- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 0/2] media: usb: siano: Fix CVE-2023-4132
by Ruan Jinjie 07 Aug '23

07 Aug '23

Backport CVE-2023-4132 fix commits. Duoming Zhou (2): media: usb: siano: Fix use after free bugs caused by do_submit_urb media: usb: siano: Fix warning due to null work_func_t function pointer drivers/media/usb/siano/smsusb.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.34.1

2 3

[PATCH OLK-5.10 0/2] media: usb: siano: Fix CVE-2023-4132
by Ruan Jinjie 07 Aug '23

07 Aug '23

Backport CVE-2023-4132 fix commits. Duoming Zhou (2): media: usb: siano: Fix use after free bugs caused by do_submit_urb media: usb: siano: Fix warning due to null work_func_t function pointer drivers/media/usb/siano/smsusb.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.34.1

2 3

[PATCH openEuler-1.0-LTS] can: bcm: Fix UAF in bcm_proc_show()
by Dong Chenchen 07 Aug '23

07 Aug '23

From: YueHaibing <yuehaibing(a)huawei.com> mainline inclusion from mainline-v6.5-rc1 commit 55c3b96074f3f9b0aee19bf93cd71af7516582bb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7R1N4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- BUG: KASAN: slab-use-after-free in bcm_proc_show+0x969/0xa80 Read of size 8 at addr ffff888155846230 by task cat/7862 CPU: 1 PID: 7862 Comm: cat Not tainted 6.5.0-rc1-00153-gc8746099c197 #230 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Call Trace: <TASK> dump_stack_lvl+0xd5/0x150 print_report+0xc1/0x5e0 kasan_report+0xba/0xf0 bcm_proc_show+0x969/0xa80 seq_read_iter+0x4f6/0x1260 seq_read+0x165/0x210 proc_reg_read+0x227/0x300 vfs_read+0x1d5/0x8d0 ksys_read+0x11e/0x240 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Allocated by task 7846: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 __kasan_kmalloc+0x9e/0xa0 bcm_sendmsg+0x264b/0x44e0 sock_sendmsg+0xda/0x180 ____sys_sendmsg+0x735/0x920 ___sys_sendmsg+0x11d/0x1b0 __sys_sendmsg+0xfa/0x1d0 do_syscall_64+0x35/0xb0 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 7846: kasan_save_stack+0x1e/0x40 kasan_set_track+0x21/0x30 kasan_save_free_info+0x27/0x40 ____kasan_slab_free+0x161/0x1c0 slab_free_freelist_hook+0x119/0x220 __kmem_cache_free+0xb4/0x2e0 rcu_core+0x809/0x1bd0 bcm_op is freed before procfs entry be removed in bcm_release(), this lead to bcm_proc_show() may read the freed bcm_op. Fixes: ffd980f976e7 ("[CAN]: Add broadcast manager (bcm) protocol") Signed-off-by: YueHaibing <yuehaibing(a)huawei.com> Reviewed-by: Oliver Hartkopp <socketcan(a)hartkopp.net> Acked-by: Oliver Hartkopp <socketcan(a)hartkopp.net> Link: https://lore.kernel.org/all/20230715092543.15548-1-yuehaibing@huawei.com Cc: stable(a)vger.kernel.org Signed-off-by: Marc Kleine-Budde <mkl(a)pengutronix.de> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/can/bcm.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/net/can/bcm.c b/net/can/bcm.c index f0af3861c959..a78d4ddd615a 100644 --- a/net/can/bcm.c +++ b/net/can/bcm.c @@ -1506,6 +1506,12 @@ static int bcm_release(struct socket *sock) lock_sock(sk); +#if IS_ENABLED(CONFIG_PROC_FS) + /* remove procfs entry */ + if (net->can.bcmproc_dir && bo->bcm_proc_read) + remove_proc_entry(bo->procname, net->can.bcmproc_dir); +#endif /* CONFIG_PROC_FS */ + list_for_each_entry_safe(op, next, &bo->tx_ops, list) bcm_remove_op(op); @@ -1541,12 +1547,6 @@ static int bcm_release(struct socket *sock) list_for_each_entry_safe(op, next, &bo->rx_ops, list) bcm_remove_op(op); -#if IS_ENABLED(CONFIG_PROC_FS) - /* remove procfs entry */ - if (net->can.bcmproc_dir && bo->bcm_proc_read) - remove_proc_entry(bo->procname, net->can.bcmproc_dir); -#endif /* CONFIG_PROC_FS */ - /* remove device reference */ if (bo->bound) { bo->bound = 0; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS] Revert "arm64/mpam: Fix mpam corrupt when cpu online"
by Wang ShaoBo 07 Aug '23

07 Aug '23

hulk inclusion category: bugfix bugzilla: 189067, https://gitee.com/openeuler/kernel/issues/I7PN0A CVE: NA ------------------------------------------------- BUG 'sleeping function called from invalid context' reported when setup MPAM driver, it was blamed to bc9e3f9895ef2 ("arm64/mpam: Fix mpam corrupt when cpu online"), which reported a 'Bad PC' BUG, but missing the right conclusion, finally disabling irqs before calling cpuhp_setup_state() may only affect the probability of reproduction. The reason why triggerring 'Bad PC' BUG report is because mpam_enable() is __init type function, and may schedule out after calling __cpuhp_setup_state()->__might_sleep(), so the space of mpam_enable() might be freed after scheduling back. As we have changed mpam_enable() to non-init type function, we can revert commit bc9e3f9895ef2 directly, to solve these both two problems. Fixes: bc9e3f9895ef2 ("arm64/mpam: Fix mpam corrupt when cpu online") Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_device.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index c59f7f09308dc..bb88db115a86c 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -596,11 +596,9 @@ static void mpam_enable(struct work_struct *work) pr_err("Failed to setup/init resctrl\n"); mutex_unlock(&mpam_devices_lock); - local_irq_disable(); mpam_cpuhp_state = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "mpam:online", mpam_cpu_online, mpam_cpu_offline); - local_irq_enable(); if (mpam_cpuhp_state <= 0) pr_err("Failed to re-register 'dyn' cpuhp callbacks"); mutex_unlock(&mpam_cpuhp_lock); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 0/2] media: usb: siano: Fix CVE-2023-4132
by Ruan Jinjie 07 Aug '23

07 Aug '23

Backport CVE-2023-4132 fix commits. Duoming Zhou (2): media: usb: siano: Fix use after free bugs caused by do_submit_urb media: usb: siano: Fix warning due to null work_func_t function pointer drivers/media/usb/siano/smsusb.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.34.1

2 3

[PATCH openEuler-22.03-LTS 0/2] media: usb: siano: Fix CVE-2023-4132
by Ruan Jinjie 07 Aug '23

07 Aug '23

Backport CVE-2023-4132 fix commits. Duoming Zhou (2): media: usb: siano: Fix use after free bugs caused by do_submit_urb media: usb: siano: Fix warning due to null work_func_t function pointer drivers/media/usb/siano/smsusb.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.34.1

2 3

【开发过程疑问】
by Hu, Yong 07 Aug '23

07 Aug '23

问题描述： x86服务器上安装openEuler 22.03-LTS官方发布的ISO后运行oech测试，kabi及system测试通过。而基于openEuler官方gitee仓库中的openEuler-22.03-LTS分支升级kernel镜像后，运行oech测试中kabi测试失败。我们的疑问： 1. 为什么使用官方代码升级kernel后oech测试中的kabi测试会失败？ 2. oech中kabi测试项的测试原理是什么？ 3. 如何定位和解决kabi测试失败的问题？期待社区的回复和解答谢谢！

1 0

[PATCH openEuler-1.0-LTS] x86/apic: Fix kernel panic when booting with intremap=off and x2apic_phys
by Lin Yujun 07 Aug '23

07 Aug '23

From: Dheeraj Kumar Srivastava <dheerajkumar.srivastava(a)amd.com> stable inclusion from stable-v4.19.288 commit 6f639f6ad1796d291f5e0ea4bd5a47968c9c1f81 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7R0M9 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 85d38d5810e285d5aec7fb5283107d1da70c12a9 ] When booting with "intremap=off" and "x2apic_phys" on the kernel command line, the physical x2APIC driver ends up being used even when x2APIC mode is disabled ("intremap=off" disables x2APIC mode). This happens because the first compound condition check in x2apic_phys_probe() is false due to x2apic_mode == 0 and so the following one returns true after default_acpi_madt_oem_check() having already selected the physical x2APIC driver. This results in the following panic: kernel BUG at arch/x86/kernel/apic/io_apic.c:2409! invalid opcode: 0000 [#1] PREEMPT SMP NOPTI CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.4.0-rc2-ver4.1rc2 #2 Hardware name: Dell Inc. PowerEdge R6515/07PXPY, BIOS 2.3.6 07/06/2021 RIP: 0010:setup_IO_APIC+0x9c/0xaf0 Call Trace: <TASK> ? native_read_msr apic_intr_mode_init x86_late_time_init start_kernel x86_64_start_reservations x86_64_start_kernel secondary_startup_64_no_verify </TASK> which is: setup_IO_APIC: apic_printk(APIC_VERBOSE, "ENABLING IO-APIC IRQs\n"); for_each_ioapic(ioapic) BUG_ON(mp_irqdomain_create(ioapic)); Return 0 to denote that x2APIC has not been enabled when probing the physical x2APIC driver. [ bp: Massage commit message heavily. ] Fixes: 9ebd680bd029 ("x86, apic: Use probe routines to simplify apic selection") Signed-off-by: Dheeraj Kumar Srivastava <dheerajkumar.srivastava(a)amd.com> Signed-off-by: Borislav Petkov (AMD) <bp(a)alien8.de> Reviewed-by: Kishon Vijay Abraham I <kvijayab(a)amd.com> Reviewed-by: Vasant Hegde <vasant.hegde(a)amd.com> Reviewed-by: Cyrill Gorcunov <gorcunov(a)gmail.com> Reviewed-by: Thomas Gleixner <tglx(a)linutronix.de> Link: https://lore.kernel.org/r/20230616212236.1389-1-dheerajkumar.srivastava@amd… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lin Yujun <linyujun809(a)huawei.com> --- arch/x86/kernel/apic/x2apic_phys.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/arch/x86/kernel/apic/x2apic_phys.c b/arch/x86/kernel/apic/x2apic_phys.c index b5cf9e7b3830..78790c4bfdeb 100644 --- a/arch/x86/kernel/apic/x2apic_phys.c +++ b/arch/x86/kernel/apic/x2apic_phys.c @@ -94,7 +94,10 @@ static void init_x2apic_ldr(void) static int x2apic_phys_probe(void) { - if (x2apic_mode && (x2apic_phys || x2apic_fadt_phys())) + if (!x2apic_mode) + return 0; + + if (x2apic_phys || x2apic_fadt_phys()) return 1; return apic == &apic_x2apic_phys; -- 2.34.1

2 1

[OLK-5.10 PATCH] vfio-pci: Match specific devices with vendor id and device id
by Kunkun Jiang 07 Aug '23

07 Aug '23

virt inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7QPGW CVE: NA ------------------------------------------------------------------ In probe_vendor_drivers, all registered vendor drivers are traversed. This is not a good idea. If a vendor driver is not implemented well enough, it may cause the system to panic. Use the vendor id and device id to select a proper driver. In the previous device registration logic, since the live migration operation ops of the three accelerator devices is the same. Therefore, only one driver entity will be registered. As a result, only the first sec will be loaded successfully, while hpre and zip cannot be loaded. The acc live migration driver needs to be adapted. Signed-off-by: Longfang Liu <liulongfang(a)huawei.com> Signed-off-by: Kunkun Jiang <jiangkunkun(a)huawei.com> --- .../crypto/hisilicon/migration/acc_vf_migration.c | 10 +++++++++- drivers/vfio/pci/vfio_pci.c | 12 +++++++++--- include/linux/vfio.h | 5 ++++- 3 files changed, 22 insertions(+), 5 deletions(-) diff --git a/drivers/crypto/hisilicon/migration/acc_vf_migration.c b/drivers/crypto/hisilicon/migration/acc_vf_migration.c index e4164aed173e..7360536b5c6c 100644 --- a/drivers/crypto/hisilicon/migration/acc_vf_migration.c +++ b/drivers/crypto/hisilicon/migration/acc_vf_migration.c @@ -1739,6 +1739,8 @@ static void acc_vf_remove(void *vendor_data) static struct vfio_pci_vendor_driver_ops sec_vf_mig_ops = { .owner = THIS_MODULE, .name = "hisi_sec2", + .vendor = PCI_VENDOR_ID_HUAWEI, + .device = PCI_DEVICE_ID_HUAWEI_SEC_VF, .probe = acc_vf_probe, .remove = acc_vf_remove, .device_ops = &acc_vf_device_ops_node, @@ -1747,6 +1749,8 @@ static struct vfio_pci_vendor_driver_ops sec_vf_mig_ops = { static struct vfio_pci_vendor_driver_ops hpre_vf_mig_ops = { .owner = THIS_MODULE, .name = "hisi_hpre", + .vendor = PCI_VENDOR_ID_HUAWEI, + .device = PCI_DEVICE_ID_HUAWEI_HPRE_VF, .probe = acc_vf_probe, .remove = acc_vf_remove, .device_ops = &acc_vf_device_ops_node, @@ -1755,6 +1759,8 @@ static struct vfio_pci_vendor_driver_ops hpre_vf_mig_ops = { static struct vfio_pci_vendor_driver_ops zip_vf_mig_ops = { .owner = THIS_MODULE, .name = "hisi_zip", + .vendor = PCI_VENDOR_ID_HUAWEI, + .device = PCI_DEVICE_ID_HUAWEI_ZIP_VF, .probe = acc_vf_probe, .remove = acc_vf_remove, .device_ops = &acc_vf_device_ops_node, @@ -1773,7 +1779,9 @@ static int __init acc_vf_module_init(void) static void __exit acc_vf_module_exit(void) { - vfio_pci_unregister_vendor_driver(&acc_vf_device_ops_node); + vfio_pci_unregister_vendor_driver(&sec_vf_mig_ops); + vfio_pci_unregister_vendor_driver(&hpre_vf_mig_ops); + vfio_pci_unregister_vendor_driver(&zip_vf_mig_ops); }; module_init(acc_vf_module_init); module_exit(acc_vf_module_exit); diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c index 6d7ae4e3b983..8eaaa06b97b8 100644 --- a/drivers/vfio/pci/vfio_pci.c +++ b/drivers/vfio/pci/vfio_pci.c @@ -2077,6 +2077,10 @@ static int probe_vendor_drivers(struct vfio_pci_device *vdev) list_for_each_entry(driver, &vfio_pci.vendor_drivers_list, next) { void *data; + if (vdev->pdev->vendor != driver->ops->vendor || + vdev->pdev->device != driver->ops->device) + continue; + if (!try_module_get(driver->ops->owner)) continue; @@ -2604,7 +2608,8 @@ int __vfio_pci_register_vendor_driver(struct vfio_pci_vendor_driver_ops *ops) /* Check for duplicates */ list_for_each_entry(tmp, &vfio_pci.vendor_drivers_list, next) { - if (tmp->ops->device_ops == ops->device_ops) { + if (tmp->ops->vendor == ops->vendor && + tmp->ops->device == ops->device) { mutex_unlock(&vfio_pci.vendor_drivers_lock); kfree(driver); return -EINVAL; @@ -2622,14 +2627,15 @@ int __vfio_pci_register_vendor_driver(struct vfio_pci_vendor_driver_ops *ops) } EXPORT_SYMBOL_GPL(__vfio_pci_register_vendor_driver); -void vfio_pci_unregister_vendor_driver(struct vfio_device_ops *device_ops) +void vfio_pci_unregister_vendor_driver(struct vfio_pci_vendor_driver_ops *ops) { struct vfio_pci_vendor_driver *driver, *tmp; mutex_lock(&vfio_pci.vendor_drivers_lock); list_for_each_entry_safe(driver, tmp, &vfio_pci.vendor_drivers_list, next) { - if (driver->ops->device_ops == device_ops) { + if (driver->ops->vendor == ops->vendor && + driver->ops->device == ops->device) { list_del(&driver->next); mutex_unlock(&vfio_pci.vendor_drivers_lock); kfree(driver); diff --git a/include/linux/vfio.h b/include/linux/vfio.h index 9a2217f13753..f516784e0356 100644 --- a/include/linux/vfio.h +++ b/include/linux/vfio.h @@ -253,12 +253,15 @@ extern int vfio_pci_set_vendor_regions(void *device_data, struct vfio_pci_vendor_driver_ops { char *name; struct module *owner; + /* Used to match device */ + unsigned short vendor; + unsigned short device; void *(*probe)(struct pci_dev *pdev); void (*remove)(void *vendor_data); struct vfio_device_ops *device_ops; }; int __vfio_pci_register_vendor_driver(struct vfio_pci_vendor_driver_ops *ops); -void vfio_pci_unregister_vendor_driver(struct vfio_device_ops *device_ops); +void vfio_pci_unregister_vendor_driver(struct vfio_pci_vendor_driver_ops *ops); #define vfio_pci_register_vendor_driver(__name, __probe, __remove, \ __device_ops) \ -- 2.33.0

1 0

[PATCH OLK-5.10] mm: disable kernelcore=mirror when no mirror memory
by Wupeng Ma 06 Aug '23

06 Aug '23

From: Ma Wupeng <mawupeng1(a)huawei.com> maillist inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7QV2C CVE: NA Reference: https://lkml.kernel.org/r/20230802072328.2107981-1-mawupeng1@huawei.com -------------------------------- For system with kernelcore=mirror enabled while no mirrored memory is reported by efi. This could lead to kernel OOM during startup since all memory beside zone DMA are in the movable zone and this prevents the kernel to use it. Zone DMA/DMA32 initialization is independent of mirrored memory and their max pfn is set in zone_sizes_init(). Since kernel can fallback to zone DMA/DMA32 if there is no memory in zone Normal, these zones are seen as mirrored memory no mather their memory attributes are. To solve this problem, disable kernelcore=mirror when there is no real mirrored memory exists. Link: https://lkml.kernel.org/r/20230802072328.2107981-1-mawupeng1@huawei.com Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Suggested-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Suggested-by: Mike Rapoport <rppt(a)kernel.org> Reviewed-by: Mike Rapoport (IBM) <rppt(a)kernel.org> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Cc: Levi Yun <ppbuk5246(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> --- include/linux/mm.h | 1 + mm/memblock.c | 5 +++++ mm/page_alloc.c | 5 +++++ 3 files changed, 11 insertions(+) diff --git a/include/linux/mm.h b/include/linux/mm.h index 58d7a59b5b65..34400f909335 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h @@ -2493,6 +2493,7 @@ extern void get_pfn_range_for_nid(unsigned int nid, extern unsigned long find_min_pfn_with_active_regions(void); extern bool mirrored_kernelcore; +extern bool memblock_has_mirror(void); #ifndef CONFIG_NEED_MULTIPLE_NODES static inline int early_pfn_to_nid(unsigned long pfn) diff --git a/mm/memblock.c b/mm/memblock.c index b7744ae2ce3d..94008ef55a82 100644 --- a/mm/memblock.c +++ b/mm/memblock.c @@ -161,6 +161,11 @@ static int memblock_can_resize __initdata_memblock; static int memblock_memory_in_slab __initdata_memblock = 0; static int memblock_reserved_in_slab __initdata_memblock = 0; +bool __init_memblock memblock_has_mirror(void) +{ + return system_has_some_mirror; +} + static enum memblock_flags __init_memblock choose_memblock_flags(void) { return system_has_some_mirror ? MEMBLOCK_MIRROR : MEMBLOCK_NONE; diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 12da70f39e0c..d797bbac809d 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -7741,6 +7741,11 @@ static void __init find_zone_movable_pfns_for_nodes(void) bool has_unmirrored_mem = false; unsigned long mirrored_sz = 0; + if (!memblock_has_mirror()) { + pr_warn("The system has no mirror memory, ignore kernelcore=mirror.\n"); + goto out; + } + for_each_mem_region(r) { if (memblock_is_mirror(r)) { mirrored_sz += r->size; -- 2.25.1

2 1

[openEuler-1.0-LTS 0/2] media: usb: siano: Fix CVE-2023-4132
by Ruan Jinjie 05 Aug '23

05 Aug '23

Backport CVE-2023-4132 fix commits. Duoming Zhou (2): media: usb: siano: Fix use after free bugs caused by do_submit_urb media: usb: siano: Fix warning due to null work_func_t function pointer drivers/media/usb/siano/smsusb.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.34.1

1 2

[openEuler-1.0-LTS 0/2] media: usb: siano: Fix CVE-2023-4132
by Ruan Jinjie 05 Aug '23

05 Aug '23

Backport CVE-2023-4132 fix commits. Duoming Zhou (2): media: usb: siano: Fix use after free bugs caused by do_submit_urb media: usb: siano: Fix warning due to null work_func_t function pointer drivers/media/usb/siano/smsusb.c | 2 ++ 1 file changed, 2 insertions(+) -- 2.34.1

1 2

[PATCH v2 openEuler-23.09 00/46]ima: Add IMA digest lists extension
by Zhou Shuiqing 04 Aug '23

04 Aug '23

This patchset supports IMA digest lists for the kernel. v2: -remove unused variable in ima_main.c David Howells (4): PGPLIB: PGP definitions (RFC 4880) PGPLIB: Basic packet parser KEYS: Provide PGP key description autogeneration KEYS: Provide a function to load keys from a PGP keyring blob Mimi Zohar (1): initramfs: add file metadata Roberto Sassu (34): initramfs: read metadata from special file METADATA!!! gen_init_cpio: add support for file metadata init: Add kernel option to force usage of tmpfs for rootfs ima: Add enforce-evm and log-evm modes to strictly check EVM status ima: Allow choice of file hash algorithm for measurement and audit ima: Generalize ima_read_policy() ima: Generalize ima_write_policy() and raise uploaded data size limit ima: Generalize policy file operations ima: Use ima_show_htable_value to show violations and hash table data ima: Add parser of compact digest list ima: Prevent usage of digest lists not measured or appraised ima: Introduce new securityfs files ima: Introduce new hook DIGEST_LIST_CHECK ima: Load all digest lists from a directory at boot time ima: Add support for measurement with digest lists ima: Add support for appraisal with digest lists evm: Add support for digest lists of metadata ima: Add meta_immutable appraisal type ima: Introduce exec_tcb policy ima: Introduce appraise_exec_tcb policy ima: Introduce appraise_exec_immutable policy ima: Add Documentation/security/IMA-digest-lists.txt mpi: introduce mpi_key_length() rsa: add parser of raw format KEYS: PGP data parser KEYS: Introduce load_pgp_public_keyring() certs: Introduce search_trusted_key() ima: Search key in the built-in keyrings ima: Allow direct upload of digest lists to securityfs ima: Add parser keyword to the policy evm: Extend evm= with x509. allow_metadata_writes and complete values ima: Execute parser to upload digest lists not recognizable by the kernel evm: Propagate choice of HMAC algorithm in evm_crypto.c config: add digest list options for arm64 and x86 Zhang Tianxing (5): ima: fix a memory leak in ima_del_digest_data_entry ima: Add max size for IMA digest database ima: don't allow control characters in policy path ima: fix CONFIG_IMA_DIGEST_DB_MEGABYTES in openeuler_defconfig ima: fix db size overflow and Kconfig issues Zheng Zengkai (1): Revert "evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded" shenxiangwei (1): ima: bugfix for digest lists importing Documentation/ABI/testing/evm | 4 +- .../admin-guide/kernel-parameters.txt | 49 +- Documentation/security/IMA-digest-lists.txt | 259 ++++++++++ arch/arm64/configs/openeuler_defconfig | 11 + arch/x86/configs/openeuler_defconfig | 31 +- certs/Kconfig | 7 + certs/Makefile | 7 + certs/system_certificates.S | 18 + certs/system_keyring.c | 44 ++ crypto/asymmetric_keys/Kconfig | 25 + crypto/asymmetric_keys/Makefile | 10 + crypto/asymmetric_keys/pgp_library.c | 281 +++++++++++ crypto/asymmetric_keys/pgp_parser.h | 23 + crypto/asymmetric_keys/pgp_preload.c | 119 +++++ crypto/asymmetric_keys/pgp_public_key.c | 383 +++++++++++++++ crypto/rsa.c | 14 +- crypto/rsa_helper.c | 69 +++ include/crypto/internal/rsa.h | 6 + include/linux/initramfs.h | 21 + include/linux/kernel_read_file.h | 1 + include/linux/mpi.h | 2 + include/linux/pgp.h | 220 +++++++++ include/linux/pgplib.h | 48 ++ include/linux/verification.h | 4 + init/do_mounts.c | 11 +- init/initramfs.c | 138 +++++- lib/mpi/mpicoder.c | 33 +- security/integrity/digsig_asymmetric.c | 10 + security/integrity/evm/Kconfig | 32 ++ security/integrity/evm/evm.h | 1 + security/integrity/evm/evm_crypto.c | 24 +- security/integrity/evm/evm_main.c | 103 +++- security/integrity/evm/evm_secfs.c | 2 +- security/integrity/iint.c | 2 + security/integrity/ima/Kconfig | 49 ++ security/integrity/ima/Makefile | 1 + security/integrity/ima/ima.h | 39 +- security/integrity/ima/ima_api.c | 42 +- security/integrity/ima/ima_appraise.c | 117 ++++- security/integrity/ima/ima_digest_list.c | 465 ++++++++++++++++++ security/integrity/ima/ima_digest_list.h | 54 ++ security/integrity/ima/ima_fs.c | 294 ++++++++--- security/integrity/ima/ima_init.c | 2 +- security/integrity/ima/ima_main.c | 124 ++++- security/integrity/ima/ima_policy.c | 116 ++++- security/integrity/integrity.h | 47 +- usr/Kconfig | 8 + usr/Makefile | 4 +- usr/gen_init_cpio.c | 136 ++++- usr/gen_initramfs.sh | 7 +- 50 files changed, 3299 insertions(+), 218 deletions(-) create mode 100644 Documentation/security/IMA-digest-lists.txt create mode 100644 crypto/asymmetric_keys/pgp_library.c create mode 100644 crypto/asymmetric_keys/pgp_parser.h create mode 100644 crypto/asymmetric_keys/pgp_preload.c create mode 100644 crypto/asymmetric_keys/pgp_public_key.c create mode 100644 include/linux/initramfs.h create mode 100644 include/linux/pgp.h create mode 100644 include/linux/pgplib.h create mode 100644 security/integrity/ima/ima_digest_list.c create mode 100644 security/integrity/ima/ima_digest_list.h -- 2.33.0

2 47

[OLK-5.10 PATCH] vfio-pci: Match specific devices with vendor id and device id
by Kunkun Jiang 04 Aug '23

04 Aug '23

virt inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7QPGW CVE: NA ------------------------------------------------------------------ In probe_vendor_drivers, all registered vendor drivers are traversed. This is not a good idea. If a vendor driver is not implemented well enough, it may cause the system to panic. Use the vendor id and device id to select a proper driver. In the previous device registration logic, since the live migration operation ops of the three accelerator devices is the same. Therefore, only one driver entity will be registered. As a result, only the first sec will be loaded successfully, while hpre and zip cannot be loaded. The acc live migration driver needs to be adapted. Signed-off-by: Longfang Liu <liulongfang(a)huawei.com> Signed-off-by: Kunkun Jiang <jiangkunkun(a)huawei.com> --- .../crypto/hisilicon/migration/acc_vf_migration.c | 10 +++++++++- drivers/vfio/pci/vfio_pci.c | 12 +++++++++--- include/linux/vfio.h | 5 ++++- 3 files changed, 22 insertions(+), 5 deletions(-) diff --git a/drivers/crypto/hisilicon/migration/acc_vf_migration.c b/drivers/crypto/hisilicon/migration/acc_vf_migration.c index e4164aed173e..7360536b5c6c 100644 --- a/drivers/crypto/hisilicon/migration/acc_vf_migration.c +++ b/drivers/crypto/hisilicon/migration/acc_vf_migration.c @@ -1739,6 +1739,8 @@ static void acc_vf_remove(void *vendor_data) static struct vfio_pci_vendor_driver_ops sec_vf_mig_ops = { .owner = THIS_MODULE, .name = "hisi_sec2", + .vendor = PCI_VENDOR_ID_HUAWEI, + .device = PCI_DEVICE_ID_HUAWEI_SEC_VF, .probe = acc_vf_probe, .remove = acc_vf_remove, .device_ops = &acc_vf_device_ops_node, @@ -1747,6 +1749,8 @@ static struct vfio_pci_vendor_driver_ops sec_vf_mig_ops = { static struct vfio_pci_vendor_driver_ops hpre_vf_mig_ops = { .owner = THIS_MODULE, .name = "hisi_hpre", + .vendor = PCI_VENDOR_ID_HUAWEI, + .device = PCI_DEVICE_ID_HUAWEI_HPRE_VF, .probe = acc_vf_probe, .remove = acc_vf_remove, .device_ops = &acc_vf_device_ops_node, @@ -1755,6 +1759,8 @@ static struct vfio_pci_vendor_driver_ops hpre_vf_mig_ops = { static struct vfio_pci_vendor_driver_ops zip_vf_mig_ops = { .owner = THIS_MODULE, .name = "hisi_zip", + .vendor = PCI_VENDOR_ID_HUAWEI, + .device = PCI_DEVICE_ID_HUAWEI_ZIP_VF, .probe = acc_vf_probe, .remove = acc_vf_remove, .device_ops = &acc_vf_device_ops_node, @@ -1773,7 +1779,9 @@ static int __init acc_vf_module_init(void) static void __exit acc_vf_module_exit(void) { - vfio_pci_unregister_vendor_driver(&acc_vf_device_ops_node); + vfio_pci_unregister_vendor_driver(&sec_vf_mig_ops); + vfio_pci_unregister_vendor_driver(&hpre_vf_mig_ops); + vfio_pci_unregister_vendor_driver(&zip_vf_mig_ops); }; module_init(acc_vf_module_init); module_exit(acc_vf_module_exit); diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c index 6d7ae4e3b983..8eaaa06b97b8 100644 --- a/drivers/vfio/pci/vfio_pci.c +++ b/drivers/vfio/pci/vfio_pci.c @@ -2077,6 +2077,10 @@ static int probe_vendor_drivers(struct vfio_pci_device *vdev) list_for_each_entry(driver, &vfio_pci.vendor_drivers_list, next) { void *data; + if (vdev->pdev->vendor != driver->ops->vendor || + vdev->pdev->device != driver->ops->device) + continue; + if (!try_module_get(driver->ops->owner)) continue; @@ -2604,7 +2608,8 @@ int __vfio_pci_register_vendor_driver(struct vfio_pci_vendor_driver_ops *ops) /* Check for duplicates */ list_for_each_entry(tmp, &vfio_pci.vendor_drivers_list, next) { - if (tmp->ops->device_ops == ops->device_ops) { + if (tmp->ops->vendor == ops->vendor && + tmp->ops->device == ops->device) { mutex_unlock(&vfio_pci.vendor_drivers_lock); kfree(driver); return -EINVAL; @@ -2622,14 +2627,15 @@ int __vfio_pci_register_vendor_driver(struct vfio_pci_vendor_driver_ops *ops) } EXPORT_SYMBOL_GPL(__vfio_pci_register_vendor_driver); -void vfio_pci_unregister_vendor_driver(struct vfio_device_ops *device_ops) +void vfio_pci_unregister_vendor_driver(struct vfio_pci_vendor_driver_ops *ops) { struct vfio_pci_vendor_driver *driver, *tmp; mutex_lock(&vfio_pci.vendor_drivers_lock); list_for_each_entry_safe(driver, tmp, &vfio_pci.vendor_drivers_list, next) { - if (driver->ops->device_ops == device_ops) { + if (driver->ops->vendor == ops->vendor && + driver->ops->device == ops->device) { list_del(&driver->next); mutex_unlock(&vfio_pci.vendor_drivers_lock); kfree(driver); diff --git a/include/linux/vfio.h b/include/linux/vfio.h index 9a2217f13753..f516784e0356 100644 --- a/include/linux/vfio.h +++ b/include/linux/vfio.h @@ -253,12 +253,15 @@ extern int vfio_pci_set_vendor_regions(void *device_data, struct vfio_pci_vendor_driver_ops { char *name; struct module *owner; + /* Used to match device */ + unsigned short vendor; + unsigned short device; void *(*probe)(struct pci_dev *pdev); void (*remove)(void *vendor_data); struct vfio_device_ops *device_ops; }; int __vfio_pci_register_vendor_driver(struct vfio_pci_vendor_driver_ops *ops); -void vfio_pci_unregister_vendor_driver(struct vfio_device_ops *device_ops); +void vfio_pci_unregister_vendor_driver(struct vfio_pci_vendor_driver_ops *ops); #define vfio_pci_register_vendor_driver(__name, __probe, __remove, \ __device_ops) \ -- 2.33.0

1 0

[PATCH openEuler-23.09 00/46]ima: Add IMA digest lists extension
by Zhou Shuiqing 04 Aug '23

04 Aug '23

This patchset supports IMA digest lists for the kernel. David Howells (4): PGPLIB: PGP definitions (RFC 4880) PGPLIB: Basic packet parser KEYS: Provide PGP key description autogeneration KEYS: Provide a function to load keys from a PGP keyring blob Mimi Zohar (1): initramfs: add file metadata Roberto Sassu (34): initramfs: read metadata from special file METADATA!!! gen_init_cpio: add support for file metadata init: Add kernel option to force usage of tmpfs for rootfs ima: Add enforce-evm and log-evm modes to strictly check EVM status ima: Allow choice of file hash algorithm for measurement and audit ima: Generalize ima_read_policy() ima: Generalize ima_write_policy() and raise uploaded data size limit ima: Generalize policy file operations ima: Use ima_show_htable_value to show violations and hash table data ima: Add parser of compact digest list ima: Prevent usage of digest lists not measured or appraised ima: Introduce new securityfs files ima: Introduce new hook DIGEST_LIST_CHECK ima: Load all digest lists from a directory at boot time ima: Add support for measurement with digest lists ima: Add support for appraisal with digest lists evm: Add support for digest lists of metadata ima: Add meta_immutable appraisal type ima: Introduce exec_tcb policy ima: Introduce appraise_exec_tcb policy ima: Introduce appraise_exec_immutable policy ima: Add Documentation/security/IMA-digest-lists.txt mpi: introduce mpi_key_length() rsa: add parser of raw format KEYS: PGP data parser KEYS: Introduce load_pgp_public_keyring() certs: Introduce search_trusted_key() ima: Search key in the built-in keyrings ima: Allow direct upload of digest lists to securityfs ima: Add parser keyword to the policy evm: Extend evm= with x509. allow_metadata_writes and complete values ima: Execute parser to upload digest lists not recognizable by the kernel evm: Propagate choice of HMAC algorithm in evm_crypto.c config: add digest list options for arm64 and x86 Zhang Tianxing (5): ima: fix a memory leak in ima_del_digest_data_entry ima: Add max size for IMA digest database ima: don't allow control characters in policy path ima: fix CONFIG_IMA_DIGEST_DB_MEGABYTES in openeuler_defconfig ima: fix db size overflow and Kconfig issues Zheng Zengkai (1): Revert "evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded" shenxiangwei (1): ima: bugfix for digest lists importing Documentation/ABI/testing/evm | 4 +- .../admin-guide/kernel-parameters.txt | 49 +- Documentation/security/IMA-digest-lists.txt | 259 ++++++++++ arch/arm64/configs/openeuler_defconfig | 11 + arch/x86/configs/openeuler_defconfig | 31 +- certs/Kconfig | 7 + certs/Makefile | 7 + certs/system_certificates.S | 18 + certs/system_keyring.c | 44 ++ crypto/asymmetric_keys/Kconfig | 25 + crypto/asymmetric_keys/Makefile | 10 + crypto/asymmetric_keys/pgp_library.c | 281 +++++++++++ crypto/asymmetric_keys/pgp_parser.h | 23 + crypto/asymmetric_keys/pgp_preload.c | 119 +++++ crypto/asymmetric_keys/pgp_public_key.c | 383 +++++++++++++++ crypto/rsa.c | 14 +- crypto/rsa_helper.c | 69 +++ include/crypto/internal/rsa.h | 6 + include/linux/initramfs.h | 21 + include/linux/kernel_read_file.h | 1 + include/linux/mpi.h | 2 + include/linux/pgp.h | 220 +++++++++ include/linux/pgplib.h | 48 ++ include/linux/verification.h | 4 + init/do_mounts.c | 11 +- init/initramfs.c | 138 +++++- lib/mpi/mpicoder.c | 33 +- security/integrity/digsig_asymmetric.c | 10 + security/integrity/evm/Kconfig | 32 ++ security/integrity/evm/evm.h | 1 + security/integrity/evm/evm_crypto.c | 24 +- security/integrity/evm/evm_main.c | 103 +++- security/integrity/evm/evm_secfs.c | 2 +- security/integrity/iint.c | 2 + security/integrity/ima/Kconfig | 49 ++ security/integrity/ima/Makefile | 1 + security/integrity/ima/ima.h | 39 +- security/integrity/ima/ima_api.c | 42 +- security/integrity/ima/ima_appraise.c | 117 ++++- security/integrity/ima/ima_digest_list.c | 465 ++++++++++++++++++ security/integrity/ima/ima_digest_list.h | 54 ++ security/integrity/ima/ima_fs.c | 294 ++++++++--- security/integrity/ima/ima_init.c | 2 +- security/integrity/ima/ima_main.c | 126 ++++- security/integrity/ima/ima_policy.c | 116 ++++- security/integrity/integrity.h | 47 +- usr/Kconfig | 8 + usr/Makefile | 4 +- usr/gen_init_cpio.c | 136 ++++- usr/gen_initramfs.sh | 7 +- 50 files changed, 3301 insertions(+), 218 deletions(-) create mode 100644 Documentation/security/IMA-digest-lists.txt create mode 100644 crypto/asymmetric_keys/pgp_library.c create mode 100644 crypto/asymmetric_keys/pgp_parser.h create mode 100644 crypto/asymmetric_keys/pgp_preload.c create mode 100644 crypto/asymmetric_keys/pgp_public_key.c create mode 100644 include/linux/initramfs.h create mode 100644 include/linux/pgp.h create mode 100644 include/linux/pgplib.h create mode 100644 security/integrity/ima/ima_digest_list.c create mode 100644 security/integrity/ima/ima_digest_list.h -- 2.33.0

2 47

[OLK-5.10] RDMA/hns: Fix missing dealloc_dfx_cnt() during device unregister
by Chengchang Tang 04 Aug '23

04 Aug '23

driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7PDHP --------------------------------------------------------------- The function hns_roce_dealloc_dfx_cnt() was omitted while uploading "RDMA/hns: Add dfx cnt stats". This patch fixes it. Fixes: d5a4ca75e7ca ("RDMA/hns: Add dfx cnt stats") Signed-off-by: Chengchang Tang <tangchengchang(a)huawei.com> --- drivers/infiniband/hw/hns/hns_roce_main.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index 8c706050f475..a9f28db6145e 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -1500,6 +1500,7 @@ void hns_roce_exit(struct hns_roce_dev *hr_dev, bool bond_cleanup) hns_roce_cmd_cleanup(hr_dev); if (hr_dev->hw->cmq_exit) hr_dev->hw->cmq_exit(hr_dev); + hns_roce_dealloc_dfx_cnt(hr_dev); } MODULE_LICENSE("Dual BSD/GPL"); -- 2.30.0

1 0

[PATCH openEuler-22.03-LTS] nvme-pci: set min_align_mask before calculating max_hw_sectors
by Yong Hu 04 Aug '23

04 Aug '23

From: Rishabh Bhatnagar <risbhat(a)amazon.com> stable inclusion from stable-v5.10.150 commit 303436e301ba72021c3894c7a44bcfc1dcf17122 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6D0XA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 61ce339f19fabbc3e51237148a7ef6f2270e44fa upstream. If swiotlb is force enabled dma_max_mapping_size ends up calling swiotlb_max_mapping_size which takes into account the min align mask for the device. Set the min align mask for nvme driver before calling dma_max_mapping_size while calculating max hw sectors. Signed-off-by: Rishabh Bhatnagar <risbhat(a)amazon.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> Signed-off-by: Yong Hu <yong.hu(a)windriver.com> --- drivers/nvme/host/pci.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index c09ee462b048..4e65685765f0 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -2624,6 +2624,8 @@ static void nvme_reset_work(struct work_struct *work) if (result) goto out_unlock; + dma_set_min_align_mask(dev->dev, NVME_CTRL_PAGE_SIZE - 1); + /* * Limit the max command size to prevent iod->sg allocations going * over a single page. @@ -2636,7 +2638,6 @@ static void nvme_reset_work(struct work_struct *work) * Don't limit the IOMMU merged segment size. */ dma_set_max_seg_size(dev->dev, 0xffffffff); - dma_set_min_align_mask(dev->dev, NVME_CTRL_PAGE_SIZE - 1); mutex_unlock(&dev->shutdown_lock); -- 2.34.1

2 1

[PATCH openEuler-23.09 00/45] ima: Add IMA digest lists extension
by Zhou Shuiqing 04 Aug '23

04 Aug '23

This patchset supports IMA digest lists for the kernel. David Howells (4): PGPLIB: PGP definitions (RFC 4880) PGPLIB: Basic packet parser KEYS: Provide PGP key description autogeneration KEYS: Provide a function to load keys from a PGP keyring blob Mimi Zohar (1): initramfs: add file metadata Roberto Sassu (33): initramfs: read metadata from special file METADATA!!! gen_init_cpio: add support for file metadata init: Add kernel option to force usage of tmpfs for rootfs ima: Add enforce-evm and log-evm modes to strictly check EVM status ima: Allow choice of file hash algorithm for measurement and audit ima: Generalize ima_read_policy() ima: Generalize ima_write_policy() and raise uploaded data size limit ima: Generalize policy file operations ima: Use ima_show_htable_value to show violations and hash table data ima: Add parser of compact digest list ima: Prevent usage of digest lists not measured or appraised ima: Introduce new securityfs files ima: Introduce new hook DIGEST_LIST_CHECK ima: Load all digest lists from a directory at boot time ima: Add support for measurement with digest lists ima: Add support for appraisal with digest lists evm: Add support for digest lists of metadata ima: Add meta_immutable appraisal type ima: Introduce exec_tcb policy ima: Introduce appraise_exec_tcb policy ima: Introduce appraise_exec_immutable policy mpi: introduce mpi_key_length() rsa: add parser of raw format KEYS: PGP data parser KEYS: Introduce load_pgp_public_keyring() certs: Introduce search_trusted_key() ima: Search key in the built-in keyrings ima: Allow direct upload of digest lists to securityfs ima: Add parser keyword to the policy evm: Extend evm= with x509. allow_metadata_writes and complete values ima: Execute parser to upload digest lists not recognizable by the kernel evm: Propagate choice of HMAC algorithm in evm_crypto.c config: add digest list options for arm64 and x86 Zhang Tianxing (5): ima: fix a memory leak in ima_del_digest_data_entry ima: Add max size for IMA digest database ima: don't allow control characters in policy path ima: fix CONFIG_IMA_DIGEST_DB_MEGABYTES in openeuler_defconfig ima: fix db size overflow and Kconfig issues Zheng Zengkai (1): Revert "evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded" shenxiangwei (1): ima: bugfix for digest lists importing Documentation/ABI/testing/evm | 4 +- .../admin-guide/kernel-parameters.txt | 49 +- arch/arm64/configs/openeuler_defconfig | 11 + arch/x86/configs/openeuler_defconfig | 31 +- certs/Kconfig | 7 + certs/Makefile | 7 + certs/system_certificates.S | 18 + certs/system_keyring.c | 44 ++ crypto/asymmetric_keys/Kconfig | 25 + crypto/asymmetric_keys/Makefile | 10 + crypto/asymmetric_keys/pgp_library.c | 281 +++++++++++ crypto/asymmetric_keys/pgp_parser.h | 23 + crypto/asymmetric_keys/pgp_preload.c | 119 +++++ crypto/asymmetric_keys/pgp_public_key.c | 383 +++++++++++++++ crypto/rsa.c | 14 +- crypto/rsa_helper.c | 69 +++ include/crypto/internal/rsa.h | 6 + include/linux/initramfs.h | 21 + include/linux/kernel_read_file.h | 1 + include/linux/mpi.h | 2 + include/linux/pgp.h | 220 +++++++++ include/linux/pgplib.h | 48 ++ include/linux/verification.h | 4 + init/do_mounts.c | 11 +- init/initramfs.c | 138 +++++- lib/mpi/mpicoder.c | 33 +- security/integrity/digsig_asymmetric.c | 10 + security/integrity/evm/Kconfig | 32 ++ security/integrity/evm/evm.h | 1 + security/integrity/evm/evm_crypto.c | 24 +- security/integrity/evm/evm_main.c | 103 +++- security/integrity/evm/evm_secfs.c | 2 +- security/integrity/iint.c | 2 + security/integrity/ima/Kconfig | 49 ++ security/integrity/ima/Makefile | 1 + security/integrity/ima/ima.h | 39 +- security/integrity/ima/ima_api.c | 42 +- security/integrity/ima/ima_appraise.c | 117 ++++- security/integrity/ima/ima_digest_list.c | 465 ++++++++++++++++++ security/integrity/ima/ima_digest_list.h | 54 ++ security/integrity/ima/ima_fs.c | 294 ++++++++--- security/integrity/ima/ima_init.c | 2 +- security/integrity/ima/ima_main.c | 126 ++++- security/integrity/ima/ima_policy.c | 116 ++++- security/integrity/integrity.h | 47 +- usr/Kconfig | 8 + usr/Makefile | 4 +- usr/gen_init_cpio.c | 136 ++++- usr/gen_initramfs.sh | 7 +- 49 files changed, 3042 insertions(+), 218 deletions(-) create mode 100644 crypto/asymmetric_keys/pgp_library.c create mode 100644 crypto/asymmetric_keys/pgp_parser.h create mode 100644 crypto/asymmetric_keys/pgp_preload.c create mode 100644 crypto/asymmetric_keys/pgp_public_key.c create mode 100644 include/linux/initramfs.h create mode 100644 include/linux/pgp.h create mode 100644 include/linux/pgplib.h create mode 100644 security/integrity/ima/ima_digest_list.c create mode 100644 security/integrity/ima/ima_digest_list.h -- 2.33.0

2 46

[PATCH openEuler-23.09 00/46]ima: Add IMA digest lists feature
by Zhou Shuiqing 04 Aug '23

04 Aug '23

This patchset supports IMA digest lists for the kernel. David Howells (4): PGPLIB: PGP definitions (RFC 4880) PGPLIB: Basic packet parser KEYS: Provide PGP key description autogeneration KEYS: Provide a function to load keys from a PGP keyring blob Mimi Zohar (1): initramfs: add file metadata Roberto Sassu (34): initramfs: read metadata from special file METADATA!!! gen_init_cpio: add support for file metadata init: Add kernel option to force usage of tmpfs for rootfs ima: Add enforce-evm and log-evm modes to strictly check EVM status ima: Allow choice of file hash algorithm for measurement and audit ima: Generalize ima_read_policy() ima: Generalize ima_write_policy() and raise uploaded data size limit ima: Generalize policy file operations ima: Use ima_show_htable_value to show violations and hash table data ima: Add parser of compact digest list ima: Prevent usage of digest lists not measured or appraised ima: Introduce new securityfs files ima: Introduce new hook DIGEST_LIST_CHECK ima: Load all digest lists from a directory at boot time ima: Add support for measurement with digest lists ima: Add support for appraisal with digest lists evm: Add support for digest lists of metadata ima: Add meta_immutable appraisal type ima: Introduce exec_tcb policy ima: Introduce appraise_exec_tcb policy ima: Introduce appraise_exec_immutable policy ima: Add Documentation/security/IMA-digest-lists.txt mpi: introduce mpi_key_length() rsa: add parser of raw format KEYS: PGP data parser KEYS: Introduce load_pgp_public_keyring() certs: Introduce search_trusted_key() ima: Search key in the built-in keyrings ima: Allow direct upload of digest lists to securityfs ima: Add parser keyword to the policy evm: Extend evm= with x509. allow_metadata_writes and complete values ima: Execute parser to upload digest lists not recognizable by the kernel evm: Propagate choice of HMAC algorithm in evm_crypto.c config: add digest list options for arm64 and x86 Zhang Tianxing (5): ima: fix a memory leak in ima_del_digest_data_entry ima: Add max size for IMA digest database ima: don't allow control characters in policy path ima: fix CONFIG_IMA_DIGEST_DB_MEGABYTES in openeuler_defconfig ima: fix db size overflow and Kconfig issues Zheng Zengkai (1): Revert "evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded" shenxiangwei (1): ima: bugfix for digest lists importing Documentation/ABI/testing/evm | 4 +- .../admin-guide/kernel-parameters.txt | 49 +- Documentation/security/IMA-digest-lists.txt | 259 ++++++++++ arch/arm64/configs/openeuler_defconfig | 11 + arch/x86/configs/openeuler_defconfig | 31 +- certs/Kconfig | 7 + certs/Makefile | 7 + certs/system_certificates.S | 18 + certs/system_keyring.c | 44 ++ crypto/asymmetric_keys/Kconfig | 25 + crypto/asymmetric_keys/Makefile | 10 + crypto/asymmetric_keys/pgp_library.c | 281 +++++++++++ crypto/asymmetric_keys/pgp_parser.h | 23 + crypto/asymmetric_keys/pgp_preload.c | 119 +++++ crypto/asymmetric_keys/pgp_public_key.c | 383 +++++++++++++++ crypto/rsa.c | 14 +- crypto/rsa_helper.c | 69 +++ include/crypto/internal/rsa.h | 6 + include/linux/initramfs.h | 21 + include/linux/kernel_read_file.h | 1 + include/linux/mpi.h | 2 + include/linux/pgp.h | 220 +++++++++ include/linux/pgplib.h | 48 ++ include/linux/verification.h | 4 + init/do_mounts.c | 11 +- init/initramfs.c | 138 +++++- lib/mpi/mpicoder.c | 33 +- security/integrity/digsig_asymmetric.c | 10 + security/integrity/evm/Kconfig | 32 ++ security/integrity/evm/evm.h | 1 + security/integrity/evm/evm_crypto.c | 24 +- security/integrity/evm/evm_main.c | 103 +++- security/integrity/evm/evm_secfs.c | 2 +- security/integrity/iint.c | 2 + security/integrity/ima/Kconfig | 49 ++ security/integrity/ima/Makefile | 1 + security/integrity/ima/ima.h | 39 +- security/integrity/ima/ima_api.c | 42 +- security/integrity/ima/ima_appraise.c | 117 ++++- security/integrity/ima/ima_digest_list.c | 465 ++++++++++++++++++ security/integrity/ima/ima_digest_list.h | 54 ++ security/integrity/ima/ima_fs.c | 294 ++++++++--- security/integrity/ima/ima_init.c | 2 +- security/integrity/ima/ima_main.c | 126 ++++- security/integrity/ima/ima_policy.c | 116 ++++- security/integrity/integrity.h | 47 +- usr/Kconfig | 8 + usr/Makefile | 4 +- usr/gen_init_cpio.c | 136 ++++- usr/gen_initramfs.sh | 7 +- 50 files changed, 3301 insertions(+), 218 deletions(-) create mode 100644 Documentation/security/IMA-digest-lists.txt create mode 100644 crypto/asymmetric_keys/pgp_library.c create mode 100644 crypto/asymmetric_keys/pgp_parser.h create mode 100644 crypto/asymmetric_keys/pgp_preload.c create mode 100644 crypto/asymmetric_keys/pgp_public_key.c create mode 100644 include/linux/initramfs.h create mode 100644 include/linux/pgp.h create mode 100644 include/linux/pgplib.h create mode 100644 security/integrity/ima/ima_digest_list.c create mode 100644 security/integrity/ima/ima_digest_list.h -- 2.33.0

2 47

[PATCH openEuler-1.0-LTS] blk-mq: Improve performance of non-mq IO schedulers with multiple HW queues
by Lei Chen 03 Aug '23

03 Aug '23

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-v5.12-rc2 commit b6e68ee82585f2ee890b0a897a6aacbf49a467bb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7QFJD?from=project-issue CVE: NA Upstream commit 5d05426e2d5fd7df8af fixes a bug introduced by this patch, but it does not need to be backported. This patch was merged in mainline-v5.12-rc1-dontuse at first, thus I denote it comes from mainline-v5.12-rc2. -------------------------------- Currently when non-mq aware IO scheduler (BFQ, mq-deadline) is used for a queue with multiple HW queues, the performance it rather bad. The problem is that these IO schedulers use queue-wide locking and their dispatch function does not respect the hctx it is passed in and returns any request it finds appropriate. Thus locality of request access is broken and dispatch from multiple CPUs just contends on IO scheduler locks. For these IO schedulers there's little point in dispatching from multiple CPUs. Instead dispatch always only from a single CPU to limit contention. Below is a comparison of dbench runs on XFS filesystem where the storage is a raid card with 64 HW queues and to it attached a single rotating disk. BFQ is used as IO scheduler: clients MQ SQ MQ-Patched Amean 1 39.12 (0.00%) 43.29 * -10.67%* 36.09 * 7.74%* Amean 2 128.58 (0.00%) 101.30 * 21.22%* 96.14 * 25.23%* Amean 4 577.42 (0.00%) 494.47 * 14.37%* 508.49 * 11.94%* Amean 8 610.95 (0.00%) 363.86 * 40.44%* 362.12 * 40.73%* Amean 16 391.78 (0.00%) 261.49 * 33.25%* 282.94 * 27.78%* Amean 32 324.64 (0.00%) 267.71 * 17.54%* 233.00 * 28.23%* Amean 64 295.04 (0.00%) 253.02 * 14.24%* 242.37 * 17.85%* Amean 512 10281.61 (0.00%) 10211.16 * 0.69%* 10447.53 * -1.61%* Numbers are times so lower is better. MQ is stock 5.10-rc6 kernel. SQ is the same kernel with megaraid_sas.host_tagset_enable=0 so that the card advertises just a single HW queue. MQ-Patched is a kernel with this patch applied. You can see multiple hardware queues heavily hurt performance in combination with BFQ. The patch restores the performance. Signed-off-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Lei Chen <lei.chen(a)smartx.com> --- block/blk-mq.c | 63 +++++++++++++++++++++++++++++++++++++--- block/kyber-iosched.c | 1 + include/linux/elevator.h | 4 +++ 3 files changed, 64 insertions(+), 4 deletions(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index 96debbe63ad2..2b0f0a9f40d9 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -1521,17 +1521,62 @@ bool blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx, bool async) return false; } EXPORT_SYMBOL(blk_mq_run_hw_queue); +/* + * Is the request queue handled by an IO scheduler that does not respect + * hardware queues when dispatching? + */ +static bool blk_mq_has_sqsched(struct request_queue *q) +{ + struct elevator_queue *e = q->elevator; -void blk_mq_run_hw_queues(struct request_queue *q, bool async) + if (e && e->type->ops.mq.dispatch_request && + !(e->type->elevator_features & ELEVATOR_F_MQ_AWARE)) + return true; + return false; +} + +/* + * Return prefered queue to dispatch from (if any) for non-mq aware IO + * scheduler. + */ +static struct blk_mq_hw_ctx *blk_mq_get_sq_hctx(struct request_queue *q) { struct blk_mq_hw_ctx *hctx; + + /* + * If the IO scheduler does not respect hardware queues when + * dispatching, we just don't bother with multiple HW queues and + * dispatch from hctx for the current CPU since running multiple queues + * just causes lock contention inside the scheduler and pointless cache + * bouncing. + */ + hctx = blk_mq_map_queue(q, raw_smp_processor_id()); + if (!blk_mq_hctx_stopped(hctx)) + return hctx; + return NULL; +} + + +void blk_mq_run_hw_queues(struct request_queue *q, bool async) +{ + struct blk_mq_hw_ctx *hctx, *sq_hctx; int i; + sq_hctx = NULL; + if (blk_mq_has_sqsched(q)) + sq_hctx = blk_mq_get_sq_hctx(q); queue_for_each_hw_ctx(q, hctx, i) { if (blk_mq_hctx_stopped(hctx)) continue; - blk_mq_run_hw_queue(hctx, async); + /* + * Dispatch from this hctx either if there's no hctx preferred + * by IO scheduler or if it has requests that bypass the + * scheduler. + */ + if (!sq_hctx || sq_hctx == hctx || + !list_empty_careful(&hctx->dispatch)) + blk_mq_run_hw_queue(hctx, async); } } EXPORT_SYMBOL(blk_mq_run_hw_queues); @@ -1543,9 +1588,12 @@ EXPORT_SYMBOL(blk_mq_run_hw_queues); */ void blk_mq_delay_run_hw_queues(struct request_queue *q, unsigned long msecs) { - struct blk_mq_hw_ctx *hctx; + struct blk_mq_hw_ctx *hctx, *sq_hctx; int i; + sq_hctx = NULL; + if (blk_mq_has_sqsched(q)) + sq_hctx = blk_mq_get_sq_hctx(q); queue_for_each_hw_ctx(q, hctx, i) { if (blk_mq_hctx_stopped(hctx)) continue; @@ -1559,7 +1607,14 @@ void blk_mq_delay_run_hw_queues(struct request_queue *q, unsigned long msecs) if (delayed_work_pending(&hctx->run_work)) continue; - blk_mq_delay_run_hw_queue(hctx, msecs); + /* + * Dispatch from this hctx either if there's no hctx preferred + * by IO scheduler or if it has requests that bypass the + * scheduler. + */ + if (!sq_hctx || sq_hctx == hctx || + !list_empty_careful(&hctx->dispatch)) + blk_mq_delay_run_hw_queue(hctx, msecs); } } EXPORT_SYMBOL(blk_mq_delay_run_hw_queues); diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c index d8f3cb1bffa6..bc0376c338ff 100644 --- a/block/kyber-iosched.c +++ b/block/kyber-iosched.c @@ -972,6 +972,7 @@ static struct elevator_type kyber_sched = { #endif .elevator_attrs = kyber_sched_attrs, .elevator_name = "kyber", + .elevator_features = ELEVATOR_F_MQ_AWARE, .elevator_owner = THIS_MODULE, }; diff --git a/include/linux/elevator.h b/include/linux/elevator.h index 663ce1780c5d..70c3c1fd5cf0 100644 --- a/include/linux/elevator.h +++ b/include/linux/elevator.h @@ -155,6 +155,7 @@ struct elevator_type size_t icq_align; /* ditto */ struct elv_fs_entry *elevator_attrs; char elevator_name[ELV_NAME_MAX]; + unsigned int elevator_features; const char *elevator_alias; struct module *elevator_owner; bool uses_mq; @@ -276,6 +277,9 @@ enum { #define rq_entry_fifo(ptr) list_entry((ptr), struct request, queuelist) #define rq_fifo_clear(rq) list_del_init(&(rq)->queuelist) +/* Supports scheduling on multiple hardware queues */ +#define ELEVATOR_F_MQ_AWARE (1U << 1) + #else /* CONFIG_BLOCK */ static inline void load_default_elevator_module(void) { } -- 2.34.1

2 1

[openEuler-1.0-LTS 1/5] workqueue: Rename "delayed" (delayed by active management) to "inactive"
by Zeng Heng 03 Aug '23

03 Aug '23

From: Lai Jiangshan <laijs(a)linux.alibaba.com> mainline inclusion from mainline-v5.15-rc1 commit f97a4a1a3f8769e3452885967955e21c88f3f263 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7LRJF DTS: DTS2023072811781 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- There are two kinds of "delayed" work items in workqueue subsystem. One is for timer-delayed work items which are visible to workqueue users. The other kind is for work items delayed by active management which can not be directly visible to workqueue users. We mixed the word "delayed" for both kinds and caused somewhat ambiguity. This patch renames the later one (delayed by active management) to "inactive", because it is used for workqueue active management and most of its related symbols are named with "active" or "activate". All "delayed" and "DELAYED" are carefully checked and renamed one by one to avoid accidentally changing the name of the other kind for timer-delayed. No functional change intended. Signed-off-by: Lai Jiangshan <laijs(a)linux.alibaba.com> Signed-off-by: Tejun Heo <tj(a)kernel.org> conflict: kernel/workqueue.c Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- include/linux/workqueue.h | 4 +-- kernel/workqueue.c | 58 +++++++++++++++++++-------------------- 2 files changed, 31 insertions(+), 31 deletions(-) diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h index 6f2b042fc44c..3ac0fa0c822d 100644 --- a/include/linux/workqueue.h +++ b/include/linux/workqueue.h @@ -30,7 +30,7 @@ void delayed_work_timer_fn(struct timer_list *t); enum { WORK_STRUCT_PENDING_BIT = 0, /* work item is pending execution */ - WORK_STRUCT_DELAYED_BIT = 1, /* work item is delayed */ + WORK_STRUCT_INACTIVE_BIT= 1, /* work item is inactive */ WORK_STRUCT_PWQ_BIT = 2, /* data points to pwq */ WORK_STRUCT_LINKED_BIT = 3, /* next work is linked to this one */ #ifdef CONFIG_DEBUG_OBJECTS_WORK @@ -43,7 +43,7 @@ enum { WORK_STRUCT_COLOR_BITS = 4, WORK_STRUCT_PENDING = 1 << WORK_STRUCT_PENDING_BIT, - WORK_STRUCT_DELAYED = 1 << WORK_STRUCT_DELAYED_BIT, + WORK_STRUCT_INACTIVE = 1 << WORK_STRUCT_INACTIVE_BIT, WORK_STRUCT_PWQ = 1 << WORK_STRUCT_PWQ_BIT, WORK_STRUCT_LINKED = 1 << WORK_STRUCT_LINKED_BIT, #ifdef CONFIG_DEBUG_OBJECTS_WORK diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 04b558a267ae..fe3c4a292909 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -207,7 +207,7 @@ struct pool_workqueue { /* L: nr of in_flight works */ int nr_active; /* L: nr of active works */ int max_active; /* L: max active works */ - struct list_head delayed_works; /* L: delayed works */ + struct list_head inactive_works; /* L: inactive works */ struct list_head pwqs_node; /* WR: node on wq->pwqs */ struct list_head mayday_node; /* MD: node on wq->maydays */ @@ -1105,7 +1105,7 @@ static void put_pwq_unlocked(struct pool_workqueue *pwq) } } -static void pwq_activate_delayed_work(struct work_struct *work) +static void pwq_activate_inactive_work(struct work_struct *work) { struct pool_workqueue *pwq = get_work_pwq(work); @@ -1113,16 +1113,16 @@ static void pwq_activate_delayed_work(struct work_struct *work) if (list_empty(&pwq->pool->worklist)) pwq->pool->watchdog_ts = jiffies; move_linked_works(work, &pwq->pool->worklist, NULL); - __clear_bit(WORK_STRUCT_DELAYED_BIT, work_data_bits(work)); + __clear_bit(WORK_STRUCT_INACTIVE_BIT, work_data_bits(work)); pwq->nr_active++; } -static void pwq_activate_first_delayed(struct pool_workqueue *pwq) +static void pwq_activate_first_inactive(struct pool_workqueue *pwq) { - struct work_struct *work = list_first_entry(&pwq->delayed_works, + struct work_struct *work = list_first_entry(&pwq->inactive_works, struct work_struct, entry); - pwq_activate_delayed_work(work); + pwq_activate_inactive_work(work); } /** @@ -1145,10 +1145,10 @@ static void pwq_dec_nr_in_flight(struct pool_workqueue *pwq, int color) pwq->nr_in_flight[color]--; pwq->nr_active--; - if (!list_empty(&pwq->delayed_works)) { - /* one down, submit a delayed one */ + if (!list_empty(&pwq->inactive_works)) { + /* one down, submit an inactive one */ if (pwq->nr_active < pwq->max_active) - pwq_activate_first_delayed(pwq); + pwq_activate_first_inactive(pwq); } /* is flush in progress and are we at the flushing tip? */ @@ -1246,14 +1246,14 @@ static int try_to_grab_pending(struct work_struct *work, bool is_dwork, debug_work_deactivate(work); /* - * A delayed work item cannot be grabbed directly because + * An inactive work item cannot be grabbed directly because * it might have linked NO_COLOR work items which, if left - * on the delayed_list, will confuse pwq->nr_active + * on the inactive_works list, will confuse pwq->nr_active * management later on and cause stall. Make sure the work * item is activated before grabbing. */ - if (*work_data_bits(work) & WORK_STRUCT_DELAYED) - pwq_activate_delayed_work(work); + if (*work_data_bits(work) & WORK_STRUCT_INACTIVE) + pwq_activate_inactive_work(work); list_del_init(&work->entry); pwq_dec_nr_in_flight(pwq, get_work_color(work)); @@ -1451,8 +1451,8 @@ static void __queue_work(int cpu, struct workqueue_struct *wq, if (list_empty(worklist)) pwq->pool->watchdog_ts = jiffies; } else { - work_flags |= WORK_STRUCT_DELAYED; - worklist = &pwq->delayed_works; + work_flags |= WORK_STRUCT_INACTIVE; + worklist = &pwq->inactive_works; } debug_work_activate(work); @@ -2496,7 +2496,7 @@ static int rescuer_thread(void *__rescuer) /* * The above execution of rescued work items could * have created more to rescue through - * pwq_activate_first_delayed() or chained + * pwq_activate_first_inactive() or chained * queueing. Let's put @pwq back on mayday list so * that such back-to-back work items, which may be * being used to relieve memory pressure, don't @@ -2922,7 +2922,7 @@ void drain_workqueue(struct workqueue_struct *wq) bool drained; spin_lock_irq(&pwq->pool->lock); - drained = !pwq->nr_active && list_empty(&pwq->delayed_works); + drained = !pwq->nr_active && list_empty(&pwq->inactive_works); spin_unlock_irq(&pwq->pool->lock); if (drained) @@ -3703,7 +3703,7 @@ static void pwq_unbound_release_workfn(struct work_struct *work) * @pwq: target pool_workqueue * * If @pwq isn't freezing, set @pwq->max_active to the associated - * workqueue's saved_max_active and activate delayed work items + * workqueue's saved_max_active and activate inactive work items * accordingly. If @pwq is freezing, clear @pwq->max_active to zero. */ static void pwq_adjust_max_active(struct pool_workqueue *pwq) @@ -3732,9 +3732,9 @@ static void pwq_adjust_max_active(struct pool_workqueue *pwq) pwq->max_active = wq->saved_max_active; - while (!list_empty(&pwq->delayed_works) && + while (!list_empty(&pwq->inactive_works) && pwq->nr_active < pwq->max_active) { - pwq_activate_first_delayed(pwq); + pwq_activate_first_inactive(pwq); kick = true; } @@ -3765,7 +3765,7 @@ static void init_pwq(struct pool_workqueue *pwq, struct workqueue_struct *wq, pwq->wq = wq; pwq->flush_color = -1; pwq->refcnt = 1; - INIT_LIST_HEAD(&pwq->delayed_works); + INIT_LIST_HEAD(&pwq->inactive_works); INIT_LIST_HEAD(&pwq->pwqs_node); INIT_LIST_HEAD(&pwq->mayday_node); INIT_WORK(&pwq->unbound_release_work, pwq_unbound_release_workfn); @@ -4386,7 +4386,7 @@ void destroy_workqueue(struct workqueue_struct *wq) if (WARN_ON((pwq != wq->dfl_pwq) && (pwq->refcnt > 1)) || WARN_ON(pwq->nr_active) || - WARN_ON(!list_empty(&pwq->delayed_works))) { + WARN_ON(!list_empty(&pwq->inactive_works))) { mutex_unlock(&wq->mutex); show_workqueue_state(); return; @@ -4527,7 +4527,7 @@ bool workqueue_congested(int cpu, struct workqueue_struct *wq) else pwq = unbound_pwq_by_node(wq, cpu_to_node(cpu)); - ret = !list_empty(&pwq->delayed_works); + ret = !list_empty(&pwq->inactive_works); rcu_read_unlock_sched(); return ret; @@ -4722,11 +4722,11 @@ static void show_pwq(struct pool_workqueue *pwq) pr_cont("\n"); } - if (!list_empty(&pwq->delayed_works)) { + if (!list_empty(&pwq->inactive_works)) { bool comma = false; - pr_info(" delayed:"); - list_for_each_entry(work, &pwq->delayed_works, entry) { + pr_info(" inactive:"); + list_for_each_entry(work, &pwq->inactive_works, entry) { pr_cont_work(comma, work); comma = !(*work_data_bits(work) & WORK_STRUCT_LINKED); } @@ -4756,7 +4756,7 @@ void show_workqueue_state(void) bool idle = true; for_each_pwq(pwq, wq) { - if (pwq->nr_active || !list_empty(&pwq->delayed_works)) { + if (pwq->nr_active || !list_empty(&pwq->inactive_works)) { idle = false; break; } @@ -4768,7 +4768,7 @@ void show_workqueue_state(void) for_each_pwq(pwq, wq) { spin_lock_irqsave(&pwq->pool->lock, flags); - if (pwq->nr_active || !list_empty(&pwq->delayed_works)) + if (pwq->nr_active || !list_empty(&pwq->inactive_works)) show_pwq(pwq); spin_unlock_irqrestore(&pwq->pool->lock, flags); /* @@ -5143,7 +5143,7 @@ EXPORT_SYMBOL_GPL(work_on_cpu_safe); * freeze_workqueues_begin - begin freezing workqueues * * Start freezing workqueues. After this function returns, all freezable - * workqueues will queue new works to their delayed_works list instead of + * workqueues will queue new works to their inactive_works list instead of * pool->worklist. * * CONTEXT: -- 2.25.1

1 4

[PATCH OLK-5.10] Revert "arm64/mpam: Fix mpam corrupt when cpu online"
by Wang ShaoBo 03 Aug '23

03 Aug '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7PN0A CVE: NA ------------------------------------------------- BUG reported when setuping MPAM driver: [Thu Jul 27 12:15:54 2023] BUG: sleeping function called from invalid context at include/linux/percpu-rwsem.h:49 [Thu Jul 27 12:15:54 2023] in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 593, name: kworker/72:1 [Thu Jul 27 12:15:54 2023] CPU: 72 PID: 593 Comm: kworker/72:1 Not tainted 5.10.0-03467-g02e1abb0f821-dirty #1 [Thu Jul 27 12:15:54 2023] Hardware name: Huawei TaiShan 2280 V2/BC82AMDDA, BIOS 1.79 08/21/2021 [Thu Jul 27 12:15:54 2023] Loaded X.509 cert 'Build time autogenerated kernel key: 9ae2dc86231d0b23cd114b5ed4089cac17566b0f' [Thu Jul 27 12:15:54 2023] Workqueue: events mpam_enable [Thu Jul 27 12:15:54 2023] Load PGP public keys [Thu Jul 27 12:15:54 2023] Call trace: [Thu Jul 27 12:15:54 2023] dump_backtrace+0x0/0x30c [Thu Jul 27 12:15:54 2023] show_stack+0x20/0x30 [Thu Jul 27 12:15:54 2023] dump_stack+0x11c/0x174 [Thu Jul 27 12:15:54 2023] ___might_sleep+0x15c/0x1a0 [Thu Jul 27 12:15:54 2023] __might_sleep+0x7c/0x100 [Thu Jul 27 12:15:54 2023] cpus_read_lock+0x3c/0x110 [Thu Jul 27 12:15:54 2023] __cpuhp_setup_state+0x3c/0x80 [Thu Jul 27 12:15:54 2023] mpam_enable+0x148/0x3a4 [Thu Jul 27 12:15:54 2023] process_one_work+0x3cc/0x984 [Thu Jul 27 12:15:54 2023] worker_thread+0x2b0/0x71c [Thu Jul 27 12:15:54 2023] kthread+0x1e0/0x220 [Thu Jul 27 12:15:54 2023] ret_from_fork+0x10/0x18 [Thu Jul 27 12:15:54 2023] kmemleak: Kernel memory leak detector initialized (mem pool available: 11650) [Thu Jul 27 12:15:54 2023] kmemleak: Automatic memory scanning thread started [Thu Jul 27 12:15:54 2023] cryptd: max_cpu_qlen set to 1000 [Thu Jul 27 12:15:54 2023] Key type encrypted registered [Thu Jul 27 12:15:54 2023] AppArmor: AppArmor sha1 policy hashing enabled [Thu Jul 27 12:15:54 2023] integrity: Loading X.509 certificate: UEFI:db Patch: bc9e3f9895ef2 ("arm64/mpam: Fix mpam corrupt when cpu online") reported a 'Bad PC' BUG, but missing the conclusion, disabling irqs before calling cpuhp_setup_state() may only affect the probability of reproduction. The reason why triggerring 'Bad PC' BUG report is because mpam_enable() is __init type function, and may schedule out after calling __cpuhp_setup_state() ->__might_sleep(), so the space of mpam_enable() might be released after scheduling back. As we have changed mpam_enable() to non-init type function, so we can revert commit bc9e3f9895ef257b76601291d99c87c13c7c31df, to solve these both two problems. Fixes: bc9e3f9895ef2 ("arm64/mpam: Fix mpam corrupt when cpu online") Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_device.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index c59f7f09308dc..bb88db115a86c 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -596,11 +596,9 @@ static void mpam_enable(struct work_struct *work) pr_err("Failed to setup/init resctrl\n"); mutex_unlock(&mpam_devices_lock); - local_irq_disable(); mpam_cpuhp_state = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "mpam:online", mpam_cpu_online, mpam_cpu_offline); - local_irq_enable(); if (mpam_cpuhp_state <= 0) pr_err("Failed to re-register 'dyn' cpuhp callbacks"); mutex_unlock(&mpam_cpuhp_lock); -- 2.25.1

1 0

[openEuler-1.0-LTS 1/5] workqueue: Rename "delayed" (delayed by active management) to "inactive"
by Zeng Heng 03 Aug '23

03 Aug '23

From: Lai Jiangshan <laijs(a)linux.alibaba.com> mainline inclusion from mainline-v5.15-rc1 commit f97a4a1a3f8769e3452885967955e21c88f3f263 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7LRJF Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- There are two kinds of "delayed" work items in workqueue subsystem. One is for timer-delayed work items which are visible to workqueue users. The other kind is for work items delayed by active management which can not be directly visible to workqueue users. We mixed the word "delayed" for both kinds and caused somewhat ambiguity. This patch renames the later one (delayed by active management) to "inactive", because it is used for workqueue active management and most of its related symbols are named with "active" or "activate". All "delayed" and "DELAYED" are carefully checked and renamed one by one to avoid accidentally changing the name of the other kind for timer-delayed. No functional change intended. Signed-off-by: Lai Jiangshan <laijs(a)linux.alibaba.com> Signed-off-by: Tejun Heo <tj(a)kernel.org> conflict: kernel/workqueue.c Signed-off-by: Zeng Heng <zengheng4(a)huawei.com> --- include/linux/workqueue.h | 4 +-- kernel/workqueue.c | 58 +++++++++++++++++++-------------------- 2 files changed, 31 insertions(+), 31 deletions(-) diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h index 6f2b042fc44c..3ac0fa0c822d 100644 --- a/include/linux/workqueue.h +++ b/include/linux/workqueue.h @@ -30,7 +30,7 @@ void delayed_work_timer_fn(struct timer_list *t); enum { WORK_STRUCT_PENDING_BIT = 0, /* work item is pending execution */ - WORK_STRUCT_DELAYED_BIT = 1, /* work item is delayed */ + WORK_STRUCT_INACTIVE_BIT= 1, /* work item is inactive */ WORK_STRUCT_PWQ_BIT = 2, /* data points to pwq */ WORK_STRUCT_LINKED_BIT = 3, /* next work is linked to this one */ #ifdef CONFIG_DEBUG_OBJECTS_WORK @@ -43,7 +43,7 @@ enum { WORK_STRUCT_COLOR_BITS = 4, WORK_STRUCT_PENDING = 1 << WORK_STRUCT_PENDING_BIT, - WORK_STRUCT_DELAYED = 1 << WORK_STRUCT_DELAYED_BIT, + WORK_STRUCT_INACTIVE = 1 << WORK_STRUCT_INACTIVE_BIT, WORK_STRUCT_PWQ = 1 << WORK_STRUCT_PWQ_BIT, WORK_STRUCT_LINKED = 1 << WORK_STRUCT_LINKED_BIT, #ifdef CONFIG_DEBUG_OBJECTS_WORK diff --git a/kernel/workqueue.c b/kernel/workqueue.c index 04b558a267ae..fe3c4a292909 100644 --- a/kernel/workqueue.c +++ b/kernel/workqueue.c @@ -207,7 +207,7 @@ struct pool_workqueue { /* L: nr of in_flight works */ int nr_active; /* L: nr of active works */ int max_active; /* L: max active works */ - struct list_head delayed_works; /* L: delayed works */ + struct list_head inactive_works; /* L: inactive works */ struct list_head pwqs_node; /* WR: node on wq->pwqs */ struct list_head mayday_node; /* MD: node on wq->maydays */ @@ -1105,7 +1105,7 @@ static void put_pwq_unlocked(struct pool_workqueue *pwq) } } -static void pwq_activate_delayed_work(struct work_struct *work) +static void pwq_activate_inactive_work(struct work_struct *work) { struct pool_workqueue *pwq = get_work_pwq(work); @@ -1113,16 +1113,16 @@ static void pwq_activate_delayed_work(struct work_struct *work) if (list_empty(&pwq->pool->worklist)) pwq->pool->watchdog_ts = jiffies; move_linked_works(work, &pwq->pool->worklist, NULL); - __clear_bit(WORK_STRUCT_DELAYED_BIT, work_data_bits(work)); + __clear_bit(WORK_STRUCT_INACTIVE_BIT, work_data_bits(work)); pwq->nr_active++; } -static void pwq_activate_first_delayed(struct pool_workqueue *pwq) +static void pwq_activate_first_inactive(struct pool_workqueue *pwq) { - struct work_struct *work = list_first_entry(&pwq->delayed_works, + struct work_struct *work = list_first_entry(&pwq->inactive_works, struct work_struct, entry); - pwq_activate_delayed_work(work); + pwq_activate_inactive_work(work); } /** @@ -1145,10 +1145,10 @@ static void pwq_dec_nr_in_flight(struct pool_workqueue *pwq, int color) pwq->nr_in_flight[color]--; pwq->nr_active--; - if (!list_empty(&pwq->delayed_works)) { - /* one down, submit a delayed one */ + if (!list_empty(&pwq->inactive_works)) { + /* one down, submit an inactive one */ if (pwq->nr_active < pwq->max_active) - pwq_activate_first_delayed(pwq); + pwq_activate_first_inactive(pwq); } /* is flush in progress and are we at the flushing tip? */ @@ -1246,14 +1246,14 @@ static int try_to_grab_pending(struct work_struct *work, bool is_dwork, debug_work_deactivate(work); /* - * A delayed work item cannot be grabbed directly because + * An inactive work item cannot be grabbed directly because * it might have linked NO_COLOR work items which, if left - * on the delayed_list, will confuse pwq->nr_active + * on the inactive_works list, will confuse pwq->nr_active * management later on and cause stall. Make sure the work * item is activated before grabbing. */ - if (*work_data_bits(work) & WORK_STRUCT_DELAYED) - pwq_activate_delayed_work(work); + if (*work_data_bits(work) & WORK_STRUCT_INACTIVE) + pwq_activate_inactive_work(work); list_del_init(&work->entry); pwq_dec_nr_in_flight(pwq, get_work_color(work)); @@ -1451,8 +1451,8 @@ static void __queue_work(int cpu, struct workqueue_struct *wq, if (list_empty(worklist)) pwq->pool->watchdog_ts = jiffies; } else { - work_flags |= WORK_STRUCT_DELAYED; - worklist = &pwq->delayed_works; + work_flags |= WORK_STRUCT_INACTIVE; + worklist = &pwq->inactive_works; } debug_work_activate(work); @@ -2496,7 +2496,7 @@ static int rescuer_thread(void *__rescuer) /* * The above execution of rescued work items could * have created more to rescue through - * pwq_activate_first_delayed() or chained + * pwq_activate_first_inactive() or chained * queueing. Let's put @pwq back on mayday list so * that such back-to-back work items, which may be * being used to relieve memory pressure, don't @@ -2922,7 +2922,7 @@ void drain_workqueue(struct workqueue_struct *wq) bool drained; spin_lock_irq(&pwq->pool->lock); - drained = !pwq->nr_active && list_empty(&pwq->delayed_works); + drained = !pwq->nr_active && list_empty(&pwq->inactive_works); spin_unlock_irq(&pwq->pool->lock); if (drained) @@ -3703,7 +3703,7 @@ static void pwq_unbound_release_workfn(struct work_struct *work) * @pwq: target pool_workqueue * * If @pwq isn't freezing, set @pwq->max_active to the associated - * workqueue's saved_max_active and activate delayed work items + * workqueue's saved_max_active and activate inactive work items * accordingly. If @pwq is freezing, clear @pwq->max_active to zero. */ static void pwq_adjust_max_active(struct pool_workqueue *pwq) @@ -3732,9 +3732,9 @@ static void pwq_adjust_max_active(struct pool_workqueue *pwq) pwq->max_active = wq->saved_max_active; - while (!list_empty(&pwq->delayed_works) && + while (!list_empty(&pwq->inactive_works) && pwq->nr_active < pwq->max_active) { - pwq_activate_first_delayed(pwq); + pwq_activate_first_inactive(pwq); kick = true; } @@ -3765,7 +3765,7 @@ static void init_pwq(struct pool_workqueue *pwq, struct workqueue_struct *wq, pwq->wq = wq; pwq->flush_color = -1; pwq->refcnt = 1; - INIT_LIST_HEAD(&pwq->delayed_works); + INIT_LIST_HEAD(&pwq->inactive_works); INIT_LIST_HEAD(&pwq->pwqs_node); INIT_LIST_HEAD(&pwq->mayday_node); INIT_WORK(&pwq->unbound_release_work, pwq_unbound_release_workfn); @@ -4386,7 +4386,7 @@ void destroy_workqueue(struct workqueue_struct *wq) if (WARN_ON((pwq != wq->dfl_pwq) && (pwq->refcnt > 1)) || WARN_ON(pwq->nr_active) || - WARN_ON(!list_empty(&pwq->delayed_works))) { + WARN_ON(!list_empty(&pwq->inactive_works))) { mutex_unlock(&wq->mutex); show_workqueue_state(); return; @@ -4527,7 +4527,7 @@ bool workqueue_congested(int cpu, struct workqueue_struct *wq) else pwq = unbound_pwq_by_node(wq, cpu_to_node(cpu)); - ret = !list_empty(&pwq->delayed_works); + ret = !list_empty(&pwq->inactive_works); rcu_read_unlock_sched(); return ret; @@ -4722,11 +4722,11 @@ static void show_pwq(struct pool_workqueue *pwq) pr_cont("\n"); } - if (!list_empty(&pwq->delayed_works)) { + if (!list_empty(&pwq->inactive_works)) { bool comma = false; - pr_info(" delayed:"); - list_for_each_entry(work, &pwq->delayed_works, entry) { + pr_info(" inactive:"); + list_for_each_entry(work, &pwq->inactive_works, entry) { pr_cont_work(comma, work); comma = !(*work_data_bits(work) & WORK_STRUCT_LINKED); } @@ -4756,7 +4756,7 @@ void show_workqueue_state(void) bool idle = true; for_each_pwq(pwq, wq) { - if (pwq->nr_active || !list_empty(&pwq->delayed_works)) { + if (pwq->nr_active || !list_empty(&pwq->inactive_works)) { idle = false; break; } @@ -4768,7 +4768,7 @@ void show_workqueue_state(void) for_each_pwq(pwq, wq) { spin_lock_irqsave(&pwq->pool->lock, flags); - if (pwq->nr_active || !list_empty(&pwq->delayed_works)) + if (pwq->nr_active || !list_empty(&pwq->inactive_works)) show_pwq(pwq); spin_unlock_irqrestore(&pwq->pool->lock, flags); /* @@ -5143,7 +5143,7 @@ EXPORT_SYMBOL_GPL(work_on_cpu_safe); * freeze_workqueues_begin - begin freezing workqueues * * Start freezing workqueues. After this function returns, all freezable - * workqueues will queue new works to their delayed_works list instead of + * workqueues will queue new works to their inactive_works list instead of * pool->worklist. * * CONTEXT: -- 2.25.1

1 4

[PATCH openEuler-22.03-LTS] nvme-pci: clear the prp2 field when not used
by Yong Hu 03 Aug '23

03 Aug '23

From: Lei Rao <lei.rao(a)intel.com> stable inclusion from stable-v5.10.188 commit 74b139c63f0775cf79266e9d9546c62b73fb3385 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7PZZC CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a56ea6147facce4ac1fc38675455f9733d96232b ] If the prp2 field is not filled in nvme_setup_prp_simple(), the prp2 field is garbage data. According to nvme spec, the prp2 is reserved if the data transfer does not cross a memory page boundary, so clear it to zero if it is not used. Signed-off-by: Lei Rao <lei.rao(a)intel.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yong Hu <yong.hu(a)windriver.com> --- drivers/nvme/host/pci.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index c09ee462b048..fbbbfdea076a 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -817,6 +817,8 @@ static blk_status_t nvme_setup_prp_simple(struct nvme_dev *dev, cmnd->dptr.prp1 = cpu_to_le64(iod->first_dma); if (bv->bv_len > first_prp_len) cmnd->dptr.prp2 = cpu_to_le64(iod->first_dma + first_prp_len); + else + cmnd->dptr.prp2 = 0; return BLK_STS_OK; } -- 2.34.1

2 1

[PATCH OLK-5.10] nvme-pci: clear the prp2 field when not used
by Yong Hu 03 Aug '23

03 Aug '23

From: Lei Rao <lei.rao(a)intel.com> stable inclusion from stable-v5.10.188 commit 74b139c63f0775cf79266e9d9546c62b73fb3385 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7PZZC CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit a56ea6147facce4ac1fc38675455f9733d96232b ] If the prp2 field is not filled in nvme_setup_prp_simple(), the prp2 field is garbage data. According to nvme spec, the prp2 is reserved if the data transfer does not cross a memory page boundary, so clear it to zero if it is not used. Signed-off-by: Lei Rao <lei.rao(a)intel.com> Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Yong Hu <yong.hu(a)windriver.com> --- drivers/nvme/host/pci.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c index c30ab2cf2533..8965ea20f5ef 100644 --- a/drivers/nvme/host/pci.c +++ b/drivers/nvme/host/pci.c @@ -817,6 +817,8 @@ static blk_status_t nvme_setup_prp_simple(struct nvme_dev *dev, cmnd->dptr.prp1 = cpu_to_le64(iod->first_dma); if (bv->bv_len > first_prp_len) cmnd->dptr.prp2 = cpu_to_le64(iod->first_dma + first_prp_len); + else + cmnd->dptr.prp2 = 0; return BLK_STS_OK; } -- 2.33.0

2 1

[PATCH OLK-5.10] sched: Add feature 'UTIL_TASKGROUP' for dynamic affinity
by Hui Tang 03 Aug '23

03 Aug '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I526XC -------------------------------- If the feature enabled, util_avg of bottom-level tg is used, otherwise, util_avg of rq's cfs_rq is used. Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- kernel/sched/fair.c | 19 ++++++++++++++----- kernel/sched/features.h | 7 +++++++ 2 files changed, 21 insertions(+), 5 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 5c8b48150862..f6068f1c28bc 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7097,6 +7097,17 @@ static inline bool prefer_cpus_valid(struct task_struct *p) cpumask_subset(p->prefer_cpus, p->cpus_ptr); } +static inline unsigned long taskgroup_cpu_util(struct task_group *tg, + int cpu) +{ +#ifdef CONFIG_FAIR_GROUP_SCHED + if (tg->se[cpu] && sched_feat(DA_UTIL_TASKGROUP)) + return tg->se[cpu]->avg.util_avg; +#endif + + return cpu_util(cpu); +} + /* * set_task_select_cpus: select the cpu range for task * @p: the task whose available cpu range will to set @@ -7127,13 +7138,11 @@ static void set_task_select_cpus(struct task_struct *p, int *idlest_cpu, rcu_read_lock(); tg = task_group(p); for_each_cpu(cpu, p->prefer_cpus) { - if (unlikely(!tg->se[cpu])) - continue; - if (idlest_cpu && available_idle_cpu(cpu)) { *idlest_cpu = cpu; } else if (idlest_cpu) { - spare = (long)(capacity_of(cpu) - tg->se[cpu]->avg.util_avg); + spare = (long)(capacity_of(cpu) - + taskgroup_cpu_util(tg, cpu)); if (spare > min_util) { min_util = spare; *idlest_cpu = cpu; @@ -7148,7 +7157,7 @@ static void set_task_select_cpus(struct task_struct *p, int *idlest_cpu, return; } - util_avg_sum += tg->se[cpu]->avg.util_avg; + util_avg_sum += taskgroup_cpu_util(tg, cpu); tg_capacity += capacity_of(cpu); } rcu_read_unlock(); diff --git a/kernel/sched/features.h b/kernel/sched/features.h index fef48f5be2fa..76fade025c4b 100644 --- a/kernel/sched/features.h +++ b/kernel/sched/features.h @@ -106,3 +106,10 @@ SCHED_FEAT(UTIL_EST_FASTUP, true) SCHED_FEAT(ALT_PERIOD, true) SCHED_FEAT(BASE_SLICE, true) + +#ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY +/* + * Use util_avg of bottom-Level taskgroup + */ +SCHED_FEAT(DA_UTIL_TASKGROUP, true) +#endif -- 2.17.1

2 1

[PATCH openEuler-1.0-LTS 0/2] can: raw: fix receiver memory leak
by Ziyang Xuan 03 Aug '23

03 Aug '23

Backport can/raw receiver memory leak fix commits. Eric Dumazet (1): can: raw: fix lockdep issue in raw_release() Ziyang Xuan (1): can: raw: fix receiver memory leak net/can/raw.c | 68 ++++++++++++++++++++++----------------------------- 1 file changed, 29 insertions(+), 39 deletions(-) -- 2.25.1

2 3

[PATCH openEuler-1.0-LTS v2 0/2] Fix host zero page refcount overflow caused by kvm
by Lei Chen 03 Aug '23

03 Aug '23

v2: 1. using full commit id instead of abbrevation 2. fix wrong mainline tag Sean Christopherson (1): KVM: Don't set Accessed/Dirty bits for ZERO_PAGE Zhuang Yanying (1): KVM: fix overflow of zero page refcount with ksm running virt/kvm/kvm_main.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH] coresight: etm4x: Don't bother the user with nonessential log message
by Tian Tao 03 Aug '23

03 Aug '23

Each cpu will print the following log when initializing ETM "coresight etm1: CPU1: etm v4.5 initialized", if there are a lot of cpus, e.g. 128. there will be a screen full of this log. replace dev_info with dev_dbg prints only when needed. Signed-off-by: Tian Tao <tiantao6(a)hisilicon.com> --- drivers/hwtracing/coresight/coresight-etm4x-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c index 7e307022303a..7b51e8594fd5 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c @@ -2033,7 +2033,7 @@ static int etm4_add_coresight_dev(struct etm4_init_arg *init_arg) etmdrvdata[drvdata->cpu] = drvdata; - dev_info(&drvdata->csdev->dev, "CPU%d: %s v%d.%d initialized\n", + dev_dbg(&drvdata->csdev->dev, "CPU%d: %s v%d.%d initialized\n", drvdata->cpu, type_name, major, minor); if (boot_enable) { -- 2.33.0

1 0

[PATCH] coresight: etm4x: Don't bother the user with nonessential log message
by Tian Tao 02 Aug '23

02 Aug '23

Each cpu will print the following log when initializing ETM "coresight etm1: CPU1: etm v4.5 initialized", if there are a lot of cpus, e.g. 128. there will be a screen full of this log. replace dev_dbg with dev _printf prints only when needed. Signed-off-by: Tian Tao <tiantao6(a)hisilicon.com> --- drivers/hwtracing/coresight/coresight-etm4x-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/hwtracing/coresight/coresight-etm4x-core.c b/drivers/hwtracing/coresight/coresight-etm4x-core.c index 7e307022303a..7b51e8594fd5 100644 --- a/drivers/hwtracing/coresight/coresight-etm4x-core.c +++ b/drivers/hwtracing/coresight/coresight-etm4x-core.c @@ -2033,7 +2033,7 @@ static int etm4_add_coresight_dev(struct etm4_init_arg *init_arg) etmdrvdata[drvdata->cpu] = drvdata; - dev_info(&drvdata->csdev->dev, "CPU%d: %s v%d.%d initialized\n", + dev_dbg(&drvdata->csdev->dev, "CPU%d: %s v%d.%d initialized\n", drvdata->cpu, type_name, major, minor); if (boot_enable) { -- 2.33.0

1 0

[PATCH OLK-5.10 v2] arm64/mpam: avoid hot-plug mpam_cpu_online() twice in mpam_enable()
by Wang ShaoBo 02 Aug '23

02 Aug '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7PN0A CVE: NA ------------------------------------------------- BUG reported when setuping MPAM driver: [Thu Jul 27 12:15:54 2023] BUG: sleeping function called from invalid context at include/linux/percpu-rwsem.h:49 [Thu Jul 27 12:15:54 2023] in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 593, name: kworker/72:1 [Thu Jul 27 12:15:54 2023] CPU: 72 PID: 593 Comm: kworker/72:1 Not tainted 5.10.0-03467-g02e1abb0f821-dirty #1 [Thu Jul 27 12:15:54 2023] Hardware name: Huawei TaiShan 2280 V2/BC82AMDDA, BIOS 1.79 08/21/2021 [Thu Jul 27 12:15:54 2023] Loaded X.509 cert 'Build time autogenerated kernel key: 9ae2dc86231d0b23cd114b5ed4089cac17566b0f' [Thu Jul 27 12:15:54 2023] Workqueue: events mpam_enable [Thu Jul 27 12:15:54 2023] Load PGP public keys [Thu Jul 27 12:15:54 2023] Call trace: [Thu Jul 27 12:15:54 2023] dump_backtrace+0x0/0x30c [Thu Jul 27 12:15:54 2023] show_stack+0x20/0x30 [Thu Jul 27 12:15:54 2023] dump_stack+0x11c/0x174 [Thu Jul 27 12:15:54 2023] ___might_sleep+0x15c/0x1a0 [Thu Jul 27 12:15:54 2023] __might_sleep+0x7c/0x100 [Thu Jul 27 12:15:54 2023] cpus_read_lock+0x3c/0x110 [Thu Jul 27 12:15:54 2023] __cpuhp_setup_state+0x3c/0x80 [Thu Jul 27 12:15:54 2023] mpam_enable+0x148/0x3a4 [Thu Jul 27 12:15:54 2023] process_one_work+0x3cc/0x984 [Thu Jul 27 12:15:54 2023] worker_thread+0x2b0/0x71c [Thu Jul 27 12:15:54 2023] kthread+0x1e0/0x220 [Thu Jul 27 12:15:54 2023] ret_from_fork+0x10/0x18 [Thu Jul 27 12:15:54 2023] kmemleak: Kernel memory leak detector initialized (mem pool available: 11650) [Thu Jul 27 12:15:54 2023] kmemleak: Automatic memory scanning thread started [Thu Jul 27 12:15:54 2023] cryptd: max_cpu_qlen set to 1000 [Thu Jul 27 12:15:54 2023] Key type encrypted registered [Thu Jul 27 12:15:54 2023] AppArmor: AppArmor sha1 policy hashing enabled [Thu Jul 27 12:15:54 2023] integrity: Loading X.509 certificate: UEFI:db Patch: bc9e3f9895ef2 ("arm64/mpam: Fix mpam corrupt when cpu online") has reported the 'Bad PC' BUG, concurrently calling cpuhp_remove_state() and cpuhp_setup_state() in mpam_enable is dangerous as we share the same state-=>mpam_cpuhp_state, which may be changed after the interrupt returns, Patch bc9e3f9895ef2 disable irqs but it didn't completely solve this problem, and trigger this BUG report, we can use lockless atomic_fetch_inc() function to avoid hot-plug mpam_cpu_online() twice in mpam_enable() instead. Fixes: bc9e3f9895ef2 ("arm64/mpam: Fix mpam corrupt when cpu online") Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_device.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index adf4bc034a51f..9ff8947a2ddf7 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -540,6 +540,7 @@ static void mpam_disable_irqs(void) static void mpam_enable(struct work_struct *work) { int err; + static atomic_t once; unsigned long flags; struct mpam_device *dev; bool all_devices_probed = true; @@ -557,7 +558,7 @@ static void mpam_enable(struct work_struct *work) } mutex_unlock(&mpam_devices_lock); - if (!all_devices_probed) + if (!all_devices_probed || atomic_fetch_inc(&once)) return; mutex_lock(&mpam_devices_lock); @@ -596,11 +597,9 @@ static void mpam_enable(struct work_struct *work) pr_err("Failed to setup/init resctrl\n"); mutex_unlock(&mpam_devices_lock); - local_irq_disable(); mpam_cpuhp_state = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "mpam:online", mpam_cpu_online, mpam_cpu_offline); - local_irq_enable(); if (mpam_cpuhp_state <= 0) pr_err("Failed to re-register 'dyn' cpuhp callbacks"); mutex_unlock(&mpam_cpuhp_lock); -- 2.25.1

1 0

[PATCH OLK-5.10 0/4] fix three CVEs by backport mainline patchs
by ZhaoLong Wang 02 Aug '23

02 Aug '23

mainline patch f5c779b7ddbda("ksmbd: fix racy issue from session setup and logoff") It fixes three CVEs: CVE-2023-32250 CVE-2023-32252 CVE-2023-32257 In order to successfully apply the patch, we chose to incorporate the related pre-installed bugfix patch. Colin Ian King (1): ksmbd: Fix spelling mistake "excceed" -> "exceeded" Dawei Li (1): ksmbd: Implements sess->ksmbd_chann_list as xarray Namjae Jeon (2): ksmbd: limit pdu length size according to connection status ksmbd: fix racy issue from session setup and logoff fs/ksmbd/connection.c | 27 +++++++--- fs/ksmbd/connection.h | 39 ++++++++------ fs/ksmbd/mgmt/user_session.c | 62 +++++++++------------ fs/ksmbd/mgmt/user_session.h | 4 +- fs/ksmbd/server.c | 3 +- fs/ksmbd/smb2pdu.c | 101 +++++++++++++++++------------------ fs/ksmbd/smb2pdu.h | 5 +- fs/ksmbd/transport_tcp.c | 2 +- 8 files changed, 123 insertions(+), 120 deletions(-) -- 2.34.3

2 5

[OLK-5.10 0/4] fix three CVEs by backport mainline patchs
by ZhaoLong Wang 02 Aug '23

02 Aug '23

mainline patch f5c779b7ddbda("ksmbd: fix racy issue from session setup and logoff") It fixes three CVEs: CVE-2023-32250 CVE-2023-32252 CVE-2023-32257 In order to successfully apply the patch, we chose to incorporate the related pre-installed bugfix patch. Colin Ian King (1): ksmbd: Fix spelling mistake "excceed" -> "exceeded" Dawei Li (1): ksmbd: Implements sess->ksmbd_chann_list as xarray Namjae Jeon (2): ksmbd: limit pdu length size according to connection status ksmbd: fix racy issue from session setup and logoff fs/ksmbd/connection.c | 27 +++++++--- fs/ksmbd/connection.h | 39 ++++++++------ fs/ksmbd/mgmt/user_session.c | 62 +++++++++------------ fs/ksmbd/mgmt/user_session.h | 4 +- fs/ksmbd/server.c | 3 +- fs/ksmbd/smb2pdu.c | 101 +++++++++++++++++------------------ fs/ksmbd/smb2pdu.h | 5 +- fs/ksmbd/transport_tcp.c | 2 +- 8 files changed, 123 insertions(+), 120 deletions(-) -- 2.34.3

1 4

[PATCH openEuler-1.0-LTS 0/2] Fix host zero page refcount overflow caused by kvm
by Lei Chen 02 Aug '23

02 Aug '23

Sean Christopherson (1): KVM: Don't set Accessed/Dirty bits for ZERO_PAGE Zhuang Yanying (1): KVM: fix overflow of zero page refcount with ksm running virt/kvm/kvm_main.c | 23 ++++++++++++++++------- 1 file changed, 16 insertions(+), 7 deletions(-) -- 2.34.1

2 3

[PATCH openEuler-23.09 00/46]ima: Add IMA digest lists feature
by Zhou Shuiqing 01 Aug '23

01 Aug '23

This patchset supports IMA digest lists for the kernel. David Howells (4): PGPLIB: PGP definitions (RFC 4880) PGPLIB: Basic packet parser KEYS: Provide PGP key description autogeneration KEYS: Provide a function to load keys from a PGP keyring blob Mimi Zohar (1): initramfs: add file metadata Roberto Sassu (34): initramfs: read metadata from special file METADATA!!! gen_init_cpio: add support for file metadata init: Add kernel option to force usage of tmpfs for rootfs ima: Add enforce-evm and log-evm modes to strictly check EVM status ima: Allow choice of file hash algorithm for measurement and audit ima: Generalize ima_read_policy() ima: Generalize ima_write_policy() and raise uploaded data size limit ima: Generalize policy file operations ima: Use ima_show_htable_value to show violations and hash table data ima: Add parser of compact digest list ima: Prevent usage of digest lists not measured or appraised ima: Introduce new securityfs files ima: Introduce new hook DIGEST_LIST_CHECK ima: Load all digest lists from a directory at boot time ima: Add support for measurement with digest lists ima: Add support for appraisal with digest lists evm: Add support for digest lists of metadata ima: Add meta_immutable appraisal type ima: Introduce exec_tcb policy ima: Introduce appraise_exec_tcb policy ima: Introduce appraise_exec_immutable policy ima: Add Documentation/security/IMA-digest-lists.txt mpi: introduce mpi_key_length() rsa: add parser of raw format KEYS: PGP data parser KEYS: Introduce load_pgp_public_keyring() certs: Introduce search_trusted_key() ima: Search key in the built-in keyrings ima: Allow direct upload of digest lists to securityfs ima: Add parser keyword to the policy evm: Extend evm= with x509. allow_metadata_writes and complete values ima: Execute parser to upload digest lists not recognizable by the kernel evm: Propagate choice of HMAC algorithm in evm_crypto.c config: add digest list options for arm64 and x86 Zhang Tianxing (5): ima: fix a memory leak in ima_del_digest_data_entry ima: Add max size for IMA digest database ima: don't allow control characters in policy path ima: fix CONFIG_IMA_DIGEST_DB_MEGABYTES in openeuler_defconfig ima: fix db size overflow and Kconfig issues Zheng Zengkai (1): Revert "evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded" shenxiangwei (1): ima: bugfix for digest lists importing Documentation/ABI/testing/evm | 4 +- .../admin-guide/kernel-parameters.txt | 49 +- Documentation/security/IMA-digest-lists.txt | 259 ++++++++++ arch/arm64/configs/openeuler_defconfig | 11 + arch/x86/configs/openeuler_defconfig | 31 +- certs/Kconfig | 7 + certs/Makefile | 7 + certs/system_certificates.S | 18 + certs/system_keyring.c | 44 ++ crypto/asymmetric_keys/Kconfig | 25 + crypto/asymmetric_keys/Makefile | 10 + crypto/asymmetric_keys/pgp_library.c | 281 +++++++++++ crypto/asymmetric_keys/pgp_parser.h | 23 + crypto/asymmetric_keys/pgp_preload.c | 119 +++++ crypto/asymmetric_keys/pgp_public_key.c | 383 +++++++++++++++ crypto/rsa.c | 14 +- crypto/rsa_helper.c | 69 +++ include/crypto/internal/rsa.h | 6 + include/linux/initramfs.h | 21 + include/linux/kernel_read_file.h | 1 + include/linux/mpi.h | 2 + include/linux/pgp.h | 220 +++++++++ include/linux/pgplib.h | 48 ++ include/linux/verification.h | 4 + init/do_mounts.c | 11 +- init/initramfs.c | 138 +++++- lib/mpi/mpicoder.c | 33 +- security/integrity/digsig_asymmetric.c | 10 + security/integrity/evm/Kconfig | 32 ++ security/integrity/evm/evm.h | 1 + security/integrity/evm/evm_crypto.c | 24 +- security/integrity/evm/evm_main.c | 103 +++- security/integrity/evm/evm_secfs.c | 2 +- security/integrity/iint.c | 2 + security/integrity/ima/Kconfig | 49 ++ security/integrity/ima/Makefile | 1 + security/integrity/ima/ima.h | 39 +- security/integrity/ima/ima_api.c | 42 +- security/integrity/ima/ima_appraise.c | 117 ++++- security/integrity/ima/ima_digest_list.c | 465 ++++++++++++++++++ security/integrity/ima/ima_digest_list.h | 54 ++ security/integrity/ima/ima_fs.c | 294 ++++++++--- security/integrity/ima/ima_init.c | 2 +- security/integrity/ima/ima_main.c | 126 ++++- security/integrity/ima/ima_policy.c | 116 ++++- security/integrity/integrity.h | 47 +- usr/Kconfig | 8 + usr/Makefile | 4 +- usr/gen_init_cpio.c | 136 ++++- usr/gen_initramfs.sh | 7 +- 50 files changed, 3301 insertions(+), 218 deletions(-) create mode 100644 Documentation/security/IMA-digest-lists.txt create mode 100644 crypto/asymmetric_keys/pgp_library.c create mode 100644 crypto/asymmetric_keys/pgp_parser.h create mode 100644 crypto/asymmetric_keys/pgp_preload.c create mode 100644 crypto/asymmetric_keys/pgp_public_key.c create mode 100644 include/linux/initramfs.h create mode 100644 include/linux/pgp.h create mode 100644 include/linux/pgplib.h create mode 100644 security/integrity/ima/ima_digest_list.c create mode 100644 security/integrity/ima/ima_digest_list.h -- 2.33.0

2 51

[PATCH OLK-5.10] arm64/mpam: implement CPU_PM notifier
by Wang ShaoBo 01 Aug '23

01 Aug '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7PP9I -------------------------------- When a CPU is suspended (either through suspend-to-RAM or CPUidle), The content of MPAM context registers can be lost, as PARTID and PMG is reserved already in this-cpu variable pqr_state, so restore it on power-up process. Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_device.c | 27 ++++++++++++++++++++++++++ arch/arm64/kernel/mpam/mpam_internal.h | 2 ++ arch/arm64/kernel/mpam/mpam_resctrl.c | 10 ++++++++++ 3 files changed, 39 insertions(+) diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index 66d787f134c0e..06e8afadd149e 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -35,6 +35,7 @@ #include <linux/of.h> #include <linux/of_platform.h> #include <linux/of_address.h> +#include <linux/cpu_pm.h> #include "mpam_resource.h" #include "mpam_device.h" @@ -532,6 +533,30 @@ static void mpam_disable_irqs(void) } } +static struct notifier_block mpam_notifier_block; +static int cpu_pm_mpam_notify(struct notifier_block *b, + unsigned long cmd, void *v) +{ + switch (cmd) { + case CPU_PM_ENTER: + break; + case CPU_PM_EXIT: + case CPU_PM_ENTER_FAILED: + mpam_restore_context(); + break; + default: + return NOTIFY_DONE; + } + + return NOTIFY_OK; +} + +static int cpu_pm_mpam_register(void) +{ + mpam_notifier_block.notifier_call = cpu_pm_mpam_notify; + return cpu_pm_register_notifier(&mpam_notifier_block); +} + /* * Enable mpam once all devices have been probed. * Scheduled by mpam_discovery_complete() once all devices have been created. @@ -603,6 +628,8 @@ static void mpam_enable(struct work_struct *work) if (mpam_cpuhp_state <= 0) pr_err("Failed to re-register 'dyn' cpuhp callbacks"); mutex_unlock(&mpam_cpuhp_lock); + + cpu_pm_mpam_register(); } static void mpam_failed(struct work_struct *work) diff --git a/arch/arm64/kernel/mpam/mpam_internal.h b/arch/arm64/kernel/mpam/mpam_internal.h index 7b84ea54975aa..1ba355988b2c4 100644 --- a/arch/arm64/kernel/mpam/mpam_internal.h +++ b/arch/arm64/kernel/mpam/mpam_internal.h @@ -342,4 +342,6 @@ int rmid_mon_ptrs_init(u32 nr_rmids); struct resctrl_resource * mpam_resctrl_get_resource(enum resctrl_resource_level level); +void mpam_restore_context(void); + #endif diff --git a/arch/arm64/kernel/mpam/mpam_resctrl.c b/arch/arm64/kernel/mpam/mpam_resctrl.c index 4a1e376ec4970..af5b52c3ad417 100644 --- a/arch/arm64/kernel/mpam/mpam_resctrl.c +++ b/arch/arm64/kernel/mpam/mpam_resctrl.c @@ -2272,6 +2272,16 @@ void __mpam_sched_in(void) } } +void mpam_restore_context(void) +{ + struct intel_pqr_state *state = this_cpu_ptr(&pqr_state); + + state->cur_rmid = 0; + state->cur_closid = 0; + + mpam_sched_in(); +} + static void mpam_update_from_resctrl_cfg(struct mpam_resctrl_res *res, u32 resctrl_cfg, enum rdt_event_id evt, -- 2.25.1

1 0

[PATCH OLK-5.10] sched: Fix build error if !FAIR_GROUP_SCHED
by Hui Tang 01 Aug '23

01 Aug '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7PNAF ------------------------------- Fix build error if !FAIR_GROUP_SCHED && QOS_SCHED_DYNAMIC_AFFINITY. Fixes: 229f5c1f3868 ("sched: Introduce dynamic affinity for cfs scheduler") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- init/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/init/Kconfig b/init/Kconfig index 31fff350a288..6369a34357b6 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1035,7 +1035,7 @@ endif #CGROUP_SCHED config QOS_SCHED_DYNAMIC_AFFINITY bool "qos dynamic affinity" - depends on CPUSETS + depends on CPUSETS && FAIR_GROUP_SCHED default n help This feature lets you allocate preferred cpus to taskgroup. If enabled, -- 2.17.1

2 1

[PATCH OLK-5.10] sched: Fix build error for dynamic_affinity_enable()
by Hui Tang 01 Aug '23

01 Aug '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7PNAF ------------------------------- Fix build error if defined(!CONFIG_JUMP_LABEL) && defined(CONFIG_QOS_SCHED_DYNAMIC_AFFINITY). Fixes: d8f77f894df3 ("sched: fix performance degradation on lmbench") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- kernel/sched/fair.c | 9 --------- 1 file changed, 9 deletions(-) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 003ebd244d31..5c8b48150862 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7070,8 +7070,6 @@ static int find_energy_efficient_cpu(struct task_struct *p, int prev_cpu) } #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY - -#ifdef CONFIG_JUMP_LABEL static DEFINE_STATIC_KEY_FALSE(__dynamic_affinity_used); static __always_inline bool dynamic_affinity_used(void) @@ -7084,13 +7082,6 @@ void dynamic_affinity_enable(void) static_branch_enable_cpuslocked(&__dynamic_affinity_used); } -#else /* CONFIG_JUMP_LABEL */ -static __always_inline bool dynamic_affinity_used(void) -{ - return true; -} -#endif - /* * Low utilization threshold for CPU * -- 2.17.1

2 1

[PATCH OLK-5.10] arm64/mpam: avoid hot-plug mpam_cpu_online() twice in mpam_enable()
by Wang ShaoBo 01 Aug '23

01 Aug '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7PN0A CVE: NA ------------------------------------------------- BUG reported when setuping MPAM driver: [Thu Jul 27 12:15:54 2023] BUG: sleeping function called from invalid context at include/linux/percpu-rwsem.h:49 [Thu Jul 27 12:15:54 2023] in_atomic(): 0, irqs_disabled(): 128, non_block: 0, pid: 593, name: kworker/72:1 [Thu Jul 27 12:15:54 2023] CPU: 72 PID: 593 Comm: kworker/72:1 Not tainted 5.10.0-03467-g02e1abb0f821-dirty #1 [Thu Jul 27 12:15:54 2023] Hardware name: Huawei TaiShan 2280 V2/BC82AMDDA, BIOS 1.79 08/21/2021 [Thu Jul 27 12:15:54 2023] Loaded X.509 cert 'Build time autogenerated kernel key: 9ae2dc86231d0b23cd114b5ed4089cac17566b0f' [Thu Jul 27 12:15:54 2023] Workqueue: events mpam_enable [Thu Jul 27 12:15:54 2023] Load PGP public keys [Thu Jul 27 12:15:54 2023] Call trace: [Thu Jul 27 12:15:54 2023] dump_backtrace+0x0/0x30c [Thu Jul 27 12:15:54 2023] show_stack+0x20/0x30 [Thu Jul 27 12:15:54 2023] dump_stack+0x11c/0x174 [Thu Jul 27 12:15:54 2023] ___might_sleep+0x15c/0x1a0 [Thu Jul 27 12:15:54 2023] __might_sleep+0x7c/0x100 [Thu Jul 27 12:15:54 2023] cpus_read_lock+0x3c/0x110 [Thu Jul 27 12:15:54 2023] __cpuhp_setup_state+0x3c/0x80 [Thu Jul 27 12:15:54 2023] mpam_enable+0x148/0x3a4 [Thu Jul 27 12:15:54 2023] process_one_work+0x3cc/0x984 [Thu Jul 27 12:15:54 2023] worker_thread+0x2b0/0x71c [Thu Jul 27 12:15:54 2023] kthread+0x1e0/0x220 [Thu Jul 27 12:15:54 2023] ret_from_fork+0x10/0x18 [Thu Jul 27 12:15:54 2023] kmemleak: Kernel memory leak detector initialized (mem pool available: 11650) [Thu Jul 27 12:15:54 2023] kmemleak: Automatic memory scanning thread started [Thu Jul 27 12:15:54 2023] cryptd: max_cpu_qlen set to 1000 [Thu Jul 27 12:15:54 2023] Key type encrypted registered [Thu Jul 27 12:15:54 2023] AppArmor: AppArmor sha1 policy hashing enabled [Thu Jul 27 12:15:54 2023] integrity: Loading X.509 certificate: UEFI:db Patch: bc9e3f9895ef2 ("arm64/mpam: Fix mpam corrupt when cpu online") disable irqs when hot-plug mpam_cpu_online() callback twice in occasional situation re-enter mpam_enable() function concurrently after probing all mpam devices success, this is not safe as cpuhp_setup_state() calls sleeping function, we can use lockless atomic_fetch_inc() function to avoid hot-plug mpam_cpu_online() twice in mpam_enable() instead. Fixes: bc9e3f9895ef2 ("arm64/mpam: Fix mpam corrupt when cpu online") Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_device.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/arch/arm64/kernel/mpam/mpam_device.c b/arch/arm64/kernel/mpam/mpam_device.c index c59f7f09308dc..66d787f134c0e 100644 --- a/arch/arm64/kernel/mpam/mpam_device.c +++ b/arch/arm64/kernel/mpam/mpam_device.c @@ -540,6 +540,7 @@ static void mpam_disable_irqs(void) static void mpam_enable(struct work_struct *work) { int err; + static atomic_t once; unsigned long flags; struct mpam_device *dev; bool all_devices_probed = true; @@ -557,7 +558,7 @@ static void mpam_enable(struct work_struct *work) } mutex_unlock(&mpam_devices_lock); - if (!all_devices_probed) + if (!all_devices_probed || atomic_fetch_inc(&once)) return; mutex_lock(&mpam_devices_lock); @@ -596,11 +597,9 @@ static void mpam_enable(struct work_struct *work) pr_err("Failed to setup/init resctrl\n"); mutex_unlock(&mpam_devices_lock); - local_irq_disable(); mpam_cpuhp_state = cpuhp_setup_state(CPUHP_AP_ONLINE_DYN, "mpam:online", mpam_cpu_online, mpam_cpu_offline); - local_irq_enable(); if (mpam_cpuhp_state <= 0) pr_err("Failed to re-register 'dyn' cpuhp callbacks"); mutex_unlock(&mpam_cpuhp_lock); -- 2.25.1

1 0

[PATCH OLK-5.10 0/2] can: raw: fix receiver memory leak
by Ziyang Xuan 01 Aug '23

01 Aug '23

Backport can/raw receiver memory leak fix commits. Eric Dumazet (1): can: raw: fix lockdep issue in raw_release() Ziyang Xuan (1): can: raw: fix receiver memory leak net/can/raw.c | 62 +++++++++++++++++++++------------------------------ 1 file changed, 25 insertions(+), 37 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10 0/2] CVE-2023-38430
by Li Nan 01 Aug '23

01 Aug '23

Li Nan (1): ksmbd: define SMB2_COMPRESSION_TRANSFORM_ID in fs/ksmbd/smb2pdu.h Namjae Jeon (1): ksmbd: validate smb request protocol id fs/ksmbd/smb2pdu.h | 1 + fs/ksmbd/connection.c | 5 +++-- fs/ksmbd/smb_common.c | 14 +++++++++++++- 3 files changed, 17 insertions(+), 3 deletions(-) -- 2.39.2

2 3

[PATCH OLK-5.10 v2 0/2] net: nfc: Fix CVE-2023-3863
by Ziyang Xuan 01 Aug '23

01 Aug '23

Backport CVE-2023-3863 fix commits. v2: - Resend the patchset. Krzysztof Kozlowski (1): nfc: llcp: simplify llcp_sock_connect() error paths Lin Ma (1): net: nfc: Fix use-after-free caused by nfc_llcp_find_local net/nfc/llcp.h | 1 - net/nfc/llcp_commands.c | 12 +++++++--- net/nfc/llcp_core.c | 49 +++++++++++++++++++++++++++++++++++------ net/nfc/llcp_sock.c | 21 ++++++++++-------- net/nfc/netlink.c | 20 ++++++++++++----- net/nfc/nfc.h | 1 + 6 files changed, 79 insertions(+), 25 deletions(-) -- 2.25.1

2 5

[PATCH v2 openEuler-23.09 00/46] ima: add IMA digest lists extension
by Zhou Shuiqing 31 Jul '23

31 Jul '23

Sync patched for IMA digest lists extension -Based on the kernel code of version 6.x v2: -Add patch0 to provide cover information for patch set. David Howells (4): PGPLIB: PGP definitions (RFC 4880) PGPLIB: Basic packet parser KEYS: Provide PGP key description autogeneration KEYS: Provide a function to load keys from a PGP keyring blob Mimi Zohar (1): initramfs: add file metadata Roberto Sassu (34): initramfs: read metadata from special file METADATA!!! gen_init_cpio: add support for file metadata init: Add kernel option to force usage of tmpfs for rootfs ima: Add enforce-evm and log-evm modes to strictly check EVM status ima: Allow choice of file hash algorithm for measurement and audit ima: Generalize ima_read_policy() ima: Generalize ima_write_policy() and raise uploaded data size limit ima: Generalize policy file operations ima: Use ima_show_htable_value to show violations and hash table data ima: Add parser of compact digest list ima: Prevent usage of digest lists not measured or appraised ima: Introduce new securityfs files ima: Introduce new hook DIGEST_LIST_CHECK ima: Load all digest lists from a directory at boot time ima: Add support for measurement with digest lists ima: Add support for appraisal with digest lists evm: Add support for digest lists of metadata ima: Add meta_immutable appraisal type ima: Introduce exec_tcb policy ima: Introduce appraise_exec_tcb policy ima: Introduce appraise_exec_immutable policy ima: Add Documentation/security/IMA-digest-lists.txt mpi: introduce mpi_key_length() rsa: add parser of raw format KEYS: PGP data parser KEYS: Introduce load_pgp_public_keyring() certs: Introduce search_trusted_key() ima: Search key in the built-in keyrings ima: Allow direct upload of digest lists to securityfs ima: Add parser keyword to the policy evm: Extend evm= with x509. allow_metadata_writes and complete values ima: Execute parser to upload digest lists not recognizable by the kernel evm: Propagate choice of HMAC algorithm in evm_crypto.c config: add digest list options for arm64 and x86 Zhang Tianxing (5): ima: fix a memory leak in ima_del_digest_data_entry ima: Add max size for IMA digest database ima: don't allow control characters in policy path ima: fix CONFIG_IMA_DIGEST_DB_MEGABYTES in openeuler_defconfig ima: fix db size overflow and Kconfig issues Zheng Zengkai (1): Revert "evm: Refuse EVM_ALLOW_METADATA_WRITES only if an HMAC key is loaded" shenxiangwei (1): ima: bugfix for digest lists importing Documentation/ABI/testing/evm | 4 +- .../admin-guide/kernel-parameters.txt | 49 +- Documentation/security/IMA-digest-lists.txt | 259 ++++++++++ arch/arm64/configs/openeuler_defconfig | 11 + arch/x86/configs/openeuler_defconfig | 31 +- certs/Kconfig | 7 + certs/Makefile | 7 + certs/system_certificates.S | 18 + certs/system_keyring.c | 44 ++ crypto/asymmetric_keys/Kconfig | 25 + crypto/asymmetric_keys/Makefile | 10 + crypto/asymmetric_keys/pgp_library.c | 281 +++++++++++ crypto/asymmetric_keys/pgp_parser.h | 23 + crypto/asymmetric_keys/pgp_preload.c | 119 +++++ crypto/asymmetric_keys/pgp_public_key.c | 383 +++++++++++++++ crypto/rsa.c | 14 +- crypto/rsa_helper.c | 69 +++ include/crypto/internal/rsa.h | 6 + include/linux/initramfs.h | 21 + include/linux/kernel_read_file.h | 1 + include/linux/mpi.h | 2 + include/linux/pgp.h | 220 +++++++++ include/linux/pgplib.h | 48 ++ include/linux/verification.h | 4 + init/do_mounts.c | 11 +- init/initramfs.c | 138 +++++- lib/mpi/mpicoder.c | 33 +- security/integrity/digsig_asymmetric.c | 10 + security/integrity/evm/Kconfig | 32 ++ security/integrity/evm/evm.h | 1 + security/integrity/evm/evm_crypto.c | 24 +- security/integrity/evm/evm_main.c | 103 +++- security/integrity/evm/evm_secfs.c | 2 +- security/integrity/iint.c | 2 + security/integrity/ima/Kconfig | 49 ++ security/integrity/ima/Makefile | 1 + security/integrity/ima/ima.h | 39 +- security/integrity/ima/ima_api.c | 42 +- security/integrity/ima/ima_appraise.c | 117 ++++- security/integrity/ima/ima_digest_list.c | 465 ++++++++++++++++++ security/integrity/ima/ima_digest_list.h | 54 ++ security/integrity/ima/ima_fs.c | 294 ++++++++--- security/integrity/ima/ima_init.c | 2 +- security/integrity/ima/ima_main.c | 128 ++++- security/integrity/ima/ima_policy.c | 116 ++++- security/integrity/integrity.h | 47 +- usr/Kconfig | 8 + usr/Makefile | 4 +- usr/gen_init_cpio.c | 136 ++++- usr/gen_initramfs.sh | 7 +- 50 files changed, 3302 insertions(+), 219 deletions(-) create mode 100644 Documentation/security/IMA-digest-lists.txt create mode 100644 crypto/asymmetric_keys/pgp_library.c create mode 100644 crypto/asymmetric_keys/pgp_parser.h create mode 100644 crypto/asymmetric_keys/pgp_preload.c create mode 100644 crypto/asymmetric_keys/pgp_public_key.c create mode 100644 include/linux/initramfs.h create mode 100644 include/linux/pgp.h create mode 100644 include/linux/pgplib.h create mode 100644 security/integrity/ima/ima_digest_list.c create mode 100644 security/integrity/ima/ima_digest_list.h -- 2.33.0

1 46

[PATCH OLK-5.10] ksmbd: fix out-of-bound read in deassemble_neg_contexts()
by Li Lingfeng 31 Jul '23

31 Jul '23

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.4-rc6 commit f1a411873c85b642f13b01f21b534c2bab81fc1b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7LU2Q CVE: CVE-2023-38427 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/f… -------------------------------- The check in the beginning is `clen + sizeof(struct smb2_neg_context) <= len_of_ctxts`, but in the end of loop, `len_of_ctxts` will subtract `((clen + 7) & ~0x7) + sizeof(struct smb2_neg_context)`, which causes integer underflow when clen does the 8 alignment. We should use `(clen + 7) & ~0x7` in the check to avoid underflow from happening. Then there are some variables that need to be declared unsigned instead of signed. [ 11.671070] BUG: KASAN: slab-out-of-bounds in smb2_handle_negotiate+0x799/0x1610 [ 11.671533] Read of size 2 at addr ffff888005e86cf2 by task kworker/0:0/7 ... [ 11.673383] Call Trace: [ 11.673541] <TASK> [ 11.673679] dump_stack_lvl+0x33/0x50 [ 11.673913] print_report+0xcc/0x620 [ 11.674671] kasan_report+0xae/0xe0 [ 11.675171] kasan_check_range+0x35/0x1b0 [ 11.675412] smb2_handle_negotiate+0x799/0x1610 [ 11.676217] ksmbd_smb_negotiate_common+0x526/0x770 [ 11.676795] handle_ksmbd_work+0x274/0x810 ... Cc: stable(a)vger.kernel.org Signed-off-by: Chih-Yen Chang <cc85nod(a)gmail.com> Tested-by: Chih-Yen Chang <cc85nod(a)gmail.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflict: fs/smb/server/smb2pdu.c Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 18e176fcddf0..c357b2127774 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -978,13 +978,13 @@ static void decode_sign_cap_ctxt(struct ksmbd_conn *conn, static __le32 deassemble_neg_contexts(struct ksmbd_conn *conn, struct smb2_negotiate_req *req, - int len_of_smb) + unsigned int len_of_smb) { /* +4 is to account for the RFC1001 len field */ struct smb2_neg_context *pctx = (struct smb2_neg_context *)req; int i = 0, len_of_ctxts; - int offset = le32_to_cpu(req->NegotiateContextOffset); - int neg_ctxt_cnt = le16_to_cpu(req->NegotiateContextCount); + unsigned int offset = le32_to_cpu(req->NegotiateContextOffset); + unsigned int neg_ctxt_cnt = le16_to_cpu(req->NegotiateContextCount); __le32 status = STATUS_INVALID_PARAMETER; ksmbd_debug(SMB, "decoding %d negotiate contexts\n", neg_ctxt_cnt); @@ -1002,7 +1002,7 @@ static __le32 deassemble_neg_contexts(struct ksmbd_conn *conn, if (len_of_ctxts == 0) break; - if (len_of_ctxts < sizeof(struct smb2_neg_context)) + if (len_of_ctxts < (int)sizeof(struct smb2_neg_context)) break; pctx = (struct smb2_neg_context *)((char *)pctx + offset); @@ -1053,9 +1053,8 @@ static __le32 deassemble_neg_contexts(struct ksmbd_conn *conn, } /* offsets must be 8 byte aligned */ - clen = (clen + 7) & ~0x7; - offset = clen + sizeof(struct smb2_neg_context); - len_of_ctxts -= clen + sizeof(struct smb2_neg_context); + offset = (clen + sizeof(struct smb2_neg_context) + 7) & ~0x7; + len_of_ctxts -= offset; } return status; } -- 2.31.1

2 1

[PATCH openEuler-23.09 01/46] initramfs: add file metadata
by Zhou Shuiqing 31 Jul '23

31 Jul '23

From: Mimi Zohar <zohar(a)linux.vnet.ibm.com> hulk inclusion category: feature feature: IMA Digest Lists extension bugzilla: 46797 ------------------------------------------------- This patch adds metadata to a file from a supplied buffer. The buffer might contains multiple metadata records. The format of each record is: <metadata len (ASCII, 8 chars)><version><type><metadata> For now, only the TYPE_XATTR metadata type is supported. The specific format of this metadata type is: <xattr #N name>\0<xattr #N value> [kamensky: fixed restoring of xattrs for symbolic links by using sys_lsetxattr() instead of sys_setxattr()] [sassu: removed state management, kept only do_setxattrs(), added support for generic file metadata, replaced sys_lsetxattr() with vfs_setxattr(), added check for entry_size, added check for hdr->c_size, replaced strlen() with strnlen(); moved do_setxattrs() before do_name()] Signed-off-by: Mimi Zohar <zohar(a)linux.vnet.ibm.com> Signed-off-by: Victor Kamensky <kamensky(a)cisco.com> Signed-off-by: Taras Kondratiuk <takondra(a)cisco.com> Signed-off-by: Roberto Sassu <roberto.sassu(a)huawei.com> Signed-off-by: Tianxing Zhang <zhangtianxing3(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> Signed-off-by: Zhou Shuiqing<zhoushuiqing2(a)huawei.com> --- include/linux/initramfs.h | 21 ++++++++++ init/initramfs.c | 88 ++++++++++++++++++++++++++++++++++++++- 2 files changed, 107 insertions(+), 2 deletions(-) create mode 100644 include/linux/initramfs.h diff --git a/include/linux/initramfs.h b/include/linux/initramfs.h new file mode 100644 index 000000000000..2f8cee441236 --- /dev/null +++ b/include/linux/initramfs.h @@ -0,0 +1,21 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * include/linux/initramfs.h + * + * Include file for file metadata in the initial ram disk. + */ +#ifndef _LINUX_INITRAMFS_H +#define _LINUX_INITRAMFS_H + +#define METADATA_FILENAME "METADATA!!!" + +enum metadata_types { TYPE_NONE, TYPE_XATTR, TYPE__LAST }; + +struct metadata_hdr { + char c_size[8]; /* total size including c_size field */ + char c_version; /* header version */ + char c_type; /* metadata type */ + char c_metadata[]; /* metadata */ +} __packed; + +#endif /*LINUX_INITRAMFS_H*/ diff --git a/init/initramfs.c b/init/initramfs.c index e7a01c2ccd1b..3b272c56a987 100644 --- a/init/initramfs.c +++ b/init/initramfs.c @@ -15,6 +15,8 @@ #include <linux/memblock.h> #include <linux/mm.h> #include <linux/namei.h> +#include <linux/xattr.h> +#include <linux/initramfs.h> #include <linux/init_syscalls.h> #include <linux/task_work.h> #include <linux/umh.h> @@ -177,7 +179,7 @@ static __initdata time64_t mtime; static __initdata unsigned long ino, major, minor, nlink; static __initdata umode_t mode; -static __initdata unsigned long body_len, name_len; +static __initdata unsigned long body_len, name_len, metadata_len; static __initdata uid_t uid; static __initdata gid_t gid; static __initdata unsigned rdev; @@ -250,7 +252,7 @@ static void __init read_into(char *buf, unsigned size, enum state next) } } -static __initdata char *header_buf, *symlink_buf, *name_buf; +static __initdata char *header_buf, *symlink_buf, *name_buf, *metadata_buf; static int __init do_start(void) { @@ -351,6 +353,88 @@ static int __init maybe_link(void) return 0; } +static int __init do_setxattrs(char *pathname, char *buf, size_t size) +{ + struct path path; + char *xattr_name, *xattr_value; + uint32_t xattr_name_size, xattr_value_size; + int ret; + + xattr_name = buf; + xattr_name_size = strnlen(xattr_name, size); + if (xattr_name_size == size) { + error("malformed xattrs"); + return -EINVAL; + } + + xattr_value = xattr_name + xattr_name_size + 1; + xattr_value_size = buf + size - xattr_value; + + ret = kern_path(pathname, 0, &path); + if (!ret) { + ret = vfs_setxattr(&nop_mnt_idmap, path.dentry, xattr_name, xattr_value, + xattr_value_size, 0); + + path_put(&path); + } + + pr_debug("%s: %s size: %u val: %s (ret: %d)\n", pathname, + xattr_name, xattr_value_size, xattr_value, ret); + + return ret; +} + +static int __init __maybe_unused do_parse_metadata(char *pathname) +{ + char *buf = metadata_buf; + char *bufend = metadata_buf + metadata_len; + struct metadata_hdr *hdr; + char str[sizeof(hdr->c_size) + 1]; + uint32_t entry_size; + + if (!metadata_len) + return 0; + + str[sizeof(hdr->c_size)] = 0; + + while (buf < bufend) { + int ret; + + if (buf + sizeof(*hdr) > bufend) { + error("malformed metadata"); + break; + } + + hdr = (struct metadata_hdr *)buf; + if (hdr->c_version != 1) { + pr_debug("Unsupported header version\n"); + break; + } + + memcpy(str, hdr->c_size, sizeof(hdr->c_size)); + ret = kstrtou32(str, 16, &entry_size); + if (ret || buf + entry_size > bufend || + entry_size < sizeof(*hdr)) { + error("malformed xattrs"); + break; + } + + switch (hdr->c_type) { + case TYPE_XATTR: + do_setxattrs(pathname, buf + sizeof(*hdr), + entry_size - sizeof(*hdr)); + break; + default: + pr_debug("Unsupported metadata type\n"); + break; + } + + buf += entry_size; + } + + return 0; +} + static __initdata struct file *wfile; static __initdata loff_t wfile_pos; -- 2.33.0

2 46

[PATCH openEuler-1.0-LTS 0/4] net: nfc: Fix CVE-2023-3863
by Ziyang Xuan 31 Jul '23

31 Jul '23

Backport CVE-2023-3863 fix commits. Aditya Pakki (1): nfc: Fix to check for kmemdup failure Krzysztof Kozlowski (2): nfc: llcp: nullify llcp_sock->dev on connect() error paths nfc: llcp: simplify llcp_sock_connect() error paths Lin Ma (1): net: nfc: Fix use-after-free caused by nfc_llcp_find_local net/nfc/llcp.h | 1 - net/nfc/llcp_commands.c | 12 +++++++--- net/nfc/llcp_core.c | 49 +++++++++++++++++++++++++++++++++++------ net/nfc/llcp_sock.c | 32 +++++++++++++++++---------- net/nfc/netlink.c | 20 ++++++++++++----- net/nfc/nfc.h | 1 + 6 files changed, 87 insertions(+), 28 deletions(-) -- 2.25.1

2 5

[PATCH OLK-5.10] net/sched: cls_u32: Fix reference counter leak leading to overflow
by Lu Wei 31 Jul '23

31 Jul '23

From: Lee Jones <lee(a)kernel.org> stable inclusion from stable-v5.10.185 commit af6eaa57986e82d7efd81984ee607927c6de61e4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7N3N2 CVE: CVE-2023-3609 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 04c55383fa5689357bcdd2c8036725a55ed632bc ] In the event of a failure in tcf_change_indev(), u32_set_parms() will immediately return without decrementing the recently incremented reference counter. If this happens enough times, the counter will rollover and the reference freed, leading to a double free which can be used to do 'bad things'. In order to prevent this, move the point of possible failure above the point where the reference counter is incremented. Also save any meaningful return values to be applied to the return data at the appropriate point in time. This issue was caught with KASAN. Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct") Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Lee Jones <lee(a)kernel.org> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/sched/cls_u32.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index da042bc8b239..1ac8ff445a6d 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -716,12 +716,18 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, struct nlattr *est, bool ovr, struct netlink_ext_ack *extack) { - int err; + int err, ifindex = -1; err = tcf_exts_validate(net, tp, tb, est, &n->exts, ovr, true, extack); if (err < 0) return err; + if (tb[TCA_U32_INDEV]) { + ifindex = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); + if (ifindex < 0) + return -EINVAL; + } + if (tb[TCA_U32_LINK]) { u32 handle = nla_get_u32(tb[TCA_U32_LINK]); struct tc_u_hnode *ht_down = NULL, *ht_old; @@ -756,13 +762,9 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, tcf_bind_filter(tp, &n->res, base); } - if (tb[TCA_U32_INDEV]) { - int ret; - ret = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); - if (ret < 0) - return -EINVAL; - n->ifindex = ret; - } + if (ifindex >= 0) + n->ifindex = ifindex; + return 0; } -- 2.31.1

2 1

[PATCH OLK-5.10 v2] ksmbd: fix global-out-of-bounds in smb2_find_context_vals
by Long Li 31 Jul '23

31 Jul '23

From: Chih-Yen Chang <cc85nod(a)gmail.com> mainline inclusion from mainline-v6.4-rc2 commit 02f76c401d17e409ed45bf7887148fcc22c93c85 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7LU2N CVE: CVE-2023-38426 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Add tag_len argument in smb2_find_context_vals() to avoid out-of-bound read when create_context's name_len is larger than tag length. [ 7.995411] ================================================================== [ 7.995866] BUG: KASAN: global-out-of-bounds in memcmp+0x83/0xa0 [ 7.996248] Read of size 8 at addr ffffffff8258d940 by task kworker/0:0/7 ... [ 7.998191] Call Trace: [ 7.998358] <TASK> [ 7.998503] dump_stack_lvl+0x33/0x50 [ 7.998743] print_report+0xcc/0x620 [ 7.999458] kasan_report+0xae/0xe0 [ 7.999895] kasan_check_range+0x35/0x1b0 [ 8.000152] memcmp+0x83/0xa0 [ 8.000347] smb2_find_context_vals+0xf7/0x1e0 [ 8.000635] smb2_open+0x1df2/0x43a0 [ 8.006398] handle_ksmbd_work+0x274/0x810 [ 8.006666] process_one_work+0x419/0x760 [ 8.006922] worker_thread+0x2a2/0x6f0 [ 8.007429] kthread+0x160/0x190 [ 8.007946] ret_from_fork+0x1f/0x30 [ 8.008181] </TASK> Cc: stable(a)vger.kernel.org Signed-off-by: Chih-Yen Chang <cc85nod(a)gmail.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Long Li <leo.lilong(a)huawei.com> --- fs/ksmbd/oplock.c | 5 +++-- fs/ksmbd/oplock.h | 2 +- fs/ksmbd/smb2pdu.c | 14 +++++++------- 3 files changed, 11 insertions(+), 10 deletions(-) diff --git a/fs/ksmbd/oplock.c b/fs/ksmbd/oplock.c index 3721fd44a43a..fc5b2137002f 100644 --- a/fs/ksmbd/oplock.c +++ b/fs/ksmbd/oplock.c @@ -1449,11 +1449,12 @@ struct lease_ctx_info *parse_lease_state(void *open_req) * smb2_find_context_vals() - find a particular context info in open request * @open_req: buffer containing smb2 file open(create) request * @tag: context name to search for + * @tag_len: the length of tag * * Return: pointer to requested context, NULL if @str context not found * or error pointer if name length is invalid. */ -struct create_context *smb2_find_context_vals(void *open_req, const char *tag) +struct create_context *smb2_find_context_vals(void *open_req, const char *tag, int tag_len) { struct create_context *cc; unsigned int next = 0; @@ -1492,7 +1493,7 @@ struct create_context *smb2_find_context_vals(void *open_req, const char *tag) return ERR_PTR(-EINVAL); name = (char *)cc + name_off; - if (memcmp(name, tag, name_len) == 0) + if (name_len == tag_len && !memcmp(name, tag, name_len)) return cc; remain_len -= next; diff --git a/fs/ksmbd/oplock.h b/fs/ksmbd/oplock.h index 0cf7a2b5bbc0..e1ba363b412a 100644 --- a/fs/ksmbd/oplock.h +++ b/fs/ksmbd/oplock.h @@ -118,7 +118,7 @@ void create_durable_v2_rsp_buf(char *cc, struct ksmbd_file *fp); void create_mxac_rsp_buf(char *cc, int maximal_access); void create_disk_id_rsp_buf(char *cc, __u64 file_id, __u64 vol_id); void create_posix_rsp_buf(char *cc, struct ksmbd_file *fp); -struct create_context *smb2_find_context_vals(void *open_req, const char *str); +struct create_context *smb2_find_context_vals(void *open_req, const char *tag, int tag_len); struct oplock_info *lookup_lease_in_table(struct ksmbd_conn *conn, char *lease_key); int find_same_lease_key(struct ksmbd_session *sess, struct ksmbd_inode *ci, diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 18e176fcddf0..d8b47cacb356 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -2453,7 +2453,7 @@ static int smb2_create_sd_buffer(struct ksmbd_work *work, return -ENOENT; /* Parse SD BUFFER create contexts */ - context = smb2_find_context_vals(req, SMB2_CREATE_SD_BUFFER); + context = smb2_find_context_vals(req, SMB2_CREATE_SD_BUFFER, 4); if (!context) return -ENOENT; else if (IS_ERR(context)) @@ -2649,7 +2649,7 @@ int smb2_open(struct ksmbd_work *work) if (req->CreateContextsOffset) { /* Parse non-durable handle create contexts */ - context = smb2_find_context_vals(req, SMB2_CREATE_EA_BUFFER); + context = smb2_find_context_vals(req, SMB2_CREATE_EA_BUFFER, 4); if (IS_ERR(context)) { rc = PTR_ERR(context); goto err_out1; @@ -2669,7 +2669,7 @@ int smb2_open(struct ksmbd_work *work) } context = smb2_find_context_vals(req, - SMB2_CREATE_QUERY_MAXIMAL_ACCESS_REQUEST); + SMB2_CREATE_QUERY_MAXIMAL_ACCESS_REQUEST, 4); if (IS_ERR(context)) { rc = PTR_ERR(context); goto err_out1; @@ -2680,7 +2680,7 @@ int smb2_open(struct ksmbd_work *work) } context = smb2_find_context_vals(req, - SMB2_CREATE_TIMEWARP_REQUEST); + SMB2_CREATE_TIMEWARP_REQUEST, 4); if (IS_ERR(context)) { rc = PTR_ERR(context); goto err_out1; @@ -2692,7 +2692,7 @@ int smb2_open(struct ksmbd_work *work) if (tcon->posix_extensions) { context = smb2_find_context_vals(req, - SMB2_CREATE_TAG_POSIX); + SMB2_CREATE_TAG_POSIX, 16); if (IS_ERR(context)) { rc = PTR_ERR(context); goto err_out1; @@ -3084,7 +3084,7 @@ int smb2_open(struct ksmbd_work *work) struct create_alloc_size_req *az_req; az_req = (struct create_alloc_size_req *)smb2_find_context_vals(req, - SMB2_CREATE_ALLOCATION_SIZE); + SMB2_CREATE_ALLOCATION_SIZE, 4); if (IS_ERR(az_req)) { rc = PTR_ERR(az_req); goto err_out; @@ -3111,7 +3111,7 @@ int smb2_open(struct ksmbd_work *work) err); } - context = smb2_find_context_vals(req, SMB2_CREATE_QUERY_ON_DISK_ID); + context = smb2_find_context_vals(req, SMB2_CREATE_QUERY_ON_DISK_ID, 4); if (IS_ERR(context)) { rc = PTR_ERR(context); goto err_out; -- 2.31.1

2 1

[PATCH OLK-5.10] psi: fix compile error for psi cgroupv1 when CONFIG_CGROUP=n
by Lu Jialin 31 Jul '23

31 Jul '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7OOZR ------------------------------- When CONFIG_CGROUP=n ,the compile error is: In file included from kernel/sched/core.c:13: kernel/sched/sched.h:2679:22: error: array type has incomplete element type ‘struct cftype’ extern struct cftype cgroup_v1_psi_files[]; ^~~~~~~~~~~~~~~~~~~ the reason is then CONFIG_CGROUP=n, struct cftype is not defined. We also find that, cgroup_v1_psi_files is used only in kernel/cgroup/cgroup.c and kernel/sched/cpuacct.c. Therefore, move extern struct cftype cgroup_v1_psi_files to kernel/sched/cpuacct.c.This also solved the compile error, because, then CONFIG_CGROUP=n, CONFIG_CGROUP_CPUACCT=n, the kernel/sched/cpuacct.c is not compiled, which will solve the compile error. Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- kernel/sched/cpuacct.c | 1 + kernel/sched/sched.h | 4 ---- 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c index 5c00d3dcee8d..28ed182b6801 100644 --- a/kernel/sched/cpuacct.c +++ b/kernel/sched/cpuacct.c @@ -390,6 +390,7 @@ static int __init setup_psi_v1(char *str) } __setup("psi_v1=", setup_psi_v1); +extern struct cftype cgroup_v1_psi_files[]; static int __init cgroup_v1_psi_init(void) { if (!psi_v1_enable) diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index 95ae9ac553fc..50f1a11ac2fd 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -2977,10 +2977,6 @@ unsigned long scale_irq_capacity(unsigned long util, unsigned long irq, unsigned } #endif -#ifdef CONFIG_PSI -extern struct cftype cgroup_v1_psi_files[]; -#endif - #if defined(CONFIG_ENERGY_MODEL) && defined(CONFIG_CPU_FREQ_GOV_SCHEDUTIL) #define perf_domain_span(pd) (to_cpumask(((pd)->em_pd->cpus))) -- 2.17.1

2 1

[PATCH OLK-5.10] tracing: Fix warning in trace_buffered_event_disable()
by Zheng Yejian 31 Jul '23

31 Jul '23

mainline inclusion from mainline-v6.5-rc4 commit dea499781a1150d285c62b26659f62fb00824fce category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7P78X Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Warning happened in trace_buffered_event_disable() at WARN_ON_ONCE(!trace_buffered_event_ref) Call Trace: ? __warn+0xa5/0x1b0 ? trace_buffered_event_disable+0x189/0x1b0 __ftrace_event_enable_disable+0x19e/0x3e0 free_probe_data+0x3b/0xa0 unregister_ftrace_function_probe_func+0x6b8/0x800 event_enable_func+0x2f0/0x3d0 ftrace_process_regex.isra.0+0x12d/0x1b0 ftrace_filter_write+0xe6/0x140 vfs_write+0x1c9/0x6f0 [...] The cause of the warning is in __ftrace_event_enable_disable(), trace_buffered_event_enable() was called once while trace_buffered_event_disable() was called twice. Reproduction script show as below, for analysis, see the comments: ``` #!/bin/bash cd /sys/kernel/tracing/ # 1. Register a 'disable_event' command, then: # 1) SOFT_DISABLED_BIT was set; # 2) trace_buffered_event_enable() was called first time; echo 'cmdline_proc_show:disable_event:initcall:initcall_finish' > \ set_ftrace_filter # 2. Enable the event registered, then: # 1) SOFT_DISABLED_BIT was cleared; # 2) trace_buffered_event_disable() was called first time; echo 1 > events/initcall/initcall_finish/enable # 3. Try to call into cmdline_proc_show(), then SOFT_DISABLED_BIT was # set again!!! cat /proc/cmdline # 4. Unregister the 'disable_event' command, then: # 1) SOFT_DISABLED_BIT was cleared again; # 2) trace_buffered_event_disable() was called second time!!! echo '!cmdline_proc_show:disable_event:initcall:initcall_finish' > \ set_ftrace_filter ``` To fix it, IIUC, we can change to call trace_buffered_event_enable() at fist time soft-mode enabled, and call trace_buffered_event_disable() at last time soft-mode disabled. Link: https://lore.kernel.org/linux-trace-kernel/20230726095804.920457-1-zhengyej… Cc: <mhiramat(a)kernel.org> Fixes: 0fc1b09ff1ff ("tracing: Use temp buffer when filtering events") Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/trace/trace_events.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index f0dede12b238..d2ca0ca0943b 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -368,7 +368,6 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, { struct trace_event_call *call = file->event_call; struct trace_array *tr = file->tr; - unsigned long file_flags = file->flags; int ret = 0; int disable; @@ -392,6 +391,8 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, break; disable = file->flags & EVENT_FILE_FL_SOFT_DISABLED; clear_bit(EVENT_FILE_FL_SOFT_MODE_BIT, &file->flags); + /* Disable use of trace_buffered_event */ + trace_buffered_event_disable(); } else disable = !(file->flags & EVENT_FILE_FL_SOFT_MODE); @@ -430,6 +431,8 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, if (atomic_inc_return(&file->sm_ref) > 1) break; set_bit(EVENT_FILE_FL_SOFT_MODE_BIT, &file->flags); + /* Enable use of trace_buffered_event */ + trace_buffered_event_enable(); } if (!(file->flags & EVENT_FILE_FL_ENABLED)) { @@ -469,15 +472,6 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, break; } - /* Enable or disable use of trace_buffered_event */ - if ((file_flags & EVENT_FILE_FL_SOFT_DISABLED) != - (file->flags & EVENT_FILE_FL_SOFT_DISABLED)) { - if (file->flags & EVENT_FILE_FL_SOFT_DISABLED) - trace_buffered_event_enable(); - else - trace_buffered_event_disable(); - } - return ret; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] tracing: Fix warning in trace_buffered_event_disable()
by Zheng Yejian 31 Jul '23

31 Jul '23

mainline inclusion from mainline-v6.5-rc4 commit dea499781a1150d285c62b26659f62fb00824fce category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7P78X CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Warning happened in trace_buffered_event_disable() at WARN_ON_ONCE(!trace_buffered_event_ref) Call Trace: ? __warn+0xa5/0x1b0 ? trace_buffered_event_disable+0x189/0x1b0 __ftrace_event_enable_disable+0x19e/0x3e0 free_probe_data+0x3b/0xa0 unregister_ftrace_function_probe_func+0x6b8/0x800 event_enable_func+0x2f0/0x3d0 ftrace_process_regex.isra.0+0x12d/0x1b0 ftrace_filter_write+0xe6/0x140 vfs_write+0x1c9/0x6f0 [...] The cause of the warning is in __ftrace_event_enable_disable(), trace_buffered_event_enable() was called once while trace_buffered_event_disable() was called twice. Reproduction script show as below, for analysis, see the comments: ``` #!/bin/bash cd /sys/kernel/tracing/ # 1. Register a 'disable_event' command, then: # 1) SOFT_DISABLED_BIT was set; # 2) trace_buffered_event_enable() was called first time; echo 'cmdline_proc_show:disable_event:initcall:initcall_finish' > \ set_ftrace_filter # 2. Enable the event registered, then: # 1) SOFT_DISABLED_BIT was cleared; # 2) trace_buffered_event_disable() was called first time; echo 1 > events/initcall/initcall_finish/enable # 3. Try to call into cmdline_proc_show(), then SOFT_DISABLED_BIT was # set again!!! cat /proc/cmdline # 4. Unregister the 'disable_event' command, then: # 1) SOFT_DISABLED_BIT was cleared again; # 2) trace_buffered_event_disable() was called second time!!! echo '!cmdline_proc_show:disable_event:initcall:initcall_finish' > \ set_ftrace_filter ``` To fix it, IIUC, we can change to call trace_buffered_event_enable() at fist time soft-mode enabled, and call trace_buffered_event_disable() at last time soft-mode disabled. Link: https://lore.kernel.org/linux-trace-kernel/20230726095804.920457-1-zhengyej… Cc: <mhiramat(a)kernel.org> Fixes: 0fc1b09ff1ff ("tracing: Use temp buffer when filtering events") Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> Signed-off-by: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Zheng Yejian <zhengyejian1(a)huawei.com> --- kernel/trace/trace_events.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 531e6e8f765b..a000adbbe64f 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -371,7 +371,6 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, { struct trace_event_call *call = file->event_call; struct trace_array *tr = file->tr; - unsigned long file_flags = file->flags; int ret = 0; int disable; @@ -395,6 +394,8 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, break; disable = file->flags & EVENT_FILE_FL_SOFT_DISABLED; clear_bit(EVENT_FILE_FL_SOFT_MODE_BIT, &file->flags); + /* Disable use of trace_buffered_event */ + trace_buffered_event_disable(); } else disable = !(file->flags & EVENT_FILE_FL_SOFT_MODE); @@ -433,6 +434,8 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, if (atomic_inc_return(&file->sm_ref) > 1) break; set_bit(EVENT_FILE_FL_SOFT_MODE_BIT, &file->flags); + /* Enable use of trace_buffered_event */ + trace_buffered_event_enable(); } if (!(file->flags & EVENT_FILE_FL_ENABLED)) { @@ -472,15 +475,6 @@ static int __ftrace_event_enable_disable(struct trace_event_file *file, break; } - /* Enable or disable use of trace_buffered_event */ - if ((file_flags & EVENT_FILE_FL_SOFT_DISABLED) != - (file->flags & EVENT_FILE_FL_SOFT_DISABLED)) { - if (file->flags & EVENT_FILE_FL_SOFT_DISABLED) - trace_buffered_event_enable(); - else - trace_buffered_event_disable(); - } - return ret; } -- 2.25.1

2 1

[OLK-5.10] Perf: add wperf support
by Xiongfeng Wang 31 Jul '23

31 Jul '23

hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I7P697 Add wperf support for openeuler. This patch is from https://github.com/OSUSysLab/wPerf.git Signed-off-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> --- drivers/perf/Kconfig | 6 + drivers/perf/Makefile | 1 + drivers/perf/wperf.c | 2082 +++++++++++++++++++++++++++++++++++++++++ 3 files changed, 2089 insertions(+) create mode 100644 drivers/perf/wperf.c diff --git a/drivers/perf/Kconfig b/drivers/perf/Kconfig index 1e82ab01e75f..ae7b398ab6e0 100644 --- a/drivers/perf/Kconfig +++ b/drivers/perf/Kconfig @@ -130,6 +130,12 @@ config ARM_SPE_PMU Extension, which provides periodic sampling of operations in the CPU pipeline and reports this via the perf AUX interface. +config WPERF + tristate "Enable support for wPerf" + depends on ARM64 + help + Enable support for wPerf + source "drivers/perf/hisilicon/Kconfig" endmenu diff --git a/drivers/perf/Makefile b/drivers/perf/Makefile index 5365fd56f88f..5afa723fe2d7 100644 --- a/drivers/perf/Makefile +++ b/drivers/perf/Makefile @@ -13,3 +13,4 @@ obj-$(CONFIG_QCOM_L3_PMU) += qcom_l3_pmu.o obj-$(CONFIG_THUNDERX2_PMU) += thunderx2_pmu.o obj-$(CONFIG_XGENE_PMU) += xgene_pmu.o obj-$(CONFIG_ARM_SPE_PMU) += arm_spe_pmu.o +obj-$(CONFIG_WPERF) += wperf.o diff --git a/drivers/perf/wperf.c b/drivers/perf/wperf.c new file mode 100644 index 000000000000..33ba6ff3e2b5 --- /dev/null +++ b/drivers/perf/wperf.c @@ -0,0 +1,2082 @@ +#include <linux/init.h> +//#include <linux/highmem.h> +#include <linux/export.h> +//#include <linux/swap.h> /* for totalram_pages */ +#include <linux/kprobes.h> +//#include <linux/bootmem.h> +#include <linux/interrupt.h> + +#include <linux/slab.h> +#include <linux/file.h> +#include <linux/syscalls.h> +#include <linux/module.h> +#include <linux/kernel.h> +#include <linux/list.h> +#include <linux/mm.h> +#include <linux/sched.h> +#include <linux/fs.h> // required for various structures related to files liked fops. +#include <linux/semaphore.h> +#include <linux/cdev.h> +#include <linux/vmalloc.h> +#include <linux/futex.h> +#include <linux/stop_machine.h> +#include <linux/genhd.h> +#include <linux/uio.h> +#include <asm/uaccess.h> +#include <asm/processor.h> +#include "ioctl_perf.h" + +#define BMAXBYTE 500 +#define BSIZEBYTE (BMAXBYTE-50) +#define BMAX (BMAXBYTE * 1024 * 1024) +#define BSIZE (BSIZEBYTE * 1024 * 1024) + +static int Major; +volatile int tag = -1; +volatile int step = -1; + +struct task_struct *p = NULL; + +unsigned long pid = -1; +unsigned long gdbpid = -1; +int ret; + +struct task_struct *ptmp; +struct task_struct *ttmp; +struct task_struct *t; + +char *switch_result; +char *switch_result_bak; +char *switch_result_tmp; +char *futex_result; +char *futex_result_bak; +char *futex_result_tmp; +char *state_result; +char *state_result_bak; +char *state_result_tmp; + +char *wait_result; +char *wait_result_bak; +char *wait_result_tmp; + +//New Added for missing event solution +volatile int ipnum = 0; +volatile int fnum = 0; +volatile int wnum = 0; +long switch_pos = 0; +long state_pos = 0; +long futex_pos = 0; +long wait_pos = 0; +int state_total = 0; +int futex_total = 0; +long tmpip; + +//For softirq events +u64 stime[NR_CPUS]; + +spinlock_t switch_lock; +spinlock_t state_lock; +spinlock_t futex_lock; +spinlock_t wait_lock; + +struct wperf_struct *perf_struct; + +struct task_struct *(*fang_curr_task)(int); +int (*fang_get_futex_key)(u32 __user *, int, union futex_key *, int); +struct futex_hash_bucket *(*fang_hash_futex)(union futex_key *); +static const struct futex_q futex_q_init = { + /* list gets initialized in queue_me()*/ + .key = FUTEX_KEY_INIT, + .bitset = FUTEX_BITSET_MATCH_ANY +}; +int (*fang_futex_wait_setup)(u32 __user *, u32, unsigned int, struct futex_q *, struct futex_hash_bucket **); +long (fang_futex_wait_restart)(struct restart_block *); +//For kernel version larger than 4.8 +//#ifdef NEWKERNEL +//u64 (*local_clock)(void); +//#endif + +long firstsec, firstusec, lastsec, lastusec; + +//Fang newly added +volatile int softirq[NR_CPUS]; +volatile int softirq1[NR_CPUS]; +#define HARDIRQ_SIZE 900 +volatile short hardirq[NR_CPUS][HARDIRQ_SIZE+1]; +volatile short hardirq_pos[NR_CPUS]; +volatile int irq[NR_CPUS]; +volatile int target[PIDNUM]; +volatile int aiotag[NR_CPUS]; +#define NETSEND_SIZE 655350 +long netsend[NETSEND_SIZE+1]; +//long futextag[65535]; +//long futexsum[65535]; +//long futexstart[65535]; +struct fang_result spin_result[NR_CPUS]; + +//Only for test +//volatile short dump_check[100000]; +//volatile short dump_cpu_check[32]; + +volatile long futex_to = 0; +volatile long futex_noto = 0; + +//static long disk_work = 0; + +int dnum; +char dname[200][200]; +long disk_work[200]; + +/*static __inline__ unsigned long long tsc_now(void) +{ + unsigned hi, lo; + __asm__ __volatile__ ("rdtsc" : "=a"(lo), "=d"(hi)); + return ( (unsigned long long)lo)|( ((unsigned long long)hi)<<32 ); +}*/ + +inline u64 fang_clock(void) { + struct timespec64 now; + u64 ret = 0; + + //getnstimeofday64(&now); + //get_monotonic_boottime(&now); + + //ret = now.tv_sec*1000000000+now.tv_nsec; + + //ret = tsc_now(); + ret = ktime_get(); + //printk(KERN_INFO "current time = %lu\n", ret); + return ret; +} + +inline u64 wperfclock(void) { + //struct timespec64 now; + //u64 ret = 0; + + //getrawmonotonic(&now); + //ret = now.tv_sec*1000000000+now.tv_nsec; + + //return ret; + //return local_clock(); + return ktime_get(); +} + +//We'll check target ID & jbd thread & ksoftirq threads +int containOfPID(int core, int pid) { + int i = 0; + for (i = 0; i < PIDNUM; i++) { + if (target[i] == 0) break; + if (target[i] == pid) + return 1; + } + //if (target[0] == pid) { + // return 1; + //} + //if (target[1] == pid) { + // return 1; + //} + //if (target[2+core] == pid) { + // return 1; + //} + return 0; +} + +__visible __notrace_funcgraph int j___switch_to(struct kprobe *p, struct pt_regs *regs) { + //struct timeval start; + struct task_struct *prev_p = regs->regs[0]; + struct task_struct *next_p = regs->regs[1]; + struct fang_result fresult; + struct futex_result furesult; + char *chartmp; + int cpu = 0; + u64 ts; + + if (step == 1) { + cpu = smp_processor_id(); + if (containOfPID(cpu, prev_p->tgid)||containOfPID(cpu, next_p->tgid)) { + ts = fang_clock(); + fresult.type = 0; + fresult.ts = ts; + fresult.perfts = wperfclock(); + fresult.core = cpu; + fresult.pid1 = prev_p->pid; + fresult.pid2 = next_p->pid; + trace_printk("switch to prev %s next %s\n", prev_p->comm, next_p->comm); + + if (in_irq()) { + //fresult.irq = hardirq[cpu][hardirq_pos[cpu]]; + fresult.irq = HARDIRQ; + } + else if (in_serving_softirq()) { + fresult.irq = softirq[cpu]; + } + else { + fresult.irq = 0; + } + fresult.pid1state = prev_p->state; + fresult.pid2state = next_p->state; + + //if (prev_p->pid == 18183) { + // printk(KERN_INFO "pid1 = %d, pid2 = %d, pid1state = %d, pid2state = %d\n", prev_p->pid, next_p->pid, prev_p->state, next_p->state); + //} + + spin_lock(&switch_lock); + chartmp = (char *)(switch_result + switch_pos); + memcpy(chartmp, &fresult, sizeof(fresult)); + switch_pos+=sizeof(fresult); + if (switch_pos >= BSIZE) + pr_info("fresult exceed !!!!!!!!!\n"); + spin_unlock(&switch_lock); + + //if (futextag[next_p->pid] == 1) { + // futexstart[next_p->pid] = ts; + // //printk(KERN_INFO "pid=%d, ts=%ld\n", next_p->pid, futexstart[prev_p->pid]); + //} + //if (futextag[prev_p->pid] == 1 && futexstart[prev_p->pid] > 0) { + // futexsum[prev_p->pid] += ts - futexstart[prev_p->pid]; + + // if (prev_p->state>0) { + // spin_lock(&state_lock); + // chartmp = (char *)(state_result + state_pos); + // furesult.pid = prev_p->pid; + // furesult.time = futexsum[prev_p->pid]; + // memcpy(chartmp, &furesult, sizeof(furesult)); + // state_pos+=sizeof(furesult); + // futexsum[prev_p->pid] = 0; + // futextag[prev_p->pid] = 0; + // futexstart[prev_p->pid] = 0; + // spin_unlock(&state_lock); + // } + //} + } + } + //return 0; + return 0; +} + +/* We need this jprobe by both steps + * First, we need to record the time entry in the first step. + * Second, we need to record the last state for GDB stack. + * */ + +static int j_try_to_wake_up(struct kprobe *kp, struct pt_regs *regs) { + struct task_struct *p = regs->regs[0]; + unsigned int state = regs->regs[1]; + int wake_flags = regs->regs[2]; + char tmp[200]; + //struct timeval start; + struct fang_result fresult; + char *chartmp = NULL; + int cpu = 0; + int i = 0; + u64 ts; + + if (step == 1) { + //if (p->pid==p->tgid+8) { + // printk(KERN_INFO "Thread %d wakes up IO thread\n", current->pid); + // dump_stack(); + // if (aiotag[cpu] == 1) { + // aiotag = 0; + // printk(KERN_INFO "Thread %d is waken up by aio_complete\n", p->pid); + // } + //} + //if (p->tgid == target[1]) { + // if (in_serving_softirq()) { + // printk(KERN_INFO "It's in softirq context\n"); + // } + // else { + // printk(KERN_INFO "It's NOT in softirq context\n"); + // dump_stack(); + // printk(KERN_INFO "------------------------\n"); + // } + //} + //if (current->pid == 4145 && p->pid == 4144) dump_stack(); + //if (p->pid == 4145) dump_stack(); + cpu = smp_processor_id(); + //if (containOfPID(cpu, p->tgid) ) { + //if (current->pid == 2381) dump_stack(); + if (containOfPID(cpu, p->tgid)) { + // Check if in hardirq context + //if (in_irq() && hardirq_pos[cpu]<=0) { + // printk(KERN_INFO "[cpu %d][hardirq_pos = %d] hardirq missing, %d wakes up %d\n", cpu, hardirq_pos[cpu], current->pid, p->pid); + // dump_stack(); + //} + //else if (in_serving_softirq() && softirq1[cpu] == 0) { + // printk(KERN_INFO "softirq missing, %d wakes up %d\n", current->pid, p->pid); + // dump_stack(); + //} + + //if (current->pid == target[cpu+2] && p->pid == 376) { + // dump_stack(); + //} + + if ((p->state & state)) { + //if (current->pid != 0 && current->tgid != target[0] && p->pid == 1935) { + //printk(KERN_INFO "%d [parent %d] wakes up %d\n", current->pid, current->tgid, p->pid); + //} + //if (aiotag[cpu] == 1) { + // aiotag[p->pid] = 1; + // aiotag[cpu] = 0; + //} + + ts = fang_clock(); + + fresult.type = 1; + fresult.ts = ts; + fresult.perfts = wperfclock(); + fresult.core = cpu; + fresult.pid1 = current->pid; + fresult.pid2 = p->pid; + trace_printk("try to wakeup cur %s next %s\n", current->comm, p->comm); + if (in_irq()) { + fresult.irq = HARDIRQ; + //dump_check[p->pid] ++; + //if (dump_check[p->pid] == 10) { + // dump_cpu_check[cpu] = p->pid; + // dump_check[p->pid]=0; + //} + } + else if (in_serving_softirq()) { + fresult.irq = softirq[cpu]; + //if (softirq[cpu] == -2 && p->pid == 4145) dump_stack(); + } + else { + fresult.irq = 0; + // Added for futex Result + //futextag[p->pid] = 1; + } + + fresult.pid1state = current->state; + fresult.pid2state = p->state; + + spin_lock(&switch_lock); + chartmp = (char *)(switch_result + switch_pos); + memcpy(chartmp, &fresult, sizeof(fresult)); + switch_pos+=sizeof(fresult); + if (switch_pos >= BSIZE) + pr_info("fresult2 exceed !!!!!!!!!\n"); + spin_unlock(&switch_lock); + } + } + } + +// return 0; + return 0; +} + +static int j_tasklet_hi_action(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = TASKLET_HI; + } + //return 0; + return 0; +} + +static int j_run_timer_softirq(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = TIMER; + } + //return 0; + return 0; +} + +static int j_net_tx_action(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = NET_TX; + } + //return 0; + return 0; +} + +static int j_net_rx_action(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = NET_RX; + //if (cpu == 7) { + // printk(KERN_INFO "[%d]softirq[cpu] = %d\n", cpu, softirq[cpu]); + //} + } + //return 0; + return 0; +} + +static int j_blk_done_softirq(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = BLK_DONE; + } + //return 0; + return 0; +} + +static int j_blk_iopoll_softirq(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = BLK_IOPOLL; + } + //return 0; + return 0; +} + +static int j_tasklet_action(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = TASKLET; + } + //return 0; + return 0; +} + +static int j_run_rebalance_domains(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = SCHED; + } + //return 0; + return 0; +} + +static int j_run_hrtimer_softirq(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = HRTIMER; + } + //return 0; + return 0; +} + +//rcu moved from softirq to kthread +static int j_rcu_process_callbacks(struct kprobe *p, struct pt_regs *regs) { + struct softirq_action *a = regs->regs[0]; + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = RCU; + } + //return 0; + return 0; +} + +//void j_hrtimer_interrupt(void) { +int j_local_apic_timer_interrupt(struct kprobe *p, struct pt_regs *regs) { + int cpu = 0; + int vector = 0; + if (step == 1) { + // Get information for do_IRQ + vector = APICTIMER; + cpu = smp_processor_id(); + + hardirq[cpu][hardirq_pos[cpu]] = vector; + hardirq_pos[cpu]+=1; + //printk(KERN_INFO "[%d] local_apic_timer starts\n", cpu); + //printk(KERN_INFO "hardirq[%d] = %d, hardirq_pos[%d] = %d\n", cpu, hardirq[cpu][hardirq_pos[cpu]], cpu, hardirq_pos[cpu]); + } + return 0; +} + +int j_do_IRQ(struct kprobe *p, struct pt_regs *regs) { + int cpu = 0; + int vector = 0; + if (step == 1) { + // Get information for do_IRQ +// vector = ~regs->orig_ax; + cpu = smp_processor_id(); + + hardirq[cpu][hardirq_pos[cpu]] = vector; + hardirq_pos[cpu]+=1; + //printk(KERN_INFO "[%d] local_apic_timer starts\n", cpu); + //printk(KERN_INFO "hardirq[%d] = %d, hardirq_pos[%d] = %d\n", cpu, hardirq[cpu][hardirq_pos[cpu]], cpu, hardirq_pos[cpu]); + } + return 0; + return 0; +} + +int j__handle_domain_irq(struct kprobe *p, struct pt_regs *regs) { + int cpu = 0; + int vector = 0; + unsigned int hwirq = regs->regs[1]; + if (step == 1) { + // Get information for do_IRQ +// vector = ~regs->orig_ax; + cpu = smp_processor_id(); + + hardirq[cpu][hardirq_pos[cpu]] = hwirq; + hardirq_pos[cpu]+=1; + if (hardirq_pos[cpu] >= HARDIRQ_SIZE) + pr_info("hardirq pos overflow !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n"); + //printk(KERN_INFO "[%d] local_apic_timer starts\n", cpu); + //printk(KERN_INFO "hardirq[%d] = %d, hardirq_pos[%d] = %d\n", cpu, hardirq[cpu][hardirq_pos[cpu]], cpu, hardirq_pos[cpu]); + } + return 0; + return 0; +} + +int j_do_handle_IPI(struct kprobe *p, struct pt_regs *regs) { + int cpu = 0; + int vector = 0; + int ipinr = regs->regs[0]; + if (step == 1) { + // Get information for do_IRQ +// vector = ~regs->orig_ax; + cpu = smp_processor_id(); + + hardirq[cpu][hardirq_pos[cpu]] = ipinr; + hardirq_pos[cpu]+=1; + if (hardirq_pos[cpu] >= HARDIRQ_SIZE) + pr_info("hardirq pos overflow !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n"); + //printk(KERN_INFO "[%d] local_apic_timer starts\n", cpu); + //printk(KERN_INFO "hardirq[%d] = %d, hardirq_pos[%d] = %d\n", cpu, hardirq[cpu][hardirq_pos[cpu]], cpu, hardirq_pos[cpu]); + } + return 0; + return 0; +} + +static int j_aio_complete(struct kprobe *p, struct pt_regs *regs) { + int cpu = smp_processor_id(); + aiotag[cpu] = 1; + //return 0; + return 0; +} + +static int j_wakeup_softirqd(struct kprobe *p, struct pt_regs *regs) { + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = KSOFTIRQ; + } + //return 0; + return 0; +} + +static struct kprobe jp1 = { + .pre_handler = j___switch_to, + .symbol_name = "__switch_to", +}; + +static struct kprobe jp2 = { + .pre_handler = j_try_to_wake_up, + .symbol_name = "try_to_wake_up", +}; + +static struct kprobe jp3 = { + .pre_handler = j_tasklet_hi_action, + .symbol_name = "tasklet_hi_action", +}; + +static struct kprobe jp4 = { + .pre_handler = j_run_timer_softirq, + .symbol_name = "run_timer_softirq", +}; + +static struct kprobe jp5 = { + .pre_handler = j_net_tx_action, + .symbol_name = "net_tx_action", +}; + +static struct kprobe jp6 = { + .pre_handler = j_net_rx_action, + .symbol_name = "net_rx_action", +}; + +static struct kprobe jp7 = { + .pre_handler = j_blk_done_softirq, + .symbol_name = "blk_done_softirq", +}; + +static struct kprobe jp8 = { + .pre_handler = j_blk_iopoll_softirq, + .symbol_name = "irq_poll_softirq", +}; + +static struct kprobe jp9 = { + .pre_handler = j_tasklet_action, + .symbol_name = "tasklet_action", +}; + +static struct kprobe jp10 = { + .pre_handler = j_run_rebalance_domains, + .symbol_name = "run_rebalance_domains", +}; + +static struct kprobe jp11 = { + .pre_handler = j_run_hrtimer_softirq, + .symbol_name = "run_hrtimer_softirq", +}; + +static struct kprobe jp12 = { + .pre_handler = j_rcu_process_callbacks, + .symbol_name = "rcu_process_callbacks", +}; + +// For Local APIC Timer Interrupt +/*static struct kprobe jp13 = { + .pre_handler = j_local_apic_timer_interrupt, + .symbol_name = "local_apic_timer_interrupt", +}; + +// For HardIRQ +static struct kprobe jp14 = { + .pre_handler = j_do_IRQ, + .symbol_name = "do_IRQ", +};*/ + +static struct kprobe jp13 = { + .pre_handler = j__handle_domain_irq, + .symbol_name = "__handle_domain_irq", +}; + +// For HardIRQ +static struct kprobe jp14 = { + .pre_handler = j_do_handle_IPI, + .symbol_name = "do_handle_IPI", +}; +//static struct kprobe jp15 = { +// .pre_handler = j_aio_complete, +// .kp = { +// .symbol_name = "aio_complete", +// }, +//}; +// For ksoftirq waking up +//static struct kprobe jp15 = { +// .pre_handler = j_wakeup_softirqd, +// .kp = { +// .symbol_name = "wakeup_softirqd", +// }, +//}; + + +// Add it temporarily for do_softirq +static int j___do_softirq(struct kprobe *p, struct pt_regs *regs) { + int cpu = 0; + u64 ts; + char *chartmp; + struct softirq_result sr; + if (step == 1) { + cpu = smp_processor_id(); + ts = fang_clock(); + spin_lock(&futex_lock); + stime[cpu] = ts; + spin_unlock(&futex_lock); + } + //return 0; + return 0; +} + +static struct kprobe jp16 = { + .pre_handler = j___do_softirq, + .symbol_name = "__do_softirq", +}; + +int j_add_interrupt_randomness(struct kprobe *p, struct pt_regs *regs) { + int cpu = 0; + int vector = 0; + if (step == 1) { + cpu = smp_processor_id(); + + hardirq[cpu][hardirq_pos[cpu]] = RANDOM; + hardirq_pos[cpu]+=1; + if (hardirq_pos[cpu] >= HARDIRQ_SIZE) + pr_info("hardirq pos overflow !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!\n"); + //printk(KERN_INFO "[%d] local_apic_timer starts\n", cpu); + //printk(KERN_INFO "hardirq[%d] = %d, hardirq_pos[%d] = %d\n", cpu, hardirq[cpu][hardirq_pos[cpu]], cpu, hardirq_pos[cpu]); + } + return 0; +} + +// Special case for add_interrupt_randomness +static struct kprobe jp17 = { + .pre_handler = j_add_interrupt_randomness, + .symbol_name = "add_interrupt_randomness", +}; + + +inline int compareDisk(const char *dname_tmp) { + int i = 0; + for (; i < dnum; i++) { + if (strcmp(dname_tmp, dname[i]) == 0) { + return i; + } + } + return -1; +} + +#ifdef NEWKERNEL +static int j_part_round_stats(struct kprobe *p, struct pt_regs *regs) { + //return 0; + return 0; +} +#else +static void old_part_round_stats_single(struct hd_struct *part, unsigned long now) { + int inflight; + const char *dname_tmp = NULL; + struct device *ddev = NULL; + int pos = 0; + + ddev = part_to_dev(part); + dname_tmp = dev_name(ddev); + + pos = compareDisk(dname_tmp); + + if (pos >= 0) { + if (now == part->stamp) { + } + else { + inflight = part_in_flight(part); + if (inflight) { + disk_work[pos] += now - part->stamp; + } + } + } +} + +static void j_part_round_stats(int cpu, struct hd_struct *part) { + unsigned long now = jiffies; + + if (step == 1) { + if (part->partno) { + old_part_round_stats_single(&part_to_disk(part)->part0, now); + } + old_part_round_stats_single(part, now); + } + return 0; +} +#endif +/* +static void j_part_round_stats_single(int cpu, struct hd_struct *part, unsigned long now) { + int inflight; + const char *dname_tmp = NULL; + struct device *ddev = NULL; + int pos = 0; + + if (step == 1) { + ddev = part_to_dev(part); + dname_tmp = dev_name(ddev); + + pos = compareDisk(dname_tmp); + if (pos >= 0) { + if (now == part->stamp) { + } + else { + #ifndef NEWKERNEL + inflight = part_in_flight(part); + #endif + if (inflight) { + disk_work[pos] += now - part->stamp; + //spin_lock(&futex_lock); + //sr.type = 1; + //sr.stime = part->stamp; + //sr.etime = now; + //sr.core = cpu; + //chartmp = (char *)(futex_result + futex_pos); + //memcpy(chartmp, &sr, sizeof(sr)); + //futex_pos+=sizeof(sr); + //spin_unlock(&futex_lock); + } + } + } + } + return 0; +} +*/ +static struct kprobe jp18 = { + .pre_handler = j_part_round_stats, + .symbol_name = "part_round_stats", +}; + +static int j_futex_wait_queue_me(struct kprobe *p, struct pt_regs *regs) { + struct futex_hash_bucket *hb = regs->regs[0]; + struct futex_q *q = regs->regs[1]; + struct hrtimer_sleeper *timeout = regs->regs[2]; + struct fang_uds fuds; + char *chartmp = NULL; + if (step == 1) { + if (current->tgid==target[0]) { + fuds.ts = fang_clock(); + fuds.pid = current->pid; + fuds.type = 1; + + spin_lock(&wait_lock); + chartmp = (char *)(wait_result + wait_pos); + memcpy(chartmp, &fuds, sizeof(fuds)); + wait_pos+=sizeof(fuds); + spin_unlock(&wait_lock); + } + } + //return 0; + return 0; +} + +static struct kprobe jp19 = { + .pre_handler = j_futex_wait_queue_me, + .symbol_name = "futex_wait_queue_me", +}; + +static int j_journal_end_buffer_io_sync(struct kprobe *p, struct pt_regs *regs) { + printk(KERN_INFO "I/O sync is happended in softirq context? %s", in_serving_softirq()>0?"True":"False"); + return 0; + //return 0; +} + +static struct kprobe jp20 = { + .pre_handler = j_journal_end_buffer_io_sync, + .symbol_name = "journal_end_buffer_io_sync", +}; + +int j_wake_up_new_task(struct kprobe *kp, struct pt_regs *regs) { + struct task_struct *p = regs->regs[0]; + if (step == 1) { + if (p->tgid == target[0]) { + u64 ts = fang_clock(); + int cpu = smp_processor_id(); + struct fang_result fresult; + char *chartmp = NULL; + fresult.type = 2; + fresult.ts = ts; + fresult.perfts = wperfclock(); + fresult.core = cpu; + fresult.pid1 = current->pid; + fresult.pid2 = p->pid; + fresult.pid1state = current->state; + fresult.pid2state = p->state; + trace_printk("wake up new cur %s next %s\n", current->comm, p->comm); + + spin_lock(&switch_lock); + chartmp = (char *)(switch_result + switch_pos); + memcpy(chartmp, &fresult, sizeof(fresult)); + switch_pos+=sizeof(fresult); + spin_unlock(&switch_lock); + + printk(KERN_INFO "[Create] Thread %d creates thread %d time %lld\n", current->pid, p->pid, ts); + trace_printk("create cur %s p %s\n", current->comm, p->comm); + } + } + return 0; +} + +static struct kprobe jp21 = { + .pre_handler = j_wake_up_new_task, + .symbol_name = "wake_up_new_task", +}; + +int j_do_exit(struct kprobe *p, struct pt_regs *regs) { + if (step == 1) { + if (current->tgid == target[0]) { + u64 ts = fang_clock(); + int cpu = smp_processor_id(); + char *chartmp = NULL; + struct fang_result fresult; + fresult.type = 3; + fresult.ts = ts; + fresult.perfts = wperfclock(); + fresult.core = cpu; + fresult.pid1 = current->pid; + fresult.pid2 = 0; + fresult.pid1state = current->state; + fresult.pid2state = 0; + + spin_lock(&switch_lock); + chartmp = (char *)(switch_result + switch_pos); + memcpy(chartmp, &fresult, sizeof(fresult)); + switch_pos+=sizeof(fresult); + spin_unlock(&switch_lock); + + printk(KERN_INFO "[Finish] Thread %d finishes time %lld\n", current->pid, ts); + } + } + return 0; +} + +static struct kprobe jp22 = { + .pre_handler = j_do_exit, + .symbol_name = "do_exit", +}; + +int j_tcp_sendmsg(struct kprobe *p, struct pt_regs *regs) { + struct sock *sk = regs->regs[0]; + struct msghdr *msg = regs->regs[1]; + if (step == 1) { + if (containOfPID(0, current->tgid)) { + if (current->pid >= NETSEND_SIZE) + pr_info("netsend overflow !!!!!!!!!!!!!!!!!!!!!!!!!!\n"); + netsend[current->pid] += (&msg->msg_iter)->count; + } + } + return 0; + return 0; +} + +static struct kprobe jp26 = { + .pre_handler = j_tcp_sendmsg, + .symbol_name = "tcp_sendmsg", +}; + + +int j_udp_sendmsg(struct kprobe *p, struct pt_regs *regs) { + struct sock *sk = regs->regs[0]; + struct msghdr *msg = regs->regs[1]; + if (step == 1) { + if (containOfPID(0, current->tgid)) { + if (current->pid >= NETSEND_SIZE) + pr_info("netsend overflow !!!!!!!!!!!!!!!!!!!!!!!!!!\n"); + netsend[current->pid] += (&msg->msg_iter)->count; + } + } + return 0; + return 0; +} + +static struct kprobe jp27 = { + .pre_handler = j_udp_sendmsg, + .symbol_name = "udp_sendmsg", +}; + +int j_tcp_sendpage(struct kprobe *p, struct pt_regs *regs) { + struct sock *sk = regs->regs[0]; + struct page *page = regs->regs[1]; + int offset = regs->regs[2]; + size_t size = regs->regs[3]; + if (step == 1) { + if (containOfPID(0, current->tgid)) { + if (current->pid >= NETSEND_SIZE) + pr_info("netsend overflow !!!!!!!!!!!!!!!!!!!!!!!!!!\n"); + netsend[current->pid] += size; + } + } + return 0; + return 0; +} + +static struct kprobe jp28 = { + .pre_handler = j_tcp_sendpage, + .symbol_name = "tcp_sendpage", +}; + +int j_udp_sendpage(struct kprobe *p, struct pt_regs *regs) { + struct sock *sk = regs->regs[0]; + struct page *page = regs->regs[1]; + int offset = regs->regs[2]; + size_t size = regs->regs[3]; + if (step == 1) { + if (containOfPID(0, current->tgid)) { + if (current->tgid >= NETSEND_SIZE) + pr_info("netsend overflow !!!!!!!!!!!!!!!!!!!!!!!!!!\n"); + netsend[current->pid] += size; + } + } + return 0; + return 0; +} + +static struct kprobe jp29 = { + .pre_handler = j_udp_sendpage, + .symbol_name = "udp_sendpage", +}; + + +int j_sock_sendmsg(struct kprobe *p, struct pt_regs *regs) { + struct socket *sock = regs->regs[0]; + struct msghdr *msg = regs->regs[1]; + //struct fang_uds fuds; + //char *chartmp = NULL; + if (step == 1) { + if (containOfPID(0, current->tgid)) { + if (current->pid >= NETSEND_SIZE) + pr_info("netsend overflow !!!!!!!!!!!!!!!!!!!!!!!!!!\n"); + netsend[current->pid] += (&msg->msg_iter)->count; + + //fuds.ts = fang_clock(); + //fuds.pid = current->pid; + //fuds.type = 2; + + //spin_lock(&wait_lock); + //chartmp = (char *)(wait_result + wait_pos); + //memcpy(chartmp, &fuds, sizeof(fuds)); + //wait_pos+=sizeof(fuds); + //spin_unlock(&wait_lock); + } + } + return 0; + return 0; +} + +static struct kprobe jp23 = { + .pre_handler = j_sock_sendmsg, + .symbol_name = "sock_sendmsg", +}; + +static long j_futex_wait_restart(struct kprobe *p, struct pt_regs *regs) { + if (step == 1) { + printk(KERN_INFO "Core %d Thread %d futex_wait_restart Time %llu\n", smp_processor_id(), current->pid, fang_clock()); + } + return 0; + return 0; +} + +int j_do_futex(struct kprobe *p, struct pt_regs *regs) { +// u32 __user *uaddr, int op, u32 val, ktime_t *timeout, +// u32 __user *uaddr2, u32 val2, u32 val3) { +//static int j_futex_wake(u32 __user *uaddr, unsigned int flags, int nr_wake, u32 bitset) { + struct fang_uds fuds; + char *chartmp = NULL; + if (step == 1) { + if (current->tgid==target[0]) { + fuds.ts = fang_clock(); + fuds.pid = current->pid; + fuds.type = 1; + + spin_lock(&wait_lock); + chartmp = (char *)(wait_result + wait_pos); + memcpy(chartmp, &fuds, sizeof(fuds)); + wait_pos+=sizeof(fuds); + spin_unlock(&wait_lock); + } + } + return 0; + return 0; +} + +static struct kprobe jp24 = { + //.pre_handler = j_futex_wake, + .pre_handler = j_do_futex, + .symbol_name = "do_futex", + //.addr = (kprobe_opcode_t *) kallsyms_lookup_name("futex_wait_restart"), +}; + +static int j___lock_sock(struct kprobe *p, struct pt_regs *regs) { + struct fang_uds fuds; + char *chartmp = NULL; + if (step == 1) { + if (current->tgid==target[0]) { + fuds.ts = fang_clock(); + fuds.pid = current->pid; + fuds.type = 3; + + spin_lock(&wait_lock); + chartmp = (char *)(wait_result + wait_pos); + memcpy(chartmp, &fuds, sizeof(fuds)); + wait_pos+=sizeof(fuds); + spin_unlock(&wait_lock); + } + } + return 0; +} +static struct kprobe jp25 = { + //.pre_handler = j_futex_wake, + .pre_handler = j___lock_sock, + .symbol_name = "__lock_sock", + //.addr = (kprobe_opcode_t *) kallsyms_lookup_name("futex_wait_restart"), +}; + + + + +int open(struct inode *inode, struct file *filp) +{ + trace_printk("inside open\n"); + printk(KERN_INFO "Inside open %llu\n", fang_clock()); + return 0; +} + +int release(struct inode *inode, struct file *filp) { + int i = 0; + printk (KERN_INFO "Inside close %llu\n", fang_clock()); + for (i = 0; i < dnum; i++) { + printk(KERN_INFO "Disk %s work time: %ld\n", dname[i], disk_work[i]); + } + for (i = 0; i < NETSEND_SIZE; i++) { + if (netsend[i] != 0) { + printk(KERN_INFO "Thread %d sends bytes: %ld\n",i, netsend[i]); + } + } + +// printk(KERN_INFO "futex with timeout: %ld\n", futex_to); +// printk(KERN_INFO "futex without timeout: %ld\n", futex_noto); + + return 0; +} + +static int tasklet_hi_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +static struct kretprobe kret3 = { + .handler = tasklet_hi_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "tasklet_hi_action", }, + //.maxactive = MAX_CPU_NR, +}; + +static int timer_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +static struct kretprobe kret4 = { + .handler = timer_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "run_timer_softirq", }, + //.maxactive = MAX_CPU_NR, +}; + +static int net_tx_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +static struct kretprobe kret5 = { + .handler = net_tx_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "net_tx_action", }, + //.maxactive = MAX_CPU_NR, +}; + +static int net_rx_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + //if (cpu == 7) { + // printk(KERN_INFO "[%d]softirq[cpu] = %d\n", cpu, softirq[cpu]); + //} + } + return 0; +} + +static struct kretprobe kret6 = { + .handler = net_rx_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "net_rx_action", }, + //.maxactive = MAX_CPU_NR, +}; + +static int blk_done_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +static struct kretprobe kret7 = { + .handler = blk_done_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "blk_done_softirq", }, + //.maxactive = MAX_CPU_NR, +}; + +static int blk_iopoll_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +static struct kretprobe kret8 = { + .handler = blk_iopoll_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "irq_poll_softirq", }, + //.maxactive = MAX_CPU_NR, +}; + +static int tasklet_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +static struct kretprobe kret9 = { + .handler = tasklet_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "tasklet_action", }, + //.maxactive = MAX_CPU_NR, +}; + +static int sched_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +static struct kretprobe kret10 = { + .handler = sched_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "run_rebalance_domains", }, + //.maxactive = MAX_CPU_NR, +}; + +static int hrtimer_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +static struct kretprobe kret11 = { + .handler = hrtimer_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "run_hrtimer_softirq", }, + //.maxactive = MAX_CPU_NR, +}; + +static int rcu_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +static struct kretprobe kret12 = { + .handler = rcu_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "rcu_process_callbacks", }, + //.maxactive = MAX_CPU_NR, +}; + +static int handle_domain_irq_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + if (hardirq_pos[cpu] != 0) hardirq_pos[cpu]-=1; + //printk(KERN_INFO "[%d] local_apic_timer ends\n", cpu); + //printk(KERN_INFO "hardirq_pos[%d] = %d\n", cpu, hardirq_pos[cpu]); + } + return 0; +} + +static struct kretprobe kret13 = { + .handler = handle_domain_irq_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "__handle_domain_irq", }, + //.maxactive = 1024, +}; + +static int do_handle_IPI_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + if (hardirq_pos[cpu] != 0) hardirq_pos[cpu]-=1; + //printk(KERN_INFO "[%d] local_apic_timer ends\n", cpu); + //printk(KERN_INFO "hardirq_pos[%d] = %d\n", cpu, hardirq_pos[cpu]); + } + return 0; +} + +static struct kretprobe kret14 = { + .handler = do_handle_IPI_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "do_handle_IPI", }, + //.maxactive = 1024, +}; + +static int KSOFTIRQ_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + softirq[cpu] = 0; + } + return 0; +} + +//static struct kretprobe kret15 = { +// .handler = KSOFTIRQ_return, +// .maxactive = NR_CPUS, +// .kp = { .symbol_name = "wakeup_softirqd", }, +// //.maxactive = MAX_CPU_NR, +//}; + +static int SOFTIRQ_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + u64 ts; + char *chartmp; + struct softirq_result sr; + if (step == 1) { + cpu = smp_processor_id(); + ts = fang_clock(); + spin_lock(&futex_lock); + sr.type = 0; + sr.stime = stime[cpu]; + sr.etime = ts; + sr.core = cpu; + chartmp = (char *)(futex_result + futex_pos); + memcpy(chartmp, &sr, sizeof(sr)); + futex_pos+=sizeof(sr); + spin_unlock(&futex_lock); + } + return 0; +} + +static struct kretprobe kret16 = { + .handler = SOFTIRQ_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "__do_softirq", }, + //.maxactive = MAX_CPU_NR, +}; + +// Special for random generator in do_IRQ +static int RANDOM_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu = smp_processor_id(); + if (hardirq_pos[cpu] != 0) hardirq_pos[cpu]-=1; + } + return 0; +} + +static struct kretprobe kret17 = { + .handler = RANDOM_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "add_interrupt_randomness", }, + //.maxactive = MAX_CPU_NR, +}; + +static int switch_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + int cpu = 0; + if (step == 1) { + cpu=smp_processor_id(); + //if (dump_cpu_check[cpu]>0) { + //printk(KERN_INFO "threadID = %d\n", dump_cpu_check[cpu]); + //dump_stack(); + //dump_cpu_check[cpu]=0; + //} + } + return 0; +} + +static struct kretprobe kret18 = { + .handler = switch_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "finish_task_switch", }, + //.maxactive = MAX_CPU_NR, +}; + +static int futex_wait_return(struct kretprobe_instance *ri, struct pt_regs *regs) +{ + struct fang_uds fuds; + char *chartmp = NULL; + if (step == 1) { + //int retval = regs_return_value(regs); + //int cpu = smp_processor_id(); + if (current->tgid==target[0]) { + fuds.ts = fang_clock(); + fuds.pid = current->pid; + fuds.type = 4; + + spin_lock(&wait_lock); + chartmp = (char *)(wait_result + wait_pos); + memcpy(chartmp, &fuds, sizeof(fuds)); + wait_pos+=sizeof(fuds); + spin_unlock(&wait_lock); + } + + /* + if (containOfPID(cpu, current->tgid) && retval < 0) { + + //printk(KERN_INFO "Core %d Thread %d RetValue %d Time %llu\n", smp_processor_id(), current->pid, retval, fang_clock()); + fuds.ts = fang_clock(); + fuds.pid = current->pid; + fuds.type = (short)retval; + + spin_lock(&wait_lock); + chartmp = (char *)(wait_result + wait_pos); + memcpy(chartmp, &fuds, sizeof(fuds)); + wait_pos+=sizeof(fuds); + spin_unlock(&wait_lock); + } + */ + } + return 0; +} + +static struct kretprobe kret19 = { + .handler = futex_wait_return, + .maxactive = NR_CPUS, + .kp = { .symbol_name = "futex_wait", }, + //.maxactive = MAX_CPU_NR, +}; + +long ioctl_funcs(struct file *filp,unsigned int cmd, unsigned long arg) +{ + + unsigned long ret = 0; + int tres; + char tmp[200]; + char *chartmp = NULL; + //struct timeval start; + unsigned long start; + struct fang_uds fuds; + struct fang_spin_uds spin_uds; + struct uds_spin_res spin_res; + int i = 0, cpu = 0; + + switch(cmd) { + case IOCTL_ADDWAIT: + if (step == 1) { + fuds.ts = fang_clock(); + fuds.pid = current->pid; + fuds.type = (short)arg; + spin_lock(&wait_lock); + chartmp = (char *)(wait_result + wait_pos); + memcpy(chartmp, &fuds, sizeof(fuds)); + wait_pos+=sizeof(fuds); + spin_unlock(&wait_lock); + } + break; + case IOCTL_ADDUDS: + if (step == 1) { + spin_uds.ts = fang_clock(); + spin_uds.pid = current->pid; + copy_from_user(&spin_res, (void*)arg, 12); + spin_uds.lock = spin_res.addr; + spin_uds.type = spin_res.type; + //fuds.ts = fang_clock(); + //fuds.pid = current->pid; + //fuds.type = (short)arg; + spin_lock(&state_lock); + //chartmp = (char *)(state_result + state_pos); + chartmp = (char *)(state_result + state_pos); + memcpy(chartmp, &spin_uds, sizeof(spin_uds)); + state_pos+=sizeof(spin_uds); + spin_unlock(&state_lock); + } + break; + case IOCTL_PID: + //printk(KERN_INFO "Setting PID = %d\n", (int)pid); + //for_each_process(p) { + // if (task_pid_nr(p)==pid) break; + //} + //target[0] = pid; + switch_pos = 0; + futex_pos = 0; + state_pos = 0; + wait_pos = 0; + + for (i=0;i<20;i++){ + disk_work[i] = 0; + } + + for (i=0; i<NETSEND_SIZE; i++) { + netsend[i] = 0; + //futextag[i] = 0; + //futexstart[i] = 0; + //futexsum[i] = 0; + } + + for (i = 0; i < PIDNUM; i++) { + target[i] = 0; + } + + dnum = 0; + + futex_to = 0; + futex_noto = 0; + + readTarget(); + + step = 1; + break; + + case IOCTL_INIT: + step = -1; + break; + + case IOCTL_COPYSWITCH: + spin_lock(&switch_lock); + ret = switch_pos; + switch_pos = 0; + switch_result_tmp = switch_result; + switch_result = switch_result_bak; + spin_unlock(&switch_lock); + switch_result_bak = switch_result_tmp; + tres = copy_to_user((void*)arg, switch_result_bak, ret); + break; + + case IOCTL_COPYWAIT: + spin_lock(&wait_lock); + ret = wait_pos; + wait_pos = 0; + wait_result_tmp = wait_result; + wait_result = wait_result_bak; + spin_unlock(&wait_lock); + wait_result_bak = wait_result_tmp; + tres = copy_to_user((void*)arg, wait_result_bak, ret); + break; + + case IOCTL_STATE_BEGIN: + sprintf(tmp, "Sample %d\n", state_total); + spin_lock(&switch_lock); + chartmp = (char *)(switch_result + switch_pos); + memcpy(chartmp, tmp, strlen(tmp)); + switch_pos+=strlen(tmp); + spin_unlock(&switch_lock); + step = 2; + state_total++; + break; + + case IOCTL_STATE_END: + step = -1; + + if (switch_pos > BSIZE) { + ret = 1; + } + else { + ret = 0; + } + //ret = 1; + break; + case IOCTL_FUTEX: + spin_lock(&futex_lock); + tag = 0; + fnum = 0; + wnum = 0; + chartmp = (char *)(futex_result + futex_pos); + memcpy(chartmp, tmp, strlen(tmp)); + futex_pos+=strlen(tmp); + futex_total++; + spin_unlock(&futex_lock); + break; + + case IOCTL_JPROBE: + break; + + case IOCTL_UNJPROBE: + break; + case IOCTL_JSWITCH: + break; + case IOCTL_COPYSTATE: + spin_lock(&state_lock); + ret = state_pos; + state_pos = 0; + state_result_tmp = state_result; + state_result = state_result_bak; + spin_unlock(&state_lock); + state_result_bak = state_result_tmp; + tres = copy_to_user((void*)arg, state_result_bak, ret); + //printk(KERN_INFO "state_pos = %d\n", state_pos); + break; + case IOCTL_COPYFUTEX: + spin_lock(&futex_lock); + ret = futex_pos; + futex_pos = 0; + futex_result_tmp = futex_result; + futex_result = futex_result_bak; + spin_unlock(&futex_lock); + futex_result_bak = futex_result_tmp; + tres = copy_to_user((void*)arg, futex_result_bak, ret); + break; + case IOCTL_COPYBUFFER: + break; + case IOCTL_GETENTRY: + spin_lock(&switch_lock); + ret = copy_to_user((void*)arg, switch_result, switch_pos); + ret = switch_pos; + switch_pos = 0; + spin_unlock(&switch_lock); + break; + case IOCTL_STEP1_BEGIN: + switch_pos = 0; + state_pos = 0; + futex_pos = 0; + wait_pos = 0; + spin_lock(&switch_lock); + t = p; + ptmp = p; + do { + start = ktime_get_ns(); + //do_gettimeofday(&start); + } while_each_thread(ptmp, t); + + printk(KERN_INFO "start time: sec = %ld usec = %ld\n", start/NSEC_PER_SEC, (start%NSEC_PER_SEC)/1000); + //step = 1; + spin_unlock(&switch_lock); + break; + case IOCTL_STEP1_END: + spin_lock(&switch_lock); + start = ktime_get_ns(); + //do_gettimeofday(&start); + lastsec = start/NSEC_PER_SEC;//start.tv_sec; + lastusec = (start%NSEC_PER_SEC)/1000;//start.tv_usec; + printk(KERN_INFO "end time: sec = %ld usec = %ld\n", lastsec, lastusec); + step = -1; + spin_unlock(&switch_lock); + break; + case IOCTL_USER_STACK: + //for_each_process(p) { + // if (task_pid_nr(p)==pid) break; + //} + //struct pt_regs *regs = task_pt_regs(p); + //printk(KERN_INFO "IP=%ld, BP=%ld\n", regs->ip, regs->bp); + //long currbp = regs->bp; + //int currpos = 0; + //while(currbp!=0 || currpos > 10) { + // copy_from_user(&currbp, currbp, 8); + // printk(KERN_INFO "Next BP = %ld", currbp); + //} + break; + case IOCTL_DNAME: + tres = copy_from_user(&dname[dnum], (void*)arg, 20); + printk(KERN_INFO "Monitored Disk: %s\n", dname[dnum]); + dnum++; + break; + case IOCTL_SPINLOCK: + cpu = smp_processor_id(); + spin_result[cpu].type = (short)arg; + spin_result[cpu].core = cpu; + spin_result[cpu].ts = fang_clock(); + spin_result[cpu].pid1 = current->pid; + spin_lock(&switch_lock); + chartmp = (char *)(switch_result + switch_pos); + memcpy(chartmp, &spin_result[cpu], sizeof(spin_result[cpu])); + switch_pos+=sizeof(spin_result[cpu]); + spin_unlock(&switch_lock); + break; + case IOCTL_TIME: + printk(KERN_INFO "now = %llu\n", ktime_get()); + break; + } + return ret; +} + +struct file_operations fops = { + open: open, + unlocked_ioctl: ioctl_funcs, + release: release +}; + +struct cdev *kernel_cdev; +dev_t dev_no, dev; + + +#include <asm/uaccess.h> +#include <asm/processor.h> + +//Fang added +int readTarget(void) { + //mm_segment_t fs; + struct file *filp = NULL; + char buf[10240] = { 0}; + int tmppos= 0; + int pidpos = 0; + char buftmp[64] = {0 }; + char* buftmp1; + int i = 0; + int ret; + + //fs = get_fs(); + //set_fs(KERNEL_DS); + trace_printk("in read target\n"); + + filp = filp_open("/tmp/target", O_RDONLY, 0); + if (filp==NULL) { + printk(KERN_ERR "Error: something wrong with the pid target file!\n"); + return -1; + } + //pr_info("filp %lx\n", filp); +#ifdef NEWKERNEL + ret = kernel_read(filp, buf, 10240, &filp->f_pos); + trace_printk("kernel read return %d\n", ret); + //kernel_read(filp, &filp->f_pos, buf, 10240); +#else + vfs_read(filp, buf, 10240, &filp->f_pos); +#endif + //filp->f_op->read(filp, buf, 1024, &filp->f_pos); + filp_close(filp,NULL); + //set_fs(fs); + //pr_info("buf %x\n", buf); + + i=0; + tmppos= 0; + + while(buf[i]) { + if (buf[i]=='\n') { + buftmp[tmppos]='\0'; + //printk(KERN_INFO "%d\n", simple_strtol(buftmp, &buftmp1, 10)); + target[pidpos] = simple_strtol(buftmp, &buftmp1, 10); + //trace_printk("target %d\n", target[pidpos]); + pidpos++; + tmppos = 0; + if (pidpos >= PIDNUM) + pr_info("pidpos exceed !!!!!!!!!\n"); + } + else { + buftmp[tmppos] = buf[i]; + tmppos++; + if (tmppos >= 64) { + pr_info("tmp pos exceedd!!!!!!!!!!\n"); + return 0; + } + } + i++; + if (i >= 10240) + pr_info("i exceed !!!!!!!!!!!!!!\n"); + } + return 0; +} + +int char_arr_init (void) { + int ret = 0; + int i = 0; + + for (i= 0;i<PIDNUM;i++) { + target[i] = 0; + } + + for (i= 0;i<NR_CPUS;i++) { + softirq[i] = 0; + hardirq_pos[i] = 0; + aiotag[i] = 0; + } + + for (i=0; i<NETSEND_SIZE; i++) { + netsend[i] = 0; + //futextag[i] = 0; + //futexstart[i] = 0; + //futexsum[i] = 0; + } + + readTarget(); + + //Check dname + //if (strcmp(dname, "") == 0) { + // printk(KERN_ERR "Error: no device name!\n"); + // return 1; + //} + //else { + // printk(KERN_INFO "Device name: %s\n", dname); + //} + //Init the file read + //fang_curr_task = (struct task_struct *(*)(int))0xffffffff870d0180; + //fang_curr_task = (struct task_struct *(*)(int))kallsyms_lookup_name("curr_task"); + //fang_get_futex_key = (int (*)(u32 __user *, int, union futex_key *, int))kallsyms_lookup_name("get_futex_key"); + //fang_hash_futex = (struct futex_hash_bucket *(*)(union futex_key *))kallsyms_lookup_name("hash_futex"); + //fang_futex_wait_setup = (int (*)(u32 __user *, u32, unsigned int, struct futex_q *, struct futex_hash_bucket **))kallsyms_lookup_name("futex_wait_setup"); + //fang_futex_wait_restart = (long (*)(struct restart_block *)kallsyms_lookup_name("futex_wait_restart"); + //For kernel version larger than 4.8 + //#ifdef NEWKERNEL + //local_clock = (u64 (*)(void))kallsyms_lookup_name("local_clock"); + //#endif + + //printk(KERN_INFO "curr_task = %lx\n", kallsyms_lookup_name("curr_task")); + //printk(KERN_INFO "get_futex_key = %lx\n", kallsyms_lookup_name("get_futex_key")); + //printk(KERN_INFO "hash_futex = %lx\n", kallsyms_lookup_name("hash_futex")); + //printk(KERN_INFO "futex_wait_setup = %lx\n", kallsyms_lookup_name("futex_wait_setup")); + + ret = alloc_chrdev_region(&dev, 0, 1, "wperf"); + if (ret) + pr_info("alloc chrdev failed\n"); + + kernel_cdev = cdev_alloc(); + kernel_cdev->ops = &fops; + kernel_cdev->owner = THIS_MODULE; + printk (" Inside init module\n"); + + ret = cdev_add( kernel_cdev,dev,1); + + if(ret < 0 ) + { + printk(KERN_INFO "Unable to allocate cdev"); + return ret; + } + + Major = MAJOR(dev); + //dev = MKDEV(Major,0); + printk (" The major number for your device is %d\n", Major); + + state_result = (char*)vmalloc(BMAX*sizeof(char)); + state_result_bak = (char*)vmalloc(BMAX*sizeof(char)); + futex_result = (char*)vmalloc(BMAX*sizeof(char)); + futex_result_bak = (char*)vmalloc(BMAX*sizeof(char)); + switch_result = (char*)vmalloc(BMAX*sizeof(char)); + switch_result_bak = (char*)vmalloc(BMAX*sizeof(char)); + + wait_result = (char*)vmalloc(BMAX*sizeof(char)); + wait_result_bak = (char*)vmalloc(BMAX*sizeof(char)); + + spin_lock_init(&switch_lock); + spin_lock_init(&state_lock); + spin_lock_init(&futex_lock); + spin_lock_init(&wait_lock); + + ret = register_kprobe(&jp1); + if (ret ) + printk(KERN_INFO "register_kprobe failed, returned %d\n", ret); + else + pr_info("register kprobe success\n"); + ret = register_kprobe(&jp2); + if (ret) { + printk(KERN_INFO "register_kprobe failed, returned %d\n", ret); + //return ret; + } + ret = register_kprobe(&jp3); + if (ret) + pr_info("register kprobe failed1\n"); + ret = register_kprobe(&jp4); + if (ret) + pr_info("register kprobe failed2\n"); + ret = register_kprobe(&jp5); + if (ret) + pr_info("register kprobe failed3\n"); + if (register_kprobe(&jp6)) { + printk(KERN_INFO "register net_rx jprobe failed!\n"); + } + ret = register_kprobe(&jp7); + if (ret) + pr_info("register kprobe failed4\n"); + ret = register_kprobe(&jp8); + if (ret) + pr_info("register kprobe failed5\n"); + ret = register_kprobe(&jp9); + if (ret) + pr_info("register kprobe failed6\n"); + ret = register_kprobe(&jp10); + if (ret) + pr_info("register kprobe failed7\n"); + //register_kprobe(&jp11); + ret = register_kprobe(&jp12); + if (ret) + pr_info("register kprobe rcu_process_callbacks failed8\n"); + //if (register_kprobe(&jp13)) { + // printk(KERN_INFO "register apic jprobe failed!%d\n"); + //} + + //register_kprobe(&jp14); + //register_kprobe(&jp15); + ret = register_kprobe(&jp16); + if (ret) + pr_info("register kprobe failed9\n"); + //register_kprobe(&jp17); + ret = register_kprobe(&jp18); + if (ret) + pr_info("register kprobe part_round_stats failed0\n"); + //register_kprobe(&jp19); + //register_kprobe(&jp20); + ret = register_kprobe(&jp21); + if (ret) + pr_info("register kprobe failed12\n"); + ret = register_kprobe(&jp22); + if (ret) + pr_info("register kprobe failed13\n"); + //register_kprobe(&jp23); + //jp24.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("futex_wait_restart"), + //register_kprobe(&jp24); + //register_kprobe(&jp25); + ret = register_kprobe(&jp26); + if (ret) + pr_info("register kprobe failed14\n"); + ret = register_kprobe(&jp27); + if (ret) + pr_info("register kprobe failed15\n"); + ret = register_kprobe(&jp28); + if (ret) + pr_info("register kprobe failed16\n"); + ret = register_kprobe(&jp29); + if (ret) + pr_info("register kprobe failed17\n"); + + + /*kret3.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("tasklet_hi_action"); + kret4.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("run_timer_softirq"); + kret5.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("net_tx_action"); + kret6.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("net_rx_action"); + kret7.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("blk_done_softirq"); + kret8.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("irq_poll_softirq"); + kret9.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("tasklet_action"); + kret10.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("run_rebalance_domains"); + kret11.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("run_hrtimer_softirq"); + kret12.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("rcu_process_callbacks"); + kret13.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("local_apic_timer_interrupt"); + kret14.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("do_IRQ"); +// kret15.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("wakeup_softirqd"); + kret16.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("__do_softirq"); + kret17.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("add_interrupt_randomness"); + //kret18.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("finish_task_switch"); + //kret19.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("futex_wait"); + //kret19.kp.addr = (kprobe_opcode_t *) kallsyms_lookup_name("__lock_sock"); +*/ + + ret = register_kretprobe(&kret3); + if (ret) { + printk(KERN_INFO "register_kretprobe failed, returned %d\n", ret); + //return ret; + } else + pr_info("register kretprobe success\n"); + ret = register_kretprobe(&kret4); + if (ret) { + printk(KERN_INFO "register_kretprobe2 failed, returned %d\n", ret); + //return ret; + } + ret = register_kretprobe(&kret5); + if (ret) + pr_info("register kretprobe failed1\n"); + ret = register_kretprobe(&kret6); + if (ret) + pr_info("register kretprobe failed2\n"); + ret = register_kretprobe(&kret7); + if (ret) + pr_info("register kretprobe failed3\n"); + ret = register_kretprobe(&kret8); + if (ret) + pr_info("register kretprobe failed4\n"); + ret = register_kretprobe(&kret9); + if (ret) + pr_info("register kretprobe failed5\n"); + ret = register_kretprobe(&kret10); + if (ret) + pr_info("register kretprobe failed6\n"); + //register_kretprobe(&kret11); + ret = register_kretprobe(&kret12); + if (ret) + pr_info("register kretprobe rcu_process_callbacks failed7\n"); + //register_kretprobe(&kret13); + //register_kretprobe(&kret14); + ret = register_kretprobe(&kret16); + if (ret) + pr_info("register kretprobe failed8\n"); + //register_kretprobe(&kret17); + //register_kretprobe(&kret18); + //register_kretprobe(&kret19); + + return 0; +} + +void char_arr_cleanup(void) { + //cdev_del(kernel_cdev); + + unregister_kprobe(&jp1); + + unregister_kprobe(&jp2); + unregister_kprobe(&jp3); + unregister_kprobe(&jp4); + unregister_kprobe(&jp5); + unregister_kprobe(&jp6); + unregister_kprobe(&jp7); + unregister_kprobe(&jp8); + unregister_kprobe(&jp9); + unregister_kprobe(&jp10); + //unregister_kprobe(&jp11); + unregister_kprobe(&jp12); + //unregister_kprobe(&jp13); + //unregister_kprobe(&jp14); + //unregister_kprobe(&jp15); + unregister_kprobe(&jp16); + //unregister_kprobe(&jp17); + unregister_kprobe(&jp18); + //unregister_kprobe(&jp19); + //unregister_kprobe(&jp20); + unregister_kprobe(&jp21); + unregister_kprobe(&jp22); + //unregister_kprobe(&jp23); + //unregister_kprobe(&jp24); + //unregister_kprobe(&jp25); + unregister_kprobe(&jp26); + unregister_kprobe(&jp27); + unregister_kprobe(&jp28); + unregister_kprobe(&jp29); + + + //unregister_kretprobe(&futex_return); + //unregister_kretprobe(&sleep_return); + //unregister_kretprobe(&signal_return); + //unregister_kretprobe(&aio_return); + + unregister_kretprobe(&kret3); + unregister_kretprobe(&kret4); + unregister_kretprobe(&kret5); + unregister_kretprobe(&kret6); + unregister_kretprobe(&kret7); + unregister_kretprobe(&kret8); + unregister_kretprobe(&kret9); + unregister_kretprobe(&kret10); + //unregister_kretprobe(&kret11); + unregister_kretprobe(&kret12); + //unregister_kretprobe(&kret13); + //unregister_kretprobe(&kret14); + unregister_kretprobe(&kret16); + //unregister_kretprobe(&kret17); + //unregister_kretprobe(&kret18); + //unregister_kretprobe(&kret19); + + /* nmissed > 0 suggests that maxactive was set too low. */ + //printk("Missed probing %d instances of %s\n", + // futex_return.nmissed, "do_futex return"); + + unregister_chrdev_region(MKDEV(Major, 0), 1); + cdev_del(kernel_cdev); + + vfree(switch_result); + vfree(switch_result_bak); + vfree(state_result); + vfree(state_result_bak); + vfree(futex_result); + vfree(futex_result_bak); + + vfree(wait_result); + vfree(wait_result_bak); + + printk(KERN_INFO " Inside cleanup_module\n"); +} +MODULE_LICENSE("GPL"); +module_init(char_arr_init); +module_exit(char_arr_cleanup); -- 2.20.1

1 0

[PATCH OLK-5.10] ksmbd: fix out-of-bound read in deassemble_neg_contexts()
by Li Lingfeng 29 Jul '23

29 Jul '23

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.4-rc6 commit f1a411873c85b642f13b01f21b534c2bab81fc1b category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7LU2Q CVE: CVE-2023-38427 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/f… -------------------------------- The check in the beginning is `clen + sizeof(struct smb2_neg_context) <= len_of_ctxts`, but in the end of loop, `len_of_ctxts` will subtract `((clen + 7) & ~0x7) + sizeof(struct smb2_neg_context)`, which causes integer underflow when clen does the 8 alignment. We should use `(clen + 7) & ~0x7` in the check to avoid underflow from happening. Then there are some variables that need to be declared unsigned instead of signed. [ 11.671070] BUG: KASAN: slab-out-of-bounds in smb2_handle_negotiate+0x799/0x1610 [ 11.671533] Read of size 2 at addr ffff888005e86cf2 by task kworker/0:0/7 ... [ 11.673383] Call Trace: [ 11.673541] <TASK> [ 11.673679] dump_stack_lvl+0x33/0x50 [ 11.673913] print_report+0xcc/0x620 [ 11.674671] kasan_report+0xae/0xe0 [ 11.675171] kasan_check_range+0x35/0x1b0 [ 11.675412] smb2_handle_negotiate+0x799/0x1610 [ 11.676217] ksmbd_smb_negotiate_common+0x526/0x770 [ 11.676795] handle_ksmbd_work+0x274/0x810 ... Cc: stable(a)vger.kernel.org Signed-off-by: Chih-Yen Chang <cc85nod(a)gmail.com> Tested-by: Chih-Yen Chang <cc85nod(a)gmail.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflict: fs/smb/server/smb2pdu.c Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- fs/ksmbd/smb2pdu.c | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/fs/ksmbd/smb2pdu.c b/fs/ksmbd/smb2pdu.c index 18e176fcddf0..c357b2127774 100644 --- a/fs/ksmbd/smb2pdu.c +++ b/fs/ksmbd/smb2pdu.c @@ -978,13 +978,13 @@ static void decode_sign_cap_ctxt(struct ksmbd_conn *conn, static __le32 deassemble_neg_contexts(struct ksmbd_conn *conn, struct smb2_negotiate_req *req, - int len_of_smb) + unsigned int len_of_smb) { /* +4 is to account for the RFC1001 len field */ struct smb2_neg_context *pctx = (struct smb2_neg_context *)req; int i = 0, len_of_ctxts; - int offset = le32_to_cpu(req->NegotiateContextOffset); - int neg_ctxt_cnt = le16_to_cpu(req->NegotiateContextCount); + unsigned int offset = le32_to_cpu(req->NegotiateContextOffset); + unsigned int neg_ctxt_cnt = le16_to_cpu(req->NegotiateContextCount); __le32 status = STATUS_INVALID_PARAMETER; ksmbd_debug(SMB, "decoding %d negotiate contexts\n", neg_ctxt_cnt); @@ -1002,7 +1002,7 @@ static __le32 deassemble_neg_contexts(struct ksmbd_conn *conn, if (len_of_ctxts == 0) break; - if (len_of_ctxts < sizeof(struct smb2_neg_context)) + if (len_of_ctxts < (int)sizeof(struct smb2_neg_context)) break; pctx = (struct smb2_neg_context *)((char *)pctx + offset); @@ -1053,9 +1053,8 @@ static __le32 deassemble_neg_contexts(struct ksmbd_conn *conn, } /* offsets must be 8 byte aligned */ - clen = (clen + 7) & ~0x7; - offset = clen + sizeof(struct smb2_neg_context); - len_of_ctxts -= clen + sizeof(struct smb2_neg_context); + offset = (clen + sizeof(struct smb2_neg_context) + 7) & ~0x7; + len_of_ctxts -= offset; } return status; } -- 2.31.1

2 1

[PATCH OLK-5.10 0/2] net: nfc: Fix CVE-2023-3863
by Ziyang Xuan 29 Jul '23

29 Jul '23

Backport CVE-2023-3863 fix commit. Krzysztof Kozlowski (1): nfc: llcp: simplify llcp_sock_connect() error paths Lin Ma (1): net: nfc: Fix use-after-free caused by nfc_llcp_find_local net/nfc/llcp.h | 1 - net/nfc/llcp_commands.c | 12 +++++++--- net/nfc/llcp_core.c | 49 +++++++++++++++++++++++++++++++++++------ net/nfc/llcp_sock.c | 21 ++++++++++-------- net/nfc/netlink.c | 20 ++++++++++++----- net/nfc/nfc.h | 1 + 6 files changed, 79 insertions(+), 25 deletions(-) -- 2.25.1

2 3

[PATCH OLK-5.10] net/sched: cls_u32: Fix reference counter leak leading to overflow
by Lu Wei 29 Jul '23

29 Jul '23

From: Lee Jones <lee(a)kernel.org> stable inclusion from stable-v5.10.185 commit af6eaa57986e82d7efd81984ee607927c6de61e4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7N3N2 CVE: CVE-2023-3609 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 04c55383fa5689357bcdd2c8036725a55ed632bc ] In the event of a failure in tcf_change_indev(), u32_set_parms() will immediately return without decrementing the recently incremented reference counter. If this happens enough times, the counter will rollover and the reference freed, leading to a double free which can be used to do 'bad things'. In order to prevent this, move the point of possible failure above the point where the reference counter is incremented. Also save any meaningful return values to be applied to the return data at the appropriate point in time. This issue was caught with KASAN. Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct") Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Lee Jones <lee(a)kernel.org> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/sched/cls_u32.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index da042bc8b239..1ac8ff445a6d 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -716,12 +716,18 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, struct nlattr *est, bool ovr, struct netlink_ext_ack *extack) { - int err; + int err, ifindex = -1; err = tcf_exts_validate(net, tp, tb, est, &n->exts, ovr, true, extack); if (err < 0) return err; + if (tb[TCA_U32_INDEV]) { + ifindex = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); + if (ifindex < 0) + return -EINVAL; + } + if (tb[TCA_U32_LINK]) { u32 handle = nla_get_u32(tb[TCA_U32_LINK]); struct tc_u_hnode *ht_down = NULL, *ht_old; @@ -756,13 +762,9 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, tcf_bind_filter(tp, &n->res, base); } - if (tb[TCA_U32_INDEV]) { - int ret; - ret = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); - if (ret < 0) - return -EINVAL; - n->ifindex = ret; - } + if (ifindex >= 0) + n->ifindex = ifindex; + return 0; } -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] net/sched: cls_u32: Fix reference counter leak leading to overflow
by Lu Wei 28 Jul '23

28 Jul '23

From: Lee Jones <lee(a)kernel.org> mainline inclusion from mainline-v6.4-rc7 commit 04c55383fa5689357bcdd2c8036725a55ed632bc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7N3N2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In the event of a failure in tcf_change_indev(), u32_set_parms() will immediately return without decrementing the recently incremented reference counter. If this happens enough times, the counter will rollover and the reference freed, leading to a double free which can be used to do 'bad things'. In order to prevent this, move the point of possible failure above the point where the reference counter is incremented. Also save any meaningful return values to be applied to the return data at the appropriate point in time. This issue was caught with KASAN. Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct") Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Lee Jones <lee(a)kernel.org> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> conflict: net/sched/cls_u32.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/sched/cls_u32.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index 23d95db99121..9c92978c8684 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -778,11 +778,22 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, struct netlink_ext_ack *extack) { int err; +#ifdef CONFIG_NET_CLS_IND + int ifindex = -1; +#endif err = tcf_exts_validate(net, tp, tb, est, &n->exts, ovr, extack); if (err < 0) return err; +#ifdef CONFIG_NET_CLS_IND + if (tb[TCA_U32_INDEV]) { + ifindex = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); + if (ifindex < 0) + return -EINVAL; + } +#endif + if (tb[TCA_U32_LINK]) { u32 handle = nla_get_u32(tb[TCA_U32_LINK]); struct tc_u_hnode *ht_down = NULL, *ht_old; @@ -814,13 +825,8 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, } #ifdef CONFIG_NET_CLS_IND - if (tb[TCA_U32_INDEV]) { - int ret; - ret = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); - if (ret < 0) - return -EINVAL; - n->ifindex = ret; - } + if (ifindex >= 0) + n->ifindex = ifindex; #endif return 0; } -- 2.34.1

2 1

[openEuler-1.0-LTS,v2] net/sched: cls_u32: Fix reference counter leak leading to overflow
by Lu Wei 28 Jul '23

28 Jul '23

From: Lee Jones <lee(a)kernel.org> mainline inclusion from mainline-v6.4-rc7 commit 04c55383fa5689357bcdd2c8036725a55ed632bc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7N3N2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In the event of a failure in tcf_change_indev(), u32_set_parms() will immediately return without decrementing the recently incremented reference counter. If this happens enough times, the counter will rollover and the reference freed, leading to a double free which can be used to do 'bad things'. In order to prevent this, move the point of possible failure above the point where the reference counter is incremented. Also save any meaningful return values to be applied to the return data at the appropriate point in time. This issue was caught with KASAN. Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct") Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Lee Jones <lee(a)kernel.org> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> conflict: net/sched/cls_u32.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- V2: add macro separation for ifindex definition net/sched/cls_u32.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index 23d95db99121..9c92978c8684 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -778,11 +778,22 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, struct netlink_ext_ack *extack) { int err; +#ifdef CONFIG_NET_CLS_IND + int ifindex = -1; +#endif err = tcf_exts_validate(net, tp, tb, est, &n->exts, ovr, extack); if (err < 0) return err; +#ifdef CONFIG_NET_CLS_IND + if (tb[TCA_U32_INDEV]) { + ifindex = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); + if (ifindex < 0) + return -EINVAL; + } +#endif + if (tb[TCA_U32_LINK]) { u32 handle = nla_get_u32(tb[TCA_U32_LINK]); struct tc_u_hnode *ht_down = NULL, *ht_old; @@ -814,13 +825,8 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, } #ifdef CONFIG_NET_CLS_IND - if (tb[TCA_U32_INDEV]) { - int ret; - ret = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); - if (ret < 0) - return -EINVAL; - n->ifindex = ret; - } + if (ifindex >= 0) + n->ifindex = ifindex; #endif return 0; } -- 2.34.1

1 0

[PATCH OLK-5.10 00/10] rcu: Add RCU stall diagnosis information
by Zhen Lei 28 Jul '23

28 Jul '23

In some extreme cases, such as the I/O pressure test, the CPU usage may be 100%, causing RCU stall. In this case, the printed information about current is not useful. Displays the number and usage of hard interrupts, soft interrupts, and context switches that are generated within half of the CPU stall timeout, can help us make a general judgment. In other cases, we can preliminarily determine whether an infinite loop occurs when local_irq, local_bh or preempt is disabled. Neeraj Upadhyay (1): rcu: Check and report missed fqs timer wakeup on RCU stall Paul E. McKenney (3): rcu: Prevent lockdep-RCU splats on lock acquisition/release rcu: For RCU grace-period kthread starvation, dump last CPU it ran on rcu: Do not NMI offline CPUs Zhen Lei (6): sched/debug: Try trigger_single_cpu_backtrace(cpu) in dump_cpu_task() sched/debug: Show the registers of 'current' in dump_cpu_task() sched: Add helper kstat_cpu_softirqs_sum() sched: Add helper nr_context_switches_cpu() rcu: Add RCU stall diagnosis information rcu: Align the output of RCU CPU stall warning messages Documentation/RCU/stallwarn.rst | 23 ++++- .../admin-guide/kernel-parameters.txt | 6 ++ include/linux/kernel_stat.h | 12 +++ kernel/rcu/Kconfig.debug | 13 +++ kernel/rcu/rcu.h | 1 + kernel/rcu/tree.c | 64 +++++++++++--- kernel/rcu/tree.h | 20 +++++ kernel/rcu/tree_stall.h | 86 +++++++++++++++++-- kernel/rcu/update.c | 2 + kernel/sched/core.c | 19 ++++ kernel/smp.c | 3 +- 11 files changed, 230 insertions(+), 19 deletions(-) -- 2.34.1

2 11

[PATCH OLK-5.10] psi: fix compile error for psi cgroupv1 when CONFIG_CGROUP=n
by Lu Jialin 28 Jul '23

28 Jul '23

Offering: HULK hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7OOZR ------------------------------- When CONFIG_CGROUP=n ,the compile error is: In file included from kernel/sched/core.c:13: kernel/sched/sched.h:2679:22: error: array type has incomplete element type ‘struct cftype’ extern struct cftype cgroup_v1_psi_files[]; ^~~~~~~~~~~~~~~~~~~ the reason is then CONFIG_CGROUP=n, struct cftype is not defined. We also find that, cgroup_v1_psi_files is used only in kernel/cgroup/cgroup.c and kernel/sched/cpuacct.c. Therefore, move extern struct cftype cgroup_v1_psi_files to kernel/sched/cpuacct.c.This also solved the compile error, because, then CONFIG_CGROUP=n, CONFIG_CGROUP_CPUACCT=n, the kernel/sched/cpuacct.c is not compiled, which will solve the compile error. Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- kernel/sched/cpuacct.c | 1 + kernel/sched/sched.h | 4 ---- 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/kernel/sched/cpuacct.c b/kernel/sched/cpuacct.c index 5c00d3dcee8d..28ed182b6801 100644 --- a/kernel/sched/cpuacct.c +++ b/kernel/sched/cpuacct.c @@ -390,6 +390,7 @@ static int __init setup_psi_v1(char *str) } __setup("psi_v1=", setup_psi_v1); +extern struct cftype cgroup_v1_psi_files[]; static int __init cgroup_v1_psi_init(void) { if (!psi_v1_enable) diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h index 95ae9ac553fc..50f1a11ac2fd 100644 --- a/kernel/sched/sched.h +++ b/kernel/sched/sched.h @@ -2977,10 +2977,6 @@ unsigned long scale_irq_capacity(unsigned long util, unsigned long irq, unsigned } #endif -#ifdef CONFIG_PSI -extern struct cftype cgroup_v1_psi_files[]; -#endif - #if defined(CONFIG_ENERGY_MODEL) && defined(CONFIG_CPU_FREQ_GOV_SCHEDUTIL) #define perf_domain_span(pd) (to_cpumask(((pd)->em_pd->cpus))) -- 2.17.1

2 1

[PATCH OLK-5.10] net/sched: cls_fw: Fix improper refcount update leads to use-after-free
by Dong Chenchen 27 Jul '23

27 Jul '23

From: M A Ramdhan <ramdhan(a)starlabs.sg> stable inclusion from stable-v5.10.187 commit 80e0e8d5f54397c5048fa2274144134dd9dc91b5 category: bugfix bugzilla: 189032,https://gitee.com/src-openeuler/kernel/issues/I7N3N3 CVE: CVE-2023-3776 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… --------------------------- [ Upstream commit 0323bce598eea038714f941ce2b22541c46d488f ] In the event of a failure in tcf_change_indev(), fw_set_parms() will immediately return an error after incrementing or decrementing reference counter in tcf_bind_filter(). If attacker can control reference counter to zero and make reference freed, leading to use after free. In order to prevent this, move the point of possible failure above the point where the TC_FW_CLASSID is handled. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: M A Ramdhan <ramdhan(a)starlabs.sg> Signed-off-by: M A Ramdhan <ramdhan(a)starlabs.sg> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Reviewed-by: Pedro Tammela <pctammela(a)mojatatu.com> Message-ID: <20230705161530.52003-1-ramdhan(a)starlabs.sg> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Dong Chenchen <dongchenchen2(a)huawei.com> --- net/sched/cls_fw.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c index ec945294626a..41f0898a5a56 100644 --- a/net/sched/cls_fw.c +++ b/net/sched/cls_fw.c @@ -210,11 +210,6 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, if (err < 0) return err; - if (tb[TCA_FW_CLASSID]) { - f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); - tcf_bind_filter(tp, &f->res, base); - } - if (tb[TCA_FW_INDEV]) { int ret; ret = tcf_change_indev(net, tb[TCA_FW_INDEV], extack); @@ -231,6 +226,11 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, } else if (head->mask != 0xFFFFFFFF) return err; + if (tb[TCA_FW_CLASSID]) { + f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); + tcf_bind_filter(tp, &f->res, base); + } + return 0; } -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS] net/sched: cls_fw: Fix improper refcount update leads to use-after-free
by Dong Chenchen 27 Jul '23

27 Jul '23

From: M A Ramdhan <ramdhan(a)starlabs.sg> mainline inclusion from mainline-v6.4 commit 0323bce598eea038714f941ce2b22541c46d488f category: bugfix bugzilla: 189032, https://gitee.com/src-openeuler/kernel/issues/I7N3N3 CVE: CVE-2023-3776 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- In the event of a failure in tcf_change_indev(), fw_set_parms() will immediately return an error after incrementing or decrementing reference counter in tcf_bind_filter(). If attacker can control reference counter to zero and make reference freed, leading to use after free. In order to prevent this, move the point of possible failure above the point where the TC_FW_CLASSID is handled. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: M A Ramdhan <ramdhan(a)starlabs.sg> Signed-off-by: M A Ramdhan <ramdhan(a)starlabs.sg> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Reviewed-by: Pedro Tammela <pctammela(a)mojatatu.com> Message-ID: <20230705161530.52003-1-ramdhan(a)starlabs.sg> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflict: net/sched/cls_fw.c Signed-off-by: dongchenchen <dongchenchen2(a)huawei.com> --- net/sched/cls_fw.c | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/net/sched/cls_fw.c b/net/sched/cls_fw.c index 29eeeaf3ea44..0c21e58d52bf 100644 --- a/net/sched/cls_fw.c +++ b/net/sched/cls_fw.c @@ -221,11 +221,6 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, if (err < 0) return err; - if (tb[TCA_FW_CLASSID]) { - f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); - tcf_bind_filter(tp, &f->res, base); - } - #ifdef CONFIG_NET_CLS_IND if (tb[TCA_FW_INDEV]) { int ret; @@ -244,6 +239,11 @@ static int fw_set_parms(struct net *net, struct tcf_proto *tp, } else if (head->mask != 0xFFFFFFFF) return err; + if (tb[TCA_FW_CLASSID]) { + f->res.classid = nla_get_u32(tb[TCA_FW_CLASSID]); + tcf_bind_filter(tp, &f->res, base); + } + return 0; } -- 2.25.1

2 1

关于oEEP-0006 kernel SIG的相关工作
by kai.liu 27 Jul '23

27 Jul '23

Hi 刘超，以下是我初步分析的工作分解，请帮忙提出意见，谢谢！ 1. Kernel config review a) 分析Fedora 38、openSUSE 15.5和Debian 12的内核配置文件，目标是达到与它们接近的50% =m比例。需分析清楚： i. 它们主要是哪些类型的驱动开启了，哪些未开启。 ii. 它们的策略是否一致。如不一致，openEuler应采用何种策略？ b) 按上一条决策对openEuler kconfig进行修改，并提交PR。 c) Kernel SIG maintainer对PR进行review，反馈意见，达成共识。 d) 提交TC确认，正式合入PR。 2. Kernel RPM拆包：将kernel二进制包拆分成3个，名字待定，参见TC仓PR#57。 a) 定义各子包的内核模块列表： i. min：含内核文件本身如vmlinuz，system.map，config，以及在虚拟化环境下启动和运行常见业务负载所必须的模块，如virtio，iptables，fs，以及少量虚拟化中常见模拟真实的硬件的驱动如LSI HBA，Intel e1000网卡等。 ii. base：包含对常见服务器硬件的驱动，如RAID卡，HBA卡，网卡。主要基于现在kernel包的模块列表。 iii. extras：新开启的模块，少量服务器相关的驱动放入基础包，其它PC/桌面/嵌入式等相关的模块放入扩展包。 b) 定义升级策略：当前kernel包应升级到新定义的base内核包。原因为： i. Base包的模块范围与原kernel包的最接近。 ii. Base包适用的服务器场景依然是openEuler的主流场景。 c) Spec文件重构。 i. 拆分包，根据上面定义的模块列表分别打包。 ii. 定义好依赖关系：extras依赖base，base依赖min。 iii. 根据升级策略，定义好Provides和Obsoletes，使得升级时可正常从原来的kernel包升级。以上1、2任务可以并行。2a、2b、2c又可以并行。1a和2a强相关，需紧密关联合作。刘恺 Email: kai.liu(a)xfusion.com<mailto:kai.liu@xfusion.com> | Mobile: 181 2600 8111

2 2

[PATCH OLK-5.10] ksmbd: allocate one more byte for implied bcc[0]
by Li Nan 27 Jul '23

27 Jul '23

From: Chih-Yen Chang <cc85nod(a)gmail.com> mainline inclusion from mainline-v6.4-rc3 commit 443d61d1fa9faa60ef925513d83742902390100f category: bugfix bugzilla: 189030, https://gitee.com/openeuler/kernel/issues/I7LU2I CVE: CVE-2023-38429 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… ---------------------------------------- ksmbd_smb2_check_message allows client to return one byte more, so we need to allocate additional memory in ksmbd_conn_handler_loop to avoid out-of-bound access. Cc: stable(a)vger.kernel.org Signed-off-by: Chih-Yen Chang <cc85nod(a)gmail.com> Acked-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflict: fs/ksmbd/connection.c Signed-off-by: Li Nan <linan122(a)huawei.com> --- fs/ksmbd/connection.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/ksmbd/connection.c b/fs/ksmbd/connection.c index 8e15ec9e8f43..9c4ca0bbd71e 100644 --- a/fs/ksmbd/connection.c +++ b/fs/ksmbd/connection.c @@ -309,7 +309,8 @@ int ksmbd_conn_handler_loop(void *p) } /* 4 for rfc1002 length field */ - size = pdu_size + 4; + /* 1 for implied bcc[0] */ + size = pdu_size + 4 + 1; conn->request_buf = kvmalloc(size, GFP_KERNEL); if (!conn->request_buf) continue; -- 2.39.2

2 1

[PATCH V2 OLK-5.10 0/6] Sync patches for sharepool
by Zhang Zekun 27 Jul '23

27 Jul '23

Sync patches for sharepool - Fix some bugs in code - Add a new feature for sharepool v2: - Fix some errors in patch 1, missing some code because of using git format-patch wrongly. Chen Jun (1): mm/sharepool: Add mg_sp_alloc_nodemask Xu Qiang (5): mm/sharepool: Change data type of members in sp_spa_stat to atomic64. mm/sharepool: Delete SPG_FLAG_NON_DVPP. mm/sharepool: Add sp_group_sem protection. mm/sharepool: Delete total_num and total_size in sp_spa_stat mm/sharepool: Delete unused flag in sp_group. include/linux/hugetlb.h | 15 ++ include/linux/share_pool.h | 12 +- include/linux/share_pool_interface.h | 19 +++ mm/hugetlb.c | 30 +++- mm/mempolicy.c | 4 +- mm/share_pool.c | 222 ++++++++++++++------------- 6 files changed, 180 insertions(+), 122 deletions(-) create mode 100644 include/linux/share_pool_interface.h -- 2.17.1

2 7

[PATCH openEuler-1.0-LTS] binder: fix UAF caused by faulty buffer cleanup
by Longlong Xia 27 Jul '23

27 Jul '23

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v5.10.182 commit 2218752325a98861dfb10f59a9b0270d6d4abe21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7L0Z9 CVE: CVE-2023-21255 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bdc1c5fac982845a58d28690cdb56db8c88a530d upstream. In binder_transaction_buffer_release() the 'failed_at' offset indicates the number of objects to clean up. However, this function was changed by commit 44d8047f1d87 ("binder: use standard functions to allocate fds"), to release all the objects in the buffer when 'failed_at' is zero. This introduced an issue when a transaction buffer is released without any objects having been processed so far. In this case, 'failed_at' is indeed zero yet it is misinterpreted as releasing the entire buffer. This leads to use-after-free errors where nodes are incorrectly freed and subsequently accessed. Such is the case in the following KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in binder_thread_read+0xc40/0x1f30 Read of size 8 at addr ffff4faf037cfc58 by task poc/474 CPU: 6 PID: 474 Comm: poc Not tainted 6.3.0-12570-g7df047b3f0aa #5 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x48/0x60 print_report+0xf8/0x5b8 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 binder_thread_read+0xc40/0x1f30 binder_ioctl+0xd9c/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Allocated by task 474: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_alloc_info+0x24/0x34 __kasan_kmalloc+0xb8/0xbc kmalloc_trace+0x48/0x5c binder_new_node+0x3c/0x3a4 binder_transaction+0x2b58/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Freed by task 475: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_free_info+0x38/0x5c __kasan_slab_free+0xe8/0x154 __kmem_cache_free+0x128/0x2bc kfree+0x58/0x70 binder_dec_node_tmpref+0x178/0x1fc binder_transaction_buffer_release+0x430/0x628 binder_transaction+0x1954/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] ================================================================== In order to avoid these issues, let's always calculate the intended 'failed_at' offset beforehand. This is renamed and wrapped in a helper function to make it clear and convenient. Fixes: 32e9f56a96d8 ("binder: don't detect sender/target during buffer cleanup") Reported-by: Zi Fan Tan <zifantan(a)google.com> Cc: stable(a)vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Acked-by: Todd Kjos <tkjos(a)google.com> Link: https://lore.kernel.org/r/20230505203020.4101154-1-cmllamas@google.com [cmllamas: resolve trivial conflict due to missing commit 9864bb4801331] Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Longlong Xia <xialonglong1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: tong tiangen <tongtiangen(a)huawei.com> Reviewed-by: Nanyong Sun <sunnanyong(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> --- drivers/android/binder.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index d73b0df55967..98c785ebfa5d 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2302,24 +2302,23 @@ static void binder_deferred_fd_close(int fd) static void binder_transaction_buffer_release(struct binder_proc *proc, struct binder_thread *thread, struct binder_buffer *buffer, - binder_size_t failed_at, + binder_size_t off_end_offset, bool is_failure) { int debug_id = buffer->debug_id; - binder_size_t off_start_offset, buffer_offset, off_end_offset; + binder_size_t off_start_offset, buffer_offset; binder_debug(BINDER_DEBUG_TRANSACTION, "%d buffer release %d, size %zd-%zd, failed at %llx\n", proc->pid, buffer->debug_id, buffer->data_size, buffer->offsets_size, - (unsigned long long)failed_at); + (unsigned long long)off_end_offset); if (buffer->target_node) binder_dec_node(buffer->target_node, 1, 0); off_start_offset = ALIGN(buffer->data_size, sizeof(void *)); - off_end_offset = is_failure && failed_at ? failed_at : - off_start_offset + buffer->offsets_size; + for (buffer_offset = off_start_offset; buffer_offset < off_end_offset; buffer_offset += sizeof(binder_size_t)) { struct binder_object_header *hdr; @@ -2479,6 +2478,21 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, } } +/* Clean up all the objects in the buffer */ +static inline void binder_release_entire_buffer(struct binder_proc *proc, + struct binder_thread *thread, + struct binder_buffer *buffer, + bool is_failure) +{ + binder_size_t off_end_offset; + + off_end_offset = ALIGN(buffer->data_size, sizeof(void *)); + off_end_offset += buffer->offsets_size; + + binder_transaction_buffer_release(proc, thread, buffer, + off_end_offset, is_failure); +} + static int binder_translate_binder(struct flat_binder_object *fp, struct binder_transaction *t, struct binder_thread *thread) @@ -3949,7 +3963,7 @@ binder_free_buf(struct binder_proc *proc, binder_node_inner_unlock(buf_node); } trace_binder_transaction_buffer_release(buffer); - binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure); + binder_release_entire_buffer(proc, thread, buffer, is_failure); binder_alloc_free_buf(&proc->alloc, buffer); } -- 2.25.1

2 1

[PATCH OLK-5.10] mm: memcontrol: fix cannot alloc the maximum memcg ID
by Lu Jialin 27 Jul '23

27 Jul '23

From: Muchun Song <songmuchun(a)bytedance.com> mainline inclusion from mainline-v5.18-rc1 commit be740503ed03ea04ca362330baf082e6a38fe462 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7NXZ6?from=project-issue Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The idr_alloc() does not include @max ID. So in the current implementation, the maximum memcg ID is 65534 instead of 65535. It seems a bug. So fix this. Link: https://lkml.kernel.org/r/20220228122126.37293-15-songmuchun@bytedance.com Signed-off-by: Muchun Song <songmuchun(a)bytedance.com> Cc: Alex Shi <alexs(a)kernel.org> Cc: Anna Schumaker <Anna.Schumaker(a)Netapp.com> Cc: Chao Yu <chao(a)kernel.org> Cc: Dave Chinner <david(a)fromorbit.com> Cc: Fam Zheng <fam.zheng(a)bytedance.com> Cc: Jaegeuk Kim <jaegeuk(a)kernel.org> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Kari Argillander <kari.argillander(a)gmail.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Qi Zheng <zhengqi.arch(a)bytedance.com> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: Shakeel Butt <shakeelb(a)google.com> Cc: Theodore Ts'o <tytso(a)mit.edu> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Wei Yang <richard.weiyang(a)gmail.com> Cc: Xiongchun Duan <duanxiongchun(a)bytedance.com> Cc: Yang Shi <shy828301(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Conflict: mm/memcontrol.c Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- mm/memcontrol.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index dfe0f1127153..5082d0664adf 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -6277,8 +6277,7 @@ static struct mem_cgroup *mem_cgroup_alloc(void) goto fail; memcg->id.id = idr_alloc(&mem_cgroup_idr, NULL, - 1, MEM_CGROUP_ID_MAX, - GFP_KERNEL); + 1, MEM_CGROUP_ID_MAX + 1, GFP_KERNEL); if (memcg->id.id < 0) { error = memcg->id.id; goto fail; -- 2.17.1

2 1

[PATCH OLK-5.10] binder: fix UAF caused by faulty buffer cleanup
by Longlong Xia 27 Jul '23

27 Jul '23

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v5.10.182 commit 2218752325a98861dfb10f59a9b0270d6d4abe21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7L0Z9 CVE: CVE-2023-21255 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bdc1c5fac982845a58d28690cdb56db8c88a530d upstream. In binder_transaction_buffer_release() the 'failed_at' offset indicates the number of objects to clean up. However, this function was changed by commit 44d8047f1d87 ("binder: use standard functions to allocate fds"), to release all the objects in the buffer when 'failed_at' is zero. This introduced an issue when a transaction buffer is released without any objects having been processed so far. In this case, 'failed_at' is indeed zero yet it is misinterpreted as releasing the entire buffer. This leads to use-after-free errors where nodes are incorrectly freed and subsequently accessed. Such is the case in the following KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in binder_thread_read+0xc40/0x1f30 Read of size 8 at addr ffff4faf037cfc58 by task poc/474 CPU: 6 PID: 474 Comm: poc Not tainted 6.3.0-12570-g7df047b3f0aa #5 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x48/0x60 print_report+0xf8/0x5b8 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 binder_thread_read+0xc40/0x1f30 binder_ioctl+0xd9c/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Allocated by task 474: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_alloc_info+0x24/0x34 __kasan_kmalloc+0xb8/0xbc kmalloc_trace+0x48/0x5c binder_new_node+0x3c/0x3a4 binder_transaction+0x2b58/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Freed by task 475: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_free_info+0x38/0x5c __kasan_slab_free+0xe8/0x154 __kmem_cache_free+0x128/0x2bc kfree+0x58/0x70 binder_dec_node_tmpref+0x178/0x1fc binder_transaction_buffer_release+0x430/0x628 binder_transaction+0x1954/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] ================================================================== In order to avoid these issues, let's always calculate the intended 'failed_at' offset beforehand. This is renamed and wrapped in a helper function to make it clear and convenient. Fixes: 32e9f56a96d8 ("binder: don't detect sender/target during buffer cleanup") Reported-by: Zi Fan Tan <zifantan(a)google.com> Cc: stable(a)vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Acked-by: Todd Kjos <tkjos(a)google.com> Link: https://lore.kernel.org/r/20230505203020.4101154-1-cmllamas@google.com [cmllamas: resolve trivial conflict due to missing commit 9864bb4801331] Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Longlong Xia <xialonglong1(a)huawei.com> --- drivers/android/binder.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index b403c7f063b0..dbae98f09658 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2267,24 +2267,23 @@ static void binder_deferred_fd_close(int fd) static void binder_transaction_buffer_release(struct binder_proc *proc, struct binder_thread *thread, struct binder_buffer *buffer, - binder_size_t failed_at, + binder_size_t off_end_offset, bool is_failure) { int debug_id = buffer->debug_id; - binder_size_t off_start_offset, buffer_offset, off_end_offset; + binder_size_t off_start_offset, buffer_offset; binder_debug(BINDER_DEBUG_TRANSACTION, "%d buffer release %d, size %zd-%zd, failed at %llx\n", proc->pid, buffer->debug_id, buffer->data_size, buffer->offsets_size, - (unsigned long long)failed_at); + (unsigned long long)off_end_offset); if (buffer->target_node) binder_dec_node(buffer->target_node, 1, 0); off_start_offset = ALIGN(buffer->data_size, sizeof(void *)); - off_end_offset = is_failure && failed_at ? failed_at : - off_start_offset + buffer->offsets_size; + for (buffer_offset = off_start_offset; buffer_offset < off_end_offset; buffer_offset += sizeof(binder_size_t)) { struct binder_object_header *hdr; @@ -2444,6 +2443,21 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, } } +/* Clean up all the objects in the buffer */ +static inline void binder_release_entire_buffer(struct binder_proc *proc, + struct binder_thread *thread, + struct binder_buffer *buffer, + bool is_failure) +{ + binder_size_t off_end_offset; + + off_end_offset = ALIGN(buffer->data_size, sizeof(void *)); + off_end_offset += buffer->offsets_size; + + binder_transaction_buffer_release(proc, thread, buffer, + off_end_offset, is_failure); +} + static int binder_translate_binder(struct flat_binder_object *fp, struct binder_transaction *t, struct binder_thread *thread) @@ -3926,7 +3940,7 @@ binder_free_buf(struct binder_proc *proc, binder_node_inner_unlock(buf_node); } trace_binder_transaction_buffer_release(buffer); - binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure); + binder_release_entire_buffer(proc, thread, buffer, is_failure); binder_alloc_free_buf(&proc->alloc, buffer); } -- 2.25.1

2 1

[PATCH OLK-5.10] ksmbd: validate smb request protocol id
by Li Nan 27 Jul '23

27 Jul '23

From: Namjae Jeon <linkinjeon(a)kernel.org> mainline inclusion from mainline-v6.4-rc6 commit 1c1bcf2d3ea061613119b534f57507c377df20f9 category: bugfix bugzilla: 189016, https://gitee.com/openeuler/kernel/issues/I7LU2S CVE: CVE-2023-38430 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit?i… ---------------------------------------- This patch add the validation for smb request protocol id. If it is not one of the four ids(SMB1_PROTO_NUMBER, SMB2_PROTO_NUMBER, SMB2_TRANSFORM_PROTO_NUM, SMB2_COMPRESSION_TRANSFORM_ID), don't allow processing the request. And this will fix the following KASAN warning also. [ 13.905265] BUG: KASAN: slab-out-of-bounds in init_smb2_rsp_hdr+0x1b9/0x1f0 [ 13.905900] Read of size 16 at addr ffff888005fd2f34 by task kworker/0:2/44 ... [ 13.908553] Call Trace: [ 13.908793] <TASK> [ 13.908995] dump_stack_lvl+0x33/0x50 [ 13.909369] print_report+0xcc/0x620 [ 13.910870] kasan_report+0xae/0xe0 [ 13.911519] kasan_check_range+0x35/0x1b0 [ 13.911796] init_smb2_rsp_hdr+0x1b9/0x1f0 [ 13.912492] handle_ksmbd_work+0xe5/0x820 Cc: stable(a)vger.kernel.org Reported-by: Chih-Yen Chang <cc85nod(a)gmail.com> Signed-off-by: Namjae Jeon <linkinjeon(a)kernel.org> Signed-off-by: Steve French <stfrench(a)microsoft.com> Conflict: fs/ksmbd/connection.c Signed-off-by: Li Nan <linan122(a)huawei.com> --- fs/ksmbd/connection.c | 5 +++-- fs/ksmbd/smb_common.c | 14 +++++++++++++- 2 files changed, 16 insertions(+), 3 deletions(-) diff --git a/fs/ksmbd/connection.c b/fs/ksmbd/connection.c index 8e15ec9e8f43..4e9ce05374a3 100644 --- a/fs/ksmbd/connection.c +++ b/fs/ksmbd/connection.c @@ -315,8 +315,6 @@ int ksmbd_conn_handler_loop(void *p) continue; memcpy(conn->request_buf, hdr_buf, sizeof(hdr_buf)); - if (!ksmbd_smb_request(conn)) - break; /* * We already read 4 bytes to find out PDU size, now @@ -334,6 +332,9 @@ int ksmbd_conn_handler_loop(void *p) continue; } + if (!ksmbd_smb_request(conn)) + break; + if (!default_conn_ops.process_fn) { pr_err("No connection request callback\n"); break; diff --git a/fs/ksmbd/smb_common.c b/fs/ksmbd/smb_common.c index 8ea2cdda0984..ff2e738ae7ac 100644 --- a/fs/ksmbd/smb_common.c +++ b/fs/ksmbd/smb_common.c @@ -156,7 +156,19 @@ int ksmbd_verify_smb_message(struct ksmbd_work *work) */ bool ksmbd_smb_request(struct ksmbd_conn *conn) { - return conn->request_buf[0] == 0; + __le32 *proto = (__le32 *)smb2_get_msg(conn->request_buf); + + if (*proto == SMB2_COMPRESSION_TRANSFORM_ID) { + pr_err_ratelimited("smb2 compression not support yet"); + return false; + } + + if (*proto != SMB1_PROTO_NUMBER && + *proto != SMB2_PROTO_NUMBER && + *proto != SMB2_TRANSFORM_PROTO_NUM) + return false; + + return true; } static bool supported_protocol(int idx) -- 2.39.2

2 1

[PATCH OLK-5.10 v2 0/6] Stop attempts to auxtrace mmap when not an auxtrace event
by Junhao He 27 Jul '23

27 Jul '23

The patches stop attempts to auxtrace mmap when it is not an auxtrace event e.g. when mmapping the CPUs on which only sideband is captured Adrian Hunter (6): libperf evlist: Remove ->idx() per_cpu parameter libperf evlist: Move ->idx() into mmap_per_evsel() libperf evlist: Add evsel as a parameter to ->idx() perf auxtrace: Record whether an auxtrace mmap is needed perf auxtrace: Add mmap_needed to auxtrace_mmap_params perf auxtrace: Remove auxtrace_mmap_params__set_idx() per_cpu parameter tools/lib/perf/evlist.c | 9 +++------ tools/lib/perf/include/internal/evlist.h | 3 ++- tools/perf/arch/arm/util/cs-etm.c | 1 + tools/perf/arch/arm64/util/arm-spe.c | 1 + tools/perf/arch/arm64/util/hisi-ptt.c | 1 + tools/perf/arch/s390/util/auxtrace.c | 1 + tools/perf/arch/x86/util/intel-bts.c | 1 + tools/perf/arch/x86/util/intel-pt.c | 1 + tools/perf/util/auxtrace.c | 13 ++++++++++--- tools/perf/util/auxtrace.h | 14 ++++++++++---- tools/perf/util/evlist.c | 6 ++++-- tools/perf/util/evsel.h | 1 + tools/perf/util/mmap.c | 4 ++-- 13 files changed, 38 insertions(+), 18 deletions(-) -- 2.33.0

2 7

[PATCH OLK-5.10] mm: memcontrol: fix cannot alloc the maximum memcg ID
by Lu Jialin 27 Jul '23

27 Jul '23

From: Muchun Song <songmuchun(a)bytedance.com> mainline inclusion from mainline-v5.18-rc1 commit be740503ed03ea04ca362330baf082e6a38fe462 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7NXZ6?from=project-issue Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The idr_alloc() does not include @max ID. So in the current implementation, the maximum memcg ID is 65534 instead of 65535. It seems a bug. So fix this. Link: https://lkml.kernel.org/r/20220228122126.37293-15-songmuchun@bytedance.com Signed-off-by: Muchun Song <songmuchun(a)bytedance.com> Cc: Alex Shi <alexs(a)kernel.org> Cc: Anna Schumaker <Anna.Schumaker(a)Netapp.com> Cc: Chao Yu <chao(a)kernel.org> Cc: Dave Chinner <david(a)fromorbit.com> Cc: Fam Zheng <fam.zheng(a)bytedance.com> Cc: Jaegeuk Kim <jaegeuk(a)kernel.org> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Kari Argillander <kari.argillander(a)gmail.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Qi Zheng <zhengqi.arch(a)bytedance.com> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: Shakeel Butt <shakeelb(a)google.com> Cc: Theodore Ts'o <tytso(a)mit.edu> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Wei Yang <richard.weiyang(a)gmail.com> Cc: Xiongchun Duan <duanxiongchun(a)bytedance.com> Cc: Yang Shi <shy828301(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- mm/memcontrol.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 635cb8b65b86..65accea3a799 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -5763,8 +5763,7 @@ static struct mem_cgroup *mem_cgroup_alloc(void) return ERR_PTR(error); memcg->id.id = idr_alloc(&mem_cgroup_idr, NULL, - 1, MEM_CGROUP_ID_MAX, - GFP_KERNEL); + 1, MEM_CGROUP_ID_MAX + 1, GFP_KERNEL); if (memcg->id.id < 0) { error = memcg->id.id; goto fail; -- 2.17.1

2 1

[openEuler-1.0-LTS] net/sched: cls_u32: Fix reference counter leak leading to overflow
by Lu Wei 27 Jul '23

27 Jul '23

From: Lee Jones <lee(a)kernel.org> mainline inclusion from mainline-v6.4-rc7 commit 04c55383fa5689357bcdd2c8036725a55ed632bc category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7N3N2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- In the event of a failure in tcf_change_indev(), u32_set_parms() will immediately return without decrementing the recently incremented reference counter. If this happens enough times, the counter will rollover and the reference freed, leading to a double free which can be used to do 'bad things'. In order to prevent this, move the point of possible failure above the point where the reference counter is incremented. Also save any meaningful return values to be applied to the return data at the appropriate point in time. This issue was caught with KASAN. Fixes: 705c7091262d ("net: sched: cls_u32: no need to call tcf_exts_change for newly allocated struct") Suggested-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Lee Jones <lee(a)kernel.org> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Acked-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> conflict: net/sched/cls_u32.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> --- net/sched/cls_u32.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c index 23d95db99121..45807e125401 100644 --- a/net/sched/cls_u32.c +++ b/net/sched/cls_u32.c @@ -777,12 +777,20 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, struct nlattr *est, bool ovr, struct netlink_ext_ack *extack) { - int err; + int err, ifindex = -1; err = tcf_exts_validate(net, tp, tb, est, &n->exts, ovr, extack); if (err < 0) return err; +#ifdef CONFIG_NET_CLS_IND + if (tb[TCA_U32_INDEV]) { + ifindex = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); + if (ifindex < 0) + return -EINVAL; + } +#endif + if (tb[TCA_U32_LINK]) { u32 handle = nla_get_u32(tb[TCA_U32_LINK]); struct tc_u_hnode *ht_down = NULL, *ht_old; @@ -814,13 +822,8 @@ static int u32_set_parms(struct net *net, struct tcf_proto *tp, } #ifdef CONFIG_NET_CLS_IND - if (tb[TCA_U32_INDEV]) { - int ret; - ret = tcf_change_indev(net, tb[TCA_U32_INDEV], extack); - if (ret < 0) - return -EINVAL; - n->ifindex = ret; - } + if (ifindex >= 0) + n->ifindex = ifindex; #endif return 0; } -- 2.34.1

1 0

[PATCH openEuler-23.09 0/7] sched: Support dynamic affinity in scheduler
by Hui Tang 26 Jul '23

26 Jul '23

This pathchset support dynamic affinity feature. Dynamic affinity set preferred cpus for task. When the utilization of taskgroup's preferred cpu is low, task only run in cpus preferred to enhance cpu resource locality and reduce interference between task cgroups, otherwise task can burst preferred cpus to use external cpu within cpus allowed. Hui Tang (1): sched: Add cmdline for dynamic affinity tanghui (6): sched: Introduce dynamic affinity for cfs scheduler cpuset: Introduce new interface for scheduler dynamic affinity sched: Adjust wakeup cpu range according CPU util dynamicly sched: Adjust cpu allowed in load balance dynamicly sched: Add statistics for scheduler dynamic affinity config: enable CONFIG_QOS_SCHED_DYNAMIC_AFFINITY by default arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/proc/base.c | 73 +++++++++++ include/linux/sched.h | 22 ++++ include/linux/sched/sysctl.h | 3 + init/Kconfig | 10 ++ init/init_task.c | 3 + kernel/cgroup/cpuset.c | 153 ++++++++++++++++++++++- kernel/fork.c | 16 +++ kernel/sched/core.c | 98 +++++++++++++++ kernel/sched/debug.c | 6 + kernel/sched/fair.c | 162 +++++++++++++++++++++++++ kernel/sysctl.c | 11 ++ 13 files changed, 558 insertions(+), 1 deletion(-) -- 2.17.1

2 8

[PATCH openEuler-22.03-LTS] binder: fix UAF caused by faulty buffer cleanup
by Longlong Xia 26 Jul '23

26 Jul '23

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v5.10.182 commit 2218752325a98861dfb10f59a9b0270d6d4abe21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7L0Z9 CVE: CVE-2023-21255 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bdc1c5fac982845a58d28690cdb56db8c88a530d upstream. In binder_transaction_buffer_release() the 'failed_at' offset indicates the number of objects to clean up. However, this function was changed by commit 44d8047f1d87 ("binder: use standard functions to allocate fds"), to release all the objects in the buffer when 'failed_at' is zero. This introduced an issue when a transaction buffer is released without any objects having been processed so far. In this case, 'failed_at' is indeed zero yet it is misinterpreted as releasing the entire buffer. This leads to use-after-free errors where nodes are incorrectly freed and subsequently accessed. Such is the case in the following KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in binder_thread_read+0xc40/0x1f30 Read of size 8 at addr ffff4faf037cfc58 by task poc/474 CPU: 6 PID: 474 Comm: poc Not tainted 6.3.0-12570-g7df047b3f0aa #5 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x48/0x60 print_report+0xf8/0x5b8 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 binder_thread_read+0xc40/0x1f30 binder_ioctl+0xd9c/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Allocated by task 474: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_alloc_info+0x24/0x34 __kasan_kmalloc+0xb8/0xbc kmalloc_trace+0x48/0x5c binder_new_node+0x3c/0x3a4 binder_transaction+0x2b58/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Freed by task 475: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_free_info+0x38/0x5c __kasan_slab_free+0xe8/0x154 __kmem_cache_free+0x128/0x2bc kfree+0x58/0x70 binder_dec_node_tmpref+0x178/0x1fc binder_transaction_buffer_release+0x430/0x628 binder_transaction+0x1954/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] ================================================================== In order to avoid these issues, let's always calculate the intended 'failed_at' offset beforehand. This is renamed and wrapped in a helper function to make it clear and convenient. Fixes: 32e9f56a96d8 ("binder: don't detect sender/target during buffer cleanup") Reported-by: Zi Fan Tan <zifantan(a)google.com> Cc: stable(a)vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Acked-by: Todd Kjos <tkjos(a)google.com> Link: https://lore.kernel.org/r/20230505203020.4101154-1-cmllamas@google.com [cmllamas: resolve trivial conflict due to missing commit 9864bb4801331] Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Longlong Xia <xialonglong1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: tong tiangen <tongtiangen(a)huawei.com> Reviewed-by: Nanyong Sun <sunnanyong(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> --- drivers/android/binder.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index d73b0df55967..98c785ebfa5d 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2302,24 +2302,23 @@ static void binder_deferred_fd_close(int fd) static void binder_transaction_buffer_release(struct binder_proc *proc, struct binder_thread *thread, struct binder_buffer *buffer, - binder_size_t failed_at, + binder_size_t off_end_offset, bool is_failure) { int debug_id = buffer->debug_id; - binder_size_t off_start_offset, buffer_offset, off_end_offset; + binder_size_t off_start_offset, buffer_offset; binder_debug(BINDER_DEBUG_TRANSACTION, "%d buffer release %d, size %zd-%zd, failed at %llx\n", proc->pid, buffer->debug_id, buffer->data_size, buffer->offsets_size, - (unsigned long long)failed_at); + (unsigned long long)off_end_offset); if (buffer->target_node) binder_dec_node(buffer->target_node, 1, 0); off_start_offset = ALIGN(buffer->data_size, sizeof(void *)); - off_end_offset = is_failure && failed_at ? failed_at : - off_start_offset + buffer->offsets_size; + for (buffer_offset = off_start_offset; buffer_offset < off_end_offset; buffer_offset += sizeof(binder_size_t)) { struct binder_object_header *hdr; @@ -2479,6 +2478,21 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, } } +/* Clean up all the objects in the buffer */ +static inline void binder_release_entire_buffer(struct binder_proc *proc, + struct binder_thread *thread, + struct binder_buffer *buffer, + bool is_failure) +{ + binder_size_t off_end_offset; + + off_end_offset = ALIGN(buffer->data_size, sizeof(void *)); + off_end_offset += buffer->offsets_size; + + binder_transaction_buffer_release(proc, thread, buffer, + off_end_offset, is_failure); +} + static int binder_translate_binder(struct flat_binder_object *fp, struct binder_transaction *t, struct binder_thread *thread) @@ -3949,7 +3963,7 @@ binder_free_buf(struct binder_proc *proc, binder_node_inner_unlock(buf_node); } trace_binder_transaction_buffer_release(buffer); - binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure); + binder_release_entire_buffer(proc, thread, buffer, is_failure); binder_alloc_free_buf(&proc->alloc, buffer); } -- 2.25.1

2 1

[PATCH 1/1] binder: fix UAF caused by faulty buffer cleanup
by Longlong Xia 26 Jul '23

26 Jul '23

From: Carlos Llamas <cmllamas(a)google.com> stable inclusion from stable-v5.10.182 commit 2218752325a98861dfb10f59a9b0270d6d4abe21 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7L0Z9 CVE: CVE-2023-21255 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit bdc1c5fac982845a58d28690cdb56db8c88a530d upstream. In binder_transaction_buffer_release() the 'failed_at' offset indicates the number of objects to clean up. However, this function was changed by commit 44d8047f1d87 ("binder: use standard functions to allocate fds"), to release all the objects in the buffer when 'failed_at' is zero. This introduced an issue when a transaction buffer is released without any objects having been processed so far. In this case, 'failed_at' is indeed zero yet it is misinterpreted as releasing the entire buffer. This leads to use-after-free errors where nodes are incorrectly freed and subsequently accessed. Such is the case in the following KASAN report: ================================================================== BUG: KASAN: slab-use-after-free in binder_thread_read+0xc40/0x1f30 Read of size 8 at addr ffff4faf037cfc58 by task poc/474 CPU: 6 PID: 474 Comm: poc Not tainted 6.3.0-12570-g7df047b3f0aa #5 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x94/0xec show_stack+0x18/0x24 dump_stack_lvl+0x48/0x60 print_report+0xf8/0x5b8 kasan_report+0xb8/0xfc __asan_load8+0x9c/0xb8 binder_thread_read+0xc40/0x1f30 binder_ioctl+0xd9c/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Allocated by task 474: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_alloc_info+0x24/0x34 __kasan_kmalloc+0xb8/0xbc kmalloc_trace+0x48/0x5c binder_new_node+0x3c/0x3a4 binder_transaction+0x2b58/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] Freed by task 475: kasan_save_stack+0x3c/0x64 kasan_set_track+0x2c/0x40 kasan_save_free_info+0x38/0x5c __kasan_slab_free+0xe8/0x154 __kmem_cache_free+0x128/0x2bc kfree+0x58/0x70 binder_dec_node_tmpref+0x178/0x1fc binder_transaction_buffer_release+0x430/0x628 binder_transaction+0x1954/0x36f0 binder_thread_write+0x8e0/0x1b78 binder_ioctl+0x14a0/0x1768 __arm64_sys_ioctl+0xd4/0x118 invoke_syscall+0x60/0x188 [...] ================================================================== In order to avoid these issues, let's always calculate the intended 'failed_at' offset beforehand. This is renamed and wrapped in a helper function to make it clear and convenient. Fixes: 32e9f56a96d8 ("binder: don't detect sender/target during buffer cleanup") Reported-by: Zi Fan Tan <zifantan(a)google.com> Cc: stable(a)vger.kernel.org Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Acked-by: Todd Kjos <tkjos(a)google.com> Link: https://lore.kernel.org/r/20230505203020.4101154-1-cmllamas@google.com [cmllamas: resolve trivial conflict due to missing commit 9864bb4801331] Signed-off-by: Carlos Llamas <cmllamas(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Longlong Xia <xialonglong1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: tong tiangen <tongtiangen(a)huawei.com> Reviewed-by: Nanyong Sun <sunnanyong(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> --- drivers/android/binder.c | 26 ++++++++++++++++++++------ 1 file changed, 20 insertions(+), 6 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index d73b0df55967..98c785ebfa5d 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2302,24 +2302,23 @@ static void binder_deferred_fd_close(int fd) static void binder_transaction_buffer_release(struct binder_proc *proc, struct binder_thread *thread, struct binder_buffer *buffer, - binder_size_t failed_at, + binder_size_t off_end_offset, bool is_failure) { int debug_id = buffer->debug_id; - binder_size_t off_start_offset, buffer_offset, off_end_offset; + binder_size_t off_start_offset, buffer_offset; binder_debug(BINDER_DEBUG_TRANSACTION, "%d buffer release %d, size %zd-%zd, failed at %llx\n", proc->pid, buffer->debug_id, buffer->data_size, buffer->offsets_size, - (unsigned long long)failed_at); + (unsigned long long)off_end_offset); if (buffer->target_node) binder_dec_node(buffer->target_node, 1, 0); off_start_offset = ALIGN(buffer->data_size, sizeof(void *)); - off_end_offset = is_failure && failed_at ? failed_at : - off_start_offset + buffer->offsets_size; + for (buffer_offset = off_start_offset; buffer_offset < off_end_offset; buffer_offset += sizeof(binder_size_t)) { struct binder_object_header *hdr; @@ -2479,6 +2478,21 @@ static void binder_transaction_buffer_release(struct binder_proc *proc, } } +/* Clean up all the objects in the buffer */ +static inline void binder_release_entire_buffer(struct binder_proc *proc, + struct binder_thread *thread, + struct binder_buffer *buffer, + bool is_failure) +{ + binder_size_t off_end_offset; + + off_end_offset = ALIGN(buffer->data_size, sizeof(void *)); + off_end_offset += buffer->offsets_size; + + binder_transaction_buffer_release(proc, thread, buffer, + off_end_offset, is_failure); +} + static int binder_translate_binder(struct flat_binder_object *fp, struct binder_transaction *t, struct binder_thread *thread) @@ -3949,7 +3963,7 @@ binder_free_buf(struct binder_proc *proc, binder_node_inner_unlock(buf_node); } trace_binder_transaction_buffer_release(buffer); - binder_transaction_buffer_release(proc, thread, buffer, 0, is_failure); + binder_release_entire_buffer(proc, thread, buffer, is_failure); binder_alloc_free_buf(&proc->alloc, buffer); } -- 2.25.1

1 0

[PATCH] Wayca: Add SAS features description doc
by Yihang Li 26 Jul '23

26 Jul '23

From: xiabing <xiabing12(a)h-partners.com> --- ...-Kunpeng-基础IO-SAS模块特性介绍.md | 389 ++++++++++++++++++ 1 file changed, 389 insertions(+) create mode 100644 WayCa-Kunpeng-底软/Wayca-Kunpeng-基础IO/Wayca-Kunpeng-基础IO-SAS模块特性介绍.md diff --git a/WayCa-Kunpeng-底软/Wayca-Kunpeng-基础IO/Wayca-Kunpeng-基础IO-SAS模块特性介绍.md b/WayCa-Kunpeng-底软/Wayca-Kunpeng-基础IO/Wayca-Kunpeng-基础IO-SAS模块特性介绍.md new file mode 100644 index 0000000..9e8cc2c --- /dev/null +++ b/WayCa-Kunpeng-底软/Wayca-Kunpeng-基础IO/Wayca-Kunpeng-基础IO-SAS模块特性介绍.md @@ -0,0 +1,389 @@ +# openEuler WayCa SIG 鲲鹏基础IO SAS模块介绍 +# 一、SAS驱动简介 +SAS驱动是适配920系列处理器SAS控制器的驱动模块。SAS（Serial Attached SCSI）即串行SCSI技术，一种磁盘连接技术。SAS控制器用于磁盘与内存之间进行交互。 + +## 源码获取路径 +- Linux kernel仓库：https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ +- openEuler 仓库：https://gitee.com/openeuler/kernel.git +- 源码路径：driver/scsi/hisi_sas + +## 功能描述 +对于鲲鹏920系列SAS模块，支持的特性如下： +- 兼容SAS3.0协议，同时向下兼容SAS2.0和SAS1.0 +-支持SSP/SMP/STP +-支持连接SATA盘（非AHCI方式） +-支持SATA协议定义的NCQ +-支持最多1024个设备 +-支持最多并发4096个IO +-支持宽端口（最多每个端口8个PHY）和窄端口模式 +-支持SAS链接速率12/6/3/1.5Gbit/s自协商， SATA链接速率6/3/1.5Gbit/s自协商 +-支持热插拔 +-支持SAS DIF +-支持SAS MSI中断模式及中断聚合 +-支持逻辑侧单个IO或整个盘的IO的abort +-支持错误以RAS方式上报 +-支持DFX +-支持BIST +-支持直连LED +-支持SAS runtime PM + +## 规格描述 + +本节主要描述用户可见、可感知的规格，以及规格描述、主线支持版本的列表 + +| 规格名称 | 规格描述 | 主线支持版本 | 备注 | +| ------------ | ------------ | ------------ | ------------ | +| 兼容SATA盘 | 非AHCI方式，可以直连SATA盘或expander连接SATA盘 | Linux Kernel 4.13 | 基本功能 | +| 支持SSP/SMP/STP | 支持直连或expander 连接SAS盘和SATA盘 | Linux Kernel 4.13 | 基本功能 | +| 支持最多1024个设备 | 支持最大设备数为1024个 | Linux Kernel 4.13 | 基本功能 | +| 支持最多4096个IO | 支持最多4096个IO | Linux Kernel 4.13 | 基本功能 | +| 支持DIF | 支持SAS DIF特性 | Linux Kernel 4.21 | - | +| 支持DIX | 支持SAS DIX特性 | Linux Kernel 5.1 | 依赖于DIF | +| 中断聚合 | 支持SAS MSI中断聚合 | Linux Kernel 4.21 | - | +| 支持错误以RAS方式上报 | 支持错误以RAS方式上报 | Linux Kernel 5.2 | - | +| 支持DFX | 以debugfs方式实现 | Linux Kernel 4.22 （Basic） Linux Kernel 5.5 (Enhance) | - | +| 支持BIST | 码流环回功能 | Linux Kernel 5.4 | - | +| 支持LED | 直连LED点灯 | Linux Kernel 4.18 | - | +| 支持SAS controller runtime PM | 支持SAS控制器的SAS controller runtime PM | Linux Kernel 4.16 | - | +## 内核config选项 +SAS驱动涉及的内核配置选项：CONFIG_SCSI_HISI_SAS和CONFIG_SCSI_HISI_SAS_PCI。对于鲲鹏920系列处理器使能，需要同时配置CONFIG_SCSI_HISI_SAS和CONFIG_SCSI_HISI_SAS_PCI。 +## 加载依赖 +模块编译后，会生成两个KO文件：hisi_sas_main.ko、hisi_sas_v3_hw.ko。先加载hisi_sas_main.ko，再加载hisi_sas_v3_hw.ko。 +## 模块参数 +SAS驱动模块当前包含四个模块参数，针对hisi_sas_main.ko的模块参数是：debugfs_enable、debugfs_dump_count，针对hisi_sas_v3_hw.ko的模块参数是：prot_mask、intr_conv。 + +| 模块参数 | 含义 | 默认值 | 设置 | +| ------------ | ------------ | ------------ | ------------ | +| debugfs_enable | 是否使能debugfs | 1 | debugfs_enable=1使能debugfs功能 debugfs_enable=0不使能debugfs功能 | +|debugfs_dump_count|debugfs dump次数设置|1|debugfs_dump_count = n (0<=n<=50)| +| prot_mask | DIF/DIX类型设置 | 0 | n: 设置DIF/DIX类型； 0: 不使能DIF/DIX | +| intr_conv | 是否使能中断聚合 | 0 | intr_conv =1使能中断聚合 intr_conv =0不使能中断聚合 | + + +# 二、特性详解 + +## 特性1：中断聚合 +- 特性介绍 + +上层的每个IO下发在底层驱动是通过DQ队列（即发送队列）发送给SAS控制器，IO完成后通过CQ队列返回。CQ队列的返回以中断方式触发。当IO产生比较频繁时，对应中断产生会很频繁，此时通过将部分中断一起上报可以提升性能。SAS驱动支持两种类型的中断聚合： + +1.中断聚合类型1： + +所有CQ队列（即CQ0-CQ15）的中断全部在CQ0上产生。 + +2.中断聚合类型2： + +在规定时间内对本队列产生的中断进行聚合，如果在规定时间内聚合到指定数量则产生一次中断，如果在规定时间内没有聚合到指定数量的中断，在规定时间达到时产生中断。 + +- 涉及代码与使能 + +| commitid | subject |openeuler OLK-5.10 enabled(Y/N) | +| ------------ | ------------ | ------------ | +| 37359798ec44 |scsi: hisi_sas: Add support for interrupt coalescing for v3 hw | Y | +| c3566f9a617d |scsi: hisi_sas: Create separate host attributes per HBA | Y | +| 488cf558e3d7 |scsi: hisi_sas: Add support for interrupt converge for v3 hw | Y | + +- 示例 + +使能中断聚合类型1： + +默认不使能中断聚合类型1，用户可以通过模块参数使能。 +```cpp +insmod hisi_sas_v3_hw.ko intr_conv=1 +``` +使能中断聚合类型2（配置中断聚合时间和次数）： +```cpp +echo 8 > /sys/devices/pci0000:74/0000:74:02.0/host0/scsi_host/host0/intr_coal_count +//设置中断聚合次数为8次 +echo 1000 > /sys/devices/pci0000:74/0000:74:02.0/host0/scsi_host/host0/intr_coal_ticks +//设置中断聚合时间为1ms +``` +查看中断聚合状态： + +对于中断聚合类型1，可通过PCI设备SYSFS接口目录下intr_conv_v3_hw接口查询中断聚合类型1是否使能； +对于中断聚合类型2，输入的中断聚合时间和中断聚合次数，其中任意参数为0，则表示不使能中断聚合类型2。 + + + + +## 特性2：DIF/DIX功能 +- 特性介绍 + +为了保证从硬盘到控制器再到应用程序之间的数据完整性，Linux内核和存储厂商共同推出了DIF+DIX来保证从应用程序到磁盘之间的完整IO路径上的“端对端”数据保护。 + +DIF(Data Integrity Field)允许提供在主机适配器和磁盘之间交换额外的保护信息。DIX(Data Integrity Extension)提供应用程序到主机适配器之间的保护信息。在传输过程中在数据IO后追加一些额外的信息，来检查数据的完整性，这些额外信息即为完整性保护信息。对于磁盘，会在原来扇区大小（512字节或者4K字节）后增加8字节来存储扇区数据的保护信息。 + +用户可通过模块参数prot_mask决定DIF/DIX支持模式。通过sg_utils工具，可以查询SAS盘的DIF支持情况、格式化为支持的DIF格式或恢复为普通盘。 + + +- 涉及代码与使能 + +| commitid | subject |openeuler OLK-5.10 enabled(Y/N) | +| ------------ | ------------ | ------------ | +| 6db831f4ef76 | scsi: hisi_sas: Make sg_tablesize consistent value | Y | +| 6e1b731b5352 | scsi: hisi_sas: Relocate some code to reduce complexity | Y | +| d6a9000b81be | scsi: hisi_sas: Add support for DIF feature for v2 hw | Y | +| b3cce125cb1e | scsi: hisi_sas: Add support for DIX feature for v3 hw | Y | + +- 示例 + +配置DIF/DIX支持模式 + +```c +insmod hisi_sas_v3_hw.ko prot_mask=0x70 +//支持DIX0/DIX1/DIX2/DIX3 +insmod hisi_sas_v3_hw.ko prot_mask=0x77 +//支持DIF1/DIF2/DIF3，支持DIX0/DIX1/DIX2/DIX3 +``` + +查询SAS盘对DIF的支持 +```c +sg_vpd --page=ei --long /dev/sdx |grep SPT +``` +格式化DIF SAS盘 +```c +sg_format --format --fmtpinfo=2 /dev/sdx //对于DIF1格式的盘 +sg_format --format --fmtpinfo=3 --pfu=1 /dev/sdx //对于DIF3格式的盘 +``` +恢复DIF盘为正常盘 +```c +sg_format -F -s 512 /dev/sdx +``` + +- 功能限制 + +EXT2文件系统由于其下发I/O数据存在并发性，导致数据与CRC之间不匹配，因此EXT2文件系统格式不支持DIF功能。 + + +## 特性3：debug调测功能 +- 特性介绍 + +debug调测功能为用户提供异常场景下自动或手动dump寄存器及部分IO数据的能力。SAS控制器驱动通过debugfs目录提供debug调测功能接口。其debugfs目录路径是：/sys/kernel/debug/hisi_sas，在该目录下会生成以SAS控制器BDF号命名的子目录。 + +- dump功能 + +自动dump功能在SAS控制器出现严重错误时（如internal abort命令超时）触发。 +手动dump可以在debugfs目录中通过命令 echo 1 > trigger_dump 对debugfs信息进行手动dump，完成dump后会在/sys/kernel/debug/hisi_sas/BDF_number/dump目录下生成相应信息。 + +- debugfs dump接口展示 + +![debugfs dump接口展示](http://image.huawei.com/tiny-lts/v1/images/adb310517372e6815b81e1… +- FIFO功能 + +FIFO功能是在接收硬件发出的触发信号后，收集相应的链路信息，并通过debugfs接口呈现给用户。FIFO功能为每个PHY提供7个配置接口以及1个展示dump数据的接口。 + +| 接口名称 | 接口描述 | 接口配置 | +| ------------ | ------------ | ------------ | +| signal_sel | 通过signal_sel可以选择一个指定的信号组 | b0000: 速率协商打包信号组 b0001: 12G tx train本端训练对端的调整方式，以及与HiLink的交互信号 b0010: 12G tx train对端训练本端的调整方式 b0011: sas_phy_ctrl_dfx0 b0100: sas_phy_ctrl_dfx1 b0101: sas_pcs_dfx0 other: 速率协商打包信号组 | +| dump_msk | 选择debug信号组需要dump的数据 | - | +| dump_mode | 配置信号触发后数据写入模式 | b001: 一直dump（无需配置trigger/ trigger_msk/trigger_mode接口） b010: 触发条件触发后，再dump32个数据就停止 b100: 触发条件触发后，不再dump | +| trigger_mode | 配置触发模式 | b001: 当cfg_dfx_trigger_msk对应的bit为1的debug信号发生跳变时触发（无需配置trigger接口） b010: 当debug信号等于cfg_dfx_trigger（cfg_dfx_trigger_msk对应的bit为1）时触发 b100: 当debug信号不等于cfg_dfx_trigger（cfg_dfx_trigger_msk对应的bit为1）时触发trigger | +| trigger | 通过trigger指定当前的信号组中触发信号的有效触发电平 | - | +| trigger_msk | 通过trigger_msk选择屏蔽一部分触发信号 | - | +| update_config | 更新接口配置 | b001:更新FIFO配置参数 | +| fifo_data | 展示根据用户配置dump的数据 | NA | + + +- 涉及代码与使能 + +| commitid | subject |openeuler OLK-5.10 enabled(Y/N) | +| ------------ | ------------ | ------------ | +| cd96fe600cc4 | scsi: hisi_sas: Add trace FIFO debugfs support | Y | +| 35160421b63d | scsi: hisi_sas: Don't create debugfs dump folder twice | Y | +| d28ed83b7693 | scsi: hisi_sas: Add timestamp for a debugfs dump | Y | +| 35ea630b2bad | scsi: hisi_sas: Add debugfs file structure for CQ | Y | +| 1b54c4db725d | scsi: hisi_sas: Add debugfs file structure for DQ | Y | +| c61163981076 | scsi: hisi_sas: Add debugfs file structure for registers | Y | +| 1f66e1fd26bd | scsi: hisi_sas: Add debugfs file structure for port | Y | +| e15f2e2dff5b | scsi: hisi_sas: Add debugfs file structure for IOST | Y | +| 0161d55f23a1 | scsi: hisi_sas: Add debugfs file structure for ITCT | Y | +| b714dd8f36dc | scsi: hisi_sas: Add debugfs file structure for IOST cache | Y | +| 357e4fc7a933 | scsi: hisi_sas: Add debugfs file structure for ITCT cache | Y | +| a70e33eae363 | scsi: hisi_sas: Allocate memory for multiple dumps of debugfs | Y | +| 905ab01faf5f | scsi: hisi_sas: Add module parameter for debugfs dump count | Y | +| 8f6432986e61 | scsi: hisi_sas: Add ability to have multiple debugfs dumps | Y | +| cabe7c10c97a | scsi: hisi_sas: Delete the debugfs folder of hisi_sas when the probe fails | Y | +| f873b66119f2 | scsi: hisi_sas: Record the phy down event in debugfs | Y | +| 26f84f9bc3ba | scsi: hisi_sas: Code style cleanup | Y | +| b601577df68a | scsi: hisi_sas: Add missing newlines | Y | +| ca06f2cd01d0 | scsi: hisi_sas: Make phy index variable name consistent | Y | +| caeddc0453b9 | scsi: hisi_sas: Do not modify upper fields of PROG_PHY_LINK_RATE reg | Y | +| 4b3a1f1feda6 | scsi: hisi_sas: Modify macro name for OOB phy linkrate | Y | +| 623a4b6d5c2a | scsi: hisi_sas: Move debugfs code to v3 hw driver | Y | +| 1dbe61bf7d76 | scsi: hisi_sas: Enable debugfs support by default | Y | +| ef63464bcf8f | scsi: hisi_sas: Create root and device debugfs directories | Y | +| eb1c2b72b769 | scsi: hisi_sas: Alloc debugfs snapshot buffer memory for all registers | Y | +| 49159a5e4175 | scsi: hisi_sas: Take debugfs snapshot for all regs | Y | +| caefac199676 | scsi: hisi_sas: Debugfs global register create file and add file operations | Y | +| 971afae7cf4f | scsi: hisi_sas: Add debugfs CQ file and add file operations | Y | +| 148e379f60c5 | scsi: hisi_sas: Add debugfs DQ file and add file operations | Y | +| 1afb4b852479 | scsi: hisi_sas: Add debugfs IOST file and add file operations | Y | +| 5979f33b982d | scsi: hisi_sas: Add debugfs ITCT file and add file operations | Y | +| 7c5e13636391 | scsi: hisi_sas: Add manual trigger for debugfs dump | Y | +| 61a6ebf3f584 | scsi: hisi_sas: Add debugfs for port registers | Y | +| bbe0a7b348b3 | scsi: hisi_sas: Snapshot HW cache of IOST and ITCT at debugfs | Y | +| b0b3e4290e28 | scsi: hisi_sas: Snapshot AXI and RAS register at debugfs | Y | +| 7105e68afaec | scsi: hisi_sas: add debugfs auto-trigger for internal abort time out | Y | +| 7ec7082c57ec | scsi: hisi_sas: Add hisi_sas_debugfs_alloc() to centralise allocation | Y | + +- 示例 + +```c +echo 0 > /sys/kernel/debug/hisi_sas/0000:30:04.0/fifo/0/signal_sel +//指定为速率协商打包信号组 +echo 0x7ff > /sys/kernel/debug/hisi_sas/0000:30:04.0/fifo/0/dump_msk +//指定需要监测的BIT +echo 1 > /sys/kernel/debug/hisi_sas/0000:30:04.0/fifo/0/dump_mode +//指定数据写入模式为一直dump +echo 1 > /sys/kernel/debug/hisi_sas/0000:30:04.0/fifo/0/update_config +//更新接口配置 +echo 12.0 Gbit > /sys/class/sas_phy/phy-4:0/maximum_linkrate +//触发速率重新协商 +cat /sys/kernel/debug/hisi_sas/0000:30:04.0/fifo/0/fifo_data +//展示dump信息 +``` + +## 特性4：BIST功能 +- 特性介绍 + +鲲鹏920系列处理器SAS支持环回码流功能，此功能通过设置链接速率、码型、PHY ID、环回类型等参数让控制器产生对应的码流，从而通过产生的码流检验链路的质量以及控制器链路层和PHY层的逻辑速率的正确性。 + +- BIST功能接口展示 + +BIST功能依赖于debugfs，因此要使能BIST功能需要提前使能debugfs。在BIST使能后会生成如下文件。 +![图片说明](http://image.huawei.com/tiny-lts/v1/images/04fb39cd3444fde201f75bf7e35cb19a_767x814.png) + +对于SAS BIST，组网要求与正常SAS控制器使用不一样：除remote模式外，其它模式不连接任何设备；remote模式需外接SAS环回头。 + +- 涉及代码与使能 + +| commitid | subject |openeuler OLK-5.10 enabled(Y/N) | +| ------------ | ------------ | ------------ | +|97b151e75861|scsi: hisi_sas: Add BIST support for phy loopback|Y| +|65a3b8bd5694|scsi: hisi_sas: Set the BIST init value before enabling BIST|Y| +| 981cc23e741a | scsi: hisi_sas: Add BIST support for fixed code pattern | Y | +| 2c4d582322ff | scsi: hisi_sas: Add BIST support for phy FFE | Y | + +- 示例 +```c +echo 1 > /sys/kernel/debug/hisi_sas/0000:30:04.0/bist/phy_id +//设置需要检测的PHY为phy1 +echo 3.0 Gbit > /sys/kernel/debug/hisi_sas/0000:30:04.0/bist/link_rate +//重新设置phy1的链路速率 +echo 1 > /sys/kernel/debug/hisi_sas/0000:30:04.0/bist/enable +//使能BIST +echo 0 > /sys/kernel/debug/hisi_sas/0000:30:04.0/bist/enable +//关闭BIST +cat /sys/kernel/debug/hisi_sas/0000:30:04.0/bist/cnt +//查看phy1的误码数量 +``` + +- 测试限制 + + 对于serdes方式，当前serdes工作模式并不是环回，会一直产生误码； + 对于码型为FIXED_DATA时, 不会有误码产生，不需要关注； + 可以通过误码注入，检查是否产生误码； + 由于协商速率要求，测试第一次需要将速率设置为大于等于3.0Gbit，后续可自由设置。 + + +## 特性5：runtime PM +- 特性介绍 + +SAS驱动支持SCSI设备的runtime PM。用户可以通过sysfs接口使能SCSI设备的runtime PM，并设置设备处于空闲状态达到用户指定时间N秒后，自动进入runtime PM状态，当用户给处于runtime PM状态的SCSI设备发送业务时，能够自动唤醒SCSI设备；当SCSI设备再次空闲N秒后自动进入runtime PM状态。 + +驱动支持SAS 控制器的runtime PM。用户可以通过sysfs接口使能SAS 控制器的runtime PM，当SAS 控制器连接的所有SCSI设备都进入runtime PM状态后，SAS 控制器会进入runtime PM状态；只要有一个SCSI设备不是runtime PM状态，SAS 控制器不会进入runtime PM状态。SAS 控制器进入runtime PM状态后，用户可对已进入runtime PM状态的SCSI设备下发业务，唤醒SCSI设备和SAS 控制器，当没有业务时SAS控制器和SCSI设备又会自动进入runtime PM状态。 + +- 用户接口及说明 + +| Runtime PM SYSFS用户接口 | 接口类型 | 含义及取值 | 默认值 | +| ------------ | ------------ | ------------ | ------------ | +| control | rw | 设置是否自动runtime PM auto: 允许设备runtime PM on: 不允许设备runtime PM | scsi设备:on scsi控制器:auto | +| runtime_status | r | 表示设备当前runtime状态 suspended: 进入suspended状态 active: 唤醒状态 suspending：正在suspending过程中 resuming: 正在唤醒过程中 unsupported: 不支持runtime PM | active | +| runtime_suspended_time | r | 设备处于suspended状态的时间 | NA | +| runtime_active_time | r | 设备处于active状态的时间 | NA | +| autosuspend_delay_ms | rw |若用户使能自动runtime PM，此项设置进入runtime PM状态前设备空闲的时间 -1: 一直不休眠 n: 设备空闲n秒后自动进入休眠| -1 | + +- 涉及代码与使能 + +驱动支持SCSI设备的runtime PM + +| commitid | subject |openeuler OLK-5.10 enabled(Y/N) | +| ------------ | ------------ | ------------ | +| 6c459ea1542b | scsi: hisi_sas: Switch to new framework to support suspend and resume | Y | +| 65ff4aef7e9b | scsi: hisi_sas: Add controller runtime PM support for v3 hw | Y | +| e06596d5000c | scsi: hisi_sas: Add check for methods _PS0 and _PR0 | Y | +| 16fd4a7c5917 | scsi: hisi_sas: Add device link between SCSI devices and hisi_hba | Y | +| b14a37e011d8 | scsi: hisi_sas: Filter out new PHY up events during suspend | Y | +| 69f4ec1edb13 | scsi: hisi_sas: Recover PHY state according to the status before reset | Y | +| 027e508aea45 | scsi: hisi_sas_v3_hw: Don't use PCI helper functions | Y | +| 71c8f15e1dbc | scsi: hisi_sas_v3_hw: Remove extra function calls for runtime pm | Y | +| 17b5e4d14837 | scsi: hisi_sas_v3_hw: Drop PCI Wakeup calls from .resume | Y | +| 027e508aea45 | scsi: hisi_sas_v3_hw: Don't use PCI helper functions | Y | +| 71c8f15e1dbcd | scsi: hisi_sas_v3_hw: Remove extra function calls for runtime pm | Y | +| 17b5e4d14837 | scsi: hisi_sas_v3_hw: Drop PCI Wakeup calls from .resume | Y | + +驱动支持SAS 控制器的runtime PM + +| commitid | subject |openeuler OLK-5.10 enabled(Y/N) | +| ------------ | ------------ | ------------ | +| d6e366685981 | PM: runtime: Drop pm_runtime_clean_up_links() | Y | +| e0e398e20463 |PM: runtime: Drop runtime PM references to supplier on link removal| Y | +| 9226c504e364 |PM: runtime: Resume the device earlier in __device_release_driver()| Y | +| fbefe22811c3 |scsi: libsas: Don't always drain event workqueue for HA resume | Y | +| 6cc739087784 |scsi: Revert "scsi: hisi_sas: Filter out new PHY up events during suspend" | Y | +| 97f410093984 |scsi: hisi_sas: Add more logs for runtime suspend/resume | Y | +| 29e2bac87421 |scsi: hisi_sas: Fix some issues related to asd_sas_port->phy_list | Y | +| 6e1fcab00a23 |scsi: block: pm: Always set request queue runtime active in blk_post_runtime_resume() | Y | +| 42159d3c8d87 |scsi: libsas: Add spin_lock/unlock() to protect asd_sas_port->phy_list | Y | +| 133b688b2d03 |scsi: mvsas: Add spin_lock/unlock() to protect asd_sas_port->phy_list | Y | +| e31e18128eb9 |scsi: libsas: Insert PORTE_BROADCAST_RCVD event for resuming host | Y | +| 0da7ca4c4fd9 |scsi: libsas: Resume host while sending SMP I/Os | Y | +| 4ea775abbb5c |scsi: libsas: Add flag SAS_HA_RESUMING | Y | +| 1bc35475c6bf |scsi: libsas: Refactor sas_queue_deferred_work() | Y | +| bf19aea4607c |scsi: libsas: Defer works of new phys during suspend | Y | +| 307d9f49cce9 |scsi: libsas: Keep host active while processing events | Y | +| 36c6b7613ef1 |scsi: hisi_sas: Initialise devices in .slave_alloc callback | Y | +| 046ab7d0f594 |scsi: hisi_sas: Wait for phyup in hisi_sas_control_phy()|Y| + +- 示例 + +```c +SCSI设备设置进入runtime PM状态 +echo auto > /sys/devices/pci0000:b4/0000:b4:02.0/host6/port-6:0/end_device-6:0/target6:0:0/6:0:0:0/power/control +//使能SCSI设备自动runtime PM +echo 5000 > /sys/devices/pci0000:b4/0000:b4:02.0/host6/port-6:0/end_device-6:0/target6:0:0/6:0:0:0/power/autosuspend_delay_ms +//设置SCSI设备进入runtime PM状态前设备空闲的时间为5s + +SAS控制器设置进入runtime PM状态 +echo auto > /sys/devices/pci0000:b4/0000:b4:02.0/power/control +//使能SAS控制器自动runtime PM +echo 2000 > /sys/devices/pci0000:b4/0000:b4:02.0/power/autosuspend_delay_ms +//设置SAS控制器进入runtime PM状态前设备空闲的时间为2s + +``` + + + + + + + + + + + + + + + + + + + + + + + + + + -- 2.30.0

1 0

openEuler Kernel SIG 双周例会
by openEuler conference 26 Jul '23

26 Jul '23

您好！ Kernel SIG 邀请您参加 2023-07-28 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG 双周例会会议内容： 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可直接回复邮件，或直接录入会议看板）会议链接：https://us06web.zoom.us/j/85789825222?pwd=bVcrNXVhVW9ObzVQWjVKdTlBNm14Zz09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2023-07-28 14:00, The subject of the conference is openEuler Kernel SIG 双周例会, Summary: 1. 进展update 2. 议题征集中欢迎大家积极申报议题（新增议题可直接回复邮件，或直接录入会议看板） You can join the meeting at https://us06web.zoom.us/j/85789825222?pwd=bVcrNXVhVW9ObzVQWjVKdTlBNm14Zz09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

2 1

[PATCH -next] of: unittest: fix null pointer dereferencing in of_unittest_find_node_by_name()
by Ruan Jinjie 26 Jul '23

26 Jul '23

when kmalloc() fail to allocate memory in kasprintf(), name or full_name will be NULL, strcmp() will cause null pointer dereference. Signed-off-by: Ruan Jinjie <ruanjinjie(a)huawei.com> --- drivers/of/unittest.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c index a406a12eb208..e5b0eea8011c 100644 --- a/drivers/of/unittest.c +++ b/drivers/of/unittest.c @@ -77,7 +77,7 @@ static void __init of_unittest_find_node_by_name(void) np = of_find_node_by_path("/testcase-data"); name = kasprintf(GFP_KERNEL, "%pOF", np); - unittest(np && !strcmp("/testcase-data", name), + unittest(np && name && !strcmp("/testcase-data", name), "find /testcase-data failed\n"); of_node_put(np); kfree(name); @@ -88,14 +88,14 @@ static void __init of_unittest_find_node_by_name(void) np = of_find_node_by_path("/testcase-data/phandle-tests/consumer-a"); name = kasprintf(GFP_KERNEL, "%pOF", np); - unittest(np && !strcmp("/testcase-data/phandle-tests/consumer-a", name), + unittest(np && name && !strcmp("/testcase-data/phandle-tests/consumer-a", name), "find /testcase-data/phandle-tests/consumer-a failed\n"); of_node_put(np); kfree(name); np = of_find_node_by_path("testcase-alias"); name = kasprintf(GFP_KERNEL, "%pOF", np); - unittest(np && !strcmp("/testcase-data", name), + unittest(np && name && !strcmp("/testcase-data", name), "find testcase-alias failed\n"); of_node_put(np); kfree(name); @@ -106,7 +106,7 @@ static void __init of_unittest_find_node_by_name(void) np = of_find_node_by_path("testcase-alias/phandle-tests/consumer-a"); name = kasprintf(GFP_KERNEL, "%pOF", np); - unittest(np && !strcmp("/testcase-data/phandle-tests/consumer-a", name), + unittest(np && name && !strcmp("/testcase-data/phandle-tests/consumer-a", name), "find testcase-alias/phandle-tests/consumer-a failed\n"); of_node_put(np); kfree(name); @@ -1533,6 +1533,8 @@ static void attach_node_and_children(struct device_node *np) const char *full_name; full_name = kasprintf(GFP_KERNEL, "%pOF", np); + if (!full_name) + return; if (!strcmp(full_name, "/__local_fixups__") || !strcmp(full_name, "/__fixups__")) { -- 2.34.1

1 0

[PATCH OLK-5.10] mm: memcontrol: fix cannot alloc the maximum memcg ID
by Lu Jialin 25 Jul '23

25 Jul '23

From: Muchun Song <songmuchun(a)bytedance.com> mainline inclusion from mainline-v5.18-rc1 commit be740503ed03ea04ca362330baf082e6a38fe462 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7NXZ6?from=project-issue Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- The idr_alloc() does not include @max ID. So in the current implementation, the maximum memcg ID is 65534 instead of 65535. It seems a bug. So fix this. Link: https://lkml.kernel.org/r/20220228122126.37293-15-songmuchun@bytedance.com Signed-off-by: Muchun Song <songmuchun(a)bytedance.com> Cc: Alex Shi <alexs(a)kernel.org> Cc: Anna Schumaker <Anna.Schumaker(a)Netapp.com> Cc: Chao Yu <chao(a)kernel.org> Cc: Dave Chinner <david(a)fromorbit.com> Cc: Fam Zheng <fam.zheng(a)bytedance.com> Cc: Jaegeuk Kim <jaegeuk(a)kernel.org> Cc: Johannes Weiner <hannes(a)cmpxchg.org> Cc: Kari Argillander <kari.argillander(a)gmail.com> Cc: Matthew Wilcox (Oracle) <willy(a)infradead.org> Cc: Michal Hocko <mhocko(a)kernel.org> Cc: Qi Zheng <zhengqi.arch(a)bytedance.com> Cc: Roman Gushchin <roman.gushchin(a)linux.dev> Cc: Shakeel Butt <shakeelb(a)google.com> Cc: Theodore Ts'o <tytso(a)mit.edu> Cc: Trond Myklebust <trond.myklebust(a)hammerspace.com> Cc: Vladimir Davydov <vdavydov.dev(a)gmail.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Wei Yang <richard.weiyang(a)gmail.com> Cc: Xiongchun Duan <duanxiongchun(a)bytedance.com> Cc: Yang Shi <shy828301(a)gmail.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- mm/memcontrol.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 635cb8b65b86..65accea3a799 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -5763,8 +5763,7 @@ static struct mem_cgroup *mem_cgroup_alloc(void) return ERR_PTR(error); memcg->id.id = idr_alloc(&mem_cgroup_idr, NULL, - 1, MEM_CGROUP_ID_MAX, - GFP_KERNEL); + 1, MEM_CGROUP_ID_MAX + 1, GFP_KERNEL); if (memcg->id.id < 0) { error = memcg->id.id; goto fail; -- 2.17.1

2 1

[PATCH openEuler-22.09 0/8] enable bonding XDP
by Zhengchao Shao 25 Jul '23

25 Jul '23

Currently, the 10G 82599 network adapter is used for the test on the Intel(R) Xeon(R) Gold 6138 CPU @ 2.00 GHz platform. The peer end uses the pktgen of the dpdk to send 64 bytes packets. The test performance is as follows: -----------------------| CPU |--| rxpck/s |--| txpck/s |---- without patch (1 dev): XDP_DROP: 1.00% 14.69Mpps XDP_TX: 2.20% 10.70Mpps 10.70Mpps XDP_DROP (RSS): 1.90% 10.13Mpps XDP_TX (RSS): 6.20% 10.09Mpps 10.09Mpps ----------------------- with patch, bond (1 dev): XDP_DROP: 1.00% 14.69Mpps XDP_TX: 2.10% 6.84Mpps 6.84Mpps XDP_DROP (RSS): 2.60% 12.57pps XDP_TX (RSS): 11.50% 12.49Mpps 12.49Mpps ----------------------- with patch, bond (2 devs): XDP_DROP: 1.90% 29.36Mpps XDP_TX: 3.90% 11.83Mpps 11.83Mpps XDP_DROP (RSS): 5.40% 25.00Mpps XDP_TX (RSS): 20.30% 19.10Mpps 19.10Mpps -------------------------------------------------------------- Jonathan Toppins (1): bonding: fix NULL deref in bond_rr_gen_slave_id Jussi Maki (5): net, bonding: Refactor bond_xmit_hash for use with xdp_buff net, core: Add support for XDP redirection to slave device net, bonding: Add XDP support to the bonding driver bonding: Fix negative jump label count on nested bonding net: bonding: Use per-cpu rr_tx_counter Moshe Tal (1): bonding: Fix extraction of ports from the packet headers Zhengchao Shao (1): net: fix kabi change in struct net_device_ops drivers/net/bonding/bond_main.c | 457 ++++++++++++++++++++++++++++---- include/linux/filter.h | 13 +- include/linux/netdevice.h | 7 +- include/net/bonding.h | 3 +- net/core/dev.c | 13 +- net/core/filter.c | 25 ++ 6 files changed, 456 insertions(+), 62 deletions(-) -- 2.34.1

2 9

[PATCH OLK-5.10] net/sched: sch_qfq: account for stab overhead in qfq_enqueue
by Zhengchao Shao 25 Jul '23

25 Jul '23

From: Pedro Tammela <pctammela(a)mojatatu.com> mainline inclusion from mainline-v6.5-rc2 commit 3e337087c3b5805fe0b8a46ba622a962880b5d64 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7N3MX CVE: CVE-2023-3611 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- Lion says: ------- In the QFQ scheduler a similar issue to CVE-2023-31436 persists. Consider the following code in net/sched/sch_qfq.c: static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free) { unsigned int len = qdisc_pkt_len(skb), gso_segs; // ... if (unlikely(cl->agg->lmax < len)) { pr_debug("qfq: increasing maxpkt from %u to %u for class %u", cl->agg->lmax, len, cl->common.classid); err = qfq_change_agg(sch, cl, cl->agg->class_weight, len); if (err) { cl->qstats.drops++; return qdisc_drop(skb, sch, to_free); } // ... } Similarly to CVE-2023-31436, "lmax" is increased without any bounds checks according to the packet length "len". Usually this would not impose a problem because packet sizes are naturally limited. This is however not the actual packet length, rather the "qdisc_pkt_len(skb)" which might apply size transformations according to "struct qdisc_size_table" as created by "qdisc_get_stab()" in net/sched/sch_api.c if the TCA_STAB option was set when modifying the qdisc. A user may choose virtually any size using such a table. As a result the same issue as in CVE-2023-31436 can occur, allowing heap out-of-bounds read / writes in the kmalloc-8192 cache. ------- We can create the issue with the following commands: tc qdisc add dev $DEV root handle 1: stab mtu 2048 tsize 512 mpu 0 \ overhead 999999999 linklayer ethernet qfq tc class add dev $DEV parent 1: classid 1:1 htb rate 6mbit burst 15k tc filter add dev $DEV parent 1: matchall classid 1:1 ping -I $DEV 1.1.1.2 This is caused by incorrectly assuming that qdisc_pkt_len() returns a length within the QFQ_MIN_LMAX < len < QFQ_MAX_LMAX. Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost") Reported-by: Lion <nnamrec(a)gmail.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: Pedro Tammela <pctammela(a)mojatatu.com> Reviewed-by: Simon Horman <simon.horman(a)corigine.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/sched/sch_qfq.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/sch_qfq.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c index cad7deacf60a..1aa9e71a1d76 100644 --- a/net/sched/sch_qfq.c +++ b/net/sched/sch_qfq.c @@ -113,6 +113,7 @@ #define QFQ_MTU_SHIFT 16 /* to support TSO/GSO */ #define QFQ_MIN_LMAX 512 /* see qfq_slot_insert */ +#define QFQ_MAX_LMAX (1UL << QFQ_MTU_SHIFT) #define QFQ_MAX_AGG_CLASSES 8 /* max num classes per aggregate allowed */ @@ -375,8 +376,13 @@ static int qfq_change_agg(struct Qdisc *sch, struct qfq_class *cl, u32 weight, u32 lmax) { struct qfq_sched *q = qdisc_priv(sch); - struct qfq_aggregate *new_agg = qfq_find_agg(q, lmax, weight); + struct qfq_aggregate *new_agg; + /* 'lmax' can range from [QFQ_MIN_LMAX, pktlen + stab overhead] */ + if (lmax > QFQ_MAX_LMAX) + return -EINVAL; + + new_agg = qfq_find_agg(q, lmax, weight); if (new_agg == NULL) { /* create new aggregate */ new_agg = kzalloc(sizeof(*new_agg), GFP_ATOMIC); if (new_agg == NULL) -- 2.34.1

2 1

[PATCH] arm64/mpam: fix missing kfree domain's ctrl_val arrray
by Jialin Zhang 25 Jul '23

25 Jul '23

From: Wang ShaoBo <bobo.shaobowang(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187154, https://gitee.com/openeuler/kernel/issues/I7M52S CVE: NA -------------------------------- Fix mpam memleak issue found by kmemleak: unreferenced object 0xffff204000d1d000 (size 128): comm "cpuhp/24", pid 132, jiffies 4294896121 (age 146328.256s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000dd76fed3>] __kmalloc+0x478/0x664 [<00000000e2fa4b32>] mpam_resctrl_setup_domain+0x290/0x5d0 [<0000000088adc589>] mpam_resctrl_cpu_online+0x14c/0x1d0 [<00000000b223bfaa>] mpam_cpu_online+0x1c8/0x2e4 [<000000004438534a>] cpuhp_invoke_callback+0x1f4/0x11b0 [<0000000049ede841>] cpuhp_thread_fun+0x2b8/0x510 [<000000000d731c73>] smpboot_thread_fn+0x260/0x5a0 [<0000000093c61bad>] kthread+0x27c/0x350 [<00000000379f0572>] ret_from_fork+0x10/0x18 There are two cases causing memleak: 1. When offline all cpus of a domain in mpam_resctrl_cpu_offline(), we only free domain's space but not the space of ctrl_val array. 2. When allocating ctrl_val array failed in mpam_resctrl_setup_domain(), the space of ctrl_val array may not be freed. Fixes: 88371f8b4c90 ("arm64/mpam: resctrl: Handle cpuhp and resctrl_dom allocation") Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> Reviewed-by: liaoyu <liaoyu15(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_setup.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/mpam/mpam_setup.c b/arch/arm64/kernel/mpam/mpam_setup.c index f32ece505c78..a174ba62ba4e 100644 --- a/arch/arm64/kernel/mpam/mpam_setup.c +++ b/arch/arm64/kernel/mpam/mpam_setup.c @@ -65,7 +65,7 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, struct mpam_component *comp_iter, *comp; u32 num_partid; u32 **ctrlval_ptr; - enum resctrl_ctrl_type type; + enum resctrl_ctrl_type type, type_free; struct list_head *tmp; num_partid = mpam_sysprops_num_partid(); @@ -96,6 +96,12 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, *ctrlval_ptr = kmalloc_array(num_partid, sizeof(**ctrlval_ptr), GFP_KERNEL); if (!*ctrlval_ptr) { + for_each_ctrl_type(type_free) { + if (type_free == type) + break; + ctrlval_ptr = &dom->resctrl_dom.ctrl_val[type_free]; + kfree(*ctrlval_ptr); + } kfree(dom); return -ENOMEM; } @@ -156,6 +162,8 @@ int mpam_resctrl_cpu_offline(unsigned int cpu) struct rdt_domain *d; struct mpam_resctrl_res *res; struct mpam_resctrl_dom *dom; + u32 **ctrlval_ptr; + enum resctrl_ctrl_type type; for_each_supported_resctrl_exports(res) { d = resctrl_get_domain_from_cpu(cpu, &res->resctrl_res); @@ -171,6 +179,11 @@ int mpam_resctrl_cpu_offline(unsigned int cpu) list_del(&d->list); dom = container_of(d, struct mpam_resctrl_dom, resctrl_dom); + for_each_ctrl_type(type) { + ctrlval_ptr = &dom->resctrl_dom.ctrl_val[type]; + kfree(*ctrlval_ptr); + } + kfree(dom); } -- 2.25.1

1 0

[PATCH openEuler-23.09 0/7] sched: Support dynamic affinity in scheduler
by Hui Tang 25 Jul '23

25 Jul '23

This pathchset support dynamic affinity feature. Dynamic affinity set preferred cpus for task. When the utilization of taskgroup's preferred cpu is low, task only run in cpus preferred to enhance cpu resource locality and reduce interference between task cgroups, otherwise task can burst preferred cpus to use external cpu within cpus allowed. Hui Tang (1): sched: Add cmdline for dynamic affinity tanghui (6): sched: Introduce dynamic affinity for cfs scheduler cpuset: Introduce new interface for scheduler dynamic affinity sched: Adjust wakeup cpu range according CPU util dynamicly sched: Adjust cpu allowed in load balance dynamicly sched: Add statistics for scheduler dynamic affinity config: enable CONFIG_QOS_SCHED_DYNAMIC_AFFINITY by default arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + fs/proc/base.c | 73 +++++++++++ include/linux/sched.h | 22 ++++ include/linux/sched/sysctl.h | 3 + init/Kconfig | 10 ++ init/init_task.c | 3 + kernel/cgroup/cpuset.c | 153 ++++++++++++++++++++++- kernel/fork.c | 16 +++ kernel/sched/core.c | 98 +++++++++++++++ kernel/sched/debug.c | 6 + kernel/sched/fair.c | 162 +++++++++++++++++++++++++ kernel/sysctl.c | 11 ++ 13 files changed, 558 insertions(+), 1 deletion(-) -- 2.17.1

2 8

[PATCH OLK-5.10 0/6] Sync patches for sharepool
by Zhang Zekun 25 Jul '23

25 Jul '23

Sync patches for sharepool - Fix some bugs in code - Add a new feature for sharepool Chen Jun (1): mm/sharepool: Add mg_sp_alloc_nodemask Xu Qiang (5): mm/sharepool: Change data type of members in sp_spa_stat to atomic64. mm/sharepool: Delete SPG_FLAG_NON_DVPP. mm/sharepool: Add sp_group_sem protection. mm/sharepool: Delete total_num and total_size in sp_spa_stat mm/sharepool: Delete unused flag in sp_group. mm/share_pool.c | 222 ++++++++++++++++++++++++------------------------ 1 file changed, 113 insertions(+), 109 deletions(-) -- 2.17.1

2 7

[PATCH openEuler-23.09 1/7] sched: Introduce dynamic affinity for cfs scheduler
by Hui Tang 25 Jul '23

25 Jul '23

From: tanghui <tanghui20(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I7NS6Y -------------------------------- Dynamic affinity set preferred cpus for task. When the utilization of taskgroup's preferred cpu is low, task only run in cpus preferred to enhance cpu resource locality and reduce interference between task cgroups, otherwise task can burst preferred cpus to use external cpu within cpus allowed. Signed-off-by: tanghui <tanghui20(a)huawei.com> --- init/Kconfig | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/init/Kconfig b/init/Kconfig index 32c24950c4ce..7a3299a632e0 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -1013,6 +1013,16 @@ config RT_GROUP_SCHED endif #CGROUP_SCHED +config QOS_SCHED_DYNAMIC_AFFINITY + bool "qos dynamic affinity" + depends on CPUSETS + default n + help + This feature lets you allocate preferred cpus to taskgroup. If enabled, + it will make taskgroup only to use preferred cpus when cpu utilization + of taskgroup is below threshold setted, otherwise make taskgroup to use + cpus allowed. + config SCHED_MM_CID def_bool y depends on SMP && RSEQ -- 2.17.1

4 9

[PATCH openEuler-23.09 0/8] arm64: Add framework to turn an IPI as NMI
by Ruan Jinjie 25 Jul '23

25 Jul '23

arm64: Add framework to turn an IPI as NMI Sumit Garg (7): arm64: Add framework to turn IPI as NMI irqchip/gic-v3: Enable support for SGIs to act as NMIs arm64: smp: Assign and setup an IPI as NMI nmi: backtrace: Allow runtime arch specific override arm64: ipi_nmi: Add support for NMI backtrace kgdb: Expose default CPUs roundup fallback mechanism arm64: kgdb: Roundup cpus using IPI as NMI Xiongfeng Wang (1): arm64: ipi_nmi: fix compile error when CONFIG_KGDB is disabled arch/arm/include/asm/irq.h | 2 +- arch/arm/kernel/smp.c | 3 +- arch/arm64/include/asm/irq.h | 6 +++ arch/arm64/include/asm/nmi.h | 17 +++++++ arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/ipi_nmi.c | 85 ++++++++++++++++++++++++++++++++ arch/arm64/kernel/kgdb.c | 18 +++++++ arch/arm64/kernel/smp.c | 8 +++ arch/mips/include/asm/irq.h | 2 +- arch/mips/kernel/process.c | 3 +- arch/powerpc/include/asm/nmi.h | 2 +- arch/powerpc/kernel/stacktrace.c | 3 +- arch/sparc/include/asm/irq_64.h | 2 +- arch/sparc/kernel/process_64.c | 4 +- arch/x86/include/asm/irq.h | 2 +- arch/x86/kernel/apic/hw_nmi.c | 3 +- drivers/irqchip/irq-gic-v3.c | 29 ++++++++--- include/linux/kgdb.h | 12 +++++ include/linux/nmi.h | 12 ++--- kernel/debug/debug_core.c | 8 ++- 20 files changed, 195 insertions(+), 28 deletions(-) create mode 100644 arch/arm64/include/asm/nmi.h create mode 100644 arch/arm64/kernel/ipi_nmi.c -- 2.34.1

2 9

[PATCH openEuler-1.0-LTS] net/sched: sch_qfq: account for stab overhead in qfq_enqueue
by Zhengchao Shao 25 Jul '23

25 Jul '23

From: Pedro Tammela <pctammela(a)mojatatu.com> mainline inclusion from mainline-v6.5-rc2 commit 3e337087c3b5805fe0b8a46ba622a962880b5d64 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I7N3MX CVE: CVE-2023-3611 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- Lion says: ------- In the QFQ scheduler a similar issue to CVE-2023-31436 persists. Consider the following code in net/sched/sch_qfq.c: static int qfq_enqueue(struct sk_buff *skb, struct Qdisc *sch, struct sk_buff **to_free) { unsigned int len = qdisc_pkt_len(skb), gso_segs; // ... if (unlikely(cl->agg->lmax < len)) { pr_debug("qfq: increasing maxpkt from %u to %u for class %u", cl->agg->lmax, len, cl->common.classid); err = qfq_change_agg(sch, cl, cl->agg->class_weight, len); if (err) { cl->qstats.drops++; return qdisc_drop(skb, sch, to_free); } // ... } Similarly to CVE-2023-31436, "lmax" is increased without any bounds checks according to the packet length "len". Usually this would not impose a problem because packet sizes are naturally limited. This is however not the actual packet length, rather the "qdisc_pkt_len(skb)" which might apply size transformations according to "struct qdisc_size_table" as created by "qdisc_get_stab()" in net/sched/sch_api.c if the TCA_STAB option was set when modifying the qdisc. A user may choose virtually any size using such a table. As a result the same issue as in CVE-2023-31436 can occur, allowing heap out-of-bounds read / writes in the kmalloc-8192 cache. ------- We can create the issue with the following commands: tc qdisc add dev $DEV root handle 1: stab mtu 2048 tsize 512 mpu 0 \ overhead 999999999 linklayer ethernet qfq tc class add dev $DEV parent 1: classid 1:1 htb rate 6mbit burst 15k tc filter add dev $DEV parent 1: matchall classid 1:1 ping -I $DEV 1.1.1.2 This is caused by incorrectly assuming that qdisc_pkt_len() returns a length within the QFQ_MIN_LMAX < len < QFQ_MAX_LMAX. Fixes: 462dbc9101ac ("pkt_sched: QFQ Plus: fair-queueing service at DRR cost") Reported-by: Lion <nnamrec(a)gmail.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Jamal Hadi Salim <jhs(a)mojatatu.com> Signed-off-by: Pedro Tammela <pctammela(a)mojatatu.com> Reviewed-by: Simon Horman <simon.horman(a)corigine.com> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com> Conflicts: net/sched/sch_qfq.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/sched/sch_qfq.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c index 0326793b700b..a08579a5f75e 100644 --- a/net/sched/sch_qfq.c +++ b/net/sched/sch_qfq.c @@ -116,6 +116,7 @@ #define QFQ_MTU_SHIFT 16 /* to support TSO/GSO */ #define QFQ_MIN_LMAX 512 /* see qfq_slot_insert */ +#define QFQ_MAX_LMAX (1UL << QFQ_MTU_SHIFT) #define QFQ_MAX_AGG_CLASSES 8 /* max num classes per aggregate allowed */ @@ -387,8 +388,13 @@ static int qfq_change_agg(struct Qdisc *sch, struct qfq_class *cl, u32 weight, u32 lmax) { struct qfq_sched *q = qdisc_priv(sch); - struct qfq_aggregate *new_agg = qfq_find_agg(q, lmax, weight); + struct qfq_aggregate *new_agg; + /* 'lmax' can range from [QFQ_MIN_LMAX, pktlen + stab overhead] */ + if (lmax > QFQ_MAX_LMAX) + return -EINVAL; + + new_agg = qfq_find_agg(q, lmax, weight); if (new_agg == NULL) { /* create new aggregate */ new_agg = kzalloc(sizeof(*new_agg), GFP_ATOMIC); if (new_agg == NULL) -- 2.34.1

2 1

[PATCH OLK-5.10] arm64/mpam: fix missing kfree domain's ctrl_val arrray
by Jialin Zhang 25 Jul '23

25 Jul '23

From: Wang ShaoBo <bobo.shaobowang(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187154, https://gitee.com/openeuler/kernel/issues/I7M52S CVE: NA -------------------------------- Fix mpam memleak issue found by kmemleak: unreferenced object 0xffff204000d1d000 (size 128): comm "cpuhp/24", pid 132, jiffies 4294896121 (age 146328.256s) hex dump (first 32 bytes): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<00000000dd76fed3>] __kmalloc+0x478/0x664 [<00000000e2fa4b32>] mpam_resctrl_setup_domain+0x290/0x5d0 [<0000000088adc589>] mpam_resctrl_cpu_online+0x14c/0x1d0 [<00000000b223bfaa>] mpam_cpu_online+0x1c8/0x2e4 [<000000004438534a>] cpuhp_invoke_callback+0x1f4/0x11b0 [<0000000049ede841>] cpuhp_thread_fun+0x2b8/0x510 [<000000000d731c73>] smpboot_thread_fn+0x260/0x5a0 [<0000000093c61bad>] kthread+0x27c/0x350 [<00000000379f0572>] ret_from_fork+0x10/0x18 There are two cases causing memleak: 1. When offline all cpus of a domain in mpam_resctrl_cpu_offline(), we only free domain's space but not the space of ctrl_val array. 2. When allocating ctrl_val array failed in mpam_resctrl_setup_domain(), the space of ctrl_val array may not be freed. Fixes: e1ff5fac8ffc ("arm64/mpam: resctrl: Handle cpuhp and resctrl_dom allocation") Signed-off-by: Wang ShaoBo <bobo.shaobowang(a)huawei.com> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- arch/arm64/kernel/mpam/mpam_setup.c | 15 ++++++++++++++- 1 file changed, 14 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kernel/mpam/mpam_setup.c b/arch/arm64/kernel/mpam/mpam_setup.c index cef66a5e6f2f..4d0ec0052133 100644 --- a/arch/arm64/kernel/mpam/mpam_setup.c +++ b/arch/arm64/kernel/mpam/mpam_setup.c @@ -65,7 +65,7 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, struct mpam_component *comp_iter, *comp; u32 num_partid; u32 **ctrlval_ptr; - enum resctrl_ctrl_type type; + enum resctrl_ctrl_type type, type_free; struct list_head *tmp; num_partid = mpam_sysprops_num_partid(); @@ -96,6 +96,12 @@ static int mpam_resctrl_setup_domain(unsigned int cpu, *ctrlval_ptr = kmalloc_array(num_partid, sizeof(**ctrlval_ptr), GFP_KERNEL); if (!*ctrlval_ptr) { + for_each_ctrl_type(type_free) { + if (type_free == type) + break; + ctrlval_ptr = &dom->resctrl_dom.ctrl_val[type_free]; + kfree(*ctrlval_ptr); + } kfree(dom); return -ENOMEM; } @@ -156,6 +162,8 @@ int mpam_resctrl_cpu_offline(unsigned int cpu) struct rdt_domain *d; struct mpam_resctrl_res *res; struct mpam_resctrl_dom *dom; + u32 **ctrlval_ptr; + enum resctrl_ctrl_type type; for_each_supported_resctrl_exports(res) { d = resctrl_get_domain_from_cpu(cpu, &res->resctrl_res); @@ -171,6 +179,11 @@ int mpam_resctrl_cpu_offline(unsigned int cpu) list_del(&d->list); dom = container_of(d, struct mpam_resctrl_dom, resctrl_dom); + for_each_ctrl_type(type) { + ctrlval_ptr = &dom->resctrl_dom.ctrl_val[type]; + kfree(*ctrlval_ptr); + } + kfree(dom); res->resctrl_res.dom_num--; -- 2.25.1

2 1

Re: [RFC 1/1] Optimizing the rand function on arm64 platforms
by tiantao (H) 24 Jul '23

24 Jul '23

在 2023/7/24 12:49, Xi Ruoyao 写道: > On Mon, 2023-07-24 at 04:01 +0000, tiantao (H) wrote: >> Thanks for the reply. >> >> Using FEAT_RNG can be a very big performance boost > Hmm, I think this may be untrue. I've attempted using inline asm to > invoke x86 rdrand instead of rand() for some competitive programming > code, but the result is *slower*. Thanks for the reply, I tested the performance on an ARM64 server very well, especially in multithreaded scenarios > The spec of this instruction [1] even says: > > If the instruction cannot return a genuine random number in a reasonable > period of time, PSTATE.NZCV is set to 0b0100 and the data value returned > is 0. > > So at least for some implementations the "reasonable period of time" may > be long. And we need to check PSTATE.NZCV and loop (or fallback to a > software-based PRNG), then it will be even slower... > > [1]:https://developer.arm.com/documentation/ddi0601/2023-06/AArch64-Register… > > Generally a hardware RNG is for cryptography use, so the design of HWRNG > is often focused on security, instead of speed. Maybe it is fast on > *your* implementation, and it may never fail on *your* implementation, > but other implementations may do things differently. > >> any suggestions for applying the FEAT_RNG feature to glibc? > The suggestion is "don't do that". > > A feature is not necessarily useful for Glibc only because it exists. >

1 0

[PATCH OLK-5.10 v3 0/8] enable bonding XDP
by Zhengchao Shao 24 Jul '23

24 Jul '23

Currently, the 10G 82599 network adapter is used for the test on the Intel(R) Xeon(R) Gold 6138 CPU @ 2.00 GHz platform. The peer end uses the pktgen of the dpdk to send 64 bytes packets. The test performance is as follows: -----------------------| CPU |--| rxpck/s |--| txpck/s |---- without patch (1 dev): XDP_DROP: 1.00% 14.69Mpps XDP_TX: 2.20% 10.70Mpps 10.70Mpps XDP_DROP (RSS): 1.90% 10.13Mpps XDP_TX (RSS): 6.20% 10.09Mpps 10.09Mpps ----------------------- with patch, bond (1 dev): XDP_DROP: 1.00% 14.69Mpps XDP_TX: 2.10% 6.84Mpps 6.84Mpps XDP_DROP (RSS): 2.00% 10.20pps XDP_TX (RSS): 8.40% 10.17Mpps 10.17Mpps ----------------------- with patch, bond (2 devs): XDP_DROP: 1.90% 29.3Mpps XDP_TX: 4.20% 11.31Mpps 11.31Mpps XDP_DROP (RSS): 3.90% 20.40Mpps XDP_TX (RSS): 16.80% 18.55Mpps 18.55Mpps -------------------------------------------------------------- Jonathan Toppins (1): bonding: fix NULL deref in bond_rr_gen_slave_id Jussi Maki (5): net, bonding: Refactor bond_xmit_hash for use with xdp_buff net, core: Add support for XDP redirection to slave device net, bonding: Add XDP support to the bonding driver bonding: Fix negative jump label count on nested bonding net: bonding: Use per-cpu rr_tx_counter Moshe Tal (1): bonding: Fix extraction of ports from the packet headers Zhengchao Shao (1): net: fix kabi change in struct net_device_ops drivers/net/bonding/bond_main.c | 457 ++++++++++++++++++++++++++++---- include/linux/filter.h | 13 +- include/linux/netdevice.h | 7 +- include/net/bonding.h | 3 +- net/core/dev.c | 13 +- net/core/filter.c | 25 ++ 6 files changed, 456 insertions(+), 62 deletions(-) -- 2.34.1

2 9

[PATCH OLK-5.10 0/5] enable bonding XDP
by Zhengchao Shao 24 Jul '23

24 Jul '23

Currently, the 10G 82599 network adapter is used for the test on the Intel(R) Xeon(R) Gold 6138 CPU @ 2.00 GHz platform. The peer end uses the pktgen of the dpdk to send 64 bytes packets. The test performance is as follows: -----------------------| CPU |--| rxpck/s |--| txpck/s |---- without patch (1 dev): XDP_DROP: 1.00% 14.69Mpps XDP_TX: 2.20% 10.70Mpps 10.70Mpps XDP_DROP (RSS): 1.90% 10.13Mpps XDP_TX (RSS): 6.20% 10.09Mpps 10.09Mpps ----------------------- with patch, bond (1 dev): XDP_DROP: 1.00% 14.69Mpps XDP_TX: 2.10% 6.84Mpps 6.84Mpps XDP_DROP (RSS): 2.00% 10.20pps XDP_TX (RSS): 8.40% 10.17Mpps 10.17Mpps ----------------------- with patch, bond (2 devs): XDP_DROP: 1.90% 29.3Mpps XDP_TX: 4.20% 11.31Mpps 11.31Mpps XDP_DROP (RSS): 3.90% 20.40Mpps XDP_TX (RSS): 16.80% 18.55Mpps 18.55Mpps -------------------------------------------------------------- Jussi Maki (5): net, bonding: Refactor bond_xmit_hash for use with xdp_buff net, core: Add support for XDP redirection to slave device net, bonding: Add XDP support to the bonding driver bonding: Fix negative jump label count on nested bonding net: bonding: Use per-cpu rr_tx_counter drivers/net/bonding/bond_main.c | 460 ++++++++++++++++++++++++++++---- include/linux/filter.h | 13 +- include/linux/netdevice.h | 6 + include/net/bonding.h | 3 +- net/core/dev.c | 13 +- net/core/filter.c | 25 ++ 6 files changed, 459 insertions(+), 61 deletions(-) -- 2.34.1

1 6

[PATCH OLK-5.10 v2 0/6] enable bonding XDP
by Zhengchao Shao 24 Jul '23

24 Jul '23

Currently, the 10G 82599 network adapter is used for the test on the Intel(R) Xeon(R) Gold 6138 CPU @ 2.00 GHz platform. The peer end uses the pktgen of the dpdk to send 64 bytes packets. The test performance is as follows: -----------------------| CPU |--| rxpck/s |--| txpck/s |---- without patch (1 dev): XDP_DROP: 1.00% 14.69Mpps XDP_TX: 2.20% 10.70Mpps 10.70Mpps XDP_DROP (RSS): 1.90% 10.13Mpps XDP_TX (RSS): 6.20% 10.09Mpps 10.09Mpps ----------------------- with patch, bond (1 dev): XDP_DROP: 1.00% 14.69Mpps XDP_TX: 2.10% 6.84Mpps 6.84Mpps XDP_DROP (RSS): 2.00% 10.20pps XDP_TX (RSS): 8.40% 10.17Mpps 10.17Mpps ----------------------- with patch, bond (2 devs): XDP_DROP: 1.90% 29.3Mpps XDP_TX: 4.20% 11.31Mpps 11.31Mpps XDP_DROP (RSS): 3.90% 20.40Mpps XDP_TX (RSS): 16.80% 18.55Mpps 18.55Mpps -------------------------------------------------------------- Jussi Maki (5): net, bonding: Refactor bond_xmit_hash for use with xdp_buff net, core: Add support for XDP redirection to slave device net, bonding: Add XDP support to the bonding driver bonding: Fix negative jump label count on nested bonding net: bonding: Use per-cpu rr_tx_counter Zhengchao Shao (1): net: fix kabi change in struct net_device_ops drivers/net/bonding/bond_main.c | 460 ++++++++++++++++++++++++++++---- include/linux/filter.h | 13 +- include/linux/netdevice.h | 7 +- include/net/bonding.h | 3 +- net/core/dev.c | 13 +- net/core/filter.c | 25 ++ 6 files changed, 459 insertions(+), 62 deletions(-) -- 2.34.1

2 7

[PATCH OLK-5.10 0/5] enable bonding XDP
by Zhengchao Shao 24 Jul '23

24 Jul '23

Currently, the 10G 82599 network adapter is used for the test on the Intel(R) Xeon(R) Gold 6138 CPU @ 2.00 GHz platform. The peer end uses the pktgen of the dpdk to send 64 bytes packets. The test performance is as follows: -----------------------| CPU |--| rxpck/s |--| txpck/s |---- without patch (1 dev): XDP_DROP: 1.00% 14.69Mpps XDP_TX: 2.20% 10.70Mpps 10.70Mpps XDP_DROP (RSS): 1.90% 10.13Mpps XDP_TX (RSS): 6.20% 10.09Mpps 10.09Mpps ----------------------- with patch, bond (1 dev): XDP_DROP: 1.00% 14.69Mpps XDP_TX: 2.10% 6.84Mpps 6.84Mpps XDP_DROP (RSS): 2.00% 10.20pps XDP_TX (RSS): 8.40% 10.17Mpps 10.17Mpps ----------------------- with patch, bond (2 devs): XDP_DROP: 1.90% 29.3Mpps XDP_TX: 4.20% 11.31Mpps 11.31Mpps XDP_DROP (RSS): 3.90% 20.40Mpps XDP_TX (RSS): 16.80% 18.55Mpps 18.55Mpps -------------------------------------------------------------- Jussi Maki (5): net, bonding: Refactor bond_xmit_hash for use with xdp_buff net, core: Add support for XDP redirection to slave device net, bonding: Add XDP support to the bonding driver bonding: Fix negative jump label count on nested bonding net: bonding: Use per-cpu rr_tx_counter drivers/net/bonding/bond_main.c | 460 ++++++++++++++++++++++++++++---- include/linux/filter.h | 13 +- include/linux/netdevice.h | 6 + include/net/bonding.h | 3 +- net/core/dev.c | 13 +- net/core/filter.c | 25 ++ 6 files changed, 459 insertions(+), 61 deletions(-) -- 2.34.1

2 6

[PATCH openEuler-22.03-LTS 0/2] Fix CDM node problems
by Zhang Zekun 24 Jul '23

24 Jul '23

Fix problem introduced by feature CDM node, which might alloc memory from other no cdm nodes. Zhou Guanghui (2): mm: fix ignore cpuset enforcement mm: fix alloc CDM node memory for MPOL_BIND mm/page_alloc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) -- 2.17.1

2 3

答复: [RFC 1/1] Optimizing the rand function on arm64 platforms
by tiantao (H) 24 Jul '23

24 Jul '23

Thanks for the reply. Using FEAT_RNG can be a very big performance boost, any suggestions for applying the FEAT_RNG feature to glibc? -----邮件原件----- 发件人: Xi Ruoyao <xry111(a)xry111.site> 发送时间: 2023年7月24日 11:50 收件人: tiantao (H) <tiantao6(a)hisilicon.com>; libc-alpha(a)sourceware.org 抄送: kernel(a)openeuler.org 主题: Re: [RFC 1/1] Optimizing the rand function on arm64 platforms On Mon, 2023-07-24 at 10:32 +0800, Tian Tao via Libc-alpha wrote: > Armv8.5 adds the FEAT_RNG feature so that true random numbers can be > obtained from the cpu. This optimization is therefore proposed for the > arm64 platform. NAK. Glibc documentation explicitly says: You can obtain repeatable sequences of numbers on a particular machine type by specifying the same initial seed value for the random number generator. This rand() implementation obviously does not satisfy this requirement. > > Signed-off-by: Tian Tao <tiantao6(a)hisilicon.com> > --- > stdlib/rand.c | 32 ++++++++++++++++++++++++++++++++ > 1 file changed, 32 insertions(+) > > diff --git a/stdlib/rand.c b/stdlib/rand.c index > c250c065e4..f199dbd65f 100644 > --- a/stdlib/rand.c > +++ b/stdlib/rand.c > @@ -19,10 +19,42 @@ > > #undef rand > > +#ifdef __aarch64__ > +// A global variable to indicate whether rndr instruction is > supported > +static int rndr_supported = 0; > +// A function prototype to check rndr support static void > +check_rndr_support (void) __attribute__ ((constructor)); #endif > > /* Return a random integer between 0 and RAND_MAX. */ > int > rand (void) > { > + // Use armv8.5 rndr instruction if supported #ifdef __aarch64__ > + if (rndr_supported) { > + unsigned int r; > + asm volatile("mrs %0, s3_3_c2_c4_0" : "=r" (r)); > + // Discard the least random bit > + r >>=1; > + return (int) r; > + } > +#endif > return (int) __random (); > } > + > +#ifdef __aarch64__ > +// A function to check rndr support and set the global variable > accordingly > +static void > +check_rndr_support (void) > +{ > + unsigned long isar0; > + // Read the ID_AA64ISAR0_EL1 register to check the rndr feature > + asm volatile("mrs %0, id_aa64isar0_el1" : "=r" (isar0)); > + // Check the bits [63:60] for the rndr feature > + if ((isar0 >> 60) & 0xf) { > + // Set the global variable to indicate rndr support > + rndr_supported = 1; > + } > +} > +#endif -- Xi Ruoyao <xry111(a)xry111.site> School of Aerospace Science and Technology, Xidian University

1 0

Re: EAS适配大数据环境验证
by Ruan Jinjie 24 Jul '23

24 Jul '23

关键线程demo 大数据测试 On 2023/7/20 10:51, Ruan Jinjie wrote: > bpftrace测调度延迟脚本 > > On 2023/7/18 12:06, Ruan Jinjie wrote: >> >> >> On 2023/7/17 10:47, Ruan Jinjie wrote: >>> >>> >>> On 2023/7/15 18:18, Ruan Jinjie wrote: >>>> >>>> >>>> On 2023/7/15 10:36, Ruan Jinjie wrote: >>>>> >>>>> >>>>> On 2023/7/14 13:18, Ruan Jinjie wrote: >>>>>> >>>>>> >>>>>> On 2023/7/13 13:03, Ruan Jinjie wrote: >>>>>>> 潮汐适配SP2 >>>>>>> >>>>>>> On 2023/7/13 10:58, Ruan Jinjie wrote: >>>>>>>> >>>>>>>> >>>>>>>> On 2023/7/12 17:23, Ruan Jinjie wrote: >>>>>>>>> >>>>>>>>> >>>>>>>>> On 2023/7/5 17:24, Ruan Jinjie wrote: >>>>>>>>>> >>>>>>>>>> >>>>>>>>>> On 2023/7/5 17:19, Ruan Jinjie wrote: >>>>>>>>>>> >>>>>>>>>>> >>>>>>>>>>> On 2023/7/4 20:34, Ruan Jinjie wrote: >>>>>>>>>>>> >>>>>>>>>>>> >>>>>>>>>>>> On 2023/7/4 13:04, Ruan Jinjie wrote: >>>>>>>>>>>>> >>>>>>>>>>>>> >>>>>>>>>>>>> On 2023/6/3 10:52, Ruan Jinjie wrote:

1 0

[RFC 1/1] Optimizing the rand function on arm64 platforms
by Tian Tao 24 Jul '23

24 Jul '23

Armv8.5 adds the FEAT_RNG feature so that true random numbers can be obtained from the cpu. This optimization is therefore proposed for the arm64 platform. Signed-off-by: Tian Tao <tiantao6(a)hisilicon.com> --- stdlib/rand.c | 32 ++++++++++++++++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/stdlib/rand.c b/stdlib/rand.c index c250c065e4..f199dbd65f 100644 --- a/stdlib/rand.c +++ b/stdlib/rand.c @@ -19,10 +19,42 @@ #undef rand +#ifdef __aarch64__ +// A global variable to indicate whether rndr instruction is supported +static int rndr_supported = 0; +// A function prototype to check rndr support +static void check_rndr_support (void) __attribute__ ((constructor)); +#endif /* Return a random integer between 0 and RAND_MAX. */ int rand (void) { + // Use armv8.5 rndr instruction if supported +#ifdef __aarch64__ + if (rndr_supported) { + unsigned int r; + asm volatile("mrs %0, s3_3_c2_c4_0" : "=r" (r)); + // Discard the least random bit + r >>=1; + return (int) r; + } +#endif return (int) __random (); } + +#ifdef __aarch64__ +// A function to check rndr support and set the global variable accordingly +static void +check_rndr_support (void) +{ + unsigned long isar0; + // Read the ID_AA64ISAR0_EL1 register to check the rndr feature + asm volatile("mrs %0, id_aa64isar0_el1" : "=r" (isar0)); + // Check the bits [63:60] for the rndr feature + if ((isar0 >> 60) & 0xf) { + // Set the global variable to indicate rndr support + rndr_supported = 1; + } +} +#endif -- 2.33.0

1 0

【会议通知】 openEuler-23.09开发讨论
by Meeting Book 21 Jul '23

21 Jul '23

会议主题 Subject openEuler-23.09开发讨论会议时间 Time 2023-07-24 10:30-12:00 (UTC+08:00)Beijing 会议地点 Location Welink视频会议 Welink Video Meeting 加入会议(External)<https://meeting.huaweicloud.com/welink/#/j/97708050/7CrJkkOXwkz174GgyAwFZLc…> 会议ID Meeting ID 97708050 Guest密码 Voice access code 890236 召集人 Convener 郑增凯提示 Tips 请点击会议链接加入会议,首次使用请在入会界面根据提示下载并安装客户端后输入ID入会。 Click the meeting link to join the meeting. For the first time, download and install the client as prompted and enter the ID to join the meeting

1 0

[PATCH openEuler-23.09 0/8] arm64: Add framework to turn an IPI as NMI
by Ruan Jinjie 21 Jul '23

21 Jul '23

arm64: Add framework to turn an IPI as NMI Sumit Garg (7): arm64: Add framework to turn IPI as NMI irqchip/gic-v3: Enable support for SGIs to act as NMIs arm64: smp: Assign and setup an IPI as NMI nmi: backtrace: Allow runtime arch specific override arm64: ipi_nmi: Add support for NMI backtrace kgdb: Expose default CPUs roundup fallback mechanism arm64: kgdb: Roundup cpus using IPI as NMI Xiongfeng Wang (1): arm64: ipi_nmi: fix compile error when CONFIG_KGDB is disabled arch/arm/include/asm/irq.h | 2 +- arch/arm/kernel/smp.c | 3 +- arch/arm64/include/asm/irq.h | 6 +++ arch/arm64/include/asm/nmi.h | 17 +++++++ arch/arm64/kernel/Makefile | 2 +- arch/arm64/kernel/ipi_nmi.c | 85 ++++++++++++++++++++++++++++++++ arch/arm64/kernel/kgdb.c | 18 +++++++ arch/arm64/kernel/smp.c | 8 +++ arch/mips/include/asm/irq.h | 2 +- arch/mips/kernel/process.c | 3 +- arch/powerpc/include/asm/nmi.h | 2 +- arch/powerpc/kernel/stacktrace.c | 3 +- arch/sparc/include/asm/irq_64.h | 2 +- arch/sparc/kernel/process_64.c | 4 +- arch/x86/include/asm/irq.h | 2 +- arch/x86/kernel/apic/hw_nmi.c | 3 +- drivers/irqchip/irq-gic-v3.c | 29 ++++++++--- include/linux/kgdb.h | 12 +++++ include/linux/nmi.h | 12 ++--- kernel/debug/debug_core.c | 8 ++- 20 files changed, 195 insertions(+), 28 deletions(-) create mode 100644 arch/arm64/include/asm/nmi.h create mode 100644 arch/arm64/kernel/ipi_nmi.c -- 2.34.1

2 9

[PATCH OLK-5.10] ipv6: Fix an uninit variable access bug in __ip6_make_skb()
by Wang Yufen 21 Jul '23

21 Jul '23

From: Ziyang Xuan <william.xuanziyang(a)huawei.com> stable inclusion from stable-v5.10.178 commit 605b056d63302ae84eb136e88d4df49124bd5e0d category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I71Z4N Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit ea30388baebcce37fd594d425a65037ca35e59e8 ] Syzbot reported a bug as following: ===================================================== BUG: KMSAN: uninit-value in arch_atomic64_inc arch/x86/include/asm/atomic64_64.h:88 [inline] BUG: KMSAN: uninit-value in arch_atomic_long_inc include/linux/atomic/atomic-long.h:161 [inline] BUG: KMSAN: uninit-value in atomic_long_inc include/linux/atomic/atomic-instrumented.h:1429 [inline] BUG: KMSAN: uninit-value in __ip6_make_skb+0x2f37/0x30f0 net/ipv6/ip6_output.c:1956 arch_atomic64_inc arch/x86/include/asm/atomic64_64.h:88 [inline] arch_atomic_long_inc include/linux/atomic/atomic-long.h:161 [inline] atomic_long_inc include/linux/atomic/atomic-instrumented.h:1429 [inline] __ip6_make_skb+0x2f37/0x30f0 net/ipv6/ip6_output.c:1956 ip6_finish_skb include/net/ipv6.h:1122 [inline] ip6_push_pending_frames+0x10e/0x550 net/ipv6/ip6_output.c:1987 rawv6_push_pending_frames+0xb12/0xb90 net/ipv6/raw.c:579 rawv6_sendmsg+0x297e/0x2e60 net/ipv6/raw.c:922 inet_sendmsg+0x101/0x180 net/ipv4/af_inet.c:827 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0xa8e/0xe70 net/socket.c:2476 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2530 __sys_sendmsg net/socket.c:2559 [inline] __do_sys_sendmsg net/socket.c:2568 [inline] __se_sys_sendmsg net/socket.c:2566 [inline] __x64_sys_sendmsg+0x367/0x540 net/socket.c:2566 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Uninit was created at: slab_post_alloc_hook mm/slab.h:766 [inline] slab_alloc_node mm/slub.c:3452 [inline] __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:967 [inline] __kmalloc_node_track_caller+0x114/0x3b0 mm/slab_common.c:988 kmalloc_reserve net/core/skbuff.c:492 [inline] __alloc_skb+0x3af/0x8f0 net/core/skbuff.c:565 alloc_skb include/linux/skbuff.h:1270 [inline] __ip6_append_data+0x51c1/0x6bb0 net/ipv6/ip6_output.c:1684 ip6_append_data+0x411/0x580 net/ipv6/ip6_output.c:1854 rawv6_sendmsg+0x2882/0x2e60 net/ipv6/raw.c:915 inet_sendmsg+0x101/0x180 net/ipv4/af_inet.c:827 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0xa8e/0xe70 net/socket.c:2476 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2530 __sys_sendmsg net/socket.c:2559 [inline] __do_sys_sendmsg net/socket.c:2568 [inline] __se_sys_sendmsg net/socket.c:2566 [inline] __x64_sys_sendmsg+0x367/0x540 net/socket.c:2566 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd It is because icmp6hdr does not in skb linear region under the scenario of SOCK_RAW socket. Access icmp6_hdr(skb)->icmp6_type directly will trigger the uninit variable access bug. Use a local variable icmp6_type to carry the correct value in different scenarios. Fixes: 14878f75abd5 ("[IPV6]: Add ICMPMsgStats MIB (RFC 4293) [rev 2]") Reported-by: syzbot+8257f4dcef79de670baf(a)syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?id=3d605ec1d0a7f2a269a1a6936ac7f2b85975ee… Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wang Hai <wanghai38(a)huawei.com> Signed-off-by: Wang Yufen <wangyufen(a)huawei.com> --- net/ipv6/ip6_output.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c index f30cc72..8be38a1 100644 --- a/net/ipv6/ip6_output.c +++ b/net/ipv6/ip6_output.c @@ -1920,8 +1920,13 @@ struct sk_buff *__ip6_make_skb(struct sock *sk, IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len); if (proto == IPPROTO_ICMPV6) { struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb)); + u8 icmp6_type; - ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type); + if (sk->sk_socket->type == SOCK_RAW && !inet_sk(sk)->hdrincl) + icmp6_type = fl6->fl6_icmp_type; + else + icmp6_type = icmp6_hdr(skb)->icmp6_type; + ICMP6MSGOUT_INC_STATS(net, idev, icmp6_type); ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS); } -- 1.8.3.1

2 1

[PATCH openEuler-22.03-LTS-SP2] block: don't set GD_NEED_PART_SCAN if scan partition failed
by Li Lingfeng 21 Jul '23

21 Jul '23

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from mainline-v6.3-rc6~9^2 commit 3723091ea1884d599cc8b8bf719d6f42e8d4d8b1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7F7J3 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Currently if disk_scan_partitions() failed, GD_NEED_PART_SCAN will still set, and partition scan will be proceed again when blkdev_get_by_dev() is called. However, this will cause a problem that re-assemble partitioned raid device will creat partition for underlying disk. Test procedure: mdadm -CR /dev/md0 -l 1 -n 2 /dev/sda /dev/sdb -e 1.0 sgdisk -n 0:0:+100MiB /dev/md0 blockdev --rereadpt /dev/sda blockdev --rereadpt /dev/sdb mdadm -S /dev/md0 mdadm -A /dev/md0 /dev/sda /dev/sdb Test result: underlying disk partition and raid partition can be observed at the same time Note that this can still happen in come corner cases that GD_NEED_PART_SCAN can be set for underlying disk while re-assemble raid device. Fixes: e5cfefa97bcc ("block: fix scan partition for exclusively open device again") Reviewed-by: Jan Kara <jack(a)suse.cz> Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/genhd.c Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- block/genhd.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/block/genhd.c b/block/genhd.c index 3c34dd011585..83f407e1563a 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -770,6 +770,13 @@ int disk_scan_partitions(struct gendisk *disk, fmode_t mode) else blkdev_put(bdev, mode & ~FMODE_EXCL); + /* + * If blkdev_get_by_dev() failed early, GD_NEED_PART_SCAN is still set, + * and this will cause that re-assemble partitioned raid device will + * creat partition for underlying disk. + */ + clear_bit(GD_NEED_PART_SCAN, &disk->state); + if (!(mode & FMODE_EXCL)) { bd_abort_claiming(claim, claim, disk_scan_partitions); bdput(claim); -- 2.31.1

2 1