei.com Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> Signed-off-by: Junhao He <hejunhao3(a)huawei.com> Auxtrace mmap is needed is added to the source patch [1], However, it is deleted when upstream openEuler. Therefore, this patch adds this modification to OpenEuler OLK-5.10. [1] 057381a7ece1 "perf auxtrace arm64: Add support for HiSilicon PCIe Tune and Trace device driver" --- tools/perf/arch/arm64/util/hisi-ptt.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/perf/arch/arm64/util/hisi-ptt.c b/tools/perf/arch/arm64/util/hisi-ptt.c index 110b2edf3e6b..97696b6e1dd5 100644 --- a/tools/perf/arch/arm64/util/hisi-ptt.c +++ b/tools/perf/arch/arm64/util/hisi-ptt.c @@ -113,6 +113,7 @@ static int hisi_ptt_recording_options(struct auxtrace_record *itr, } evsel->core.attr.freq = 0; evsel->core.attr.sample_period = 1; + evsel->needs_auxtrace_mmap = true; hisi_ptt_evsel = evsel; opts->full_auxtrace = true; } -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS 0/4] Avoid spin or livelock during panic
by Ye Weihua 25 Oct '23

25 Oct '23

Stephen Brennan (4): printk: Add panic_in_progress helper printk: disable optimistic spin during panic printk: Avoid livelock with heavy printk during panic printk: Drop console_sem during panic kernel/printk/printk.c | 55 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 54 insertions(+), 1 deletion(-) -- 2.34.1

2 5

[PATCH OLK-5.10] psi: fix "no previous prototype" warnings when CONFIG_CGROUPS=n
by Lu Jialin 25 Oct '23

25 Oct '23

From: Suren Baghdasaryan <surenb(a)google.com> mainline inclusion from mainline-v5.17-rc2 commit 51e50fbd3efc6064c30ed73a5e009018b36e290a category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I89DEJ CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ------------------------------------------------- When CONFIG_CGROUPS is disabled psi code generates the following warnings: kernel/sched/psi.c:1112:21: warning: no previous prototype for 'psi_trigger_create' [-Wmissing-prototypes] 1112 | struct psi_trigger *psi_trigger_create(struct psi_group *group, | ^~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1182:6: warning: no previous prototype for 'psi_trigger_destroy' [-Wmissing-prototypes] 1182 | void psi_trigger_destroy(struct psi_trigger *t) | ^~~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1249:10: warning: no previous prototype for 'psi_trigger_poll' [-Wmissing-prototypes] 1249 | __poll_t psi_trigger_poll(void **trigger_ptr, | ^~~~~~~~~~~~~~~~ Change the declarations of these functions in the header to provide the prototypes even when they are unused. Link: https://lkml.kernel.org/r/20220119223940.787748-2-surenb@google.com Fixes: 0e94682b73bf ("psi: introduce psi monitor") Signed-off-by: Suren Baghdasaryan <surenb(a)google.com> Reported-by: kernel test robot <lkp(a)intel.com> Acked-by: Johannes Weiner <hannes(a)cmpxchg.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Conflict: include/linux/psi.h Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- include/linux/psi.h | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/include/linux/psi.h b/include/linux/psi.h index 41079ebe17a6..86635a5630ba 100644 --- a/include/linux/psi.h +++ b/include/linux/psi.h @@ -26,12 +26,6 @@ void psi_memstall_enter(unsigned long *flags); void psi_memstall_leave(unsigned long *flags); int psi_show(struct seq_file *s, struct psi_group *group, enum psi_res res); - -#ifdef CONFIG_CGROUPS -int psi_cgroup_alloc(struct cgroup *cgrp); -void psi_cgroup_free(struct cgroup *cgrp); -void cgroup_move_task(struct task_struct *p, struct css_set *to); - struct psi_trigger *psi_trigger_create(struct psi_group *group, char *buf, size_t nbytes, enum psi_res res, struct kernfs_open_file *of); @@ -39,6 +33,11 @@ void psi_trigger_destroy(struct psi_trigger *t); __poll_t psi_trigger_poll(void **trigger_ptr, struct file *file, poll_table *wait); + +#ifdef CONFIG_CGROUPS +int psi_cgroup_alloc(struct cgroup *cgrp); +void psi_cgroup_free(struct cgroup *cgrp); +void cgroup_move_task(struct task_struct *p, struct css_set *to); #endif #else /* CONFIG_PSI */ -- 2.34.1

2 1

[PATCH OLK-5.10 00/38] Add error handling for device_add_disk
by Zhong Jinghua 25 Oct '23

25 Oct '23

Befor these paths, block is not know when drvier is add fail. Now, add error handling for drivers. Christoph Hellwig (14): block: fold register_disk into device_add_disk block: call blk_integrity_add earlier in device_add_disk block: add the events* attributes to disk_attrs block: fix error unwinding in device_add_disk block: clear ->slave_dir when dropping the main slave_dir reference block: add blk_alloc_disk and blk_cleanup_disk APIs blk-mq: add the blk_mq_alloc_disk APIs loop: use blk_mq_alloc_disk and blk_cleanup_disk loop: fix order of cleaning up the queue and freeing the tagset nbd: use blk_mq_alloc_disk and blk_cleanup_disk block: add a flag to make put_disk on partially initalized disks safer nvme: use blk_mq_alloc_disk brd: convert to blk_alloc_disk/blk_cleanup_disk ubi: use blk_mq_alloc_disk and blk_cleanup_disk Dan Carpenter (1): blk-mq: fix an IS_ERR() vs NULL bug Luis Chamberlain (11): block: return errors from blk_integrity_add block: return errors from disk_alloc_events block: add error handling for device_add_disk / add_disk block: fix device_add_disk() kobject_create_and_add() error handling loop: add error handling support for add_disk() nbd: add error handling support for add_disk() nvme: add error handling support for add_disk() block/brd: add error handling support for add_disk() scsi: sd: Add error handling support for add_disk() scsi: sr: Add error handling support for add_disk() mtd/ubi/block: add error handling support for add_disk() Tetsuo Handa (1): block: check minor range in device_add_disk() Wang Qing (1): nbd: fix order of cleaning up the queue and freeing the tagset Yu Kuai (1): block: fix memory leak for elevator on add_disk failure Zhong Jinghua (9): block: return errors from blk_register_region block: Fix the kabi change in device_add_disk block: Fix the kabi change on blk_register_region block: call blk_get_queue earlier in __device_add_disk block: Fix minor range check in device_add_disk() block: Set memalloc_noio to false in the error path scsi: sd: Clean up sdkp if device_add_disk() failed mtd/ubi/block: Fix null pointer dereference issue in error path mtd/ubi/block: Fix uaf problem in ubiblock_cleanup block/blk-integrity.c | 12 +- block/blk-mq.c | 19 +++ block/blk.h | 5 +- block/genhd.c | 286 ++++++++++++++++++++++++++------------- drivers/block/brd.c | 103 ++++++-------- drivers/block/loop.c | 26 ++-- drivers/block/nbd.c | 59 ++++---- drivers/mtd/ubi/block.c | 76 +++++------ drivers/nvme/host/core.c | 41 +++--- drivers/scsi/sd.c | 8 +- drivers/scsi/sr.c | 7 +- include/linux/blk-mq.h | 12 ++ include/linux/genhd.h | 36 +++++ 13 files changed, 417 insertions(+), 273 deletions(-) -- 2.31.1

2 39

[openEuler/rdma-core] libhns: Support flexible WQE buffer page size
by Chengchang Tang 23 Oct '23

23 Oct '23

driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I87LTM -------------------------------------------------------------------------- Currently, driver fixedly allocates 4K pages for user space WQE buffer even in a 64K system. This results in HW reading WQE with a granularity of 4K even in a 64K system. Considering that we support 1024-byte inline, in the scenario of using SQ inline, HW will switch pages every 4 WQEs. This will introduce a delay of about 400ns, which is an average delay of 100ns per packet. In order to improve performance, we allow user-mode drivers to use a larger page size to allocate WQE buffers, thereby reducing the latency introduced by HW page switching. User-mode drivers will be allowed to allocate WQE buffers between 4K to system page size. During ibv_create_qp(), the driver will dynamically select the appropriate page size based on ibv_qp_cap, thus reducing memory consumption while improving performance. This feature needs to be used in conjunction with the kernel-mode driver. In order to ensure forward compatibility, if the kernel-mode driver does not support this feature, the user-mode driver will continue to use a fixed 4K pagesize to allocate WQE buffer. Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> --- kernel-headers/rdma/hns-abi.h | 5 ++- providers/hns/hns_roce_u.c | 2 +- providers/hns/hns_roce_u.h | 1 + providers/hns/hns_roce_u_verbs.c | 65 ++++++++++++++++++++++++++------ 4 files changed, 59 insertions(+), 14 deletions(-) diff --git a/kernel-headers/rdma/hns-abi.h b/kernel-headers/rdma/hns-abi.h index cab941f..157dc9d 100644 --- a/kernel-headers/rdma/hns-abi.h +++ b/kernel-headers/rdma/hns-abi.h @@ -81,7 +81,8 @@ struct hns_roce_ib_create_qp { __u8 log_sq_bb_count; __u8 log_sq_stride; __u8 sq_no_prefetch; - __u8 reserved[5]; + __u8 reserved[4]; + __u8 pageshift; __aligned_u64 sdb_addr; __aligned_u64 comp_mask; __aligned_u64 create_flags; @@ -122,6 +123,7 @@ enum { HNS_ROCE_RQ_INLINE_FLAGS = 1 << 1, HNS_ROCE_CQE_INLINE_FLAGS = 1 << 2, HNS_ROCE_UCTX_CONFIG_DCA = 1 << 3, + HNS_ROCE_UCTX_DYN_QP_PGSZ = 1 << 4, }; enum { @@ -129,6 +131,7 @@ enum { HNS_ROCE_RSP_RQ_INLINE_FLAGS = 1 << 1, HNS_ROCE_RSP_CQE_INLINE_FLAGS = 1 << 2, HNS_ROCE_UCTX_RSP_DCA_FLAGS = HNS_ROCE_UCTX_CONFIG_DCA, + HNS_ROCE_UCTX_RSP_DYN_QP_PGSZ = HNS_ROCE_UCTX_DYN_QP_PGSZ, }; struct hns_roce_ib_alloc_ucontext_resp { diff --git a/providers/hns/hns_roce_u.c b/providers/hns/hns_roce_u.c index 0660081..02ad880 100644 --- a/providers/hns/hns_roce_u.c +++ b/providers/hns/hns_roce_u.c @@ -267,7 +267,7 @@ static void ucontext_set_cmd(struct hns_roce_alloc_ucontext *cmd, struct hnsdv_context_attr *attr) { cmd->config |= HNS_ROCE_EXSGE_FLAGS | HNS_ROCE_RQ_INLINE_FLAGS | - HNS_ROCE_CQE_INLINE_FLAGS; + HNS_ROCE_CQE_INLINE_FLAGS | HNS_ROCE_UCTX_DYN_QP_PGSZ; if (!attr || !(attr->flags & HNSDV_CONTEXT_FLAGS_DCA)) return; diff --git a/providers/hns/hns_roce_u.h b/providers/hns/hns_roce_u.h index 5501d8e..ae9ae51 100644 --- a/providers/hns/hns_roce_u.h +++ b/providers/hns/hns_roce_u.h @@ -409,6 +409,7 @@ struct hns_roce_qp { uint8_t sl; uint8_t tc_mode; uint8_t priority; + uint8_t pageshift; unsigned int qkey; enum ibv_mtu path_mtu; diff --git a/providers/hns/hns_roce_u_verbs.c b/providers/hns/hns_roce_u_verbs.c index 7b58dd0..f76341c 100644 --- a/providers/hns/hns_roce_u_verbs.c +++ b/providers/hns/hns_roce_u_verbs.c @@ -1327,31 +1327,69 @@ static void free_recv_rinl_buf(struct hns_roce_rinl_buf *rinl_buf) } } +static void get_best_multi_region_pg_shift(struct hns_roce_device *hr_dev, + struct hns_roce_context *ctx, + struct hns_roce_qp *qp, bool dca_en) +{ + uint32_t ext_sge_size; + uint32_t sq_size; + uint32_t rq_size; + uint8_t pg_shift; + + if (!(ctx->config & HNS_ROCE_UCTX_RSP_DYN_QP_PGSZ) || dca_en) { + qp->pageshift = HNS_HW_PAGE_SHIFT; + return; + } + + /* + * The larger the pagesize used, the better the performance, but it + * may waste more memory. Therefore, we use the least common multiple + * (aligned to power of 2) of sq wqe buffer size, rq wqe buffer size, + * and ext_sge buffer size as the pagesize. Additionally, since the + * kernel cannot guarantee the allocation of contiguous memory larger + * than the system page, the pagesize must be smaller than the system + * page. + */ + sq_size = qp->sq.wqe_cnt << qp->sq.wqe_shift; + ext_sge_size = qp->ex_sge.sge_cnt << qp->ex_sge.sge_shift; + rq_size = qp->rq.wqe_cnt << qp->rq.wqe_shift; + + pg_shift = max_t(uint8_t, sq_size ? hr_ilog32(sq_size) : 0, + ext_sge_size ? hr_ilog32(ext_sge_size) : 0); + pg_shift = max_t(uint8_t, pg_shift, rq_size ? hr_ilog32(rq_size) : 0); + pg_shift = max_t(uint8_t, pg_shift, HNS_HW_PAGE_SHIFT); + qp->pageshift = min_t(uint8_t, pg_shift, hr_ilog32(hr_dev->page_size)); +} + static int calc_qp_buff_size(struct hns_roce_device *hr_dev, - struct hns_roce_qp *qp) + struct hns_roce_context *ctx, + struct hns_roce_qp *qp, bool dca_en) { struct hns_roce_wq *sq = &qp->sq; struct hns_roce_wq *rq = &qp->rq; + unsigned int page_size; unsigned int size; qp->buf_size = 0; + get_best_multi_region_pg_shift(hr_dev, ctx, qp, dca_en); + page_size = 1 << qp->pageshift; /* SQ WQE */ sq->offset = 0; - size = to_hr_hem_entries_size(sq->wqe_cnt, sq->wqe_shift); + size = align(sq->wqe_cnt << sq->wqe_shift, page_size); qp->buf_size += size; /* extend SGE WQE in SQ */ qp->ex_sge.offset = qp->buf_size; if (qp->ex_sge.sge_cnt > 0) { - size = to_hr_hem_entries_size(qp->ex_sge.sge_cnt, - qp->ex_sge.sge_shift); + size = align(qp->ex_sge.sge_cnt << qp->ex_sge.sge_shift, + page_size); qp->buf_size += size; } /* RQ WQE */ rq->offset = qp->buf_size; - size = to_hr_hem_entries_size(rq->wqe_cnt, rq->wqe_shift); + size = align(rq->wqe_cnt << rq->wqe_shift, page_size); qp->buf_size += size; if (qp->buf_size < 1) @@ -1375,7 +1413,7 @@ static inline bool check_qp_support_dca(struct hns_roce_dca_ctx *dca_ctx, if (hns_attr && (hns_attr->comp_mask & HNSDV_QP_INIT_ATTR_MASK_QP_CREATE_FLAGS) && (hns_attr->create_flags & HNSDV_QP_CREATE_ENABLE_DCA_MODE)) - return true; + return dca_ctx->max_size > 0; return false; } @@ -1396,9 +1434,12 @@ static int qp_alloc_wqe(struct ibv_qp_init_attr_ex *attr, struct hns_roce_qp *qp, struct hns_roce_context *ctx) { struct hns_roce_device *hr_dev = to_hr_dev(ctx->ibv_ctx.context.device); + bool dca_en = check_qp_support_dca(&ctx->dca_ctx, attr, hns_attr); + int ret; - if (calc_qp_buff_size(hr_dev, qp)) - return -EINVAL; + ret = calc_qp_buff_size(hr_dev, ctx, qp, dca_en); + if (ret) + return ret; qp->sq.wrid = malloc(qp->sq.wqe_cnt * sizeof(uint64_t)); if (!qp->sq.wrid) @@ -1416,19 +1457,18 @@ static int qp_alloc_wqe(struct ibv_qp_init_attr_ex *attr, goto err_alloc; } - if (check_qp_support_dca(&ctx->dca_ctx, attr, hns_attr) && - ctx->dca_ctx.max_size > 0) { + if (dca_en) { /* when DCA is enabled, use a buffer list to store page addr */ qp->buf.buf = NULL; qp->dca_wqe.max_cnt = hr_hw_page_count(qp->buf_size); - qp->dca_wqe.shift = HNS_HW_PAGE_SHIFT; + qp->dca_wqe.shift = qp->pageshift; qp->dca_wqe.bufs = calloc(qp->dca_wqe.max_cnt, sizeof(void *)); if (!qp->dca_wqe.bufs) goto err_alloc; verbs_debug(&ctx->ibv_ctx, "alloc DCA buf.\n"); } else { if (hns_roce_alloc_buf(&qp->buf, qp->buf_size, - HNS_HW_PAGE_SIZE)) + 1 << qp->pageshift)) goto err_alloc; } @@ -1642,6 +1682,7 @@ static int qp_exec_create_cmd(struct ibv_qp_init_attr_ex *attr, cmd_ex.buf_addr = (uintptr_t)qp->buf.buf; cmd_ex.log_sq_stride = qp->sq.wqe_shift; cmd_ex.log_sq_bb_count = hr_ilog32(qp->sq.wqe_cnt); + cmd_ex.pageshift = qp->pageshift; if (cmd_flag->congest_type_flags) { cmd_ex.comp_mask |= HNS_ROCE_CREATE_QP_MASK_CONGEST_TYPE; -- 2.30.0

1 2

[PATCH OLK-5.10] scsi: mpt3sas: Perform additional retries if doorbell read returns 0
by Hao Zhang 23 Oct '23

23 Oct '23

From: Ranjan Kumar <ranjan.kumar(a)broadcom.com> stable inclusion from stable-v5.10.195 commit ffed0c8fcf043946f2bf09bd2a9caa1ca5289959 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I868SX CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit 4ca10f3e31745d35249a727ecd108eb58f0a8c5e upstream. The driver retries certain register reads 3 times if the returned value is 0. This was done because the controller could return 0 for certain registers if other registers were being accessed concurrently by the BMC. In certain systems with increased BMC interactions, the register values returned can be 0 for longer than 3 retries. Change the retry count from 3 to 30 for the affected registers to prevent problems with out-of-band management. Fixes: b899202901a8 ("scsi: mpt3sas: Add separate function for aero doorbell reads") Cc: stable(a)vger.kernel.org Signed-off-by: Ranjan Kumar <ranjan.kumar(a)broadcom.com> Link: https://lore.kernel.org/r/20230829090020.5417-2-ranjan.kumar@broadcom.com Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Hao Zhang <Hao.Zhang(a)windriver.com> --- drivers/scsi/mpt3sas/mpt3sas_base.c | 46 +++++++++++++++++++++-------- drivers/scsi/mpt3sas/mpt3sas_base.h | 1 + 2 files changed, 34 insertions(+), 13 deletions(-) diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c index 55902825ecb5..06cb2addac31 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.c +++ b/drivers/scsi/mpt3sas/mpt3sas_base.c @@ -131,6 +131,9 @@ _base_get_ioc_facts(struct MPT3SAS_ADAPTER *ioc); static void _base_clear_outstanding_commands(struct MPT3SAS_ADAPTER *ioc); +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr); + /** * mpt3sas_base_check_cmd_timeout - Function * to check timeout and command termination due @@ -206,6 +209,20 @@ _base_readl_aero(const volatile void __iomem *addr) return ret_val; } +static u32 +_base_readl_ext_retry(const volatile void __iomem *addr) +{ + u32 i, ret_val; + + for (i = 0 ; i < 30 ; i++) { + ret_val = readl(addr); + if (ret_val == 0) + continue; + } + + return ret_val; +} + static inline u32 _base_readl(const volatile void __iomem *addr) { @@ -861,7 +878,7 @@ mpt3sas_halt_firmware(struct MPT3SAS_ADAPTER *ioc) dump_stack(); - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell & MPI2_DOORBELL_DATA_MASK); @@ -5661,7 +5678,7 @@ mpt3sas_base_get_iocstate(struct MPT3SAS_ADAPTER *ioc, int cooked) { u32 s, sc; - s = ioc->base_readl(&ioc->chip->Doorbell); + s = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); sc = s & MPI2_IOC_STATE_MASK; return cooked ? sc : s; } @@ -5806,7 +5823,7 @@ _base_wait_for_doorbell_ack(struct MPT3SAS_ADAPTER *ioc, int timeout) __func__, count, timeout)); return 0; } else if (int_status & MPI2_HIS_IOC2SYS_DB_STATUS) { - doorbell = ioc->base_readl(&ioc->chip->Doorbell); + doorbell = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if ((doorbell & MPI2_IOC_STATE_MASK) == MPI2_IOC_STATE_FAULT) { mpt3sas_print_fault_code(ioc, doorbell); @@ -5846,7 +5863,7 @@ _base_wait_for_doorbell_not_used(struct MPT3SAS_ADAPTER *ioc, int timeout) count = 0; cntdn = 1000 * timeout; do { - doorbell_reg = ioc->base_readl(&ioc->chip->Doorbell); + doorbell_reg = ioc->base_readl_ext_retry(&ioc->chip->Doorbell); if (!(doorbell_reg & MPI2_DOORBELL_USED)) { dhsprintk(ioc, ioc_info(ioc, "%s: successful count(%d), timeout(%d)\n", @@ -5983,7 +6000,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __le32 *mfp; /* make sure doorbell is not in use */ - if ((ioc->base_readl(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { + if ((ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_USED)) { ioc_err(ioc, "doorbell is in use (line=%d)\n", __LINE__); return -EFAULT; } @@ -6032,7 +6049,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, } /* read the first two 16-bits, it gives the total length of the reply */ - reply[0] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[0] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); if ((_base_wait_for_doorbell_int(ioc, 5))) { @@ -6040,7 +6057,7 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, __LINE__); return -EFAULT; } - reply[1] = le16_to_cpu(ioc->base_readl(&ioc->chip->Doorbell) + reply[1] = le16_to_cpu(ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); @@ -6051,10 +6068,10 @@ _base_handshake_req_reply_wait(struct MPT3SAS_ADAPTER *ioc, int request_bytes, return -EFAULT; } if (i >= reply_bytes/2) /* overflow case */ - ioc->base_readl(&ioc->chip->Doorbell); + ioc->base_readl_ext_retry(&ioc->chip->Doorbell); else reply[i] = le16_to_cpu( - ioc->base_readl(&ioc->chip->Doorbell) + ioc->base_readl_ext_retry(&ioc->chip->Doorbell) & MPI2_DOORBELL_DATA_MASK); writel(0, &ioc->chip->HostInterruptStatus); } @@ -6900,7 +6917,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) goto out; } - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); drsprintk(ioc, ioc_info(ioc, "wrote magic sequence: count(%d), host_diagnostic(0x%08x)\n", count, host_diagnostic)); @@ -6920,7 +6937,7 @@ _base_diag_reset(struct MPT3SAS_ADAPTER *ioc) for (count = 0; count < (300000000 / MPI2_HARD_RESET_PCIE_SECOND_READ_DELAY_MICRO_SEC); count++) { - host_diagnostic = ioc->base_readl(&ioc->chip->HostDiagnostic); + host_diagnostic = ioc->base_readl_ext_retry(&ioc->chip->HostDiagnostic); if (host_diagnostic == 0xFFFFFFFF) { ioc_info(ioc, @@ -7307,10 +7324,13 @@ mpt3sas_base_attach(struct MPT3SAS_ADAPTER *ioc) ioc->rdpq_array_enable_assigned = 0; ioc->use_32bit_dma = false; ioc->dma_mask = 64; - if (ioc->is_aero_ioc) + if (ioc->is_aero_ioc) { ioc->base_readl = &_base_readl_aero; - else + ioc->base_readl_ext_retry = &_base_readl_ext_retry; + } else { ioc->base_readl = &_base_readl; + ioc->base_readl_ext_retry = &_base_readl; + } r = mpt3sas_base_map_resources(ioc); if (r) goto out_free_resources; diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h index 0f5db94e0ccd..7c8dabfa1036 100644 --- a/drivers/scsi/mpt3sas/mpt3sas_base.h +++ b/drivers/scsi/mpt3sas/mpt3sas_base.h @@ -1469,6 +1469,7 @@ struct MPT3SAS_ADAPTER { u8 diag_trigger_active; u8 atomic_desc_capable; BASE_READ_REG base_readl; + BASE_READ_REG base_readl_ext_retry; struct SL_WH_MASTER_TRIGGER_T diag_trigger_master; struct SL_WH_EVENT_TRIGGERS_T diag_trigger_event; struct SL_WH_SCSI_TRIGGERS_T diag_trigger_scsi; -- 2.33.0

2 1

[PATCH OLK-5.10] f2fs: fix to avoid NULL pointer dereference f2fs_write_end_io()
by Zhihao Cheng 23 Oct '23

23 Oct '23

From: Chao Yu <chao(a)kernel.org> stable inclusion from stable-v5.10.188 commit b39ef5b52f10b819bd0ceeb22e8f7df7800880ca category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I78FS1 CVE: CVE-2023-2898 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit d8189834d4348ae608083e1f1f53792cfcc2a9bc upstream. butt3rflyh4ck reports a bug as below: When a thread always calls F2FS_IOC_RESIZE_FS to resize fs, if resize fs is failed, f2fs kernel thread would invoke callback function to update f2fs io info, it would call f2fs_write_end_io and may trigger null-ptr-deref in NODE_MAPPING. general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [0x0000000000000030-0x0000000000000037] RIP: 0010:NODE_MAPPING fs/f2fs/f2fs.h:1972 [inline] RIP: 0010:f2fs_write_end_io+0x727/0x1050 fs/f2fs/data.c:370 <TASK> bio_endio+0x5af/0x6c0 block/bio.c:1608 req_bio_endio block/blk-mq.c:761 [inline] blk_update_request+0x5cc/0x1690 block/blk-mq.c:906 blk_mq_end_request+0x59/0x4c0 block/blk-mq.c:1023 lo_complete_rq+0x1c6/0x280 drivers/block/loop.c:370 blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1101 __do_softirq+0x1d4/0x8ef kernel/softirq.c:571 run_ksoftirqd kernel/softirq.c:939 [inline] run_ksoftirqd+0x31/0x60 kernel/softirq.c:931 smpboot_thread_fn+0x659/0x9e0 kernel/smpboot.c:164 kthread+0x33e/0x440 kernel/kthread.c:379 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 The root cause is below race case can cause leaving dirty metadata in f2fs after filesystem is remount as ro: Thread A Thread B - f2fs_ioc_resize_fs - f2fs_readonly --- return false - f2fs_resize_fs - f2fs_remount - write_checkpoint - set f2fs as ro - free_segment_range - update meta_inode's data Then, if f2fs_put_super() fails to write_checkpoint due to readonly status, and meta_inode's dirty data will be writebacked after node_inode is put, finally, f2fs_write_end_io will access NULL pointer on sbi->node_inode. Thread A IRQ context - f2fs_put_super - write_checkpoint fails - iput(node_inode) - node_inode = NULL - iput(meta_inode) - write_inode_now - f2fs_write_meta_page - f2fs_write_end_io - NODE_MAPPING(sbi) : access NULL pointer on node_inode Fixes: b4b10061ef98 ("f2fs: refactor resize_fs to avoid meta updates in progress") Reported-by: butt3rflyh4ck <butterflyhuangxx(a)gmail.com> Closes: https://lore.kernel.org/r/1684480657-2375-1-git-send-email-yangtiezhu@loong… Tested-by: butt3rflyh4ck <butterflyhuangxx(a)gmail.com> Signed-off-by: Chao Yu <chao(a)kernel.org> Signed-off-by: Jaegeuk Kim <jaegeuk(a)kernel.org> Signed-off-by: Stefan Ghinea <stefan.ghinea(a)windriver.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> --- fs/f2fs/f2fs.h | 2 +- fs/f2fs/file.c | 2 +- fs/f2fs/gc.c | 22 +++++++++++++++++++--- 3 files changed, 21 insertions(+), 5 deletions(-) diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h index c03fdda1bddf..7272c0e0ac96 100644 --- a/fs/f2fs/f2fs.h +++ b/fs/f2fs/f2fs.h @@ -3483,7 +3483,7 @@ block_t f2fs_start_bidx_of_node(unsigned int node_ofs, struct inode *inode); int f2fs_gc(struct f2fs_sb_info *sbi, bool sync, bool background, bool force, unsigned int segno); void f2fs_build_gc_manager(struct f2fs_sb_info *sbi); -int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count); +int f2fs_resize_fs(struct file *filp, __u64 block_count); int __init f2fs_create_garbage_collection_cache(void); void f2fs_destroy_garbage_collection_cache(void); diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c index d56fcace1821..30a257973e82 100644 --- a/fs/f2fs/file.c +++ b/fs/f2fs/file.c @@ -3355,7 +3355,7 @@ static int f2fs_ioc_resize_fs(struct file *filp, unsigned long arg) sizeof(block_count))) return -EFAULT; - return f2fs_resize_fs(sbi, block_count); + return f2fs_resize_fs(filp, block_count); } static int f2fs_ioc_enable_verity(struct file *filp, unsigned long arg) diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c index 63e37d7cffd6..b908dfaafc9c 100644 --- a/fs/f2fs/gc.c +++ b/fs/f2fs/gc.c @@ -7,6 +7,7 @@ */ #include <linux/fs.h> #include <linux/module.h> +#include <linux/mount.h> #include <linux/backing-dev.h> #include <linux/init.h> #include <linux/f2fs_fs.h> @@ -1977,8 +1978,9 @@ static void update_fs_metadata(struct f2fs_sb_info *sbi, int secs) } } -int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count) +int f2fs_resize_fs(struct file *filp, __u64 block_count) { + struct f2fs_sb_info *sbi = F2FS_I_SB(file_inode(filp)); __u64 old_block_count, shrunk_blocks; struct cp_control cpc = { CP_RESIZE, 0, 0, 0 }; unsigned int secs; @@ -2016,12 +2018,18 @@ int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count) return -EINVAL; } + err = mnt_want_write_file(filp); + if (err) + return err; + shrunk_blocks = old_block_count - block_count; secs = div_u64(shrunk_blocks, BLKS_PER_SEC(sbi)); /* stop other GC */ - if (!down_write_trylock(&sbi->gc_lock)) - return -EAGAIN; + if (!down_write_trylock(&sbi->gc_lock)) { + err = -EAGAIN; + goto out_drop_write; + } /* stop CP to protect MAIN_SEC in free_segment_range */ f2fs_lock_op(sbi); @@ -2041,10 +2049,18 @@ int f2fs_resize_fs(struct f2fs_sb_info *sbi, __u64 block_count) out_unlock: f2fs_unlock_op(sbi); up_write(&sbi->gc_lock); +out_drop_write: + mnt_drop_write_file(filp); if (err) return err; freeze_super(sbi->sb); + + if (f2fs_readonly(sbi->sb)) { + thaw_super(sbi->sb); + return -EROFS; + } + down_write(&sbi->gc_lock); mutex_lock(&sbi->cp_mutex); -- 2.31.1

2 1

[PATCH openEuler-23.09 0/2] bug fixes for gmem
by Wupeng Ma 22 Oct '23

22 Oct '23

From: Ma Wupeng <mawupeng1(a)huawei.com> bug fixes for gmem. Ma Wupeng (2): mm: gmem: Reture false if hnid is bigger than MAX_NUMNODES mm: gmem: Iter all vmas via find_vma_intersection include/linux/gmem.h | 7 ++-- mm/gmem.c | 98 ++++++++++++++++++++++++++++---------------- 2 files changed, 66 insertions(+), 39 deletions(-) -- 2.25.1

2 3

[PATCH] driver inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I7SVH7
by mingqian218472 21 Oct '23

21 Oct '23

From: 闫海涛 <yanhaitao2(a)huawei.com> --- 0007.patch | 633 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 633 insertions(+) create mode 100644 0007.patch diff --git a/0007.patch b/0007.patch new file mode 100644 index 0000000..0b1222a --- /dev/null +++ b/0007.patch @@ -0,0 +1,633 @@ +diff --git a/fs/nfs/enfs/enfs_multipath.c b/fs/nfs/enfs/enfs_multipath.c +new file mode 100644 +index 000000000000..7a58cab74869 +--- /dev/null ++++ b/fs/nfs/enfs/enfs_multipath.c +@@ -0,0 +1,627 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* ++ * Copyright (c) Huawei Technologies Co., Ltd. 2023-2023. All rights reserved. ++ */ ++#include "enfs_multipath.h" ++#include <linux/in.h> ++#include <linux/in6.h> ++#include <linux/kallsyms.h> ++#include <linux/mm.h> ++#include <linux/module.h> ++#include <linux/mount.h> ++#include <linux/namei.h> ++#include <linux/rcupdate.h> ++#include <linux/slab.h> ++#include <linux/socket.h> ++#include <linux/atomic.h> ++#include <linux/sunrpc/addr.h> ++#include <linux/sunrpc/bc_xprt.h> ++#include <linux/sunrpc/clnt.h> ++#include <linux/sunrpc/metrics.h> ++#include <linux/sunrpc/rpc_pipe_fs.h> ++#include <linux/sunrpc/xprt.h> ++#include <linux/sunrpc/xprtmultipath.h> ++#include <linux/types.h> ++#include <linux/un.h> ++#include <linux/utsname.h> ++#include <linux/workqueue.h> ++#include <trace/events/sunrpc.h> ++#include <linux/sunrpc/sunrpc_enfs_adapter.h> ++ ++#include "enfs.h" ++#include "enfs_log.h" ++#include "enfs_multipath_parse.h" ++#include "enfs_path.h" ++#include "enfs_proc.h" ++#include "enfs_remount.h" ++#include "enfs_roundrobin.h" ++#include "failover_path.h" ++#include "failover_time.h" ++#include "pm_ping.h" ++#include "pm_state.h" ++ ++struct xprt_attach_callback_data { ++ atomic_t *conditon; ++ wait_queue_head_t *waitq; ++}; ++ ++struct xprt_attach_info { ++ struct sockaddr_storage *localAddress; ++ struct sockaddr_storage *remoteAddress; ++ struct rpc_xprt *xprt; ++ struct xprt_attach_callback_data *data; ++}; ++ ++static DECLARE_WAIT_QUEUE_HEAD(path_attach_wait_queue); ++ ++ ++static void sockaddr_set_port(struct sockaddr *addr, int port) ++{ ++ switch (addr->sa_family) { ++ case AF_INET: ++ ((struct sockaddr_in *)addr)->sin_port = htons(port); ++ break; ++ case AF_INET6: ++ ((struct sockaddr_in6 *)addr)->sin6_port = htons(port); ++ break; ++ } ++} ++ ++static int sockaddr_ip_to_str(struct sockaddr *addr, char *buf, int len) ++{ ++ switch (addr->sa_family) { ++ case AF_INET: { ++ struct sockaddr_in *sin = (struct sockaddr_in *)addr; ++ ++ snprintf(buf, len, "%pI4", &sin->sin_addr); ++ return 0; ++ } ++ case AF_INET6: { ++ struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)addr; ++ ++ snprintf(buf, len, "%pI6", &sin6->sin6_addr); ++ return 0; ++ } ++ default: ++ break; ++ } ++ return 1; ++} ++ ++void print_enfs_multipath_addr(struct sockaddr *local, struct sockaddr *remote) ++{ ++ char buf1[128]; ++ char buf2[128]; ++ ++ sockaddr_ip_to_str(local, buf1, sizeof(buf1)); ++ sockaddr_ip_to_str(remote, buf2, sizeof(buf2)); ++ ++ pr_info("local:%s remote:%s\n", buf1, buf2); ++} ++ ++static int enfs_servername(char *servername, unsigned long long len, ++ struct rpc_create_args *args) ++{ ++ struct sockaddr_un *sun = (struct sockaddr_un *)args->address; ++ struct sockaddr_in *sin = (struct sockaddr_in *)args->address; ++ struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)args->address; ++ ++ servername[0] = '\0'; ++ switch (args->address->sa_family) { ++ case AF_LOCAL: ++ snprintf(servername, len, "%s", sun->sun_path); ++ break; ++ case AF_INET: ++ snprintf(servername, len, "%pI4", &sin->sin_addr.s_addr); ++ break; ++ case AF_INET6: ++ snprintf(servername, len, "%pI6", &sin6->sin6_addr); ++ break; ++ default: ++ pr_info("invalid family:%d\n", ++ args->address->sa_family); ++ return -EINVAL; ++ } ++ return 0; ++} ++ ++static void pm_xprt_ping_callback(void *data) ++{ ++ struct xprt_attach_callback_data *attach_callback_data = ++ (struct xprt_attach_callback_data *)data; ++ ++ atomic_dec(attach_callback_data->conditon); ++ wake_up(attach_callback_data->waitq); ++} ++ ++static ++int enfs_add_xprt_setup(struct rpc_clnt *clnt, struct rpc_xprt_switch *xps, ++ struct rpc_xprt *xprt, void *data) ++{ ++ int ret; ++ struct enfs_xprt_context *ctx; ++ struct xprt_attach_info *attach_info = data; ++ struct sockaddr_storage *srcaddr = attach_info->localAddress; ++ ++ ctx = (struct enfs_xprt_context *)xprt->multipath_context; ++ ctx->stats = rpc_alloc_iostats(clnt); ++ ctx->main = false; ++ ctx->srcaddr = *srcaddr; ++ pm_set_path_state(xprt, PM_STATE_INIT); ++ pm_ping_set_path_check_state(xprt, PM_CHECK_INIT); ++ ++ attach_info->xprt = xprt; ++ xprt_get(xprt); ++ ++ ret = pm_ping_rpc_test_xprt_with_callback(clnt, xprt, ++ pm_xprt_ping_callback, attach_info->data); ++ if (ret != 1) { ++ enfs_log_error("Failed to add ping task.\n"); ++ atomic_dec(attach_info->data->conditon); ++ } ++ ++ // so that rpc_clnt_add_xprt ++ // does not call rpc_xprt_switch_add_xprt ++ return 1; ++} ++ ++int enfs_configure_xprt_to_clnt(struct xprt_create *xprtargs, ++ struct rpc_clnt *clnt, ++ struct xprt_attach_info *attach_info) ++{ ++ int err = 0; ++ ++ xprtargs->srcaddr = (struct sockaddr *)attach_info->localAddress; ++ xprtargs->dstaddr = (struct sockaddr *)attach_info->remoteAddress; ++ ++ sockaddr_set_port((struct sockaddr *)attach_info->localAddress, 2049); ++ sockaddr_set_port((struct sockaddr *)attach_info->remoteAddress, 2049); ++ print_enfs_multipath_addr((struct sockaddr *)attach_info->localAddress, ++ (struct sockaddr *)attach_info->remoteAddress); ++ ++ err = rpc_clnt_add_xprt(clnt, xprtargs, ++ enfs_add_xprt_setup, ++ attach_info); ++ if (err != 1) { ++ enfs_log_error("clnt add xprt err:%d\n", err); ++ return err; ++ } ++ return 0; ++} ++ ++// Calculate the greatest common divisor of two numbers ++static int enfs_cal_gcd(int num1, int num2) ++{ ++ if (num2 == 0) ++ return num1; ++ return enfs_cal_gcd(num2, num1 % num2); ++} ++ ++bool enfs_cmp_addrs(struct sockaddr_storage *srcaddr, ++ struct sockaddr_storage *dstaddr, ++ struct sockaddr_storage *localAddress, ++ struct sockaddr_storage *remoteAddress) ++{ ++ if (rpc_cmp_addr((struct sockaddr *)srcaddr, ++ (struct sockaddr *)localAddress)) { ++ ++ if (rpc_cmp_addr((struct sockaddr *)dstaddr, ++ (struct sockaddr *)remoteAddress)) ++ return true; ++ ++ } ++ ++ return false; ++} ++ ++bool enfs_xprt_addrs_is_same(struct rpc_xprt *xprt, ++ struct sockaddr_storage *localAddress, ++ struct sockaddr_storage *remoteAddress) ++{ ++ struct enfs_xprt_context *xprt_local_info = NULL; ++ struct sockaddr_storage *srcaddr = NULL; ++ struct sockaddr_storage *dstaddr = NULL; ++ ++ if (xprt == NULL) ++ return true; ++ xprt_local_info = (struct enfs_xprt_context *)xprt->multipath_context; ++ srcaddr = &xprt_local_info->srcaddr; ++ dstaddr = &xprt->addr; ++ ++ return enfs_cmp_addrs(srcaddr, dstaddr, localAddress, remoteAddress); ++} ++ ++bool enfs_already_have_xprt(struct rpc_clnt *clnt, ++ struct sockaddr_storage *localAddress, ++ struct sockaddr_storage *remoteAddress) ++{ ++ struct rpc_xprt *pos = NULL; ++ struct rpc_xprt_switch *xps = NULL; ++ ++ rcu_read_lock(); ++ xps = xprt_switch_get(rcu_dereference(clnt->cl_xpi.xpi_xpswitch)); ++ if (xps == NULL) { ++ rcu_read_unlock(); ++ return false; ++ } ++ list_for_each_entry_rcu(pos, &xps->xps_xprt_list, xprt_switch) { ++ if (enfs_xprt_addrs_is_same(pos, localAddress, remoteAddress)) { ++ xprt_switch_put(xps); ++ rcu_read_unlock(); ++ return true; ++ } ++ } ++ xprt_switch_put(xps); ++ rcu_read_unlock(); ++ return false; ++} ++ ++static void enfs_xprt_switch_add_xprt(struct rpc_clnt *clnt, ++ struct rpc_xprt *xprt) ++{ ++ struct rpc_xprt_switch *xps; ++ ++ rcu_read_lock(); ++ xps = rcu_dereference(clnt->cl_xpi.xpi_xpswitch); ++ spin_lock(&xps->xps_lock); ++ if (xps->xps_net == xprt->xprt_net || xps->xps_net == NULL) ++ xprt_switch_add_xprt_locked(xps, xprt); ++ spin_unlock(&xps->xps_lock); ++ rcu_read_unlock(); ++} ++ ++static void enfs_add_xprts_to_clnt(struct rpc_clnt *clnt, ++ struct xprt_attach_info *attach_infos, ++ int total_combinations) ++{ ++ struct rpc_xprt *xprt; ++ enum pm_path_state state; ++ int i; ++ int link_count = 0; ++ ++ for (i = 0; i < total_combinations; i++) { ++ xprt = attach_infos[i].xprt; ++ ++ if (xprt == NULL) ++ continue; ++ ++ state = pm_get_path_state(xprt); ++ ++ if (link_count < MAX_XPRT_NUM_PER_CLIENT && ++ state == PM_STATE_NORMAL) { ++ ++ enfs_xprt_switch_add_xprt(clnt, xprt); ++ link_count++; ++ continue; ++ ++ } ++ ++ xprt_put(xprt); ++ } ++} ++ ++static void enfs_combine_addr(struct xprt_create *xprtargs, ++ struct rpc_clnt *clnt, ++ struct nfs_ip_list *local, ++ struct nfs_ip_list *remote) ++{ ++ int i; ++ int err; ++ int local_index; ++ int remote_index; ++ int link_count = 0; ++ int local_total = local->count; ++ int remote_total = remote->count; ++ int local_remote_total_lcm; ++ int total_combinations = local_total * remote_total; ++ struct xprt_attach_info *attach_infos; ++ atomic_t wait_queue_condition; ++ ++ struct xprt_attach_callback_data attach_callback_data = { ++ &wait_queue_condition, &path_attach_wait_queue}; ++ ++ atomic_set(&wait_queue_condition, total_combinations); ++ ++ pr_info("local count:%d remote count:%d\n", local_total, remote_total); ++ if (local_total == 0 || remote_total == 0) { ++ pr_err("no ip list is present.\n"); ++ return; ++ } ++ ++ attach_infos = kzalloc( ++ (total_combinations) * sizeof(struct xprt_attach_info), ++ GFP_KERNEL); ++ if (attach_infos == NULL) { ++ enfs_log_error("Failed to kzalloc memory\n"); ++ return; ++ } ++ // Calculate the least common multiple of local_total and remote_total ++ local_remote_total_lcm = total_combinations / ++ enfs_cal_gcd(local_total, remote_total); ++ ++ // It needs to be offset one for lcm times of ++ // cycle so that all possible link setup method would be traversed ++ for (i = 0; i < total_combinations; i++) { ++ local_index = i % local_total; ++ remote_index = (i + link_count / local_remote_total_lcm) % ++ remote_total; ++ ++ if (enfs_already_have_xprt(clnt, ++ &local->address[local_index], ++ &remote->address[remote_index])) { ++ ++ atomic_dec(&wait_queue_condition); ++ link_count++; ++ continue; ++ ++ } ++ ++ attach_infos[i].localAddress = &local->address[local_index]; ++ attach_infos[i].remoteAddress = &remote->address[remote_index]; ++ attach_infos[i].data = &attach_callback_data; ++ ++ err = enfs_configure_xprt_to_clnt(xprtargs, ++ clnt, &attach_infos[i]); ++ if (err) { ++ pr_err("add xprt ippair err:%d\n", err); ++ atomic_dec(&wait_queue_condition); ++ } ++ link_count++; ++ } ++ ++ wait_event(path_attach_wait_queue, ++ atomic_read(&wait_queue_condition) == 0); ++ ++ enfs_add_xprts_to_clnt(clnt, attach_infos, total_combinations); ++ ++ kfree(attach_infos); ++} ++ ++void enfs_xprt_ippair_create(struct xprt_create *xprtargs, ++ struct rpc_clnt *clnt, ++ void *data) ++{ ++ struct multipath_mount_options *mopt = ++ (struct multipath_mount_options *)data; ++ ++ if (mopt == NULL) { ++ pr_err("ip list is NULL.\n"); ++ return; ++ } ++ ++ enfs_combine_addr(xprtargs, clnt, ++ mopt->local_ip_list, ++ mopt->remote_ip_list); ++ enfs_lb_set_policy(clnt); ++} ++ ++struct xprts_options_and_clnt { ++ struct rpc_create_args *args; ++ struct rpc_clnt *clnt; ++ void *data; ++}; ++ ++static void set_clnt_enfs_flag(struct rpc_clnt *clnt) ++{ ++ clnt->cl_enfs = true; ++} ++ ++int enfs_config_xprt_create_args(struct xprt_create *xprtargs, ++ struct rpc_create_args *args, ++ char *servername, size_t length) ++{ ++ int errno = 0; ++ ++ xprtargs->ident = args->protocol; ++ xprtargs->net = args->net; ++ xprtargs->addrlen = args->addrsize; ++ xprtargs->servername = args->servername; ++ ++ if (args->flags & RPC_CLNT_CREATE_INFINITE_SLOTS) ++ xprtargs->flags |= XPRT_CREATE_INFINITE_SLOTS; ++ if (args->flags & RPC_CLNT_CREATE_NO_IDLE_TIMEOUT) ++ xprtargs->flags |= XPRT_CREATE_NO_IDLE_TIMEOUT; ++ ++ if (xprtargs->servername == NULL) { ++ errno = enfs_servername(servername, length, args); ++ if (errno) ++ return errno; ++ xprtargs->servername = servername; ++ } ++ ++ return 0; ++} ++ ++int enfs_multipath_create_thread(void *data) ++{ ++ int errno; ++ char servername[48]; ++ struct xprts_options_and_clnt *create_args = ++ (struct xprts_options_and_clnt *)data; ++ struct multipath_mount_options *mount_options = ++ (struct multipath_mount_options *) ++ create_args->args->multipath_option; ++ struct xprt_create xprtargs; ++ ++ memset(&xprtargs, 0, sizeof(struct xprt_create)); ++ ++ if (mount_options == NULL) { ++ enfs_log_error("enfs: local and remot addr empty\n"); ++ return -EINVAL; ++ } ++ ++ errno = enfs_config_xprt_create_args(&xprtargs, ++ create_args->args, servername, ++ sizeof(servername)); ++ if (errno) { ++ enfs_log_error("enfs: create xprt failed! errno:%d\n", ++ errno); ++ return errno; ++ } ++ ++ //mount : localaddrs or remoteaddrs is empty ++ if (mount_options->local_ip_list->count == 0) { ++ errno = rpc_localaddr(create_args->clnt, ++ (struct sockaddr *) ++ &mount_options->local_ip_list->address[0], ++ sizeof(struct sockaddr_storage)); ++ if (errno) { ++ enfs_log_error("enfs: get clnt srcaddr errno:%d\n", ++ errno); ++ return errno; ++ } ++ mount_options->local_ip_list->count = 1; ++ } ++ ++ if (mount_options->remote_ip_list->count == 0) { ++ errno = rpc_peeraddr(create_args->clnt, ++ (struct sockaddr *) ++ &mount_options->remote_ip_list->address[0], ++ sizeof(struct sockaddr_storage)); ++ if (errno == 0) { ++ enfs_log_error("enfs: get clnt dstaddr errno:%d\n", ++ errno); ++ return errno; ++ } ++ mount_options->remote_ip_list->count = 1; ++ } ++ ++ errno = enfs_proc_create_clnt(create_args->clnt); ++ if (errno != 0) ++ pr_err("create clnt proc failed.\n"); ++ ++ set_clnt_enfs_flag(create_args->clnt); ++ enfs_xprt_ippair_create(&xprtargs, create_args->clnt, mount_options); ++ ++ kfree(create_args->args); ++ kfree(data); ++ return 0; ++} ++ ++static int set_main_xprt_ctx(struct rpc_clnt *clnt, struct rpc_xprt *xprt, ++ struct sockaddr_storage *srcaddr) ++{ ++ struct enfs_xprt_context *ctx = xprt->multipath_context; ++ ++ if (!ctx) { ++ enfs_log_error("main xprt not multipath ctx.\n"); ++ return -1; ++ } ++ ++ ctx->main = true; ++ ctx->stats = rpc_alloc_iostats(clnt); ++ ctx->srcaddr = *srcaddr; ++ pm_set_path_state(xprt, PM_STATE_NORMAL); ++ pm_ping_set_path_check_state(xprt, PM_CHECK_INIT); ++ ++ return 0; ++} ++ ++static int alloc_main_xprt_multicontext(struct rpc_create_args *args, ++ struct rpc_clnt *clnt) ++{ ++ int err; ++ struct sockaddr_storage srcaddr; ++ ++ // avoid main xprt multicontex local addr is empty. ++ err = rpc_localaddr(clnt, (struct sockaddr *)&srcaddr, sizeof(srcaddr)); ++ if (err) { ++ enfs_log_error("get clnt localaddr err:%d\n", err); ++ return err; ++ } ++ ++ err = set_main_xprt_ctx(clnt, clnt->cl_xprt, &srcaddr); ++ if (err) ++ enfs_log_error("alloc main xprt failed.\n"); ++ ++ return err; ++} ++ ++void enfs_create_multi_xprt(struct rpc_create_args *args, struct rpc_clnt *clnt) ++{ ++ // struct task_struct *th; ++ struct xprts_options_and_clnt *thargs; ++ struct rpc_create_args *cargs; ++ int err; ++ ++ enfs_log_info("%s %p\n", __func__, clnt); ++ ++ cargs = kmalloc(sizeof(struct rpc_create_args), GFP_KERNEL); ++ if (cargs == NULL) ++ return; ++ ++ *cargs = *args; ++ ++ thargs = kmalloc(sizeof(struct xprts_options_and_clnt), GFP_KERNEL); ++ if (thargs == NULL) { ++ kfree(cargs); ++ return; ++ } ++ ++ alloc_main_xprt_multicontext(args, clnt); ++ ++ thargs->args = cargs; ++ thargs->clnt = clnt; ++ thargs->data = args->multipath_option; ++ ++ err = enfs_multipath_create_thread(thargs); ++ ++ if (err != 0) { ++ kfree(cargs); ++ kfree(thargs); ++ } ++} ++ ++static void enfs_create_xprt_ctx(struct rpc_xprt *xprt) ++{ ++ int err; ++ ++ err = enfs_alloc_xprt_ctx(xprt); ++ if (err) ++ enfs_log_error("alloc xprt failed.\n"); ++} ++ ++static struct rpc_multipath_ops ops = { ++ .owner = THIS_MODULE, ++ .create_clnt = enfs_create_multi_xprt, ++ .releas_clnt = enfs_proc_delete_clnt, ++ .create_xprt = enfs_create_xprt_ctx, ++ .destroy_xprt = enfs_free_xprt_ctx, ++ .xprt_iostat = enfs_count_iostat, ++ .failover_handle = failover_handle, ++ .adjust_task_timeout = failover_adjust_task_timeout, ++ .init_task_req = failover_init_task_req, ++ .prepare_transmit = failover_prepare_transmit, ++}; ++ ++int enfs_multipath_init(void) ++{ ++ int err; ++ ++ enfs_log_info("multipath init.\n"); ++ ++ err = pm_ping_init(); ++ if (err != 0) { ++ enfs_log_error("pm ping init err:%d\n", err); ++ return err; ++ } ++ ++ err = enfs_proc_init(); ++ if (err != 0) { ++ enfs_log_error("enfs proc init err:%d\n", err); ++ pm_ping_fini(); ++ return err; ++ } ++ ++ rpc_multipath_ops_register(&ops); ++ ++ return 0; ++} ++ ++void enfs_multipath_exit(void) ++{ ++ enfs_log_info("multipath exit.\n"); ++ rpc_multipath_ops_unregister(&ops); ++ enfs_proc_exit(); ++ pm_ping_fini(); ++} -- 2.25.0.windows.1

1 0

[PATCH OLK-5.10 0/4] Avoid spin or livelock during panic
by Ye Weihua 21 Oct '23

21 Oct '23

Stephen Brennan (4): printk: Add panic_in_progress helper printk: disable optimistic spin during panic printk: Avoid livelock with heavy printk during panic printk: Drop console_sem during panic kernel/printk/printk.c | 55 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 54 insertions(+), 1 deletion(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/4] Avoid spin or livelock during panic
by Ye Weihua 21 Oct '23

21 Oct '23

Stephen Brennan (4): printk: Add panic_in_progress helper printk: disable optimistic spin during panic printk: Avoid livelock with heavy printk during panic printk: Drop console_sem during panic kernel/printk/printk.c | 55 +++++++++++++++++++++++++++++++++++++++++- 1 file changed, 54 insertions(+), 1 deletion(-) -- 2.34.1

2 5

[PATCH OLK-5.10 0/2] coresight: etm4x: Match all ETM4 instances based on DEVARCH and DEVTYPE
by Junhao He 20 Oct '23

20 Oct '23

Match all ETM4 instances based on DEVARCH and DEVTYPE Junhao He (1): Revert "coresight: etm4x: Add Support for HiSilicon T6 ETM" Suzuki K Poulose (1): coresight: etm4x: Match all ETM4 instances based on DEVARCH and DEVTYPE .../coresight/coresight-etm4x-core.c | 6 +++++- drivers/hwtracing/coresight/coresight-priv.h | 19 +++++++++++++++++-- 2 files changed, 22 insertions(+), 3 deletions(-) -- 2.33.0

2 3

[PATCH v6 OLK-5.10 00/19] Introduce PBHA and PBHA bit0 to control the usage of HBM Cache precisely
by Wupeng Ma 19 Oct '23

19 Oct '23

From: Ma Wupeng <mawupeng1(a)huawei.com> Patch 1: move FDT init out of kaslr_early_init for future use. Patch 2 to 8: enable feature PBHA for arm64. Patch 9-18: Control the usage of HBM cache for kernel and task precisely. Patch 19: Enable feature PBHA for arm64 by default. Changelog since v5: - Return -EINVAL if pbha bit0 is not enabled in pbha_bit0_update_vma in patch #15 Changelog since v4: - update pbha_bit0_update_pgprot to pgprot_pbha_bit0 Changelog since v3: - update desc for patch #15 Changelog since v2: - correct the error Documentation in patch #18 Changelog since v1: - fix kabi broken due to include files James Morse (7): KVM: arm64: Detect and enable PBHA for stage2 dt-bindings: Rename the description of cpu nodes cpu.yaml dt-bindings: arm: Add binding for Page Based Hardware Attributes arm64: cpufeature: Enable PBHA bits for stage1 arm64: mm: Add pgprot_pbha() to allow drivers to request PBHA values KVM: arm64: Configure PBHA bits for stage2 Documentation: arm64: Describe the support and expectations for PBHA Ma Wupeng (11): arm64: cpufeature: Enable PBHA for stage1 early via FDT arm64: mm: Detect and enable PBHA bit0 at early startup arm64: mm: Update kernel pte entries if pbha bit0 enabled arm64: mm: Show PBHA bit 59 as PBHA0 in ptdump arm64: mm: Introduce VM_PBHA_BIT0 to enable pbha bit0 for single vma arm64: mm: Set PBHA0 bit for VM_PBHA_BIT0 arm64: mm: Introduce procfs interface to update PBHA0 bit arm64: mm: Set flag VM_PBHA_BIT0 for global init task arm64: mm: Introduce prctl to control pbha behavior arm64: mm: Introduce kernel param pbha openeuler: configs: arm64: Enable PBHA by default Marc Zyngier (1): arm64: Extract early FDT mapping from kaslr_early_init() .../admin-guide/kernel-parameters.txt | 8 + Documentation/arm64/index.rst | 1 + Documentation/arm64/pbha.rst | 85 +++ .../devicetree/bindings/arm/cpu.yaml | 537 ++++++++++++++++ .../devicetree/bindings/arm/cpus.yaml | 584 +++--------------- arch/arm64/Kconfig | 20 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpucaps.h | 3 + arch/arm64/include/asm/cpufeature.h | 15 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_pgtable.h | 9 + arch/arm64/include/asm/mman.h | 10 + arch/arm64/include/asm/pgtable-hwdef.h | 6 + arch/arm64/include/asm/pgtable.h | 26 + arch/arm64/include/asm/setup.h | 3 + arch/arm64/include/uapi/asm/mman.h | 1 + arch/arm64/kernel/cpufeature.c | 258 ++++++++ arch/arm64/kernel/head.S | 6 +- arch/arm64/kernel/image-vars.h | 3 + arch/arm64/kernel/kaslr.c | 7 +- arch/arm64/kernel/setup.c | 15 + arch/arm64/kvm/reset.c | 15 +- arch/arm64/mm/hugetlbpage.c | 2 + arch/arm64/mm/mmu.c | 14 +- arch/arm64/mm/ptdump.c | 5 + .../firmware/efi/libstub/efi-stub-helper.c | 3 + drivers/firmware/efi/libstub/fdt.c | 57 ++ drivers/soc/hisilicon/Makefile | 1 + drivers/soc/hisilicon/pbha.c | 207 +++++++ fs/proc/base.c | 103 +++ fs/proc/task_mmu.c | 3 + include/linux/mm.h | 8 +- include/linux/pbha.h | 66 ++ include/uapi/asm-generic/mman-common.h | 1 + include/uapi/linux/prctl.h | 2 + kernel/sys.c | 10 + mm/memory.c | 4 + mm/vmalloc.c | 5 + 38 files changed, 1582 insertions(+), 523 deletions(-) create mode 100644 Documentation/arm64/pbha.rst create mode 100644 Documentation/devicetree/bindings/arm/cpu.yaml create mode 100644 drivers/soc/hisilicon/pbha.c create mode 100644 include/linux/pbha.h -- 2.25.1

2 20

[PATCH OLK-5.10 v2] coresight: Fix loss of connection info when a module is unloaded
by Junhao He 19 Oct '23

19 Oct '23

From: James Clark <james.clark(a)arm.com> mainline inclusion from mainline-v6.4-rc1 commit c45b2835e7b205783bdfe08cc98fa86a7c5eeb74 category: Bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I89FF2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- child_fwnode should be a read only property based on the DT or ACPI. If it's cleared on the parent device when a child is unloaded, then when the child is loaded again the connection won't be remade. child_dev should be cleared instead which signifies that the connection should be remade when the child_fwnode registers a new coresight_device. Similarly the reference count shouldn't be decremented as long as the parent device exists. The correct place to drop the reference is in coresight_release_platform_data() which is already done. Reproducible on Juno with the following steps: # load all coresight modules. $ cd /sys/bus/coresight/devices/ $ echo 1 > tmc_etr0/enable_sink $ echo 1 > etm0/enable_source # Works fine ^ $ echo 0 > etm0/enable_source $ rmmod coresight-funnel $ modprobe coresight-funnel $ echo 1 > etm0/enable_source -bash: echo: write error: Invalid argument Fixes: 37ea1ffddffa ("coresight: Use fwnode handle instead of device names") Fixes: 2af89ebacf29 ("coresight: Clear the connection field properly") Tested-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> Reviewed-by: Mike Leach <mike.leach(a)linaro.org> Signed-off-by: James Clark <james.clark(a)arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> Link: https://lore.kernel.org/r/20230425143542.2305069-2-james.clark@arm.com Signed-off-by: Junhao He <hejunhao3(a)huawei.com> --- drivers/hwtracing/coresight/coresight-core.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c index ee7b5cfcf786..9696f402a328 100644 --- a/drivers/hwtracing/coresight/coresight-core.c +++ b/drivers/hwtracing/coresight/coresight-core.c @@ -1443,13 +1443,8 @@ static int coresight_remove_match(struct device *dev, void *data) if (csdev->dev.fwnode == conn->child_fwnode) { iterator->orphan = true; coresight_remove_links(iterator, conn); - /* - * Drop the reference to the handle for the remote - * device acquired in parsing the connections from - * platform data. - */ - fwnode_handle_put(conn->child_fwnode); - conn->child_fwnode = NULL; + + conn->child_dev = NULL; /* No need to continue */ break; } -- 2.33.0

2 1

[PATCH openEuler-1.0-LTS 0/2] radix-tree bugfix backport
by Ye Weihua 19 Oct '23

19 Oct '23

*** BLURB HERE *** Matthew Wilcox (2): idr: Permit any valid kernel pointer to be stored radix tree: Don't return retry entries from lookup lib/idr.c | 4 -- lib/radix-tree.c | 25 +++++--- tools/testing/radix-tree/Makefile | 1 + tools/testing/radix-tree/idr-test.c | 63 ++++++++++++++++++++ tools/testing/radix-tree/main.c | 1 + tools/testing/radix-tree/regression.h | 1 + tools/testing/radix-tree/regression4.c | 79 ++++++++++++++++++++++++++ 7 files changed, 162 insertions(+), 12 deletions(-) create mode 100644 tools/testing/radix-tree/regression4.c -- 2.34.1

2 3

[PATCH OLK-5.10] psi: Fix "no previous prototype" warnings when CONFIG_CGROUPS=n
by Xia Fukun 19 Oct '23

19 Oct '23

From: Suren Baghdasaryan <surenb(a)google.com> mainline inclusion from mainline-v6.5-rc7 commit ec2444530612a886b406e2830d7f314d1a07d4bb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I89DEJ CVE: NA -------------------------------- When CONFIG_CGROUPS is disabled psi code generates the following warnings: kernel/sched/psi.c:1112:21: warning: no previous prototype for 'psi_trigger_create' [-Wmissing-prototypes] 1112 | struct psi_trigger *psi_trigger_create(struct psi_group *group, | ^~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1182:6: warning: no previous prototype for 'psi_trigger_destroy' [-Wmissing-prototypes] 1182 | void psi_trigger_destroy(struct psi_trigger *t) | ^~~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1249:10: warning: no previous prototype for 'psi_trigger_poll' [-Wmissing-prototypes] 1249 | __poll_t psi_trigger_poll(void **trigger_ptr, | ^~~~~~~~~~~~~~~~ Change declarations of these functions in the header to provide the prototypes even when they are unused. Fixes: 0e94682b73bf ("psi: introduce psi monitor") Reported-by: kernel test robot <lkp(a)intel.com> Signed-off-by: Suren Baghdasaryan <surenb(a)google.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20220119223940.787748-2-surenb@google.com Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- include/linux/psi.h | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/include/linux/psi.h b/include/linux/psi.h index d290f0493c33..c0c1d7e0c84d 100644 --- a/include/linux/psi.h +++ b/include/linux/psi.h @@ -26,18 +26,17 @@ void psi_memstall_enter(unsigned long *flags); void psi_memstall_leave(unsigned long *flags); int psi_show(struct seq_file *s, struct psi_group *group, enum psi_res res); - -#ifdef CONFIG_CGROUPS -int psi_cgroup_alloc(struct cgroup *cgrp); -void psi_cgroup_free(struct cgroup *cgrp); -void cgroup_move_task(struct task_struct *p, struct css_set *to); - struct psi_trigger *psi_trigger_create(struct psi_group *group, char *buf, size_t nbytes, enum psi_res res); void psi_trigger_destroy(struct psi_trigger *t); __poll_t psi_trigger_poll(void **trigger_ptr, struct file *file, poll_table *wait); + +#ifdef CONFIG_CGROUPS +int psi_cgroup_alloc(struct cgroup *cgrp); +void psi_cgroup_free(struct cgroup *cgrp); +void cgroup_move_task(struct task_struct *p, struct css_set *to); #endif #else /* CONFIG_PSI */ -- 2.34.1

2 1

[PATCH OLK-5.10] psi: Fix "no previous prototype" warnings when CONFIG_CGROUPS=n
by Xia Fukun 19 Oct '23

19 Oct '23

From: Suren Baghdasaryan <surenb(a)google.com> mainline inclusion from mainline-v6.5 commit ec2444530612a886b406e2830d7f314d1a07d4bb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I89DEJ CVE: NA -------------------------------- When CONFIG_CGROUPS is disabled psi code generates the following warnings: kernel/sched/psi.c:1112:21: warning: no previous prototype for 'psi_trigger_create' [-Wmissing-prototypes] 1112 | struct psi_trigger *psi_trigger_create(struct psi_group *group, | ^~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1182:6: warning: no previous prototype for 'psi_trigger_destroy' [-Wmissing-prototypes] 1182 | void psi_trigger_destroy(struct psi_trigger *t) | ^~~~~~~~~~~~~~~~~~~ kernel/sched/psi.c:1249:10: warning: no previous prototype for 'psi_trigger_poll' [-Wmissing-prototypes] 1249 | __poll_t psi_trigger_poll(void **trigger_ptr, | ^~~~~~~~~~~~~~~~ Change declarations of these functions in the header to provide the prototypes even when they are unused. Fixes: 0e94682b73bf ("psi: introduce psi monitor") Reported-by: kernel test robot <lkp(a)intel.com> Signed-off-by: Suren Baghdasaryan <surenb(a)google.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20220119223940.787748-2-surenb@google.com Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> --- include/linux/psi.h | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/include/linux/psi.h b/include/linux/psi.h index d290f0493c33..c0c1d7e0c84d 100644 --- a/include/linux/psi.h +++ b/include/linux/psi.h @@ -26,18 +26,17 @@ void psi_memstall_enter(unsigned long *flags); void psi_memstall_leave(unsigned long *flags); int psi_show(struct seq_file *s, struct psi_group *group, enum psi_res res); - -#ifdef CONFIG_CGROUPS -int psi_cgroup_alloc(struct cgroup *cgrp); -void psi_cgroup_free(struct cgroup *cgrp); -void cgroup_move_task(struct task_struct *p, struct css_set *to); - struct psi_trigger *psi_trigger_create(struct psi_group *group, char *buf, size_t nbytes, enum psi_res res); void psi_trigger_destroy(struct psi_trigger *t); __poll_t psi_trigger_poll(void **trigger_ptr, struct file *file, poll_table *wait); + +#ifdef CONFIG_CGROUPS +int psi_cgroup_alloc(struct cgroup *cgrp); +void psi_cgroup_free(struct cgroup *cgrp); +void cgroup_move_task(struct task_struct *p, struct css_set *to); #endif #else /* CONFIG_PSI */ -- 2.34.1

2 1

[resend V2] openEuler 2023 年度优秀项目推荐结果公示
by Huxinwei 19 Oct '23

19 Oct '23

各位社区开发者，大家好：昨天的结果公示，后续又进一步收到错过的推荐。截止当前，技术委员会已收到优秀项目推荐如下。感谢大家的参与，讨论评审预计在下周技术委员会例会上进行，如有其他意见，请在下周二25号之前邮件反馈给我。再次感谢大家的支持。项目名称项目代码仓推荐人 FangTian视窗引擎 https://gitee.com/openeuler/ft_engine https://gitee.com/openeuler/ft_mmi https://gitee.com/openeuler/arkui-linux https://gitee.com/openeuler/ft_flutter https://gitee.com/openeuler/ft_multimedia 华亚东 @hua_yadong huayadong(a)kylinos.cn<mailto:huayadong@kylinos.cn> 吴圣垚 @shen_hua_li shengyao(a)iscas.ac.cn<mailto:shengyao@iscas.ac.cn> 宋亚南 @yanansong songyanan5(a)huawei.com<mailto:songyanan5@huawei.com> 靳国恩 @abc12133 jinguoen(a)huawei.com<mailto:jinguoen@huawei.com> 冯绍波 @ShaoboFeng fengshaobo(a)huawei.com<mailto:fengshaobo@huawei.com> 郑森文 @zhengsenwen senwen(a)iscas.ac.cn<mailto:senwen@iscas.ac.cn> 张子豪 @MouseZhang mousezhang(a)openkylin.top<mailto:mousezhang@openkylin.top> 黄钰馨 @huangyuxin2023 huangyuxin(a)isrc.iscas.ac.cn<mailto:huangyuxin@isrc.iscas.ac.cn> 蒋文宇 @jiangwenyu1 jiangwenyu1(a)huawei.com<mailto:jiangwenyu1@huawei.com> sysMaster https://gitee.com/openeuler/sysmaster 熊伟 @myeuler 何晓文@overweight 胡世元 @love_hangzhou A-Tune https://gitee.com/openeuler/A-Tune 王建民 @jianminw jianmin(a)iscas.ac.cn<mailto:jianmin@iscas.ac.cn> 李次华 @Monday licihua(a)huawei.com<mailto:licihua@huawei.com> 谢志鹏 @xiezhipeng1 xiezhipeng1(a)huawei.com<mailto:xiezhipeng1@huawei.com> A-OPS https://gitee.com/openeuler/A-Ops https://gitee.com/openeuler/aops-apollo https://gitee.com/openeuler/aops-diana https://gitee.com/openeuler/aops-zeus https://gitee.com/openeuler/gala-gopher https://gitee.com/openeuler/gala-spider https://gitee.com/openeuler/gala-anteater https://gitee.com/openeuler/gala-ragdoll https://gitee.com/openeuler/syscare https://gitee.com/openeuler/X-diagnosis 胡峰 @solarhu 罗盛炜 @Lostwayzxc 杨昭 @yangzhao_kl StratoVirt https://gitee.com/openeuler/stratovirt 王志钢 @cellfaint wangzhigang17(a)huawei.com<mailto:wangzhigang17@huawei.com> 朱科潜 @kevinzhu1 zhukeqian1(a)huawei.com<mailto:zhukeqian1@huawei.com> 汤中睿 @tzr tangzhongrui(a)cmss.chinamobile.com<mailto:tangzhongrui@cmss.chinamobile.com> secGear https://gitee.com/openeuler/secGear 朱健伟 @zhujianwei001 zhujianwei7(a)huawei.com<mailto:zhujianwei7@huawei.com> 刘忻 @ICC-NSG xinl(a)lzu.edu.cn<mailto:xinl@lzu.edu.cn> 杜东 @dongduResearcher dd_nirvana(a)sjtu.edu.cn<mailto:dd_nirvana@sjtu.edu.cn> 侯明永 @houmingyong houmingyong(a)huawei.com<mailto:houmingyong@huawei.com> PINC (PlugIN framework for Compiler) https://gitee.com/openEuler/pin-gcc-clienthttps://gitee.com/openeuler/pin-s…<https://gitee.com/openEuler/pin-gcc-clienthttps:/gitee.com/openeuler/pin-se…> 李彦成@li-yancheng 黄晓权@huang-xiaoquan 丁光亚@dguangya 伍明川@wumingchuan iSulad https://gitee.com/openeuler/iSulad https://gitee.com/openeuler/lcro https://gitee.com/openeuler/clibcni 蔡灏旻 @caihaomin 魏宝辉 @weibaohui Apache Bigtop支持openEuler OS https://github.com/apache/bigtop/tree/openEuler-support 熊伟 @myeuler 郑振宇 @ZhengZhenyu zhengzhenyu(a)huawei.com<mailto:zhengzhenyu@huawei.com> 蒋健源 @jenkins-jiang jiangjianyuan(a)huawei.com<mailto:jiangjianyuan@huawei.com> 杨昭 @yangzhao_kl yangzhao1(a)kylinos.cn<mailto:yangzhao1@kylinos.cn> 温伟健 @wenwj0 wenweijian2(a)huawei.com<mailto:wenweijian2@huawei.com> 陈强 @macchen1 mac.chenqiang(a)huawei.com<mailto:mac.chenqiang@huawei.com> sysboost https://gitee.com/openeuler/sysboost @liu-yuntao-10 liuyuntao10(a)huawei.com<mailto:liuyuntao10@huawei.com> @softkiller zhoukang7(a)huawei.com<mailto:zhoukang7@huawei.com> @pan-y182 yangpan51(a)huawei.com<mailto:yangpan51@huawei.com> openEuler Kernel https://gitee.com/openeuler/kernel https://gitee.com/src-openeuler/kernel 谢秀奇 @xiexiuqi xiexiuqi(a)huawei.com<mailto:xiexiuqi@huawei.com> 桑力鹏 @sanglipeng sanglipeng1(a)jd.com<mailto:sanglipeng1@jd.com> 曾昭荣 @x56Jason jason.zeng(a)intel.com<mailto:jason.zeng@intel.com> 孔新伟 @kongzizaixian kong.kongxinwei(a)hisilicon.com<mailto:kong.kongxinwei@hisilicon.com> 刘恺 @kailiu42 kai.liu(a)xfusion.com<mailto:kai.liu@xfusion.com> GMEM（Generalized Memory Management） https://gitee.com/openeuler/kernel/tree/openEuler-23.09/ 主要代码文件： include/linux/gmem.h include/linux/gmem_as.h include/linux/vm_object.h mm/gmem.c mm/vm_object.c mm/huge_memory.c mm/memory.c mm/mmap.c drivers/remote_pager/ @xiexiuqi xiexiuqi(a)huawei.com<mailto:xiexiuqi@huawei.com> @weixizhu94 weixi.zhu(a)huawei.com<mailto:weixi.zhu@huawei.com> @fangchuang fangchuangchuang(a)huawei.com<mailto:fangchuangchuang@huawei.com> @SuperSix173 liuchao173(a)huawei.com<mailto:liuchao173@huawei.com> gazelle https://gitee.com/openeuler/gazelle 胡峰 @solarhu 陆志浩 @MrRlu 吴长冶 @ nlgwcy 郑杰兵@steganographer utsudo https://gitee.com/openeuler/utsudo https://gitee.com/src-openeuler/utsudo 王路军 @ut-wanglujun wanglujun(a)uniontech.com<mailto:wanglujun@uniontech.com> 曹佩庆@hustcao4 caopeiqing(a)uniontech.com<mailto:caopeiqing@uniontech.com> 宾凌宇@binlingyu binlingyu(a)uniontech.com<mailto:binlingyu@uniontech.com> 张欢欢 @luckhuanhuan zhanghuanhuan(a)uniontech.com<mailto:zhanghuanhuan@uniontech.com> 吕从庆 @HelloWorld_lvcongqing lvcongqing(a)uniontech.com<mailto:lvcongqing@uniontech.com> DDE桌面环境 .... 吕从庆 @HelloWorld_lvcongqing lvcongqing(a)uniontech.com<mailto:lvcongqing@uniontech.com> 杨晓旋 @ut-layne-yang yangxiaoxuan(a)uniontech.com<mailto:yangxiaoxuan@uniontech.com> 杨显钊 @ xzyangha yangxianzhao(a)uniontech.com<mailto:yangxianzhao@uniontech.com> 李伟刚 @open-bot liweigang(a)uniontech.com<mailto:liweigang@uniontech.com> kiran桌面环境 https://gitee.com/openeuler/kiran-authentication-devices 等石勇 @stonefly128 tangjie02(a)kylinsec.com.cn<mailto:tangjie02@kylinsec.com.cn> 吴伟 @wuwei_plct wuwei2016(a)iscas.ac.cn<mailto:wuwei2016@iscas.ac.cn> 唐杰 @tangjie02 tangjie02(a)kylinsec.com.cn<mailto:tangjie02@kylinsec.com.cn> 柳鑫浩 @liubuguiii liuxinghao(a)kylinsec.com.cn<mailto:liuxinghao@kylinsec.com.cn> 王逸樵 @eusteuc eusetuc(a)outlook.com<mailto:eusetuc@outlook.com> NestOS https://gitee.com/openeuler/NestOS 王麟 @wonleing wangl29(a)chinatelecom.cn<mailto:wangl29@chinatelecom.cn> 王利民 @wanglmb wanglimin(a)xfusion.com<mailto:wanglimin@xfusion.com> 刘昊 @duguhaotian liuhao27(a)huawei.com<mailto:liuhao27@huawei.com> 杜奕威 @duyiwei7w duyiwei(a)kylinos.cn<mailto:duyiwei@kylinos.cn> NestOS Kubernetes Deployer https://gitee.com/openeuler/nestos-kubernetes-deployer 候健 @hjimmy houjian(a)kylinos.cn<mailto:houjian@kylinos.cn> 王悦良 @wangyueliang wangyueliang(a)kylinos.cn<mailto:wangyueliang@kylinos.cn> 杨昭 @yangzhao_kl yangzhao1(a)kylinos.cn<mailto:yangzhao1@kylinos.cn> 杜奕威 @duyiwei7w duyiwei(a)kylinos.cn<mailto:duyiwei@kylinos.cn> PilotGo https://gitee.com/openeuler/PilotGo 杨昭 @yangzhao_kl yangzhao1(a)kylinos.cn<mailto:yangzhao1@kylinos.cn> 陆志浩 @MrRlu luzhihao(a)huawei.com<mailto:luzhihao@huawei.com> 罗盛玮 @Lostwayzxc luoshengwei(a)huawei.com<mailto:luoshengwei@huawei.com> 镜像文件级定制裁剪项目imageTailor https://gitee.com/openeuler/imageTailor 吴峰光 @wu_fengguang wufengguang(a)huawei.com<mailto:wufengguang@huawei.com> 王龙 @laoqinren wanglong19(a)meituan.com<mailto:wanglong19@meituan.com> 高立江 @qq_mud gaolijiang(a)chinapost.com.cn<mailto:gaolijiang@chinapost.com.cn> 朱春意 @zhuchunyi zhuchunyi(a)huawei.com<mailto:zhuchunyi@huawei.com> migration-tools https://gitee.com/openeuler/migration-tools<https://gitee.com/openeuler/NestOS> 吕从庆 @HelloWorld_lvcongqing lvcongqing(a)uniontech.com<mailto:lvcongqing@uniontech.com> 王磊 @wanglei-uos wangleic(a)uniontech.com<mailto:wangleic@uniontech.com> 李鑫 @F16lx lixin(a)uniontech.com<mailto:lixin@uniontech.com> 刘兴伟 @xingwei-liu liuxingwei(a)uniontech.com<mailto:liuxingwei@uniontech.com> CVE-ease https://gitee.com/openeuler/cve-ease 朱健伟 @zhujianwei001 zhujianwei7(a)huawei.com<mailto:zhujianwei7@huawei.com> 马威 @movie0125 mawei(a)uniontech.com<mailto:mawei@uniontech.com> 王麟 @wonleing wangl29(a)chinatelecom.cn<mailto:wangl29@chinatelecom.cn> 杜奕威 @duyiwei7w duyiwei(a)kylinos.cn<mailto:duyiwei@kylinos.cn> gala-ragdoll https://gitee.com/openeuler/gala-ragdoll.git 柳磊 @liulei 450962(a)qq.com<mailto:450962@qq.com> 李超峰 @李超峰0220(*无效gitee id) lichaofeng(a)cmos.chinamobile.com<mailto:lichaofeng@cmos.chinamobile.com> 杨彬 @byrobinsm binyangck(a)isoftstone.com<mailto:binyangck@isoftstone.com> 张道龙 @zhangdaolong dlzhangak(a)isoftstone.com<mailto:dlzhangak@isoftstone.com> CCPS https://gitee.com/openeuler/ccps 吕从庆 @HelloWorld_lvcongqing lvcongqing(a)uniontech.com<mailto:lvcongqing@uniontech.com> 王磊 @wanglei-uos wangleic(a)uniontech.com<mailto:wangleic@uniontech.com> 季宗耀 @orangeji11 jizongyao(a)uniontech.com<mailto:jizongyao@uniontech.com> 麦合木提·买买提 @mahmut mahmut(a)uniontech.com<mailto:mahmut@uniontech.com> GCC for openEuler https://gitee.com/openEuler/gcc 李彦成 @li-yancheng 黄晓权 @huang-xiaoquan 丁光亚 @dguangya 伍明川 @wumingchuan ZVM https://gitee.com/openeuler/zvm 任慰 @vonhust renwei41(a)huawei.com<mailto:renwei41@huawei.com> 方林旭 @fanglinxu fanglinxu(a)huawei.com<mailto:fanglinxu@huawei.com> 熊程来 @cocoeoli xiongcl(a)hnu.edu.cn<mailto:xiongcl@hnu.edu.cn> 谢国骐 @xie-guoqi xgqman(a)hnu.edu.cn<mailto:xgqman@hnu.edu.cn> 韩宗成 @hzc04 hanzongcheng(a)huawei.com<mailto:hanzongcheng@huawei.com> 罗永茂 @yongmao_luo luoyongmao(a)huawei.com<mailto:luoyongmao@huawei.com> 粱其锋 @emancipator liangqifeng(a)ncti-gba.cn<mailto:liangqifeng@ncti-gba.cn> Rust-Shyper https://gitee.com/openeuler/rust_shyper 任慰 @vonhust renwei41(a)huawei.com<mailto:renwei41@huawei.com> 方林旭 @fanglinxu fanglinxu(a)huawei.com<mailto:fanglinxu@huawei.com> 叶增软 @yezengruan yezengruan(a)huawei.com<mailto:yezengruan@huawei.com> 莫策 @motse306 moce4917(a)buaa.edu.cn<mailto:moce4917@buaa.edu.cn> 王雷 wanglei(a)buaa.edu.cn<mailto:wanglei@buaa.edu.cn> 韩宗成 @hzc04 hanzongcheng(a)huawei.com<mailto:hanzongcheng@huawei.com> 罗永茂 @yongmao_luo luoyongmao(a)huawei.com<mailto:luoyongmao@huawei.com> 粱其锋 @emancipator liangqifeng(a)ncti-gba.cn<mailto:liangqifeng@ncti-gba.cn> oebuild https://gitee.com/openeuler/oebuild 任慰 @vonhust renwei41(a)huawei.com<mailto:renwei41@huawei.com> 方林旭 @fanglinxu fanglinxu(a)huawei.com<mailto:fanglinxu@huawei.com> 粱其锋 @emancipator liangqifeng(a)ncti-gba.cn<mailto:liangqifeng@ncti-gba.cn> 王伟 @wangwei622_admin wangwei(a)cdjrlc.com<mailto:wangwei@cdjrlc.com> 李新宇 @alichinese lixinyu44(a)huawei.com<mailto:lixinyu44@huawei.com> 发件人: Huxinwei 发送时间: 2023年10月18日 16:38 收件人: 'tc(a)openeuler.org' <tc(a)openeuler.org>; 'dev(a)openeuler.org' <dev(a)openeuler.org>; 'kernel(a)openeuler.org' <kernel(a)openeuler.org> 抄送: 'shinwell_hu(a)openeuler.sh' <shinwell_hu(a)openeuler.sh>; Xiongwei (William, Euler) <xiongwei888(a)huawei.com> 主题: [resend] openEuler 2023 年度优秀项目推荐结果公示各位社区开发者，大家好：上午的结果公示，在大家帮助下，识别了之前因为各种原因漏了的项目推荐。截止当前，技术委员会已收到优秀项目推荐如下。感谢大家的参与，讨论评审预计在下周技术委员会例会上进行，如有其他意见，请在下周二17号之前邮件反馈给我。再次感谢大家的支持。项目名称项目代码仓推荐人 FangTian视窗引擎 https://gitee.com/openeuler/ft_engine https://gitee.com/openeuler/ft_mmi https://gitee.com/openeuler/arkui-linux https://gitee.com/openeuler/ft_flutter https://gitee.com/openeuler/ft_multimedia 华亚东 @hua_yadong huayadong(a)kylinos.cn<mailto:huayadong@kylinos.cn> 吴圣垚 @shen_hua_li shengyao(a)iscas.ac.cn<mailto:shengyao@iscas.ac.cn> 宋亚南 @yanansong songyanan5(a)huawei.com<mailto:songyanan5@huawei.com> 靳国恩 @abc12133 jinguoen(a)huawei.com<mailto:jinguoen@huawei.com> 冯绍波 @ShaoboFeng fengshaobo(a)huawei.com<mailto:fengshaobo@huawei.com> 郑森文 @zhengsenwen senwen(a)iscas.ac.cn<mailto:senwen@iscas.ac.cn> 张子豪 @MouseZhang mousezhang(a)openkylin.top<mailto:mousezhang@openkylin.top> 黄钰馨 @huangyuxin2023 huangyuxin(a)isrc.iscas.ac.cn<mailto:huangyuxin@isrc.iscas.ac.cn> 蒋文宇 @jiangwenyu1 jiangwenyu1(a)huawei.com<mailto:jiangwenyu1@huawei.com> sysMaster https://gitee.com/openeuler/sysmaster 熊伟 @myeuler 何晓文@overweight 胡世元 @love_hangzhou A-Tune https://gitee.com/openeuler/A-Tune 王建民 @jianminw jianmin(a)iscas.ac.cn<mailto:jianmin@iscas.ac.cn> 李次华 @Monday licihua(a)huawei.com<mailto:licihua@huawei.com> 谢志鹏 @xiezhipeng1 xiezhipeng1(a)huawei.com<mailto:xiezhipeng1@huawei.com> A-OPS https://gitee.com/openeuler/A-Ops https://gitee.com/openeuler/aops-apollo https://gitee.com/openeuler/aops-diana https://gitee.com/openeuler/aops-zeus https://gitee.com/openeuler/gala-gopher https://gitee.com/openeuler/gala-spider https://gitee.com/openeuler/gala-anteater https://gitee.com/openeuler/gala-ragdoll https://gitee.com/openeuler/syscare https://gitee.com/openeuler/X-diagnosis 胡峰 @solarhu 罗盛炜 @Lostwayzxc 杨昭 @yangzhao_kl StratoVirt https://gitee.com/openeuler/stratovirt 王志钢 @cellfaint wangzhigang17(a)huawei.com<mailto:wangzhigang17@huawei.com> 朱科潜 @kevinzhu1 zhukeqian1(a)huawei.com<mailto:zhukeqian1@huawei.com> 汤中睿 @tzr tangzhongrui(a)cmss.chinamobile.com<mailto:tangzhongrui@cmss.chinamobile.com> secGear https://gitee.com/openeuler/secGear 朱健伟 @zhujianwei001 zhujianwei7(a)huawei.com<mailto:zhujianwei7@huawei.com> 刘忻 @ICC-NSG xinl(a)lzu.edu.cn<mailto:xinl@lzu.edu.cn> 杜东 @dongduResearcher dd_nirvana(a)sjtu.edu.cn<mailto:dd_nirvana@sjtu.edu.cn> 侯明永 @houmingyong houmingyong(a)huawei.com<mailto:houmingyong@huawei.com> PINC (PlugIN framework for Compiler) https://gitee.com/openEuler/pin-gcc-clienthttps://gitee.com/openeuler/pin-s…<https://gitee.com/openEuler/pin-gcc-clienthttps:/gitee.com/openeuler/pin-se…> 李彦成@li-yancheng 黄晓权@huang-xiaoquan 丁光亚@dguangya 伍明川@wumingchuan iSulad https://gitee.com/openeuler/iSulad https://gitee.com/openeuler/lcro https://gitee.com/openeuler/clibcni 蔡灏旻 @caihaomin 魏宝辉 @weibaohui Apache Bigtop支持openEuler OS https://github.com/apache/bigtop/tree/openEuler-support 熊伟 @myeuler 郑振宇 @ZhengZhenyu zhengzhenyu(a)huawei.com<mailto:zhengzhenyu@huawei.com> 蒋健源 @jenkins-jiang jiangjianyuan(a)huawei.com<mailto:jiangjianyuan@huawei.com> 杨昭 @yangzhao_kl yangzhao1(a)kylinos.cn<mailto:yangzhao1@kylinos.cn> 温伟健 @wenwj0 wenweijian2(a)huawei.com<mailto:wenweijian2@huawei.com> 陈强 @macchen1 mac.chenqiang(a)huawei.com<mailto:mac.chenqiang@huawei.com> sysboost https://gitee.com/openeuler/sysboost @liu-yuntao-10 liuyuntao10(a)huawei.com<mailto:liuyuntao10@huawei.com> @softkiller zhoukang7(a)huawei.com<mailto:zhoukang7@huawei.com> @pan-y182 yangpan51(a)huawei.com<mailto:yangpan51@huawei.com> openEuler Kernel https://gitee.com/openeuler/kernel https://gitee.com/src-openeuler/kernel 谢秀奇 @xiexiuqi xiexiuqi(a)huawei.com<mailto:xiexiuqi@huawei.com> 桑力鹏 @sanglipeng sanglipeng1(a)jd.com<mailto:sanglipeng1@jd.com> 曾昭荣 @x56Jason jason.zeng(a)intel.com<mailto:jason.zeng@intel.com> 孔新伟 @kongzizaixian kong.kongxinwei(a)hisilicon.com<mailto:kong.kongxinwei@hisilicon.com> 刘恺 @kailiu42 kai.liu(a)xfusion.com<mailto:kai.liu@xfusion.com> GMEM（Generalized Memory Management） https://gitee.com/openeuler/kernel/tree/openEuler-23.09/ 主要代码文件： include/linux/gmem.h include/linux/gmem_as.h include/linux/vm_object.h mm/gmem.c mm/vm_object.c mm/huge_memory.c mm/memory.c mm/mmap.c drivers/remote_pager/ @xiexiuqi xiexiuqi(a)huawei.com<mailto:xiexiuqi@huawei.com> @weixizhu94 weixi.zhu(a)huawei.com<mailto:weixi.zhu@huawei.com> @fangchuang fangchuangchuang(a)huawei.com<mailto:fangchuangchuang@huawei.com> @SuperSix173 liuchao173(a)huawei.com<mailto:liuchao173@huawei.com> gazelle https://gitee.com/openeuler/gazelle 胡峰 @solarhu 陆志浩 @MrRlu 吴长冶 @ nlgwcy 郑杰兵@steganographer utsudo https://gitee.com/openeuler/utsudo https://gitee.com/src-openeuler/utsudo 王路军 @ut-wanglujun wanglujun(a)uniontech.com<mailto:wanglujun@uniontech.com> 曹佩庆@hustcao4 caopeiqing(a)uniontech.com<mailto:caopeiqing@uniontech.com> 宾凌宇@binlingyu binlingyu(a)uniontech.com<mailto:binlingyu@uniontech.com> 张欢欢 @luckhuanhuan zhanghuanhuan(a)uniontech.com<mailto:zhanghuanhuan@uniontech.com> 吕从庆 @HelloWorld_lvcongqing lvcongqing(a)uniontech.com<mailto:lvcongqing@uniontech.com> DDE桌面环境 .... 吕从庆 @HelloWorld_lvcongqing lvcongqing(a)uniontech.com<mailto:lvcongqing@uniontech.com> 杨晓旋 @ut-layne-yang yangxiaoxuan(a)uniontech.com<mailto:yangxiaoxuan@uniontech.com> 杨显钊 @ xzyangha yangxianzhao(a)uniontech.com<mailto:yangxianzhao@uniontech.com> 李伟刚 @open-bot liweigang(a)uniontech.com<mailto:liweigang@uniontech.com> kiran桌面环境 https://gitee.com/openeuler/kiran-authentication-devices 等石勇 @stonefly128 tangjie02(a)kylinsec.com.cn<mailto:tangjie02@kylinsec.com.cn> 吴伟 @wuwei_plct wuwei2016(a)iscas.ac.cn<mailto:wuwei2016@iscas.ac.cn> 唐杰 @tangjie02 tangjie02(a)kylinsec.com.cn<mailto:tangjie02@kylinsec.com.cn> 柳鑫浩 @liubuguiii liuxinghao(a)kylinsec.com.cn<mailto:liuxinghao@kylinsec.com.cn> 王逸樵 @eusteuc eusetuc(a)outlook.com<mailto:eusetuc@outlook.com> NestOS https://gitee.com/openeuler/NestOS 王麟 @wonleing wangl29(a)chinatelecom.cn<mailto:wangl29@chinatelecom.cn> 王利民 @wanglmb wanglimin(a)xfusion.com<mailto:wanglimin@xfusion.com> 刘昊 @duguhaotian liuhao27(a)huawei.com<mailto:liuhao27@huawei.com> 杜奕威 @duyiwei7w duyiwei(a)kylinos.cn<mailto:duyiwei@kylinos.cn> NestOS Kubernetes Deployer https://gitee.com/openeuler/nestos-kubernetes-deployer 候健 @hjimmy houjian(a)kylinos.cn<mailto:houjian@kylinos.cn> 王悦良 @wangyueliang wangyueliang(a)kylinos.cn<mailto:wangyueliang@kylinos.cn> 杨昭 @yangzhao_kl yangzhao1(a)kylinos.cn<mailto:yangzhao1@kylinos.cn> 杜奕威 @duyiwei7w duyiwei(a)kylinos.cn<mailto:duyiwei@kylinos.cn> PilotGo https://gitee.com/openeuler/PilotGo 杨昭 @yangzhao_kl yangzhao1(a)kylinos.cn<mailto:yangzhao1@kylinos.cn> 陆志浩 @MrRlu luzhihao(a)huawei.com<mailto:luzhihao@huawei.com> 罗盛玮 @Lostwayzxc luoshengwei(a)huawei.com<mailto:luoshengwei@huawei.com> 镜像文件级定制裁剪项目imageTailor https://gitee.com/openeuler/imageTailor 吴峰光 @wu_fengguang wufengguang(a)huawei.com<mailto:wufengguang@huawei.com> 王龙 @laoqinren wanglong19(a)meituan.com<mailto:wanglong19@meituan.com> 高立江 @qq_mud gaolijiang(a)chinapost.com.cn<mailto:gaolijiang@chinapost.com.cn> 朱春意 @zhuchunyi zhuchunyi(a)huawei.com<mailto:zhuchunyi@huawei.com> migration-tools https://gitee.com/openeuler/migration-tools<https://gitee.com/openeuler/NestOS> 吕从庆 @HelloWorld_lvcongqing lvcongqing(a)uniontech.com<mailto:lvcongqing@uniontech.com> 王磊 @wanglei-uos wangleic(a)uniontech.com<mailto:wangleic@uniontech.com> 李鑫 @F16lx lixin(a)uniontech.com<mailto:lixin@uniontech.com> 刘兴伟 @xingwei-liu liuxingwei(a)uniontech.com<mailto:liuxingwei@uniontech.com> CVE-ease https://gitee.com/openeuler/cve-ease 朱健伟 @zhujianwei001 zhujianwei7(a)huawei.com<mailto:zhujianwei7@huawei.com> 马威 @movie0125 mawei(a)uniontech.com<mailto:mawei@uniontech.com> 王麟 @wonleing wangl29(a)chinatelecom.cn<mailto:wangl29@chinatelecom.cn> 杜奕威 @duyiwei7w duyiwei(a)kylinos.cn<mailto:duyiwei@kylinos.cn> gala-ragdoll https://gitee.com/openeuler/gala-ragdoll.git 柳磊 @liulei 450962(a)qq.com<mailto:450962@qq.com> 李超峰 @李超峰0220(*无效gitee id) lichaofeng(a)cmos.chinamobile.com<mailto:lichaofeng@cmos.chinamobile.com> 杨彬 @byrobinsm binyangck(a)isoftstone.com<mailto:binyangck@isoftstone.com> 张道龙 @zhangdaolong dlzhangak(a)isoftstone.com<mailto:dlzhangak@isoftstone.com> CCPS https://gitee.com/openeuler/ccps 吕从庆 @HelloWorld_lvcongqing lvcongqing(a)uniontech.com<mailto:lvcongqing@uniontech.com> 王磊 @wanglei-uos wangleic(a)uniontech.com<mailto:wangleic@uniontech.com> 季宗耀 @orangeji11 jizongyao(a)uniontech.com<mailto:jizongyao@uniontech.com> 麦合木提·买买提 @mahmut mahmut(a)uniontech.com<mailto:mahmut@uniontech.com> GCC for openEuler https://gitee.com/openEuler/gcc 李彦成 @li-yancheng 黄晓权 @huang-xiaoquan 丁光亚 @dguangya 伍明川 @wumingchuan ZVM https://gitee.com/openeuler/zvm 任慰 @vonhust renwei41(a)huawei.com<mailto:renwei41@huawei.com> 方林旭 @fanglinxu fanglinxu(a)huawei.com<mailto:fanglinxu@huawei.com> 熊程来 @cocoeoli xiongcl(a)hnu.edu.cn<mailto:xiongcl@hnu.edu.cn> 谢国骐 @xie-guoqi xgqman(a)hnu.edu.cn<mailto:xgqman@hnu.edu.cn> 韩宗成 @hzc04 hanzongcheng(a)huawei.com<mailto:hanzongcheng@huawei.com> 罗永茂 @yongmao_luo luoyongmao(a)huawei.com<mailto:luoyongmao@huawei.com> 粱其锋 @emancipator liangqifeng(a)ncti-gba.cn<mailto:liangqifeng@ncti-gba.cn> 发件人: Huxinwei 发送时间: 2023年9月25日 10:26 收件人: tc(a)openeuler.org<mailto:tc@openeuler.org>; dev(a)openeuler.org<mailto:dev@openeuler.org>; kernel(a)openeuler.org<mailto:kernel@openeuler.org> 抄送: shinwell_hu(a)openeuler.sh<mailto:shinwell_hu@openeuler.sh>; Xiongwei (William, Euler) <xiongwei888(a)huawei.com<mailto:xiongwei888@huawei.com>> 主题: 启动 openEuler 2023 年度优秀项目推荐各位社区的开发者：经 openEuler技术委员会9月20日会议讨论，现正式启动 openEuler 2023年度优秀项目的评选，请各位社区开发者和参与者推荐。当前在评选标准和项目设置上的考虑，可以参见：oEEP (openeuler.org)<https://www.openeuler.org/zh/oEEP/?name=oEEP-0007%20openEuler%E4%BC%98%E7%A…> 。截止 2023 年 10 月 15 日（周日）为止，任意三名以上社区参与者联名，可以向 tc(a)openeuler.org<mailto:tc@openeuler.org> 推荐您认可的项目。推荐项目的邮件请在邮件主题中明确包含 “openEuler 2023 年度优秀项目推荐” 字样。推荐项目的邮件内容中，请明确联名推荐人的邮箱地址和相应的 gitee id，推荐的项目名称，项目代码仓位置，推荐获奖的方向。我将汇总所有推荐，在 10 月 18 日之前通过社区邮件列表公示。欢迎大家的参与和推荐 Regards openEuler Technical Committee

1 0

[PATCH OLK-5.10 0/6] Fixed five CVEs vulnerabilities of ksmbd
by ZhaoLong Wang 19 Oct '23

19 Oct '23

CVE-2023-32254 CVE-2023-32246 CVE-2023-32256 CVE-2023-32258 CVE-2023-2593 Marios Makassikis (2): ksmbd: send proper error response in smb2_tree_connect() ksmbd: do not call kvmalloc() with __GFP_NORETRY | __GFP_NO_WARN Namjae Jeon (4): ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix racy issue from smb2 close and logoff with multichannel ksmbd: fix infinite loop in ksmbd_conn_handler_loop() fs/ksmbd/connection.c | 56 +++++++++++++++++++++++++++--------- fs/ksmbd/connection.h | 19 ++++++++++-- fs/ksmbd/mgmt/tree_connect.c | 13 ++++++++- fs/ksmbd/mgmt/tree_connect.h | 3 ++ fs/ksmbd/mgmt/user_session.c | 36 +++++++++++++++++++---- fs/ksmbd/server.c | 1 + fs/ksmbd/smb2pdu.c | 31 +++++++++++--------- fs/ksmbd/transport_tcp.c | 5 +++- 8 files changed, 126 insertions(+), 38 deletions(-) -- 2.34.3

2 7

[PATCH openEuler-23.09] mm: gmem: Reture false if hnid is bigger than MAX_NUMNODES
by Wupeng Ma 19 Oct '23

19 Oct '23

From: Ma Wupeng <mawupeng1(a)huawei.com> euleros inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7WLVX --------------------------------------------- Reture false if hnid is bigger than MAX_NUMNODES. Fixes: 46a7894b5e4c ("mm: gmem: Introduce GMEM") Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- include/linux/gmem.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/include/linux/gmem.h b/include/linux/gmem.h index e198180b8085..1786f8676376 100644 --- a/include/linux/gmem.h +++ b/include/linux/gmem.h @@ -327,13 +327,14 @@ extern struct hnode *hnodes[]; static inline bool is_hnode(int node) { - return !node_isset(node, node_possible_map) - && node_isset(node, hnode_map); + return (node < MAX_NUMNODES) && !node_isset(node, node_possible_map) && + node_isset(node, hnode_map); } static inline bool is_hnode_allowed(int node) { - return is_hnode(node) && node_isset(node, current->mems_allowed); + return (node < MAX_NUMNODES) && is_hnode(node) && + node_isset(node, current->mems_allowed); } static inline struct hnode *get_hnode(unsigned int hnid) -- 2.25.1

2 1

[PATCH 1/1] mm: gmem: Reture false if hnid is bigger than MAX_NUMNODES
by Wupeng Ma 19 Oct '23

19 Oct '23

From: Ma Wupeng <mawupeng1(a)huawei.com> euleros inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7WLVX --------------------------------------------- Reture false if hnid is bigger than MAX_NUMNODES. Fixes: 46a7894b5e4c ("mm: gmem: Introduce GMEM") Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- include/linux/gmem.h | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/include/linux/gmem.h b/include/linux/gmem.h index e198180b8085..1786f8676376 100644 --- a/include/linux/gmem.h +++ b/include/linux/gmem.h @@ -327,13 +327,14 @@ extern struct hnode *hnodes[]; static inline bool is_hnode(int node) { - return !node_isset(node, node_possible_map) - && node_isset(node, hnode_map); + return (node < MAX_NUMNODES) && !node_isset(node, node_possible_map) && + node_isset(node, hnode_map); } static inline bool is_hnode_allowed(int node) { - return is_hnode(node) && node_isset(node, current->mems_allowed); + return (node < MAX_NUMNODES) && is_hnode(node) && + node_isset(node, current->mems_allowed); } static inline struct hnode *get_hnode(unsigned int hnid) -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS v2 0/2] Revert irq reentrant warm log
by Yipeng Zou 19 Oct '23

19 Oct '23

There is no need print this warm log since a95cc4dafae34(genirq: introduce handle_fasteoi_edge_irq flow handler) has been merged. Yipeng Zou (2): Revert "genirq: add printk safe in irq context" Revert "genirq: Introduce warn log when irq be reentrant" kernel/irq/chip.c | 14 -------------- 1 file changed, 14 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS 0/2] Revert irq reentrant warm log
by Yipeng Zou 19 Oct '23

19 Oct '23

There is no need print this warm log since a95cc4dafae34(genirq: introduce handle_fasteoi_edge_irq flow handler) has been merged. Yipeng Zou (2): Revert "genirq: add printk safe in irq context" Revert "genirq: Introduce warn log when irq be reentrant" kernel/irq/chip.c | 14 -------------- 1 file changed, 14 deletions(-) -- 2.34.1

2 3

[PATCH OLK-5.10] coresight: Fix loss of connection info when a module is unloaded
by Junhao He 18 Oct '23

18 Oct '23

From: James Clark <james.clark(a)arm.com> mainline inclusion from mainline-v6.4-rc1 commit c45b2835e7b205783bdfe08cc98fa86a7c5eeb74 category: Bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I85PIL CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- child_fwnode should be a read only property based on the DT or ACPI. If it's cleared on the parent device when a child is unloaded, then when the child is loaded again the connection won't be remade. child_dev should be cleared instead which signifies that the connection should be remade when the child_fwnode registers a new coresight_device. Similarly the reference count shouldn't be decremented as long as the parent device exists. The correct place to drop the reference is in coresight_release_platform_data() which is already done. Reproducible on Juno with the following steps: # load all coresight modules. $ cd /sys/bus/coresight/devices/ $ echo 1 > tmc_etr0/enable_sink $ echo 1 > etm0/enable_source # Works fine ^ $ echo 0 > etm0/enable_source $ rmmod coresight-funnel $ modprobe coresight-funnel $ echo 1 > etm0/enable_source -bash: echo: write error: Invalid argument Fixes: 37ea1ffddffa ("coresight: Use fwnode handle instead of device names") Fixes: 2af89ebacf29 ("coresight: Clear the connection field properly") Tested-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> Reviewed-by: Mike Leach <mike.leach(a)linaro.org> Signed-off-by: James Clark <james.clark(a)arm.com> Signed-off-by: Suzuki K Poulose <suzuki.poulose(a)arm.com> Link: https://lore.kernel.org/r/20230425143542.2305069-2-james.clark@arm.com Signed-off-by: Junhao He <hejunhao3(a)huawei.com> --- drivers/hwtracing/coresight/coresight-core.c | 9 ++------- 1 file changed, 2 insertions(+), 7 deletions(-) diff --git a/drivers/hwtracing/coresight/coresight-core.c b/drivers/hwtracing/coresight/coresight-core.c index ee7b5cfcf786..9696f402a328 100644 --- a/drivers/hwtracing/coresight/coresight-core.c +++ b/drivers/hwtracing/coresight/coresight-core.c @@ -1443,13 +1443,8 @@ static int coresight_remove_match(struct device *dev, void *data) if (csdev->dev.fwnode == conn->child_fwnode) { iterator->orphan = true; coresight_remove_links(iterator, conn); - /* - * Drop the reference to the handle for the remote - * device acquired in parsing the connections from - * platform data. - */ - fwnode_handle_put(conn->child_fwnode); - conn->child_fwnode = NULL; + + conn->child_dev = NULL; /* No need to continue */ break; } -- 2.33.0

2 1

[resend] openEuler 2023 年度优秀项目推荐结果公示
by Huxinwei 18 Oct '23

18 Oct '23

各位社区开发者，大家好：上午的结果公示，在大家帮助下，识别了之前因为各种原因漏了的项目推荐。截止当前，技术委员会已收到优秀项目推荐如下。感谢大家的参与，讨论评审预计在下周技术委员会例会上进行，如有其他意见，请在下周二17号之前邮件反馈给我。再次感谢大家的支持。项目名称项目代码仓推荐人 FangTian视窗引擎 https://gitee.com/openeuler/ft_engine https://gitee.com/openeuler/ft_mmi https://gitee.com/openeuler/arkui-linux https://gitee.com/openeuler/ft_flutter https://gitee.com/openeuler/ft_multimedia 华亚东 @hua_yadong huayadong(a)kylinos.cn<mailto:huayadong@kylinos.cn> 吴圣垚 @shen_hua_li shengyao(a)iscas.ac.cn<mailto:shengyao@iscas.ac.cn> 宋亚南 @yanansong songyanan5(a)huawei.com<mailto:songyanan5@huawei.com> 靳国恩 @abc12133 jinguoen(a)huawei.com<mailto:jinguoen@huawei.com> 冯绍波 @ShaoboFeng fengshaobo(a)huawei.com<mailto:fengshaobo@huawei.com> 郑森文 @zhengsenwen senwen(a)iscas.ac.cn<mailto:senwen@iscas.ac.cn> 张子豪 @MouseZhang mousezhang(a)openkylin.top 黄钰馨 @huangyuxin2023 huangyuxin(a)isrc.iscas.ac.cn<mailto:huangyuxin@isrc.iscas.ac.cn> 蒋文宇 @jiangwenyu1 jiangwenyu1(a)huawei.com<mailto:jiangwenyu1@huawei.com> sysMaster https://gitee.com/openeuler/sysmaster 熊伟 @myeuler 何晓文@overweight 胡世元 @love_hangzhou A-Tune https://gitee.com/openeuler/A-Tune 王建民 @jianminw jianmin(a)iscas.ac.cn<mailto:jianmin@iscas.ac.cn> 李次华 @Monday licihua(a)huawei.com<mailto:licihua@huawei.com> 谢志鹏 @xiezhipeng1 xiezhipeng1(a)huawei.com<mailto:xiezhipeng1@huawei.com> A-OPS https://gitee.com/openeuler/A-Ops https://gitee.com/openeuler/aops-apollo https://gitee.com/openeuler/aops-diana https://gitee.com/openeuler/aops-zeus https://gitee.com/openeuler/gala-gopher https://gitee.com/openeuler/gala-spider https://gitee.com/openeuler/gala-anteater https://gitee.com/openeuler/gala-ragdoll https://gitee.com/openeuler/syscare https://gitee.com/openeuler/X-diagnosis 胡峰 @solarhu 罗盛炜 @Lostwayzxc 杨昭 @yangzhao_kl StratoVirt https://gitee.com/openeuler/stratovirt 王志钢 @cellfaint wangzhigang17(a)huawei.com<mailto:wangzhigang17@huawei.com> 朱科潜 @kevinzhu1 zhukeqian1(a)huawei.com<mailto:zhukeqian1@huawei.com> 汤中睿 @tzr tangzhongrui(a)cmss.chinamobile.com<mailto:tangzhongrui@cmss.chinamobile.com> secGear https://gitee.com/openeuler/secGear 朱健伟 @zhujianwei001 zhujianwei7(a)huawei.com<mailto:zhujianwei7@huawei.com> 刘忻 @ICC-NSG xinl(a)lzu.edu.cn<mailto:xinl@lzu.edu.cn> 杜东 @dongduResearcher dd_nirvana(a)sjtu.edu.cn<mailto:dd_nirvana@sjtu.edu.cn> 侯明永 @houmingyong houmingyong(a)huawei.com<mailto:houmingyong@huawei.com> PINC (PlugIN framework for Compiler) https://gitee.com/openEuler/pin-gcc-clienthttps://gitee.com/openeuler/pin-s…<https://gitee.com/openEuler/pin-gcc-clienthttps:/gitee.com/openeuler/pin-se…> 李彦成@li-yancheng 黄晓权@huang-xiaoquan 丁光亚@dguangya 伍明川@wumingchuan iSulad https://gitee.com/openeuler/iSulad https://gitee.com/openeuler/lcro https://gitee.com/openeuler/clibcni 蔡灏旻 @caihaomin 魏宝辉 @weibaohui Apache Bigtop支持openEuler OS https://github.com/apache/bigtop/tree/openEuler-support 熊伟 @myeuler 郑振宇 @ZhengZhenyu zhengzhenyu(a)huawei.com<mailto:zhengzhenyu@huawei.com> 蒋健源 @jenkins-jiang jiangjianyuan(a)huawei.com<mailto:jiangjianyuan@huawei.com> 杨昭 @yangzhao_kl yangzhao1(a)kylinos.cn<mailto:yangzhao1@kylinos.cn> 温伟健 @wenwj0 wenweijian2(a)huawei.com<mailto:wenweijian2@huawei.com> 陈强 @macchen1 mac.chenqiang(a)huawei.com<mailto:mac.chenqiang@huawei.com> sysboost https://gitee.com/openeuler/sysboost @liu-yuntao-10 liuyuntao10(a)huawei.com<mailto:liuyuntao10@huawei.com> @softkiller zhoukang7(a)huawei.com<mailto:zhoukang7@huawei.com> @pan-y182 yangpan51(a)huawei.com<mailto:yangpan51@huawei.com> openEuler Kernel https://gitee.com/openeuler/kernel https://gitee.com/src-openeuler/kernel 谢秀奇 @xiexiuqi xiexiuqi(a)huawei.com<mailto:xiexiuqi@huawei.com> 桑力鹏 @sanglipeng sanglipeng1(a)jd.com<mailto:sanglipeng1@jd.com> 曾昭荣 @x56Jason jason.zeng(a)intel.com<mailto:jason.zeng@intel.com> 孔新伟 @kongzizaixian kong.kongxinwei(a)hisilicon.com<mailto:kong.kongxinwei@hisilicon.com> 刘恺 @kailiu42 kai.liu(a)xfusion.com<mailto:kai.liu@xfusion.com> GMEM（Generalized Memory Management） https://gitee.com/openeuler/kernel/tree/openEuler-23.09/ 主要代码文件： include/linux/gmem.h include/linux/gmem_as.h include/linux/vm_object.h mm/gmem.c mm/vm_object.c mm/huge_memory.c mm/memory.c mm/mmap.c drivers/remote_pager/ @xiexiuqi xiexiuqi(a)huawei.com<mailto:xiexiuqi@huawei.com> @weixizhu94 weixi.zhu(a)huawei.com<mailto:weixi.zhu@huawei.com> @fangchuang fangchuangchuang(a)huawei.com<mailto:fangchuangchuang@huawei.com> @SuperSix173 liuchao173(a)huawei.com<mailto:liuchao173@huawei.com> gazelle https://gitee.com/openeuler/gazelle 胡峰 @solarhu 陆志浩 @MrRlu 吴长冶 @ nlgwcy 郑杰兵@steganographer utsudo https://gitee.com/openeuler/utsudo https://gitee.com/src-openeuler/utsudo 王路军 @ut-wanglujun wanglujun(a)uniontech.com<mailto:wanglujun@uniontech.com> 曹佩庆@hustcao4 caopeiqing(a)uniontech.com<mailto:caopeiqing@uniontech.com> 宾凌宇@binlingyu binlingyu(a)uniontech.com<mailto:binlingyu@uniontech.com> 张欢欢 @luckhuanhuan zhanghuanhuan(a)uniontech.com<mailto:zhanghuanhuan@uniontech.com> 吕从庆 @HelloWorld_lvcongqing lvcongqing(a)uniontech.com<mailto:lvcongqing@uniontech.com> DDE桌面环境 .... 吕从庆 @HelloWorld_lvcongqing lvcongqing(a)uniontech.com<mailto:lvcongqing@uniontech.com> 杨晓旋 @ut-layne-yang yangxiaoxuan(a)uniontech.com<mailto:yangxiaoxuan@uniontech.com> 杨显钊 @ xzyangha yangxianzhao(a)uniontech.com<mailto:yangxianzhao@uniontech.com> 李伟刚 @open-bot liweigang(a)uniontech.com<mailto:liweigang@uniontech.com> kiran桌面环境 https://gitee.com/openeuler/kiran-authentication-devices 等石勇 @stonefly128 tangjie02(a)kylinsec.com.cn<mailto:tangjie02@kylinsec.com.cn> 吴伟 @wuwei_plct wuwei2016(a)iscas.ac.cn<mailto:wuwei2016@iscas.ac.cn> 唐杰 @tangjie02 tangjie02(a)kylinsec.com.cn<mailto:tangjie02@kylinsec.com.cn> 柳鑫浩 @liubuguiii liuxinghao(a)kylinsec.com.cn<mailto:liuxinghao@kylinsec.com.cn> 王逸樵 @eusteuc eusetuc(a)outlook.com<mailto:eusetuc@outlook.com> NestOS https://gitee.com/openeuler/NestOS 王麟 @wonleing wangl29(a)chinatelecom.cn<mailto:wangl29@chinatelecom.cn> 王利民 @wanglmb wanglimin(a)xfusion.com<mailto:wanglimin@xfusion.com> 刘昊 @duguhaotian liuhao27(a)huawei.com<mailto:liuhao27@huawei.com> 杜奕威 @duyiwei7w duyiwei(a)kylinos.cn<mailto:duyiwei@kylinos.cn> NestOS Kubernetes Deployer https://gitee.com/openeuler/nestos-kubernetes-deployer 候健 @hjimmy houjian(a)kylinos.cn<mailto:houjian@kylinos.cn> 王悦良 @wangyueliang wangyueliang(a)kylinos.cn<mailto:wangyueliang@kylinos.cn> 杨昭 @yangzhao_kl yangzhao1(a)kylinos.cn<mailto:yangzhao1@kylinos.cn> 杜奕威 @duyiwei7w duyiwei(a)kylinos.cn<mailto:duyiwei@kylinos.cn> PilotGo https://gitee.com/openeuler/PilotGo 杨昭 @yangzhao_kl yangzhao1(a)kylinos.cn<mailto:yangzhao1@kylinos.cn> 陆志浩 @MrRlu luzhihao(a)huawei.com<mailto:luzhihao@huawei.com> 罗盛玮 @Lostwayzxc luoshengwei(a)huawei.com<mailto:luoshengwei@huawei.com> 镜像文件级定制裁剪项目imageTailor https://gitee.com/openeuler/imageTailor 吴峰光 @wu_fengguang wufengguang(a)huawei.com<mailto:wufengguang@huawei.com> 王龙 @laoqinren wanglong19(a)meituan.com<mailto:wanglong19@meituan.com> 高立江 @qq_mud gaolijiang(a)chinapost.com.cn<mailto:gaolijiang@chinapost.com.cn> 朱春意 @zhuchunyi zhuchunyi(a)huawei.com<mailto:zhuchunyi@huawei.com> migration-tools https://gitee.com/openeuler/migration-tools<https://gitee.com/openeuler/NestOS> 吕从庆 @HelloWorld_lvcongqing lvcongqing(a)uniontech.com<mailto:lvcongqing@uniontech.com> 王磊 @wanglei-uos wangleic(a)uniontech.com<mailto:wangleic@uniontech.com> 李鑫 @F16lx lixin(a)uniontech.com<mailto:lixin@uniontech.com> 刘兴伟 @xingwei-liu liuxingwei(a)uniontech.com<mailto:liuxingwei@uniontech.com> CVE-ease https://gitee.com/openeuler/cve-ease 朱健伟 @zhujianwei001 zhujianwei7(a)huawei.com<mailto:zhujianwei7@huawei.com> 马威 @movie0125 mawei(a)uniontech.com<mailto:mawei@uniontech.com> 王麟 @wonleing wangl29(a)chinatelecom.cn<mailto:wangl29@chinatelecom.cn> 杜奕威 @duyiwei7w duyiwei(a)kylinos.cn<mailto:duyiwei@kylinos.cn> gala-ragdoll https://gitee.com/openeuler/gala-ragdoll.git 柳磊 @liulei 450962(a)qq.com<mailto:450962@qq.com> 李超峰 @李超峰0220(*无效gitee id) lichaofeng(a)cmos.chinamobile.com<mailto:lichaofeng@cmos.chinamobile.com> 杨彬 @byrobinsm binyangck(a)isoftstone.com<mailto:binyangck@isoftstone.com> 张道龙 @zhangdaolong dlzhangak(a)isoftstone.com<mailto:dlzhangak@isoftstone.com> CCPS https://gitee.com/openeuler/ccps 吕从庆 @HelloWorld_lvcongqing lvcongqing(a)uniontech.com<mailto:lvcongqing@uniontech.com> 王磊 @wanglei-uos wangleic(a)uniontech.com<mailto:wangleic@uniontech.com> 季宗耀 @orangeji11 jizongyao(a)uniontech.com<mailto:jizongyao@uniontech.com> 麦合木提·买买提 @mahmut mahmut(a)uniontech.com<mailto:mahmut@uniontech.com> GCC for openEuler https://gitee.com/openEuler/gcc 李彦成 @li-yancheng 黄晓权 @huang-xiaoquan 丁光亚 @dguangya 伍明川 @wumingchuan ZVM https://gitee.com/openeuler/zvm 任慰 @vonhust renwei41(a)huawei.com<mailto:renwei41@huawei.com> 方林旭 @fanglinxu fanglinxu(a)huawei.com<mailto:fanglinxu@huawei.com> 熊程来 @cocoeoli xiongcl(a)hnu.edu.cn<mailto:xiongcl@hnu.edu.cn> 谢国骐 @xie-guoqi xgqman(a)hnu.edu.cn<mailto:xgqman@hnu.edu.cn> 韩宗成 @hzc04 hanzongcheng(a)huawei.com<mailto:hanzongcheng@huawei.com> 罗永茂 @yongmao_luo luoyongmao(a)huawei.com<mailto:luoyongmao@huawei.com> 粱其锋 @emancipator liangqifeng(a)ncti-gba.cn<mailto:liangqifeng@ncti-gba.cn> 发件人: Huxinwei 发送时间: 2023年9月25日 10:26 收件人: tc(a)openeuler.org; dev(a)openeuler.org; kernel(a)openeuler.org 抄送: shinwell_hu(a)openeuler.sh; Xiongwei (William, Euler) <xiongwei888(a)huawei.com> 主题: 启动 openEuler 2023 年度优秀项目推荐各位社区的开发者：经 openEuler技术委员会9月20日会议讨论，现正式启动 openEuler 2023年度优秀项目的评选，请各位社区开发者和参与者推荐。当前在评选标准和项目设置上的考虑，可以参见：oEEP (openeuler.org)<https://www.openeuler.org/zh/oEEP/?name=oEEP-0007%20openEuler%E4%BC%98%E7%A…> 。截止 2023 年 10 月 15 日（周日）为止，任意三名以上社区参与者联名，可以向 tc(a)openeuler.org<mailto:tc@openeuler.org> 推荐您认可的项目。推荐项目的邮件请在邮件主题中明确包含 “openEuler 2023 年度优秀项目推荐” 字样。推荐项目的邮件内容中，请明确联名推荐人的邮箱地址和相应的 gitee id，推荐的项目名称，项目代码仓位置，推荐获奖的方向。我将汇总所有推荐，在 10 月 18 日之前通过社区邮件列表公示。欢迎大家的参与和推荐 Regards openEuler Technical Committee

1 0

[PATCH OLK-5.10 v2 0/3] fix cgroup poll UAF
by Lu Jialin 18 Oct '23

18 Oct '23

Arnd Bergmann (1): kernfs: add stub helper for kernfs_generic_poll() Randy Dunlap (1): sched/psi: Select KERNFS as needed Suren Baghdasaryan (1): sched/psi: use kernfs polling functions for PSI trigger polling include/linux/kernfs.h | 4 ++++ include/linux/psi.h | 5 +++-- include/linux/psi_types.h | 3 +++ init/Kconfig | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/sched/psi.c | 29 +++++++++++++++++++++-------- 6 files changed, 33 insertions(+), 11 deletions(-) -- 2.34.1

2 4

[PATCH openEuler-1.0-LTS v2] x86/microcode/AMD: Make stub function static inline
by liwei 18 Oct '23

18 Oct '23

From: Valdis Klētnieks <valdis.kletnieks(a)vt.edu> mainline inclusion from mainline-v5.6-rc1 commit 82c881b28aa89215a760e39c5f6bcde2d6ce4918 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I88UBD?from=project-issue CVE: NA -------------------------------- When building with C=1 W=1 (and when CONFIG_MICROCODE_AMD=n, as Luc Van Oostenryck correctly points out) both sparse and gcc complain: CHECK arch/x86/kernel/cpu/microcode/core.c ./arch/x86/include/asm/microcode_amd.h:56:6: warning: symbol \ 'reload_ucode_amd' was not declared. Should it be static? CC arch/x86/kernel/cpu/microcode/core.o In file included from arch/x86/kernel/cpu/microcode/core.c:36: ./arch/x86/include/asm/microcode_amd.h:56:6: warning: no previous \ prototype for 'reload_ucode_amd' [-Wmissing-prototypes] 56 | void reload_ucode_amd(void) {} | ^~~~~~~~~~~~~~~~ And they're right - that function can be a static inline like its brethren. Signed-off-by: Valdis Klētnieks <valdis.kletnieks(a)vt.edu> Signed-off-by: Borislav Petkov <bp(a)suse.de> Cc: Luc Van Oostenryck <luc.vanoostenryck(a)gmail.com> Cc: x86(a)kernel.org Link: https://lkml.kernel.org/r/52170.1575603873@turing-police Conflicts: arch/x86/include/asm/microcode_amd.h Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/x86/include/asm/microcode_amd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/include/asm/microcode_amd.h b/arch/x86/include/asm/microcode_amd.h index bdecac3ae8c3..b56a1c0d5f60 100644 --- a/arch/x86/include/asm/microcode_amd.h +++ b/arch/x86/include/asm/microcode_amd.h @@ -54,7 +54,7 @@ static inline void __init load_ucode_amd_bsp(unsigned int family) {} static inline void load_ucode_amd_ap(unsigned int family) {} static inline int __init save_microcode_in_initrd_amd(unsigned int family) { return -EINVAL; } -void reload_ucode_amd(void) {} +static inline void reload_ucode_amd(void) {} static inline void amd_check_microcode(void) {} #endif #endif /* _ASM_X86_MICROCODE_AMD_H */ -- 2.25.1

2 1

[PATCH OLK-5.10 0/3] fix poll UAF
by Lu Jialin 18 Oct '23

18 Oct '23

Arnd Bergmann (1): kernfs: add stub helper for kernfs_generic_poll() Randy Dunlap (1): sched/psi: Select KERNFS as needed Suren Baghdasaryan (1): sched/psi: use kernfs polling functions for PSI trigger polling include/linux/kernfs.h | 4 ++++ include/linux/psi.h | 5 +++-- include/linux/psi_types.h | 3 +++ init/Kconfig | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/sched/psi.c | 27 ++++++++++++++++++++------- 6 files changed, 32 insertions(+), 10 deletions(-) -- 2.34.1

2 5

[PATCH] x86/microcode/AMD: Make stub function static inline
by liwei 18 Oct '23

18 Oct '23

From: Valdis Klētnieks <valdis.kletnieks(a)vt.edu> When building with C=1 W=1 (and when CONFIG_MICROCODE_AMD=n, as Luc Van Oostenryck correctly points out) both sparse and gcc complain: CHECK arch/x86/kernel/cpu/microcode/core.c ./arch/x86/include/asm/microcode_amd.h:56:6: warning: symbol \ 'reload_ucode_amd' was not declared. Should it be static? CC arch/x86/kernel/cpu/microcode/core.o In file included from arch/x86/kernel/cpu/microcode/core.c:36: ./arch/x86/include/asm/microcode_amd.h:56:6: warning: no previous \ prototype for 'reload_ucode_amd' [-Wmissing-prototypes] 56 | void reload_ucode_amd(void) {} | ^~~~~~~~~~~~~~~~ And they're right - that function can be a static inline like its brethren. Signed-off-by: Valdis Klētnieks <valdis.kletnieks(a)vt.edu> Signed-off-by: Borislav Petkov <bp(a)suse.de> Cc: Luc Van Oostenryck <luc.vanoostenryck(a)gmail.com> Cc: x86(a)kernel.org Link: https://lkml.kernel.org/r/52170.1575603873@turing-police --- arch/x86/include/asm/microcode_amd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/include/asm/microcode_amd.h b/arch/x86/include/asm/microcode_amd.h index 209492849566..6685e1218959 100644 --- a/arch/x86/include/asm/microcode_amd.h +++ b/arch/x86/include/asm/microcode_amd.h @@ -53,6 +53,6 @@ static inline void __init load_ucode_amd_bsp(unsigned int family) {} static inline void load_ucode_amd_ap(unsigned int family) {} static inline int __init save_microcode_in_initrd_amd(unsigned int family) { return -EINVAL; } -void reload_ucode_amd(void) {} +static inline void reload_ucode_amd(void) {} #endif #endif /* _ASM_X86_MICROCODE_AMD_H */ -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] perf/core: Fix reentry problem in perf_output_read_group()
by Yang Jihong 18 Oct '23

18 Oct '23

mainline inclusion from mainline-v6.0-rc2 commit 6b959ba22d34ca793ffdb15b5715457c78e38b1a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I88WX3 CVE: NA -------------------------------- perf_output_read_group may respond to IPI request of other cores and invoke __perf_install_in_context function. As a result, hwc configuration is modified. causing inconsistency and unexpected consequences. Interrupts are not disabled when perf_output_read_group reads PMU counter. In this case, IPI request may be received from other cores. As a result, PMU configuration is modified and an error occurs when reading PMU counter: CPU0 CPU1 __se_sys_perf_event_open perf_install_in_context perf_output_read_group smp_call_function_single for_each_sibling_event(sub, leader) { generic_exec_single if ((sub != event) && remote_function (sub->state == PERF_EVENT_STATE_ACTIVE)) | <enter IPI handler: __perf_install_in_context> <----RAISE IPI-----+ __perf_install_in_context ctx_resched event_sched_out armpmu_del ... hwc->idx = -1; // event->hwc.idx is set to -1 ... <exit IPI> sub->pmu->read(sub); armpmu_read armv8pmu_read_counter armv8pmu_read_hw_counter int idx = event->hw.idx; // idx = -1 u64 val = armv8pmu_read_evcntr(idx); u32 counter = ARMV8_IDX_TO_COUNTER(idx); // invalid counter = 30 read_pmevcntrn(counter) // undefined instruction Signed-off-by: Yang Jihong <yangjihong1(a)huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Link: https://lkml.kernel.org/r/20220902082918.179248-1-yangjihong1@huawei.com Signed-off-by: Yang Jihong <yangjihong1(a)huawei.com> --- kernel/events/core.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/kernel/events/core.c b/kernel/events/core.c index b1e4beb6931c..b7da090569ed 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -6208,9 +6208,16 @@ static void perf_output_read_group(struct perf_output_handle *handle, { struct perf_event *leader = event->group_leader, *sub; u64 read_format = event->attr.read_format; + unsigned long flags; u64 values[5]; int n = 0; + /* + * Disabling interrupts avoids all counter scheduling + * (context switches, timer based rotation and IPIs). + */ + local_irq_save(flags); + values[n++] = 1 + leader->nr_siblings; if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) @@ -6242,6 +6249,8 @@ static void perf_output_read_group(struct perf_output_handle *handle, __output_copy(handle, values, n * sizeof(u64)); } + + local_irq_restore(flags); } #define PERF_FORMAT_TOTAL_TIMES (PERF_FORMAT_TOTAL_TIME_ENABLED|\ -- 2.34.1

2 1

[PATCH OLK-5.10 0/3] fix poll UAF
by Lu Jialin 18 Oct '23

18 Oct '23

Arnd Bergmann (1): kernfs: add stub helper for kernfs_generic_poll() Randy Dunlap (1): sched/psi: Select KERNFS as needed Suren Baghdasaryan (1): sched/psi: use kernfs polling functions for PSI trigger polling include/linux/kernfs.h | 4 ++++ include/linux/psi.h | 5 +++-- include/linux/psi_types.h | 3 +++ init/Kconfig | 1 + kernel/cgroup/cgroup.c | 2 +- kernel/sched/psi.c | 27 ++++++++++++++++++++------- 6 files changed, 32 insertions(+), 10 deletions(-) -- 2.34.1

2 5

[PATCH openEuler-1.0-LTS] x86/microcode/AMD: Fix compile fail
by liwei 18 Oct '23

18 Oct '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I88UBD?from=project-issue CVE: NA ---------------------------------- When CONFIG_MICROCODE_AMD is not defined, the reload_ucode_amd function is implemented by multiple files in the header file. As a result, multiple definition of reload_ucode_amd. Fix this error. Fixes: 0eeacafff0a7 ("x86/cpu/amd: Add a Zenbleed fix") Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/x86/include/asm/microcode_amd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/include/asm/microcode_amd.h b/arch/x86/include/asm/microcode_amd.h index bdecac3ae8c3..b56a1c0d5f60 100644 --- a/arch/x86/include/asm/microcode_amd.h +++ b/arch/x86/include/asm/microcode_amd.h @@ -54,7 +54,7 @@ static inline void __init load_ucode_amd_bsp(unsigned int family) {} static inline void load_ucode_amd_ap(unsigned int family) {} static inline int __init save_microcode_in_initrd_amd(unsigned int family) { return -EINVAL; } -void reload_ucode_amd(void) {} +static inline void reload_ucode_amd(void) {} static inline void amd_check_microcode(void) {} #endif #endif /* _ASM_X86_MICROCODE_AMD_H */ -- 2.25.1

2 1

openEuler 2023 年度优秀项目推荐结果公示
by Huxinwei 18 Oct '23

18 Oct '23

各位社区开发者，大家好：技术委员会目前已收到优秀项目推荐如下。感谢大家的参与，讨论评审预计在下周技术委员会例会上进行，如有其他意见，请在下周二17号之前邮件反馈给我。谢谢项目名称项目代码仓推荐人 FangTian视窗引擎 https://gitee.com/openeuler/ft_engine https://gitee.com/openeuler/ft_mmi https://gitee.com/openeuler/arkui-linux https://gitee.com/openeuler/ft_flutter https://gitee.com/openeuler/ft_multimedia 华亚东 huayadong(a)kylinos.cn<mailto:huayadong@kylinos.cn> @hua_yadong 吴圣垚 shengyao(a)iscas.ac.cn<mailto:shengyao@iscas.ac.cn> @shen_hua_li 宋亚南 songyanan5(a)huawei.com<mailto:songyanan5@huawei.com> @yanansong 靳国恩 jinguoen(a)huawei.com<mailto:jinguoen@huawei.com> @abc12133 冯绍波 fengshaobo(a)huawei.com<mailto:fengshaobo@huawei.com> @ShaoboFeng 郑森文 senwen(a)iscas.ac.cn<mailto:senwen@iscas.ac.cn> @zhengsenwen 张子豪 mousezhang(a)openkylin.top @MouseZhang 黄钰馨 huangyuxin(a)isrc.iscas.ac.cn<mailto:huangyuxin@isrc.iscas.ac.cn> @huangyuxin2023 蒋文宇 jiangwenyu1(a)huawei.com<mailto:jiangwenyu1@huawei.com> @jiangwenyu1 sysMaster https://gitee.com/openeuler/sysmaster 熊伟 @myeuler 何晓文@overweight 胡世元 @love_hangzhou A-Tune https://gitee.com/openeuler/A-Tune 王建民 @jianminw jianmin(a)iscas.ac.cn<mailto:jianmin@iscas.ac.cn> 李次华 @Monday licihua(a)huawei.com<mailto:licihua@huawei.com> 谢志鹏 @xiezhipeng1 xiezhipeng1(a)huawei.com<mailto:xiezhipeng1@huawei.com> A-OPS https://gitee.com/openeuler/A-Ops https://gitee.com/openeuler/aops-apollo https://gitee.com/openeuler/aops-diana https://gitee.com/openeuler/aops-zeus https://gitee.com/openeuler/gala-gopher https://gitee.com/openeuler/gala-spider https://gitee.com/openeuler/gala-anteater https://gitee.com/openeuler/gala-ragdoll https://gitee.com/openeuler/syscare https://gitee.com/openeuler/X-diagnosis 胡峰 @solarhu 罗盛炜 @Lostwayzxc 杨昭 @yangzhao_kl StratoVirt https://gitee.com/openeuler/stratovirt 王志钢 @cellfaint wangzhigang17(a)huawei.com<mailto:wangzhigang17@huawei.com> 朱科潜 @kevinzhu1 zhukeqian1(a)huawei.com<mailto:zhukeqian1@huawei.com> 汤中睿 @tzr tangzhongrui(a)cmss.chinamobile.com<mailto:tangzhongrui@cmss.chinamobile.com> secGear https://gitee.com/openeuler/secGear 朱健伟 @zhujianwei001 zhujianwei7(a)huawei.com<mailto:zhujianwei7@huawei.com> 刘忻 @ICC-NSG xinl(a)lzu.edu.cn<mailto:xinl@lzu.edu.cn> 杜东 @dongduResearcher dd_nirvana(a)sjtu.edu.cn<mailto:dd_nirvana@sjtu.edu.cn> 侯明永 @houmingyong houmingyong(a)huawei.com<mailto:houmingyong@huawei.com> PINC (PlugIN framework for Compiler) https://gitee.com/openEuler/pin-gcc-client https://gitee.com/openeuler/pin-server<https://gitee.com/openEuler/pin-gcc-client%0bhttps:/gitee.com/openeuler/pin…> 李彦成@li-yancheng 黄晓权@huang-xiaoquan 丁光亚@dguangya 伍明川@wumingchuan iSulad https://gitee.com/openeuler/iSulad https://gitee.com/openeuler/lcro https://gitee.com/openeuler/clibcni 蔡灏旻 @caihaomin 魏宝辉 @weibaohui Apache Bigtop支持openEuler OS https://github.com/apache/bigtop/tree/openEuler-support 熊伟 @myeuler 郑振宇 @ZhengZhenyu zhengzhenyu(a)huawei.com<mailto:zhengzhenyu@huawei.com> 蒋健源 @jenkins-jiang jiangjianyuan(a)huawei.com<mailto:jiangjianyuan@huawei.com> 杨昭 @yangzhao_kl yangzhao1(a)kylinos.cn<mailto:yangzhao1@kylinos.cn> 温伟健 @wenwj0 wenweijian2(a)huawei.com<mailto:wenweijian2@huawei.com> 陈强 @macchen1 mac.chenqiang(a)huawei.com<mailto:mac.chenqiang@huawei.com> sysboost https://gitee.com/openeuler/sysboost @liu-yuntao-10 liuyuntao10(a)huawei.com<mailto:liuyuntao10@huawei.com> @softkiller zhoukang7(a)huawei.com<mailto:zhoukang7@huawei.com> @pan-y182 yangpan51(a)huawei.com<mailto:yangpan51@huawei.com> openEuler Kernel https://gitee.com/openeuler/kernel 谢秀奇 xiexiuqi(a)huawei.com<mailto:xiexiuqi@huawei.com> @xiexiuqi 桑力鹏 sanglipeng1(a)jd.com<mailto:sanglipeng1@jd.com> @sanglipeng 曾昭荣 jason.zeng(a)intel.com<mailto:jason.zeng@intel.com> @x56Jason 孔新伟 kong.kongxinwei(a)hisilicon.com<mailto:kong.kongxinwei@hisilicon.com> @kongzizaixian 刘恺 kai.liu(a)xfusion.com<mailto:kai.liu@xfusion.com> @kailiu42 GMEM（Generalized Memory Management） https://gitee.com/openeuler/kernel/tree/openEuler-23.09/ 主要代码文件： include/linux/gmem.h include/linux/gmem_as.h include/linux/vm_object.h mm/gmem.c mm/vm_object.c mm/huge_memory.c mm/memory.c mm/mmap.c drivers/remote_pager/ @xiexiuqi xiexiuqi(a)huawei.com<mailto:xiexiuqi@huawei.com> @weixizhu94 weixi.zhu(a)huawei.com<mailto:weixi.zhu@huawei.com> @fangchuang fangchuangchuang(a)huawei.com<mailto:fangchuangchuang@huawei.com> @SuperSix173 liuchao173(a)huawei.com<mailto:liuchao173@huawei.com> gazelle https://gitee.com/openeuler/gazelle 胡峰 @solarhu 陆志浩 @MrRlu 吴长冶 @ nlgwcy 郑杰兵@steganographer utsudo https://gitee.com/openeuler/utsudo 王路军 wanglujun(a)uniontech.com<mailto:wanglujun@uniontech.com> @ut-wanglujun 曹佩庆 caopeiqing(a)uniontech.com<mailto:caopeiqing@uniontech.com> @hustcao4 宾凌宇 binlingyu(a)uniontech.com<mailto:binlingyu@uniontech.com> @binlingyu 张欢欢zhanghuanhuan(a)uniontech.com<mailto:zhanghuanhuan@uniontech.com> @luckhuanhuan 吕从庆 lvcongqing(a)uniontech.com<mailto:lvcongqing@uniontech.com> @HelloWorld_lvcongqing DDE桌面环境 src-openeuler 代码仓，数量较多，不在此列举吕从庆 lvcongqing(a)uniontech.com<mailto:lvcongqing@uniontech.com> @HelloWorld_lvcongqing 杨晓旋 yangxiaoxuan(a)uniontech.com<mailto:yangxiaoxuan@uniontech.com> @ut-layne-yang 杨显钊 yangxianzhao(a)uniontech.com<mailto:yangxianzhao@uniontech.com> @ xzyangha 李伟刚 liweigang(a)uniontech.com<mailto:liweigang@uniontech.com> @open-bot kiran桌面环境 https://gitee.com/openeuler/kiran-authentication-devices 等石勇 tangjie02(a)kylinsec.com.cn<mailto:tangjie02@kylinsec.com.cn> @stonefly128 吴伟 wuwei2016(a)iscas.ac.cn<mailto:wuwei2016@iscas.ac.cn> @wuwei_plct 唐杰 tangjie02(a)kylinsec.com.cn<mailto:tangjie02@kylinsec.com.cn> @tangjie02 柳鑫浩 liuxinghao(a)kylinsec.com.cn<mailto:liuxinghao@kylinsec.com.cn> @liubuguiii 王逸樵 eusetuc(a)outlook.com<mailto:eusetuc@outlook.com> @eusteuc NestOS https://gitee.com/openeuler/NestOS 王麟 wangl29(a)chinatelecom.cn<mailto:wangl29@chinatelecom.cn> @wonleing 王利民 wanglimin(a)xfusion.com<mailto:wanglimin@xfusion.com> @wanglmb 刘昊 liuhao27(a)huawei.com<mailto:liuhao27@huawei.com> @duguhaotian 杜奕威 duyiwei(a)kylinos.cn<mailto:duyiwei@kylinos.cn> @duyiwei7w NestOS Kubernetes Deployer https://gitee.com/openeuler/nestos-kubernetes-deployer 候健 houjian(a)kylinos.cn<mailto:houjian@kylinos.cn> @hjimmy 王悦良 wangyueliang(a)kylinos.cn<mailto:wangyueliang@kylinos.cn> @wangyueliang 杨昭 yangzhao1(a)kylinos.cn<mailto:yangzhao1@kylinos.cn> @yangzhao_kl 杜奕威 duyiwei(a)kylinos.cn<mailto:duyiwei@kylinos.cn> @duyiwei7w PilotGo https://gitee.com/openeuler/PilotGo 杨昭 yangzhao1(a)kylinos.cn<mailto:yangzhao1@kylinos.cn> @yangzhao_kl 陆志浩 luzhihao(a)huawei.com<mailto:luzhihao@huawei.com> @MrRlu 罗盛玮luoshengwei(a)huawei.com<mailto:luoshengwei@huawei.com> @Lostwayzxc 发件人: Huxinwei 发送时间: 2023年9月25日 10:26 收件人: tc(a)openeuler.org; dev(a)openeuler.org; kernel(a)openeuler.org 抄送: shinwell_hu(a)openeuler.sh; Xiongwei (William, Euler) <xiongwei888(a)huawei.com> 主题: 启动 openEuler 2023 年度优秀项目推荐各位社区的开发者：经 openEuler技术委员会9月20日会议讨论，现正式启动 openEuler 2023年度优秀项目的评选，请各位社区开发者和参与者推荐。当前在评选标准和项目设置上的考虑，可以参见：oEEP (openeuler.org)<https://www.openeuler.org/zh/oEEP/?name=oEEP-0007%20openEuler%E4%BC%98%E7%A…> 。截止 2023 年 10 月 15 日（周日）为止，任意三名以上社区参与者联名，可以向 tc(a)openeuler.org<mailto:tc@openeuler.org> 推荐您认可的项目。推荐项目的邮件请在邮件主题中明确包含 “openEuler 2023 年度优秀项目推荐” 字样。推荐项目的邮件内容中，请明确联名推荐人的邮箱地址和相应的 gitee id，推荐的项目名称，项目代码仓位置，推荐获奖的方向。我将汇总所有推荐，在 10 月 18 日之前通过社区邮件列表公示。欢迎大家的参与和推荐 Regards openEuler Technical Committee

1 0

[PATCH openEuler-1.0-LTS] hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I88UBD?from=project-issue CVE: NA
by liwei 18 Oct '23

18 Oct '23

---------------------------------- When CONFIG_MICROCODE_AMD is not defined, the reload_ucode_amd function is implemented by multiple files in the header file. As a result, multiple definition of reload_ucode_amd. Fix this error. Fixes: 0eeacafff0a7 ("x86/cpu/amd: Add a Zenbleed fix") Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/x86/include/asm/microcode_amd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/include/asm/microcode_amd.h b/arch/x86/include/asm/microcode_amd.h index bdecac3ae8c3..b56a1c0d5f60 100644 --- a/arch/x86/include/asm/microcode_amd.h +++ b/arch/x86/include/asm/microcode_amd.h @@ -54,7 +54,7 @@ static inline void __init load_ucode_amd_bsp(unsigned int family) {} static inline void load_ucode_amd_ap(unsigned int family) {} static inline int __init save_microcode_in_initrd_amd(unsigned int family) { return -EINVAL; } -void reload_ucode_amd(void) {} +static inline void reload_ucode_amd(void) {} static inline void amd_check_microcode(void) {} #endif #endif /* _ASM_X86_MICROCODE_AMD_H */ -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] x86/microcode/AMD: Fix compile fail
by liwei 18 Oct '23

18 Oct '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I88UBD?from=project-issue CVE: NA ---------------------------------- When CONFIG_MICROCODE_AMD is not defined, the reload_ucode_amd function is implemented by multiple files in the header file. As a result, multiple definition of reload_ucode_amd. Fix this error. Signed-off-by: liwei <liwei728(a)huawei.com> --- arch/x86/include/asm/microcode_amd.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/arch/x86/include/asm/microcode_amd.h b/arch/x86/include/asm/microcode_amd.h index bdecac3ae8c3..b56a1c0d5f60 100644 --- a/arch/x86/include/asm/microcode_amd.h +++ b/arch/x86/include/asm/microcode_amd.h @@ -54,7 +54,7 @@ static inline void __init load_ucode_amd_bsp(unsigned int family) {} static inline void load_ucode_amd_ap(unsigned int family) {} static inline int __init save_microcode_in_initrd_amd(unsigned int family) { return -EINVAL; } -void reload_ucode_amd(void) {} +static inline void reload_ucode_amd(void) {} static inline void amd_check_microcode(void) {} #endif #endif /* _ASM_X86_MICROCODE_AMD_H */ -- 2.25.1

2 1

[OLK-5.10 v2 0/7] A set of bugfixes for openeuler
by Chengchang Tang 18 Oct '23

18 Oct '23

From: Juan Zhou <zhoujuan51(a)h-partners.com> Chengchang Tang (6): RDMA/hns: Fix context dca configuration RDMA/hns: Fix potential NULL pointer in DCA memory query RDMA/hns: Fix registering dca debugfs when dca has not been set RDMA/hns: Fix printing level of asynchronous events RDMA/hns: Fix signed-unsigned mix with relational RDMA/hns: Fix unregistering device and accessing to debugfs concurrently Junxian Huang (1): RDMA/hns: Fix the concurrency error between bond and reset. drivers/infiniband/hw/hns/hns_roce_bond.c | 153 ++++++++++++++----- drivers/infiniband/hw/hns/hns_roce_bond.h | 1 + drivers/infiniband/hw/hns/hns_roce_dca.c | 10 +- drivers/infiniband/hw/hns/hns_roce_debugfs.c | 7 +- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 22 ++- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 4 +- drivers/infiniband/hw/hns/hns_roce_main.c | 3 +- 7 files changed, 143 insertions(+), 57 deletions(-) -- 2.30.0

1 7

[PATCH OLK-5.10] igb: set max size RX buffer when store bad packet is enabled
by Lu Wei 18 Oct '23

18 Oct '23

From: Radoslaw Tyl <radoslawx.tyl(a)intel.com> stable inclusion from stable-v5.10.195 commit 3e39008e9e3043663324f0920a5d6ebfa68cc92a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I885ON CVE: CVE-2023-45871 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bb5ed01cd2428cd25b1c88a3a9cba87055eb289f upstream. Increase the RX buffer size to 3K when the SBP bit is on. The size of the RX buffer determines the number of pages allocated which may not be sufficient for receive frames larger than the set MTU size. Cc: stable(a)vger.kernel.org Fixes: 89eaefb61dc9 ("igb: Support RX-ALL feature flag.") Reported-by: Manfred Rudigier <manfred.rudigier(a)omicronenergy.com> Signed-off-by: Radoslaw Tyl <radoslawx.tyl(a)intel.com> Tested-by: Arpana Arland <arpanax.arland(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- drivers/net/ethernet/intel/igb/igb_main.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c index b5ab3bcb0751..2f219229a95e 100644 --- a/drivers/net/ethernet/intel/igb/igb_main.c +++ b/drivers/net/ethernet/intel/igb/igb_main.c @@ -4733,6 +4733,10 @@ void igb_configure_rx_ring(struct igb_adapter *adapter, static void igb_set_rx_buffer_len(struct igb_adapter *adapter, struct igb_ring *rx_ring) { +#if (PAGE_SIZE < 8192) + struct e1000_hw *hw = &adapter->hw; +#endif + /* set build_skb and buffer size flags */ clear_ring_build_skb_enabled(rx_ring); clear_ring_uses_large_buffer(rx_ring); @@ -4743,10 +4747,9 @@ static void igb_set_rx_buffer_len(struct igb_adapter *adapter, set_ring_build_skb_enabled(rx_ring); #if (PAGE_SIZE < 8192) - if (adapter->max_frame_size <= IGB_MAX_FRAME_BUILD_SKB) - return; - - set_ring_uses_large_buffer(rx_ring); + if (adapter->max_frame_size > IGB_MAX_FRAME_BUILD_SKB || + rd32(E1000_RCTL) & E1000_RCTL_SBP) + set_ring_uses_large_buffer(rx_ring); #endif } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] igb: set max size RX buffer when store bad packet is enabled
by Lu Wei 18 Oct '23

18 Oct '23

From: Radoslaw Tyl <radoslawx.tyl(a)intel.com> mainline inclusion from mainline-v6.6-rc1 commit bb5ed01cd2428cd25b1c88a3a9cba87055eb289f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I885ON Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Increase the RX buffer size to 3K when the SBP bit is on. The size of the RX buffer determines the number of pages allocated which may not be sufficient for receive frames larger than the set MTU size. Cc: stable(a)vger.kernel.org Fixes: 89eaefb61dc9 ("igb: Support RX-ALL feature flag.") Reported-by: Manfred Rudigier <manfred.rudigier(a)omicronenergy.com> Signed-off-by: Radoslaw Tyl <radoslawx.tyl(a)intel.com> Tested-by: Arpana Arland <arpanax.arland(a)intel.com> (A Contingent worker at Intel) Signed-off-by: Tony Nguyen <anthony.l.nguyen(a)intel.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- drivers/net/ethernet/intel/igb/igb_main.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c index 6d9b8e81b44d..bebfeaf5aa26 100644 --- a/drivers/net/ethernet/intel/igb/igb_main.c +++ b/drivers/net/ethernet/intel/igb/igb_main.c @@ -4561,6 +4561,10 @@ void igb_configure_rx_ring(struct igb_adapter *adapter, static void igb_set_rx_buffer_len(struct igb_adapter *adapter, struct igb_ring *rx_ring) { +#if (PAGE_SIZE < 8192) + struct e1000_hw *hw = &adapter->hw; +#endif + /* set build_skb and buffer size flags */ clear_ring_build_skb_enabled(rx_ring); clear_ring_uses_large_buffer(rx_ring); @@ -4571,10 +4575,9 @@ static void igb_set_rx_buffer_len(struct igb_adapter *adapter, set_ring_build_skb_enabled(rx_ring); #if (PAGE_SIZE < 8192) - if (adapter->max_frame_size <= IGB_MAX_FRAME_BUILD_SKB) - return; - - set_ring_uses_large_buffer(rx_ring); + if (adapter->max_frame_size > IGB_MAX_FRAME_BUILD_SKB || + rd32(E1000_RCTL) & E1000_RCTL_SBP) + set_ring_uses_large_buffer(rx_ring); #endif } -- 2.34.1

2 1

[PATCH OLK-5.10] audit: fix possible soft lockup in __audit_inode_child()
by Yi Yang 17 Oct '23

17 Oct '23

From: Gaosheng Cui <cuigaosheng1(a)huawei.com> stable inclusion from stable-v5.10.195 commit 98ef243d5900d75a64539a2165745bffbb155d43 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I88UP7 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b59bc6e37237e37eadf50cd5de369e913f524463 ] Tracefs or debugfs maybe cause hundreds to thousands of PATH records, too many PATH records maybe cause soft lockup. For example: 1. CONFIG_KASAN=y && CONFIG_PREEMPTION=n 2. auditctl -a exit,always -S open -k key 3. sysctl -w kernel.watchdog_thresh=5 4. mkdir /sys/kernel/debug/tracing/instances/test There may be a soft lockup as follows: watchdog: BUG: soft lockup - CPU#45 stuck for 7s! [mkdir:15498] Kernel panic - not syncing: softlockup: hung tasks Call trace: dump_backtrace+0x0/0x30c show_stack+0x20/0x30 dump_stack+0x11c/0x174 panic+0x27c/0x494 watchdog_timer_fn+0x2bc/0x390 __run_hrtimer+0x148/0x4fc __hrtimer_run_queues+0x154/0x210 hrtimer_interrupt+0x2c4/0x760 arch_timer_handler_phys+0x48/0x60 handle_percpu_devid_irq+0xe0/0x340 __handle_domain_irq+0xbc/0x130 gic_handle_irq+0x78/0x460 el1_irq+0xb8/0x140 __audit_inode_child+0x240/0x7bc tracefs_create_file+0x1b8/0x2a0 trace_create_file+0x18/0x50 event_create_dir+0x204/0x30c __trace_add_new_event+0xac/0x100 event_trace_add_tracer+0xa0/0x130 trace_array_create_dir+0x60/0x140 trace_array_create+0x1e0/0x370 instance_mkdir+0x90/0xd0 tracefs_syscall_mkdir+0x68/0xa0 vfs_mkdir+0x21c/0x34c do_mkdirat+0x1b4/0x1d4 __arm64_sys_mkdirat+0x4c/0x60 el0_svc_common.constprop.0+0xa8/0x240 do_el0_svc+0x8c/0xc0 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Therefore, we add cond_resched() to __audit_inode_child() to fix it. Fixes: 5195d8e217a7 ("audit: dynamically allocate audit_names when not enough space is in the names array") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- kernel/auditsc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 07e2788bbbf1..57b982b44732 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -2203,6 +2203,8 @@ void __audit_inode_child(struct inode *parent, } } + cond_resched(); + /* is there a matching child entry? */ list_for_each_entry(n, &context->names_list, list) { /* can only match entries that have a name */ -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/5] Fixed five CVE vulnerabilities of ksmbd.
by ZhaoLong Wang 17 Oct '23

17 Oct '23

CVE-2023-32254 CVE-2023-32246 CVE-2023-32256 CVE-2023-32258 CVE-2023-2593 Marios Makassikis (1): ksmbd: send proper error response in smb2_tree_connect() Namjae Jeon (4): ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix racy issue from smb2 close and logoff with multichannel ksmbd: fix infinite loop in ksmbd_conn_handler_loop() fs/ksmbd/connection.c | 61 +++++++++++++++++++++++++++--------- fs/ksmbd/connection.h | 19 +++++++++-- fs/ksmbd/mgmt/tree_connect.c | 13 +++++++- fs/ksmbd/mgmt/tree_connect.h | 3 ++ fs/ksmbd/mgmt/user_session.c | 36 +++++++++++++++++---- fs/ksmbd/server.c | 1 + fs/ksmbd/smb2pdu.c | 31 ++++++++++-------- fs/ksmbd/transport_tcp.c | 5 ++- 8 files changed, 130 insertions(+), 39 deletions(-) -- 2.34.3

2 6

[PATCH OLK-5.10 0/5] Fixed five CVE vulnerabilities of ksmbd
by ZhaoLong Wang 17 Oct '23

17 Oct '23

CVE-2023-32254 CVE-2023-32246 CVE-2023-32256 CVE-2023-32258 CVE-2023-2593 Marios Makassikis (1): ksmbd: send proper error response in smb2_tree_connect() Namjae Jeon (4): ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix racy issue from smb2 close and logoff with multichannel ksmbd: fix infinite loop in ksmbd_conn_handler_loop() fs/ksmbd/connection.c | 61 +++++++++++++++++++++++++++--------- fs/ksmbd/connection.h | 19 +++++++++-- fs/ksmbd/mgmt/tree_connect.c | 13 +++++++- fs/ksmbd/mgmt/tree_connect.h | 3 ++ fs/ksmbd/mgmt/user_session.c | 36 +++++++++++++++++---- fs/ksmbd/server.c | 1 + fs/ksmbd/smb2pdu.c | 31 ++++++++++-------- fs/ksmbd/transport_tcp.c | 5 ++- 8 files changed, 130 insertions(+), 39 deletions(-) -- 2.34.3

2 6

[PATCH OLK-5.10] xhci: print warning when HCE was set
by Longfang Liu 17 Oct '23

17 Oct '23

mainline inclusion from mainline-v6.2-rc1 commit 2a25e66d676dfb9b018abd503deed3d38a892dec category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I87TGP CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- When HCE(Host Controller Error) is set, it means that the xhci hardware controller has an error at this time, but the current xhci driver software does not log this event. By adding an HCE event detection in the xhci interrupt processing interface, a warning log is output to the system, which is convenient for system device status tracking. Signed-off-by: Longfang Liu <liulongfang(a)huawei.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Link: https://lore.kernel.org/r/20221130091944.2171610-2-mathias.nyman@linux.inte… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/host/xhci-ring.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 935368c6b31d..d99ea8492749 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -2935,6 +2935,11 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) if (!(status & STS_EINT)) goto out; + if (status & STS_HCE) { + xhci_warn(xhci, "WARNING: Host Controller Error\n"); + goto out; + } + if (status & STS_FATAL) { xhci_warn(xhci, "WARNING: Host System Error\n"); xhci_halt(xhci); -- 2.24.0

2 1

[PATCH openEuler-1.0-LTS v2] audit: fix possible soft lockup in __audit_inode_child()
by Yi Yang 17 Oct '23

17 Oct '23

From: Gaosheng Cui <cuigaosheng1(a)huawei.com> stable inclusion from stable-v4.19.295 commit 1640c7bd4eddec6c72f3a99cbb74e333a2ce9f5d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I88RR0 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit b59bc6e37237e37eadf50cd5de369e913f524463 ] Tracefs or debugfs maybe cause hundreds to thousands of PATH records, too many PATH records maybe cause soft lockup. For example: 1. CONFIG_KASAN=y && CONFIG_PREEMPTION=n 2. auditctl -a exit,always -S open -k key 3. sysctl -w kernel.watchdog_thresh=5 4. mkdir /sys/kernel/debug/tracing/instances/test There may be a soft lockup as follows: watchdog: BUG: soft lockup - CPU#45 stuck for 7s! [mkdir:15498] Kernel panic - not syncing: softlockup: hung tasks Call trace: dump_backtrace+0x0/0x30c show_stack+0x20/0x30 dump_stack+0x11c/0x174 panic+0x27c/0x494 watchdog_timer_fn+0x2bc/0x390 __run_hrtimer+0x148/0x4fc __hrtimer_run_queues+0x154/0x210 hrtimer_interrupt+0x2c4/0x760 arch_timer_handler_phys+0x48/0x60 handle_percpu_devid_irq+0xe0/0x340 __handle_domain_irq+0xbc/0x130 gic_handle_irq+0x78/0x460 el1_irq+0xb8/0x140 __audit_inode_child+0x240/0x7bc tracefs_create_file+0x1b8/0x2a0 trace_create_file+0x18/0x50 event_create_dir+0x204/0x30c __trace_add_new_event+0xac/0x100 event_trace_add_tracer+0xa0/0x130 trace_array_create_dir+0x60/0x140 trace_array_create+0x1e0/0x370 instance_mkdir+0x90/0xd0 tracefs_syscall_mkdir+0x68/0xa0 vfs_mkdir+0x21c/0x34c do_mkdirat+0x1b4/0x1d4 __arm64_sys_mkdirat+0x4c/0x60 el0_svc_common.constprop.0+0xa8/0x240 do_el0_svc+0x8c/0xc0 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Therefore, we add cond_resched() to __audit_inode_child() to fix it. Fixes: 5195d8e217a7 ("audit: dynamically allocate audit_names when not enough space is in the names array") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- v2:Fix checkformat error --- kernel/auditsc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 57d30b75f7a2..61fd210f0226 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1931,6 +1931,8 @@ void __audit_inode_child(struct inode *parent, } } + cond_resched(); + /* is there a matching child entry? */ list_for_each_entry(n, &context->names_list, list) { /* can only match entries that have a name */ -- 2.25.1

2 1

[PATCH OLK-5.10 0/5] Fix 5 CVE of ksmbd
by ZhaoLong Wang 17 Oct '23

17 Oct '23

CVE-2023-32254 CVE-2023-32246 CVE-2023-32256 CVE-2023-32258 CVE-2023-2593 Marios Makassikis (1): ksmbd: send proper error response in smb2_tree_connect() Namjae Jeon (4): ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix racy issue from smb2 close and logoff with multichannel ksmbd: fix infinite loop in ksmbd_conn_handler_loop() fs/ksmbd/connection.c | 61 +++++++++++++++++++++++++++--------- fs/ksmbd/connection.h | 19 +++++++++-- fs/ksmbd/mgmt/tree_connect.c | 13 +++++++- fs/ksmbd/mgmt/tree_connect.h | 3 ++ fs/ksmbd/mgmt/user_session.c | 36 +++++++++++++++++---- fs/ksmbd/server.c | 1 + fs/ksmbd/smb2pdu.c | 31 ++++++++++-------- fs/ksmbd/transport_tcp.c | 5 ++- 8 files changed, 130 insertions(+), 39 deletions(-) -- 2.34.3

1 5

[PATCH OLK-5.10 0/5] Fix 5 CVE of ksmbd
by ZhaoLong Wang 17 Oct '23

17 Oct '23

CVE-2023-32254 CVE-2023-32246 CVE-2023-32256 CVE-2023-32258 CVE-2023-2593 Marios Makassikis (1): ksmbd: send proper error response in smb2_tree_connect() Namjae Jeon (4): ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix racy issue from smb2 close and logoff with multichannel ksmbd: fix infinite loop in ksmbd_conn_handler_loop() fs/ksmbd/connection.c | 61 +++++++++++++++++++++++++++--------- fs/ksmbd/connection.h | 19 +++++++++-- fs/ksmbd/mgmt/tree_connect.c | 13 +++++++- fs/ksmbd/mgmt/tree_connect.h | 3 ++ fs/ksmbd/mgmt/user_session.c | 36 +++++++++++++++++---- fs/ksmbd/server.c | 1 + fs/ksmbd/smb2pdu.c | 31 ++++++++++-------- fs/ksmbd/transport_tcp.c | 5 ++- 8 files changed, 130 insertions(+), 39 deletions(-) -- 2.34.3

1 5

[PATCH openEuler-1.0-LTS] audit: fix possible soft lockup in __audit_inode_child()
by Yi Yang 17 Oct '23

17 Oct '23

From: Gaosheng Cui <cuigaosheng1(a)huawei.com> stable inclusion from stable-v4.19.295 commit 1640c7bd4eddec6c72f3a99cbb74e333a2ce9f5d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I88RR0 CVE: NA Reference:https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/… -------------------------------- [ Upstream commit b59bc6e37237e37eadf50cd5de369e913f524463 ] Tracefs or debugfs maybe cause hundreds to thousands of PATH records, too many PATH records maybe cause soft lockup. For example: 1. CONFIG_KASAN=y && CONFIG_PREEMPTION=n 2. auditctl -a exit,always -S open -k key 3. sysctl -w kernel.watchdog_thresh=5 4. mkdir /sys/kernel/debug/tracing/instances/test There may be a soft lockup as follows: watchdog: BUG: soft lockup - CPU#45 stuck for 7s! [mkdir:15498] Kernel panic - not syncing: softlockup: hung tasks Call trace: dump_backtrace+0x0/0x30c show_stack+0x20/0x30 dump_stack+0x11c/0x174 panic+0x27c/0x494 watchdog_timer_fn+0x2bc/0x390 __run_hrtimer+0x148/0x4fc __hrtimer_run_queues+0x154/0x210 hrtimer_interrupt+0x2c4/0x760 arch_timer_handler_phys+0x48/0x60 handle_percpu_devid_irq+0xe0/0x340 __handle_domain_irq+0xbc/0x130 gic_handle_irq+0x78/0x460 el1_irq+0xb8/0x140 __audit_inode_child+0x240/0x7bc tracefs_create_file+0x1b8/0x2a0 trace_create_file+0x18/0x50 event_create_dir+0x204/0x30c __trace_add_new_event+0xac/0x100 event_trace_add_tracer+0xa0/0x130 trace_array_create_dir+0x60/0x140 trace_array_create+0x1e0/0x370 instance_mkdir+0x90/0xd0 tracefs_syscall_mkdir+0x68/0xa0 vfs_mkdir+0x21c/0x34c do_mkdirat+0x1b4/0x1d4 __arm64_sys_mkdirat+0x4c/0x60 el0_svc_common.constprop.0+0xa8/0x240 do_el0_svc+0x8c/0xc0 el0_svc+0x20/0x30 el0_sync_handler+0xb0/0xb4 el0_sync+0x160/0x180 Therefore, we add cond_resched() to __audit_inode_child() to fix it. Fixes: 5195d8e217a7 ("audit: dynamically allocate audit_names when not enough space is in the names array") Signed-off-by: Gaosheng Cui <cuigaosheng1(a)huawei.com> Signed-off-by: Paul Moore <paul(a)paul-moore.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- kernel/auditsc.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 57d30b75f7a2..61fd210f0226 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1931,6 +1931,8 @@ void __audit_inode_child(struct inode *parent, } } + cond_resched(); + /* is there a matching child entry? */ list_for_each_entry(n, &context->names_list, list) { /* can only match entries that have a name */ -- 2.34.1

2 1

[PATCH OLK-5.10 00/24] coresight: Add new API to allocate trace source ID values
by Junhao He 17 Oct '23

17 Oct '23

From: xiabing <xiabing12(a)h-partners.com> The current method for allocating trace source ID values to sources is to use a fixed algorithm for CPU based sources of (cpu_num * 2 + 0x10). The STM is allocated ID 0x1. This fixed algorithm is used in both the CoreSight driver code, and by perf when writing the trace metadata in the AUXTRACE_INFO record. The method needs replacing as currently:- 1. It is inefficient in using available IDs. 2. Does not scale to larger systems with many cores and the algorithm has no limits so will generate invalid trace IDs for cpu number > 44. Additionally requirements to allocate additional system IDs on some systems have been seen. This patch set introduces an API that allows the allocation of trace IDs in a dynamic manner. Architecturally reserved IDs are never allocated, and the system is limited to allocating only valid IDs. Each of the current trace sources ETM3.x, ETM4.x and STM is updated to use the new API. For the ETMx.x devices IDs are allocated on certain events a) When using sysfs, an ID will be allocated on hardware enable, or a read of sysfs TRCTRACEID register and freed when the sysfs reset is written. b) When using perf, ID is allocated on during setup AUX event, and freed on event free. IDs are communicated using the AUX_OUTPUT_HW_ID packet. The ID allocator is notified when perf sessions start and stop so CPU based IDs are kept constant throughout any perf session. Adrian Hunter (1): perf/x86: Add new event for AUX output counter index German Gomez (1): perf cs_etm: Keep separate symbols for ETMv4 and ETE parameters James Clark (4): perf cs-etm: Tidy up auxtrace info header printing perf cs-etm: Cleanup cs_etm__process_auxtrace_info() perf cs-etm: Print unknown header version as an error perf cs-etm: Print auxtrace info even if OpenCSD isn't linked Mike Leach (15): coresight: trace-id: Add API to dynamically assign Trace ID values coresight: Remove obsolete Trace ID unniqueness checks coresight: perf: traceid: Add perf ID allocation and notifiers coresight: stm: Update STM driver to use Trace ID API coresight: etm4x: Update ETM4 driver to use Trace ID API coresight: etm3x: Update ETM3 driver to use Trace ID API coresight: etmX.X: stm: Remove trace_id() callback coresight: trace id: Remove legacy get trace ID function. perf cs-etm: Move mapping of Trace ID and cpu into helper function perf cs-etm: Update record event to use new Trace ID protocol kernel: events: Export perf_report_aux_output_id() perf cs-etm: Handle PERF_RECORD_AUX_OUTPUT_HW_ID packet coresight: events: PERF_RECORD_AUX_OUTPUT_HW_ID used for Trace ID coresight: trace-id: Add debug & test macros to Trace ID allocation coresight: etm4x: Fix missing trctraceidr file in sysfs Ruidong Tian (1): coresight: perf: Release Coresight path when alloc trace id failed Suzuki K Poulose (1): coresight: perf: Output trace id only once xiabing (1): Revert "drivers/ETM: fix error in invalid cs_id" .../testing/sysfs-bus-coresight-devices-etm3x | 2 +- arch/x86/events/core.c | 6 + arch/x86/events/intel/core.c | 16 + arch/x86/events/perf_event.h | 1 + drivers/hwtracing/coresight/Makefile | 2 +- drivers/hwtracing/coresight/coresight-core.c | 45 -- .../hwtracing/coresight/coresight-etm-perf.c | 32 + .../hwtracing/coresight/coresight-etm-perf.h | 2 + drivers/hwtracing/coresight/coresight-etm.h | 3 +- .../coresight/coresight-etm3x-core.c | 93 +-- .../coresight/coresight-etm3x-sysfs.c | 27 +- .../coresight/coresight-etm4x-core.c | 73 ++- .../coresight/coresight-etm4x-sysfs.c | 50 +- drivers/hwtracing/coresight/coresight-etm4x.h | 3 + drivers/hwtracing/coresight/coresight-stm.c | 49 +- .../hwtracing/coresight/coresight-trace-id.c | 297 ++++++++++ .../hwtracing/coresight/coresight-trace-id.h | 156 +++++ include/linux/coresight-pmu.h | 35 +- include/linux/coresight.h | 3 - include/linux/perf_event.h | 1 + include/uapi/linux/perf_event.h | 15 + kernel/events/core.c | 31 + tools/include/linux/coresight-pmu.h | 48 +- tools/perf/arch/arm/util/cs-etm.c | 66 ++- tools/perf/util/Build | 1 + tools/perf/util/cs-etm-base.c | 191 ++++++ .../perf/util/cs-etm-decoder/cs-etm-decoder.c | 7 + tools/perf/util/cs-etm.c | 546 ++++++++++-------- tools/perf/util/cs-etm.h | 37 +- 29 files changed, 1387 insertions(+), 451 deletions(-) create mode 100644 drivers/hwtracing/coresight/coresight-trace-id.c create mode 100644 drivers/hwtracing/coresight/coresight-trace-id.h create mode 100644 tools/perf/util/cs-etm-base.c -- 2.30.0

2 25

[PATCH OLK-5.10 0/4] CVE-2023-37453
by Lin Yujun 17 Oct '23

17 Oct '23

*** BLURB HERE *** Alan Stern (4): USB: core: Unite old scheme and new scheme descriptor reads USB: core: Change usb_get_device_descriptor() API USB: core: Fix race by not overwriting udev->descriptor in hub_port_init() USB: core: Fix oversight in SuperSpeed initialization drivers/usb/core/hcd.c | 10 +- drivers/usb/core/hub.c | 349 +++++++++++++++++++++---------------- drivers/usb/core/message.c | 29 ++- drivers/usb/core/usb.h | 4 +- 4 files changed, 223 insertions(+), 169 deletions(-) -- 2.34.1

2 5

[PATCH] xhci: print warning when HCE was set
by Longfang Liu 17 Oct '23

17 Oct '23

mainline inclusion from mainline-v6.2-rc1 commit 2a25e66d676dfb9b018abd503deed3d38a892dec category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I87TGP CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- When HCE(Host Controller Error) is set, it means that the xhci hardware controller has an error at this time, but the current xhci driver software does not log this event. By adding an HCE event detection in the xhci interrupt processing interface, a warning log is output to the system, which is convenient for system device status tracking. Signed-off-by: Longfang Liu <liulongfang(a)huawei.com> Signed-off-by: Mathias Nyman <mathias.nyman(a)linux.intel.com> Link: https://lore.kernel.org/r/20221130091944.2171610-2-mathias.nyman@linux.inte… Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> --- drivers/usb/host/xhci-ring.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c index 935368c6b31d..d99ea8492749 100644 --- a/drivers/usb/host/xhci-ring.c +++ b/drivers/usb/host/xhci-ring.c @@ -2935,6 +2935,11 @@ irqreturn_t xhci_irq(struct usb_hcd *hcd) if (!(status & STS_EINT)) goto out; + if (status & STS_HCE) { + xhci_warn(xhci, "WARNING: Host Controller Error\n"); + goto out; + } + if (status & STS_FATAL) { xhci_warn(xhci, "WARNING: Host System Error\n"); xhci_halt(xhci); -- 2.24.0

1 0

[PATCH openEuler-1.0-LTS v2] netfilter: xt_u32: validate user space input
by Lu Wei 17 Oct '23

17 Oct '23

From: Wander Lairson Costa <wander(a)redhat.com> mainline inclusion from mainline-v6.6-rc1 commit 69c5d284f67089b4750d28ff6ac6f52ec224b330 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I85CAT CVE: CVE-2023-39192 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The xt_u32 module doesn't validate the fields in the xt_u32 structure. An attacker may take advantage of this to trigger an OOB read by setting the size fields with a value beyond the arrays boundaries. Add a checkentry function to validate the structure. This was originally reported by the ZDI project (ZDI-CAN-18408). Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match") Cc: stable(a)vger.kernel.org Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/netfilter/xt_u32.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c index a95b50342dbb..58ba402bc0b0 100644 --- a/net/netfilter/xt_u32.c +++ b/net/netfilter/xt_u32.c @@ -95,11 +95,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par) return ret ^ data->invert; } +static int u32_mt_checkentry(const struct xt_mtchk_param *par) +{ + const struct xt_u32 *data = par->matchinfo; + const struct xt_u32_test *ct; + unsigned int i; + + if (data->ntests > ARRAY_SIZE(data->tests)) + return -EINVAL; + + for (i = 0; i < data->ntests; ++i) { + ct = &data->tests[i]; + + if (ct->nnums > ARRAY_SIZE(ct->location) || + ct->nvalues > ARRAY_SIZE(ct->value)) + return -EINVAL; + } + + return 0; +} + static struct xt_match xt_u32_mt_reg __read_mostly = { .name = "u32", .revision = 0, .family = NFPROTO_UNSPEC, .match = u32_mt, + .checkentry = u32_mt_checkentry, .matchsize = sizeof(struct xt_u32), .me = THIS_MODULE, }; -- 2.34.1

2 1

[PATCH OLK-5.10 v2] netfilter: xt_u32: validate user space input
by Lu Wei 17 Oct '23

17 Oct '23

From: Wander Lairson Costa <wander(a)redhat.com> mainline inclusion from mainline-v6.6-rc1 commit 69c5d284f67089b4750d28ff6ac6f52ec224b330 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I85CAT CVE: CVE-2023-39192 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The xt_u32 module doesn't validate the fields in the xt_u32 structure. An attacker may take advantage of this to trigger an OOB read by setting the size fields with a value beyond the arrays boundaries. Add a checkentry function to validate the structure. This was originally reported by the ZDI project (ZDI-CAN-18408). Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match") Cc: stable(a)vger.kernel.org Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/netfilter/xt_u32.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c index 177b40d08098..117d4615d668 100644 --- a/net/netfilter/xt_u32.c +++ b/net/netfilter/xt_u32.c @@ -96,11 +96,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par) return ret ^ data->invert; } +static int u32_mt_checkentry(const struct xt_mtchk_param *par) +{ + const struct xt_u32 *data = par->matchinfo; + const struct xt_u32_test *ct; + unsigned int i; + + if (data->ntests > ARRAY_SIZE(data->tests)) + return -EINVAL; + + for (i = 0; i < data->ntests; ++i) { + ct = &data->tests[i]; + + if (ct->nnums > ARRAY_SIZE(ct->location) || + ct->nvalues > ARRAY_SIZE(ct->value)) + return -EINVAL; + } + + return 0; +} + static struct xt_match xt_u32_mt_reg __read_mostly = { .name = "u32", .revision = 0, .family = NFPROTO_UNSPEC, .match = u32_mt, + .checkentry = u32_mt_checkentry, .matchsize = sizeof(struct xt_u32), .me = THIS_MODULE, }; -- 2.34.1

2 1

[PATCH OLK-5.10 0/3] Fix 4 CVE of ksmbd
by ZhaoLong Wang 17 Oct '23

17 Oct '23

CVE-2023-32254 CVE-2023-32246 CVE-2023-32256 CVE-2023-32258 Namjae Jeon (3): ksmbd: fix racy issue under cocurrent smb2 tree disconnect ksmbd: call rcu_barrier() in ksmbd_server_exit() ksmbd: fix racy issue from smb2 close and logoff with multichannel fs/ksmbd/connection.c | 54 +++++++++++++++++++++++++++--------- fs/ksmbd/connection.h | 19 +++++++++++-- fs/ksmbd/mgmt/tree_connect.c | 13 ++++++++- fs/ksmbd/mgmt/tree_connect.h | 3 ++ fs/ksmbd/mgmt/user_session.c | 36 ++++++++++++++++++++---- fs/ksmbd/server.c | 1 + fs/ksmbd/smb2pdu.c | 24 ++++++++-------- 7 files changed, 116 insertions(+), 34 deletions(-) -- 2.34.3

2 4

[PATCH OLK-5.10] crypto: drbg - Only fail when jent is unavailable in FIPS mode
by Lu Jialin 17 Oct '23

17 Oct '23

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from stable-v5.10.180 commit 2a67bc52cd3f0783ac412d8007ae7bdd04911b10 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I88MMY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 686cd976b6ddedeeb1a1fb09ba53a891d3cc9a03 ] When jent initialisation fails for any reason other than ENOENT, the entire drbg fails to initialise, even when we're not in FIPS mode. This is wrong because we can still use the kernel RNG when we're not in FIPS mode. Change it so that it only fails when we are in FIPS mode. Fixes: 57225e679788 ("crypto: drbg - Use callback API for random readiness") Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Reviewed-by: Stephan Mueller <smueller(a)chronox.de> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflict: crypto/drbg.c Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- crypto/drbg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/drbg.c b/crypto/drbg.c index a4b5d6dbe99d..3019a26c5021 100644 --- a/crypto/drbg.c +++ b/crypto/drbg.c @@ -1573,7 +1573,7 @@ static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers, if (IS_ERR(drbg->jent)) { ret = PTR_ERR(drbg->jent); drbg->jent = NULL; - if (fips_enabled || ret != -ENOENT) + if (fips_enabled) goto free_everything; pr_info("DRBG: Continuing without Jitter RNG\n"); } -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS v2] USB: ene_usb6250: Allocate enough memory for full object
by Yipeng Zou 17 Oct '23

17 Oct '23

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.6-rc2 commit ce33e64c1788912976b61314b56935abd4bc97ef category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I885FJ CVE: CVE-2023-45862 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The allocation of PageBuffer is 512 bytes in size, but the dereferencing of struct ms_bootblock_idi (also size 512) happens at a calculated offset within the allocation, which means the object could potentially extend beyond the end of the allocation. Avoid this case by just allocating enough space to catch any accesses beyond the end. Seen with GCC 13: ../drivers/usb/storage/ene_ub6250.c: In function 'ms_lib_process_bootblock': ../drivers/usb/storage/ene_ub6250.c:1050:44: warning: array subscript 'struct ms_bootblock_idi[0]' is partly outside array bounds of 'unsigned char[512]' [-Warray-bounds=] 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~ ../include/uapi/linux/byteorder/little_endian.h:37:51: note: in definition of macro '__le16_to_cpu' 37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x)) | ^ ../drivers/usb/storage/ene_ub6250.c:1050:29: note: in expansion of macro 'le16_to_cpu' 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~~~~~~~~~~ In file included from ../drivers/usb/storage/ene_ub6250.c:5: In function 'kmalloc', inlined from 'ms_lib_process_bootblock' at ../drivers/usb/storage/ene_ub6250.c:942:15: ../include/linux/slab.h:580:24: note: at offset [256, 512] into object of size 512 allocated by 'kmalloc_trace' 580 | return kmalloc_trace( | ^~~~~~~~~~~~~~ 581 | kmalloc_caches[kmalloc_type(flags)][index], | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 582 | flags, size); | ~~~~~~~~~~~~ Cc: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Kees Cook <keescook(a)chromium.org> Link: https://lore.kernel.org/r/20230204183546.never.849-kees@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/usb/storage/ene_ub6250.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c index 4d261e4de9ad..e6768662c5ed 100644 --- a/drivers/usb/storage/ene_ub6250.c +++ b/drivers/usb/storage/ene_ub6250.c @@ -940,7 +940,7 @@ static int ms_lib_process_bootblock(struct us_data *us, u16 PhyBlock, u8 *PageDa struct ms_lib_type_extdat ExtraData; struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; - PageBuffer = kmalloc(MS_BYTES_PER_PAGE, GFP_KERNEL); + PageBuffer = kzalloc(MS_BYTES_PER_PAGE * 2, GFP_KERNEL); if (PageBuffer == NULL) return (u32)-1; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] USB: ene_usb6250: Allocate enough memory for full object
by Yipeng Zou 17 Oct '23

17 Oct '23

From: Kees Cook <keescook(a)chromium.org> mainline inclusion from mainline-v6.6-rc2 commit ce33e64c1788912976b61314b56935abd4bc97ef category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I88NEK CVE: CVE-2023-45862 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The allocation of PageBuffer is 512 bytes in size, but the dereferencing of struct ms_bootblock_idi (also size 512) happens at a calculated offset within the allocation, which means the object could potentially extend beyond the end of the allocation. Avoid this case by just allocating enough space to catch any accesses beyond the end. Seen with GCC 13: ../drivers/usb/storage/ene_ub6250.c: In function 'ms_lib_process_bootblock': ../drivers/usb/storage/ene_ub6250.c:1050:44: warning: array subscript 'struct ms_bootblock_idi[0]' is partly outside array bounds of 'unsigned char[512]' [-Warray-bounds=] 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~ ../include/uapi/linux/byteorder/little_endian.h:37:51: note: in definition of macro '__le16_to_cpu' 37 | #define __le16_to_cpu(x) ((__force __u16)(__le16)(x)) | ^ ../drivers/usb/storage/ene_ub6250.c:1050:29: note: in expansion of macro 'le16_to_cpu' 1050 | if (le16_to_cpu(idi->wIDIgeneralConfiguration) != MS_IDI_GENERAL_CONF) | ^~~~~~~~~~~ In file included from ../drivers/usb/storage/ene_ub6250.c:5: In function 'kmalloc', inlined from 'ms_lib_process_bootblock' at ../drivers/usb/storage/ene_ub6250.c:942:15: ../include/linux/slab.h:580:24: note: at offset [256, 512] into object of size 512 allocated by 'kmalloc_trace' 580 | return kmalloc_trace( | ^~~~~~~~~~~~~~ 581 | kmalloc_caches[kmalloc_type(flags)][index], | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 582 | flags, size); | ~~~~~~~~~~~~ Cc: Alan Stern <stern(a)rowland.harvard.edu> Signed-off-by: Kees Cook <keescook(a)chromium.org> Link: https://lore.kernel.org/r/20230204183546.never.849-kees@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- drivers/usb/storage/ene_ub6250.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c index 4d261e4de9ad..e6768662c5ed 100644 --- a/drivers/usb/storage/ene_ub6250.c +++ b/drivers/usb/storage/ene_ub6250.c @@ -940,7 +940,7 @@ static int ms_lib_process_bootblock(struct us_data *us, u16 PhyBlock, u8 *PageDa struct ms_lib_type_extdat ExtraData; struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; - PageBuffer = kmalloc(MS_BYTES_PER_PAGE, GFP_KERNEL); + PageBuffer = kzalloc(MS_BYTES_PER_PAGE * 2, GFP_KERNEL); if (PageBuffer == NULL) return (u32)-1; -- 2.34.1

2 1

[OLK-5.10] crypto: drbg - Only fail when jent is unavailable in FIPS mode
by Lu Jialin 17 Oct '23

17 Oct '23

From: Herbert Xu <herbert(a)gondor.apana.org.au> stable inclusion from stable-v5.10.180 commit 2a67bc52cd3f0783ac412d8007ae7bdd04911b10 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I88MMY Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 686cd976b6ddedeeb1a1fb09ba53a891d3cc9a03 ] When jent initialisation fails for any reason other than ENOENT, the entire drbg fails to initialise, even when we're not in FIPS mode. This is wrong because we can still use the kernel RNG when we're not in FIPS mode. Change it so that it only fails when we are in FIPS mode. Fixes: 57225e679788 ("crypto: drbg - Use callback API for random readiness") Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Reviewed-by: Stephan Mueller <smueller(a)chronox.de> Signed-off-by: Herbert Xu <herbert(a)gondor.apana.org.au> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Conflict: crypto/drbg.c Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- crypto/drbg.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crypto/drbg.c b/crypto/drbg.c index a4b5d6dbe99d..3019a26c5021 100644 --- a/crypto/drbg.c +++ b/crypto/drbg.c @@ -1573,7 +1573,7 @@ static int drbg_instantiate(struct drbg_state *drbg, struct drbg_string *pers, if (IS_ERR(drbg->jent)) { ret = PTR_ERR(drbg->jent); drbg->jent = NULL; - if (fips_enabled || ret != -ENOENT) + if (fips_enabled) goto free_everything; pr_info("DRBG: Continuing without Jitter RNG\n"); } -- 2.34.1

1 0

[PATCH v5 OLK-5.10 00/19] Introduce PBHA and PBHA bit0 to control the usage of HBM Cache precisely
by Wupeng Ma 17 Oct '23

17 Oct '23

From: Ma Wupeng <mawupeng1(a)huawei.com> Patch 1: move FDT init out of kaslr_early_init for future use. Patch 2 to 8: enable feature PBHA for arm64. Patch 9-18: Control the usage of HBM cache for kernel and task precisely. Patch 19: Enable feature PBHA for arm64 by default. Changelog since v4: - update pbha_bit0_update_pgprot to pgprot_pbha_bit0 Changelog since v3: - update desc for patch #15 Changelog since v2: - correct the error Documentation in patch #18 Changelog since v1: - fix kabi broken due to include files James Morse (7): KVM: arm64: Detect and enable PBHA for stage2 dt-bindings: Rename the description of cpu nodes cpu.yaml dt-bindings: arm: Add binding for Page Based Hardware Attributes arm64: cpufeature: Enable PBHA bits for stage1 arm64: mm: Add pgprot_pbha() to allow drivers to request PBHA values KVM: arm64: Configure PBHA bits for stage2 Documentation: arm64: Describe the support and expectations for PBHA Ma Wupeng (11): arm64: cpufeature: Enable PBHA for stage1 early via FDT arm64: mm: Detect and enable PBHA bit0 at early startup arm64: mm: Update kernel pte entries if pbha bit0 enabled arm64: mm: Show PBHA bit 59 as PBHA0 in ptdump arm64: mm: Introduce VM_PBHA_BIT0 to enable pbha bit0 for single vma arm64: mm: Set PBHA0 bit for VM_PBHA_BIT0 arm64: mm: Introduce procfs interface to update PBHA0 bit arm64: mm: Set flag VM_PBHA_BIT0 for global init task arm64: mm: Introduce prctl to control pbha behavior arm64: mm: Introduce kernel param pbha openeuler: configs: arm64: Enable PBHA by default Marc Zyngier (1): arm64: Extract early FDT mapping from kaslr_early_init() .../admin-guide/kernel-parameters.txt | 8 + Documentation/arm64/index.rst | 1 + Documentation/arm64/pbha.rst | 85 +++ .../devicetree/bindings/arm/cpu.yaml | 537 ++++++++++++++++ .../devicetree/bindings/arm/cpus.yaml | 584 +++--------------- arch/arm64/Kconfig | 20 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpucaps.h | 3 + arch/arm64/include/asm/cpufeature.h | 15 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_pgtable.h | 9 + arch/arm64/include/asm/mman.h | 10 + arch/arm64/include/asm/pgtable-hwdef.h | 6 + arch/arm64/include/asm/pgtable.h | 26 + arch/arm64/include/asm/setup.h | 3 + arch/arm64/include/uapi/asm/mman.h | 1 + arch/arm64/kernel/cpufeature.c | 258 ++++++++ arch/arm64/kernel/head.S | 6 +- arch/arm64/kernel/image-vars.h | 3 + arch/arm64/kernel/kaslr.c | 7 +- arch/arm64/kernel/setup.c | 15 + arch/arm64/kvm/reset.c | 15 +- arch/arm64/mm/hugetlbpage.c | 2 + arch/arm64/mm/mmu.c | 14 +- arch/arm64/mm/ptdump.c | 5 + .../firmware/efi/libstub/efi-stub-helper.c | 3 + drivers/firmware/efi/libstub/fdt.c | 57 ++ drivers/soc/hisilicon/Makefile | 1 + drivers/soc/hisilicon/pbha.c | 204 ++++++ fs/proc/base.c | 103 +++ fs/proc/task_mmu.c | 3 + include/linux/mm.h | 8 +- include/linux/pbha.h | 66 ++ include/uapi/asm-generic/mman-common.h | 1 + include/uapi/linux/prctl.h | 2 + kernel/sys.c | 10 + mm/memory.c | 4 + mm/vmalloc.c | 5 + 38 files changed, 1579 insertions(+), 523 deletions(-) create mode 100644 Documentation/arm64/pbha.rst create mode 100644 Documentation/devicetree/bindings/arm/cpu.yaml create mode 100644 drivers/soc/hisilicon/pbha.c create mode 100644 include/linux/pbha.h -- 2.25.1

2 20

[PATCH OLK-5.10,v2] netfilter: xt_u32: validate user space input
by Lu Wei 17 Oct '23

17 Oct '23

From: Wander Lairson Costa <wander(a)redhat.com> mainline inclusion from mainline-v6.6-rc1 commit 69c5d284f67089b4750d28ff6ac6f52ec224b330 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I85CAT CVE: CVE-2023-39192 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The xt_u32 module doesn't validate the fields in the xt_u32 structure. An attacker may take advantage of this to trigger an OOB read by setting the size fields with a value beyond the arrays boundaries. Add a checkentry function to validate the structure. This was originally reported by the ZDI project (ZDI-CAN-18408). Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match") Cc: stable(a)vger.kernel.org Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/netfilter/xt_u32.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c index 177b40d08098..117d4615d668 100644 --- a/net/netfilter/xt_u32.c +++ b/net/netfilter/xt_u32.c @@ -96,11 +96,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par) return ret ^ data->invert; } +static int u32_mt_checkentry(const struct xt_mtchk_param *par) +{ + const struct xt_u32 *data = par->matchinfo; + const struct xt_u32_test *ct; + unsigned int i; + + if (data->ntests > ARRAY_SIZE(data->tests)) + return -EINVAL; + + for (i = 0; i < data->ntests; ++i) { + ct = &data->tests[i]; + + if (ct->nnums > ARRAY_SIZE(ct->location) || + ct->nvalues > ARRAY_SIZE(ct->value)) + return -EINVAL; + } + + return 0; +} + static struct xt_match xt_u32_mt_reg __read_mostly = { .name = "u32", .revision = 0, .family = NFPROTO_UNSPEC, .match = u32_mt, + .checkentry = u32_mt_checkentry, .matchsize = sizeof(struct xt_u32), .me = THIS_MODULE, }; -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS,v2] netfilter: xt_u32: validate user space input
by Lu Wei 17 Oct '23

17 Oct '23

From: Wander Lairson Costa <wander(a)redhat.com> mainline inclusion from mainline-v6.6-rc1 commit 69c5d284f67089b4750d28ff6ac6f52ec224b330 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I85CAT CVE: CVE-2023-39192 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The xt_u32 module doesn't validate the fields in the xt_u32 structure. An attacker may take advantage of this to trigger an OOB read by setting the size fields with a value beyond the arrays boundaries. Add a checkentry function to validate the structure. This was originally reported by the ZDI project (ZDI-CAN-18408). Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match") Cc: stable(a)vger.kernel.org Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/netfilter/xt_u32.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c index a95b50342dbb..58ba402bc0b0 100644 --- a/net/netfilter/xt_u32.c +++ b/net/netfilter/xt_u32.c @@ -95,11 +95,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par) return ret ^ data->invert; } +static int u32_mt_checkentry(const struct xt_mtchk_param *par) +{ + const struct xt_u32 *data = par->matchinfo; + const struct xt_u32_test *ct; + unsigned int i; + + if (data->ntests > ARRAY_SIZE(data->tests)) + return -EINVAL; + + for (i = 0; i < data->ntests; ++i) { + ct = &data->tests[i]; + + if (ct->nnums > ARRAY_SIZE(ct->location) || + ct->nvalues > ARRAY_SIZE(ct->value)) + return -EINVAL; + } + + return 0; +} + static struct xt_match xt_u32_mt_reg __read_mostly = { .name = "u32", .revision = 0, .family = NFPROTO_UNSPEC, .match = u32_mt, + .checkentry = u32_mt_checkentry, .matchsize = sizeof(struct xt_u32), .me = THIS_MODULE, }; -- 2.34.1

1 0

[PATCH v4 OLK-5.10 00/19] Introduce PBHA and PBHA bit0 to control the usage of HBM Cache precisely
by Wupeng Ma 16 Oct '23

16 Oct '23

From: Ma Wupeng <mawupeng1(a)huawei.com> Patch 1: move FDT init out of kaslr_early_init for future use. Patch 2 to 8: enable feature PBHA for arm64. Patch 9-18: Control the usage of HBM cache for kernel and task precisely. Patch 19: Enable feature PBHA for arm64 by default. Changelog since v3: - update desc for patch #15 Changelog since v2: - correct the error Documentation in patch #18 Changelog since v1: - fix kabi broken due to include files James Morse (7): KVM: arm64: Detect and enable PBHA for stage2 dt-bindings: Rename the description of cpu nodes cpu.yaml dt-bindings: arm: Add binding for Page Based Hardware Attributes arm64: cpufeature: Enable PBHA bits for stage1 arm64: mm: Add pgprot_pbha() to allow drivers to request PBHA values KVM: arm64: Configure PBHA bits for stage2 Documentation: arm64: Describe the support and expectations for PBHA Ma Wupeng (11): arm64: cpufeature: Enable PBHA for stage1 early via FDT arm64: mm: Detect and enable PBHA bit0 at early startup arm64: mm: Update kernel pte entries if pbha bit0 enabled arm64: mm: Show PBHA bit 59 as PBHA0 in ptdump arm64: mm: Introduce VM_PBHA_BIT0 to enable pbha bit0 for single vma arm64: mm: Set PBHA0 bit for VM_PBHA_BIT0 arm64: mm: Introduce procfs interface to update PBHA0 bit arm64: mm: Set flag VM_PBHA_BIT0 for global init task arm64: mm: Introduce prctl to control pbha behavior arm64: mm: Introduce kernel param pbha openeuler: configs: arm64: Enable PBHA by default Marc Zyngier (1): arm64: Extract early FDT mapping from kaslr_early_init() .../admin-guide/kernel-parameters.txt | 8 + Documentation/arm64/index.rst | 1 + Documentation/arm64/pbha.rst | 85 +++ .../devicetree/bindings/arm/cpu.yaml | 537 ++++++++++++++++ .../devicetree/bindings/arm/cpus.yaml | 584 +++--------------- arch/arm64/Kconfig | 20 + arch/arm64/configs/openeuler_defconfig | 1 + arch/arm64/include/asm/cpucaps.h | 3 + arch/arm64/include/asm/cpufeature.h | 15 + arch/arm64/include/asm/kvm_arm.h | 1 + arch/arm64/include/asm/kvm_pgtable.h | 9 + arch/arm64/include/asm/mman.h | 10 + arch/arm64/include/asm/pgtable-hwdef.h | 6 + arch/arm64/include/asm/pgtable.h | 26 + arch/arm64/include/asm/setup.h | 3 + arch/arm64/include/uapi/asm/mman.h | 1 + arch/arm64/kernel/cpufeature.c | 258 ++++++++ arch/arm64/kernel/head.S | 6 +- arch/arm64/kernel/image-vars.h | 3 + arch/arm64/kernel/kaslr.c | 7 +- arch/arm64/kernel/setup.c | 15 + arch/arm64/kvm/reset.c | 15 +- arch/arm64/mm/hugetlbpage.c | 2 + arch/arm64/mm/mmu.c | 14 +- arch/arm64/mm/ptdump.c | 5 + .../firmware/efi/libstub/efi-stub-helper.c | 3 + drivers/firmware/efi/libstub/fdt.c | 57 ++ drivers/soc/hisilicon/Makefile | 1 + drivers/soc/hisilicon/pbha.c | 204 ++++++ fs/proc/base.c | 103 +++ fs/proc/task_mmu.c | 3 + include/linux/mm.h | 8 +- include/linux/pbha.h | 66 ++ include/uapi/asm-generic/mman-common.h | 1 + include/uapi/linux/prctl.h | 2 + kernel/sys.c | 10 + mm/memory.c | 4 + mm/vmalloc.c | 5 + 38 files changed, 1579 insertions(+), 523 deletions(-) create mode 100644 Documentation/arm64/pbha.rst create mode 100644 Documentation/devicetree/bindings/arm/cpu.yaml create mode 100644 drivers/soc/hisilicon/pbha.c create mode 100644 include/linux/pbha.h -- 2.25.1

2 20

[PATCH openEuler-1.0-LTS] ext4: fix rec_len verify error
by Baokun Li 16 Oct '23

16 Oct '23

From: Shida Zhang <zhangshida(a)kylinos.cn> stable inclusion from stable-v4.19.296 commit 996f30b44369fa2d1fe62d30a14ef27e05b30448 category: bugfix bugzilla: 189039, https://gitee.com/openeuler/kernel/issues/I7OXK8 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 7fda67e8c3ab6069f75888f67958a6d30454a9f6 upstream. With the configuration PAGE_SIZE 64k and filesystem blocksize 64k, a problem occurred when more than 13 million files were directly created under a directory: EXT4-fs error (device xx): ext4_dx_csum_set:492: inode #xxxx: comm xxxxx: dir seems corrupt? Run e2fsck -D. EXT4-fs error (device xx): ext4_dx_csum_verify:463: inode #xxxx: comm xxxxx: dir seems corrupt? Run e2fsck -D. EXT4-fs error (device xx): dx_probe:856: inode #xxxx: block 8188: comm xxxxx: Directory index failed checksum When enough files are created, the fake_dirent->reclen will be 0xffff. it doesn't equal to the blocksize 65536, i.e. 0x10000. But it is not the same condition when blocksize equals to 4k. when enough files are created, the fake_dirent->reclen will be 0x1000. it equals to the blocksize 4k, i.e. 0x1000. The problem seems to be related to the limitation of the 16-bit field when the blocksize is set to 64k. To address this, helpers like ext4_rec_len_{from,to}_disk has already been introduced to complete the conversion between the encoded and the plain form of rec_len. So fix this one by using the helper, and all the other in this file too. Cc: stable(a)kernel.org Fixes: dbe89444042a ("ext4: Calculate and verify checksums for htree nodes") Suggested-by: Andreas Dilger <adilger(a)dilger.ca> Suggested-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Shida Zhang <zhangshida(a)kylinos.cn> Reviewed-by: Andreas Dilger <adilger(a)dilger.ca> Reviewed-by: Darrick J. Wong <djwong(a)kernel.org> Link: https://lore.kernel.org/r/20230803060938.1929759-1-zhangshida@kylinos.cn Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Signed-off-by: Shida Zhang <zhangshida(a)kylinos.cn> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Baokun Li <libaokun1(a)huawei.com> --- fs/ext4/namei.c | 26 +++++++++++++++----------- 1 file changed, 15 insertions(+), 11 deletions(-) diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index 972611b72195..c55e1b64c38b 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -336,17 +336,17 @@ static struct ext4_dir_entry_tail *get_dirent_tail(struct inode *inode, struct ext4_dir_entry *de) { struct ext4_dir_entry_tail *t; + int blocksize = EXT4_BLOCK_SIZE(inode->i_sb); #ifdef PARANOID struct ext4_dir_entry *d, *top; d = de; top = (struct ext4_dir_entry *)(((void *)de) + - (EXT4_BLOCK_SIZE(inode->i_sb) - - sizeof(struct ext4_dir_entry_tail))); - while (d < top && d->rec_len) + (blocksize - sizeof(struct ext4_dir_entry_tail))); + while (d < top && ext4_rec_len_from_disk(d->rec_len, blocksize)) d = (struct ext4_dir_entry *)(((void *)d) + - le16_to_cpu(d->rec_len)); + ext4_rec_len_from_disk(d->rec_len, blocksize)); if (d != top) return NULL; @@ -357,7 +357,8 @@ static struct ext4_dir_entry_tail *get_dirent_tail(struct inode *inode, #endif if (t->det_reserved_zero1 || - le16_to_cpu(t->det_rec_len) != sizeof(struct ext4_dir_entry_tail) || + (ext4_rec_len_from_disk(t->det_rec_len, blocksize) != + sizeof(struct ext4_dir_entry_tail)) || t->det_reserved_zero2 || t->det_reserved_ft != EXT4_FT_DIR_CSUM) return NULL; @@ -439,13 +440,14 @@ static struct dx_countlimit *get_dx_countlimit(struct inode *inode, struct ext4_dir_entry *dp; struct dx_root_info *root; int count_offset; + int blocksize = EXT4_BLOCK_SIZE(inode->i_sb); + unsigned int rlen = ext4_rec_len_from_disk(dirent->rec_len, blocksize); - if (le16_to_cpu(dirent->rec_len) == EXT4_BLOCK_SIZE(inode->i_sb)) + if (rlen == blocksize) count_offset = 8; - else if (le16_to_cpu(dirent->rec_len) == 12) { + else if (rlen == 12) { dp = (struct ext4_dir_entry *)(((void *)dirent) + 12); - if (le16_to_cpu(dp->rec_len) != - EXT4_BLOCK_SIZE(inode->i_sb) - 12) + if (ext4_rec_len_from_disk(dp->rec_len, blocksize) != blocksize - 12) return NULL; root = (struct dx_root_info *)(((void *)dp + 12)); if (root->reserved_zero || @@ -1258,6 +1260,7 @@ static int dx_make_map(struct inode *dir, struct buffer_head *bh, unsigned int buflen = bh->b_size; char *base = bh->b_data; struct dx_hash_info h = *hinfo; + int blocksize = EXT4_BLOCK_SIZE(dir->i_sb); if (ext4_has_metadata_csum(dir->i_sb)) buflen -= sizeof(struct ext4_dir_entry_tail); @@ -1271,11 +1274,12 @@ static int dx_make_map(struct inode *dir, struct buffer_head *bh, map_tail--; map_tail->hash = h.hash; map_tail->offs = ((char *) de - base)>>2; - map_tail->size = le16_to_cpu(de->rec_len); + map_tail->size = ext4_rec_len_from_disk(de->rec_len, + blocksize); count++; cond_resched(); } - de = ext4_next_entry(de, dir->i_sb->s_blocksize); + de = ext4_next_entry(de, blocksize); } return count; } -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] netfilter: xt_u32: validate user space input
by Lu Wei 13 Oct '23

13 Oct '23

From: Wander Lairson Costa <wander(a)redhat.com> mainline inclusion from mainline-v6.6-rc1 commit 69c5d284f67089b4750d28ff6ac6f52ec224b330 category: bugfix bugzilla: 189278 CVE: CVE-2023-39192 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The xt_u32 module doesn't validate the fields in the xt_u32 structure. An attacker may take advantage of this to trigger an OOB read by setting the size fields with a value beyond the arrays boundaries. Add a checkentry function to validate the structure. This was originally reported by the ZDI project (ZDI-CAN-18408). Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match") Cc: stable(a)vger.kernel.org Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/netfilter/xt_u32.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c index a95b50342dbb..58ba402bc0b0 100644 --- a/net/netfilter/xt_u32.c +++ b/net/netfilter/xt_u32.c @@ -95,11 +95,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par) return ret ^ data->invert; } +static int u32_mt_checkentry(const struct xt_mtchk_param *par) +{ + const struct xt_u32 *data = par->matchinfo; + const struct xt_u32_test *ct; + unsigned int i; + + if (data->ntests > ARRAY_SIZE(data->tests)) + return -EINVAL; + + for (i = 0; i < data->ntests; ++i) { + ct = &data->tests[i]; + + if (ct->nnums > ARRAY_SIZE(ct->location) || + ct->nvalues > ARRAY_SIZE(ct->value)) + return -EINVAL; + } + + return 0; +} + static struct xt_match xt_u32_mt_reg __read_mostly = { .name = "u32", .revision = 0, .family = NFPROTO_UNSPEC, .match = u32_mt, + .checkentry = u32_mt_checkentry, .matchsize = sizeof(struct xt_u32), .me = THIS_MODULE, }; -- 2.34.1

2 1

[PATCH OLK-5.10] netfilter: xt_u32: validate user space input
by Lu Wei 13 Oct '23

13 Oct '23

From: Wander Lairson Costa <wander(a)redhat.com> mainline inclusion from mainline-v6.6-rc1 commit 69c5d284f67089b4750d28ff6ac6f52ec224b330 category: bugfix bugzilla: 189278 CVE: CVE-2023-39192 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The xt_u32 module doesn't validate the fields in the xt_u32 structure. An attacker may take advantage of this to trigger an OOB read by setting the size fields with a value beyond the arrays boundaries. Add a checkentry function to validate the structure. This was originally reported by the ZDI project (ZDI-CAN-18408). Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match") Cc: stable(a)vger.kernel.org Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/netfilter/xt_u32.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c index 177b40d08098..117d4615d668 100644 --- a/net/netfilter/xt_u32.c +++ b/net/netfilter/xt_u32.c @@ -96,11 +96,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par) return ret ^ data->invert; } +static int u32_mt_checkentry(const struct xt_mtchk_param *par) +{ + const struct xt_u32 *data = par->matchinfo; + const struct xt_u32_test *ct; + unsigned int i; + + if (data->ntests > ARRAY_SIZE(data->tests)) + return -EINVAL; + + for (i = 0; i < data->ntests; ++i) { + ct = &data->tests[i]; + + if (ct->nnums > ARRAY_SIZE(ct->location) || + ct->nvalues > ARRAY_SIZE(ct->value)) + return -EINVAL; + } + + return 0; +} + static struct xt_match xt_u32_mt_reg __read_mostly = { .name = "u32", .revision = 0, .family = NFPROTO_UNSPEC, .match = u32_mt, + .checkentry = u32_mt_checkentry, .matchsize = sizeof(struct xt_u32), .me = THIS_MODULE, }; -- 2.34.1

2 1

[PATCH OLK-5.10] netfilter: xt_u32: validate user space input
by Lu Wei 13 Oct '23

13 Oct '23

From: Wander Lairson Costa <wander(a)redhat.com> mainline inclusion from mainline-v6.6-rc1 commit 04a07b7392d47dea88b6bc00389655cf26c5ef46 category: bugfix bugzilla: 189278 CVE: CVE-2023-39192 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The xt_u32 module doesn't validate the fields in the xt_u32 structure. An attacker may take advantage of this to trigger an OOB read by setting the size fields with a value beyond the arrays boundaries. Add a checkentry function to validate the structure. This was originally reported by the ZDI project (ZDI-CAN-18408). Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match") Cc: stable(a)vger.kernel.org Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/netfilter/xt_u32.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c index 177b40d08098..117d4615d668 100644 --- a/net/netfilter/xt_u32.c +++ b/net/netfilter/xt_u32.c @@ -96,11 +96,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par) return ret ^ data->invert; } +static int u32_mt_checkentry(const struct xt_mtchk_param *par) +{ + const struct xt_u32 *data = par->matchinfo; + const struct xt_u32_test *ct; + unsigned int i; + + if (data->ntests > ARRAY_SIZE(data->tests)) + return -EINVAL; + + for (i = 0; i < data->ntests; ++i) { + ct = &data->tests[i]; + + if (ct->nnums > ARRAY_SIZE(ct->location) || + ct->nvalues > ARRAY_SIZE(ct->value)) + return -EINVAL; + } + + return 0; +} + static struct xt_match xt_u32_mt_reg __read_mostly = { .name = "u32", .revision = 0, .family = NFPROTO_UNSPEC, .match = u32_mt, + .checkentry = u32_mt_checkentry, .matchsize = sizeof(struct xt_u32), .me = THIS_MODULE, }; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] netfilter: xt_u32: validate user space input
by Lu Wei 13 Oct '23

13 Oct '23

From: Wander Lairson Costa <wander(a)redhat.com> mainline inclusion from mainline-v6.6-rc1 commit 04a07b7392d47dea88b6bc00389655cf26c5ef46 category: bugfix bugzilla: 189278 CVE: CVE-2023-39192 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The xt_u32 module doesn't validate the fields in the xt_u32 structure. An attacker may take advantage of this to trigger an OOB read by setting the size fields with a value beyond the arrays boundaries. Add a checkentry function to validate the structure. This was originally reported by the ZDI project (ZDI-CAN-18408). Fixes: 1b50b8a371e9 ("[NETFILTER]: Add u32 match") Cc: stable(a)vger.kernel.org Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/netfilter/xt_u32.c | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c index a95b50342dbb..58ba402bc0b0 100644 --- a/net/netfilter/xt_u32.c +++ b/net/netfilter/xt_u32.c @@ -95,11 +95,32 @@ static bool u32_mt(const struct sk_buff *skb, struct xt_action_param *par) return ret ^ data->invert; } +static int u32_mt_checkentry(const struct xt_mtchk_param *par) +{ + const struct xt_u32 *data = par->matchinfo; + const struct xt_u32_test *ct; + unsigned int i; + + if (data->ntests > ARRAY_SIZE(data->tests)) + return -EINVAL; + + for (i = 0; i < data->ntests; ++i) { + ct = &data->tests[i]; + + if (ct->nnums > ARRAY_SIZE(ct->location) || + ct->nvalues > ARRAY_SIZE(ct->value)) + return -EINVAL; + } + + return 0; +} + static struct xt_match xt_u32_mt_reg __read_mostly = { .name = "u32", .revision = 0, .family = NFPROTO_UNSPEC, .match = u32_mt, + .checkentry = u32_mt_checkentry, .matchsize = sizeof(struct xt_u32), .me = THIS_MODULE, }; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] netfilter: xt_sctp: validate the flag_info count
by Zhengchao Shao 13 Oct '23

13 Oct '23

From: Wander Lairson Costa <wander(a)redhat.com> stable inclusion from stable-v4.19.295 commit f25dbfadaf525d854597c16420dd753ca47b9396 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I85CAQ CVE: CVE-2023-39193 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e99476497687ef9e850748fe6d232264f30bc8f9 upstream. sctp_mt_check doesn't validate the flag_count field. An attacker can take advantage of that to trigger a OOB read and leak memory information. Add the field validation in the checkentry function. Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables") Cc: stable(a)vger.kernel.org Reported-by: Lucas Leong <wmliang(a)infosec.exchange> Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netfilter/xt_sctp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c index 2d2fa1d53ea6..05495d3f47b8 100644 --- a/net/netfilter/xt_sctp.c +++ b/net/netfilter/xt_sctp.c @@ -149,6 +149,8 @@ static int sctp_mt_check(const struct xt_mtchk_param *par) { const struct xt_sctp_info *info = par->matchinfo; + if (info->flag_count > ARRAY_SIZE(info->flag_info)) + return -EINVAL; if (info->flags & ~XT_SCTP_VALID_FLAGS) return -EINVAL; if (info->invflags & ~XT_SCTP_VALID_FLAGS) -- 2.34.1

2 1

[PATCH OLK-5.10] netfilter: xt_sctp: validate the flag_info count
by Zhengchao Shao 13 Oct '23

13 Oct '23

From: Wander Lairson Costa <wander(a)redhat.com> stable inclusion from stable-v5.10.195 commit 5541827d13cf19b905594eaee586527476efaa61 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I85CAQ CVE: CVE-2023-39193 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit e99476497687ef9e850748fe6d232264f30bc8f9 upstream. sctp_mt_check doesn't validate the flag_count field. An attacker can take advantage of that to trigger a OOB read and leak memory information. Add the field validation in the checkentry function. Fixes: 2e4e6a17af35 ("[NETFILTER] x_tables: Abstraction layer for {ip,ip6,arp}_tables") Cc: stable(a)vger.kernel.org Reported-by: Lucas Leong <wmliang(a)infosec.exchange> Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/netfilter/xt_sctp.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c index 680015ba7cb6..d4bf089c9e3f 100644 --- a/net/netfilter/xt_sctp.c +++ b/net/netfilter/xt_sctp.c @@ -150,6 +150,8 @@ static int sctp_mt_check(const struct xt_mtchk_param *par) { const struct xt_sctp_info *info = par->matchinfo; + if (info->flag_count > ARRAY_SIZE(info->flag_info)) + return -EINVAL; if (info->flags & ~XT_SCTP_VALID_FLAGS) return -EINVAL; if (info->invflags & ~XT_SCTP_VALID_FLAGS) -- 2.34.1

2 1

[PATCH OLK-5.10] netfilter: nfnetlink_osf: avoid OOB read
by Liu Jian 13 Oct '23

13 Oct '23

From: Wander Lairson Costa <wander(a)redhat.com> stable inclusion from stable-v5.10.195 commit 780f60dde29692c42091602fee9c25e9e391f3dc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I86MTP CVE: CVE-2023-39189 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit f4f8a7803119005e87b716874bec07c751efafec ] The opt_num field is controlled by user mode and is not currently validated inside the kernel. An attacker can take advantage of this to trigger an OOB read and potentially leak information. BUG: KASAN: slab-out-of-bounds in nf_osf_match_one+0xbed/0xd10 net/netfilter/nfnetlink_osf.c:88 Read of size 2 at addr ffff88804bc64272 by task poc/6431 CPU: 1 PID: 6431 Comm: poc Not tainted 6.0.0-rc4 #1 Call Trace: nf_osf_match_one+0xbed/0xd10 net/netfilter/nfnetlink_osf.c:88 nf_osf_find+0x186/0x2f0 net/netfilter/nfnetlink_osf.c:281 nft_osf_eval+0x37f/0x590 net/netfilter/nft_osf.c:47 expr_call_ops_eval net/netfilter/nf_tables_core.c:214 nft_do_chain+0x2b0/0x1490 net/netfilter/nf_tables_core.c:264 nft_do_chain_ipv4+0x17c/0x1f0 net/netfilter/nft_chain_filter.c:23 [..] Also add validation to genre, subtype and version fields. Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match") Reported-by: Lucas Leong <wmliang(a)infosec.exchange> Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/netfilter/nfnetlink_osf.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c index 51e3953b414c..260a655def34 100644 --- a/net/netfilter/nfnetlink_osf.c +++ b/net/netfilter/nfnetlink_osf.c @@ -316,6 +316,14 @@ static int nfnl_osf_add_callback(struct net *net, struct sock *ctnl, f = nla_data(osf_attrs[OSF_ATTR_FINGER]); + if (f->opt_num > ARRAY_SIZE(f->opt)) + return -EINVAL; + + if (!memchr(f->genre, 0, MAXGENRELEN) || + !memchr(f->subtype, 0, MAXGENRELEN) || + !memchr(f->version, 0, MAXGENRELEN)) + return -EINVAL; + kf = kmalloc(sizeof(struct nf_osf_finger), GFP_KERNEL); if (!kf) return -ENOMEM; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] netfilter: nfnetlink_osf: avoid OOB read
by Liu Jian 13 Oct '23

13 Oct '23

From: Wander Lairson Costa <wander(a)redhat.com> stable inclusion from stable-v4.19.295 commit 40d427ffccf9e60bd7288ea3748c066404a35622 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I86MTP CVE: CVE-2023-39189 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit f4f8a7803119005e87b716874bec07c751efafec ] The opt_num field is controlled by user mode and is not currently validated inside the kernel. An attacker can take advantage of this to trigger an OOB read and potentially leak information. BUG: KASAN: slab-out-of-bounds in nf_osf_match_one+0xbed/0xd10 net/netfilter/nfnetlink_osf.c:88 Read of size 2 at addr ffff88804bc64272 by task poc/6431 CPU: 1 PID: 6431 Comm: poc Not tainted 6.0.0-rc4 #1 Call Trace: nf_osf_match_one+0xbed/0xd10 net/netfilter/nfnetlink_osf.c:88 nf_osf_find+0x186/0x2f0 net/netfilter/nfnetlink_osf.c:281 nft_osf_eval+0x37f/0x590 net/netfilter/nft_osf.c:47 expr_call_ops_eval net/netfilter/nf_tables_core.c:214 nft_do_chain+0x2b0/0x1490 net/netfilter/nf_tables_core.c:264 nft_do_chain_ipv4+0x17c/0x1f0 net/netfilter/nft_chain_filter.c:23 [..] Also add validation to genre, subtype and version fields. Fixes: 11eeef41d5f6 ("netfilter: passive OS fingerprint xtables match") Reported-by: Lucas Leong <wmliang(a)infosec.exchange> Signed-off-by: Wander Lairson Costa <wander(a)redhat.com> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> --- net/netfilter/nfnetlink_osf.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/net/netfilter/nfnetlink_osf.c b/net/netfilter/nfnetlink_osf.c index 917f06110c82..46713818228c 100644 --- a/net/netfilter/nfnetlink_osf.c +++ b/net/netfilter/nfnetlink_osf.c @@ -318,6 +318,14 @@ static int nfnl_osf_add_callback(struct net *net, struct sock *ctnl, f = nla_data(osf_attrs[OSF_ATTR_FINGER]); + if (f->opt_num > ARRAY_SIZE(f->opt)) + return -EINVAL; + + if (!memchr(f->genre, 0, MAXGENRELEN) || + !memchr(f->subtype, 0, MAXGENRELEN) || + !memchr(f->version, 0, MAXGENRELEN)) + return -EINVAL; + kf = kmalloc(sizeof(struct nf_osf_finger), GFP_KERNEL); if (!kf) return -ENOMEM; -- 2.34.1

2 1