- Kernel - mailweb.openeuler.org

[openEuler-5.10-LTS 00/10] Backport 5.10.125 LTS
by Zheng Zengkai 26 Oct '22

26 Oct '22

Backport 5.10.125 LTS patches from upstream. git cherry-pick v5.10.124..v5.10.125~1 -s Already merged(-2): 9429b75bc271 tcp: increase source port perturb table to 2^16 df3f3bb5059d io_uring: add missing item types for various requests Context conflict: 24b922a5da00 tcp: dynamically allocate the perturb table used by source ports Total patches: 12 - 2 = 10 Christian Borntraeger (1): s390/mm: use non-quiescing sske for KVM switch to keyed guest Damien Le Moal (1): zonefs: fix zonefs_iomap_begin() for reads Eric Dumazet (1): tcp: add some entropy in __inet_hash_connect() Lukas Wunner (1): serial: core: Initialize rs485 RTS polarity already on probe Marian Postevca (1): usb: gadget: u_ether: fix regression in setting fixed MAC address Will Deacon (1): arm64: mm: Don't invalidate FROM_DEVICE buffers at start of DMA transfer Willy Tarreau (4): tcp: use different parts of the port_offset for index and offset tcp: add small random increments to the source port tcp: dynamically allocate the perturb table used by source ports tcp: drop the hash_32() part from the index calculation arch/arm64/mm/cache.S | 2 - arch/s390/mm/pgtable.c | 2 +- drivers/tty/serial/serial_core.c | 34 ++++------ drivers/usb/gadget/function/u_ether.c | 11 +++- fs/zonefs/super.c | 92 ++++++++++++++++++--------- net/ipv4/inet_hashtables.c | 22 +++++-- 6 files changed, 102 insertions(+), 61 deletions(-) -- 2.20.1

1 10

[PATCH openEuler-5.10-LTS 00/80] Backport 5.10.124 LTS
by Zheng Zengkai 26 Oct '22

26 Oct '22

Backport 5.10.124 LTS patches from upstream. git cherry-pick v5.10.123..v5.10.124~1 -s Already merged(-3): 2c9548bc2650 powerpc/kasan: Silence KASAN warnings in __get_wchan() 6fdaf31ad5f3 ext4: fix bug_on ext4_mb_use_inode_pa 0ca74dacfd47 ext4: make variable "count" signed Context conflict: 4603a37f6eae random: credit cpu and bootloader seeds by default Total patches: 83 - 3 = 80 Adam Ford (2): arm64: dts: imx8mm-beacon: Enable RTS-CTS on UART3 ASoC: wm8962: Fix suspend while playing music Al Viro (1): 9p: missing chunk of "fs/9p: Don't update file type when updating file attributes" Alan Previn (1): drm/i915/reset: Fix error_state_read ptr + offset use Aleksandr Loktionov (1): i40e: Fix call trace in setup_tx_descriptors Alexander Usyskin (1): mei: me: add raptor lake point S DID Andy Chi (1): ALSA: hda/realtek: fix right sounds and mute/micmute LEDs for HP machine Ashish Kalra (1): KVM: SVM: Use kzalloc for sev ioctl interfaces to prevent kernel data leak Bart Van Assche (1): block: Fix handling of offline queues in blk_mq_alloc_request_hctx() Charles Keepax (6): ASoC: cs42l52: Fix TLV scales for mixer controls ASoC: cs35l36: Update digital volume TLV ASoC: cs53l30: Correct number of volume levels on SX controls ASoC: cs42l52: Correct TLV for Bypass Volume ASoC: cs42l56: Correct typo in minimum level for SX volume controls ASoC: cs42l51: Correct minimum value for SX volume control Chen Lin (1): net: ethernet: mtk_eth_soc: fix misuse of mem alloc interface netdev[napi]_alloc_frag Chengguang Xu (2): scsi: ipr: Fix missing/incorrect resource cleanup in error case scsi: pmcraid: Fix missing resource cleanup in error case Christophe JAILLET (1): net: bgmac: Fix an erroneous kfree() in bgmac_remove() Daniel Wagner (1): nvme: use sysfs_emit instead of sprintf Davide Caratti (1): net/sched: act_police: more accurate MTU policing Duoming Zhou (1): net: ax25: Fix deadlock caused by skb_recv_datagram in ax25_recvmsg Grzegorz Szczurek (2): i40e: Fix adding ADQ filter to TC0 i40e: Fix calculating the number of queue pairs Hui Wang (1): ASoC: nau8822: Add operation for internal PLL off and on Ian Abbott (1): comedi: vmk80xx: fix expression for tx buffer size Ilpo Järvinen (1): serial: 8250: Store to lsr_save_flags after lsr read Ilya Maximets (1): net: openvswitch: fix misuse of the cached connection on tuple changes James Smart (2): scsi: lpfc: Fix port stuck in bypassed state after LIP in PT2PT topology scsi: lpfc: Allow reduced polling rate for nvme_admin_async_event cmd completion Jason A. Donenfeld (2): random: credit cpu and bootloader seeds by default crypto: memneq - move into lib/ Jiasheng Jiang (1): i2c: npcm7xx: Add check for platform_driver_register Josh Poimboeuf (1): faddr2line: Fix overlapping text section failures, the sequel Linus Torvalds (1): mellanox: mlx5: avoid uninitialized variable warning with gcc-12 Marc Zyngier (1): KVM: arm64: Don't read a HW interrupt pending state in user context Marius Hoch (1): Input: soc_button_array - also add Lenovo Yoga Tablet2 1051F to dmi_use_low_level_irq Mark Brown (2): ASoC: es8328: Fix event generation for deemphasis control ASoC: wm_adsp: Fix event generation for wm_adsp_fw_put() Mark Rutland (2): arm64: ftrace: fix branch range checks arm64: ftrace: consistently handle PLTs. Masahiro Yamada (3): clocksource: hyper-v: unexport __init-annotated hv_init_clocksource() certs/blacklist_hashes.c: fix const confusion in certs blacklist powerpc/book3e: get rid of #include <generated/compile.h> Matthew Wilcox (Oracle) (1): quota: Prevent memory allocation recursion while holding dq_lock Miaoqian Lin (6): misc: atmel-ssc: Fix IRQ check in ssc_probe irqchip/gic/realview: Fix refcount leak in realview_gic_of_init irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions usb: dwc2: Fix memory leak in dwc2_hcd_init usb: gadget: lpc32xx_udc: Fix refcount leak in lpc32xx_udc_probe Mikulas Patocka (1): dm mirror log: round up region bitmap size to BITS_PER_LONG Murilo Opsfelder Araujo (1): virtio-pci: Remove wrong address verification in vp_del_vqs() Peng Fan (1): clk: imx8mp: fix usb_root_clk parent Petr Machata (1): mlxsw: spectrum_cnt: Reorder counter pools Rob Clark (1): dma-debug: make things less spammy under memory pressure Robert Eckelmann (1): USB: serial: io_ti: add Agilent E5805A support Robin Murphy (1): dma-direct: don't over-decrypt memory Roman Li (1): drm/amd/display: Cap OLED brightness per max frame-average luminance Saurabh Sengar (1): Drivers: hv: vmbus: Release cpu lock in error case Sean Christopherson (1): KVM: x86: Account a variety of miscellaneous allocations Serge Semin (2): gpio: dwapb: Don't print error on -EPROBE_DEFER i2c: designware: Use standard optional ref clock implementation Sergey Shtylyov (1): ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() Slark Xiao (1): USB: serial: option: add support for Cinterion MV31 with new baseline Thomas Weißschuh (1): nvme: add device name to warning in uuid_show() Trond Myklebust (3): nfsd: Replace use of rwsem with errseq_t pNFS: Don't keep retrying if the server replied NFS4ERR_LAYOUTUNAVAILABLE pNFS: Avoid a live lock condition in pnfs_update_layout() Vincent Whitchurch (1): tty: goldfish: Fix free_irq() on remove Vinicius Costa Gomes (2): Revert "PCI: Make pci_enable_ptm() private" igc: Enable PCIe PTM Wang Yufen (1): ipv6: Fix signed integer overflow in l2tp_ip6_sendmsg Wentao Wang (1): scsi: vmw_pvscsi: Expand vcpuHint to 16 bits Xiaohui Zhang (1): nfc: nfcmrvl: Fix memory leak in nfcmrvl_play_deferred Yuntao Wang (1): bpf: Fix incorrect memory charge cost calculation in stack_map_alloc() Yupeng Li (1): MIPS: Loongson-3: fix compile mips cpu_hwmon as module build error. Zhang Yi (1): ext4: add reserved GDT blocks check chengkaitao (1): virtio-mmio: fix missing put_device() when vm_cmdline_parent registration failed huangwenhui (1): ALSA: hda/realtek - Add HW8326 support .../freescale/imx8mm-beacon-baseboard.dtsi | 3 + arch/arm64/kernel/ftrace.c | 137 +++++++++--------- arch/arm64/kvm/vgic/vgic-mmio-v2.c | 4 +- arch/arm64/kvm/vgic/vgic-mmio.c | 19 ++- arch/arm64/kvm/vgic/vgic-mmio.h | 3 + arch/powerpc/mm/nohash/kaslr_booke.c | 8 +- arch/x86/kvm/svm/nested.c | 4 +- arch/x86/kvm/svm/sev.c | 4 +- arch/x86/kvm/vmx/vmx.c | 2 +- block/blk-mq.c | 2 + certs/blacklist_hashes.c | 2 +- crypto/Kconfig | 1 + crypto/Makefile | 2 +- drivers/ata/libata-core.c | 4 +- drivers/char/Kconfig | 54 ++++--- drivers/clk/imx/clk-imx8mp.c | 2 +- drivers/clocksource/hyperv_timer.c | 1 - drivers/gpio/gpio-dwapb.c | 7 +- .../gpu/drm/amd/display/amdgpu_dm/amdgpu_dm.c | 8 +- drivers/gpu/drm/i915/i915_sysfs.c | 15 +- drivers/hv/channel_mgmt.c | 1 + drivers/i2c/busses/i2c-designware-common.c | 3 - drivers/i2c/busses/i2c-designware-platdrv.c | 13 +- drivers/i2c/busses/i2c-npcm7xx.c | 3 +- drivers/input/misc/soc_button_array.c | 4 +- drivers/irqchip/irq-gic-realview.c | 1 + drivers/irqchip/irq-gic-v3.c | 7 +- drivers/md/dm-log.c | 3 +- drivers/misc/atmel-ssc.c | 4 +- drivers/misc/mei/hw-me-regs.h | 2 + drivers/misc/mei/pci-me.c | 2 + drivers/net/ethernet/broadcom/bgmac-bcma.c | 1 - .../net/ethernet/intel/i40e/i40e_ethtool.c | 25 +++- drivers/net/ethernet/intel/i40e/i40e_main.c | 5 + .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 2 +- drivers/net/ethernet/intel/igc/igc_main.c | 5 + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 21 ++- drivers/net/ethernet/mellanox/mlx5/core/lag.c | 2 +- .../ethernet/mellanox/mlxsw/spectrum_cnt.h | 2 +- drivers/nfc/nfcmrvl/usb.c | 16 +- drivers/nvme/host/core.c | 44 +++--- drivers/nvme/host/multipath.c | 8 +- drivers/pci/pci.h | 3 - drivers/platform/mips/Kconfig | 2 +- drivers/scsi/ipr.c | 4 +- drivers/scsi/lpfc/lpfc_hw4.h | 3 + drivers/scsi/lpfc/lpfc_nportdisc.c | 3 +- drivers/scsi/lpfc/lpfc_nvme.c | 11 +- drivers/scsi/pmcraid.c | 2 +- drivers/scsi/vmw_pvscsi.h | 4 +- drivers/staging/comedi/drivers/vmk80xx.c | 2 +- drivers/tty/goldfish.c | 2 +- drivers/tty/serial/8250/8250_port.c | 2 + drivers/usb/dwc2/hcd.c | 2 +- drivers/usb/gadget/udc/lpc32xx_udc.c | 1 + drivers/usb/serial/io_ti.c | 2 + drivers/usb/serial/io_usbvend.h | 1 + drivers/usb/serial/option.c | 6 + drivers/virtio/virtio_mmio.c | 1 + drivers/virtio/virtio_pci_common.c | 3 +- fs/9p/vfs_inode_dotl.c | 10 +- fs/ext4/resize.c | 10 ++ fs/nfs/callback_proc.c | 1 + fs/nfs/pnfs.c | 21 ++- fs/nfs/pnfs.h | 1 + fs/nfsd/filecache.c | 1 - fs/nfsd/filecache.h | 1 - fs/nfsd/nfs4proc.c | 7 +- fs/nfsd/vfs.c | 40 ++--- fs/quota/dquot.c | 10 ++ include/linux/pci.h | 7 + kernel/bpf/stackmap.c | 3 +- kernel/dma/debug.c | 2 +- kernel/dma/direct.c | 16 +- lib/Kconfig | 3 + lib/Makefile | 1 + lib/crypto/Kconfig | 1 + {crypto => lib}/memneq.c | 0 net/ax25/af_ax25.c | 34 ++++- net/l2tp/l2tp_ip6.c | 5 +- net/openvswitch/actions.c | 6 + net/openvswitch/conntrack.c | 3 +- net/sched/act_police.c | 16 +- scripts/faddr2line | 45 ++++-- sound/hda/hdac_device.c | 1 + sound/pci/hda/patch_realtek.c | 15 ++ sound/soc/codecs/cs35l36.c | 3 +- sound/soc/codecs/cs42l51.c | 2 +- sound/soc/codecs/cs42l52.c | 8 +- sound/soc/codecs/cs42l56.c | 4 +- sound/soc/codecs/cs53l30.c | 16 +- sound/soc/codecs/es8328.c | 5 +- sound/soc/codecs/nau8822.c | 4 + sound/soc/codecs/nau8822.h | 3 + sound/soc/codecs/wm8962.c | 1 + sound/soc/codecs/wm_adsp.c | 2 +- .../selftests/net/forwarding/tc_police.sh | 52 +++++++ 97 files changed, 578 insertions(+), 292 deletions(-) rename {crypto => lib}/memneq.c (100%) -- 2.20.1

1 80

[PATCH openEuler-5.10 0/4] Try to fix kabi change caused by Intel AMX
by Zheng Zengkai 26 Oct '22

26 Oct '22

These four patches try to avoid or fix kabi change caused by Intel AMX PR: https://gitee.com/openeuler/kernel/pulls/58 Zheng Zengkai (4): x86: Avoid kabi change caused by adding pkru element in thread_struct x86/extable: Avoid kabi change caused by exception table rework x86/fpu: Avoid kabi change caused by struct fpu mm: Fix kabi change caused by saved_auxv[] in mm_struct for x86_64 arch/x86/include/asm/extable.h | 4 ++++ arch/x86/include/asm/fpu/types.h | 4 ++++ arch/x86/include/asm/processor.h | 2 ++ arch/x86/include/uapi/asm/auxvec.h | 1 + include/linux/mm_types.h | 15 +++++++++++++++ 5 files changed, 26 insertions(+) -- 2.20.1

6 15

[PATCH openEuler-1.0-LTS] nfp: fix use-after-free in area_cache_get()
by Yongqiang Liu 25 Oct '22

25 Oct '22

From: Jialiang Wang <wangjialiang0806(a)163.com> mainline inclusion from mainline-v6.0-rc1 commit 02e1a114fdb71e59ee6770294166c30d437bf86a category: bugfix bugzilla: 187867, https://gitee.com/src-openeuler/kernel/issues/I5W7B5 CVE: CVE-2022-3545 -------------------------------- area_cache_get() is used to distribute cache->area and set cache->id, and if cache->id is not 0 and cache->area->kref refcount is 0, it will release the cache->area by nfp_cpp_area_release(). area_cache_get() set cache->id before cpp->op->area_init() and nfp_cpp_area_acquire(). But if area_init() or nfp_cpp_area_acquire() fails, the cache->id is is already set but the refcount is not increased as expected. At this time, calling the nfp_cpp_area_release() will cause use-after-free. To avoid the use-after-free, set cache->id after area_init() and nfp_cpp_area_acquire() complete successfully. Note: This vulnerability is triggerable by providing emulated device equipped with specified configuration. BUG: KASAN: use-after-free in nfp6000_area_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:760) Write of size 4 at addr ffff888005b7f4a0 by task swapper/0/1 Call Trace: <TASK> nfp6000_area_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:760) area_cache_get.constprop.8 (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:884) Allocated by task 1: nfp_cpp_area_alloc_with_name (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:303) nfp_cpp_area_cache_add (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:802) nfp6000_init (drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c:1230) nfp_cpp_from_operations (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:1215) nfp_pci_probe (drivers/net/ethernet/netronome/nfp/nfp_main.c:744) Freed by task 1: kfree (mm/slub.c:4562) area_cache_get.constprop.8 (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:873) nfp_cpp_read (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:924 drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c:973) nfp_cpp_readl (drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cpplib.c:48) Signed-off-by: Jialiang Wang <wangjialiang0806(a)163.com> Reviewed-by: Yinjun Zhang <yinjun.zhang(a)corigine.com> Acked-by: Simon Horman <simon.horman(a)corigine.com> Link: https://lore.kernel.org/r/20220810073057.4032-1-wangjialiang0806@163.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Yuyao Lin <linyuyao1(a)huawei.com> Reviewed-by: Wei Li <liwei391(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c index 73de57a09800..6f5d69293a25 100644 --- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c +++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_cppcore.c @@ -872,7 +872,6 @@ area_cache_get(struct nfp_cpp *cpp, u32 id, } /* Adjust the start address to be cache size aligned */ - cache->id = id; cache->addr = addr & ~(u64)(cache->size - 1); /* Re-init to the new ID and address */ @@ -892,6 +891,8 @@ area_cache_get(struct nfp_cpp *cpp, u32 id, return NULL; } + cache->id = id; + exit: /* Adjust offset */ *offset = addr - cache->addr; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] mISDN: fix use-after-free bugs in l1oip timer handlers
by Yongqiang Liu 25 Oct '22

25 Oct '22

From: Duoming Zhou <duoming(a)zju.edu.cn> mainline inclusion from mainline-v6.1-rc1 commit 2568a7e0832ee30b0a351016d03062ab4e0e0a3f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5W7YH CVE: CVE-2022-3565 -------------------------------- The l1oip_cleanup() traverses the l1oip_ilist and calls release_card() to cleanup module and stack. However, release_card() calls del_timer() to delete the timers such as keep_tl and timeout_tl. If the timer handler is running, the del_timer() will not stop it and result in UAF bugs. One of the processes is shown below: (cleanup routine) | (timer handler) release_card() | l1oip_timeout() ... | del_timer() | ... ... | kfree(hc) //FREE | | hc->timeout_on = 0 //USE Fix by calling del_timer_sync() in release_card(), which makes sure the timer handlers have finished before the resources, such as l1oip and so on, have been deallocated. What's more, the hc->workq and hc->socket_thread can kick those timers right back in. We add a bool flag to show if card is released. Then, check this flag in hc->workq and hc->socket_thread. Fixes: 3712b42d4b1b ("Add layer1 over IP support") Signed-off-by: Duoming Zhou <duoming(a)zju.edu.cn> Reviewed-by: Leon Romanovsky <leonro(a)nvidia.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: GUO Zihua <guozihua(a)huawei.com> Reviewed-by: GONG Ruiqi <gongruiqi1(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/isdn/mISDN/l1oip.h | 1 + drivers/isdn/mISDN/l1oip_core.c | 13 +++++++------ 2 files changed, 8 insertions(+), 6 deletions(-) diff --git a/drivers/isdn/mISDN/l1oip.h b/drivers/isdn/mISDN/l1oip.h index 7ea10db20e3a..48133d022812 100644 --- a/drivers/isdn/mISDN/l1oip.h +++ b/drivers/isdn/mISDN/l1oip.h @@ -59,6 +59,7 @@ struct l1oip { int bundle; /* bundle channels in one frm */ int codec; /* codec to use for transmis. */ int limit; /* limit number of bchannels */ + bool shutdown; /* if card is released */ /* timer */ struct timer_list keep_tl; diff --git a/drivers/isdn/mISDN/l1oip_core.c b/drivers/isdn/mISDN/l1oip_core.c index b05022f94f18..2f4a01ab25e8 100644 --- a/drivers/isdn/mISDN/l1oip_core.c +++ b/drivers/isdn/mISDN/l1oip_core.c @@ -289,7 +289,7 @@ l1oip_socket_send(struct l1oip *hc, u8 localcodec, u8 channel, u32 chanmask, p = frame; /* restart timer */ - if (time_before(hc->keep_tl.expires, jiffies + 5 * HZ)) + if (time_before(hc->keep_tl.expires, jiffies + 5 * HZ) && !hc->shutdown) mod_timer(&hc->keep_tl, jiffies + L1OIP_KEEPALIVE * HZ); else hc->keep_tl.expires = jiffies + L1OIP_KEEPALIVE * HZ; @@ -615,7 +615,9 @@ l1oip_socket_parse(struct l1oip *hc, struct sockaddr_in *sin, u8 *buf, int len) goto multiframe; /* restart timer */ - if (time_before(hc->timeout_tl.expires, jiffies + 5 * HZ) || !hc->timeout_on) { + if ((time_before(hc->timeout_tl.expires, jiffies + 5 * HZ) || + !hc->timeout_on) && + !hc->shutdown) { hc->timeout_on = 1; mod_timer(&hc->timeout_tl, jiffies + L1OIP_TIMEOUT * HZ); } else /* only adjust timer */ @@ -1247,11 +1249,10 @@ release_card(struct l1oip *hc) { int ch; - if (timer_pending(&hc->keep_tl)) - del_timer(&hc->keep_tl); + hc->shutdown = true; - if (timer_pending(&hc->timeout_tl)) - del_timer(&hc->timeout_tl); + del_timer_sync(&hc->keep_tl); + del_timer_sync(&hc->timeout_tl); cancel_work_sync(&hc->workq); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] tcp: Fix data races around icsk->icsk_af_ops.
by Yongqiang Liu 25 Oct '22

25 Oct '22

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> mainline inclusion from mainline-v6.1-rc1 commit f49cd2f4d6170d27a2c61f1fecb03d8a70c91f57 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5W7ZF CVE: CVE-2022-3566 -------------------------------- setsockopt(IPV6_ADDRFORM) and tcp_v6_connect() change icsk->icsk_af_ops under lock_sock(), but tcp_(get|set)sockopt() read it locklessly. To avoid load/store tearing, we need to add READ_ONCE() and WRITE_ONCE() for the reads and writes. Thanks to Eric Dumazet for providing the syzbot report: BUG: KCSAN: data-race in tcp_setsockopt / tcp_v6_connect write to 0xffff88813c624518 of 8 bytes by task 23936 on cpu 0: tcp_v6_connect+0x5b3/0xce0 net/ipv6/tcp_ipv6.c:240 __inet_stream_connect+0x159/0x6d0 net/ipv4/af_inet.c:660 inet_stream_connect+0x44/0x70 net/ipv4/af_inet.c:724 __sys_connect_file net/socket.c:1976 [inline] __sys_connect+0x197/0x1b0 net/socket.c:1993 __do_sys_connect net/socket.c:2003 [inline] __se_sys_connect net/socket.c:2000 [inline] __x64_sys_connect+0x3d/0x50 net/socket.c:2000 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff88813c624518 of 8 bytes by task 23937 on cpu 1: tcp_setsockopt+0x147/0x1c80 net/ipv4/tcp.c:3789 sock_common_setsockopt+0x5d/0x70 net/core/sock.c:3585 __sys_setsockopt+0x212/0x2b0 net/socket.c:2252 __do_sys_setsockopt net/socket.c:2263 [inline] __se_sys_setsockopt net/socket.c:2260 [inline] __x64_sys_setsockopt+0x62/0x70 net/socket.c:2260 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0xffffffff8539af68 -> 0xffffffff8539aff8 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 23937 Comm: syz-executor.5 Not tainted 6.0.0-rc4-syzkaller-00331-g4ed9c1e971b1-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot <syzkaller(a)googlegroups.com> Reported-by: Eric Dumazet <edumazet(a)google.com> Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: net/ipv4/tcp.c net/ipv6/ipv6_sockglue.c net/ipv6/tcp_ipv6.c Signed-off-by: Ziyang Xuan <william.xuanziyang(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/ipv4/tcp.c | 10 ++++++---- net/ipv6/ipv6_sockglue.c | 3 ++- net/ipv6/tcp_ipv6.c | 6 ++++-- 3 files changed, 12 insertions(+), 7 deletions(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 325a1dafbd90..094cd93e50c2 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -3114,8 +3114,9 @@ int tcp_setsockopt(struct sock *sk, int level, int optname, char __user *optval, const struct inet_connection_sock *icsk = inet_csk(sk); if (level != SOL_TCP) - return icsk->icsk_af_ops->setsockopt(sk, level, optname, - optval, optlen); + /* Paired with WRITE_ONCE() in do_ipv6_setsockopt() and tcp_v6_connect() */ + return READ_ONCE(icsk->icsk_af_ops)->setsockopt(sk, level, optname, + optval, optlen); return do_tcp_setsockopt(sk, level, optname, optval, optlen); } EXPORT_SYMBOL(tcp_setsockopt); @@ -3635,8 +3636,9 @@ int tcp_getsockopt(struct sock *sk, int level, int optname, char __user *optval, struct inet_connection_sock *icsk = inet_csk(sk); if (level != SOL_TCP) - return icsk->icsk_af_ops->getsockopt(sk, level, optname, - optval, optlen); + /* Paired with WRITE_ONCE() in do_ipv6_setsockopt() and tcp_v6_connect() */ + return READ_ONCE(icsk->icsk_af_ops)->getsockopt(sk, level, optname, + optval, optlen); return do_tcp_getsockopt(sk, level, optname, optval, optlen); } EXPORT_SYMBOL(tcp_getsockopt); diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index d3f3a2f79646..85e5bdfa1f87 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -231,7 +231,8 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, sock_prot_inuse_add(net, &tcp_prot, 1); local_bh_enable(); sk->sk_prot = &tcp_prot; - icsk->icsk_af_ops = &ipv4_specific; + /* Paired with READ_ONCE() in tcp_(get|set)sockopt() */ + WRITE_ONCE(icsk->icsk_af_ops, &ipv4_specific); sk->sk_socket->ops = &inet_stream_ops; sk->sk_family = PF_INET; tcp_sync_mss(sk, icsk->icsk_pmtu_cookie); diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index de2975175503..ab9e022325e7 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -229,7 +229,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, sin.sin_port = usin->sin6_port; sin.sin_addr.s_addr = usin->sin6_addr.s6_addr32[3]; - icsk->icsk_af_ops = &ipv6_mapped; + /* Paired with READ_ONCE() in tcp_(get|set)sockopt() */ + WRITE_ONCE(icsk->icsk_af_ops, &ipv6_mapped); sk->sk_backlog_rcv = tcp_v4_do_rcv; #ifdef CONFIG_TCP_MD5SIG tp->af_specific = &tcp_sock_ipv6_mapped_specific; @@ -239,7 +240,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, if (err) { icsk->icsk_ext_hdr_len = exthdrlen; - icsk->icsk_af_ops = &ipv6_specific; + /* Paired with READ_ONCE() in tcp_(get|set)sockopt() */ + WRITE_ONCE(icsk->icsk_af_ops, &ipv6_specific); sk->sk_backlog_rcv = tcp_v6_do_rcv; #ifdef CONFIG_TCP_MD5SIG tp->af_specific = &tcp_sock_ipv6_specific; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] Bluetooth: L2CAP: Fix use-after-free caused by l2cap_reassemble_sdu
by Yongqiang Liu 25 Oct '22

25 Oct '22

From: Maxim Mikityanskiy <maxtram95(a)gmail.com> mainline inclusion from bluetooth-next commit 89f9f3cb86b1c63badaf392a83dd661d56cc50b1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5W7XW CVE: CVE-2022-3564 -------------------------------- Fix the race condition between the following two flows that run in parallel: 1. l2cap_reassemble_sdu -> chan->ops->recv (l2cap_sock_recv_cb) -> __sock_queue_rcv_skb. 2. bt_sock_recvmsg -> skb_recv_datagram, skb_free_datagram. An SKB can be queued by the first flow and immediately dequeued and freed by the second flow, therefore the callers of l2cap_reassemble_sdu can't use the SKB after that function returns. However, some places continue accessing struct l2cap_ctrl that resides in the SKB's CB for a short time after l2cap_reassemble_sdu returns, leading to a use-after-free condition (the stack trace is below, line numbers for kernel 5.19.8). Fix it by keeping a local copy of struct l2cap_ctrl. BUG: KASAN: use-after-free in l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth Read of size 1 at addr ffff88812025f2f0 by task kworker/u17:3/43169 Workqueue: hci0 hci_rx_work [bluetooth] Call Trace: <TASK> dump_stack_lvl (lib/dump_stack.c:107 (discriminator 4)) print_report.cold (mm/kasan/report.c:314 mm/kasan/report.c:429) ? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth kasan_report (mm/kasan/report.c:162 mm/kasan/report.c:493) ? l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth l2cap_rx_state_recv (net/bluetooth/l2cap_core.c:6906) bluetooth l2cap_rx (net/bluetooth/l2cap_core.c:7236 net/bluetooth/l2cap_core.c:7271) bluetooth ret_from_fork (arch/x86/entry/entry_64.S:306) </TASK> Allocated by task 43169: kasan_save_stack (mm/kasan/common.c:39) __kasan_slab_alloc (mm/kasan/common.c:45 mm/kasan/common.c:436 mm/kasan/common.c:469) kmem_cache_alloc_node (mm/slab.h:750 mm/slub.c:3243 mm/slub.c:3293) __alloc_skb (net/core/skbuff.c:414) l2cap_recv_frag (./include/net/bluetooth/bluetooth.h:425 net/bluetooth/l2cap_core.c:8329) bluetooth l2cap_recv_acldata (net/bluetooth/l2cap_core.c:8442) bluetooth hci_rx_work (net/bluetooth/hci_core.c:3642 net/bluetooth/hci_core.c:3832) bluetooth process_one_work (kernel/workqueue.c:2289) worker_thread (./include/linux/list.h:292 kernel/workqueue.c:2437) kthread (kernel/kthread.c:376) ret_from_fork (arch/x86/entry/entry_64.S:306) Freed by task 27920: kasan_save_stack (mm/kasan/common.c:39) kasan_set_track (mm/kasan/common.c:45) kasan_set_free_info (mm/kasan/generic.c:372) ____kasan_slab_free (mm/kasan/common.c:368 mm/kasan/common.c:328) slab_free_freelist_hook (mm/slub.c:1780) kmem_cache_free (mm/slub.c:3536 mm/slub.c:3553) skb_free_datagram (./include/net/sock.h:1578 ./include/net/sock.h:1639 net/core/datagram.c:323) bt_sock_recvmsg (net/bluetooth/af_bluetooth.c:295) bluetooth l2cap_sock_recvmsg (net/bluetooth/l2cap_sock.c:1212) bluetooth sock_read_iter (net/socket.c:1087) new_sync_read (./include/linux/fs.h:2052 fs/read_write.c:401) vfs_read (fs/read_write.c:482) ksys_read (fs/read_write.c:620) do_syscall_64 (arch/x86/entry/common.c:50 arch/x86/entry/common.c:80) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120) Link: https://lore.kernel.org/linux-bluetooth/CAKErNvoqga1WcmoR3-0875esY6TVWFQDan… Fixes: d2a7ac5d5d3a ("Bluetooth: Add the ERTM receive state machine") Fixes: 4b51dae96731 ("Bluetooth: Add streaming mode receive and incoming packet classifier") Signed-off-by: Maxim Mikityanskiy <maxtram95(a)gmail.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> conflicts： net/bluetooth/l2cap_core.c Signed-off-by: Xia Longlong <xialonglong1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/bluetooth/l2cap_core.c | 48 ++++++++++++++++++++++++++++++++------ 1 file changed, 41 insertions(+), 7 deletions(-) diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c index 38789494867d..436a92e3bf20 100644 --- a/net/bluetooth/l2cap_core.c +++ b/net/bluetooth/l2cap_core.c @@ -6204,6 +6204,7 @@ static int l2cap_rx_state_recv(struct l2cap_chan *chan, struct l2cap_ctrl *control, struct sk_buff *skb, u8 event) { + struct l2cap_ctrl local_control; int err = 0; bool skb_in_use = false; @@ -6228,15 +6229,32 @@ static int l2cap_rx_state_recv(struct l2cap_chan *chan, chan->buffer_seq = chan->expected_tx_seq; skb_in_use = true; + /* l2cap_reassemble_sdu may free skb, hence invalidate + * control, so make a copy in advance to use it after + * l2cap_reassemble_sdu returns and to avoid the race + * condition, for example: + * + * The current thread calls: + * l2cap_reassemble_sdu + * chan->ops->recv == l2cap_sock_recv_cb + * __sock_queue_rcv_skb + * Another thread calls: + * bt_sock_recvmsg + * skb_recv_datagram + * skb_free_datagram + * Then the current thread tries to access control, but + * it was freed by skb_free_datagram. + */ + local_control = *control; err = l2cap_reassemble_sdu(chan, skb, control); if (err) break; - if (control->final) { + if (local_control.final) { if (!test_and_clear_bit(CONN_REJ_ACT, &chan->conn_state)) { - control->final = 0; - l2cap_retransmit_all(chan, control); + local_control.final = 0; + l2cap_retransmit_all(chan, &local_control); l2cap_ertm_send(chan); } } @@ -6616,11 +6634,27 @@ static int l2cap_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, struct sk_buff *skb) { + /* l2cap_reassemble_sdu may free skb, hence invalidate control, so store + * the txseq field in advance to use it after l2cap_reassemble_sdu + * returns and to avoid the race condition, for example: + * + * The current thread calls: + * l2cap_reassemble_sdu + * chan->ops->recv == l2cap_sock_recv_cb + * __sock_queue_rcv_skb + * Another thread calls: + * bt_sock_recvmsg + * skb_recv_datagram + * skb_free_datagram + * Then the current thread tries to access control, but it was freed by + * skb_free_datagram. + */ + u16 txseq = control->txseq; + BT_DBG("chan %p, control %p, skb %p, state %d", chan, control, skb, chan->rx_state); - if (l2cap_classify_txseq(chan, control->txseq) == - L2CAP_TXSEQ_EXPECTED) { + if (l2cap_classify_txseq(chan, txseq) == L2CAP_TXSEQ_EXPECTED) { l2cap_pass_to_tx(chan, control); BT_DBG("buffer_seq %d->%d", chan->buffer_seq, @@ -6643,8 +6677,8 @@ static int l2cap_stream_rx(struct l2cap_chan *chan, struct l2cap_ctrl *control, } } - chan->last_acked_seq = control->txseq; - chan->expected_tx_seq = __next_seq(chan, control->txseq); + chan->last_acked_seq = txseq; + chan->expected_tx_seq = __next_seq(chan, txseq); return 0; } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] bnx2x: fix potential memory leak in bnx2x_tpa_stop()
by Yongqiang Liu 24 Oct '22

24 Oct '22

From: Jianglei Nie <niejianglei2021(a)163.com> mainline inclusion from mainline-v6.1-rc1 commit b43f9acbb8942b05252be83ac25a81cec70cc192 category: bugfix bugzilla: 187839, https://gitee.com/src-openeuler/kernel/issues/I5W7B1 CVE: CVE-2022-3542 -------------------------------- bnx2x_tpa_stop() allocates a memory chunk from new_data with bnx2x_frag_alloc(). The new_data should be freed when gets some error. But when "pad + len > fp->rx_buf_size" is true, bnx2x_tpa_stop() returns without releasing the new_data, which will lead to a memory leak. We should free the new_data with bnx2x_frag_free() when "pad + len > fp->rx_buf_size" is true. Fixes: 07b0f00964def8af9321cfd6c4a7e84f6362f728 ("bnx2x: fix possible panic under memory stress") Signed-off-by: Jianglei Nie <niejianglei2021(a)163.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Ren Zhijie <renzhijie2(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Chen Hui <judy.chenhui(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c index cf01e73d1bcc..a123f1733a59 100644 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c @@ -788,6 +788,7 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp, BNX2X_ERR("skb_put is about to fail... pad %d len %d rx_buf_size %d\n", pad, len, fp->rx_buf_size); bnx2x_panic(); + bnx2x_frag_free(fp, new_data); return; } #endif -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] r8152: Rate limit overflow messages
by Yongqiang Liu 21 Oct '22

21 Oct '22

From: Andrew Gaul <gaul(a)gaul.org> mainline inclusion from mainline-v6.1-rc1 commit 93e2be344a7db169b7119de21ac1bf253b8c6907 category: bugfix bugzilla: 187847, https://gitee.com/src-openeuler/kernel/issues/I5WFKR CVE: CVE-2022-3594 -------------------------------- My system shows almost 10 million of these messages over a 24-hour period which pollutes my logs. Signed-off-by: Andrew Gaul <gaul(a)google.com> Link: https://lore.kernel.org/r/20221002034128.2026653-1-gaul@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/usb/r8152.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c index 91d47a714afd..f28fc023c8b7 100644 --- a/drivers/net/usb/r8152.c +++ b/drivers/net/usb/r8152.c @@ -1386,7 +1386,9 @@ static void intr_callback(struct urb *urb) "Stop submitting intr, status %d\n", status); return; case -EOVERFLOW: - netif_info(tp, intr, tp->netdev, "intr status -EOVERFLOW\n"); + if (net_ratelimit()) + netif_info(tp, intr, tp->netdev, + "intr status -EOVERFLOW\n"); goto resubmit; /* -EPIPE: should clear the halt */ default: -- 2.25.1

1 0

openEuler Kernel SIG例会
by openEuler conference 20 Oct '22

20 Oct '22

您好！ Kernel SIG 邀请您参加 2022-10-21 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG例会会议内容： 1.22.03-LTS-SP1 支持generic VDPA device介绍； 2.openEuler-22.03-LTS-SP1信息同步； 3.kernel SIG committer推举会议链接：https://us06web.zoom.us/j/85064426665?pwd=cDkyZ25DVDNwZXdJWUx0emVxQWR2QT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-10-21 14:00, The subject of the conference is openEuler Kernel SIG例会, Summary: 1.22.03-LTS-SP1 支持generic VDPA device介绍； 2.openEuler-22.03-LTS-SP1信息同步； 3.kernel SIG committer推举 You can join the meeting at https://us06web.zoom.us/j/85064426665?pwd=cDkyZ25DVDNwZXdJWUx0emVxQWR2QT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] tcp/udp: Fix memory leak in ipv6_renew_options().
by Yongqiang Liu 20 Oct '22

20 Oct '22

From: Kuniyuki Iwashima <kuniyu(a)amazon.com> mainline inclusion from mainline-v6.1-rc1 commit 3c52c6bb831f6335c176a0fc7214e26f43adbd11 category: bugfix bugzilla: 187825, https://gitee.com/src-openeuler/kernel/issues/I5VZ0J CVE: CVE-2022-3524 -------------------------------- syzbot reported a memory leak [0] related to IPV6_ADDRFORM. The scenario is that while one thread is converting an IPv6 socket into IPv4 with IPV6_ADDRFORM, another thread calls do_ipv6_setsockopt() and allocates memory to inet6_sk(sk)->XXX after conversion. Then, the converted sk with (tcp|udp)_prot never frees the IPv6 resources, which inet6_destroy_sock() should have cleaned up. setsockopt(IPV6_ADDRFORM) setsockopt(IPV6_DSTOPTS) +-----------------------+ +----------------------+ - do_ipv6_setsockopt(sk, ...) - sockopt_lock_sock(sk) - do_ipv6_setsockopt(sk, ...) - lock_sock(sk) ^._ called via tcpv6_prot - WRITE_ONCE(sk->sk_prot, &tcp_prot) before WRITE_ONCE() - xchg(&np->opt, NULL) - txopt_put(opt) - sockopt_release_sock(sk) - release_sock(sk) - sockopt_lock_sock(sk) - lock_sock(sk) - ipv6_set_opt_hdr(sk, ...) - ipv6_update_options(sk, opt) - xchg(&inet6_sk(sk)->opt, opt) ^._ opt is never freed. - sockopt_release_sock(sk) - release_sock(sk) Since IPV6_DSTOPTS allocates options under lock_sock(), we can avoid this memory leak by testing whether sk_family is changed by IPV6_ADDRFORM after acquiring the lock. This issue exists from the initial commit between IPV6_ADDRFORM and IPV6_PKTOPTIONS. [0]: BUG: memory leak unreferenced object 0xffff888009ab9f80 (size 96): comm "syz-executor583", pid 328, jiffies 4294916198 (age 13.034s) hex dump (first 32 bytes): 01 00 00 00 48 00 00 00 08 00 00 00 00 00 00 00 ....H........... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000002ee98ae1>] kmalloc include/linux/slab.h:605 [inline] [<000000002ee98ae1>] sock_kmalloc+0xb3/0x100 net/core/sock.c:2566 [<0000000065d7b698>] ipv6_renew_options+0x21e/0x10b0 net/ipv6/exthdrs.c:1318 [<00000000a8c756d7>] ipv6_set_opt_hdr net/ipv6/ipv6_sockglue.c:354 [inline] [<00000000a8c756d7>] do_ipv6_setsockopt.constprop.0+0x28b7/0x4350 net/ipv6/ipv6_sockglue.c:668 [<000000002854d204>] ipv6_setsockopt+0xdf/0x190 net/ipv6/ipv6_sockglue.c:1021 [<00000000e69fdcf8>] tcp_setsockopt+0x13b/0x2620 net/ipv4/tcp.c:3789 [<0000000090da4b9b>] __sys_setsockopt+0x239/0x620 net/socket.c:2252 [<00000000b10d192f>] __do_sys_setsockopt net/socket.c:2263 [inline] [<00000000b10d192f>] __se_sys_setsockopt net/socket.c:2260 [inline] [<00000000b10d192f>] __x64_sys_setsockopt+0xbe/0x160 net/socket.c:2260 [<000000000a80d7aa>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<000000000a80d7aa>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 [<000000004562b5c6>] entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Kuniyuki Iwashima <kuniyu(a)amazon.com> Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Xu Jia <xujia39(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/ipv6/ipv6_sockglue.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index b2e03e84a2df..d3f3a2f79646 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -168,6 +168,12 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, rtnl_lock(); lock_sock(sk); + /* Another thread has converted the socket into IPv4 with + * IPV6_ADDRFORM concurrently. + */ + if (unlikely(sk->sk_family != AF_INET6)) + goto unlock; + switch (optname) { case IPV6_ADDRFORM: @@ -915,6 +921,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, break; } +unlock: release_sock(sk); if (needs_rtnl) rtnl_unlock(); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] net: mvpp2: fix mvpp2 debugfs leak
by Yongqiang Liu 20 Oct '22

20 Oct '22

From: "Russell King (Oracle)" <rmk+kernel(a)armlinux.org.uk> mainline inclusion from mainline-v6.0-rc7 commit 0152dfee235e87660f52a117fc9f70dc55956bb4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5W7AX CVE: CVE-2022-3535 -------------------------------- When mvpp2 is unloaded, the driver specific debugfs directory is not removed, which technically leads to a memory leak. However, this directory is only created when the first device is probed, so the hardware is present. Removing the module is only something a developer would to when e.g. testing out changes, so the module would be reloaded. So this memory leak is minor. The original attempt in commit fe2c9c61f668 ("net: mvpp2: debugfs: fix memory leak when using debugfs_lookup()") that was labelled as a memory leak fix was not, it fixed a refcount leak, but in doing so created a problem when the module is reloaded - the directory already exists, but mvpp2_root is NULL, so we lose all debugfs entries. This fix has been reverted. This is the alternative fix, where we remove the offending directory whenever the driver is unloaded. Fixes: 21da57a23125 ("net: mvpp2: add a debugfs interface for the Header Parser") Signed-off-by: Russell King (Oracle) <rmk+kernel(a)armlinux.org.uk> Reviewed-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Reviewed-by: Marcin Wojtas <mw(a)semihalf.com> Link: https://lore.kernel.org/r/E1ofOAB-00CzkG-UO@rmk-PC.armlinux.org.uk Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Conflicts: drivers/net/ethernet/marvell/mvpp2/mvpp2.h drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c Signed-off-by: Hui Tang <tanghui20(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/net/ethernet/marvell/mvpp2/mvpp2.h | 1 + drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c | 10 ++++++++-- drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c | 13 ++++++++++++- 3 files changed, 21 insertions(+), 3 deletions(-) diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h index 46911b67b039..23f60bc5d48f 100644 --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2.h +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2.h @@ -1107,5 +1107,6 @@ void mvpp2_percpu_write_relaxed(struct mvpp2 *priv, int cpu, u32 offset, void mvpp2_dbgfs_init(struct mvpp2 *priv, const char *name); void mvpp2_dbgfs_cleanup(struct mvpp2 *priv); +void mvpp2_dbgfs_exit(void); #endif diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c index f9744a61e5dd..d77414e1e704 100644 --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_debugfs.c @@ -660,6 +660,13 @@ static int mvpp2_dbgfs_port_init(struct dentry *parent, return 0; } +static struct dentry *mvpp2_root; + +void mvpp2_dbgfs_exit(void) +{ + debugfs_remove(mvpp2_root); +} + void mvpp2_dbgfs_cleanup(struct mvpp2 *priv) { debugfs_remove_recursive(priv->dbgfs_dir); @@ -667,10 +674,9 @@ void mvpp2_dbgfs_cleanup(struct mvpp2 *priv) void mvpp2_dbgfs_init(struct mvpp2 *priv, const char *name) { - struct dentry *mvpp2_dir, *mvpp2_root; + struct dentry *mvpp2_dir; int ret, i; - mvpp2_root = debugfs_lookup(MVPP2_DRIVER_NAME, NULL); if (!mvpp2_root) { mvpp2_root = debugfs_create_dir(MVPP2_DRIVER_NAME, NULL); if (IS_ERR(mvpp2_root)) diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c index 04bee450eb3d..beb79455adc7 100644 --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c @@ -5412,7 +5412,18 @@ static struct platform_driver mvpp2_driver = { }, }; -module_platform_driver(mvpp2_driver); +static int __init mvpp2_driver_init(void) +{ + return platform_driver_register(&mvpp2_driver); +} +module_init(mvpp2_driver_init); + +static void __exit mvpp2_driver_exit(void) +{ + platform_driver_unregister(&mvpp2_driver); + mvpp2_dbgfs_exit(); +} +module_exit(mvpp2_driver_exit); MODULE_DESCRIPTION("Marvell PPv2 Ethernet Driver - www.marvell.com"); MODULE_AUTHOR("Marcin Wojtas <mw(a)semihalf.com>"); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] kcm: avoid potential race in kcm_tx_work
by Yongqiang Liu 19 Oct '22

19 Oct '22

From: Eric Dumazet <edumazet(a)google.com> mainline inclusion from mainline-v6.1-rc1 commit ec7eede369fe5b0d085ac51fdbb95184f87bfc6c category: bugfix bugzilla: 187823, https://gitee.com/src-openeuler/kernel/issues/I5VZ0N CVE: CVE-2022-3521 -------------------------------- syzbot found that kcm_tx_work() could crash [1] in: /* Primarily for SOCK_SEQPACKET sockets */ if (likely(sk->sk_socket) && test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) { <<*>> clear_bit(SOCK_NOSPACE, &sk->sk_socket->flags); sk->sk_write_space(sk); } I think the reason is that another thread might concurrently run in kcm_release() and call sock_orphan(sk) while sk is not locked. kcm_tx_work() find sk->sk_socket being NULL. [1] BUG: KASAN: null-ptr-deref in instrument_atomic_write include/linux/instrumented.h:86 [inline] BUG: KASAN: null-ptr-deref in clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] BUG: KASAN: null-ptr-deref in kcm_tx_work+0xff/0x160 net/kcm/kcmsock.c:742 Write of size 8 at addr 0000000000000008 by task kworker/u4:3/53 CPU: 0 PID: 53 Comm: kworker/u4:3 Not tainted 5.19.0-rc3-next-20220621-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: kkcmd kcm_tx_work Call Trace: <TASK> __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 kasan_report+0xbe/0x1f0 mm/kasan/report.c:495 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 instrument_atomic_write include/linux/instrumented.h:86 [inline] clear_bit include/asm-generic/bitops/instrumented-atomic.h:41 [inline] kcm_tx_work+0xff/0x160 net/kcm/kcmsock.c:742 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 </TASK> Fixes: ab7ac4eb9832 ("kcm: Kernel Connection Multiplexor module") Reported-by: syzbot <syzkaller(a)googlegroups.com> Signed-off-by: Eric Dumazet <edumazet(a)google.com> Cc: Tom Herbert <tom(a)herbertland.com> Link: https://lore.kernel.org/r/20221012133412.519394-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Baisong Zhong <zhongbaisong(a)huawei.com> Reviewed-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/kcm/kcmsock.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c index b919db02c7f9..dd83837f0fbf 100644 --- a/net/kcm/kcmsock.c +++ b/net/kcm/kcmsock.c @@ -1839,10 +1839,10 @@ static int kcm_release(struct socket *sock) kcm = kcm_sk(sk); mux = kcm->mux; + lock_sock(sk); sock_orphan(sk); kfree_skb(kcm->seq_skb); - lock_sock(sk); /* Purge queue under lock to avoid race condition with tx_work trying * to act when queue is nonempty. If tx_work runs after this point * it will just return. -- 2.25.1

1 0

[PATCH openEuler-5.10 01/47] add config to control detecting conflict of opening block device
by Zheng Zengkai 19 Oct '22

19 Oct '22

From: Li Lingfeng <lilingfeng3(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I53Q6M CVE: NA -------------------------------- We have a feature to add info when opening a write opend block device exclusively. Now we need to add switch to control it. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Reviewed-by: Chao Liu <liuchao173(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/Kconfig | 7 +++++++ fs/block_dev.c | 10 ++++++++++ include/linux/blk_types.h | 2 +- 3 files changed, 18 insertions(+), 1 deletion(-) diff --git a/block/Kconfig b/block/Kconfig index a2297edfdde8..e5c965f1ea25 100644 --- a/block/Kconfig +++ b/block/Kconfig @@ -202,6 +202,13 @@ config BLK_INLINE_ENCRYPTION_FALLBACK by falling back to the kernel crypto API when inline encryption hardware is not present. +config BLK_DEV_DUMPINFO + bool "Enable detecting conflict of opening block device" + default n + help + Dump info when open an write opened block device exclusively + or open an exclusive opened device for write + menu "Partition Types" source "block/partitions/Kconfig" diff --git a/fs/block_dev.c b/fs/block_dev.c index c8a3c93cc256..c55181b4a665 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -1479,6 +1479,7 @@ int bdev_disk_changed(struct block_device *bdev, bool invalidate) */ EXPORT_SYMBOL_GPL(bdev_disk_changed); +#ifdef CONFIG_BLK_DEV_DUMPINFO static void blkdev_dump_conflict_opener(struct block_device *bdev, char *msg) { char name[BDEVNAME_SIZE]; @@ -1512,6 +1513,7 @@ static bool is_conflict_excl_open(struct block_device *bdev, struct block_device return !!whole->bd_write_openers; } +#endif /* * bd_mutex locking: * @@ -1631,6 +1633,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, void *holder, if (for_part) bdev->bd_part_count++; +#ifdef CONFIG_BLK_DEV_DUMPINFO if (!for_part && (mode & FMODE_WRITE)) { spin_lock(&bdev_lock); bdev->bd_write_openers++; @@ -1638,9 +1641,11 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, void *holder, bdev->bd_contains->bd_part_write_openers++; spin_unlock(&bdev_lock); } +#endif if (claiming) { spin_lock(&bdev_lock); +#ifdef CONFIG_BLK_DEV_DUMPINFO /* * Open an write opened block device exclusively, the * writing process may probability corrupt the device, @@ -1649,8 +1654,10 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, void *holder, if (is_conflict_excl_open(bdev, claiming, mode)) blkdev_dump_conflict_opener(bdev, "VFS: Open an write opened " "block device exclusively"); +#endif bd_finish_claiming(bdev, claiming, holder); spin_unlock(&bdev_lock); +#ifdef CONFIG_BLK_DEV_DUMPINFO } else if (!for_part && (mode & FMODE_WRITE)) { spin_lock(&bdev_lock); /* @@ -1663,6 +1670,7 @@ static int __blkdev_get(struct block_device *bdev, fmode_t mode, void *holder, blkdev_dump_conflict_opener(bdev, "VFS: Open an exclusive opened " "block device for write"); spin_unlock(&bdev_lock); +#endif } /* @@ -1881,6 +1889,7 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part) if (for_part) bdev->bd_part_count--; +#ifdef CONFIG_BLK_DEV_DUMPINFO if (!for_part && (mode & FMODE_WRITE)) { spin_lock(&bdev_lock); bdev->bd_write_openers--; @@ -1888,6 +1897,7 @@ static void __blkdev_put(struct block_device *bdev, fmode_t mode, int for_part) bdev->bd_contains->bd_part_write_openers--; spin_unlock(&bdev_lock); } +#endif if (!--bdev->bd_openers) { WARN_ON_ONCE(bdev->bd_holders); diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h index bbb62ff84601..fbea6b0aef3e 100644 --- a/include/linux/blk_types.h +++ b/include/linux/blk_types.h @@ -48,7 +48,7 @@ struct block_device { int bd_fsfreeze_count; /* Mutex for freeze */ struct mutex bd_fsfreeze_mutex; -#ifndef __GENKSYMS__ +#if defined(CONFIG_BLK_DEV_DUMPINFO) && !defined(__GENKSYMS__) KABI_USE2(1, int bd_write_openers, int bd_part_write_openers); #else KABI_RESERVE(1) -- 2.20.1

1 46

[PATCH openEuler-5.10-LTS 000/168] Backport 5.10.122 LTS
by Zheng Zengkai 18 Oct '22

18 Oct '22

Backport 5.10.122 LTS patches from upstream. git cherry-pick v5.10.121..v5.10.122~1 -s Already merged(-6): 36ee9ffca8ef driver core: fix deadlock in __device_attach 6d8d3f68cbec ubi: ubi_create_volume: Fix use-after-free when volume creation failed c0868f6e728c nbd: call genl_unregister_family() first in nbd_cleanup() 122e4adaff24 nbd: fix race between nbd_alloc_config() and module removal f72df77600a4 nbd: fix io hung while disconnecting device 3be74fc0afbe powerpc/32: Fix overread/overwrite of thread_struct via ptrace Total patches: 174 - 6 = 168 Adrian Hunter (1): mmc: block: Fix CQE recovery reset success Alexander Lobakin (1): modpost: fix removing numeric suffixes Alexandru Tachici (1): iio: adc: ad7124: Remove shift from scan_type Alexey Kardashevskiy (1): powerpc/mm: Switch obsolete dssall to .long Andre Przywara (1): clocksource/drivers/sp804: Avoid error on multiple instances Baokun Li (1): jffs2: fix memory leak in jffs2_do_fill_super Bjorn Andersson (1): usb: typec: mux: Check dev_set_name() return value Brian Norris (2): drm/bridge: analogix_dp: Support PSR-exit to disable transition drm/atomic: Force bridge self-refresh-exit on CRTC switch Cameron Berkenpas (1): ALSA: hda/realtek: Fix for quirk to enable speaker output on the Lenovo Yoga DuetITL 2021 Changbin Du (1): sysrq: do not omit current cpu when showing backtrace of all active CPUs Changcheng Liu (1): net/mlx5: correct ECE offset in query qp output Christian Borntraeger (1): s390/gmap: voluntarily schedule during key setting Christophe JAILLET (1): staging: fieldbus: Fix the error handling path in anybuss_host_common_probe() Chuck Lever (1): SUNRPC: Fix the calculation of xdr->end in xdr_get_next_encode_buffer() Cixi Geng (2): iio: adc: sc27xx: fix read big scale voltage not right iio: adc: sc27xx: Fine tune the scale calibration values Damien Le Moal (2): scsi: sd: Fix potential NULL pointer dereference zonefs: fix handling of explicit_open option on mount Dan Carpenter (1): net: ethernet: mtk_eth_soc: out of bounds read in mtk_hwlro_get_fdir_entry() Daniel Gibson (1): tty: n_tty: Restore EOF push handling behavior Dave Jiang (2): dmaengine: idxd: set DMA_INTERRUPT cap bit dmaengine: idxd: add missing callback function to support DMA_INTERRUPT David Howells (1): afs: Fix infinite loop found by xfstest generic/676 Dongliang Mu (1): f2fs: remove WARN_ON in f2fs_is_valid_blkaddr Duoming Zhou (4): drivers: staging: rtl8192u: Fix deadlock in ieee80211_beacons_stop() drivers: staging: rtl8192e: Fix deadlock in rtllib_beacons_stop() drivers: tty: serial: Fix deadlock in sa1100_set_termios() drivers: usb: host: Fix deadlock in oxu_bus_suspend() Eric Dumazet (3): tcp: tcp_rtx_synack() can be called from process context bpf, arm64: Clear prog->jited_len along prog->jited tcp: fix tcp_mtup_probe_success vs wrong snd_cwnd Evan Green (1): USB: hcd-pci: Fully suspend across freeze/thaw cycle Feras Daoud (1): net/mlx5: Rearm the FW tracer after each tracer event Florian Westphal (1): netfilter: nat: really support inet nat without l3 address Gal Pressman (1): net/mlx4_en: Fix wrong return value on ioctl EEPROM query failure Gong Yuanjun (2): mips: cpc: Fix refcount leak in mips_cpc_default_phys_base drm/radeon: fix a possible null pointer dereference Greg Ungerer (2): m68knommu: set ZERO_PAGE() to the allocated zeroed page m68knommu: fix undefined reference to `_init_sp' Guangguan Wang (1): net/smc: fixes for converting from "struct smc_cdc_tx_pend **" to "struct smc_wr_tx_pend_priv *" Guilherme G. Piccoli (1): coresight: cpu-debug: Replace mutex with mutex_trylock on panic notifier Guoju Fang (1): net: sched: add barrier to fix packet stuck problem for lockless qdisc Guoqing Jiang (1): md: protect md_unregister_thread from reentrancy Haibo Chen (1): gpio: pca953x: use the correct register address to do regcache sync Hangyu Hua (1): usb: usbip: fix a refcount leak in stub_probe() Hannes Reinecke (1): scsi: myrb: Fix up null pointer access on myrb_cleanup() Hao Luo (1): kernfs: Separate kernfs_pr_cont_buf and rename_lock. Heinrich Schuchardt (1): riscv: read-only pages should not be writable Hoang Le (1): tipc: check attribute length for bearer name Huang Guobin (1): tty: Fix a possible resource leak in icom_probe Ilpo Järvinen (8): serial: 8250_fintek: Check SER_RS485_RTS_* only with RS485 serial: digicolor-usart: Don't allow CS5-6 serial: rda-uart: Don't allow CS5-6 serial: txx9: Don't allow CS5-6 serial: sh-sci: Don't allow CS5-6 serial: sifive: Sanitize CSIZE and c_iflag serial: st-asc: Sanitize CSIZE and correct PARENB for CS7 serial: stm32-usart: Correct CSIZE, bits, and parity Jakob Koschel (1): staging: greybus: codecs: fix type confusion of list iterator variable Jann Horn (1): s390/crypto: fix scatterwalk_unmap() callers in AES-GCM Jiasheng Jiang (1): lkdtm/bugs: Check for the NULL pointer after calling kmalloc Johan Hovold (2): phy: qcom-qmp: fix pipe-clock imbalance on power-on failure PCI: qcom: Fix pipe clock imbalance John Ogness (2): serial: meson: acquire port->lock in startup() serial: msm_serial: disable interrupts in __msm_console_write() Jun Miao (1): tracing: Fix sleeping function called from invalid context on RT kernel Kees Cook (2): lkdtm/usercopy: Expand size of "out of frame" object nodemask: Fix return values to be unsigned Kinglong Mee (1): xprtrdma: treat all calls not a bcall when bc_serv is NULL Krzysztof Kozlowski (3): rpmsg: qcom_smd: Fix irq_of_parse_and_map() return value rpmsg: qcom_smd: Fix returning 0 if irq_of_parse_and_map() fails clocksource/drivers/oxnas-rps: Fix irq_of_parse_and_map() return value Kuan-Ying Lee (1): scripts/gdb: change kernel config dumping method Kuniyuki Iwashima (1): af_unix: Fix a data-race in unix_dgram_peer_wake_me(). Leo Yan (1): perf c2c: Fix sorting in percent_rmt_hitm_cmp() Leon Romanovsky (1): net/mlx5: Don't use already freed action pointer Li Jun (1): extcon: ptn5150: Add queue work sync before driver release Lin Ma (1): USB: storage: karma: fix rio_karma_init return Linus Torvalds (1): drm: imx: fix compiler warning with gcc-12 Liu Xinpeng (1): watchdog: wdat_wdt: Stop watchdog when rebooting the system Lucas Tanure (1): i2c: cadence: Increase timeout per message if necessary Maciej W. Rozycki (1): serial: sifive: Report actual baud base rather than fixed 115200 Marek Szyprowski (1): usb: dwc2: gadget: don't reset gadget's driver->bus Mark Bloch (1): net/mlx5: fs, fail conflicting actions Mark-PK Tsai (1): tracing: Avoid adding tracer option before update_tracer_options Martin Faltesek (3): nfc: st21nfca: fix incorrect validating logic in EVT_TRANSACTION nfc: st21nfca: fix memory leaks in EVT_TRANSACTION handling nfc: st21nfca: fix incorrect sizing calculations in EVT_TRANSACTION Martin Habets (1): sfc: fix considering that all channels have TX queues Masahiro Yamada (5): xen: unexport __init-annotated xen_xlate_map_ballooned_pages() net: mdio: unexport __init-annotated mdio_bus_init() net: xfrm: unexport __init-annotated xfrm4_protocol_init() net: ipv6: unexport __init-annotated seg6_hmac_init() modpost: fix undefined behavior of is_arm_mapping_symbol() Masami Hiramatsu (1): bootconfig: Make the bootconfig.o as a normal object file Mathias Nyman (1): Input: bcm5974 - set missing URB_NO_TRANSFER_DMA_MAP urb flag Maxim Mikityanskiy (1): net/mlx5e: Update netdev features after changing XDP state Menglong Dong (1): bpf: Fix probe read error in ___bpf_prog_run() Miaoqian Lin (13): tty: serial: owl: Fix missing clk_disable_unprepare() in owl_uart_probe usb: musb: Fix missing of_node_put() in omap2430_probe iio: adc: stmpe-adc: Fix wait_for_completion_timeout return value check iio: proximity: vl53l0x: Fix return value check of wait_for_completion_timeout soc: rockchip: Fix refcount leak in rockchip_grf_init firmware: dmi-sysfs: Fix memory leak in dmi_sysfs_register_handle watchdog: rti-wdt: Fix pm_runtime_get_sync() error checking watchdog: ts4800_wdt: Fix refcount leak in ts4800_wdt_probe net: ethernet: ti: am65-cpsw-nuss: Fix some refcount leaks net: dsa: mv88e6xxx: Fix refcount leak in mv88e6xxx_mdios_register ata: pata_octeon_cf: Fix refcount leak in octeon_cf_probe net: dsa: lantiq_gswip: Fix refcount leak in gswip_gphy_fw_list net: altera: Fix refcount leak in altera_tse_mdio_create Michael Ellerman (1): powerpc/kasan: Force thread size increase with KASAN Michal Kubecek (1): Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process" Miquel Raynal (1): iio: st_sensors: Add a local lock for protecting odr Niels Dossche (1): usb: usbip: add missing device lock on tweak configuration cmd Olivier Matz (2): ixgbe: fix bcast packets Rx on VF after promisc removal ixgbe: fix unexpected VLAN Rx in promisc mode on VF Pablo Neira Ayuso (5): netfilter: nf_tables: delete flowtable hooks via transaction list netfilter: nf_tables: always initialize flowtable hook list in transaction netfilter: nf_tables: release new hooks on unsupported flowtable flags netfilter: nf_tables: memleak flow rule from commit path netfilter: nf_tables: bail out early if hardware offload is not supported Pascal Hambourg (1): md/raid0: Ignore RAID0 layout if the second zone has only one device Paulo Alcantara (1): cifs: fix reconnect on smb3 mount types Peter Zijlstra (2): x86/cpu: Elide KCSAN for cpu_has() and friends jump_label,noinstr: Avoid instrumentation for JUMP_LABEL=n builds Radhey Shyam Pandey (1): dmaengine: zynqmp_dma: In struct zynqmp_dma_chan fix desc_size data type Randy Dunlap (1): pcmcia: db1xxx_ss: restrict to MIPS_DB1XXX boards Samuel Holland (1): clocksource/drivers/riscv: Events are stopped during CPU suspend Saravana Kannan (1): driver core: Fix wait_for_device_probe() & deferred_probe_timeout interaction Saurabh Sengar (1): video: fbdev: hyperv_fb: Allow resolutions with size > 64 MB for Gen1 Schspa Shi (1): driver: base: fix UAF when driver_attach failed Sergey Shtylyov (1): ata: libata-transport: fix {dma|pio|xfer}_mode sysfs files Shengjiu Wang (1): ASoC: fsl_sai: Fix FSL_SAI_xDR/xFR definition Sherry Sun (1): tty: serial: fsl_lpuart: fix potential bug when using both of_alias_get_id and ida_simple_get Shuah Khan (1): misc: rtsx: set NULL intfdata when probe fails Shyam Prasad N (1): cifs: return errors during session setup during reconnects Stephen Boyd (2): interconnect: qcom: sc7180: Drop IP0 interconnects interconnect: Restore sync state by ignoring ipa-virt in provider count Steve French (1): cifs: version operations for smb20 unneeded when legacy support disabled Tan Tee Min (1): net: phy: dp83867: retrigger SGMII AN when link change Tony Lindgren (1): bus: ti-sysc: Fix warnings for unbind for serial Trond Myklebust (1): NFSv4: Don't hold the layoutget locks across multiple RPC calls Uwe Kleine-König (1): pwm: lp3943: Fix duty calculation in case period was clamped Venky Shankar (1): ceph: allow ceph.dir.rctime xattr to be updatable Vincent Ray (1): net: sched: fixed barrier to prevent skbuff sticking in qdisc backlog Wang Cheng (2): staging: rtl8712: fix uninit-value in usb_read8() and friends staging: rtl8712: fix uninit-value in r871xu_drv_init() Wang Weiyang (1): tty: goldfish: Use tty_port_destroy() to destroy port Willem de Bruijn (1): ip_gre: test csum_start instead of transport header Xiaoke Wang (2): iio: dummy: iio_simple_dummy: check the return value of kstrdup() staging: rtl8712: fix a potential memory leak in r871xu_drv_init() Xiaomeng Tong (2): misc: fastrpc: fix an incorrect NULL check on list iterator firmware: stratix10-svc: fix a missing check on list iterator Xie Yongji (1): vringh: Fix loop descriptors check in the indirect cases Yang Yingliang (4): rtc: mt6397: check return value after calling platform_get_resource() iommu/arm-smmu: fix possible null-ptr-deref in arm_smmu_device_probe() iommu/arm-smmu-v3: check return value after calling platform_get_resource() video: fbdev: pxa3xx-gcu: release the resources correctly in pxa3xx_gcu_probe/remove() Yu Xiao (1): nfp: only report pause frame configuration for physical device Zhen Ni (1): USB: host: isp116x: check return value after calling platform_get_resource() Zheng Yongjun (1): usb: dwc3: pci: Fix pm_runtime_get_sync() error checking Zheyu Ma (1): tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() Zhihao Cheng (1): ubi: fastmap: Fix high cpu usage of ubi_bgt by making sure wl_pool not empty bumwoo lee (1): extcon: Modify extcon device to be created after driver data is set huangwenhui (1): ALSA: hda/conexant - Fix loopback issue with CX20632 Íñigo Huguet (1): sfc: fix wrong tx channel offset with efx_separate_tx_channels Documentation/ABI/testing/sysfs-ata | 11 ++-- arch/arm64/net/bpf_jit_comp.c | 1 + arch/m68k/Kconfig.machine | 1 + arch/m68k/include/asm/pgtable_no.h | 3 +- arch/mips/kernel/mips-cpc.c | 1 + arch/powerpc/Kconfig | 1 - arch/powerpc/include/asm/ppc-opcode.h | 2 + arch/powerpc/include/asm/thread_info.h | 10 +++- arch/powerpc/kernel/idle.c | 2 +- arch/powerpc/kernel/idle_6xx.S | 2 +- arch/powerpc/kernel/l2cr_6xx.S | 6 +-- arch/powerpc/kernel/swsusp_32.S | 2 +- arch/powerpc/kernel/swsusp_asm64.S | 2 +- arch/powerpc/mm/mmu_context.c | 2 +- arch/powerpc/platforms/powermac/cache.S | 4 +- arch/riscv/kernel/efi.c | 2 +- arch/s390/crypto/aes_s390.c | 4 +- arch/s390/mm/gmap.c | 14 +++++ arch/x86/include/asm/cpufeature.h | 2 +- drivers/ata/libata-transport.c | 2 +- drivers/ata/pata_octeon_cf.c | 3 ++ drivers/base/bus.c | 4 +- drivers/base/dd.c | 5 -- drivers/bus/ti-sysc.c | 4 +- drivers/clocksource/timer-oxnas-rps.c | 2 +- drivers/clocksource/timer-riscv.c | 2 +- drivers/clocksource/timer-sp804.c | 10 ++-- drivers/dma/idxd/dma.c | 23 ++++++++ drivers/dma/xilinx/zynqmp_dma.c | 5 +- drivers/extcon/extcon-ptn5150.c | 11 ++++ drivers/extcon/extcon.c | 29 +++++----- drivers/firmware/dmi-sysfs.c | 2 +- drivers/firmware/stratix10-svc.c | 12 ++--- drivers/gpio/gpio-pca953x.c | 19 ++++--- .../drm/bridge/analogix/analogix_dp_core.c | 42 +++++++++++++-- drivers/gpu/drm/drm_atomic_helper.c | 16 ++++-- drivers/gpu/drm/imx/ipuv3-crtc.c | 2 +- drivers/gpu/drm/radeon/radeon_connectors.c | 4 ++ .../hwtracing/coresight/coresight-cpu-debug.c | 7 +-- drivers/i2c/busses/i2c-cadence.c | 12 ++++- drivers/iio/adc/ad7124.c | 1 - drivers/iio/adc/sc27xx_adc.c | 20 +++---- drivers/iio/adc/stmpe-adc.c | 8 +-- .../iio/common/st_sensors/st_sensors_core.c | 24 ++++++--- drivers/iio/dummy/iio_simple_dummy.c | 20 ++++--- drivers/iio/proximity/vl53l0x-i2c.c | 7 ++- drivers/input/mouse/bcm5974.c | 7 ++- drivers/interconnect/core.c | 7 ++- drivers/interconnect/qcom/sc7180.c | 21 -------- drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 2 + drivers/iommu/arm/arm-smmu/arm-smmu.c | 5 +- drivers/md/md.c | 15 ++++-- drivers/md/raid0.c | 31 +++++------ drivers/misc/cardreader/rtsx_usb.c | 1 + drivers/misc/fastrpc.c | 9 ++-- drivers/misc/lkdtm/bugs.c | 5 ++ drivers/misc/lkdtm/usercopy.c | 17 ++++-- drivers/mmc/core/block.c | 3 +- drivers/mtd/ubi/ubi.h | 4 +- drivers/net/dsa/lantiq_gswip.c | 4 +- drivers/net/dsa/mv88e6xxx/chip.c | 1 + drivers/net/ethernet/altera/altera_tse_main.c | 6 ++- .../net/ethernet/intel/ixgbe/ixgbe_sriov.c | 8 +-- drivers/net/ethernet/mediatek/mtk_eth_soc.c | 3 ++ .../net/ethernet/mellanox/mlx4/en_ethtool.c | 2 +- .../mellanox/mlx5/core/diag/fw_tracer.c | 7 ++- .../net/ethernet/mellanox/mlx5/core/en_main.c | 5 ++ .../net/ethernet/mellanox/mlx5/core/fs_core.c | 35 ++++++++++-- .../mellanox/mlx5/core/steering/fs_dr.c | 9 ++-- .../ethernet/netronome/nfp/nfp_net_ethtool.c | 4 +- drivers/net/ethernet/sfc/efx_channels.c | 6 +-- drivers/net/ethernet/sfc/net_driver.h | 2 +- drivers/net/ethernet/ti/am65-cpsw-nuss.c | 3 +- drivers/net/phy/dp83867.c | 29 ++++++++++ drivers/net/phy/mdio_bus.c | 1 - drivers/nfc/st21nfca/se.c | 53 +++++++++++-------- drivers/pci/controller/dwc/pcie-qcom.c | 6 --- drivers/pcmcia/Kconfig | 2 +- drivers/phy/qualcomm/phy-qcom-qmp.c | 2 +- drivers/pwm/pwm-lp3943.c | 1 + drivers/rpmsg/qcom_smd.c | 4 +- drivers/rtc/rtc-mt6397.c | 2 + drivers/scsi/myrb.c | 11 ++-- drivers/scsi/sd.c | 1 - drivers/soc/rockchip/grf.c | 2 + drivers/staging/fieldbus/anybuss/host.c | 2 +- drivers/staging/greybus/audio_codec.c | 4 +- drivers/staging/rtl8192e/rtllib_softmac.c | 2 +- .../rtl8192u/ieee80211/ieee80211_softmac.c | 2 +- drivers/staging/rtl8712/os_intfs.c | 1 - drivers/staging/rtl8712/usb_intf.c | 12 ++--- drivers/staging/rtl8712/usb_ops.c | 27 ++++++---- drivers/tty/goldfish.c | 2 + drivers/tty/n_tty.c | 38 ++++++++++++- drivers/tty/serial/8250/8250_fintek.c | 8 +-- drivers/tty/serial/digicolor-usart.c | 2 + drivers/tty/serial/fsl_lpuart.c | 24 ++------- drivers/tty/serial/icom.c | 2 +- drivers/tty/serial/meson_uart.c | 13 +++++ drivers/tty/serial/msm_serial.c | 5 ++ drivers/tty/serial/owl-uart.c | 1 + drivers/tty/serial/rda-uart.c | 2 + drivers/tty/serial/sa1100.c | 4 +- drivers/tty/serial/serial_txx9.c | 2 + drivers/tty/serial/sh-sci.c | 6 ++- drivers/tty/serial/sifive.c | 8 ++- drivers/tty/serial/st-asc.c | 4 ++ drivers/tty/serial/stm32-usart.c | 15 ++++-- drivers/tty/synclink_gt.c | 2 + drivers/tty/sysrq.c | 13 +++-- drivers/usb/core/hcd-pci.c | 4 +- drivers/usb/dwc2/gadget.c | 1 - drivers/usb/dwc3/dwc3-pci.c | 2 +- drivers/usb/host/isp116x-hcd.c | 6 ++- drivers/usb/host/oxu210hp-hcd.c | 2 + drivers/usb/musb/omap2430.c | 1 + drivers/usb/storage/karma.c | 15 +++--- drivers/usb/typec/mux.c | 14 +++-- drivers/usb/usbip/stub_dev.c | 2 +- drivers/usb/usbip/stub_rx.c | 2 + drivers/vhost/vringh.c | 10 +++- drivers/video/fbdev/hyperv_fb.c | 19 +------ drivers/video/fbdev/pxa3xx-gcu.c | 12 +++-- drivers/watchdog/rti_wdt.c | 2 +- drivers/watchdog/ts4800_wdt.c | 5 +- drivers/watchdog/wdat_wdt.c | 1 + drivers/xen/xlate_mmu.c | 1 - fs/afs/dir.c | 5 +- fs/ceph/xattr.c | 10 +++- fs/cifs/cifsfs.c | 2 +- fs/cifs/cifsfs.h | 2 +- fs/cifs/cifsglob.h | 4 +- fs/cifs/misc.c | 27 ++++++---- fs/cifs/smb2ops.c | 7 ++- fs/cifs/smb2pdu.c | 3 ++ fs/f2fs/checkpoint.c | 4 +- fs/jffs2/fs.c | 1 + fs/kernfs/dir.c | 31 ++++++----- fs/nfs/nfs4proc.c | 4 ++ fs/zonefs/super.c | 11 ++-- include/linux/iio/common/st_sensors.h | 3 ++ include/linux/jump_label.h | 4 +- include/linux/mlx5/mlx5_ifc.h | 5 +- include/linux/nodemask.h | 38 ++++++------- include/net/flow_offload.h | 1 + include/net/netfilter/nf_tables.h | 1 - include/net/netfilter/nf_tables_offload.h | 2 +- include/net/sch_generic.h | 42 +++++---------- kernel/bpf/core.c | 14 ++--- kernel/trace/trace.c | 13 +++-- lib/Makefile | 2 +- lib/nodemask.c | 4 +- net/core/flow_offload.c | 6 +++ net/ipv4/ip_gre.c | 11 ++-- net/ipv4/tcp_input.c | 11 ++-- net/ipv4/tcp_output.c | 4 +- net/ipv4/xfrm4_protocol.c | 1 - net/ipv6/seg6_hmac.c | 1 - net/key/af_key.c | 10 ++-- net/netfilter/nf_tables_api.c | 52 ++++++++---------- net/netfilter/nf_tables_offload.c | 23 +++++++- net/netfilter/nft_nat.c | 3 +- net/smc/smc_cdc.c | 2 +- net/sunrpc/xdr.c | 6 ++- net/sunrpc/xprtrdma/rpc_rdma.c | 5 ++ net/tipc/bearer.c | 3 +- net/unix/af_unix.c | 2 +- scripts/gdb/linux/config.py | 6 +-- scripts/mod/modpost.c | 5 +- sound/pci/hda/patch_conexant.c | 7 +++ sound/pci/hda/patch_realtek.c | 1 + sound/soc/fsl/fsl_sai.h | 4 +- tools/perf/builtin-c2c.c | 4 +- tools/testing/selftests/netfilter/nft_nat.sh | 43 +++++++++++++++ 174 files changed, 946 insertions(+), 508 deletions(-) -- 2.20.1

1 168

[PATCH openEuler-22.03-LTS-Ascend 01/79] mm/sharepool: Support read-only memory allocation
by Zheng Zengkai 18 Oct '22

18 Oct '22

From: Zhou Guanghui <zhouguanghui1(a)huawei.com> Offering: HULK ascend inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5DS9S -------------------------------- When the driver uses the shared pool memory to share the memory with the user space, the user space is not allowed to operate this area. This prevents users from damaging sensitive data. When the sp_alloc and k2u processes apply for private memory, read-only memory can be applied for. Signed-off-by: Zhou Guanghui <zhouguanghui1(a)huawei.com> --- include/linux/share_pool.h | 3 ++- mm/share_pool.c | 18 ++++++++++++++++-- 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/include/linux/share_pool.h b/include/linux/share_pool.h index 6f294911c6af..5539a17da7a9 100644 --- a/include/linux/share_pool.h +++ b/include/linux/share_pool.h @@ -15,6 +15,7 @@ #define SP_HUGEPAGE_ONLY (1 << 1) #define SP_DVPP (1 << 2) #define SP_SPEC_NODE_ID (1 << 3) +#define SP_PROT_RO (1 << 16) #define DEVICE_ID_BITS 4UL #define DEVICE_ID_MASK ((1UL << DEVICE_ID_BITS) - 1UL) @@ -24,7 +25,7 @@ #define NODE_ID_SHIFT (DEVICE_ID_SHIFT + DEVICE_ID_BITS) #define SP_FLAG_MASK (SP_HUGEPAGE | SP_HUGEPAGE_ONLY | SP_DVPP | \ - SP_SPEC_NODE_ID | \ + SP_SPEC_NODE_ID | SP_PROT_RO | \ (DEVICE_ID_MASK << DEVICE_ID_SHIFT) | \ (NODE_ID_MASK << NODE_ID_SHIFT)) diff --git a/mm/share_pool.c b/mm/share_pool.c index 76088952d0a5..99f25a551afc 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -2331,6 +2331,9 @@ static int sp_alloc_mmap(struct mm_struct *mm, struct sp_area *spa, if (spg_node) prot = spg_node->prot; + if (ac->sp_flags & SP_PROT_RO) + prot = PROT_READ; + /* when success, mmap_addr == spa->va_start */ mmap_addr = sp_mmap(mm, spa_file(spa), spa, &populate, prot); if (IS_ERR_VALUE(mmap_addr)) { @@ -2355,6 +2358,10 @@ static int sp_alloc_mmap(struct mm_struct *mm, struct sp_area *spa, ret = -EINVAL; goto unmap; } + + if (ac->sp_flags & SP_PROT_RO) + vma->vm_flags &= ~VM_MAYWRITE; + /* clean PTE_RDONLY flags or trigger SMMU event */ if (prot & PROT_WRITE) vma->vm_page_prot = __pgprot(((~PTE_RDONLY) & vma->vm_page_prot.pgprot) | PTE_DIRTY); @@ -2650,6 +2657,9 @@ static unsigned long sp_remap_kva_to_vma(unsigned long kva, struct sp_area *spa, goto put_mm; } + if (kc && kc->sp_flags & SP_PROT_RO) + prot = PROT_READ; + ret_addr = sp_mmap(mm, spa_file(spa), spa, &populate, prot); if (IS_ERR_VALUE(ret_addr)) { pr_debug("k2u mmap failed %lx\n", ret_addr); @@ -2662,6 +2672,9 @@ static unsigned long sp_remap_kva_to_vma(unsigned long kva, struct sp_area *spa, if (prot & PROT_WRITE) vma->vm_page_prot = __pgprot(((~PTE_RDONLY) & vma->vm_page_prot.pgprot) | PTE_DIRTY); + if (kc && kc->sp_flags & SP_PROT_RO) + vma->vm_flags &= ~VM_MAYWRITE; + if (is_vm_hugetlb_page(vma)) { ret = remap_vmalloc_hugepage_range(vma, (void *)kva, 0); if (ret) { @@ -2713,6 +2726,7 @@ static void *sp_make_share_kva_to_task(unsigned long kva, unsigned long size, un struct sp_area *spa; struct spg_proc_stat *stat; unsigned long prot = PROT_READ | PROT_WRITE; + struct sp_k2u_context kc; down_write(&sp_group_sem); stat = sp_init_process_stat(current, current->mm, spg_none); @@ -2731,8 +2745,8 @@ static void *sp_make_share_kva_to_task(unsigned long kva, unsigned long size, un } spa->kva = kva; - - uva = (void *)sp_remap_kva_to_vma(kva, spa, current->mm, prot, NULL); + kc.sp_flags = sp_flags; + uva = (void *)sp_remap_kva_to_vma(kva, spa, current->mm, prot, &kc); __sp_area_drop(spa); if (IS_ERR(uva)) pr_err("remap k2u to task failed %ld\n", PTR_ERR(uva)); -- 2.20.1

1 78

[PATCH openEuler-5.10-LTS 01/12] mm/rmap: Fix anon_vma->degree ambiguity leading to double-reuse
by Zheng Zengkai 18 Oct '22

18 Oct '22

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v5.10.141 commit 98f401d36396134c0c86e9e3bd00b6b6b028b521 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5USOP CVE: CVE-2022-42703 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2555283eb40df89945557273121e9393ef9b542b upstream. anon_vma->degree tracks the combined number of child anon_vmas and VMAs that use the anon_vma as their ->anon_vma. anon_vma_clone() then assumes that for any anon_vma attached to src->anon_vma_chain other than src->anon_vma, it is impossible for it to be a leaf node of the VMA tree, meaning that for such VMAs ->degree is elevated by 1 because of a child anon_vma, meaning that if ->degree equals 1 there are no VMAs that use the anon_vma as their ->anon_vma. This assumption is wrong because the ->degree optimization leads to leaf nodes being abandoned on anon_vma_clone() - an existing anon_vma is reused and no new parent-child relationship is created. So it is possible to reuse an anon_vma for one VMA while it is still tied to another VMA. This is an issue because is_mergeable_anon_vma() and its callers assume that if two VMAs have the same ->anon_vma, the list of anon_vmas attached to the VMAs is guaranteed to be the same. When this assumption is violated, vma_merge() can merge pages into a VMA that is not attached to the corresponding anon_vma, leading to dangling page->mapping pointers that will be dereferenced during rmap walks. Fix it by separately tracking the number of child anon_vmas and the number of VMAs using the anon_vma as their ->anon_vma. Fixes: 7a3ef208e662 ("mm: prevent endless growth of anon_vma hierarchy") Cc: stable(a)kernel.org Acked-by: Michal Hocko <mhocko(a)suse.com> Acked-by: Vlastimil Babka <vbabka(a)suse.cz> Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/rmap.h | 7 +++++-- mm/rmap.c | 29 ++++++++++++++++------------- 2 files changed, 21 insertions(+), 15 deletions(-) diff --git a/include/linux/rmap.h b/include/linux/rmap.h index 8d04e7deedc6..297744ea4dd0 100644 --- a/include/linux/rmap.h +++ b/include/linux/rmap.h @@ -39,12 +39,15 @@ struct anon_vma { atomic_t refcount; /* - * Count of child anon_vmas and VMAs which points to this anon_vma. + * Count of child anon_vmas. Equals to the count of all anon_vmas that + * have ->parent pointing to this one, including itself. * * This counter is used for making decision about reusing anon_vma * instead of forking new one. See comments in function anon_vma_clone. */ - unsigned degree; + unsigned long num_children; + /* Count of VMAs whose ->anon_vma pointer points to this object. */ + unsigned long num_active_vmas; struct anon_vma *parent; /* Parent of this anon_vma */ diff --git a/mm/rmap.c b/mm/rmap.c index 0dc39cf94345..d0ef90af0567 100644 --- a/mm/rmap.c +++ b/mm/rmap.c @@ -89,7 +89,8 @@ static inline struct anon_vma *anon_vma_alloc(void) anon_vma = kmem_cache_alloc(anon_vma_cachep, GFP_KERNEL); if (anon_vma) { atomic_set(&anon_vma->refcount, 1); - anon_vma->degree = 1; /* Reference for first vma */ + anon_vma->num_children = 0; + anon_vma->num_active_vmas = 0; anon_vma->parent = anon_vma; /* * Initialise the anon_vma root to point to itself. If called @@ -197,6 +198,7 @@ int __anon_vma_prepare(struct vm_area_struct *vma) anon_vma = anon_vma_alloc(); if (unlikely(!anon_vma)) goto out_enomem_free_avc; + anon_vma->num_children++; /* self-parent link for new root */ allocated = anon_vma; } @@ -206,8 +208,7 @@ int __anon_vma_prepare(struct vm_area_struct *vma) if (likely(!vma->anon_vma)) { vma->anon_vma = anon_vma; anon_vma_chain_link(vma, avc, anon_vma); - /* vma reference or self-parent link for new root */ - anon_vma->degree++; + anon_vma->num_active_vmas++; allocated = NULL; avc = NULL; } @@ -292,19 +293,19 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src) anon_vma_chain_link(dst, avc, anon_vma); /* - * Reuse existing anon_vma if its degree lower than two, - * that means it has no vma and only one anon_vma child. + * Reuse existing anon_vma if it has no vma and only one + * anon_vma child. * - * Do not chose parent anon_vma, otherwise first child - * will always reuse it. Root anon_vma is never reused: + * Root anon_vma is never reused: * it has self-parent reference and at least one child. */ if (!dst->anon_vma && src->anon_vma && - anon_vma != src->anon_vma && anon_vma->degree < 2) + anon_vma->num_children < 2 && + anon_vma->num_active_vmas == 0) dst->anon_vma = anon_vma; } if (dst->anon_vma) - dst->anon_vma->degree++; + dst->anon_vma->num_active_vmas++; unlock_anon_vma_root(root); return 0; @@ -354,6 +355,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) anon_vma = anon_vma_alloc(); if (!anon_vma) goto out_error; + anon_vma->num_active_vmas++; avc = anon_vma_chain_alloc(GFP_KERNEL); if (!avc) goto out_error_free_anon_vma; @@ -374,7 +376,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma) vma->anon_vma = anon_vma; anon_vma_lock_write(anon_vma); anon_vma_chain_link(vma, avc, anon_vma); - anon_vma->parent->degree++; + anon_vma->parent->num_children++; anon_vma_unlock_write(anon_vma); return 0; @@ -406,7 +408,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma) * to free them outside the lock. */ if (RB_EMPTY_ROOT(&anon_vma->rb_root.rb_root)) { - anon_vma->parent->degree--; + anon_vma->parent->num_children--; continue; } @@ -414,7 +416,7 @@ void unlink_anon_vmas(struct vm_area_struct *vma) anon_vma_chain_free(avc); } if (vma->anon_vma) { - vma->anon_vma->degree--; + vma->anon_vma->num_active_vmas--; /* * vma would still be needed after unlink, and anon_vma will be prepared @@ -432,7 +434,8 @@ void unlink_anon_vmas(struct vm_area_struct *vma) list_for_each_entry_safe(avc, next, &vma->anon_vma_chain, same_vma) { struct anon_vma *anon_vma = avc->anon_vma; - VM_WARN_ON(anon_vma->degree); + VM_WARN_ON(anon_vma->num_children); + VM_WARN_ON(anon_vma->num_active_vmas); put_anon_vma(anon_vma); list_del(&avc->same_vma); -- 2.20.1

1 11

[PATCH openEuler-1.0-LTS] fbdev: smscufx: Fix use-after-free in ufx_ops_open()
by Yongqiang Liu 18 Oct '22

18 Oct '22

From: Hyunwoo Kim <imv4bel(a)gmail.com> mainline inclusion from mainline-v6.0-rc1 commit 5610bcfe8693c02e2e4c8b31427f1bdbdecc839c category: bugfix bugzilla: 187798, https://gitee.com/src-openeuler/kernel/issues/I5U1NZ CVE: CVE-2022-41849 -------------------------------- A race condition may occur if the user physically removes the USB device while calling open() for this device node. This is a race condition between the ufx_ops_open() function and the ufx_usb_disconnect() function, which may eventually result in UAF. So, add a mutex to the ufx_ops_open() and ufx_usb_disconnect() functions to avoid race contidion of krefs. Signed-off-by: Hyunwoo Kim <imv4bel(a)gmail.com> Cc: stable(a)vger.kernel.org Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: ChenXiaoSong <chenxiaosong2(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/video/fbdev/smscufx.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/drivers/video/fbdev/smscufx.c b/drivers/video/fbdev/smscufx.c index 22b606af0a87..2256e5816090 100644 --- a/drivers/video/fbdev/smscufx.c +++ b/drivers/video/fbdev/smscufx.c @@ -140,6 +140,8 @@ static int ufx_submit_urb(struct ufx_data *dev, struct urb * urb, size_t len); static int ufx_alloc_urb_list(struct ufx_data *dev, int count, size_t size); static void ufx_free_urb_list(struct ufx_data *dev); +static DEFINE_MUTEX(disconnect_mutex); + /* reads a control register */ static int ufx_reg_read(struct ufx_data *dev, u32 index, u32 *data) { @@ -1073,9 +1075,13 @@ static int ufx_ops_open(struct fb_info *info, int user) if (user == 0 && !console) return -EBUSY; + mutex_lock(&disconnect_mutex); + /* If the USB device is gone, we don't accept new opens */ - if (dev->virtualized) + if (dev->virtualized) { + mutex_unlock(&disconnect_mutex); return -ENODEV; + } dev->fb_count++; @@ -1099,6 +1105,8 @@ static int ufx_ops_open(struct fb_info *info, int user) pr_debug("open /dev/fb%d user=%d fb_info=%p count=%d", info->node, user, info, dev->fb_count); + mutex_unlock(&disconnect_mutex); + return 0; } @@ -1747,6 +1755,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface) { struct ufx_data *dev; + mutex_lock(&disconnect_mutex); + dev = usb_get_intfdata(interface); pr_debug("USB disconnect starting\n"); @@ -1767,6 +1777,8 @@ static void ufx_usb_disconnect(struct usb_interface *interface) kref_put(&dev->kref, ufx_free); /* consider ufx_data freed */ + + mutex_unlock(&disconnect_mutex); } static struct usb_driver ufx_driver = { -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] arm64: fix oops in concurrently setting insn_emulation sysctls
by Yongqiang Liu 18 Oct '22

18 Oct '22

From: haibinzhang (张海斌) <haibinzhang(a)tencent.com> stable inclusion from stable-v4.19.256 commit b51881b1da57fe9877125dfdd0aac5172958fcfd category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5U71M CVE: CVE-2022-20422 --------------------------- [ Upstream commit af483947d472eccb79e42059276c4deed76f99a6 ] emulation_proc_handler() changes table->data for proc_dointvec_minmax and can generate the following Oops if called concurrently with itself: | Unable to handle kernel NULL pointer dereference at virtual address 0000000000000010 | Internal error: Oops: 96000006 [#1] SMP | Call trace: | update_insn_emulation_mode+0xc0/0x148 | emulation_proc_handler+0x64/0xb8 | proc_sys_call_handler+0x9c/0xf8 | proc_sys_write+0x18/0x20 | __vfs_write+0x20/0x48 | vfs_write+0xe4/0x1d0 | ksys_write+0x70/0xf8 | __arm64_sys_write+0x20/0x28 | el0_svc_common.constprop.0+0x7c/0x1c0 | el0_svc_handler+0x2c/0xa0 | el0_svc+0x8/0x200 To fix this issue, keep the table->data as &insn->current_mode and use container_of() to retrieve the insn pointer. Another mutex is used to protect against the current_mode update but not for retrieving insn_emulation as table->data is no longer changing. Co-developed-by: hewenliang <hewenliang4(a)huawei.com> Signed-off-by: hewenliang <hewenliang4(a)huawei.com> Signed-off-by: Haibin Zhang <haibinzhang(a)tencent.com> Reviewed-by: Catalin Marinas <catalin.marinas(a)arm.com> Link: https://lore.kernel.org/r/20220128090324.2727688-1-hewenliang4@huawei.com Link: https://lore.kernel.org/r/9A004C03-250B-46C5-BF39-782D7551B00E@tencent.com Signed-off-by: Will Deacon <will(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: ruanjinjie <ruanjinjie(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/arm64/kernel/armv8_deprecated.c | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c index 0cbf78581974..88d3454f2848 100644 --- a/arch/arm64/kernel/armv8_deprecated.c +++ b/arch/arm64/kernel/armv8_deprecated.c @@ -62,6 +62,7 @@ struct insn_emulation { static LIST_HEAD(insn_emulation); static int nr_insn_emulated __initdata; static DEFINE_RAW_SPINLOCK(insn_emulation_lock); +static DEFINE_MUTEX(insn_emulation_mutex); static void register_emulation_hooks(struct insn_emulation_ops *ops) { @@ -210,10 +211,10 @@ static int emulation_proc_handler(struct ctl_table *table, int write, loff_t *ppos) { int ret = 0; - struct insn_emulation *insn = (struct insn_emulation *) table->data; + struct insn_emulation *insn = container_of(table->data, struct insn_emulation, current_mode); enum insn_emulation_mode prev_mode = insn->current_mode; - table->data = &insn->current_mode; + mutex_lock(&insn_emulation_mutex); ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); if (ret || !write || prev_mode == insn->current_mode) @@ -226,7 +227,7 @@ static int emulation_proc_handler(struct ctl_table *table, int write, update_insn_emulation_mode(insn, INSN_UNDEF); } ret: - table->data = insn; + mutex_unlock(&insn_emulation_mutex); return ret; } @@ -250,7 +251,7 @@ static void __init register_insn_emulation_sysctl(void) sysctl->maxlen = sizeof(int); sysctl->procname = insn->ops->name; - sysctl->data = insn; + sysctl->data = &insn->current_mode; sysctl->extra1 = &insn->min; sysctl->extra2 = &insn->max; sysctl->proc_handler = emulation_proc_handler; -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/2] init/Kconfig: Add SMP to the dependencies of QOS_SCHED
by Yongqiang Liu 17 Oct '22

17 Oct '22

From: Xia Fukun <xiafukun(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UPB0 CVE: NA ------------------------------------------------------------ After CONFIG_SMP is disabled during kernel compilation, CONFIG_QOS_SCHED is not disabled. As a result, the following error occurs: kernel/sched/fair.c: In function ‘check_qos_cfs_rq’: kernel/sched/fair.c:7324:4: error: implicit declaration of function ‘sched_idle_cpu’; did you mean ‘sched_idle_rq’? [-Werror=implicit-function-declaration] 7324 | !sched_idle_cpu(smp_processor_id()) && | ^~~~~~~~~~~~~~ ./include/linux/compiler.h:78:42: note: in definition of macro ‘unlikely’ 78 | # define unlikely(x) __builtin_expect(!!(x), 0) | ^ CC mm/highmem.o kernel/sched/fair.c: In function ‘pick_next_task_fair’: kernel/sched/fair.c:7599:43: error: ‘struct rq’ has no member named ‘online’ 7599 | if (cfs_rq->idle_h_nr_running != 0 && rq->online) | ^~ AR arch/x86/mm/pat/built-in.a CC kernel/sched/stats.o kernel/sched/fair.c:7790:7: error: ‘struct rq’ has no member named ‘idle_stamp’; did you mean ‘idle_state’? 7790 | rq->idle_stamp = 0; | ^~~~~~~~~~ | idle_state This is because the definitions of the corresponding functions and variables depend on the SMP configuration. So add SMP to the dependencies of QOS_SCHED. Signed-off-by: Xia Fukun <xiafukun(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Reviewed-by: zheng zucheng <zhengzucheng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- init/Kconfig | 1 + 1 file changed, 1 insertion(+) diff --git a/init/Kconfig b/init/Kconfig index 2c79f2e51fc4..a2a733080fe1 100644 --- a/init/Kconfig +++ b/init/Kconfig @@ -791,6 +791,7 @@ config QOS_SCHED bool "Qos task scheduling" depends on CGROUP_SCHED depends on CFS_BANDWIDTH + depends on SMP default n -- 2.25.1

1 1

[PATCH openEuler-5.10 01/12] blk-iocost: don't ignore vrate_min on QD contention
by Zheng Zengkai 14 Oct '22

14 Oct '22

From: Tejun Heo <tj(a)kernel.org> mainline inclusion from mainline-v5.13-rc1 commit f46ec84b5acbf8d7067d71a6bbdde213d4b86036 category: bugfix bugzilla: 187443, https://gitee.com/openeuler/kernel/issues/I5PFPV CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------------------------------------- ioc_adjust_base_vrate() ignored vrate_min when rq_wait_pct indicates that there is QD contention. The reasoning was that QD depletion always reliably indicates device saturation and thus it's safe to override user specified vrate_min. However, this sometimes leads to unnecessary throttling, especially on really fast devices, because vrate adjustments have delays and inertia. It also confuses users because the behavior violates the explicitly specified configuration. This patch drops the special case handling so that vrate_min is always applied. Signed-off-by: Tejun Heo <tj(a)kernel.org> Link: https://lore.kernel.org/r/YIIo1HuyNmhDeiNx@slm.duckdns.org Signed-off-by: Jens Axboe <axboe(a)kernel.dk> confilict: block/blk-iocost.c Signed-off-by: Li Nan <linan122(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/blk-iocost.c | 4 ---- 1 file changed, 4 deletions(-) diff --git a/block/blk-iocost.c b/block/blk-iocost.c index fb8f959a7f32..08e4ba856e3b 100644 --- a/block/blk-iocost.c +++ b/block/blk-iocost.c @@ -2341,10 +2341,6 @@ static void ioc_timer_fn(struct timer_list *timer) u64 vrate = ioc->vtime_base_rate; u64 vrate_min = ioc->vrate_min, vrate_max = ioc->vrate_max; - /* rq_wait signal is always reliable, ignore user vrate_min */ - if (rq_wait_pct > RQ_WAIT_BUSY_PCT) - vrate_min = VRATE_MIN; - /* * If vrate is out of bounds, apply clamp gradually as the * bounds can change abruptly. Otherwise, apply busy_level -- 2.20.1

1 11

[PATCH openEuler-1.0-LTS 1/3] HID: roccat: Fix use-after-free in roccat_read()
by Yongqiang Liu 14 Oct '22

14 Oct '22

From: Hyunwoo Kim <imv4bel(a)gmail.com> mainline inclusion from mainline master commit cacdb14b1c8d3804a3a7d31773bc7569837b71a4 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5U1PE CVE: CVE-2022-41850 -------------------------------- roccat_report_event() is responsible for registering roccat-related reports in struct roccat_device. int roccat_report_event(int minor, u8 const *data) { struct roccat_device *device; struct roccat_reader *reader; struct roccat_report *report; uint8_t *new_value; device = devices[minor]; new_value = kmemdup(data, device->report_size, GFP_ATOMIC); if (!new_value) return -ENOMEM; report = &device->cbuf[device->cbuf_end]; /* passing NULL is safe */ kfree(report->value); ... The registered report is stored in the struct roccat_device member "struct roccat_report cbuf[ROCCAT_CBUF_SIZE];". If more reports are received than the "ROCCAT_CBUF_SIZE" value, kfree() the saved report from cbuf[0] and allocates a new reprot. Since there is no lock when this kfree() is performed, kfree() can be performed even while reading the saved report. static ssize_t roccat_read(struct file *file, char __user *buffer, size_t count, loff_t *ppos) { struct roccat_reader *reader = file->private_data; struct roccat_device *device = reader->device; struct roccat_report *report; ssize_t retval = 0, len; DECLARE_WAITQUEUE(wait, current); mutex_lock(&device->cbuf_lock); ... report = &device->cbuf[reader->cbuf_start]; /* * If report is larger than requested amount of data, rest of report * is lost! */ len = device->report_size > count ? count : device->report_size; if (copy_to_user(buffer, report->value, len)) { retval = -EFAULT; goto exit_unlock; } ... The roccat_read() function receives the device->cbuf report and delivers it to the user through copy_to_user(). If the N+ROCCAT_CBUF_SIZE th report is received while copying of the Nth report->value is in progress, the pointer that copy_to_user() is working on is kfree()ed and UAF read may occur. (race condition) Since the device node of this driver does not set separate permissions, this is not a security vulnerability, but because it is used for requesting screen display of profile or dpi settings, a user using the roccat device can apply udev to this device node or There is a possibility to use it by giving. Signed-off-by: Hyunwoo Kim <imv4bel(a)gmail.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Signed-off-by: Cai Xinchen <caixinchen1(a)huawei.com> Reviewed-by: Ruiqi Gong <gongruiqi1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/hid/hid-roccat.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/hid/hid-roccat.c b/drivers/hid/hid-roccat.c index 5be8de70c651..c9cec00b4e6e 100644 --- a/drivers/hid/hid-roccat.c +++ b/drivers/hid/hid-roccat.c @@ -260,6 +260,8 @@ int roccat_report_event(int minor, u8 const *data) if (!new_value) return -ENOMEM; + mutex_lock(&device->cbuf_lock); + report = &device->cbuf[device->cbuf_end]; /* passing NULL is safe */ @@ -279,6 +281,8 @@ int roccat_report_event(int minor, u8 const *data) reader->cbuf_start = (reader->cbuf_start + 1) % ROCCAT_CBUF_SIZE; } + mutex_unlock(&device->cbuf_lock); + wake_up_interruptible(&device->wait); return 0; } -- 2.25.1

1 2

[PATCH openEuler-5.10-LTS 01/16] RDMA/hns: Remove redundant DFX file and DFX ops structure
by Zheng Zengkai 13 Oct '22

13 Oct '22

From: Wenpeng Liang <liangwenpeng(a)huawei.com> mainline inclusion from mainline-for-next commit 40b4b79c866f category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5TAQ5 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/commit/?id=40… ---------------------------------------------------------------------- There is no need to use a dedicated DXF file and DFX structure to manage the interface of the query queue context. Link: https://lore.kernel.org/r/20220822104455.2311053-2-liangwenpeng@huawei.com Signed-off-by: Wenpeng Liang <liangwenpeng(a)huawei.com> Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Zhengfeng Luo <luozhengfeng(a)h-partners.com> Reviewed-by: Yangyang Li <liyangyang20(a)huawei.com> Reviewed-by: YueHaibing <yuehaibing(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/infiniband/hw/hns/Makefile | 2 +- drivers/infiniband/hw/hns/hns_roce_device.h | 10 ++---- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 35 ++++++++++++++++--- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 3 -- drivers/infiniband/hw/hns/hns_roce_main.c | 6 +++- drivers/infiniband/hw/hns/hns_roce_restrack.c | 35 +++++++------------ 6 files changed, 50 insertions(+), 41 deletions(-) diff --git a/drivers/infiniband/hw/hns/Makefile b/drivers/infiniband/hw/hns/Makefile index 9f04f25d9631..a7d259238305 100644 --- a/drivers/infiniband/hw/hns/Makefile +++ b/drivers/infiniband/hw/hns/Makefile @@ -10,6 +10,6 @@ hns-roce-objs := hns_roce_main.o hns_roce_cmd.o hns_roce_pd.o \ hns_roce_cq.o hns_roce_alloc.o hns_roce_db.o hns_roce_srq.o hns_roce_restrack.o ifdef CONFIG_INFINIBAND_HNS_HIP08 -hns-roce-hw-v2-objs := hns_roce_hw_v2.o hns_roce_hw_v2_dfx.o $(hns-roce-objs) +hns-roce-hw-v2-objs := hns_roce_hw_v2.o $(hns-roce-objs) obj-$(CONFIG_INFINIBAND_HNS) += hns-roce-hw-v2.o endif diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h index 2d29221055be..848f0e0e76a4 100644 --- a/drivers/infiniband/hw/hns/hns_roce_device.h +++ b/drivers/infiniband/hw/hns/hns_roce_device.h @@ -849,11 +849,6 @@ struct hns_roce_caps { enum cong_type cong_type; }; -struct hns_roce_dfx_hw { - int (*query_cqc_info)(struct hns_roce_dev *hr_dev, u32 cqn, - int *buffer); -}; - enum hns_roce_device_state { HNS_ROCE_DEVICE_STATE_INITED, HNS_ROCE_DEVICE_STATE_RST_DOWN, @@ -899,6 +894,7 @@ struct hns_roce_hw { int (*init_eq)(struct hns_roce_dev *hr_dev); void (*cleanup_eq)(struct hns_roce_dev *hr_dev); int (*write_srqc)(struct hns_roce_srq *srq, void *mb_buf); + int (*query_cqc)(struct hns_roce_dev *hr_dev, u32 cqn, void *buffer); const struct ib_device_ops *hns_roce_dev_ops; const struct ib_device_ops *hns_roce_dev_srq_ops; }; @@ -960,7 +956,6 @@ struct hns_roce_dev { void *priv; struct workqueue_struct *irq_workq; struct work_struct ecc_work; - const struct hns_roce_dfx_hw *dfx; u32 func_num; u32 is_vf; u32 cong_algo_tmpl_id; @@ -1223,8 +1218,7 @@ u8 hns_get_gid_index(struct hns_roce_dev *hr_dev, u8 port, int gid_index); void hns_roce_handle_device_err(struct hns_roce_dev *hr_dev); int hns_roce_init(struct hns_roce_dev *hr_dev); void hns_roce_exit(struct hns_roce_dev *hr_dev); -int hns_roce_fill_res_cq_entry(struct sk_buff *msg, - struct ib_cq *ib_cq); +int hns_roce_fill_res_cq_entry(struct sk_buff *msg, struct ib_cq *ib_cq); struct hns_user_mmap_entry * hns_roce_user_mmap_entry_insert(struct ib_ucontext *ucontext, u64 address, size_t length, diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index de7873551ffc..6b772536ab3c 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -5801,6 +5801,35 @@ static int hns_roce_v2_modify_cq(struct ib_cq *cq, u16 cq_count, u16 cq_period) return ret; } +static int hns_roce_v2_query_cqc(struct hns_roce_dev *hr_dev, u32 cqn, + void *buffer) +{ + struct hns_roce_v2_cq_context *context; + struct hns_roce_cmd_mailbox *mailbox; + int ret; + + mailbox = hns_roce_alloc_cmd_mailbox(hr_dev); + if (IS_ERR(mailbox)) + return PTR_ERR(mailbox); + + context = mailbox->buf; + ret = hns_roce_cmd_mbox(hr_dev, 0, mailbox->dma, + HNS_ROCE_CMD_QUERY_CQC, cqn); + if (ret) { + ibdev_err(&hr_dev->ib_dev, + "failed to process cmd when querying CQ, ret = %d.\n", + ret); + goto err_mailbox; + } + + memcpy(buffer, context, sizeof(*context)); + +err_mailbox: + hns_roce_free_cmd_mailbox(hr_dev, mailbox); + + return ret; +} + static void hns_roce_irq_work_handle(struct work_struct *work) { struct hns_roce_work *irq_work = @@ -6593,10 +6622,6 @@ static void hns_roce_v2_cleanup_eq_table(struct hns_roce_dev *hr_dev) kfree(eq_table->eq); } -static const struct hns_roce_dfx_hw hns_roce_dfx_hw_v2 = { - .query_cqc_info = hns_roce_v2_query_cqc_info, -}; - static const struct ib_device_ops hns_roce_v2_dev_ops = { .destroy_qp = hns_roce_v2_destroy_qp, .modify_cq = hns_roce_v2_modify_cq, @@ -6637,6 +6662,7 @@ static const struct hns_roce_hw hns_roce_hw_v2 = { .init_eq = hns_roce_v2_init_eq_table, .cleanup_eq = hns_roce_v2_cleanup_eq_table, .write_srqc = hns_roce_v2_write_srqc, + .query_cqc = hns_roce_v2_query_cqc, .hns_roce_dev_ops = &hns_roce_v2_dev_ops, .hns_roce_dev_srq_ops = &hns_roce_v2_dev_srq_ops, }; @@ -6668,7 +6694,6 @@ static void hns_roce_hw_v2_get_cfg(struct hns_roce_dev *hr_dev, hr_dev->is_vf = id->driver_data; hr_dev->dev = &handle->pdev->dev; hr_dev->hw = &hns_roce_hw_v2; - hr_dev->dfx = &hns_roce_dfx_hw_v2; hr_dev->sdb_offset = ROCEE_DB_SQ_L_0_REG; hr_dev->odb_offset = hr_dev->sdb_offset; diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h index 8aa56c24e677..6bf878fe661e 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h @@ -1455,9 +1455,6 @@ struct hns_roce_sccc_clr_done { __le32 rsv[5]; }; -int hns_roce_v2_query_cqc_info(struct hns_roce_dev *hr_dev, u32 cqn, - int *buffer); - int hns_roce_v2_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata); int hns_roce_v2_destroy_qp_common(struct hns_roce_dev *hr_dev, diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index 11f42cebfa40..9d4dbc3205c6 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -514,7 +514,6 @@ static const struct ib_device_ops hns_roce_dev_ops = { .destroy_ah = hns_roce_destroy_ah, .destroy_cq = hns_roce_destroy_cq, .disassociate_ucontext = hns_roce_disassociate_ucontext, - .fill_res_cq_entry = hns_roce_fill_res_cq_entry, .get_dma_mr = hns_roce_get_dma_mr, .get_link_layer = hns_roce_get_link_layer, .get_port_immutable = hns_roce_port_immutable, @@ -564,6 +563,10 @@ static const struct ib_device_ops hns_roce_dev_xrcd_ops = { INIT_RDMA_OBJ_SIZE(ib_xrcd, hns_roce_xrcd, ibxrcd), }; +static const struct ib_device_ops hns_roce_dev_restrack_ops = { + .fill_res_cq_entry = hns_roce_fill_res_cq_entry, +}; + static int hns_roce_register_device(struct hns_roce_dev *hr_dev) { int ret; @@ -642,6 +645,7 @@ static int hns_roce_register_device(struct hns_roce_dev *hr_dev) ib_set_device_ops(ib_dev, hr_dev->hw->hns_roce_dev_ops); ib_set_device_ops(ib_dev, &hns_roce_dev_ops); + ib_set_device_ops(ib_dev, &hns_roce_dev_restrack_ops); for (i = 0; i < hr_dev->caps.num_ports; i++) { if (!hr_dev->iboe.netdevs[i]) continue; diff --git a/drivers/infiniband/hw/hns/hns_roce_restrack.c b/drivers/infiniband/hw/hns/hns_roce_restrack.c index 24a154d64630..83417be15d3f 100644 --- a/drivers/infiniband/hw/hns/hns_roce_restrack.c +++ b/drivers/infiniband/hw/hns/hns_roce_restrack.c @@ -55,45 +55,34 @@ static int hns_roce_fill_cq(struct sk_buff *msg, return -EMSGSIZE; } -int hns_roce_fill_res_cq_entry(struct sk_buff *msg, - struct ib_cq *ib_cq) +int hns_roce_fill_res_cq_entry(struct sk_buff *msg, struct ib_cq *ib_cq) { struct hns_roce_dev *hr_dev = to_hr_dev(ib_cq->device); struct hns_roce_cq *hr_cq = to_hr_cq(ib_cq); - struct hns_roce_v2_cq_context *context; + struct hns_roce_v2_cq_context context; struct nlattr *table_attr; int ret; - if (!hr_dev->dfx->query_cqc_info) + if (!hr_dev->hw->query_cqc) return -EINVAL; - context = kzalloc(sizeof(struct hns_roce_v2_cq_context), GFP_KERNEL); - if (!context) - return -ENOMEM; - - ret = hr_dev->dfx->query_cqc_info(hr_dev, hr_cq->cqn, (int *)context); + ret = hr_dev->hw->query_cqc(hr_dev, hr_cq->cqn, &context); if (ret) - goto err; + return -EINVAL; table_attr = nla_nest_start(msg, RDMA_NLDEV_ATTR_DRIVER); - if (!table_attr) { - ret = -EMSGSIZE; - goto err; - } + if (!table_attr) + return -EMSGSIZE; - if (hns_roce_fill_cq(msg, context)) { - ret = -EMSGSIZE; - goto err_cancel_table; - } + if (hns_roce_fill_cq(msg, &context)) + goto err; nla_nest_end(msg, table_attr); - kfree(context); return 0; -err_cancel_table: - nla_nest_cancel(msg, table_attr); err: - kfree(context); - return ret; + nla_nest_cancel(msg, table_attr); + + return -EMSGSIZE; } -- 2.20.1

1 15

[PATCH openEuler-5.10 01/30] RDMA/hns: Remove redundant DFX file and DFX ops structure
by Zheng Zengkai 11 Oct '22

11 Oct '22

From: Wenpeng Liang <liangwenpeng(a)huawei.com> mainline inclusion from mainline-for-next commit 40b4b79c866f category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5TAQ5 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git/commit/?id=40… ---------------------------------------------------------------------- There is no need to use a dedicated DXF file and DFX structure to manage the interface of the query queue context. Link: https://lore.kernel.org/r/20220822104455.2311053-2-liangwenpeng@huawei.com Signed-off-by: Wenpeng Liang <liangwenpeng(a)huawei.com> Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Zhengfeng Luo <luozhengfeng(a)h-partners.com> Reviewed-by: Yangyang Li <liyangyang20(a)huawei.com> Reviewed-by: YueHaibing <yuehaibing(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/infiniband/hw/hns/Makefile | 2 +- drivers/infiniband/hw/hns/hns_roce_device.h | 10 ++---- drivers/infiniband/hw/hns/hns_roce_hw_v2.c | 35 ++++++++++++++++--- drivers/infiniband/hw/hns/hns_roce_hw_v2.h | 3 -- drivers/infiniband/hw/hns/hns_roce_main.c | 6 +++- drivers/infiniband/hw/hns/hns_roce_restrack.c | 35 +++++++------------ 6 files changed, 50 insertions(+), 41 deletions(-) diff --git a/drivers/infiniband/hw/hns/Makefile b/drivers/infiniband/hw/hns/Makefile index 9f04f25d9631..a7d259238305 100644 --- a/drivers/infiniband/hw/hns/Makefile +++ b/drivers/infiniband/hw/hns/Makefile @@ -10,6 +10,6 @@ hns-roce-objs := hns_roce_main.o hns_roce_cmd.o hns_roce_pd.o \ hns_roce_cq.o hns_roce_alloc.o hns_roce_db.o hns_roce_srq.o hns_roce_restrack.o ifdef CONFIG_INFINIBAND_HNS_HIP08 -hns-roce-hw-v2-objs := hns_roce_hw_v2.o hns_roce_hw_v2_dfx.o $(hns-roce-objs) +hns-roce-hw-v2-objs := hns_roce_hw_v2.o $(hns-roce-objs) obj-$(CONFIG_INFINIBAND_HNS) += hns-roce-hw-v2.o endif diff --git a/drivers/infiniband/hw/hns/hns_roce_device.h b/drivers/infiniband/hw/hns/hns_roce_device.h index 2d29221055be..848f0e0e76a4 100644 --- a/drivers/infiniband/hw/hns/hns_roce_device.h +++ b/drivers/infiniband/hw/hns/hns_roce_device.h @@ -849,11 +849,6 @@ struct hns_roce_caps { enum cong_type cong_type; }; -struct hns_roce_dfx_hw { - int (*query_cqc_info)(struct hns_roce_dev *hr_dev, u32 cqn, - int *buffer); -}; - enum hns_roce_device_state { HNS_ROCE_DEVICE_STATE_INITED, HNS_ROCE_DEVICE_STATE_RST_DOWN, @@ -899,6 +894,7 @@ struct hns_roce_hw { int (*init_eq)(struct hns_roce_dev *hr_dev); void (*cleanup_eq)(struct hns_roce_dev *hr_dev); int (*write_srqc)(struct hns_roce_srq *srq, void *mb_buf); + int (*query_cqc)(struct hns_roce_dev *hr_dev, u32 cqn, void *buffer); const struct ib_device_ops *hns_roce_dev_ops; const struct ib_device_ops *hns_roce_dev_srq_ops; }; @@ -960,7 +956,6 @@ struct hns_roce_dev { void *priv; struct workqueue_struct *irq_workq; struct work_struct ecc_work; - const struct hns_roce_dfx_hw *dfx; u32 func_num; u32 is_vf; u32 cong_algo_tmpl_id; @@ -1223,8 +1218,7 @@ u8 hns_get_gid_index(struct hns_roce_dev *hr_dev, u8 port, int gid_index); void hns_roce_handle_device_err(struct hns_roce_dev *hr_dev); int hns_roce_init(struct hns_roce_dev *hr_dev); void hns_roce_exit(struct hns_roce_dev *hr_dev); -int hns_roce_fill_res_cq_entry(struct sk_buff *msg, - struct ib_cq *ib_cq); +int hns_roce_fill_res_cq_entry(struct sk_buff *msg, struct ib_cq *ib_cq); struct hns_user_mmap_entry * hns_roce_user_mmap_entry_insert(struct ib_ucontext *ucontext, u64 address, size_t length, diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c index de7873551ffc..6b772536ab3c 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.c +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.c @@ -5801,6 +5801,35 @@ static int hns_roce_v2_modify_cq(struct ib_cq *cq, u16 cq_count, u16 cq_period) return ret; } +static int hns_roce_v2_query_cqc(struct hns_roce_dev *hr_dev, u32 cqn, + void *buffer) +{ + struct hns_roce_v2_cq_context *context; + struct hns_roce_cmd_mailbox *mailbox; + int ret; + + mailbox = hns_roce_alloc_cmd_mailbox(hr_dev); + if (IS_ERR(mailbox)) + return PTR_ERR(mailbox); + + context = mailbox->buf; + ret = hns_roce_cmd_mbox(hr_dev, 0, mailbox->dma, + HNS_ROCE_CMD_QUERY_CQC, cqn); + if (ret) { + ibdev_err(&hr_dev->ib_dev, + "failed to process cmd when querying CQ, ret = %d.\n", + ret); + goto err_mailbox; + } + + memcpy(buffer, context, sizeof(*context)); + +err_mailbox: + hns_roce_free_cmd_mailbox(hr_dev, mailbox); + + return ret; +} + static void hns_roce_irq_work_handle(struct work_struct *work) { struct hns_roce_work *irq_work = @@ -6593,10 +6622,6 @@ static void hns_roce_v2_cleanup_eq_table(struct hns_roce_dev *hr_dev) kfree(eq_table->eq); } -static const struct hns_roce_dfx_hw hns_roce_dfx_hw_v2 = { - .query_cqc_info = hns_roce_v2_query_cqc_info, -}; - static const struct ib_device_ops hns_roce_v2_dev_ops = { .destroy_qp = hns_roce_v2_destroy_qp, .modify_cq = hns_roce_v2_modify_cq, @@ -6637,6 +6662,7 @@ static const struct hns_roce_hw hns_roce_hw_v2 = { .init_eq = hns_roce_v2_init_eq_table, .cleanup_eq = hns_roce_v2_cleanup_eq_table, .write_srqc = hns_roce_v2_write_srqc, + .query_cqc = hns_roce_v2_query_cqc, .hns_roce_dev_ops = &hns_roce_v2_dev_ops, .hns_roce_dev_srq_ops = &hns_roce_v2_dev_srq_ops, }; @@ -6668,7 +6694,6 @@ static void hns_roce_hw_v2_get_cfg(struct hns_roce_dev *hr_dev, hr_dev->is_vf = id->driver_data; hr_dev->dev = &handle->pdev->dev; hr_dev->hw = &hns_roce_hw_v2; - hr_dev->dfx = &hns_roce_dfx_hw_v2; hr_dev->sdb_offset = ROCEE_DB_SQ_L_0_REG; hr_dev->odb_offset = hr_dev->sdb_offset; diff --git a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h index 8aa56c24e677..6bf878fe661e 100644 --- a/drivers/infiniband/hw/hns/hns_roce_hw_v2.h +++ b/drivers/infiniband/hw/hns/hns_roce_hw_v2.h @@ -1455,9 +1455,6 @@ struct hns_roce_sccc_clr_done { __le32 rsv[5]; }; -int hns_roce_v2_query_cqc_info(struct hns_roce_dev *hr_dev, u32 cqn, - int *buffer); - int hns_roce_v2_destroy_qp(struct ib_qp *ibqp, struct ib_udata *udata); int hns_roce_v2_destroy_qp_common(struct hns_roce_dev *hr_dev, diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c index 11f42cebfa40..9d4dbc3205c6 100644 --- a/drivers/infiniband/hw/hns/hns_roce_main.c +++ b/drivers/infiniband/hw/hns/hns_roce_main.c @@ -514,7 +514,6 @@ static const struct ib_device_ops hns_roce_dev_ops = { .destroy_ah = hns_roce_destroy_ah, .destroy_cq = hns_roce_destroy_cq, .disassociate_ucontext = hns_roce_disassociate_ucontext, - .fill_res_cq_entry = hns_roce_fill_res_cq_entry, .get_dma_mr = hns_roce_get_dma_mr, .get_link_layer = hns_roce_get_link_layer, .get_port_immutable = hns_roce_port_immutable, @@ -564,6 +563,10 @@ static const struct ib_device_ops hns_roce_dev_xrcd_ops = { INIT_RDMA_OBJ_SIZE(ib_xrcd, hns_roce_xrcd, ibxrcd), }; +static const struct ib_device_ops hns_roce_dev_restrack_ops = { + .fill_res_cq_entry = hns_roce_fill_res_cq_entry, +}; + static int hns_roce_register_device(struct hns_roce_dev *hr_dev) { int ret; @@ -642,6 +645,7 @@ static int hns_roce_register_device(struct hns_roce_dev *hr_dev) ib_set_device_ops(ib_dev, hr_dev->hw->hns_roce_dev_ops); ib_set_device_ops(ib_dev, &hns_roce_dev_ops); + ib_set_device_ops(ib_dev, &hns_roce_dev_restrack_ops); for (i = 0; i < hr_dev->caps.num_ports; i++) { if (!hr_dev->iboe.netdevs[i]) continue; diff --git a/drivers/infiniband/hw/hns/hns_roce_restrack.c b/drivers/infiniband/hw/hns/hns_roce_restrack.c index 24a154d64630..83417be15d3f 100644 --- a/drivers/infiniband/hw/hns/hns_roce_restrack.c +++ b/drivers/infiniband/hw/hns/hns_roce_restrack.c @@ -55,45 +55,34 @@ static int hns_roce_fill_cq(struct sk_buff *msg, return -EMSGSIZE; } -int hns_roce_fill_res_cq_entry(struct sk_buff *msg, - struct ib_cq *ib_cq) +int hns_roce_fill_res_cq_entry(struct sk_buff *msg, struct ib_cq *ib_cq) { struct hns_roce_dev *hr_dev = to_hr_dev(ib_cq->device); struct hns_roce_cq *hr_cq = to_hr_cq(ib_cq); - struct hns_roce_v2_cq_context *context; + struct hns_roce_v2_cq_context context; struct nlattr *table_attr; int ret; - if (!hr_dev->dfx->query_cqc_info) + if (!hr_dev->hw->query_cqc) return -EINVAL; - context = kzalloc(sizeof(struct hns_roce_v2_cq_context), GFP_KERNEL); - if (!context) - return -ENOMEM; - - ret = hr_dev->dfx->query_cqc_info(hr_dev, hr_cq->cqn, (int *)context); + ret = hr_dev->hw->query_cqc(hr_dev, hr_cq->cqn, &context); if (ret) - goto err; + return -EINVAL; table_attr = nla_nest_start(msg, RDMA_NLDEV_ATTR_DRIVER); - if (!table_attr) { - ret = -EMSGSIZE; - goto err; - } + if (!table_attr) + return -EMSGSIZE; - if (hns_roce_fill_cq(msg, context)) { - ret = -EMSGSIZE; - goto err_cancel_table; - } + if (hns_roce_fill_cq(msg, &context)) + goto err; nla_nest_end(msg, table_attr); - kfree(context); return 0; -err_cancel_table: - nla_nest_cancel(msg, table_attr); err: - kfree(context); - return ret; + nla_nest_cancel(msg, table_attr); + + return -EMSGSIZE; } -- 2.20.1

1 29

[PATCH openEuler-1.0-LTS 1/7] Revert "quota: Add more checking after reading from quota file"
by Yongqiang Liu 11 Oct '22

11 Oct '22

From: Zhong Jinghua <zhongjinghua(a)huawei.com> hulk inclusion category: bugfix bugzilla: 187046, https://gitee.com/openeuler/kernel/issues/I5QH0X CVE: NA -------------------------------- This reverts commit f66997d9c183c751a27b2b022dff35bded71571a. The mainline of this patch already exists, revert the interim patch. Signed-off-by: Zhong Jinghua <zhongjinghua(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/quota/quota_tree.c | 43 ++++++++++--------------------------------- 1 file changed, 10 insertions(+), 33 deletions(-) diff --git a/fs/quota/quota_tree.c b/fs/quota/quota_tree.c index 3c600ed3781a..5389cabc6f20 100644 --- a/fs/quota/quota_tree.c +++ b/fs/quota/quota_tree.c @@ -79,12 +79,12 @@ static ssize_t write_blk(struct qtree_mem_dqinfo *info, uint blk, char *buf) return ret; } -static inline int do_check_range(struct super_block *sb, const char *val_name, - uint val, uint min_val, uint max_val) +static inline int do_check_range(struct super_block *sb, uint val, + uint min_val, uint max_val) { if (val < min_val || val >= max_val) { - quota_error(sb, "Getting %s %u out of range %u-%u", - val_name, val, min_val, max_val); + quota_error(sb, "Getting block %u out of range %u-%u", + val, min_val, max_val); return -EUCLEAN; } @@ -98,13 +98,11 @@ static int check_free_block(struct qtree_mem_dqinfo *info, uint nextblk, prevblk; nextblk = le32_to_cpu(dh->dqdh_next_free); - err = do_check_range(info->dqi_sb, "dqdh_next_free", nextblk, 0, - info->dqi_blocks); + err = do_check_range(info->dqi_sb, nextblk, 0, info->dqi_blocks); if (err) return err; prevblk = le32_to_cpu(dh->dqdh_prev_free); - err = do_check_range(info->dqi_sb, "dqdh_prev_free", prevblk, 0, - info->dqi_blocks); + err = do_check_range(info->dqi_sb, prevblk, 0, info->dqi_blocks); if (err) return err; @@ -278,11 +276,6 @@ static uint find_free_dqentry(struct qtree_mem_dqinfo *info, *err = check_free_block(info, dh); if (*err) goto out_buf; - *err = do_check_range(info->dqi_sb, "dqdh_entries", - le16_to_cpu(dh->dqdh_entries), 0, - qtree_dqstr_in_blk(info)); - if (*err) - goto out_buf; } else { blk = get_free_dqblk(info); if ((int)blk < 0) { @@ -364,10 +357,6 @@ static int do_insert_tree(struct qtree_mem_dqinfo *info, struct dquot *dquot, } ref = (__le32 *)buf; newblk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]); - ret = do_check_range(dquot->dq_sb, "block", newblk, 0, - info->dqi_blocks); - if (ret) - goto out_buf; if (!newblk) newson = 1; if (depth == info->dqi_qtree_depth - 1) { @@ -480,11 +469,6 @@ static int free_dqentry(struct qtree_mem_dqinfo *info, struct dquot *dquot, } dh = (struct qt_disk_dqdbheader *)buf; ret = check_free_block(info, dh); - if (ret) - goto out_buf; - ret = do_check_range(info->dqi_sb, "dqdh_entries", - le16_to_cpu(dh->dqdh_entries), 1, - qtree_dqstr_in_blk(info) + 1); if (ret) goto out_buf; le16_add_cpu(&dh->dqdh_entries, -1); @@ -543,7 +527,7 @@ static int remove_tree(struct qtree_mem_dqinfo *info, struct dquot *dquot, goto out_buf; } newblk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]); - ret = do_check_range(dquot->dq_sb, "block", newblk, QT_TREEOFF, + ret = do_check_range(dquot->dq_sb, newblk, QT_TREEOFF, info->dqi_blocks); if (ret) goto out_buf; @@ -647,8 +631,7 @@ static loff_t find_tree_dqentry(struct qtree_mem_dqinfo *info, blk = le32_to_cpu(ref[get_index(info, dquot->dq_id, depth)]); if (!blk) /* No reference? */ goto out_buf; - ret = do_check_range(dquot->dq_sb, "block", blk, QT_TREEOFF, - info->dqi_blocks); + ret = do_check_range(dquot->dq_sb, blk, QT_TREEOFF, info->dqi_blocks); if (ret) goto out_buf; @@ -764,13 +747,7 @@ static int find_next_id(struct qtree_mem_dqinfo *info, qid_t *id, goto out_buf; } for (i = __get_index(info, *id, depth); i < epb; i++) { - uint blk_no = le32_to_cpu(ref[i]); - - ret = do_check_range(info->dqi_sb, "block", blk_no, 0, - info->dqi_blocks); - if (ret) - goto out_buf; - if (blk_no == 0) { + if (ref[i] == cpu_to_le32(0)) { *id += level_inc; continue; } @@ -778,7 +755,7 @@ static int find_next_id(struct qtree_mem_dqinfo *info, qid_t *id, ret = 0; goto out_buf; } - ret = find_next_id(info, id, blk_no, depth + 1); + ret = find_next_id(info, id, le32_to_cpu(ref[i]), depth + 1); if (ret != -ENOENT) break; } -- 2.25.1

1 6

[PATCH openEuler-1.0-LTS 00/30] linux-4.19-y inclusion
by Yongqiang Liu 11 Oct '22

11 Oct '22

Brian Norris (1): tracefs: Only clobber mode/uid/gid on remount if asked David Hildenbrand (1): mm/hugetlb: fix hugetlb not supporting softdirty tracking Denis V. Lunev (1): neigh: fix possible DoS due to net iface start/stop loop Eric Dumazet (1): tcp: annotate data-race around challenge_timestamp Florian Westphal (2): netfilter: ebtables: reject blobs that don't provide all entry points netfilter: ebtables: fix memory leak when blob is malformed Gaosheng Cui (1): audit: fix potential double free on error path from fsnotify_add_inode_mark Greg Kroah-Hartman (1): debugfs: add debugfs_lookup_and_remove() Harsh Modi (1): netfilter: br_netfilter: Drop dst references before setting. Jann Horn (1): mm: Fix TLB flush for not-first PFNMAP mappings in unmap_region() Jonathan Toppins (1): bonding: 802.3ad: fix no transmission of LACPDUs Kuniyuki Iwashima (9): net: Fix data-races around weight_p and dev_weight_[rt]x_bias. net: Fix data-races around netdev_tstamp_prequeue. ratelimit: Fix data-races in ___ratelimit(). net: Fix a data-race around sysctl_tstamp_allow_data. net: Fix a data-race around sysctl_net_busy_poll. net: Fix a data-race around sysctl_net_busy_read. net: Fix a data-race around netdev_budget. net: Fix a data-race around netdev_budget_usecs. net: Fix a data-race around sysctl_somaxconn. Maciej Żenczykowski (1): net: ipvtap - add __init/__exit annotations to module init/exit funcs Mike Snitzer (1): dm: return early from dm_pr_call() if DM device is suspended Neal Cardwell (1): tcp: fix early ETIMEDOUT after spurious non-SACK RTO NeilBrown (1): SUNRPC: use _bh spinlocking on ->transport_lock Quanyang Wang (1): asm-generic: sections: refactor memory_intersects Siddh Raman Pant (1): loop: Check for overflow while configuring loop Trond Myklebust (1): NFSv4: Fix races in the legacy idmapper upcall Xin Xiong (1): xfrm: fix refcount leak in __xfrm_policy_check() Yang Yingliang (1): net: neigh: don't call kfree_skb() under spin_lock_irqsave() Yee Lee (1): Revert "mm: kmemleak: take a full lowmem check in kmemleak_*_phys()" drivers/block/loop.c | 5 +++ drivers/md/dm.c | 5 +++ drivers/net/bonding/bond_3ad.c | 38 ++++++++----------- drivers/net/ipvlan/ipvtap.c | 4 +- fs/debugfs/inode.c | 22 +++++++++++ fs/nfs/nfs4idmap.c | 46 ++++++++++++----------- fs/tracefs/inode.c | 29 ++++++++++---- include/asm-generic/sections.h | 7 +++- include/linux/debugfs.h | 6 +++ include/linux/netfilter_bridge/ebtables.h | 4 -- include/net/busy_poll.h | 2 +- kernel/audit_fsnotify.c | 1 + lib/ratelimit.c | 12 ++++-- mm/kmemleak.c | 8 ++-- mm/mmap.c | 17 +++++++-- net/bridge/br_netfilter_hooks.c | 2 + net/bridge/br_netfilter_ipv6.c | 1 + net/bridge/netfilter/ebtable_broute.c | 8 ---- net/bridge/netfilter/ebtable_filter.c | 8 ---- net/bridge/netfilter/ebtable_nat.c | 8 ---- net/bridge/netfilter/ebtables.c | 10 ++--- net/core/dev.c | 14 +++---- net/core/neighbour.c | 27 ++++++++++--- net/core/skbuff.c | 2 +- net/core/sock.c | 2 +- net/core/sysctl_net_core.c | 15 +++++--- net/ipv4/tcp_input.c | 29 +++++++++----- net/sched/sch_generic.c | 2 +- net/socket.c | 2 +- net/sunrpc/xprt.c | 4 +- net/xfrm/xfrm_policy.c | 1 + 31 files changed, 205 insertions(+), 136 deletions(-) -- 2.25.1

1 30

[PATCH openEuler-1.0-LTS] bonding: fix reference count leak in balance-alb mode
by Sun Shouxin 11 Oct '22

11 Oct '22

mainline inclusion from mainline-v6.0 commit 4f5d33f4f798b1c6d92b613f0087f639d9836971 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UYT6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/d… ------------------------------------------------------------------------ Commit d5410ac7b0ba ("net:bonding:support balance-alb interface with vlan to bridge") introduced a reference count leak by not releasing the reference acquired by ip_dev_find(). Remedy this by insuring the reference is released. Fixes: d5410ac7b0ba ("net:bonding:support balance-alb interface with vlan to bridge") Signed-off-by: Jay Vosburgh <jay.vosburgh(a)canonical.com> Reviewed-by: Nikolay Aleksandrov <razor(a)blackwall.org> Link: https://lore.kernel.org/r/26758.1660194413@famine Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor --- drivers/net/bonding/bond_alb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index f493bcf..87ad03c 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -680,8 +680,11 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) dev = ip_dev_find(dev_net(bond->dev), arp->ip_src); if (dev) { - if (netif_is_bridge_master(dev)) + if (netif_is_bridge_master(dev)) { + dev_put(dev); return NULL; + } + dev_put(dev); } if (arp->op_code == htons(ARPOP_REPLY)) { -- 1.8.3.1

1 0

[PATCH openEuler-1.0-LTS] net:bonding:support balance-alb interface with vlan to bridge
by Sun Shouxin 11 Oct '22

11 Oct '22

mainline inclusion from mainline-v6.0 commit d5410ac7b0baeca91cf73ff5241d35998ecc8c9e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UYT6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/d… ----------------------------------------------------------------- In my test, balance-alb bonding with two slaves eth0 and eth1, and then Bond0.150 is created with vlan id attached bond0. After adding bond0.150 into one linux bridge, I noted that Bond0, bond0.150 and bridge were assigned to the same MAC as eth0. Once bond0.150 receives a packet whose dest IP is bridge's and dest MAC is eth1's, the linux bridge will not match eth1's MAC entry in FDB, and not handle it as expected. The patch fix the issue, and diagram as below: eth1(mac:eth1_mac)--bond0(balance-alb,mac:eth0_mac)--eth0(mac:eth0_mac) | bond0.150(mac:eth0_mac) | bridge(ip:br_ip, mac:eth0_mac)--other port Suggested-by: Hu Yadi <huyd12(a)chinatelecom.cn> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor --- drivers/net/bonding/bond_alb.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index 856efe8..f493bcf 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -665,6 +665,7 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) { struct slave *tx_slave = NULL; + struct net_device *dev; struct arp_pkt *arp; if (!pskb_network_may_pull(skb, sizeof(*arp))) @@ -677,6 +678,12 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) if (!bond_slave_has_mac_rx(bond, arp->mac_src)) return NULL; + dev = ip_dev_find(dev_net(bond->dev), arp->ip_src); + if (dev) { + if (netif_is_bridge_master(dev)) + return NULL; + } + if (arp->op_code == htons(ARPOP_REPLY)) { /* the arp must be sent on the selected rx channel */ tx_slave = rlb_choose_channel(skb, bond, arp); -- 1.8.3.1

1 0

[PATCH openEuler-1.0-LTS] net: bonding: Add support for IPV6 ns/na to balance-alb/balance-tlb mode
by Sun Shouxin 11 Oct '22

11 Oct '22

mainline inclusion from mainline-v6.0 commit 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UY5E CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/dri… ------------------------------------------------------------ Since ipv6 neighbor solicitation and advertisement messages isn't handled gracefully in bond6 driver, we can see packet drop due to inconsistency between mac address in the option message and source MAC . Another examples is ipv6 neighbor solicitation and advertisement messages from VM via tap attached to host bridge, the src mac might be changed through balance-alb mode, but it is not synced with Link-layer address in the option message. The patch implements bond6's tx handle for ipv6 neighbor solicitation and advertisement messages. Suggested-by: Hu Yadi <huyd12(a)chinatelecom.cn> Acked-by: Jay Vosburgh <jay.vosburgh(a)canonical.com> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor --- drivers/net/bonding/bond_alb.c | 29 +++++++++++++++++++++++++++-- 1 file changed, 27 insertions(+), 2 deletions(-) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index a6a89a0..856efe8 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -1281,6 +1281,27 @@ static int alb_set_mac_address(struct bonding *bond, void *addr) return res; } +/* determine if the packet is NA or NS */ +static bool alb_determine_nd(struct sk_buff *skb, struct bonding *bond) +{ + struct ipv6hdr *ip6hdr; + struct icmp6hdr *hdr; + + if (!pskb_network_may_pull(skb, sizeof(*ip6hdr))) + return true; + + ip6hdr = ipv6_hdr(skb); + if (ip6hdr->nexthdr != IPPROTO_ICMPV6) + return false; + + if (!pskb_network_may_pull(skb, sizeof(*ip6hdr) + sizeof(*hdr))) + return true; + + hdr = icmp6_hdr(skb); + return hdr->icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT || + hdr->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION; +} + /************************ exported alb funcions ************************/ int bond_alb_initialize(struct bonding *bond, int rlb_enabled) @@ -1363,10 +1384,12 @@ netdev_tx_t bond_tlb_xmit(struct sk_buff *skb, struct net_device *bond_dev) /* Do not TX balance any multicast or broadcast */ if (!is_multicast_ether_addr(eth_data->h_dest)) { switch (skb->protocol) { + case htons(ETH_P_IPV6): + if (alb_determine_nd(skb, bond)) + break; case htons(ETH_P_IP): case htons(ETH_P_IPX): /* In case of IPX, it will falback to L2 hash */ - case htons(ETH_P_IPV6): hash_index = bond_xmit_hash(bond, skb); if (bond->params.tlb_dynamic_lb) { tx_slave = tlb_choose_channel(bond, @@ -1440,10 +1463,12 @@ netdev_tx_t bond_alb_xmit(struct sk_buff *skb, struct net_device *bond_dev) break; } - if (!pskb_network_may_pull(skb, sizeof(*ip6hdr))) { + if (alb_determine_nd(skb, bond)) { do_tx_balance = false; break; } + + /* The IPv6 header is pulled by alb_determine_nd */ /* Additionally, DAD probes should not be tx-balanced as that * will lead to false positives for duplicate addresses and * prevent address configuration from working. -- 1.8.3.1

1 0

[PATCH OLK-5.10] bonding: fix reference count leak in balance-alb mode
by Sun Shouxin 11 Oct '22

11 Oct '22

mainline inclusion from mainline-v6.0 commit 4f5d33f4f798b1c6d92b613f0087f639d9836971 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UYT6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/d… ------------------------------------------------------------------------------------ Commit d5410ac7b0ba ("net:bonding:support balance-alb interface with vlan to bridge") introduced a reference count leak by not releasing the reference acquired by ip_dev_find(). Remedy this by insuring the reference is released. Fixes: d5410ac7b0ba ("net:bonding:support balance-alb interface with vlan to bridge") Signed-off-by: Jay Vosburgh <jay.vosburgh(a)canonical.com> Reviewed-by: Nikolay Aleksandrov <razor(a)blackwall.org> Link: https://lore.kernel.org/r/26758.1660194413@famine Signed-off-by: Jakub Kicinski <kuba(a)kernel.org> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor --- drivers/net/bonding/bond_alb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index d9c03a9..9130b57 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -665,8 +665,11 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) dev = ip_dev_find(dev_net(bond->dev), arp->ip_src); if (dev) { - if (netif_is_bridge_master(dev)) + if (netif_is_bridge_master(dev)) { + dev_put(dev); return NULL; + } + dev_put(dev); } if (arp->op_code == htons(ARPOP_REPLY)) { -- 1.8.3.1

1 0

[PATCH OLK-5.10] net:bonding:support balance-alb interface with vlan to bridge
by Sun Shouxin 10 Oct '22

10 Oct '22

mainline inclusion from mainline-v6.0 commit d5410ac7b0baeca91cf73ff5241d35998ecc8c9e category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UYT6 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/d… --------------------------------------------------------------- In my test, balance-alb bonding with two slaves eth0 and eth1, and then Bond0.150 is created with vlan id attached bond0. After adding bond0.150 into one linux bridge, I noted that Bond0, bond0.150 and bridge were assigned to the same MAC as eth0. Once bond0.150 receives a packet whose dest IP is bridge's and dest MAC is eth1's, the linux bridge will not match eth1's MAC entry in FDB, and not handle it as expected. The patch fix the issue, and diagram as below: eth1(mac:eth1_mac)--bond0(balance-alb,mac:eth0_mac)--eth0(mac:eth0_mac) | bond0.150(mac:eth0_mac) | bridge(ip:br_ip, mac:eth0_mac)--other port Suggested-by: Hu Yadi <huyd12(a)chinatelecom.cn> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor --- drivers/net/bonding/bond_alb.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index 8826380..d9c03a9 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -650,6 +650,7 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) { struct slave *tx_slave = NULL; + struct net_device *dev; struct arp_pkt *arp; if (!pskb_network_may_pull(skb, sizeof(*arp))) @@ -662,6 +663,12 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) if (!bond_slave_has_mac_rx(bond, arp->mac_src)) return NULL; + dev = ip_dev_find(dev_net(bond->dev), arp->ip_src); + if (dev) { + if (netif_is_bridge_master(dev)) + return NULL; + } + if (arp->op_code == htons(ARPOP_REPLY)) { /* the arp must be sent on the selected rx channel */ tx_slave = rlb_choose_channel(skb, bond, arp); -- 1.8.3.1

1 0

[PATCH OLK-5.10] net: bonding: Add support for IPV6 ns/na to balance-alb/balance-tlb mode
by Sun Shouxin 10 Oct '22

10 Oct '22

mainline inclusion from mainline-v6.0 commit 0da8aa00bfcfeb3f4e6537dd8e2001e0727ba549 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5UY5E CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/dri… ----------------------------------------------------------- Since ipv6 neighbor solicitation and advertisement messages isn't handled gracefully in bond6 driver, we can see packet drop due to inconsistency between mac address in the option message and source MAC . Another examples is ipv6 neighbor solicitation and advertisement messages from VM via tap attached to host bridge, the src mac might be changed through balance-alb mode, but it is not synced with Link-layer address in the option message. The patch implements bond6's tx handle for ipv6 neighbor solicitation and advertisement messages. Suggested-by: Hu Yadi <huyd12(a)chinatelecom.cn> Acked-by: Jay Vosburgh <jay.vosburgh(a)canonical.com> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Sun Shouxin <sunshouxin(a)chinatelecom.cn> # openEuler_contributor Signed-off-by: Ctyun Kernel <ctyuncommiter01(a)chinatelecom.cn> # openEuler_contributor --- drivers/net/bonding/bond_alb.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c index 0436aef9c9ef..882638076355 100644 --- a/drivers/net/bonding/bond_alb.c +++ b/drivers/net/bonding/bond_alb.c @@ -1268,6 +1268,27 @@ static int alb_set_mac_address(struct bonding *bond, void *addr) return res; } +/* determine if the packet is NA or NS */ +static bool alb_determine_nd(struct sk_buff *skb, struct bonding *bond) +{ + struct ipv6hdr *ip6hdr; + struct icmp6hdr *hdr; + + if (!pskb_network_may_pull(skb, sizeof(*ip6hdr))) + return true; + + ip6hdr = ipv6_hdr(skb); + if (ip6hdr->nexthdr != IPPROTO_ICMPV6) + return false; + + if (!pskb_network_may_pull(skb, sizeof(*ip6hdr) + sizeof(*hdr))) + return true; + + hdr = icmp6_hdr(skb); + return hdr->icmp6_type == NDISC_NEIGHBOUR_ADVERTISEMENT || + hdr->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION; +} + /************************ exported alb funcions ************************/ int bond_alb_initialize(struct bonding *bond, int rlb_enabled) @@ -1347,10 +1368,13 @@ struct slave *bond_xmit_tlb_slave_get(struct bonding *bond, /* Do not TX balance any multicast or broadcast */ if (!is_multicast_ether_addr(eth_data->h_dest)) { switch (skb->protocol) { + case htons(ETH_P_IPV6): + if (alb_determine_nd(skb, bond)) + break; + fallthrough; case htons(ETH_P_IP): case htons(ETH_P_IPX): /* In case of IPX, it will falback to L2 hash */ - case htons(ETH_P_IPV6): hash_index = bond_xmit_hash(bond, skb); if (bond->params.tlb_dynamic_lb) { tx_slave = tlb_choose_channel(bond, @@ -1433,10 +1457,12 @@ struct slave *bond_xmit_alb_slave_get(struct bonding *bond, break; } - if (!pskb_network_may_pull(skb, sizeof(*ip6hdr))) { + if (alb_determine_nd(skb, bond)) { do_tx_balance = false; break; } + + /* The IPv6 header is pulled by alb_determine_nd */ /* Additionally, DAD probes should not be tx-balanced as that * will lead to false positives for duplicate addresses and * prevent address configuration from working. -- 2.27.0

1 0

[PATCH openEuler-1.0-LTS 1/3] ext4: check if directory block is within i_size
by Yongqiang Liu 10 Oct '22

10 Oct '22

From: Lukas Czerner <lczerner(a)redhat.com> mainline inclusion from mainline-v6.0-rc1 commit 65f8ea4cd57dbd46ea13b41dc8bac03176b04233 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I58WSQ CVE: CVE-2022-1184 -------------------------------- Currently ext4 directory handling code implicitly assumes that the directory blocks are always within the i_size. In fact ext4_append() will attempt to allocate next directory block based solely on i_size and the i_size is then appropriately increased after a successful allocation. However, for this to work it requires i_size to be correct. If, for any reason, the directory inode i_size is corrupted in a way that the directory tree refers to a valid directory block past i_size, we could end up corrupting parts of the directory tree structure by overwriting already used directory blocks when modifying the directory. Fix it by catching the corruption early in __ext4_read_dirblock(). Addresses Red-Hat-Bugzilla: #2070205 CVE: CVE-2022-1184 Signed-off-by: Lukas Czerner <lczerner(a)redhat.com> Cc: stable(a)vger.kernel.org Reviewed-by: Andreas Dilger <adilger(a)dilger.ca> Link: https://lore.kernel.org/r/20220704142721.157985-1-lczerner@redhat.com Signed-off-by: Theodore Ts'o <tytso(a)mit.edu> Conflicts: fs/ext4/namei.c Signed-off-by: Baokun Li <libaokun1(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/ext4/namei.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c index b2d4fb82e8f4..1a9eda144c7a 100644 --- a/fs/ext4/namei.c +++ b/fs/ext4/namei.c @@ -124,6 +124,13 @@ static struct buffer_head *__ext4_read_dirblock(struct inode *inode, struct ext4_dir_entry *dirent; int is_dx_block = 0; + if (block >= inode->i_size) { + ext4_error_inode(inode, func, line, block, + "Attempting to read directory block (%u) that is past i_size (%llu)", + block, inode->i_size); + return ERR_PTR(-EFSCORRUPTED); + } + bh = ext4_bread(NULL, inode, block, 0); if (IS_ERR(bh)) { __ext4_warning(inode->i_sb, func, line, -- 2.25.1

1 2

[PATCH openEuler-1.0-LTS 01/10] md/raid10: prevent unnecessary calls to wake_up() in fast path
by Yongqiang Liu 09 Oct '22

09 Oct '22

From: Yu Kuai <yukuai3(a)huawei.com> mainline inclusion from md-next commit 7fdc91928ac109d3d1468ad7f951deb29a375e3d category: performance bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PRMO CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/song/md.git/commit/?h=md-ne… -------------------------------- Currently, wake_up() is called unconditionally in fast path such as raid10_make_request(), which will cause lock contention under high concurrency: raid10_make_request wake_up __wake_up_common_lock spin_lock_irqsave Improve performance by only call wake_up() if waitqueue is not empty. Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Reviewed-by: Logan Gunthorpe <logang(a)deltatee.com> Acked-by: Guoqing Jiang <guoqing.jiang(a)linux.dev> Signed-off-by: Song Liu <song(a)kernel.org> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/md/raid10.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c index 5049c4d829e5..13e0b4a462fc 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -305,6 +305,12 @@ static void put_buf(struct r10bio *r10_bio) lower_barrier(conf); } +static void wake_up_barrier(struct r10conf *conf) +{ + if (wq_has_sleeper(&conf->wait_barrier)) + wake_up(&conf->wait_barrier); +} + static void reschedule_retry(struct r10bio *r10_bio) { unsigned long flags; @@ -1025,7 +1031,7 @@ static void allow_barrier(struct r10conf *conf) { if ((atomic_dec_and_test(&conf->nr_pending)) || (conf->array_freeze_pending)) - wake_up(&conf->wait_barrier); + wake_up_barrier(conf); } static void freeze_array(struct r10conf *conf, int extra) @@ -1584,7 +1590,7 @@ static bool raid10_make_request(struct mddev *mddev, struct bio *bio) __make_request(mddev, bio, sectors); /* In case raid10d snuck in to freeze_array */ - wake_up(&conf->wait_barrier); + wake_up_barrier(conf); return true; } -- 2.25.1

1 9

申报一个议题：Add sysfs file for OverlayFS
by hiixfj 02 Oct '22

02 Oct '22

您好：在实际生产环境中不断出现overlayfs没有真正卸掉的出现了诸如quota统计数据持续增长等问题。对于现网环境目前没有好的办法去界定该类情况。 overlayfs在实际使用过程中是有很多限制但是并没有在代码层面直接做限制，所以在使用过程会出现操作错误引入的一些奇怪的问题往往这类问题表露出来的现象是比较奇怪的，定位起来比较耗时。基于这样的背景overlayfs的维测功能需要增强。该补丁为 overlayfs 增加了 sysfs 文件，用于记录 overlayfs 的挂载信息。 PR链接：https://gitee.com/openeuler/kernel/pulls/149 ------------------------------------------- 手机：(+86) 151-1048-1699 邮箱：hiixfj(a)gmail.com

1 0

[PATCH openEuler-5.10 01/38] rbtree: Add generic add and find helpers
by Zheng Zengkai 30 Sep '22

30 Sep '22

From: Peter Zijlstra <peterz(a)infradead.org> mainline inclusion from mainline-v5.12-rc1 commit 2d24dd5798d0474d9bf705bfca8725e7d20f9d54 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5OOWG CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------------------------------------------------- I've always been bothered by the endless (fragile) boilerplate for rbtree, and I recently wrote some rbtree helpers for objtool and figured I should lift them into the kernel and use them more widely. Provide: partial-order; less() based: - rb_add(): add a new entry to the rbtree - rb_add_cached(): like rb_add(), but for a rb_root_cached total-order; cmp() based: - rb_find(): find an entry in an rbtree - rb_find_add(): find an entry, and add if not found - rb_find_first(): find the first (leftmost) matching entry - rb_next_match(): continue from rb_find_first() - rb_for_each(): iterate a sub-tree using the previous two Inlining and constant propagation should see the compiler inline the whole thing, including the various compare functions. Signed-off-by: Peter Zijlstra (Intel) <peterz(a)infradead.org> Signed-off-by: Ingo Molnar <mingo(a)kernel.org> Reviewed-by: Michel Lespinasse <walken(a)google.com> Acked-by: Davidlohr Bueso <dbueso(a)suse.de> Conflicts: tools/objtool/elf.c [Feature 3690914ed35e("objtool: Extract elf_symbol_add()")] Signed-off-by: Lin Shengwang <linshengwang1(a)huawei.com> Reviewed-by: lihua <hucool.lihua(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- include/linux/rbtree.h | 190 ++++++++++++++++++++++++++++++++++ tools/include/linux/rbtree.h | 192 ++++++++++++++++++++++++++++++++++- tools/objtool/elf.c | 73 ++----------- 3 files changed, 392 insertions(+), 63 deletions(-) diff --git a/include/linux/rbtree.h b/include/linux/rbtree.h index d7db17996322..e0b300de8f3f 100644 --- a/include/linux/rbtree.h +++ b/include/linux/rbtree.h @@ -158,4 +158,194 @@ static inline void rb_replace_node_cached(struct rb_node *victim, rb_replace_node(victim, new, &root->rb_root); } +/* + * The below helper functions use 2 operators with 3 different + * calling conventions. The operators are related like: + * + * comp(a->key,b) < 0 := less(a,b) + * comp(a->key,b) > 0 := less(b,a) + * comp(a->key,b) == 0 := !less(a,b) && !less(b,a) + * + * If these operators define a partial order on the elements we make no + * guarantee on which of the elements matching the key is found. See + * rb_find(). + * + * The reason for this is to allow the find() interface without requiring an + * on-stack dummy object, which might not be feasible due to object size. + */ + +/** + * rb_add_cached() - insert @node into the leftmost cached tree @tree + * @node: node to insert + * @tree: leftmost cached tree to insert @node into + * @less: operator defining the (partial) node order + */ +static __always_inline void +rb_add_cached(struct rb_node *node, struct rb_root_cached *tree, + bool (*less)(struct rb_node *, const struct rb_node *)) +{ + struct rb_node **link = &tree->rb_root.rb_node; + struct rb_node *parent = NULL; + bool leftmost = true; + + while (*link) { + parent = *link; + if (less(node, parent)) { + link = &parent->rb_left; + } else { + link = &parent->rb_right; + leftmost = false; + } + } + + rb_link_node(node, parent, link); + rb_insert_color_cached(node, tree, leftmost); +} + +/** + * rb_add() - insert @node into @tree + * @node: node to insert + * @tree: tree to insert @node into + * @less: operator defining the (partial) node order + */ +static __always_inline void +rb_add(struct rb_node *node, struct rb_root *tree, + bool (*less)(struct rb_node *, const struct rb_node *)) +{ + struct rb_node **link = &tree->rb_node; + struct rb_node *parent = NULL; + + while (*link) { + parent = *link; + if (less(node, parent)) + link = &parent->rb_left; + else + link = &parent->rb_right; + } + + rb_link_node(node, parent, link); + rb_insert_color(node, tree); +} + +/** + * rb_find_add() - find equivalent @node in @tree, or add @node + * @node: node to look-for / insert + * @tree: tree to search / modify + * @cmp: operator defining the node order + * + * Returns the rb_node matching @node, or NULL when no match is found and @node + * is inserted. + */ +static __always_inline struct rb_node * +rb_find_add(struct rb_node *node, struct rb_root *tree, + int (*cmp)(struct rb_node *, const struct rb_node *)) +{ + struct rb_node **link = &tree->rb_node; + struct rb_node *parent = NULL; + int c; + + while (*link) { + parent = *link; + c = cmp(node, parent); + + if (c < 0) + link = &parent->rb_left; + else if (c > 0) + link = &parent->rb_right; + else + return parent; + } + + rb_link_node(node, parent, link); + rb_insert_color(node, tree); + return NULL; +} + +/** + * rb_find() - find @key in tree @tree + * @key: key to match + * @tree: tree to search + * @cmp: operator defining the node order + * + * Returns the rb_node matching @key or NULL. + */ +static __always_inline struct rb_node * +rb_find(const void *key, const struct rb_root *tree, + int (*cmp)(const void *key, const struct rb_node *)) +{ + struct rb_node *node = tree->rb_node; + + while (node) { + int c = cmp(key, node); + + if (c < 0) + node = node->rb_left; + else if (c > 0) + node = node->rb_right; + else + return node; + } + + return NULL; +} + +/** + * rb_find_first() - find the first @key in @tree + * @key: key to match + * @tree: tree to search + * @cmp: operator defining node order + * + * Returns the leftmost node matching @key, or NULL. + */ +static __always_inline struct rb_node * +rb_find_first(const void *key, const struct rb_root *tree, + int (*cmp)(const void *key, const struct rb_node *)) +{ + struct rb_node *node = tree->rb_node; + struct rb_node *match = NULL; + + while (node) { + int c = cmp(key, node); + + if (c <= 0) { + if (!c) + match = node; + node = node->rb_left; + } else if (c > 0) { + node = node->rb_right; + } + } + + return match; +} + +/** + * rb_next_match() - find the next @key in @tree + * @key: key to match + * @tree: tree to search + * @cmp: operator defining node order + * + * Returns the next node matching @key, or NULL. + */ +static __always_inline struct rb_node * +rb_next_match(const void *key, struct rb_node *node, + int (*cmp)(const void *key, const struct rb_node *)) +{ + node = rb_next(node); + if (node && cmp(key, node)) + node = NULL; + return node; +} + +/** + * rb_for_each() - iterates a subtree matching @key + * @node: iterator + * @key: key to match + * @tree: tree to search + * @cmp: operator defining node order + */ +#define rb_for_each(node, key, tree, cmp) \ + for ((node) = rb_find_first((key), (tree), (cmp)); \ + (node); (node) = rb_next_match((key), (node), (cmp))) + #endif /* _LINUX_RBTREE_H */ diff --git a/tools/include/linux/rbtree.h b/tools/include/linux/rbtree.h index 30dd21f976c3..2680f2edb837 100644 --- a/tools/include/linux/rbtree.h +++ b/tools/include/linux/rbtree.h @@ -152,4 +152,194 @@ static inline void rb_replace_node_cached(struct rb_node *victim, rb_replace_node(victim, new, &root->rb_root); } -#endif /* __TOOLS_LINUX_PERF_RBTREE_H */ +/* + * The below helper functions use 2 operators with 3 different + * calling conventions. The operators are related like: + * + * comp(a->key,b) < 0 := less(a,b) + * comp(a->key,b) > 0 := less(b,a) + * comp(a->key,b) == 0 := !less(a,b) && !less(b,a) + * + * If these operators define a partial order on the elements we make no + * guarantee on which of the elements matching the key is found. See + * rb_find(). + * + * The reason for this is to allow the find() interface without requiring an + * on-stack dummy object, which might not be feasible due to object size. + */ + +/** + * rb_add_cached() - insert @node into the leftmost cached tree @tree + * @node: node to insert + * @tree: leftmost cached tree to insert @node into + * @less: operator defining the (partial) node order + */ +static __always_inline void +rb_add_cached(struct rb_node *node, struct rb_root_cached *tree, + bool (*less)(struct rb_node *, const struct rb_node *)) +{ + struct rb_node **link = &tree->rb_root.rb_node; + struct rb_node *parent = NULL; + bool leftmost = true; + + while (*link) { + parent = *link; + if (less(node, parent)) { + link = &parent->rb_left; + } else { + link = &parent->rb_right; + leftmost = false; + } + } + + rb_link_node(node, parent, link); + rb_insert_color_cached(node, tree, leftmost); +} + +/** + * rb_add() - insert @node into @tree + * @node: node to insert + * @tree: tree to insert @node into + * @less: operator defining the (partial) node order + */ +static __always_inline void +rb_add(struct rb_node *node, struct rb_root *tree, + bool (*less)(struct rb_node *, const struct rb_node *)) +{ + struct rb_node **link = &tree->rb_node; + struct rb_node *parent = NULL; + + while (*link) { + parent = *link; + if (less(node, parent)) + link = &parent->rb_left; + else + link = &parent->rb_right; + } + + rb_link_node(node, parent, link); + rb_insert_color(node, tree); +} + +/** + * rb_find_add() - find equivalent @node in @tree, or add @node + * @node: node to look-for / insert + * @tree: tree to search / modify + * @cmp: operator defining the node order + * + * Returns the rb_node matching @node, or NULL when no match is found and @node + * is inserted. + */ +static __always_inline struct rb_node * +rb_find_add(struct rb_node *node, struct rb_root *tree, + int (*cmp)(struct rb_node *, const struct rb_node *)) +{ + struct rb_node **link = &tree->rb_node; + struct rb_node *parent = NULL; + int c; + + while (*link) { + parent = *link; + c = cmp(node, parent); + + if (c < 0) + link = &parent->rb_left; + else if (c > 0) + link = &parent->rb_right; + else + return parent; + } + + rb_link_node(node, parent, link); + rb_insert_color(node, tree); + return NULL; +} + +/** + * rb_find() - find @key in tree @tree + * @key: key to match + * @tree: tree to search + * @cmp: operator defining the node order + * + * Returns the rb_node matching @key or NULL. + */ +static __always_inline struct rb_node * +rb_find(const void *key, const struct rb_root *tree, + int (*cmp)(const void *key, const struct rb_node *)) +{ + struct rb_node *node = tree->rb_node; + + while (node) { + int c = cmp(key, node); + + if (c < 0) + node = node->rb_left; + else if (c > 0) + node = node->rb_right; + else + return node; + } + + return NULL; +} + +/** + * rb_find_first() - find the first @key in @tree + * @key: key to match + * @tree: tree to search + * @cmp: operator defining node order + * + * Returns the leftmost node matching @key, or NULL. + */ +static __always_inline struct rb_node * +rb_find_first(const void *key, const struct rb_root *tree, + int (*cmp)(const void *key, const struct rb_node *)) +{ + struct rb_node *node = tree->rb_node; + struct rb_node *match = NULL; + + while (node) { + int c = cmp(key, node); + + if (c <= 0) { + if (!c) + match = node; + node = node->rb_left; + } else if (c > 0) { + node = node->rb_right; + } + } + + return match; +} + +/** + * rb_next_match() - find the next @key in @tree + * @key: key to match + * @tree: tree to search + * @cmp: operator defining node order + * + * Returns the next node matching @key, or NULL. + */ +static __always_inline struct rb_node * +rb_next_match(const void *key, struct rb_node *node, + int (*cmp)(const void *key, const struct rb_node *)) +{ + node = rb_next(node); + if (node && cmp(key, node)) + node = NULL; + return node; +} + +/** + * rb_for_each() - iterates a subtree matching @key + * @node: iterator + * @key: key to match + * @tree: tree to search + * @cmp: operator defining node order + */ +#define rb_for_each(node, key, tree, cmp) \ + for ((node) = rb_find_first((key), (tree), (cmp)); \ + (node); (node) = rb_next_match((key), (node), (cmp))) + +#endif /* __TOOLS_LINUX_PERF_RBTREE_H */ diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c index de6e42040d75..a0468ead1ea1 100644 --- a/tools/objtool/elf.c +++ b/tools/objtool/elf.c @@ -43,75 +43,24 @@ static void elf_hash_init(struct hlist_head *table) #define elf_hash_for_each_possible(name, obj, member, key) \ hlist_for_each_entry(obj, &name[hash_min(key, elf_hash_bits())], member) -static void rb_add(struct rb_root *tree, struct rb_node *node, - int (*cmp)(struct rb_node *, const struct rb_node *)) -{ - struct rb_node **link = &tree->rb_node; - struct rb_node *parent = NULL; - - while (*link) { - parent = *link; - if (cmp(node, parent) < 0) - link = &parent->rb_left; - else - link = &parent->rb_right; - } - - rb_link_node(node, parent, link); - rb_insert_color(node, tree); -} - -static struct rb_node *rb_find_first(const struct rb_root *tree, const void *key, - int (*cmp)(const void *key, const struct rb_node *)) -{ - struct rb_node *node = tree->rb_node; - struct rb_node *match = NULL; - - while (node) { - int c = cmp(key, node); - if (c <= 0) { - if (!c) - match = node; - node = node->rb_left; - } else if (c > 0) { - node = node->rb_right; - } - } - - return match; -} - -static struct rb_node *rb_next_match(struct rb_node *node, const void *key, - int (*cmp)(const void *key, const struct rb_node *)) -{ - node = rb_next(node); - if (node && cmp(key, node)) - node = NULL; - return node; -} - -#define rb_for_each(tree, node, key, cmp) \ - for ((node) = rb_find_first((tree), (key), (cmp)); \ - (node); (node) = rb_next_match((node), (key), (cmp))) - -static int symbol_to_offset(struct rb_node *a, const struct rb_node *b) +static bool symbol_to_offset(struct rb_node *a, const struct rb_node *b) { struct symbol *sa = rb_entry(a, struct symbol, node); struct symbol *sb = rb_entry(b, struct symbol, node); if (sa->offset < sb->offset) - return -1; + return true; if (sa->offset > sb->offset) - return 1; + return false; if (sa->len < sb->len) - return -1; + return true; if (sa->len > sb->len) - return 1; + return false; sa->alias = sb; - return 0; + return false; } static int symbol_by_offset(const void *key, const struct rb_node *node) @@ -165,7 +114,7 @@ struct symbol *find_symbol_by_offset(struct section *sec, unsigned long offset) { struct rb_node *node; - rb_for_each(&sec->symbol_tree, node, &offset, symbol_by_offset) { + rb_for_each(node, &offset, &sec->symbol_tree, symbol_by_offset) { struct symbol *s = rb_entry(node, struct symbol, node); if (s->offset == offset && s->type != STT_SECTION) @@ -179,7 +128,7 @@ struct symbol *find_func_by_offset(struct section *sec, unsigned long offset) { struct rb_node *node; - rb_for_each(&sec->symbol_tree, node, &offset, symbol_by_offset) { + rb_for_each(node, &offset, &sec->symbol_tree, symbol_by_offset) { struct symbol *s = rb_entry(node, struct symbol, node); if (s->offset == offset && s->type == STT_FUNC) @@ -193,7 +142,7 @@ struct symbol *find_symbol_containing(const struct section *sec, unsigned long o { struct rb_node *node; - rb_for_each(&sec->symbol_tree, node, &offset, symbol_by_offset) { + rb_for_each(node, &offset, &sec->symbol_tree, symbol_by_offset) { struct symbol *s = rb_entry(node, struct symbol, node); if (s->type != STT_SECTION) @@ -207,7 +156,7 @@ struct symbol *find_func_containing(struct section *sec, unsigned long offset) { struct rb_node *node; - rb_for_each(&sec->symbol_tree, node, &offset, symbol_by_offset) { + rb_for_each(node, &offset, &sec->symbol_tree, symbol_by_offset) { struct symbol *s = rb_entry(node, struct symbol, node); if (s->type == STT_FUNC) @@ -352,7 +301,7 @@ static void elf_add_symbol(struct elf *elf, struct symbol *sym) sym->offset = sym->sym.st_value; sym->len = sym->sym.st_size; - rb_add(&sym->sec->symbol_tree, &sym->node, symbol_to_offset); + rb_add(&sym->node, &sym->sec->symbol_tree, symbol_to_offset); pnode = rb_prev(&sym->node); if (pnode) entry = &rb_entry(pnode, struct symbol, node)->list; -- 2.20.1

1 37

Kernel SIG 申报议题：开源之夏增加rust-for-linux driver支持
by lihongyu 29 Sep '22

29 Sep '22

议题：开源之夏 增加rust-for-linux driver支持简介：主要介绍一下rust-for-linux api支持和新增driver情况。

1 0

[PATCH openEuler-5.10 01/10] mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
by Zheng Zengkai 29 Sep '22

29 Sep '22

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v5.10.142 commit 895428ee124ad70b9763259308354877b725c31d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PE9S CVE: CVE-2022-39188 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit b67fbebd4cf980aecbcc750e1462128bffe8ae15 upstream. Some drivers rely on having all VMAs through which a PFN might be accessible listed in the rmap for correctness. However, on X86, it was possible for a VMA with stale TLB entries to not be listed in the rmap. This was fixed in mainline with commit b67fbebd4cf9 ("mmu_gather: Force tlb-flush VM_PFNMAP vmas"), but that commit relies on preceding refactoring in commit 18ba064e42df3 ("mmu_gather: Let there be one tlb_{start,end}_vma() implementation") and commit 1e9fdf21a4339 ("mmu_gather: Remove per arch tlb_{start,end}_vma()"). This patch provides equivalent protection without needing that refactoring, by forcing a TLB flush between removing PTEs in unmap_vmas() and the call to unlink_file_vma() in free_pgtables(). [This is a stable-specific rewrite of the upstream commit!] Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ze zuo <zuoze1(a)huawei.com> Reviewed-by: Chen Wandun <chenwandun(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- mm/mmap.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/mm/mmap.c b/mm/mmap.c index 5489d70db84e..7fba5d89ecde 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2962,6 +2962,18 @@ static void unmap_region(struct mm_struct *mm, tlb_gather_mmu(&tlb, mm, start, end); update_hiwater_rss(mm); unmap_vmas(&tlb, vma, start, end); + + /* + * Ensure we have no stale TLB entries by the time this mapping is + * removed from the rmap. + * Note that we don't have to worry about nested flushes here because + * we're holding the mm semaphore for removing the mapping - so any + * concurrent flush in this region has to be coming through the rmap, + * and we synchronize against that using the rmap lock. + */ + if ((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) != 0) + tlb_flush_mmu(&tlb); + free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS, next ? next->vm_start : USER_PGTABLES_CEILING); tlb_finish_mmu(&tlb, start, end); -- 2.20.1

1 9

[PATCH openEuler-5.10 000/427] Backport 5.10.121 LTS
by Zheng Zengkai 29 Sep '22

29 Sep '22

Backport 5.10.121 LTS patches from upstream. git cherry-pick v5.10.120..v5.10.121~1 -s Already merged(-13): 94845fc422f9 inotify: show inotify mask flags in proc fdinfo 9a9dc60da79a fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages dd887f83ea54 ext4: fix use-after-free in ext4_rename_dir_prepare adf490083ca5 ext4: fix warning in ext4_handle_inode_extension 1b061af03764 ext4: fix bug_on in ext4_writepages 4fd58b5cf118 ext4: fix bug_on in __es_tree_search 46c2b5f81c9e bcache: improve multithreaded bch_btree_check() 3f686b249b1c bcache: improve multithreaded bch_sectors_dirty_init() 0cf22f234ebc bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() 59afd4f28790 bcache: avoid journal no-space deadlock by reserving 1 journal bucket 893cf5f68a4c xfs: fix chown leaking delalloc quota blocks when fssetxattr fails e3ffe7387c70 xfs: force log and push AIL to clear pinned inodes when aborting mount 47c1680e51ef md: bcache: check the return value of kzalloc() in detached_dev_do_request() Rejected(-3): hinic driver drops related file in the patch: 33411945c9ad net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init dc7753d60097 net: huawei: hinic: Use devm_kcalloc() instead of devm_kzalloc() 8096e2d7c0f9 hinic: Avoid some over memory allocation Context conflict: 643ceee253a4 xfs: sync lazy sb accounting on quiesce of read-only mounts 80b0a2b3dfea bfq: Remove pointless bfq_init_rq() calls a67100f42665 ext4: only allow test_dummy_encryption when supported KABI changed(-2)： 147a376c1afe sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq 61bbbde9b6d2 drm: fix EDID struct for old ARM OABI format 7a55a5159dae scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac() KABI fixed(+1): sched/fair: Fix kabi broken in struct cfs_rq Defered(-5): 9834b13e8b96 tty: fix deadlock caused by calling printk() under tty_port->lock 70a7dea84639 bfq: Track whether bfq_group is still online 0285718e2825 bfq: Get rid of __bio_blkcg() usage 51f724bffa34 bfq: Make sure bfqg for which we are queueing requests is online c26ccbaeb8d8 kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add] Total patches: 449 - 13 - 3 - 2 + 1 - 5 = 427 Abhinav Kumar (1): drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path Abhishek Kumar (1): ath10k: skip ath10k_halt during suspend for driver state RESTARTING Aditya Garg (1): efi: Do not import certificates from UEFI Secure Boot for T2 Macs Aidan MacDonald (1): mmc: jz4740: Apply DMA engine limits to maximum segment size Akira Yokosawa (1): docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0 Albert Wang (1): usb: dwc3: gadget: Move null pinter check to proper place Alex Elder (2): net: ipa: fix page free in ipa_endpoint_trans_release() net: ipa: fix page free in ipa_endpoint_replenish_one() Alexander Aring (2): dlm: fix plock invalid read dlm: fix missing lkb refcount handling Alexander Wetzel (1): rtl818x: Prevent using not initialized queues Alexandre Ghiti (1): riscv: Initialize thread pointer before calling C functions Alexandru Elisei (1): arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall Alexey Dobriyan (1): proc: fix dentry/inode overinstantiating under /proc/${pid}/net Alexey Khoroshilov (1): ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv() Alice Wong (1): drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo Amadeusz Sławiński (1): ALSA: jack: Access input_dev under mutex Amelie Delaunay (3): dmaengine: stm32-mdma: remove GISR1 register dmaengine: stm32-mdma: rework interrupt handler dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler() Amir Goldstein (1): fsnotify: fix wrong lockdep annotations Ammar Faizi (2): x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails x86/delay: Fix the wrong asm constraint in delay_loop() Andre Przywara (1): ARM: dts: suniv: F1C100: fix watchdog compatible Andreas Gruenbacher (1): iomap: iomap_write_failed fix Andrii Nakryiko (2): libbpf: Don't error out on CO-RE relos for overriden weak subprogs libbpf: Fix logic for finding matching program for CO-RE relocation Archie Pusaka (2): Bluetooth: use inclusive language in HCI role comments Bluetooth: use inclusive language when filtering devices Arnd Bergmann (2): drbd: fix duplicate array initializer ARM: pxa: maybe fix gpio lookup tables Baochen Qiang (1): ath11k: Don't check arvif->is_started before sending management frames Bart Van Assche (1): scsi: ufs: qcom: Fix ufs_qcom_resume() Bhaskar Chowdhury (1): Bluetooth: L2CAP: Rudimentary typo fixes Biju Das (1): spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width} based on DMA direction Bjorn Andersson (1): soc: qcom: llcc: Add MODULE_DEVICE_TABLE() Bjorn Helgaas (1): PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299 Björn Ardö (1): mailbox: forward the hrtimer if not queued and under a lock Bob Peterson (1): gfs2: use i_lock spin_lock for inode qadata Borislav Petkov (1): x86/microcode: Add explicit CPU vendor dependency Brian Foster (3): xfs: sync lazy sb accounting on quiesce of read-only mounts xfs: restore shutdown check in mapped write fault path xfs: consider shutdown in bmapbt cursor delete assert Brian Norris (2): PM / devfreq: rk3399_dmc: Disable edev on remove() drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX Cai Huoqing (1): media: staging: media: rkvdec: Make use of the helper function devm_platform_ioremap_resource() Carl Yin(殷张成) (1): USB: serial: option: add Quectel BG95 modem Chao Yu (7): f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count() f2fs: fix to do sanity check on block address in f2fs_do_zero_range() f2fs: fix to clear dirty inode in f2fs_evict_inode() f2fs: fix deadloop in foreground GC f2fs: fix to do sanity check on total_data_blocks f2fs: fix fallocate to use file_modified to update permissions consistently f2fs: fix to do sanity check for inline inode Charles Keepax (3): ASoC: tscs454: Add endianness flag in snd_soc_component_driver ASoC: atmel-pdmic: Remove endianness flag on pdmic component ASoC: atmel-classd: Remove endianness flag on class d component Chen-Tsung Hsieh (1): mtd: spi-nor: core: Check written SR value in spi_nor_write_16bit_sr_and_check() Chen-Yu Tsai (1): media: hantro: Empty encoder capture buffers by default Chengming Zhou (1): sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq Christoph Hellwig (2): target: remove an incorrect unmap zeroes data deduction virtio_blk: fix the discard_granularity and discard_alignment queue limits Christophe JAILLET (4): media: aspeed: Fix an error handling path in aspeed_video_probe() memory: samsung: exynos5422-dmc: Avoid some over memory allocation drivers/base/memory: fix an unlikely reference counting issue in __add_memory_block() dmaengine: idxd: Fix the error handling path in idxd_cdev_register() Christophe de Dinechin (1): nodemask.h: fix compilation error with GCC12 Chuanhong Guo (1): arm: mediatek: select arch timer for mt7629 Colin Ian King (2): ALSA: pcm: Check for null pointer of pointer substream before dereferencing it selftests/resctrl: Fix null pointer dereference on open failed Corentin Labbe (3): crypto: marvell/cesa - ECB does not IV crypto: sun8i-ss - rework handling of IV crypto: sun8i-ss - handle zero sized sg Corey Minyard (2): ipmi:ssif: Check for NULL msg when handling events and messages ipmi: Fix pr_fmt to avoid compilation issues Cristian Marussi (1): firmware: arm_scmi: Fix list protocols enumeration in the base protocol Dan Carpenter (5): ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix drm/msm: return an error pointer in msm_gem_prime_get_sg_table() PCI: cadence: Fix find_first_zero_bit() limit PCI: rockchip: Fix find_first_zero_bit() limit OPP: call of_node_put() on error path in _bandwidth_supported() Dan Williams (2): nvdimm: Fix firmware activation deadlock scenarios nvdimm: Allow overwrite in the presence of disabled dimms Daniel Lezcano (2): thermal/drivers/core: Use a char pointer for the cooling device name thermal/core: Fix memory leak in the error path Daniel Thompson (1): irqchip/exiu: Fix acknowledgment of edge triggered interrupts Daniel Vetter (1): fbcon: Consistently protect deferred_takeover with console_lock() Darrick J. Wong (1): xfs: fix incorrect root dquot corruption error when switching group/project quota types Dave Airlie (1): drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. Dave Chinner (1): xfs: assert in xfs_btree_del_cursor should take into account error David Howells (7): rxrpc: Return an error to sendmsg if call failed rxrpc, afs: Fix selection of abort codes rxrpc: Fix listen() setting the bar too high for the prealloc rings rxrpc: Don't try to resend the request if we're receiving the reply rxrpc: Fix overlapping ACK accounting rxrpc: Don't let ack.previousPacket regress rxrpc: Fix decision on when to generate an IDLE ACK Dennis Dalessandro (1): RDMA/hfi1: Fix potential integer multiplication overflow errors Dimitri John Ledkov (1): cfg80211: declare MODULE_FIRMWARE for regulatory.db Dinh Nguyen (1): dt-bindings: gpio: altera: correct interrupt-cells Dmitry Baryshkov (2): drm/msm/dsi: fix error checks and return values for DSI xmit functions drm/msm: add missing include to msm_drv.c Dmitry Torokhov (1): Input: stmfts - do not leave device disabled in stmfts_input_open Dongliang Mu (3): HID: bigben: fix slab-out-of-bounds Write in bigben_probe rtlwifi: Use pr_warn instead of WARN_ONCE media: ov7670: remove ov7670_power_off from ov7670_remove Douglas Miller (2): RDMA/hfi1: Prevent panic when SDMA is disabled RDMA/hfi1: Prevent use of lock before it is initialized Duoming Zhou (1): NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx Emmanuel Grumbach (1): iwlwifi: mvm: fix assert 1F04 upon reconfig Eric Biggers (2): ext4: reject the 'commit' option on ext2 filesystems ext4: only allow test_dummy_encryption when supported Eric Dumazet (2): net: remove two BUG() from skb_checksum_help() sctp: read sk->sk_bound_dev_if once in sctp_rcv() Eric W. Biederman (3): ptrace/um: Replace PT_DTRACE with TIF_SINGLESTEP ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP ptrace: Reimplement PTRACE_KILL by always sending SIGKILL Eugenio Pérez (1): vdpasim: allow to enable a vq repeatedly Evan Quan (1): drm/amd/pm: fix the compile warning Fabio Estevam (1): net: phy: micrel: Allow probing without .driver_data Felix Fietkau (1): mac80211: upgrade passive scan to active scan on DFS channels after beacon rx Finn Thain (1): macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled Francesco Dolcini (1): PCI: imx6: Fix PERST# start-up sequence GUO Zihua (1): ima: remove the IMA_TEMPLATE Kconfig option Geert Uytterhoeven (2): m68k: atari: Make Atari ROM port I/O write macros return void m68k: math-emu: Fix dependencies of math emulation support Gilad Ben-Yossef (1): crypto: ccree - use fine grained DMA mapping dir Guenter Roeck (2): platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls MIPS: Loongson: Use hwmon_device_register_with_groups() to register hwmon Guo Ren (1): csky: patch_text: Fixup last cpu should be master Gustavo A. R. Silva (1): net: stmmac: selftests: Use kcalloc() instead of kzalloc() Hangyu Hua (3): media: rga: fix possible memory leak in rga_probe drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() misc: ocxl: fix possible double free in ocxl_file_register_afu Hans Verkuil (1): media: cec-adap.c: fix is_configuring state Hans de Goede (1): ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408 Haowen Bai (4): b43legacy: Fix assigning negative value to unsigned variable b43: Fix assigning negative value to unsigned variable ipw2x00: Fix potential NULL dereference in libipw_xmit() sfc: ef10: Fix assigning negative value to unsigned variable Haren Myneni (1): powerpc/powernv/vas: Assign real address to rx_fifo in vas_rx_win_attr Hari Bathini (2): powerpc/fadump: Fix fadump to work with a different endian capture kernel powerpc/fadump: fix PT_LOAD segment for boot memory area Hari Chandrakanthan (1): ath11k: disable spectral scan during spectral deinit Heiko Carstens (1): s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES Helge Deller (2): parisc/stifb: Implement fb_is_primary_device() parisc/stifb: Keep track of hardware path of graphics card Heming Zhao (1): md/bitmap: don't set sb values if can't pass sanity check Howard Chung (1): Bluetooth: Interleave with allowlist scan Jaegeuk Kim (1): f2fs: don't need inode lock for system hidden quota Jagan Teki (1): drm/panel: panel-simple: Fix proper bpc for AM-1280800N3TZQW-T00H Jakob Koschel (1): f2fs: fix dereference of stale list iterator after loop body Jakub Kicinski (2): eth: tg3: silence the GCC 12 array-bounds warning net: stmmac: fix out-of-bounds access in a selftest James Clark (1): perf tools: Use Python devtools for version autodetection rather than runtime James Smart (1): scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() Jan Kara (8): bfq: Split shared queues on move between cgroups bfq: Update cgroup information before merging bio ext4: verify dir block before splitting it ext4: avoid cycles in directory h-tree bfq: Avoid merging queues with different parents bfq: Drop pointless unlock-lock pair bfq: Remove pointless bfq_init_rq() calls block: fix bio_clone_blkg_association() to associate with proper blkcg_gq Jan Kiszka (1): efi: Add missing prototype for efi_capsule_setup_info Jani Nikula (2): drm/edid: fix invalid EDID extension block filtering drm/i915/dsi: fix VBT send packet port selection for ICL+ Janusz Krzysztofik (1): ARM: OMAP1: clock: Fix UART rate reporting algorithm Jason A. Donenfeld (2): openrisc: start CPU timer early in boot Revert "random: use static branch for crng_ready()" Jeffrey Mitchell (1): xfs: set inode size after creating symlink Jessica Zhang (2): drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected Jia-Wei Chang (1): cpufreq: mediatek: Use module_init and add module_exit Jiantao Zhang (1): PCI: dwc: Fix setting error return on MSI DMA mapping failure Jiasheng Jiang (1): drm: mali-dp: potential dereference of null pointer Jiri Slaby (1): serial: pch: don't overwrite xmit->buf[0] by x_char Joerg Roedel (1): iommu/amd: Increase timeout waiting for GA log enablement Johan Hovold (4): PCI: qcom: Fix runtime PM imbalance on probe errors PCI: qcom: Fix unbalanced PHY init on probe errors phy: qcom-qmp: fix struct clk leak on probe errors phy: qcom-qmp: fix reset-controller leak on probe errors Johannes Berg (3): nl80211: show SSID for P2P_GO interfaces wifi: mac80211: fix use-after-free in chanctx code um: chan_user: Fix winch_tramp() return value Jonas Karlman (1): media: rkvdec: h264: Fix bit depth wrap in pps packet Jonathan Bakker (1): ARM: dts: s5pv210: Remove spi-cs-high on panel in Aries Jonathan Teh (1): HID: hid-led: fix maximum brightness for Dream Cheeky Josh Poimboeuf (2): x86/speculation: Add missing prototype for unpriv_ebpf_notify() scripts/faddr2line: Fix overlapping text section failures Junxiao Bi via Ocfs2-devel (1): ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock Kajol Jain (1): powerpc/perf: Fix the threshold compare group constraint for power9 Kan Liang (1): perf/x86/intel: Fix event constraints for ICL Kathiravan T (1): arm64: dts: qcom: ipq8074: fix the sleep clock frequency Keita Suzuki (2): drm/amd/pm: fix double free in si_parse_power_table() tracing: Fix potential double free in create_var_ref() Keith Busch (1): nvme: set dma alignment to dword Kirill A. Shutemov (1): ACPICA: Avoid cache flush inside virtual machines Kishon Vijay Abraham I (1): usb: core: hcd: Add support for deferring roothub registration Kiwoong Kim (1): scsi: ufs: core: Exclude UECxx from SFR dump list Konrad Dybcio (2): arm64: dts: qcom: msm8994: Fix BLSP[12]_DMA channels count regulator: qcom_smd: Fix up PM8950 regulator configuration Krzysztof Kozlowski (6): ARM: dts: ox820: align interrupt controller node name with dtschema ARM: dts: s5pv210: align DMA channels with dtschema ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value pinctrl: mvebu: Fix irq_of_parse_and_map() return value Kuldeep Singh (1): spi: qcom-qspi: Add minItems to interconnect-names Kuninori Morimoto (2): ASoC: samsung: Use dev_err_probe() helper i2c: rcar: fix PM ref counts in probe error paths Kuogee Hsieh (3): drm/msm/dpu: adjust display_v_end for eDP and DP drm/msm/dp: stop event kernel thread when DP unbind drm/msm/dp: fix event thread stuck in wait_event after kthread_stop() Kuppuswamy Sathyanarayanan (1): PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits Kwanghoon Son (1): media: exynos4-is: Fix compile warning Lai Jiangshan (1): x86/sev: Annotate stack change in the #VC handler Len Brown (1): tools/power turbostat: fix ICX DRAM power numbers Leo Yan (1): perf c2c: Use stdio interface if slang is not supported Lin Ma (2): ASoC: rt5645: Fix errorenous cleanup order NFC: NULL out the dev->rfkill to prevent UAF Liu Zixian (1): drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes Liviu Dudau (1): drm/komeda: return early if drm_universal_plane_init() fails. Luca Weiss (1): media: venus: hfi: avoid null dereference in deinit Lucas Stach (2): drm/bridge: adv7511: clean up CEC adapter when probe fails drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem Lv Ruyi (7): scsi: megaraid: Fix error check return value of register_chrdev() drm: msm: fix error check return value of irq_of_parse_and_map() powerpc/xics: fix refcount leak in icp_opal_init() powerpc/powernv: fix missing of_node_put in uv_init() drm/msm/dp: fix error check return value of irq_of_parse_and_map() drm/msm/hdmi: fix error check return value of irq_of_parse_and_map() mfd: ipaq-micro: Fix error check return value of platform_get_irq() Maciej W. Rozycki (2): MIPS: IP27: Remove incorrect `cpu_has_fpu' override MIPS: IP30: Remove incorrect `cpu_has_fpu' override Manivannan Sadhasivam (1): scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled Mao Jinlong (1): coresight: core: Fix coresight device probe failure issue Marc Kleine-Budde (1): can: xilinx_can: mark bit timing constants as const Marek Vasut (2): drm/panel: simple: Add missing bus flags for Innolux G070Y2-L01 ARM: dts: stm32: Fix PHY post-reset delay on Avenger96 Mario Limonciello (1): ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default Marios Levogiannis (1): ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS Mark Bloch (1): net/mlx5: fs, delete the FTE when there are no rules attached to it Mark Brown (2): ASoC: dapm: Don't fold register value changes into notifications ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control Mathias Nyman (1): xhci: Allow host runtime PM as default for Intel Alder Lake N xHCI Matthieu Baerts (1): x86/pm: Fix false positive kmemleak report in msr_build_context() Max Filippov (1): irqchip: irq-xtensa-mx: fix initial IRQ affinity Max Krummenacher (1): ARM: dts: imx6dl-colibri: Fix I2C pinmuxing Maxime Ripard (3): drm/vc4: hvs: Reset muxes at probe time drm/vc4: txp: Don't set TXP_VSTART_AT_EOF drm/vc4: txp: Force alpha to be 0xff if it's disabled Miaohe Lin (1): drivers/base/node.c: fix compaction sysfs file leak Miaoqian Lin (20): ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout HID: elan: Fix potential double free in elan_input_configured drm/bridge: Fix error handling in analogix_dp_probe ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt ASoC: samsung: Fix refcount leak in aries_audio_probe media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe media: st-delta: Fix PM disable depth imbalance in delta_probe media: exynos4-is: Change clk_disable to clk_disable_unprepare ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_* drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc Input: sparcspkr - fix refcount leak in bbc_beep_probe powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup Michael Ellerman (1): powerpc/64: Only WARN if __pa()/__va() called with bad addresses Michael Rodin (1): media: vsp1: Fix offset calculation for plane cropping Michael Walle (1): i2c: at91: use dma safe buffers Mike Kravetz (1): hugetlb: fix huge_pmd_unshare address update Mike Travis (1): x86/platform/uv: Update TSC sync state for UV5 Mikulas Patocka (1): dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC Miles Chen (1): drm/mediatek: Fix mtk_cec_mask() Minghao Chi (1): scsi: ufs: Use pm_runtime_resume_and_get() instead of pm_runtime_get_sync() Monish Kumar R (1): USB: new quirk for Dell Gen 2 devices Muchun Song (1): dax: fix cache flush on PMD-mapped pages Nathan Chancellor (2): drm/i915: Fix CFI violation with show_dynamic_id() i2c: at91: Initialize dma_buf in at91_twi_xfer() Nico Boehr (1): s390/perf: obtain sie_block from the right address Nicolas Dufresne (3): media: rkvdec: h264: Fix dpb_valid implementation media: coda: Fix reported H264 profile media: coda: Add more H264 levels for CODA960 Nicolas Frattaroli (1): ASoC: rk3328: fix disabling mclk on pclk probe failure Niels Dossche (5): mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue ipv6: fix locking issues with loops over idev->addr_list IB/rdmavt: add missing locks in rvt_ruc_loopback ath11k: acquire ab->base_lock in unassign when finding the peer by addr Bluetooth: use hdev lock for accept_list and reject_list in conn req Niklas Cassel (1): binfmt_flat: do not stop relocating GOT entries prematurely on riscv Noralf Trønnes (1): dt-bindings: display: sitronix, st7735r: Fix backlight in example Nuno Sá (1): of: overlay: do not break notify on NOTIFY_{OK|STOP} OGAWA Hirofumi (1): fat: add ratelimit to fat*_ent_bread() Padmanabha Srinivasaiah (1): rcu-tasks: Fix race in schedule and flush work Pali Rohár (1): irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x Patrice Chotard (1): spi: stm32-qspi: Fix wait_cmd timeout in APM mode Paul Cercueil (1): drm/ingenic: Reset pixclock rate when parent clock rate changes Paul E. McKenney (2): rcu: Make TASKS_RUDE_RCU select IRQ_WORK scftorture: Fix distribution of short handler delays Paul Moore (1): lsm,selinux: pass flowi_common instead of flowi to the LSM hooks Pavel Skripkin (1): media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init Peilin Ye (1): Fonts: Make font size unsigned in font_desc Peng Wu (3): ARM: versatile: Add missing of_node_put in dcscb_init ARM: hisi: Add missing of_node_put after of_find_compatible_node powerpc/iommu: Add missing of_node_put in iommu_init_early_dart Petr Machata (2): mlxsw: spectrum_dcb: Do not warn about priority changes mlxsw: Treat LLDP packets as control Phil Auld (1): kselftest/cgroup: fix test_stress.sh to use OUTPUT dir Phil Elwell (3): ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED Philipp Zabel (1): media: coda: limit frame interval enumeration to supported encoder frame sizes Pierre-Louis Bossart (2): ASoC: max98357a: remove dependency on GPIOLIB ASoC: rt1015p: remove dependency on GPIOLIB Qinglang Miao (1): cpufreq: mediatek: add missing platform_driver_unregister() on error in mtk_cpufreq_driver_init QintaoShen (1): soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc Qu Wenruo (2): btrfs: add "0x" prefix for unsupported optional features btrfs: repair super block num_devices automatically Randy Dunlap (6): x86: Fix return value of __setup handlers x86/mm: Cleanup the control_va_addr_alignment() __setup handler powerpc/8xx: export 'cpm_setbrg' for modules powerpc/idle: Fix return value of __setup() handler powerpc/4xx/cpm: Fix return value of __setup() handler macintosh: via-pmu and via-cuda need RTC_LIB Ravi Bangoria (2): perf/amd/ibs: Cascade pmu init functions' return value perf/amd/ibs: Use interrupt regs ip for stack unwinding Rei Yamamoto (1): mm, compaction: fast_find_migrateblock() should return pfn in the target zone Rex-BC Chen (1): cpufreq: mediatek: Unregister platform device on exit Rik van der Kemp (1): ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop Ronnie Sahlberg (1): cifs: when extending a file with falloc we should make files not-sparse Russell King (Oracle) (1): net: dsa: mt7530: 1G can also support 1000BASE-X link mode Sakari Ailus (1): ACPI: property: Release subnode properties with data nodes Samuel Holland (1): riscv: Fix irq_work when SMP is disabled Sathish Narasimman (1): Bluetooth: LL privacy allow RPA Schspa Shi (1): cpufreq: Fix possible race in cpufreq online error path Sean Christopherson (3): KVM: nVMX: Leave most VM-Exit info fields unmodified on failed VM-Entry KVM: nVMX: Clear IDT vectoring on nested VM-Exit for double/triple fault Kconfig: Add option for asm goto w/ tied outputs to workaround clang-13 bug Sebastian Andrzej Siewior (1): crypto: cryptd - Protect per-CPU resource by disabling BH. Shawn Lin (1): arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 Smith, Kyle Miller (Nimble Kernel) (1): nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags Song Liu (1): ftrace: Clean up hash direct_functions on register failures Stefan Wahren (4): thermal/drivers/bcm2711: Don't clamp temperature at zero ARM: dts: bcm2835-rpi-b: Fix GPIO line names gpiolib: of: Introduce hook for missing gpio-ranges pinctrl: bcm2835: implement hook for missing gpio-ranges Steve French (1): SMB3: EBADF/EIO errors in rename/open caused by race condition in smb2_compound_op Steven Price (1): drm/plane: Move range check for format_count earlier Takashi Iwai (1): ALSA: usb-audio: Cancel pending work at closing a MIDI substream Tali Perry (2): i2c: npcm: Fix timeout calculation i2c: npcm: Handle spurious interrupts Tejas Upadhyay (1): iommu/vt-d: Add RPLS to quirk list to skip TE disabling Tejun Heo (1): blk-iolatency: Fix inflight count imbalances and IO hangs on offline Tetsuo Handa (1): media: imon: reorganize serialization Theodore Ts'o (1): ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state Thibaut VARÈNE (1): ath9k: fix QCA9561 PA bias level Thorsten Scherer (1): ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec clocks Tokunori Ikegami (2): mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N Tong Tiangen (1): arm64: fix types in copy_highpage() Trond Myklebust (5): NFS: Do not report EINTR/ERESTARTSYS as mapping errors NFS: fsync() should report filesystem errors over EINTR/ERESTARTSYS NFS: Do not report flush errors in nfs_write_end() NFS: Don't report errors from nfs_pageio_complete() more than once NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout Tyler Hicks (1): EDAC/dmc520: Don't print an error for each unconfigured interrupt line Tyrone Ting (1): i2c: npcm: Correct register access width Tzung-Bi Shih (1): platform/chrome: cros_ec: fix error handling in cros_ec_register() Vasily Averin (1): tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate Vignesh Raghavendra (1): drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit Vincent Mailhol (1): can: mcp251xfd: silence clang's -Wunaligned-access warning Vincent Whitchurch (1): um: Fix out-of-bounds read in LDT setup Vinod Polimera (1): drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume Viresh Kumar (1): Revert "cpufreq: Fix possible race in cpufreq online error path" Waiman Long (2): ipc/mqueue: use get_tree_nodev() in mqueue_get_tree() kseltest/cgroup: Make test_stress.sh work if run interactively Wenli Looi (1): ath9k: fix ar9003_get_eepmisc Xiao Yang (1): RDMA/rxe: Generate a completion for unsupported/invalid opcode Xiaomeng Tong (11): media: uvcvideo: Fix missing check to determine if element is found in list scsi: dc395x: Fix a missing check on list iterator drm/nouveau/clk: Fix an incorrect NULL check on list iterator drm/nouveau/kms/nv50-: atom: fix an incorrect NULL check on list iterator md: fix an incorrect NULL check in does_sb_need_changing md: fix an incorrect NULL check in md_reload_sb iommu/msm: Fix an incorrect NULL check on list iterator carl9170: tx: fix an incorrect use of list iterator stm: ltdc: fix two incorrect NULL checks on list iterator tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator gma500: fix an incorrect NULL check on list iterator Xie Yongji (1): nbd: Fix hung on disconnect request if socket is closed before Yang Jihong (1): perf tools: Add missing headers needed by util/data.h Yang Yingliang (10): pinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources() mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe() drm/msm/hdmi: check return value after calling platform_get_resource_byname() drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname() thermal/core: Fix memory leak in __thermal_cooling_device_register() ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition() pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources() hwrng: omap3-rom - fix using wrong clk_disable() in omap_rom_rng_runtime_resume() mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe() Yi Yang (1): xtensa/simdisk: fix proc_read_simdisk() Yicong Yang (1): PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() Ying Hsu (1): Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout Yong Wu (1): iommu/mediatek: Add list_del in mtk_iommu_remove Yonghong Song (1): selftests/bpf: fix btf_dump/btf_dump due to recent clang change Yongzhi Liu (1): hv_netvsc: Fix potential dereference of NULL pointer Yuntao Wang (1): bpf: Fix excessive memory allocation in stack_map_alloc() Zev Weiss (1): regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET Zheng Yongjun (2): spi: img-spfi: Fix pm_runtime_get_sync() error checking thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe Zheng Zengkai (1): sched/fair: Fix kabi broken in struct cfs_rq Zhengjun Xing (1): perf jevents: Fix event syntax error caused by ExtSel Zheyu Ma (3): media: pci: cx23885: Fix the error handling in cx23885_initdev() media: cx25821: Fix the warning when removing the module mtd: rawnand: denali: Use managed device resources Zhou Qingyang (1): drm/komeda: Fix an undefined behavior bug in komeda_plane_add() Zixuan Fu (1): fs: jfs: fix possible NULL pointer dereference in dbFree() Ziyang Xuan (1): thermal/core: fix a UAF bug in __thermal_cooling_device_register() jianghaoran (1): ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL liuyacan (1): net/smc: postpone sk_refcnt increment in connect() Documentation/conf.py | 2 +- .../bindings/display/sitronix,st7735r.yaml | 1 + .../devicetree/bindings/gpio/gpio-altera.txt | 5 +- .../bindings/spi/qcom,spi-qcom-qspi.yaml | 1 + arch/arm/boot/dts/bcm2835-rpi-b.dts | 13 +- arch/arm/boot/dts/bcm2835-rpi-zero-w.dts | 22 +- arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 2 +- arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts | 4 +- arch/arm/boot/dts/exynos5250-smdk5250.dts | 4 +- arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts | 6 +- arch/arm/boot/dts/imx6qdl-colibri.dtsi | 6 +- arch/arm/boot/dts/ox820.dtsi | 2 +- arch/arm/boot/dts/s5pv210-aries.dtsi | 3 +- arch/arm/boot/dts/s5pv210.dtsi | 12 +- .../boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 1 + arch/arm/boot/dts/suniv-f1c100s.dtsi | 4 +- arch/arm/mach-hisi/platsmp.c | 4 + arch/arm/mach-mediatek/Kconfig | 1 + arch/arm/mach-omap1/clock.c | 2 +- arch/arm/mach-pxa/cm-x300.c | 8 +- arch/arm/mach-pxa/magician.c | 2 +- arch/arm/mach-pxa/tosa.c | 4 +- arch/arm/mach-vexpress/dcscb.c | 1 + arch/arm64/Kconfig.platforms | 1 + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 2 +- arch/arm64/boot/dts/qcom/msm8994.dtsi | 4 +- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 2 +- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/mm/copypage.c | 4 +- arch/csky/kernel/probes/kprobes.c | 2 +- arch/m68k/Kconfig.cpu | 2 +- arch/m68k/include/asm/raw_io.h | 6 +- .../asm/mach-ip27/cpu-feature-overrides.h | 1 - .../asm/mach-ip30/cpu-feature-overrides.h | 1 - arch/openrisc/include/asm/timex.h | 1 + arch/openrisc/kernel/head.S | 9 + arch/parisc/include/asm/fb.h | 4 + arch/powerpc/include/asm/page.h | 7 +- arch/powerpc/include/asm/vas.h | 2 +- arch/powerpc/kernel/fadump.c | 8 +- arch/powerpc/kernel/idle.c | 2 +- arch/powerpc/perf/isa207-common.c | 3 +- arch/powerpc/platforms/4xx/cpm.c | 2 +- arch/powerpc/platforms/8xx/cpm1.c | 1 + arch/powerpc/platforms/powernv/opal-fadump.c | 94 ++++---- arch/powerpc/platforms/powernv/opal-fadump.h | 10 +- arch/powerpc/platforms/powernv/ultravisor.c | 1 + arch/powerpc/platforms/powernv/vas-fault.c | 2 +- arch/powerpc/platforms/powernv/vas-window.c | 4 +- arch/powerpc/platforms/powernv/vas.h | 2 +- arch/powerpc/sysdev/dart_iommu.c | 6 +- arch/powerpc/sysdev/fsl_rio.c | 2 + arch/powerpc/sysdev/xics/icp-opal.c | 1 + arch/riscv/include/asm/irq_work.h | 2 +- arch/riscv/kernel/head.S | 1 + arch/s390/include/asm/preempt.h | 15 +- arch/s390/kernel/perf_event.c | 2 +- arch/um/drivers/chan_user.c | 9 +- arch/um/include/asm/thread_info.h | 2 + arch/um/kernel/exec.c | 2 +- arch/um/kernel/process.c | 2 +- arch/um/kernel/ptrace.c | 8 +- arch/um/kernel/signal.c | 4 +- arch/x86/Kconfig | 4 +- arch/x86/entry/entry_64.S | 1 + arch/x86/entry/vdso/vma.c | 2 +- arch/x86/events/amd/ibs.c | 55 ++++- arch/x86/events/intel/core.c | 2 +- arch/x86/include/asm/acenv.h | 14 +- arch/x86/include/asm/suspend_32.h | 2 +- arch/x86/include/asm/suspend_64.h | 12 +- arch/x86/kernel/apic/apic.c | 2 +- arch/x86/kernel/apic/x2apic_uv_x.c | 8 +- arch/x86/kernel/cpu/intel.c | 2 +- arch/x86/kernel/cpu/mce/amd.c | 32 +-- arch/x86/kernel/step.c | 3 +- arch/x86/kernel/sys_x86_64.c | 7 +- arch/x86/kvm/vmx/nested.c | 45 +++- arch/x86/kvm/vmx/vmcs.h | 5 + arch/x86/lib/delay.c | 4 +- arch/x86/mm/pat/memtype.c | 2 +- arch/x86/um/ldt.c | 6 +- arch/xtensa/kernel/ptrace.c | 4 +- arch/xtensa/kernel/signal.c | 4 +- arch/xtensa/platforms/iss/simdisk.c | 18 +- block/bfq-cgroup.c | 36 ++- block/bfq-iosched.c | 36 ++- block/bfq-iosched.h | 1 + block/blk-cgroup.c | 8 +- block/blk-iolatency.c | 122 +++++----- crypto/cryptd.c | 23 +- drivers/acpi/property.c | 18 +- drivers/acpi/sleep.c | 12 + drivers/base/memory.c | 5 +- drivers/base/node.c | 1 + drivers/block/drbd/drbd_main.c | 11 +- drivers/block/nbd.c | 13 +- drivers/block/virtio_blk.c | 7 +- drivers/char/hw_random/omap3-rom-rng.c | 2 +- drivers/char/ipmi/ipmi_msghandler.c | 4 +- drivers/char/ipmi/ipmi_ssif.c | 23 ++ drivers/char/random.c | 12 +- drivers/cpufreq/mediatek-cpufreq.c | 19 +- .../allwinner/sun8i-ss/sun8i-ss-cipher.c | 115 ++++++--- .../crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 30 ++- .../crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 10 +- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 14 +- drivers/crypto/ccree/cc_buffer_mgr.c | 27 ++- drivers/crypto/marvell/cesa/cipher.c | 1 - drivers/crypto/nx/nx-common-powernv.c | 2 +- drivers/devfreq/rk3399_dmc.c | 2 + drivers/dma/idxd/cdev.c | 8 +- drivers/dma/stm32-mdma.c | 87 ++++--- drivers/edac/dmc520_edac.c | 2 +- drivers/firmware/arm_scmi/base.c | 2 +- drivers/gpio/gpiolib-of.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 3 +- drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c | 14 +- drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 8 +- .../gpu/drm/arm/display/komeda/komeda_plane.c | 10 +- drivers/gpu/drm/arm/malidp_crtc.c | 5 +- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 1 + .../drm/bridge/analogix/analogix_dp_core.c | 31 ++- drivers/gpu/drm/drm_edid.c | 6 +- drivers/gpu/drm/drm_plane.c | 14 +- drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 6 + drivers/gpu/drm/gma500/psb_intel_display.c | 7 +- drivers/gpu/drm/i915/display/intel_dsi_vbt.c | 33 ++- drivers/gpu/drm/i915/i915_perf.c | 4 +- drivers/gpu/drm/i915/i915_perf_types.h | 2 +- drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 61 ++++- drivers/gpu/drm/mediatek/mtk_cec.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 1 + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c | 1 + drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 8 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 14 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c | 6 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c | 15 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h | 4 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 15 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 +- drivers/gpu/drm/msm/dp/dp_display.c | 55 +++-- drivers/gpu/drm/msm/dsi/dsi_host.c | 21 +- drivers/gpu/drm/msm/hdmi/hdmi.c | 10 +- drivers/gpu/drm/msm/msm_drv.c | 1 + drivers/gpu/drm/msm/msm_gem_prime.c | 2 +- drivers/gpu/drm/nouveau/dispnv50/atom.h | 6 +- drivers/gpu/drm/nouveau/dispnv50/crc.c | 27 ++- .../gpu/drm/nouveau/nvkm/subdev/clk/base.c | 6 +- drivers/gpu/drm/panel/panel-simple.c | 3 +- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 2 +- drivers/gpu/drm/stm/ltdc.c | 16 +- drivers/gpu/drm/tilcdc/tilcdc_external.c | 8 +- drivers/gpu/drm/vc4/vc4_hvs.c | 26 ++- drivers/gpu/drm/vc4/vc4_txp.c | 8 +- drivers/gpu/drm/virtio/virtgpu_display.c | 2 + drivers/hid/hid-bigbenff.c | 6 + drivers/hid/hid-elan.c | 2 - drivers/hid/hid-led.c | 2 +- drivers/hwtracing/coresight/coresight-core.c | 33 ++- drivers/i2c/busses/i2c-at91-master.c | 11 + drivers/i2c/busses/i2c-npcm7xx.c | 103 +++++--- drivers/i2c/busses/i2c-rcar.c | 15 +- drivers/infiniband/hw/hfi1/file_ops.c | 2 + drivers/infiniband/hw/hfi1/init.c | 2 +- drivers/infiniband/hw/hfi1/sdma.c | 12 +- drivers/infiniband/sw/rdmavt/qp.c | 6 +- drivers/infiniband/sw/rxe/rxe_req.c | 2 +- drivers/input/misc/sparcspkr.c | 1 + drivers/input/touchscreen/stmfts.c | 16 +- drivers/iommu/amd/init.c | 2 +- drivers/iommu/intel/iommu.c | 2 +- drivers/iommu/msm_iommu.c | 11 +- drivers/iommu/mtk_iommu.c | 3 +- drivers/irqchip/irq-armada-370-xp.c | 11 +- drivers/irqchip/irq-aspeed-i2c-ic.c | 4 +- drivers/irqchip/irq-aspeed-scu-ic.c | 4 +- drivers/irqchip/irq-sni-exiu.c | 25 +- drivers/irqchip/irq-xtensa-mx.c | 18 +- drivers/macintosh/Kconfig | 6 + drivers/macintosh/Makefile | 3 +- drivers/macintosh/via-pmu.c | 2 +- drivers/mailbox/mailbox.c | 19 +- drivers/md/md-bitmap.c | 44 ++-- drivers/md/md.c | 18 +- drivers/media/cec/core/cec-adap.c | 6 +- drivers/media/i2c/ov7670.c | 1 - drivers/media/pci/cx23885/cx23885-core.c | 6 +- drivers/media/pci/cx25821/cx25821-core.c | 2 +- drivers/media/platform/aspeed-video.c | 4 +- drivers/media/platform/coda/coda-common.c | 35 ++- drivers/media/platform/exynos4-is/fimc-is.c | 6 +- .../platform/exynos4-is/fimc-isp-video.h | 2 +- drivers/media/platform/qcom/venus/hfi.c | 3 + drivers/media/platform/rockchip/rga/rga.c | 6 +- drivers/media/platform/sti/delta/delta-v4l2.c | 6 +- drivers/media/platform/vsp1/vsp1_rpf.c | 6 +- drivers/media/rc/imon.c | 99 ++++---- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 7 +- drivers/media/usb/uvc/uvc_v4l2.c | 20 +- drivers/memory/samsung/exynos5422-dmc.c | 5 +- drivers/mfd/davinci_voicecodec.c | 6 +- drivers/mfd/ipaq-micro.c | 2 +- drivers/misc/ocxl/file.c | 2 + drivers/mmc/host/jz4740_mmc.c | 20 ++ drivers/mmc/host/sdhci_am654.c | 23 +- drivers/mtd/chips/cfi_cmdset_0002.c | 103 ++++---- .../mtd/nand/raw/cadence-nand-controller.c | 5 +- drivers/mtd/nand/raw/denali_pci.c | 15 +- drivers/mtd/spi-nor/core.c | 9 + drivers/net/can/spi/mcp251xfd/mcp251xfd.h | 2 +- drivers/net/can/xilinx_can.c | 4 +- drivers/net/dsa/mt7530.c | 14 +- drivers/net/ethernet/broadcom/Makefile | 5 + .../chelsio/inline_crypto/chtls/chtls_cm.c | 2 +- .../net/ethernet/mellanox/mlx5/core/fs_core.c | 10 +- .../ethernet/mellanox/mlxsw/core_thermal.c | 2 +- .../ethernet/mellanox/mlxsw/spectrum_dcb.c | 13 -- .../ethernet/mellanox/mlxsw/spectrum_trap.c | 2 +- drivers/net/ethernet/sfc/ef10.c | 2 +- .../stmicro/stmmac/stmmac_selftests.c | 15 +- drivers/net/hyperv/netvsc_drv.c | 5 +- drivers/net/ipa/ipa_endpoint.c | 4 +- drivers/net/phy/micrel.c | 11 +- drivers/net/wireguard/socket.c | 4 +- drivers/net/wireless/ath/ath10k/mac.c | 20 +- drivers/net/wireless/ath/ath11k/mac.c | 16 +- drivers/net/wireless/ath/ath11k/spectral.c | 17 +- .../net/wireless/ath/ath9k/ar9003_eeprom.c | 2 +- drivers/net/wireless/ath/ath9k/ar9003_phy.h | 2 +- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 8 + drivers/net/wireless/ath/carl9170/tx.c | 3 + drivers/net/wireless/broadcom/b43/phy_n.c | 2 +- drivers/net/wireless/broadcom/b43legacy/phy.c | 2 +- .../net/wireless/intel/ipw2x00/libipw_tx.c | 2 +- .../net/wireless/intel/iwlwifi/mvm/power.c | 3 + drivers/net/wireless/marvell/mwifiex/11h.c | 2 + .../wireless/realtek/rtl818x/rtl8180/dev.c | 8 +- drivers/net/wireless/realtek/rtlwifi/usb.c | 2 +- drivers/nfc/st21nfca/se.c | 17 +- drivers/nfc/st21nfca/st21nfca.h | 1 + drivers/nvdimm/core.c | 9 - drivers/nvdimm/security.c | 5 - drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 1 + drivers/of/overlay.c | 4 +- drivers/opp/of.c | 2 +- .../pci/controller/cadence/pcie-cadence-ep.c | 3 +- drivers/pci/controller/dwc/pci-imx6.c | 23 +- .../pci/controller/dwc/pcie-designware-host.c | 3 +- drivers/pci/controller/dwc/pcie-qcom.c | 9 +- drivers/pci/controller/pcie-rockchip-ep.c | 3 +- drivers/pci/pci.c | 12 +- drivers/pci/pcie/aer.c | 7 +- drivers/phy/qualcomm/phy-qcom-qmp.c | 11 +- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 18 ++ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 2 +- drivers/pinctrl/renesas/core.c | 7 +- drivers/pinctrl/renesas/pinctrl-rzn1.c | 10 +- drivers/platform/chrome/cros_ec.c | 16 +- drivers/platform/chrome/cros_ec_chardev.c | 2 +- drivers/platform/chrome/cros_ec_proto.c | 50 +++- drivers/platform/mips/cpu_hwmon.c | 127 ++++------ drivers/regulator/core.c | 7 +- drivers/regulator/pfuze100-regulator.c | 2 + drivers/regulator/qcom_smd-regulator.c | 35 ++- drivers/scsi/dc395x.c | 15 +- drivers/scsi/lpfc/lpfc_sli.c | 6 +- drivers/scsi/megaraid.c | 2 +- drivers/scsi/ufs/ti-j721e-ufs.c | 6 +- drivers/scsi/ufs/ufs-qcom.c | 14 +- drivers/scsi/ufs/ufshcd.c | 7 +- drivers/soc/qcom/llcc-qcom.c | 1 + drivers/soc/qcom/smp2p.c | 1 + drivers/soc/qcom/smsm.c | 1 + drivers/soc/ti/ti_sci_pm_domains.c | 2 + drivers/spi/spi-fsl-qspi.c | 4 + drivers/spi/spi-img-spfi.c | 2 +- drivers/spi/spi-rspi.c | 15 +- drivers/spi/spi-stm32-qspi.c | 3 +- drivers/spi/spi-ti-qspi.c | 5 +- drivers/staging/media/hantro/hantro_v4l2.c | 8 +- drivers/staging/media/rkvdec/rkvdec-h264.c | 37 ++- drivers/staging/media/rkvdec/rkvdec.c | 4 +- drivers/target/target_core_device.c | 1 - drivers/thermal/broadcom/bcm2711_thermal.c | 5 +- drivers/thermal/broadcom/sr-thermal.c | 3 + drivers/thermal/imx_sc_thermal.c | 6 +- drivers/thermal/thermal_core.c | 42 ++-- drivers/tty/serial/pch_uart.c | 27 +-- drivers/usb/core/hcd.c | 29 ++- drivers/usb/core/quirks.c | 3 + drivers/usb/dwc3/gadget.c | 6 +- drivers/usb/host/xhci-pci.c | 2 + drivers/usb/serial/option.c | 2 + drivers/vdpa/vdpa_sim/vdpa_sim.c | 5 +- drivers/video/console/sticon.c | 5 +- drivers/video/console/sticore.c | 32 ++- drivers/video/fbdev/amba-clcd.c | 5 +- drivers/video/fbdev/core/fbcon.c | 5 +- drivers/video/fbdev/sticore.h | 3 + drivers/video/fbdev/stifb.c | 4 +- fs/afs/rxrpc.c | 8 +- fs/binfmt_flat.c | 27 ++- fs/btrfs/disk-io.c | 4 +- fs/btrfs/volumes.c | 8 +- fs/cifs/smb2inode.c | 2 - fs/cifs/smb2ops.c | 2 +- fs/dax.c | 3 +- fs/dlm/lock.c | 11 +- fs/dlm/plock.c | 12 +- fs/ext4/ext4.h | 6 - fs/ext4/namei.c | 54 +++-- fs/ext4/super.c | 24 +- fs/f2fs/f2fs.h | 19 +- fs/f2fs/file.c | 20 +- fs/f2fs/inline.c | 29 ++- fs/f2fs/inode.c | 19 +- fs/f2fs/segment.c | 42 ++-- fs/f2fs/segment.h | 33 ++- fs/f2fs/super.c | 6 +- fs/fat/fatent.c | 7 +- fs/gfs2/quota.c | 32 ++- fs/iomap/buffered-io.c | 3 +- fs/jfs/jfs_dmap.c | 3 +- fs/nfs/file.c | 16 +- fs/nfs/pnfs.c | 2 + fs/nfs/write.c | 11 +- fs/notify/mark.c | 6 +- fs/ocfs2/dlmfs/userdlm.c | 16 +- fs/proc/generic.c | 3 + fs/proc/proc_net.c | 3 + fs/xfs/libxfs/xfs_btree.c | 35 ++- fs/xfs/xfs_dquot.c | 39 +++- fs/xfs/xfs_iomap.c | 3 + fs/xfs/xfs_log.c | 28 ++- fs/xfs/xfs_log.h | 1 + fs/xfs/xfs_mount.c | 3 +- fs/xfs/xfs_symlink.c | 1 + include/linux/bpf.h | 2 + include/linux/efi.h | 2 + include/linux/font.h | 2 +- include/linux/gpio/driver.h | 12 + include/linux/lsm_hook_defs.h | 4 +- include/linux/lsm_hooks.h | 2 +- include/linux/mailbox_controller.h | 1 + include/linux/mtd/cfi.h | 1 + include/linux/nodemask.h | 13 +- include/linux/platform_data/cros_ec_proto.h | 3 + include/linux/ptrace.h | 7 - include/linux/security.h | 23 +- include/linux/thermal.h | 2 +- include/linux/usb/hcd.h | 2 + include/net/bluetooth/hci.h | 16 +- include/net/bluetooth/hci_core.h | 18 +- include/net/flow.h | 10 + include/net/if_inet6.h | 8 + include/net/route.h | 6 +- include/sound/jack.h | 1 + include/trace/events/rxrpc.h | 2 +- include/trace/events/vmscan.h | 4 +- init/Kconfig | 5 + ipc/mqueue.c | 14 ++ kernel/bpf/stackmap.c | 1 - kernel/dma/debug.c | 2 +- kernel/ptrace.c | 5 +- kernel/rcu/Kconfig | 1 + kernel/rcu/tasks.h | 3 + kernel/scftorture.c | 5 +- kernel/sched/fair.c | 8 +- kernel/sched/pelt.h | 4 +- kernel/sched/sched.h | 4 +- kernel/trace/ftrace.c | 5 +- kernel/trace/trace_events_hist.c | 3 + mm/compaction.c | 2 + mm/hugetlb.c | 9 +- net/bluetooth/hci_conn.c | 8 +- net/bluetooth/hci_core.c | 27 ++- net/bluetooth/hci_debugfs.c | 8 +- net/bluetooth/hci_event.c | 91 ++++---- net/bluetooth/hci_request.c | 221 ++++++++++++++---- net/bluetooth/hci_sock.c | 12 +- net/bluetooth/l2cap_core.c | 10 +- net/bluetooth/mgmt.c | 14 +- net/bluetooth/mgmt_config.c | 10 + net/bluetooth/sco.c | 21 +- net/bluetooth/smp.c | 6 +- net/core/dev.c | 8 +- net/dccp/ipv4.c | 2 +- net/dccp/ipv6.c | 6 +- net/ipv4/icmp.c | 4 +- net/ipv4/inet_connection_sock.c | 4 +- net/ipv4/ip_output.c | 2 +- net/ipv4/ping.c | 2 +- net/ipv4/raw.c | 2 +- net/ipv4/syncookies.c | 2 +- net/ipv4/udp.c | 2 +- net/ipv6/addrconf.c | 33 ++- net/ipv6/af_inet6.c | 2 +- net/ipv6/datagram.c | 2 +- net/ipv6/icmp.c | 6 +- net/ipv6/inet6_connection_sock.c | 4 +- net/ipv6/netfilter/nf_reject_ipv6.c | 2 +- net/ipv6/ping.c | 2 +- net/ipv6/raw.c | 2 +- net/ipv6/syncookies.c | 2 +- net/ipv6/tcp_ipv6.c | 4 +- net/ipv6/udp.c | 2 +- net/l2tp/l2tp_ip6.c | 2 +- net/mac80211/chan.c | 7 +- net/mac80211/ieee80211_i.h | 5 + net/mac80211/scan.c | 20 ++ net/netfilter/nf_synproxy_core.c | 2 +- net/nfc/core.c | 1 + net/rxrpc/ar-internal.h | 13 +- net/rxrpc/call_event.c | 7 +- net/rxrpc/conn_object.c | 2 +- net/rxrpc/input.c | 31 ++- net/rxrpc/output.c | 20 +- net/rxrpc/recvmsg.c | 8 +- net/rxrpc/sendmsg.c | 6 + net/rxrpc/sysctl.c | 4 +- net/sctp/input.c | 4 +- net/smc/af_smc.c | 2 +- net/wireless/nl80211.c | 1 + net/wireless/reg.c | 4 + net/xfrm/xfrm_state.c | 6 +- scripts/faddr2line | 150 +++++++----- security/integrity/ima/Kconfig | 14 +- .../platform_certs/keyring_handler.h | 8 + security/integrity/platform_certs/load_uefi.c | 33 +++ security/security.c | 17 +- security/selinux/hooks.c | 4 +- security/selinux/include/xfrm.h | 2 +- security/selinux/xfrm.c | 13 +- sound/core/jack.c | 34 ++- sound/core/pcm_memory.c | 3 +- sound/pci/hda/patch_realtek.c | 11 + sound/soc/atmel/atmel-classd.c | 1 - sound/soc/atmel/atmel-pdmic.c | 1 - sound/soc/codecs/Kconfig | 2 - sound/soc/codecs/max98090.c | 6 +- sound/soc/codecs/rk3328_codec.c | 2 +- sound/soc/codecs/rt5514.c | 2 +- sound/soc/codecs/rt5645.c | 7 +- sound/soc/codecs/tscs454.c | 12 +- sound/soc/codecs/wm2000.c | 6 +- sound/soc/fsl/imx-sgtl5000.c | 14 +- sound/soc/intel/boards/bytcr_rt5640.c | 12 + sound/soc/mediatek/mt2701/mt2701-wm8960.c | 9 +- sound/soc/mediatek/mt8173/mt8173-max98090.c | 5 +- sound/soc/mxs/mxs-saif.c | 1 + sound/soc/samsung/aries_wm8994.c | 17 +- sound/soc/samsung/arndale.c | 5 +- sound/soc/samsung/littlemill.c | 5 +- sound/soc/samsung/lowland.c | 5 +- sound/soc/samsung/odroid.c | 4 +- sound/soc/samsung/smdk_wm8994.c | 4 +- sound/soc/samsung/smdk_wm8994pcm.c | 4 +- sound/soc/samsung/snow.c | 9 +- sound/soc/samsung/speyside.c | 5 +- sound/soc/samsung/tm2_wm5110.c | 3 +- sound/soc/samsung/tobermory.c | 5 +- sound/soc/soc-dapm.c | 2 - sound/soc/ti/j721e-evm.c | 44 +++- sound/usb/midi.c | 3 + tools/lib/bpf/libbpf.c | 20 +- tools/perf/Makefile.config | 39 +++- tools/perf/builtin-c2c.c | 6 +- tools/perf/pmu-events/jevents.c | 2 +- tools/perf/util/data.h | 1 + tools/power/x86/turbostat/turbostat.c | 1 + .../bpf/progs/btf_dump_test_case_syntax.c | 2 +- tools/testing/selftests/cgroup/test_stress.sh | 2 +- tools/testing/selftests/resctrl/fill_buf.c | 4 +- 477 files changed, 3474 insertions(+), 1907 deletions(-) -- 2.20.1

1 427

[PATCH openEuler-1.0-LTS 1/3] mm: sharepool: delete redundant check in __sp_remap_get_pfn
by Yongqiang Liu 29 Sep '22

29 Sep '22

From: Guo Mengqi <guomengqi3(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5QETC CVE: NA -------------------------------- sp_make_share_k2u only supports vmalloc address now. Therefore, delete a backup handle case. Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/share_pool.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/mm/share_pool.c b/mm/share_pool.c index bd021da5a930..d49c066d1229 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -2860,11 +2860,11 @@ static int is_vmap_hugepage(unsigned long addr) static unsigned long __sp_remap_get_pfn(unsigned long kva) { - unsigned long pfn; + unsigned long pfn = -EINVAL; + + /* sp_make_share_k2u only support vmalloc address */ if (is_vmalloc_addr((void *)kva)) pfn = vmalloc_to_pfn((void *)kva); - else - pfn = virt_to_pfn(kva); return pfn; } -- 2.25.1

1 2

openEuler Kernel SIG例会
by openEuler conference 29 Sep '22

29 Sep '22

您好！ Kernel SIG 邀请您参加 2022-09-30 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG例会会议内容： 1.openEuler-22.09内核版本总结； 2.openEuler-22.03-LTS-SP1开始内核需求收集；会议链接：https://us06web.zoom.us/j/83050040350?pwd=eXdPa28zb1orVmRvS0J4c2lPUnhpUT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-09-30 14:00, The subject of the conference is openEuler Kernel SIG例会, Summary: 1.openEuler-22.09内核版本总结； 2.openEuler-22.03-LTS-SP1开始内核需求收集； You can join the meeting at https://us06web.zoom.us/j/83050040350?pwd=eXdPa28zb1orVmRvS0J4c2lPUnhpUT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-22.09] xfrm: Reinject transport-mode packets through workqueue
by Zheng Zengkai 29 Sep '22

29 Sep '22

From: Liu Jian <liujian56(a)huawei.com> maillist inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5K0NK CVE: NA Reference: https://patchwork.kernel.org/project/netdevbpf/patch/20220924080157.247678-… -------------------------------- The following warning is displayed when the tcp6-multi-diffip11 stress test case of the LTP test suite is tested: watchdog: BUG: soft lockup - CPU#0 stuck for 22s! [ns-tcpserver:48198] CPU: 0 PID: 48198 Comm: ns-tcpserver Kdump: loaded Not tainted 6.0.0-rc6+ #39 Hardware name: QEMU KVM Virtual Machine, BIOS 0.0.0 02/06/2015 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : des3_ede_encrypt+0x27c/0x460 [libdes] lr : 0x3f sp : ffff80000ceaa1b0 x29: ffff80000ceaa1b0 x28: ffff0000df056100 x27: ffff0000e51e5280 x26: ffff80004df75030 x25: ffff0000e51e4600 x24: 000000000000003b x23: 0000000000802080 x22: 000000000000003d x21: 0000000000000038 x20: 0000000080000020 x19: 000000000000000a x18: 0000000000000033 x17: ffff0000e51e4780 x16: ffff80004e2d1448 x15: ffff80004e2d1248 x14: ffff0000e51e4680 x13: ffff80004e2d1348 x12: ffff80004e2d1548 x11: ffff80004e2d1848 x10: ffff80004e2d1648 x9 : ffff80004e2d1748 x8 : ffff80004e2d1948 x7 : 000000000bcaf83d x6 : 000000000000001b x5 : ffff80004e2d1048 x4 : 00000000761bf3bf x3 : 000000007f1dd0a3 x2 : ffff0000e51e4780 x1 : ffff0000e3b9a2f8 x0 : 00000000db44e872 Call trace: des3_ede_encrypt+0x27c/0x460 [libdes] crypto_des3_ede_encrypt+0x1c/0x30 [des_generic] crypto_cbc_encrypt+0x148/0x190 crypto_skcipher_encrypt+0x2c/0x40 crypto_authenc_encrypt+0xc8/0xfc [authenc] crypto_aead_encrypt+0x2c/0x40 echainiv_encrypt+0x144/0x1a0 [echainiv] crypto_aead_encrypt+0x2c/0x40 esp6_output_tail+0x1c8/0x5d0 [esp6] esp6_output+0x120/0x278 [esp6] xfrm_output_one+0x458/0x4ec xfrm_output_resume+0x6c/0x1f0 xfrm_output+0xac/0x4ac __xfrm6_output+0x130/0x270 xfrm6_output+0x60/0xec ip6_xmit+0x2ec/0x5bc inet6_csk_xmit+0xbc/0x10c __tcp_transmit_skb+0x460/0x8c0 tcp_write_xmit+0x348/0x890 __tcp_push_pending_frames+0x44/0x110 tcp_rcv_established+0x3c8/0x720 tcp_v6_do_rcv+0xdc/0x4a0 tcp_v6_rcv+0xc24/0xcb0 ip6_protocol_deliver_rcu+0xf0/0x574 ip6_input_finish+0x48/0x7c ip6_input+0x48/0xc0 ip6_rcv_finish+0x80/0x9c xfrm_trans_reinject+0xb0/0xf4 tasklet_action_common.constprop.0+0xf8/0x134 tasklet_action+0x30/0x3c __do_softirq+0x128/0x368 do_softirq+0xb4/0xc0 __local_bh_enable_ip+0xb0/0xb4 put_cpu_fpsimd_context+0x40/0x70 kernel_neon_end+0x20/0x40 sha1_base_do_update.constprop.0.isra.0+0x11c/0x140 [sha1_ce] sha1_ce_finup+0x94/0x110 [sha1_ce] crypto_shash_finup+0x34/0xc0 hmac_finup+0x48/0xe0 crypto_shash_finup+0x34/0xc0 shash_digest_unaligned+0x74/0x90 crypto_shash_digest+0x4c/0x9c shash_ahash_digest+0xc8/0xf0 shash_async_digest+0x28/0x34 crypto_ahash_digest+0x48/0xcc crypto_authenc_genicv+0x88/0xcc [authenc] crypto_authenc_encrypt+0xd8/0xfc [authenc] crypto_aead_encrypt+0x2c/0x40 echainiv_encrypt+0x144/0x1a0 [echainiv] crypto_aead_encrypt+0x2c/0x40 esp6_output_tail+0x1c8/0x5d0 [esp6] esp6_output+0x120/0x278 [esp6] xfrm_output_one+0x458/0x4ec xfrm_output_resume+0x6c/0x1f0 xfrm_output+0xac/0x4ac __xfrm6_output+0x130/0x270 xfrm6_output+0x60/0xec ip6_xmit+0x2ec/0x5bc inet6_csk_xmit+0xbc/0x10c __tcp_transmit_skb+0x460/0x8c0 tcp_write_xmit+0x348/0x890 __tcp_push_pending_frames+0x44/0x110 tcp_push+0xb4/0x14c tcp_sendmsg_locked+0x71c/0xb64 tcp_sendmsg+0x40/0x6c inet6_sendmsg+0x4c/0x80 sock_sendmsg+0x5c/0x6c __sys_sendto+0x128/0x15c __arm64_sys_sendto+0x30/0x40 invoke_syscall+0x50/0x120 el0_svc_common.constprop.0+0x170/0x194 do_el0_svc+0x38/0x4c el0_svc+0x28/0xe0 el0t_64_sync_handler+0xbc/0x13c el0t_64_sync+0x180/0x184 Get softirq info by bcc tool: ./softirqs -NT 10 Tracing soft irq event time... Hit Ctrl-C to end. 15:34:34 SOFTIRQ TOTAL_nsecs block 158990 timer 20030920 sched 46577080 net_rx 676746820 tasklet 9906067650 15:34:45 SOFTIRQ TOTAL_nsecs block 86100 sched 38849790 net_rx 676532470 timer 1163848790 tasklet 9409019620 15:34:55 SOFTIRQ TOTAL_nsecs sched 58078450 net_rx 475156720 timer 533832410 tasklet 9431333300 The tasklet software interrupt takes too much time. Therefore, the xfrm_trans_reinject executor is changed from tasklet to workqueue. Add add spin lock to protect the queue. This reduces the processing flow of the tcp_sendmsg function in this scenario. Fixes: acf568ee859f0 ("xfrm: Reinject transport-mode packets through tasklet") Signed-off-by: Liu Jian <liujian56(a)huawei.com> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Conflicts: net/xfrm/xfrm_input.c Signed-off-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- net/xfrm/xfrm_input.c | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c index 61e6220ddd5a..66e4d3395f82 100644 --- a/net/xfrm/xfrm_input.c +++ b/net/xfrm/xfrm_input.c @@ -24,7 +24,8 @@ #include "xfrm_inout.h" struct xfrm_trans_tasklet { - struct tasklet_struct tasklet; + struct work_struct work; + spinlock_t queue_lock; struct sk_buff_head queue; }; @@ -760,18 +761,22 @@ int xfrm_input_resume(struct sk_buff *skb, int nexthdr) } EXPORT_SYMBOL(xfrm_input_resume); -static void xfrm_trans_reinject(unsigned long data) +static void xfrm_trans_reinject(struct work_struct *work) { - struct xfrm_trans_tasklet *trans = (void *)data; + struct xfrm_trans_tasklet *trans = container_of(work, struct xfrm_trans_tasklet, work); struct sk_buff_head queue; struct sk_buff *skb; __skb_queue_head_init(&queue); + spin_lock_bh(&trans->queue_lock); skb_queue_splice_init(&trans->queue, &queue); + spin_unlock_bh(&trans->queue_lock); + local_bh_disable(); while ((skb = __skb_dequeue(&queue))) XFRM_TRANS_SKB_CB(skb)->finish(XFRM_TRANS_SKB_CB(skb)->net, NULL, skb); + local_bh_enable(); } int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb, @@ -789,8 +794,10 @@ int xfrm_trans_queue_net(struct net *net, struct sk_buff *skb, XFRM_TRANS_SKB_CB(skb)->finish = finish; XFRM_TRANS_SKB_CB(skb)->net = net; + spin_lock_bh(&trans->queue_lock); __skb_queue_tail(&trans->queue, skb); - tasklet_schedule(&trans->tasklet); + spin_unlock_bh(&trans->queue_lock); + schedule_work(&trans->work); return 0; } EXPORT_SYMBOL(xfrm_trans_queue_net); @@ -817,8 +824,8 @@ void __init xfrm_input_init(void) struct xfrm_trans_tasklet *trans; trans = &per_cpu(xfrm_trans_tasklet, i); + spin_lock_init(&trans->queue_lock); __skb_queue_head_init(&trans->queue); - tasklet_init(&trans->tasklet, xfrm_trans_reinject, - (unsigned long)trans); + INIT_WORK(&trans->work, xfrm_trans_reinject); } } -- 2.20.1

1 0

[PATCH openEuler-1.0-LTS] Revert "cifs: fix double free race when mount fails in cifs_get_root()"
by Yongqiang Liu 29 Sep '22

29 Sep '22

From: Luo Meng <luomeng12(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5TMYD CVE: NA -------------------------------- This reverts commit 7959a47042a6c1ec5a97966cf3c04ee972b55348. Commit 2fe0e281f7ad (cifs: fix double free race when mount fails in cifs_get_root()) fixes a double free. However there is no such issue on 4.19 because it will return after cifs_cleanup_volume_info(). Since merge this patch, cifs_cleanup_volume_info() is skipped, leading to a memory leak. Signed-off-by: Luo Meng <luomeng12(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/cifs/cifsfs.c | 1 - 1 file changed, 1 deletion(-) diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c index baa1713d6695..bc906fcf3f6d 100644 --- a/fs/cifs/cifsfs.c +++ b/fs/cifs/cifsfs.c @@ -779,7 +779,6 @@ cifs_smb3_do_mount(struct file_system_type *fs_type, out_super: deactivate_locked_super(sb); - return root; out: cifs_cleanup_volume_info(volume_info); return root; -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 0/3] hisi_sas NCQ enhancement
by Yongqiang Liu 28 Sep '22

28 Sep '22

Xingui Yang (3): scsi: hisi_sas: Modify v3 HW ATA completion process when SATA disk is in error status scsi: hisi_sas: Enable force phy when SATA disk directly connected scsi: hisi_sas: Release resource directly in hisi_sas_abort_task() when NCQ error drivers/scsi/hisi_sas/hisi_sas.h | 1 + drivers/scsi/hisi_sas/hisi_sas_main.c | 20 +++++++++---- drivers/scsi/hisi_sas/hisi_sas_v2_hw.c | 10 +++++-- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 41 ++++++++++++++++++++++++-- 4 files changed, 61 insertions(+), 11 deletions(-) -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS] sched: Fix invalid free for tsk->se.dyn_affi_stats
by Yongqiang Liu 28 Sep '22

28 Sep '22

From: Hui Tang <tanghui20(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5TIOZ CVE: NA -------------------------------- BUG: KASAN: double-free or invalid-free in sched_prefer_cpus_free[...] Freed by task 0: save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x120/0x228 mm/kasan/kasan.c:521 kasan_slab_free+0x10/0x18 mm/kasan/kasan.c:528 slab_free_hook mm/slub.c:1397 [inline] slab_free_freelist_hook mm/slub.c:1425 [inline] slab_free mm/slub.c:3004 [inline] kfree+0x84/0x250 mm/slub.c:3965 sched_prefer_cpus_free+0x58/0x78 kernel/sched/core.c:7219 free_task+0xb0/0xe8 kernel/fork.c:463 __delayed_free_task+0x24/0x30 kernel/fork.c:1716 __rcu_reclaim kernel/rcu/rcu.h:236 [inline] rcu_do_batch+0x200/0x5e0 kernel/rcu/tree.c:2584 invoke_rcu_callbacks kernel/rcu/tree.c:2897 [inline] __rcu_process_callbacks kernel/rcu/tree.c:2864 [inline] rcu_process_callbacks+0x470/0xb60 kernel/rcu/tree.c:2881 __do_softirq+0x2d0/0xba0 kernel/softirq.c:292 Add init of 'tsk->se.dyn_affi_stats == NULL' in dup_task_struct(). Fixes: ebca52abe099c ("sched: Add statistics for scheduler dynamic affinity") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> Reviewed-by: Zhang Qiao <zhangqiao22(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- kernel/fork.c | 1 + 1 file changed, 1 insertion(+) diff --git a/kernel/fork.c b/kernel/fork.c index 4207d5e5958b..b5453a26655e 100644 --- a/kernel/fork.c +++ b/kernel/fork.c @@ -893,6 +893,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node) #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY tsk->prefer_cpus = NULL; + tsk->se.dyn_affi_stats = NULL; #endif setup_thread_stack(tsk, orig); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/6] mm: fix missing handler for __GFP_NOWARN
by Yongqiang Liu 28 Sep '22

28 Sep '22

From: Qi Zheng <zhengqi.arch(a)bytedance.com> mainline inclusion from mainline-v5.19-rc1 commit 3f913fc5f9745613088d3c569778c9813ab9c129 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5T8FD CVE: NA -------------------------------- We expect no warnings to be issued when we specify __GFP_NOWARN, but currently in paths like alloc_pages() and kmalloc(), there are still some warnings printed, fix it. But for some warnings that report usage problems, we don't deal with them. If such warnings are printed, then we should fix the usage problems. Such as the following case: WARN_ON_ONCE((gfp_flags & __GFP_NOFAIL) && (order > 1)); [zhengqi.arch(a)bytedance.com: v2] Link: https://lkml.kernel.org/r/20220511061951.1114-1-zhengqi.arch@bytedance.com Link: https://lkml.kernel.org/r/20220510113809.80626-1-zhengqi.arch@bytedance.com Signed-off-by: Qi Zheng <zhengqi.arch(a)bytedance.com> Cc: Akinobu Mita <akinobu.mita(a)gmail.com> Cc: Vlastimil Babka <vbabka(a)suse.cz> Cc: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Cc: Jiri Slaby <jirislaby(a)kernel.org> Cc: Steven Rostedt (Google) <rostedt(a)goodmis.org> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Conflict: mm/internal.h mm/page_alloc.c Signed-off-by: Ye Weihua <yeweihua4(a)huawei.com> Reviewed-by: Kuohai Xu <xukuohai(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- include/linux/fault-inject.h | 2 ++ lib/fault-inject.c | 3 +++ mm/failslab.c | 3 +++ mm/internal.h | 15 +++++++++++++++ mm/page_alloc.c | 16 +++++++++------- 5 files changed, 32 insertions(+), 7 deletions(-) diff --git a/include/linux/fault-inject.h b/include/linux/fault-inject.h index 7e6c77740413..4f00068354c1 100644 --- a/include/linux/fault-inject.h +++ b/include/linux/fault-inject.h @@ -20,6 +20,7 @@ struct fault_attr { atomic_t space; unsigned long verbose; bool task_filter; + bool no_warn; unsigned long stacktrace_depth; unsigned long require_start; unsigned long require_end; @@ -39,6 +40,7 @@ struct fault_attr { .ratelimit_state = RATELIMIT_STATE_INIT_DISABLED, \ .verbose = 2, \ .dname = NULL, \ + .no_warn = false, \ } #define DECLARE_FAULT_ATTR(name) struct fault_attr name = FAULT_ATTR_INITIALIZER diff --git a/lib/fault-inject.c b/lib/fault-inject.c index cf7b129b0b2b..af8b0ae64a85 100644 --- a/lib/fault-inject.c +++ b/lib/fault-inject.c @@ -40,6 +40,9 @@ EXPORT_SYMBOL_GPL(setup_fault_attr); static void fail_dump(struct fault_attr *attr) { + if (attr->no_warn) + return; + if (attr->verbose > 0 && __ratelimit(&attr->ratelimit_state)) { printk(KERN_NOTICE "FAULT_INJECTION: forcing a failure.\n" "name %pd, interval %lu, probability %lu, " diff --git a/mm/failslab.c b/mm/failslab.c index 215cb1ea169d..f4d829f95454 100644 --- a/mm/failslab.c +++ b/mm/failslab.c @@ -30,6 +30,9 @@ bool __should_failslab(struct kmem_cache *s, gfp_t gfpflags) if (failslab.cache_filter && !(s->flags & SLAB_FAILSLAB)) return false; + if (gfpflags & __GFP_NOWARN) + failslab.attr.no_warn = true; + return should_fail(&failslab.attr, s->object_size); } diff --git a/mm/internal.h b/mm/internal.h index c94de10189eb..1b861446c751 100644 --- a/mm/internal.h +++ b/mm/internal.h @@ -36,6 +36,21 @@ /* Do not use these with a slab allocator */ #define GFP_SLAB_BUG_MASK (__GFP_DMA32|__GFP_HIGHMEM|~__GFP_BITS_MASK) +/* + * Different from WARN_ON_ONCE(), no warning will be issued + * when we specify __GFP_NOWARN. + */ +#define WARN_ON_ONCE_GFP(cond, gfp) ({ \ + static bool __section(".data.once") __warned; \ + int __ret_warn_once = !!(cond); \ + \ + if (unlikely(!(gfp & __GFP_NOWARN) && __ret_warn_once && !__warned)) { \ + __warned = true; \ + WARN_ON(1); \ + } \ + unlikely(__ret_warn_once); \ +}) + void page_writeback_init(void); vm_fault_t do_swap_page(struct vm_fault *vmf); diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 44d286286dbb..cede3ebe7353 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -3253,6 +3253,9 @@ static bool should_fail_alloc_page(gfp_t gfp_mask, unsigned int order) (gfp_mask & __GFP_DIRECT_RECLAIM)) return false; + if (gfp_mask & __GFP_NOWARN) + fail_page_alloc.attr.no_warn = true; + return should_fail(&fail_page_alloc.attr, 1 << order); } @@ -3743,7 +3746,8 @@ __alloc_pages_may_oom(gfp_t gfp_mask, unsigned int order, goto out; /* Exhausted what can be done so it's blame time */ - if (out_of_memory(&oc) || WARN_ON_ONCE(gfp_mask & __GFP_NOFAIL)) { + if (out_of_memory(&oc) || + WARN_ON_ONCE_GFP(gfp_mask & __GFP_NOFAIL, gfp_mask)) { *did_some_progress = 1; /* @@ -4534,7 +4538,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, * All existing users of the __GFP_NOFAIL are blockable, so warn * of any new users that actually require GFP_NOWAIT */ - if (WARN_ON_ONCE(!can_direct_reclaim)) + if (WARN_ON_ONCE_GFP(!can_direct_reclaim, gfp_mask)) goto fail; /* @@ -4542,7 +4546,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, * because we cannot reclaim anything and only can loop waiting * for somebody to do a work for us */ - WARN_ON_ONCE(current->flags & PF_MEMALLOC); + WARN_ON_ONCE_GFP(current->flags & PF_MEMALLOC, gfp_mask); /* * non failing costly orders are a hard requirement which we @@ -4550,7 +4554,7 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, * so that we can identify them and convert them to something * else. */ - WARN_ON_ONCE(order > PAGE_ALLOC_COSTLY_ORDER); + WARN_ON_ONCE_GFP(order > PAGE_ALLOC_COSTLY_ORDER, gfp_mask); /* * Help non-failing allocations by giving them access to memory @@ -4732,10 +4736,8 @@ __alloc_pages_nodemask(gfp_t gfp_mask, unsigned int order, int preferred_nid, * There are several places where we assume that the order value is sane * so bail out early if the request is out of bound. */ - if (unlikely(order >= MAX_ORDER)) { - WARN_ON_ONCE(!(gfp_mask & __GFP_NOWARN)); + if (WARN_ON_ONCE_GFP(order >= MAX_ORDER, gfp_mask)) return NULL; - } prepare_before_alloc(&gfp_mask); -- 2.25.1

1 5

[PATCH openEuler-5.10-LTS 01/17] mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
by Zheng Zengkai 27 Sep '22

27 Sep '22

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v5.10.142 commit 895428ee124ad70b9763259308354877b725c31d category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PE9S CVE: CVE-2022-39188 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=… -------------------------------- commit b67fbebd4cf980aecbcc750e1462128bffe8ae15 upstream. Some drivers rely on having all VMAs through which a PFN might be accessible listed in the rmap for correctness. However, on X86, it was possible for a VMA with stale TLB entries to not be listed in the rmap. This was fixed in mainline with commit b67fbebd4cf9 ("mmu_gather: Force tlb-flush VM_PFNMAP vmas"), but that commit relies on preceding refactoring in commit 18ba064e42df3 ("mmu_gather: Let there be one tlb_{start,end}_vma() implementation") and commit 1e9fdf21a4339 ("mmu_gather: Remove per arch tlb_{start,end}_vma()"). This patch provides equivalent protection without needing that refactoring, by forcing a TLB flush between removing PTEs in unmap_vmas() and the call to unlink_file_vma() in free_pgtables(). [This is a stable-specific rewrite of the upstream commit!] Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: ze zuo <zuoze1(a)huawei.com> Reviewed-by: Chen Wandun <chenwandun(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- mm/mmap.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/mm/mmap.c b/mm/mmap.c index 5489d70db84e..7fba5d89ecde 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2962,6 +2962,18 @@ static void unmap_region(struct mm_struct *mm, tlb_gather_mmu(&tlb, mm, start, end); update_hiwater_rss(mm); unmap_vmas(&tlb, vma, start, end); + + /* + * Ensure we have no stale TLB entries by the time this mapping is + * removed from the rmap. + * Note that we don't have to worry about nested flushes here because + * we're holding the mm semaphore for removing the mapping - so any + * concurrent flush in this region has to be coming through the rmap, + * and we synchronize against that using the rmap lock. + */ + if ((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) != 0) + tlb_flush_mmu(&tlb); + free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS, next ? next->vm_start : USER_PGTABLES_CEILING); tlb_finish_mmu(&tlb, start, end); -- 2.20.1

1 16

[PATCH openEuler-5.10-LTS 000/427] Backport 5.10.121 LTS
by Zheng Zengkai 27 Sep '22

27 Sep '22

Backport 5.10.121 LTS patches from upstream. git cherry-pick v5.10.120..v5.10.121~1 -s Already merged(-13): 94845fc422f9 inotify: show inotify mask flags in proc fdinfo 9a9dc60da79a fs-writeback: writeback_sb_inodes：Recalculate 'wrote' according skipped pages dd887f83ea54 ext4: fix use-after-free in ext4_rename_dir_prepare adf490083ca5 ext4: fix warning in ext4_handle_inode_extension 1b061af03764 ext4: fix bug_on in ext4_writepages 4fd58b5cf118 ext4: fix bug_on in __es_tree_search 46c2b5f81c9e bcache: improve multithreaded bch_btree_check() 3f686b249b1c bcache: improve multithreaded bch_sectors_dirty_init() 0cf22f234ebc bcache: remove incremental dirty sector counting for bch_sectors_dirty_init() 59afd4f28790 bcache: avoid journal no-space deadlock by reserving 1 journal bucket 893cf5f68a4c xfs: fix chown leaking delalloc quota blocks when fssetxattr fails e3ffe7387c70 xfs: force log and push AIL to clear pinned inodes when aborting mount 47c1680e51ef md: bcache: check the return value of kzalloc() in detached_dev_do_request() Rejected(-3): hinic driver drops related file in the patch: 33411945c9ad net: hinic: add missing destroy_workqueue in hinic_pf_to_mgmt_init dc7753d60097 net: huawei: hinic: Use devm_kcalloc() instead of devm_kzalloc() 8096e2d7c0f9 hinic: Avoid some over memory allocation Context conflict: 643ceee253a4 xfs: sync lazy sb accounting on quiesce of read-only mounts 80b0a2b3dfea bfq: Remove pointless bfq_init_rq() calls a67100f42665 ext4: only allow test_dummy_encryption when supported KABI changed(-2)： 147a376c1afe sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq 61bbbde9b6d2 drm: fix EDID struct for old ARM OABI format 7a55a5159dae scsi: fcoe: Fix Wstringop-overflow warnings in fcoe_wwn_from_mac() KABI fixed(+1): sched/fair: Fix kabi broken in struct cfs_rq Defered(-5): 9834b13e8b96 tty: fix deadlock caused by calling printk() under tty_port->lock 70a7dea84639 bfq: Track whether bfq_group is still online 0285718e2825 bfq: Get rid of __bio_blkcg() usage 51f724bffa34 bfq: Make sure bfqg for which we are queueing requests is online c26ccbaeb8d8 kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add] Total patches: 449 - 13 - 3 - 2 + 1 - 5 = 427 Abhinav Kumar (1): drm/msm/dpu: handle pm_runtime_get_sync() errors in bind path Abhishek Kumar (1): ath10k: skip ath10k_halt during suspend for driver state RESTARTING Aditya Garg (1): efi: Do not import certificates from UEFI Secure Boot for T2 Macs Aidan MacDonald (1): mmc: jz4740: Apply DMA engine limits to maximum segment size Akira Yokosawa (1): docs/conf.py: Cope with removal of language=None in Sphinx 5.0.0 Albert Wang (1): usb: dwc3: gadget: Move null pinter check to proper place Alex Elder (2): net: ipa: fix page free in ipa_endpoint_trans_release() net: ipa: fix page free in ipa_endpoint_replenish_one() Alexander Aring (2): dlm: fix plock invalid read dlm: fix missing lkb refcount handling Alexander Wetzel (1): rtl818x: Prevent using not initialized queues Alexandre Ghiti (1): riscv: Initialize thread pointer before calling C functions Alexandru Elisei (1): arm64: compat: Do not treat syscall number as ESR_ELx for a bad syscall Alexey Dobriyan (1): proc: fix dentry/inode overinstantiating under /proc/${pid}/net Alexey Khoroshilov (1): ASoC: max98090: Move check for invalid values before casting in max98090_put_enab_tlv() Alice Wong (1): drm/amdgpu/ucode: Remove firmware load type check in amdgpu_ucode_free_bo Amadeusz Sławiński (1): ALSA: jack: Access input_dev under mutex Amelie Delaunay (3): dmaengine: stm32-mdma: remove GISR1 register dmaengine: stm32-mdma: rework interrupt handler dmaengine: stm32-mdma: fix chan initialization in stm32_mdma_irq_handler() Amir Goldstein (1): fsnotify: fix wrong lockdep annotations Ammar Faizi (2): x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails x86/delay: Fix the wrong asm constraint in delay_loop() Andre Przywara (1): ARM: dts: suniv: F1C100: fix watchdog compatible Andreas Gruenbacher (1): iomap: iomap_write_failed fix Andrii Nakryiko (2): libbpf: Don't error out on CO-RE relos for overriden weak subprogs libbpf: Fix logic for finding matching program for CO-RE relocation Archie Pusaka (2): Bluetooth: use inclusive language in HCI role comments Bluetooth: use inclusive language when filtering devices Arnd Bergmann (2): drbd: fix duplicate array initializer ARM: pxa: maybe fix gpio lookup tables Baochen Qiang (1): ath11k: Don't check arvif->is_started before sending management frames Bart Van Assche (1): scsi: ufs: qcom: Fix ufs_qcom_resume() Bhaskar Chowdhury (1): Bluetooth: L2CAP: Rudimentary typo fixes Biju Das (1): spi: spi-rspi: Remove setting {src,dst}_{addr,addr_width} based on DMA direction Bjorn Andersson (1): soc: qcom: llcc: Add MODULE_DEVICE_TABLE() Bjorn Helgaas (1): PCI/PM: Fix bridge_d3_blacklist[] Elo i2 overwrite of Gigabyte X299 Björn Ardö (1): mailbox: forward the hrtimer if not queued and under a lock Bob Peterson (1): gfs2: use i_lock spin_lock for inode qadata Borislav Petkov (1): x86/microcode: Add explicit CPU vendor dependency Brian Foster (3): xfs: sync lazy sb accounting on quiesce of read-only mounts xfs: restore shutdown check in mapped write fault path xfs: consider shutdown in bmapbt cursor delete assert Brian Norris (2): PM / devfreq: rk3399_dmc: Disable edev on remove() drm/bridge: analogix_dp: Grab runtime PM reference for DP-AUX Cai Huoqing (1): media: staging: media: rkvdec: Make use of the helper function devm_platform_ioremap_resource() Carl Yin(殷张成) (1): USB: serial: option: add Quectel BG95 modem Chao Yu (7): f2fs: fix to avoid f2fs_bug_on() in dec_valid_node_count() f2fs: fix to do sanity check on block address in f2fs_do_zero_range() f2fs: fix to clear dirty inode in f2fs_evict_inode() f2fs: fix deadloop in foreground GC f2fs: fix to do sanity check on total_data_blocks f2fs: fix fallocate to use file_modified to update permissions consistently f2fs: fix to do sanity check for inline inode Charles Keepax (3): ASoC: tscs454: Add endianness flag in snd_soc_component_driver ASoC: atmel-pdmic: Remove endianness flag on pdmic component ASoC: atmel-classd: Remove endianness flag on class d component Chen-Tsung Hsieh (1): mtd: spi-nor: core: Check written SR value in spi_nor_write_16bit_sr_and_check() Chen-Yu Tsai (1): media: hantro: Empty encoder capture buffers by default Chengming Zhou (1): sched/fair: Fix cfs_rq_clock_pelt() for throttled cfs_rq Christoph Hellwig (2): target: remove an incorrect unmap zeroes data deduction virtio_blk: fix the discard_granularity and discard_alignment queue limits Christophe JAILLET (4): media: aspeed: Fix an error handling path in aspeed_video_probe() memory: samsung: exynos5422-dmc: Avoid some over memory allocation drivers/base/memory: fix an unlikely reference counting issue in __add_memory_block() dmaengine: idxd: Fix the error handling path in idxd_cdev_register() Christophe de Dinechin (1): nodemask.h: fix compilation error with GCC12 Chuanhong Guo (1): arm: mediatek: select arch timer for mt7629 Colin Ian King (2): ALSA: pcm: Check for null pointer of pointer substream before dereferencing it selftests/resctrl: Fix null pointer dereference on open failed Corentin Labbe (3): crypto: marvell/cesa - ECB does not IV crypto: sun8i-ss - rework handling of IV crypto: sun8i-ss - handle zero sized sg Corey Minyard (2): ipmi:ssif: Check for NULL msg when handling events and messages ipmi: Fix pr_fmt to avoid compilation issues Cristian Marussi (1): firmware: arm_scmi: Fix list protocols enumeration in the base protocol Dan Carpenter (5): ath9k_htc: fix potential out of bounds access with invalid rxstatus->rs_keyix drm/msm: return an error pointer in msm_gem_prime_get_sg_table() PCI: cadence: Fix find_first_zero_bit() limit PCI: rockchip: Fix find_first_zero_bit() limit OPP: call of_node_put() on error path in _bandwidth_supported() Dan Williams (2): nvdimm: Fix firmware activation deadlock scenarios nvdimm: Allow overwrite in the presence of disabled dimms Daniel Lezcano (2): thermal/drivers/core: Use a char pointer for the cooling device name thermal/core: Fix memory leak in the error path Daniel Thompson (1): irqchip/exiu: Fix acknowledgment of edge triggered interrupts Daniel Vetter (1): fbcon: Consistently protect deferred_takeover with console_lock() Darrick J. Wong (1): xfs: fix incorrect root dquot corruption error when switching group/project quota types Dave Airlie (1): drm/amdgpu/cs: make commands with 0 chunks illegal behaviour. Dave Chinner (1): xfs: assert in xfs_btree_del_cursor should take into account error David Howells (7): rxrpc: Return an error to sendmsg if call failed rxrpc, afs: Fix selection of abort codes rxrpc: Fix listen() setting the bar too high for the prealloc rings rxrpc: Don't try to resend the request if we're receiving the reply rxrpc: Fix overlapping ACK accounting rxrpc: Don't let ack.previousPacket regress rxrpc: Fix decision on when to generate an IDLE ACK Dennis Dalessandro (1): RDMA/hfi1: Fix potential integer multiplication overflow errors Dimitri John Ledkov (1): cfg80211: declare MODULE_FIRMWARE for regulatory.db Dinh Nguyen (1): dt-bindings: gpio: altera: correct interrupt-cells Dmitry Baryshkov (2): drm/msm/dsi: fix error checks and return values for DSI xmit functions drm/msm: add missing include to msm_drv.c Dmitry Torokhov (1): Input: stmfts - do not leave device disabled in stmfts_input_open Dongliang Mu (3): HID: bigben: fix slab-out-of-bounds Write in bigben_probe rtlwifi: Use pr_warn instead of WARN_ONCE media: ov7670: remove ov7670_power_off from ov7670_remove Douglas Miller (2): RDMA/hfi1: Prevent panic when SDMA is disabled RDMA/hfi1: Prevent use of lock before it is initialized Duoming Zhou (1): NFC: hci: fix sleep in atomic context bugs in nfc_hci_hcp_message_tx Emmanuel Grumbach (1): iwlwifi: mvm: fix assert 1F04 upon reconfig Eric Biggers (2): ext4: reject the 'commit' option on ext2 filesystems ext4: only allow test_dummy_encryption when supported Eric Dumazet (2): net: remove two BUG() from skb_checksum_help() sctp: read sk->sk_bound_dev_if once in sctp_rcv() Eric W. Biederman (3): ptrace/um: Replace PT_DTRACE with TIF_SINGLESTEP ptrace/xtensa: Replace PT_SINGLESTEP with TIF_SINGLESTEP ptrace: Reimplement PTRACE_KILL by always sending SIGKILL Eugenio Pérez (1): vdpasim: allow to enable a vq repeatedly Evan Quan (1): drm/amd/pm: fix the compile warning Fabio Estevam (1): net: phy: micrel: Allow probing without .driver_data Felix Fietkau (1): mac80211: upgrade passive scan to active scan on DFS channels after beacon rx Finn Thain (1): macintosh/via-pmu: Fix build failure when CONFIG_INPUT is disabled Francesco Dolcini (1): PCI: imx6: Fix PERST# start-up sequence GUO Zihua (1): ima: remove the IMA_TEMPLATE Kconfig option Geert Uytterhoeven (2): m68k: atari: Make Atari ROM port I/O write macros return void m68k: math-emu: Fix dependencies of math emulation support Gilad Ben-Yossef (1): crypto: ccree - use fine grained DMA mapping dir Guenter Roeck (2): platform/chrome: Re-introduce cros_ec_cmd_xfer and use it for ioctls MIPS: Loongson: Use hwmon_device_register_with_groups() to register hwmon Guo Ren (1): csky: patch_text: Fixup last cpu should be master Gustavo A. R. Silva (1): net: stmmac: selftests: Use kcalloc() instead of kzalloc() Hangyu Hua (3): media: rga: fix possible memory leak in rga_probe drm: msm: fix possible memory leak in mdp5_crtc_cursor_set() misc: ocxl: fix possible double free in ocxl_file_register_afu Hans Verkuil (1): media: cec-adap.c: fix is_configuring state Hans de Goede (1): ASoC: Intel: bytcr_rt5640: Add quirk for the HP Pro Tablet 408 Haowen Bai (4): b43legacy: Fix assigning negative value to unsigned variable b43: Fix assigning negative value to unsigned variable ipw2x00: Fix potential NULL dereference in libipw_xmit() sfc: ef10: Fix assigning negative value to unsigned variable Haren Myneni (1): powerpc/powernv/vas: Assign real address to rx_fifo in vas_rx_win_attr Hari Bathini (2): powerpc/fadump: Fix fadump to work with a different endian capture kernel powerpc/fadump: fix PT_LOAD segment for boot memory area Hari Chandrakanthan (1): ath11k: disable spectral scan during spectral deinit Heiko Carstens (1): s390/preempt: disable __preempt_count_add() optimization for PROFILE_ALL_BRANCHES Helge Deller (2): parisc/stifb: Implement fb_is_primary_device() parisc/stifb: Keep track of hardware path of graphics card Heming Zhao (1): md/bitmap: don't set sb values if can't pass sanity check Howard Chung (1): Bluetooth: Interleave with allowlist scan Jaegeuk Kim (1): f2fs: don't need inode lock for system hidden quota Jagan Teki (1): drm/panel: panel-simple: Fix proper bpc for AM-1280800N3TZQW-T00H Jakob Koschel (1): f2fs: fix dereference of stale list iterator after loop body Jakub Kicinski (2): eth: tg3: silence the GCC 12 array-bounds warning net: stmmac: fix out-of-bounds access in a selftest James Clark (1): perf tools: Use Python devtools for version autodetection rather than runtime James Smart (1): scsi: lpfc: Fix resource leak in lpfc_sli4_send_seq_to_ulp() Jan Kara (8): bfq: Split shared queues on move between cgroups bfq: Update cgroup information before merging bio ext4: verify dir block before splitting it ext4: avoid cycles in directory h-tree bfq: Avoid merging queues with different parents bfq: Drop pointless unlock-lock pair bfq: Remove pointless bfq_init_rq() calls block: fix bio_clone_blkg_association() to associate with proper blkcg_gq Jan Kiszka (1): efi: Add missing prototype for efi_capsule_setup_info Jani Nikula (2): drm/edid: fix invalid EDID extension block filtering drm/i915/dsi: fix VBT send packet port selection for ICL+ Janusz Krzysztofik (1): ARM: OMAP1: clock: Fix UART rate reporting algorithm Jason A. Donenfeld (2): openrisc: start CPU timer early in boot Revert "random: use static branch for crng_ready()" Jeffrey Mitchell (1): xfs: set inode size after creating symlink Jessica Zhang (2): drm/msm/mdp5: Return error code in mdp5_pipe_release when deadlock is detected drm/msm/mdp5: Return error code in mdp5_mixer_release when deadlock is detected Jia-Wei Chang (1): cpufreq: mediatek: Use module_init and add module_exit Jiantao Zhang (1): PCI: dwc: Fix setting error return on MSI DMA mapping failure Jiasheng Jiang (1): drm: mali-dp: potential dereference of null pointer Jiri Slaby (1): serial: pch: don't overwrite xmit->buf[0] by x_char Joerg Roedel (1): iommu/amd: Increase timeout waiting for GA log enablement Johan Hovold (4): PCI: qcom: Fix runtime PM imbalance on probe errors PCI: qcom: Fix unbalanced PHY init on probe errors phy: qcom-qmp: fix struct clk leak on probe errors phy: qcom-qmp: fix reset-controller leak on probe errors Johannes Berg (3): nl80211: show SSID for P2P_GO interfaces wifi: mac80211: fix use-after-free in chanctx code um: chan_user: Fix winch_tramp() return value Jonas Karlman (1): media: rkvdec: h264: Fix bit depth wrap in pps packet Jonathan Bakker (1): ARM: dts: s5pv210: Remove spi-cs-high on panel in Aries Jonathan Teh (1): HID: hid-led: fix maximum brightness for Dream Cheeky Josh Poimboeuf (2): x86/speculation: Add missing prototype for unpriv_ebpf_notify() scripts/faddr2line: Fix overlapping text section failures Junxiao Bi via Ocfs2-devel (1): ocfs2: dlmfs: fix error handling of user_dlm_destroy_lock Kajol Jain (1): powerpc/perf: Fix the threshold compare group constraint for power9 Kan Liang (1): perf/x86/intel: Fix event constraints for ICL Kathiravan T (1): arm64: dts: qcom: ipq8074: fix the sleep clock frequency Keita Suzuki (2): drm/amd/pm: fix double free in si_parse_power_table() tracing: Fix potential double free in create_var_ref() Keith Busch (1): nvme: set dma alignment to dword Kirill A. Shutemov (1): ACPICA: Avoid cache flush inside virtual machines Kishon Vijay Abraham I (1): usb: core: hcd: Add support for deferring roothub registration Kiwoong Kim (1): scsi: ufs: core: Exclude UECxx from SFR dump list Konrad Dybcio (2): arm64: dts: qcom: msm8994: Fix BLSP[12]_DMA channels count regulator: qcom_smd: Fix up PM8950 regulator configuration Krzysztof Kozlowski (6): ARM: dts: ox820: align interrupt controller node name with dtschema ARM: dts: s5pv210: align DMA channels with dtschema ARM: dts: exynos: add atmel,24c128 fallback to Samsung EEPROM irqchip/aspeed-i2c-ic: Fix irq_of_parse_and_map() return value irqchip/aspeed-scu-ic: Fix irq_of_parse_and_map() return value pinctrl: mvebu: Fix irq_of_parse_and_map() return value Kuldeep Singh (1): spi: qcom-qspi: Add minItems to interconnect-names Kuninori Morimoto (2): ASoC: samsung: Use dev_err_probe() helper i2c: rcar: fix PM ref counts in probe error paths Kuogee Hsieh (3): drm/msm/dpu: adjust display_v_end for eDP and DP drm/msm/dp: stop event kernel thread when DP unbind drm/msm/dp: fix event thread stuck in wait_event after kthread_stop() Kuppuswamy Sathyanarayanan (1): PCI/AER: Clear MULTI_ERR_COR/UNCOR_RCV bits Kwanghoon Son (1): media: exynos4-is: Fix compile warning Lai Jiangshan (1): x86/sev: Annotate stack change in the #VC handler Len Brown (1): tools/power turbostat: fix ICX DRAM power numbers Leo Yan (1): perf c2c: Use stdio interface if slang is not supported Lin Ma (2): ASoC: rt5645: Fix errorenous cleanup order NFC: NULL out the dev->rfkill to prevent UAF Liu Zixian (1): drm/virtio: fix NULL pointer dereference in virtio_gpu_conn_get_modes Liviu Dudau (1): drm/komeda: return early if drm_universal_plane_init() fails. Luca Weiss (1): media: venus: hfi: avoid null dereference in deinit Lucas Stach (2): drm/bridge: adv7511: clean up CEC adapter when probe fails drm/etnaviv: check for reaped mapping in etnaviv_iommu_unmap_gem Lv Ruyi (7): scsi: megaraid: Fix error check return value of register_chrdev() drm: msm: fix error check return value of irq_of_parse_and_map() powerpc/xics: fix refcount leak in icp_opal_init() powerpc/powernv: fix missing of_node_put in uv_init() drm/msm/dp: fix error check return value of irq_of_parse_and_map() drm/msm/hdmi: fix error check return value of irq_of_parse_and_map() mfd: ipaq-micro: Fix error check return value of platform_get_irq() Maciej W. Rozycki (2): MIPS: IP27: Remove incorrect `cpu_has_fpu' override MIPS: IP30: Remove incorrect `cpu_has_fpu' override Manivannan Sadhasivam (1): scsi: ufs: qcom: Add a readl() to make sure ref_clk gets enabled Mao Jinlong (1): coresight: core: Fix coresight device probe failure issue Marc Kleine-Budde (1): can: xilinx_can: mark bit timing constants as const Marek Vasut (2): drm/panel: simple: Add missing bus flags for Innolux G070Y2-L01 ARM: dts: stm32: Fix PHY post-reset delay on Avenger96 Mario Limonciello (1): ACPI: PM: Block ASUS B1400CEAE from suspend to idle by default Marios Levogiannis (1): ALSA: hda/realtek - Fix microphone noise on ASUS TUF B550M-PLUS Mark Bloch (1): net/mlx5: fs, delete the FTE when there are no rules attached to it Mark Brown (2): ASoC: dapm: Don't fold register value changes into notifications ASoC: rt5514: Fix event generation for "DSP Voice Wake Up" control Mathias Nyman (1): xhci: Allow host runtime PM as default for Intel Alder Lake N xHCI Matthieu Baerts (1): x86/pm: Fix false positive kmemleak report in msr_build_context() Max Filippov (1): irqchip: irq-xtensa-mx: fix initial IRQ affinity Max Krummenacher (1): ARM: dts: imx6dl-colibri: Fix I2C pinmuxing Maxime Ripard (3): drm/vc4: hvs: Reset muxes at probe time drm/vc4: txp: Don't set TXP_VSTART_AT_EOF drm/vc4: txp: Force alpha to be 0xff if it's disabled Miaohe Lin (1): drivers/base/node.c: fix compaction sysfs file leak Miaoqian Lin (20): ASoC: mediatek: Fix error handling in mt8173_max98090_dev_probe ASoC: mediatek: Fix missing of_node_put in mt2701_wm8960_machine_probe spi: spi-ti-qspi: Fix return value handling of wait_for_completion_timeout HID: elan: Fix potential double free in elan_input_configured drm/bridge: Fix error handling in analogix_dp_probe ASoC: fsl: Fix refcount leak in imx_sgtl5000_probe ASoC: mxs-saif: Fix refcount leak in mxs_saif_probe regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt ASoC: samsung: Fix refcount leak in aries_audio_probe media: exynos4-is: Fix PM disable depth imbalance in fimc_is_probe media: st-delta: Fix PM disable depth imbalance in delta_probe media: exynos4-is: Change clk_disable to clk_disable_unprepare ASoC: ti: j721e-evm: Fix refcount leak in j721e_soc_probe_* drm/msm/a6xx: Fix refcount leak in a6xx_gpu_init thermal/drivers/imx_sc_thermal: Fix refcount leak in imx_sc_thermal_probe soc: qcom: smp2p: Fix missing of_node_put() in smp2p_parse_ipc soc: qcom: smsm: Fix missing of_node_put() in smsm_parse_ipc Input: sparcspkr - fix refcount leak in bbc_beep_probe powerpc/fsl_rio: Fix refcount leak in fsl_rio_setup video: fbdev: clcdfb: Fix refcount leak in clcdfb_of_vram_setup Michael Ellerman (1): powerpc/64: Only WARN if __pa()/__va() called with bad addresses Michael Rodin (1): media: vsp1: Fix offset calculation for plane cropping Michael Walle (1): i2c: at91: use dma safe buffers Mike Kravetz (1): hugetlb: fix huge_pmd_unshare address update Mike Travis (1): x86/platform/uv: Update TSC sync state for UV5 Mikulas Patocka (1): dma-debug: change allocation mode from GFP_NOWAIT to GFP_ATIOMIC Miles Chen (1): drm/mediatek: Fix mtk_cec_mask() Minghao Chi (1): scsi: ufs: Use pm_runtime_resume_and_get() instead of pm_runtime_get_sync() Monish Kumar R (1): USB: new quirk for Dell Gen 2 devices Muchun Song (1): dax: fix cache flush on PMD-mapped pages Nathan Chancellor (2): drm/i915: Fix CFI violation with show_dynamic_id() i2c: at91: Initialize dma_buf in at91_twi_xfer() Nico Boehr (1): s390/perf: obtain sie_block from the right address Nicolas Dufresne (3): media: rkvdec: h264: Fix dpb_valid implementation media: coda: Fix reported H264 profile media: coda: Add more H264 levels for CODA960 Nicolas Frattaroli (1): ASoC: rk3328: fix disabling mclk on pclk probe failure Niels Dossche (5): mwifiex: add mutex lock for call in mwifiex_dfs_chan_sw_work_queue ipv6: fix locking issues with loops over idev->addr_list IB/rdmavt: add missing locks in rvt_ruc_loopback ath11k: acquire ab->base_lock in unassign when finding the peer by addr Bluetooth: use hdev lock for accept_list and reject_list in conn req Niklas Cassel (1): binfmt_flat: do not stop relocating GOT entries prematurely on riscv Noralf Trønnes (1): dt-bindings: display: sitronix, st7735r: Fix backlight in example Nuno Sá (1): of: overlay: do not break notify on NOTIFY_{OK|STOP} OGAWA Hirofumi (1): fat: add ratelimit to fat*_ent_bread() Padmanabha Srinivasaiah (1): rcu-tasks: Fix race in schedule and flush work Pali Rohár (1): irqchip/armada-370-xp: Do not touch Performance Counter Overflow on A375, A38x, A39x Patrice Chotard (1): spi: stm32-qspi: Fix wait_cmd timeout in APM mode Paul Cercueil (1): drm/ingenic: Reset pixclock rate when parent clock rate changes Paul E. McKenney (2): rcu: Make TASKS_RUDE_RCU select IRQ_WORK scftorture: Fix distribution of short handler delays Paul Moore (1): lsm,selinux: pass flowi_common instead of flowi to the LSM hooks Pavel Skripkin (1): media: pvrusb2: fix array-index-out-of-bounds in pvr2_i2c_core_init Peilin Ye (1): Fonts: Make font size unsigned in font_desc Peng Wu (3): ARM: versatile: Add missing of_node_put in dcscb_init ARM: hisi: Add missing of_node_put after of_find_compatible_node powerpc/iommu: Add missing of_node_put in iommu_init_early_dart Petr Machata (2): mlxsw: spectrum_dcb: Do not warn about priority changes mlxsw: Treat LLDP packets as control Phil Auld (1): kselftest/cgroup: fix test_stress.sh to use OUTPUT dir Phil Elwell (3): ARM: dts: bcm2835-rpi-zero-w: Fix GPIO line name for Wifi/BT ARM: dts: bcm2837-rpi-cm3-io3: Fix GPIO line names for SMPS I2C ARM: dts: bcm2837-rpi-3-b-plus: Fix GPIO line name of power LED Philipp Zabel (1): media: coda: limit frame interval enumeration to supported encoder frame sizes Pierre-Louis Bossart (2): ASoC: max98357a: remove dependency on GPIOLIB ASoC: rt1015p: remove dependency on GPIOLIB Qinglang Miao (1): cpufreq: mediatek: add missing platform_driver_unregister() on error in mtk_cpufreq_driver_init QintaoShen (1): soc: ti: ti_sci_pm_domains: Check for null return of devm_kcalloc Qu Wenruo (2): btrfs: add "0x" prefix for unsupported optional features btrfs: repair super block num_devices automatically Randy Dunlap (6): x86: Fix return value of __setup handlers x86/mm: Cleanup the control_va_addr_alignment() __setup handler powerpc/8xx: export 'cpm_setbrg' for modules powerpc/idle: Fix return value of __setup() handler powerpc/4xx/cpm: Fix return value of __setup() handler macintosh: via-pmu and via-cuda need RTC_LIB Ravi Bangoria (2): perf/amd/ibs: Cascade pmu init functions' return value perf/amd/ibs: Use interrupt regs ip for stack unwinding Rei Yamamoto (1): mm, compaction: fast_find_migrateblock() should return pfn in the target zone Rex-BC Chen (1): cpufreq: mediatek: Unregister platform device on exit Rik van der Kemp (1): ALSA: hda/realtek: Enable 4-speaker output for Dell XPS 15 9520 laptop Ronnie Sahlberg (1): cifs: when extending a file with falloc we should make files not-sparse Russell King (Oracle) (1): net: dsa: mt7530: 1G can also support 1000BASE-X link mode Sakari Ailus (1): ACPI: property: Release subnode properties with data nodes Samuel Holland (1): riscv: Fix irq_work when SMP is disabled Sathish Narasimman (1): Bluetooth: LL privacy allow RPA Schspa Shi (1): cpufreq: Fix possible race in cpufreq online error path Sean Christopherson (3): KVM: nVMX: Leave most VM-Exit info fields unmodified on failed VM-Entry KVM: nVMX: Clear IDT vectoring on nested VM-Exit for double/triple fault Kconfig: Add option for asm goto w/ tied outputs to workaround clang-13 bug Sebastian Andrzej Siewior (1): crypto: cryptd - Protect per-CPU resource by disabling BH. Shawn Lin (1): arm64: dts: rockchip: Move drive-impedance-ohm to emmc phy on rk3399 Smith, Kyle Miller (Nimble Kernel) (1): nvme-pci: fix a NULL pointer dereference in nvme_alloc_admin_tags Song Liu (1): ftrace: Clean up hash direct_functions on register failures Stefan Wahren (4): thermal/drivers/bcm2711: Don't clamp temperature at zero ARM: dts: bcm2835-rpi-b: Fix GPIO line names gpiolib: of: Introduce hook for missing gpio-ranges pinctrl: bcm2835: implement hook for missing gpio-ranges Steve French (1): SMB3: EBADF/EIO errors in rename/open caused by race condition in smb2_compound_op Steven Price (1): drm/plane: Move range check for format_count earlier Takashi Iwai (1): ALSA: usb-audio: Cancel pending work at closing a MIDI substream Tali Perry (2): i2c: npcm: Fix timeout calculation i2c: npcm: Handle spurious interrupts Tejas Upadhyay (1): iommu/vt-d: Add RPLS to quirk list to skip TE disabling Tejun Heo (1): blk-iolatency: Fix inflight count imbalances and IO hangs on offline Tetsuo Handa (1): media: imon: reorganize serialization Theodore Ts'o (1): ext4: filter out EXT4_FC_REPLAY from on-disk superblock field s_state Thibaut VARÈNE (1): ath9k: fix QCA9561 PA bias level Thorsten Scherer (1): ARM: dts: ci4x10: Adapt to changes in imx6qdl.dtsi regarding fec clocks Tokunori Ikegami (2): mtd: cfi_cmdset_0002: Move and rename chip_check/chip_ready/chip_good_for_write mtd: cfi_cmdset_0002: Use chip_ready() for write on S29GL064N Tong Tiangen (1): arm64: fix types in copy_highpage() Trond Myklebust (5): NFS: Do not report EINTR/ERESTARTSYS as mapping errors NFS: fsync() should report filesystem errors over EINTR/ERESTARTSYS NFS: Do not report flush errors in nfs_write_end() NFS: Don't report errors from nfs_pageio_complete() more than once NFSv4/pNFS: Do not fail I/O when we fail to allocate the pNFS layout Tyler Hicks (1): EDAC/dmc520: Don't print an error for each unconfigured interrupt line Tyrone Ting (1): i2c: npcm: Correct register access width Tzung-Bi Shih (1): platform/chrome: cros_ec: fix error handling in cros_ec_register() Vasily Averin (1): tracing: incorrect isolate_mote_t cast in mm_vmscan_lru_isolate Vignesh Raghavendra (1): drivers: mmc: sdhci_am654: Add the quirk to set TESTCD bit Vincent Mailhol (1): can: mcp251xfd: silence clang's -Wunaligned-access warning Vincent Whitchurch (1): um: Fix out-of-bounds read in LDT setup Vinod Polimera (1): drm/msm/disp/dpu1: set vbif hw config to NULL to avoid use after memory free during pm runtime resume Viresh Kumar (1): Revert "cpufreq: Fix possible race in cpufreq online error path" Waiman Long (2): ipc/mqueue: use get_tree_nodev() in mqueue_get_tree() kseltest/cgroup: Make test_stress.sh work if run interactively Wenli Looi (1): ath9k: fix ar9003_get_eepmisc Xiao Yang (1): RDMA/rxe: Generate a completion for unsupported/invalid opcode Xiaomeng Tong (11): media: uvcvideo: Fix missing check to determine if element is found in list scsi: dc395x: Fix a missing check on list iterator drm/nouveau/clk: Fix an incorrect NULL check on list iterator drm/nouveau/kms/nv50-: atom: fix an incorrect NULL check on list iterator md: fix an incorrect NULL check in does_sb_need_changing md: fix an incorrect NULL check in md_reload_sb iommu/msm: Fix an incorrect NULL check on list iterator carl9170: tx: fix an incorrect use of list iterator stm: ltdc: fix two incorrect NULL checks on list iterator tilcdc: tilcdc_external: fix an incorrect NULL check on list iterator gma500: fix an incorrect NULL check on list iterator Xie Yongji (1): nbd: Fix hung on disconnect request if socket is closed before Yang Jihong (1): perf tools: Add missing headers needed by util/data.h Yang Yingliang (10): pinctrl: renesas: rzn1: Fix possible null-ptr-deref in sh_pfc_map_resources() mtd: rawnand: cadence: fix possible null-ptr-deref in cadence_nand_dt_probe() drm/msm/hdmi: check return value after calling platform_get_resource_byname() drm/rockchip: vop: fix possible null-ptr-deref in vop_bind() spi: spi-fsl-qspi: check return value after calling platform_get_resource_byname() thermal/core: Fix memory leak in __thermal_cooling_device_register() ASoC: wm2000: fix missing clk_disable_unprepare() on error in wm2000_anc_transition() pinctrl: renesas: core: Fix possible null-ptr-deref in sh_pfc_map_resources() hwrng: omap3-rom - fix using wrong clk_disable() in omap_rom_rng_runtime_resume() mfd: davinci_voicecodec: Fix possible null-ptr-deref davinci_vc_probe() Yi Yang (1): xtensa/simdisk: fix proc_read_simdisk() Yicong Yang (1): PCI: Avoid pci_dev_lock() AB/BA deadlock with sriov_numvfs_store() Ying Hsu (1): Bluetooth: fix dangling sco_conn and use-after-free in sco_sock_timeout Yong Wu (1): iommu/mediatek: Add list_del in mtk_iommu_remove Yonghong Song (1): selftests/bpf: fix btf_dump/btf_dump due to recent clang change Yongzhi Liu (1): hv_netvsc: Fix potential dereference of NULL pointer Yuntao Wang (1): bpf: Fix excessive memory allocation in stack_map_alloc() Zev Weiss (1): regulator: core: Fix enable_count imbalance with EXCLUSIVE_GET Zheng Yongjun (2): spi: img-spfi: Fix pm_runtime_get_sync() error checking thermal/drivers/broadcom: Fix potential NULL dereference in sr_thermal_probe Zheng Zengkai (1): sched/fair: Fix kabi broken in struct cfs_rq Zhengjun Xing (1): perf jevents: Fix event syntax error caused by ExtSel Zheyu Ma (3): media: pci: cx23885: Fix the error handling in cx23885_initdev() media: cx25821: Fix the warning when removing the module mtd: rawnand: denali: Use managed device resources Zhou Qingyang (1): drm/komeda: Fix an undefined behavior bug in komeda_plane_add() Zixuan Fu (1): fs: jfs: fix possible NULL pointer dereference in dbFree() Ziyang Xuan (1): thermal/core: fix a UAF bug in __thermal_cooling_device_register() jianghaoran (1): ipv6: Don't send rs packets to the interface of ARPHRD_TUNNEL liuyacan (1): net/smc: postpone sk_refcnt increment in connect() Documentation/conf.py | 2 +- .../bindings/display/sitronix,st7735r.yaml | 1 + .../devicetree/bindings/gpio/gpio-altera.txt | 5 +- .../bindings/spi/qcom,spi-qcom-qspi.yaml | 1 + arch/arm/boot/dts/bcm2835-rpi-b.dts | 13 +- arch/arm/boot/dts/bcm2835-rpi-zero-w.dts | 22 +- arch/arm/boot/dts/bcm2837-rpi-3-b-plus.dts | 2 +- arch/arm/boot/dts/bcm2837-rpi-cm3-io3.dts | 4 +- arch/arm/boot/dts/exynos5250-smdk5250.dts | 4 +- arch/arm/boot/dts/imx6dl-eckelmann-ci4x10.dts | 6 +- arch/arm/boot/dts/imx6qdl-colibri.dtsi | 6 +- arch/arm/boot/dts/ox820.dtsi | 2 +- arch/arm/boot/dts/s5pv210-aries.dtsi | 3 +- arch/arm/boot/dts/s5pv210.dtsi | 12 +- .../boot/dts/stm32mp15xx-dhcor-avenger96.dtsi | 1 + arch/arm/boot/dts/suniv-f1c100s.dtsi | 4 +- arch/arm/mach-hisi/platsmp.c | 4 + arch/arm/mach-mediatek/Kconfig | 1 + arch/arm/mach-omap1/clock.c | 2 +- arch/arm/mach-pxa/cm-x300.c | 8 +- arch/arm/mach-pxa/magician.c | 2 +- arch/arm/mach-pxa/tosa.c | 4 +- arch/arm/mach-vexpress/dcscb.c | 1 + arch/arm64/Kconfig.platforms | 1 + arch/arm64/boot/dts/qcom/ipq8074.dtsi | 2 +- arch/arm64/boot/dts/qcom/msm8994.dtsi | 4 +- arch/arm64/boot/dts/rockchip/rk3399.dtsi | 2 +- arch/arm64/kernel/sys_compat.c | 2 +- arch/arm64/mm/copypage.c | 4 +- arch/csky/kernel/probes/kprobes.c | 2 +- arch/m68k/Kconfig.cpu | 2 +- arch/m68k/include/asm/raw_io.h | 6 +- .../asm/mach-ip27/cpu-feature-overrides.h | 1 - .../asm/mach-ip30/cpu-feature-overrides.h | 1 - arch/openrisc/include/asm/timex.h | 1 + arch/openrisc/kernel/head.S | 9 + arch/parisc/include/asm/fb.h | 4 + arch/powerpc/include/asm/page.h | 7 +- arch/powerpc/include/asm/vas.h | 2 +- arch/powerpc/kernel/fadump.c | 8 +- arch/powerpc/kernel/idle.c | 2 +- arch/powerpc/perf/isa207-common.c | 3 +- arch/powerpc/platforms/4xx/cpm.c | 2 +- arch/powerpc/platforms/8xx/cpm1.c | 1 + arch/powerpc/platforms/powernv/opal-fadump.c | 94 ++++---- arch/powerpc/platforms/powernv/opal-fadump.h | 10 +- arch/powerpc/platforms/powernv/ultravisor.c | 1 + arch/powerpc/platforms/powernv/vas-fault.c | 2 +- arch/powerpc/platforms/powernv/vas-window.c | 4 +- arch/powerpc/platforms/powernv/vas.h | 2 +- arch/powerpc/sysdev/dart_iommu.c | 6 +- arch/powerpc/sysdev/fsl_rio.c | 2 + arch/powerpc/sysdev/xics/icp-opal.c | 1 + arch/riscv/include/asm/irq_work.h | 2 +- arch/riscv/kernel/head.S | 1 + arch/s390/include/asm/preempt.h | 15 +- arch/s390/kernel/perf_event.c | 2 +- arch/um/drivers/chan_user.c | 9 +- arch/um/include/asm/thread_info.h | 2 + arch/um/kernel/exec.c | 2 +- arch/um/kernel/process.c | 2 +- arch/um/kernel/ptrace.c | 8 +- arch/um/kernel/signal.c | 4 +- arch/x86/Kconfig | 4 +- arch/x86/entry/entry_64.S | 1 + arch/x86/entry/vdso/vma.c | 2 +- arch/x86/events/amd/ibs.c | 55 ++++- arch/x86/events/intel/core.c | 2 +- arch/x86/include/asm/acenv.h | 14 +- arch/x86/include/asm/suspend_32.h | 2 +- arch/x86/include/asm/suspend_64.h | 12 +- arch/x86/kernel/apic/apic.c | 2 +- arch/x86/kernel/apic/x2apic_uv_x.c | 8 +- arch/x86/kernel/cpu/intel.c | 2 +- arch/x86/kernel/cpu/mce/amd.c | 32 +-- arch/x86/kernel/step.c | 3 +- arch/x86/kernel/sys_x86_64.c | 7 +- arch/x86/kvm/vmx/nested.c | 45 +++- arch/x86/kvm/vmx/vmcs.h | 5 + arch/x86/lib/delay.c | 4 +- arch/x86/mm/pat/memtype.c | 2 +- arch/x86/um/ldt.c | 6 +- arch/xtensa/kernel/ptrace.c | 4 +- arch/xtensa/kernel/signal.c | 4 +- arch/xtensa/platforms/iss/simdisk.c | 18 +- block/bfq-cgroup.c | 36 ++- block/bfq-iosched.c | 36 ++- block/bfq-iosched.h | 1 + block/blk-cgroup.c | 8 +- block/blk-iolatency.c | 122 +++++----- crypto/cryptd.c | 23 +- drivers/acpi/property.c | 18 +- drivers/acpi/sleep.c | 12 + drivers/base/memory.c | 5 +- drivers/base/node.c | 1 + drivers/block/drbd/drbd_main.c | 11 +- drivers/block/nbd.c | 13 +- drivers/block/virtio_blk.c | 7 +- drivers/char/hw_random/omap3-rom-rng.c | 2 +- drivers/char/ipmi/ipmi_msghandler.c | 4 +- drivers/char/ipmi/ipmi_ssif.c | 23 ++ drivers/char/random.c | 12 +- drivers/cpufreq/mediatek-cpufreq.c | 19 +- .../allwinner/sun8i-ss/sun8i-ss-cipher.c | 115 ++++++--- .../crypto/allwinner/sun8i-ss/sun8i-ss-core.c | 30 ++- .../crypto/allwinner/sun8i-ss/sun8i-ss-hash.c | 10 +- drivers/crypto/allwinner/sun8i-ss/sun8i-ss.h | 14 +- drivers/crypto/ccree/cc_buffer_mgr.c | 27 ++- drivers/crypto/marvell/cesa/cipher.c | 1 - drivers/crypto/nx/nx-common-powernv.c | 2 +- drivers/devfreq/rk3399_dmc.c | 2 + drivers/dma/idxd/cdev.c | 8 +- drivers/dma/stm32-mdma.c | 87 ++++--- drivers/edac/dmc520_edac.c | 2 +- drivers/firmware/arm_scmi/base.c | 2 +- drivers/gpio/gpiolib-of.c | 5 + drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c | 2 +- drivers/gpu/drm/amd/amdgpu/amdgpu_ucode.c | 3 +- drivers/gpu/drm/amd/pm/powerplay/kv_dpm.c | 14 +- drivers/gpu/drm/amd/pm/powerplay/si_dpm.c | 8 +- .../gpu/drm/arm/display/komeda/komeda_plane.c | 10 +- drivers/gpu/drm/arm/malidp_crtc.c | 5 +- drivers/gpu/drm/bridge/adv7511/adv7511_drv.c | 1 + .../drm/bridge/analogix/analogix_dp_core.c | 31 ++- drivers/gpu/drm/drm_edid.c | 6 +- drivers/gpu/drm/drm_plane.c | 14 +- drivers/gpu/drm/etnaviv/etnaviv_mmu.c | 6 + drivers/gpu/drm/gma500/psb_intel_display.c | 7 +- drivers/gpu/drm/i915/display/intel_dsi_vbt.c | 33 ++- drivers/gpu/drm/i915/i915_perf.c | 4 +- drivers/gpu/drm/i915/i915_perf_types.h | 2 +- drivers/gpu/drm/ingenic/ingenic-drm-drv.c | 61 ++++- drivers/gpu/drm/mediatek/mtk_cec.c | 2 +- drivers/gpu/drm/msm/adreno/a6xx_gpu.c | 1 + drivers/gpu/drm/msm/disp/dpu1/dpu_hw_intf.c | 1 + drivers/gpu/drm/msm/disp/dpu1/dpu_kms.c | 8 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_crtc.c | 14 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_kms.c | 6 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.c | 15 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_mixer.h | 4 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.c | 15 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_pipe.h | 2 +- drivers/gpu/drm/msm/disp/mdp5/mdp5_plane.c | 20 +- drivers/gpu/drm/msm/dp/dp_display.c | 55 +++-- drivers/gpu/drm/msm/dsi/dsi_host.c | 21 +- drivers/gpu/drm/msm/hdmi/hdmi.c | 10 +- drivers/gpu/drm/msm/msm_drv.c | 1 + drivers/gpu/drm/msm/msm_gem_prime.c | 2 +- drivers/gpu/drm/nouveau/dispnv50/atom.h | 6 +- drivers/gpu/drm/nouveau/dispnv50/crc.c | 27 ++- .../gpu/drm/nouveau/nvkm/subdev/clk/base.c | 6 +- drivers/gpu/drm/panel/panel-simple.c | 3 +- drivers/gpu/drm/rockchip/rockchip_drm_vop.c | 2 +- drivers/gpu/drm/stm/ltdc.c | 16 +- drivers/gpu/drm/tilcdc/tilcdc_external.c | 8 +- drivers/gpu/drm/vc4/vc4_hvs.c | 26 ++- drivers/gpu/drm/vc4/vc4_txp.c | 8 +- drivers/gpu/drm/virtio/virtgpu_display.c | 2 + drivers/hid/hid-bigbenff.c | 6 + drivers/hid/hid-elan.c | 2 - drivers/hid/hid-led.c | 2 +- drivers/hwtracing/coresight/coresight-core.c | 33 ++- drivers/i2c/busses/i2c-at91-master.c | 11 + drivers/i2c/busses/i2c-npcm7xx.c | 103 +++++--- drivers/i2c/busses/i2c-rcar.c | 15 +- drivers/infiniband/hw/hfi1/file_ops.c | 2 + drivers/infiniband/hw/hfi1/init.c | 2 +- drivers/infiniband/hw/hfi1/sdma.c | 12 +- drivers/infiniband/sw/rdmavt/qp.c | 6 +- drivers/infiniband/sw/rxe/rxe_req.c | 2 +- drivers/input/misc/sparcspkr.c | 1 + drivers/input/touchscreen/stmfts.c | 16 +- drivers/iommu/amd/init.c | 2 +- drivers/iommu/intel/iommu.c | 2 +- drivers/iommu/msm_iommu.c | 11 +- drivers/iommu/mtk_iommu.c | 3 +- drivers/irqchip/irq-armada-370-xp.c | 11 +- drivers/irqchip/irq-aspeed-i2c-ic.c | 4 +- drivers/irqchip/irq-aspeed-scu-ic.c | 4 +- drivers/irqchip/irq-sni-exiu.c | 25 +- drivers/irqchip/irq-xtensa-mx.c | 18 +- drivers/macintosh/Kconfig | 6 + drivers/macintosh/Makefile | 3 +- drivers/macintosh/via-pmu.c | 2 +- drivers/mailbox/mailbox.c | 19 +- drivers/md/md-bitmap.c | 44 ++-- drivers/md/md.c | 18 +- drivers/media/cec/core/cec-adap.c | 6 +- drivers/media/i2c/ov7670.c | 1 - drivers/media/pci/cx23885/cx23885-core.c | 6 +- drivers/media/pci/cx25821/cx25821-core.c | 2 +- drivers/media/platform/aspeed-video.c | 4 +- drivers/media/platform/coda/coda-common.c | 35 ++- drivers/media/platform/exynos4-is/fimc-is.c | 6 +- .../platform/exynos4-is/fimc-isp-video.h | 2 +- drivers/media/platform/qcom/venus/hfi.c | 3 + drivers/media/platform/rockchip/rga/rga.c | 6 +- drivers/media/platform/sti/delta/delta-v4l2.c | 6 +- drivers/media/platform/vsp1/vsp1_rpf.c | 6 +- drivers/media/rc/imon.c | 99 ++++---- drivers/media/usb/pvrusb2/pvrusb2-hdw.c | 7 +- drivers/media/usb/uvc/uvc_v4l2.c | 20 +- drivers/memory/samsung/exynos5422-dmc.c | 5 +- drivers/mfd/davinci_voicecodec.c | 6 +- drivers/mfd/ipaq-micro.c | 2 +- drivers/misc/ocxl/file.c | 2 + drivers/mmc/host/jz4740_mmc.c | 20 ++ drivers/mmc/host/sdhci_am654.c | 23 +- drivers/mtd/chips/cfi_cmdset_0002.c | 103 ++++---- .../mtd/nand/raw/cadence-nand-controller.c | 5 +- drivers/mtd/nand/raw/denali_pci.c | 15 +- drivers/mtd/spi-nor/core.c | 9 + drivers/net/can/spi/mcp251xfd/mcp251xfd.h | 2 +- drivers/net/can/xilinx_can.c | 4 +- drivers/net/dsa/mt7530.c | 14 +- drivers/net/ethernet/broadcom/Makefile | 5 + .../chelsio/inline_crypto/chtls/chtls_cm.c | 2 +- .../net/ethernet/mellanox/mlx5/core/fs_core.c | 10 +- .../ethernet/mellanox/mlxsw/core_thermal.c | 2 +- .../ethernet/mellanox/mlxsw/spectrum_dcb.c | 13 -- .../ethernet/mellanox/mlxsw/spectrum_trap.c | 2 +- drivers/net/ethernet/sfc/ef10.c | 2 +- .../stmicro/stmmac/stmmac_selftests.c | 15 +- drivers/net/hyperv/netvsc_drv.c | 5 +- drivers/net/ipa/ipa_endpoint.c | 4 +- drivers/net/phy/micrel.c | 11 +- drivers/net/wireguard/socket.c | 4 +- drivers/net/wireless/ath/ath10k/mac.c | 20 +- drivers/net/wireless/ath/ath11k/mac.c | 16 +- drivers/net/wireless/ath/ath11k/spectral.c | 17 +- .../net/wireless/ath/ath9k/ar9003_eeprom.c | 2 +- drivers/net/wireless/ath/ath9k/ar9003_phy.h | 2 +- drivers/net/wireless/ath/ath9k/htc_drv_txrx.c | 8 + drivers/net/wireless/ath/carl9170/tx.c | 3 + drivers/net/wireless/broadcom/b43/phy_n.c | 2 +- drivers/net/wireless/broadcom/b43legacy/phy.c | 2 +- .../net/wireless/intel/ipw2x00/libipw_tx.c | 2 +- .../net/wireless/intel/iwlwifi/mvm/power.c | 3 + drivers/net/wireless/marvell/mwifiex/11h.c | 2 + .../wireless/realtek/rtl818x/rtl8180/dev.c | 8 +- drivers/net/wireless/realtek/rtlwifi/usb.c | 2 +- drivers/nfc/st21nfca/se.c | 17 +- drivers/nfc/st21nfca/st21nfca.h | 1 + drivers/nvdimm/core.c | 9 - drivers/nvdimm/security.c | 5 - drivers/nvme/host/core.c | 2 +- drivers/nvme/host/pci.c | 1 + drivers/of/overlay.c | 4 +- drivers/opp/of.c | 2 +- .../pci/controller/cadence/pcie-cadence-ep.c | 3 +- drivers/pci/controller/dwc/pci-imx6.c | 23 +- .../pci/controller/dwc/pcie-designware-host.c | 3 +- drivers/pci/controller/dwc/pcie-qcom.c | 9 +- drivers/pci/controller/pcie-rockchip-ep.c | 3 +- drivers/pci/pci.c | 12 +- drivers/pci/pcie/aer.c | 7 +- drivers/phy/qualcomm/phy-qcom-qmp.c | 11 +- drivers/pinctrl/bcm/pinctrl-bcm2835.c | 18 ++ drivers/pinctrl/mvebu/pinctrl-armada-37xx.c | 2 +- drivers/pinctrl/renesas/core.c | 7 +- drivers/pinctrl/renesas/pinctrl-rzn1.c | 10 +- drivers/platform/chrome/cros_ec.c | 16 +- drivers/platform/chrome/cros_ec_chardev.c | 2 +- drivers/platform/chrome/cros_ec_proto.c | 50 +++- drivers/platform/mips/cpu_hwmon.c | 127 ++++------ drivers/regulator/core.c | 7 +- drivers/regulator/pfuze100-regulator.c | 2 + drivers/regulator/qcom_smd-regulator.c | 35 ++- drivers/scsi/dc395x.c | 15 +- drivers/scsi/lpfc/lpfc_sli.c | 6 +- drivers/scsi/megaraid.c | 2 +- drivers/scsi/ufs/ti-j721e-ufs.c | 6 +- drivers/scsi/ufs/ufs-qcom.c | 14 +- drivers/scsi/ufs/ufshcd.c | 7 +- drivers/soc/qcom/llcc-qcom.c | 1 + drivers/soc/qcom/smp2p.c | 1 + drivers/soc/qcom/smsm.c | 1 + drivers/soc/ti/ti_sci_pm_domains.c | 2 + drivers/spi/spi-fsl-qspi.c | 4 + drivers/spi/spi-img-spfi.c | 2 +- drivers/spi/spi-rspi.c | 15 +- drivers/spi/spi-stm32-qspi.c | 3 +- drivers/spi/spi-ti-qspi.c | 5 +- drivers/staging/media/hantro/hantro_v4l2.c | 8 +- drivers/staging/media/rkvdec/rkvdec-h264.c | 37 ++- drivers/staging/media/rkvdec/rkvdec.c | 4 +- drivers/target/target_core_device.c | 1 - drivers/thermal/broadcom/bcm2711_thermal.c | 5 +- drivers/thermal/broadcom/sr-thermal.c | 3 + drivers/thermal/imx_sc_thermal.c | 6 +- drivers/thermal/thermal_core.c | 42 ++-- drivers/tty/serial/pch_uart.c | 27 +-- drivers/usb/core/hcd.c | 29 ++- drivers/usb/core/quirks.c | 3 + drivers/usb/dwc3/gadget.c | 6 +- drivers/usb/host/xhci-pci.c | 2 + drivers/usb/serial/option.c | 2 + drivers/vdpa/vdpa_sim/vdpa_sim.c | 5 +- drivers/video/console/sticon.c | 5 +- drivers/video/console/sticore.c | 32 ++- drivers/video/fbdev/amba-clcd.c | 5 +- drivers/video/fbdev/core/fbcon.c | 5 +- drivers/video/fbdev/sticore.h | 3 + drivers/video/fbdev/stifb.c | 4 +- fs/afs/rxrpc.c | 8 +- fs/binfmt_flat.c | 27 ++- fs/btrfs/disk-io.c | 4 +- fs/btrfs/volumes.c | 8 +- fs/cifs/smb2inode.c | 2 - fs/cifs/smb2ops.c | 2 +- fs/dax.c | 3 +- fs/dlm/lock.c | 11 +- fs/dlm/plock.c | 12 +- fs/ext4/ext4.h | 6 - fs/ext4/namei.c | 54 +++-- fs/ext4/super.c | 24 +- fs/f2fs/f2fs.h | 19 +- fs/f2fs/file.c | 20 +- fs/f2fs/inline.c | 29 ++- fs/f2fs/inode.c | 19 +- fs/f2fs/segment.c | 42 ++-- fs/f2fs/segment.h | 33 ++- fs/f2fs/super.c | 6 +- fs/fat/fatent.c | 7 +- fs/gfs2/quota.c | 32 ++- fs/iomap/buffered-io.c | 3 +- fs/jfs/jfs_dmap.c | 3 +- fs/nfs/file.c | 16 +- fs/nfs/pnfs.c | 2 + fs/nfs/write.c | 11 +- fs/notify/mark.c | 6 +- fs/ocfs2/dlmfs/userdlm.c | 16 +- fs/proc/generic.c | 3 + fs/proc/proc_net.c | 3 + fs/xfs/libxfs/xfs_btree.c | 35 ++- fs/xfs/xfs_dquot.c | 39 +++- fs/xfs/xfs_iomap.c | 3 + fs/xfs/xfs_log.c | 28 ++- fs/xfs/xfs_log.h | 1 + fs/xfs/xfs_mount.c | 3 +- fs/xfs/xfs_symlink.c | 1 + include/linux/bpf.h | 2 + include/linux/efi.h | 2 + include/linux/font.h | 2 +- include/linux/gpio/driver.h | 12 + include/linux/lsm_hook_defs.h | 4 +- include/linux/lsm_hooks.h | 2 +- include/linux/mailbox_controller.h | 1 + include/linux/mtd/cfi.h | 1 + include/linux/nodemask.h | 13 +- include/linux/platform_data/cros_ec_proto.h | 3 + include/linux/ptrace.h | 7 - include/linux/security.h | 23 +- include/linux/thermal.h | 2 +- include/linux/usb/hcd.h | 2 + include/net/bluetooth/hci.h | 16 +- include/net/bluetooth/hci_core.h | 18 +- include/net/flow.h | 10 + include/net/if_inet6.h | 8 + include/net/route.h | 6 +- include/sound/jack.h | 1 + include/trace/events/rxrpc.h | 2 +- include/trace/events/vmscan.h | 4 +- init/Kconfig | 5 + ipc/mqueue.c | 14 ++ kernel/bpf/stackmap.c | 1 - kernel/dma/debug.c | 2 +- kernel/ptrace.c | 5 +- kernel/rcu/Kconfig | 1 + kernel/rcu/tasks.h | 3 + kernel/scftorture.c | 5 +- kernel/sched/fair.c | 8 +- kernel/sched/pelt.h | 4 +- kernel/sched/sched.h | 4 +- kernel/trace/ftrace.c | 5 +- kernel/trace/trace_events_hist.c | 3 + mm/compaction.c | 2 + mm/hugetlb.c | 9 +- net/bluetooth/hci_conn.c | 8 +- net/bluetooth/hci_core.c | 27 ++- net/bluetooth/hci_debugfs.c | 8 +- net/bluetooth/hci_event.c | 91 ++++---- net/bluetooth/hci_request.c | 221 ++++++++++++++---- net/bluetooth/hci_sock.c | 12 +- net/bluetooth/l2cap_core.c | 10 +- net/bluetooth/mgmt.c | 14 +- net/bluetooth/mgmt_config.c | 10 + net/bluetooth/sco.c | 21 +- net/bluetooth/smp.c | 6 +- net/core/dev.c | 8 +- net/dccp/ipv4.c | 2 +- net/dccp/ipv6.c | 6 +- net/ipv4/icmp.c | 4 +- net/ipv4/inet_connection_sock.c | 4 +- net/ipv4/ip_output.c | 2 +- net/ipv4/ping.c | 2 +- net/ipv4/raw.c | 2 +- net/ipv4/syncookies.c | 2 +- net/ipv4/udp.c | 2 +- net/ipv6/addrconf.c | 33 ++- net/ipv6/af_inet6.c | 2 +- net/ipv6/datagram.c | 2 +- net/ipv6/icmp.c | 6 +- net/ipv6/inet6_connection_sock.c | 4 +- net/ipv6/netfilter/nf_reject_ipv6.c | 2 +- net/ipv6/ping.c | 2 +- net/ipv6/raw.c | 2 +- net/ipv6/syncookies.c | 2 +- net/ipv6/tcp_ipv6.c | 4 +- net/ipv6/udp.c | 2 +- net/l2tp/l2tp_ip6.c | 2 +- net/mac80211/chan.c | 7 +- net/mac80211/ieee80211_i.h | 5 + net/mac80211/scan.c | 20 ++ net/netfilter/nf_synproxy_core.c | 2 +- net/nfc/core.c | 1 + net/rxrpc/ar-internal.h | 13 +- net/rxrpc/call_event.c | 7 +- net/rxrpc/conn_object.c | 2 +- net/rxrpc/input.c | 31 ++- net/rxrpc/output.c | 20 +- net/rxrpc/recvmsg.c | 8 +- net/rxrpc/sendmsg.c | 6 + net/rxrpc/sysctl.c | 4 +- net/sctp/input.c | 4 +- net/smc/af_smc.c | 2 +- net/wireless/nl80211.c | 1 + net/wireless/reg.c | 4 + net/xfrm/xfrm_state.c | 6 +- scripts/faddr2line | 150 +++++++----- security/integrity/ima/Kconfig | 14 +- .../platform_certs/keyring_handler.h | 8 + security/integrity/platform_certs/load_uefi.c | 33 +++ security/security.c | 17 +- security/selinux/hooks.c | 4 +- security/selinux/include/xfrm.h | 2 +- security/selinux/xfrm.c | 13 +- sound/core/jack.c | 34 ++- sound/core/pcm_memory.c | 3 +- sound/pci/hda/patch_realtek.c | 11 + sound/soc/atmel/atmel-classd.c | 1 - sound/soc/atmel/atmel-pdmic.c | 1 - sound/soc/codecs/Kconfig | 2 - sound/soc/codecs/max98090.c | 6 +- sound/soc/codecs/rk3328_codec.c | 2 +- sound/soc/codecs/rt5514.c | 2 +- sound/soc/codecs/rt5645.c | 7 +- sound/soc/codecs/tscs454.c | 12 +- sound/soc/codecs/wm2000.c | 6 +- sound/soc/fsl/imx-sgtl5000.c | 14 +- sound/soc/intel/boards/bytcr_rt5640.c | 12 + sound/soc/mediatek/mt2701/mt2701-wm8960.c | 9 +- sound/soc/mediatek/mt8173/mt8173-max98090.c | 5 +- sound/soc/mxs/mxs-saif.c | 1 + sound/soc/samsung/aries_wm8994.c | 17 +- sound/soc/samsung/arndale.c | 5 +- sound/soc/samsung/littlemill.c | 5 +- sound/soc/samsung/lowland.c | 5 +- sound/soc/samsung/odroid.c | 4 +- sound/soc/samsung/smdk_wm8994.c | 4 +- sound/soc/samsung/smdk_wm8994pcm.c | 4 +- sound/soc/samsung/snow.c | 9 +- sound/soc/samsung/speyside.c | 5 +- sound/soc/samsung/tm2_wm5110.c | 3 +- sound/soc/samsung/tobermory.c | 5 +- sound/soc/soc-dapm.c | 2 - sound/soc/ti/j721e-evm.c | 44 +++- sound/usb/midi.c | 3 + tools/lib/bpf/libbpf.c | 20 +- tools/perf/Makefile.config | 39 +++- tools/perf/builtin-c2c.c | 6 +- tools/perf/pmu-events/jevents.c | 2 +- tools/perf/util/data.h | 1 + tools/power/x86/turbostat/turbostat.c | 1 + .../bpf/progs/btf_dump_test_case_syntax.c | 2 +- tools/testing/selftests/cgroup/test_stress.sh | 2 +- tools/testing/selftests/resctrl/fill_buf.c | 4 +- 477 files changed, 3474 insertions(+), 1907 deletions(-) -- 2.20.1

1 427

[PATCH 1/4] perf/core: Provide a kernel-internal interface to recalibrate event period
by Laibin Qiu 27 Sep '22

27 Sep '22

From: Like Xu <like.xu(a)linux.intel.com> mainline inclusion from mainline-v5.4 commit 3ca270fc9edb258d5bfa271bcf851614e9e6e7d4 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5SDUS CVE: NA ------------- Currently, perf_event_period() is used by user tools via ioctl. Based on naming convention, exporting perf_event_period() for kernel users (such as KVM) who may recalibrate the event period for their assigned counter according to their requirements. The perf_event_period() is an external accessor, just like the perf_event_{en,dis}able() and should thus use perf_event_ctx_lock(). Suggested-by: Kan Liang <kan.liang(a)linux.intel.com> Signed-off-by: Like Xu <like.xu(a)linux.intel.com> Acked-by: Peter Zijlstra <peterz(a)infradead.org> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> Signed-off-by: Yanan Wang <wangyanan55(a)huawei.com> Reviewed-by: Zenghui Yu <yuzenghui(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- include/linux/perf_event.h | 5 +++++ kernel/events/core.c | 28 +++++++++++++++++++++------- 2 files changed, 26 insertions(+), 7 deletions(-) diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h index 41bc1d3b311f..514962a49c62 100644 --- a/include/linux/perf_event.h +++ b/include/linux/perf_event.h @@ -1336,6 +1336,7 @@ extern void perf_event_disable_local(struct perf_event *event); extern void perf_event_disable_inatomic(struct perf_event *event); extern void perf_event_task_tick(void); extern int perf_event_account_interrupt(struct perf_event *event); +extern int perf_event_period(struct perf_event *event, u64 value); #else /* !CONFIG_PERF_EVENTS: */ static inline void * perf_aux_output_begin(struct perf_output_handle *handle, @@ -1408,6 +1409,10 @@ static inline void perf_event_disable(struct perf_event *event) { } static inline int __perf_event_disable(void *info) { return -1; } static inline void perf_event_task_tick(void) { } static inline int perf_event_release_kernel(struct perf_event *event) { return 0; } +static inline int perf_event_period(struct perf_event *event, u64 value) +{ + return -EINVAL; +} #endif #if defined(CONFIG_PERF_EVENTS) && defined(CONFIG_CPU_SUP_INTEL) diff --git a/kernel/events/core.c b/kernel/events/core.c index 616cccf9c835..b1e4beb6931c 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -5034,16 +5034,11 @@ static int perf_event_check_period(struct perf_event *event, u64 value) return event->pmu->check_period(event, value); } -static int perf_event_period(struct perf_event *event, u64 __user *arg) +static int _perf_event_period(struct perf_event *event, u64 value) { - u64 value; - if (!is_sampling_event(event)) return -EINVAL; - if (copy_from_user(&value, arg, sizeof(value))) - return -EFAULT; - if (!value) return -EINVAL; @@ -5058,6 +5053,19 @@ static int perf_event_period(struct perf_event *event, u64 __user *arg) return 0; } +int perf_event_period(struct perf_event *event, u64 value) +{ + struct perf_event_context *ctx; + int ret; + + ctx = perf_event_ctx_lock(event); + ret = _perf_event_period(event, value); + perf_event_ctx_unlock(event, ctx); + + return ret; +} +EXPORT_SYMBOL_GPL(perf_event_period); + static const struct file_operations perf_fops; static inline int perf_fget_light(int fd, struct fd *p) @@ -5101,8 +5109,14 @@ static long _perf_ioctl(struct perf_event *event, unsigned int cmd, unsigned lon return _perf_event_refresh(event, arg); case PERF_EVENT_IOC_PERIOD: - return perf_event_period(event, (u64 __user *)arg); + { + u64 value; + + if (copy_from_user(&value, (u64 __user *)arg, sizeof(value))) + return -EFAULT; + return _perf_event_period(event, value); + } case PERF_EVENT_IOC_ID: { u64 id = primary_event_id(event); -- 2.25.1

1 3

[PATCH openEuler-1.0-LTS] media: em28xx: initialize refcount before kref_get
by Yongqiang Liu 27 Sep '22

27 Sep '22

From: Dongliang Mu <mudongliangabcd(a)gmail.com> stable inclusion from stable-v4.19.238 commit 0113fa98a49a8e46a19b0ad80f29c904c6feec23 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5RX5X CVE: CVE-2022-3239 --------------------------- [ Upstream commit c08eadca1bdfa099e20a32f8fa4b52b2f672236d ] The commit 47677e51e2a4("[media] em28xx: Only deallocate struct em28xx after finishing all extensions") adds kref_get to many init functions (e.g., em28xx_audio_init). However, kref_init is called too late in em28xx_usb_probe, since em28xx_init_dev before will invoke those init functions and call kref_get function. Then refcount bug occurs in my local syzkaller instance. Fix it by moving kref_init before em28xx_init_dev. This issue occurs not only in dev but also dev->dev_next. Fixes: 47677e51e2a4 ("[media] em28xx: Only deallocate struct em28xx after finishing all extensions") Reported-by: syzkaller <syzkaller(a)googlegroups.com> Signed-off-by: Dongliang Mu <mudongliangabcd(a)gmail.com> Signed-off-by: Hans Verkuil <hverkuil-cisco(a)xs4all.nl> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/media/usb/em28xx/em28xx-cards.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c index 3f59a98dbf9a..00a3b5768b9a 100644 --- a/drivers/media/usb/em28xx/em28xx-cards.c +++ b/drivers/media/usb/em28xx/em28xx-cards.c @@ -3816,6 +3816,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, goto err_free; } + kref_init(&dev->ref); + dev->devno = nr; dev->model = id->driver_info; dev->alt = -1; @@ -3916,6 +3918,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, } if (dev->board.has_dual_ts && em28xx_duplicate_dev(dev) == 0) { + kref_init(&dev->dev_next->ref); + dev->dev_next->ts = SECONDARY_TS; dev->dev_next->alt = -1; dev->dev_next->is_audio_only = has_vendor_audio && @@ -3970,12 +3974,8 @@ static int em28xx_usb_probe(struct usb_interface *intf, em28xx_write_reg(dev, 0x0b, 0x82); mdelay(100); } - - kref_init(&dev->dev_next->ref); } - kref_init(&dev->ref); - request_modules(dev); /* -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/6] efi: capsule-loader: Fix use-after-free in efi_capsule_write
by Yongqiang Liu 26 Sep '22

26 Sep '22

From: Hyunwoo Kim <imv4bel(a)gmail.com> mainline inclusion from mainline-v6.0-rc5 commit 9cb636b5f6a8cc6d1b50809ec8f8d33ae0c84c95 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5QI0W CVE: CVE-2022-40307 --------------------------- A race condition may occur if the user calls close() on another thread during a write() operation on the device node of the efi capsule. This is a race condition that occurs between the efi_capsule_write() and efi_capsule_flush() functions of efi_capsule_fops, which ultimately results in UAF. So, the page freeing process is modified to be done in efi_capsule_release() instead of efi_capsule_flush(). Cc: <stable(a)vger.kernel.org> # v4.9+ Signed-off-by: Hyunwoo Kim <imv4bel(a)gmail.com> Link: https://lore.kernel.org/all/20220907102920.GA88602@ubuntu/ Signed-off-by: Ard Biesheuvel <ardb(a)kernel.org> Signed-off-by: Xia Longlong <xialonglong1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/firmware/efi/capsule-loader.c | 31 ++++++--------------------- 1 file changed, 7 insertions(+), 24 deletions(-) diff --git a/drivers/firmware/efi/capsule-loader.c b/drivers/firmware/efi/capsule-loader.c index 96688986da56..94aae1e67c99 100644 --- a/drivers/firmware/efi/capsule-loader.c +++ b/drivers/firmware/efi/capsule-loader.c @@ -243,29 +243,6 @@ static ssize_t efi_capsule_write(struct file *file, const char __user *buff, return ret; } -/** - * efi_capsule_flush - called by file close or file flush - * @file: file pointer - * @id: not used - * - * If a capsule is being partially uploaded then calling this function - * will be treated as upload termination and will free those completed - * buffer pages and -ECANCELED will be returned. - **/ -static int efi_capsule_flush(struct file *file, fl_owner_t id) -{ - int ret = 0; - struct capsule_info *cap_info = file->private_data; - - if (cap_info->index > 0) { - pr_err("capsule upload not complete\n"); - efi_free_all_buff_pages(cap_info); - ret = -ECANCELED; - } - - return ret; -} - /** * efi_capsule_release - called by file close * @inode: not used @@ -278,6 +255,13 @@ static int efi_capsule_release(struct inode *inode, struct file *file) { struct capsule_info *cap_info = file->private_data; + if (cap_info->index > 0 && + (cap_info->header.headersize == 0 || + cap_info->count < cap_info->total_size)) { + pr_err("capsule upload not complete\n"); + efi_free_all_buff_pages(cap_info); + } + kfree(cap_info->pages); kfree(cap_info->phys); kfree(file->private_data); @@ -325,7 +309,6 @@ static const struct file_operations efi_capsule_fops = { .owner = THIS_MODULE, .open = efi_capsule_open, .write = efi_capsule_write, - .flush = efi_capsule_flush, .release = efi_capsule_release, .llseek = no_llseek, }; -- 2.25.1

1 5

[PATCH] Memory model: Fix the memory model issues for Linux kernel
by Hanjun Guo 24 Sep '22

24 Sep '22

From: Jonas Oberhauser <jonas.oberhauser(a)huawei.com> This is the update and fixes for memory model, simplify the model by removing redundancies, making semantics of seq-cst explicit, making ppo a subset of po, making ppo locally computable, as well as eliminating several spurious bugs in qspinlock and litmus tests, and ensuring correct compilation to the official power model. These issues were detected by Jonas Oberhauser, Viktor Vafeiadis, and the authors of "Verifying and Optimizing Compact NUMA-Aware Locks on Weak Memory Models", and the solutions are proposed by Jonas Oberhauser and Viktor Vafeiadis. Please refer to this link on the web: https://static.sched.com/hosted_files/osseu2022/e1/oss-eu22-jonas.pdf Signed-off-by: Jonas Oberhauser <jonas.oberhauser(a)huawei.com> Signed-off-by: Hanjun Guo <guohanjun(a)huawei.com> --- tools/memory-model/linux-kernel.bell | 9 ++-- tools/memory-model/linux-kernel.cat | 100 +++++++++++++++++++---------------- tools/memory-model/linux-kernel.def | 34 ++++++------ 3 files changed, 77 insertions(+), 66 deletions(-) diff --git a/tools/memory-model/linux-kernel.bell b/tools/memory-model/linux-kernel.bell index 5be86b1..880b28b 100644 --- a/tools/memory-model/linux-kernel.bell +++ b/tools/memory-model/linux-kernel.bell @@ -4,6 +4,8 @@ * Copyright (C) 2016 Luc Maranget <luc.maranget(a)inria.fr> for Inria * Copyright (C) 2017 Alan Stern <stern(a)rowland.harvard.edu>, * Andrea Parri <parri.andrea(a)gmail.com> + * Copyright (C) 2022 Jonas Oberhauser <jonas.oberhauser(a)huawei.com> + * Viktor Vafeiadis <viktor(a)mpi-sws.org> * * An earlier version of this file appeared in the companion webpage for * "Frightening small children and disconcerting grown-ups: Concurrency @@ -16,10 +18,11 @@ enum Accesses = 'once (*READ_ONCE,WRITE_ONCE*) || 'release (*smp_store_release*) || 'acquire (*smp_load_acquire*) || + 'seq-cst (*smp_load, xchg...*) || 'noreturn (* R of non-return RMW *) -instructions R[{'once,'acquire,'noreturn}] -instructions W[{'once,'release}] -instructions RMW[{'once,'acquire,'release}] +instructions R[{'seq-cst, 'once,'acquire,'noreturn}] +instructions W[{'seq-cst, 'once,'release}] +instructions RMW[{'seq-cst, 'once,'acquire,'release}] enum Barriers = 'wmb (*smp_wmb*) || 'rmb (*smp_rmb*) || diff --git a/tools/memory-model/linux-kernel.cat b/tools/memory-model/linux-kernel.cat index d70315f..9f14d31 100644 --- a/tools/memory-model/linux-kernel.cat +++ b/tools/memory-model/linux-kernel.cat @@ -4,6 +4,8 @@ * Copyright (C) 2016 Luc Maranget <luc.maranget(a)inria.fr> for Inria * Copyright (C) 2017 Alan Stern <stern(a)rowland.harvard.edu>, * Andrea Parri <parri.andrea(a)gmail.com> + * Copyright (C) 2022 Jonas Oberhauser <jonas.oberhauser(a)huawei.com>, + * Viktor Vafeiadis <viktor(a)mpi-sws.org> * * An earlier version of this file appeared in the companion webpage for * "Frightening small children and disconcerting grown-ups: Concurrency @@ -25,25 +27,33 @@ include "lock.cat" (*******************) (* Release Acquire *) + let acq-po = [Acquire] ; po ; [M] let po-rel = [M] ; po ; [Release] let po-unlock-lock-po = po ; [UL] ; (po|rf) ; [LKR] ; po (* Fences *) -let R4rmb = R \ Noreturn (* Reads for which rmb works *) -let rmb = [R4rmb] ; fencerel(Rmb) ; [R4rmb] -let wmb = [W] ; fencerel(Wmb) ; [W] -let mb = ([M] ; fencerel(Mb) ; [M]) | - ([M] ; fencerel(Before-atomic) ; [RMW] ; po? ; [M]) | - ([M] ; po? ; [RMW] ; fencerel(After-atomic) ; [M]) | - ([M] ; po? ; [LKW] ; fencerel(After-spinlock) ; [M]) | - ([M] ; po ; [UL] ; (co | po) ; [LKW] ; - fencerel(After-unlock-lock) ; [M]) -let gp = po ; [Sync-rcu | Sync-srcu] ; po? -let strong-fence = mb | gp - +let R4rmb = R \ Noreturn +let rmb = [R4rmb] ; po ; [Rmb] ; po ; [R4rmb] +let wmb = [W] ; po ; [Wmb] ; po ; [W] + +let rmb-plain = [R \ Noreturn] ; po ; [Rmb] ; po \ ( po ; [W] ; po-loc) ; [R \ Noreturn] +let plain-wmb = [W] ; po \ (po-loc ; [W] ; po) ; [Wmb] ; po ; [W] +let strong-fence = + [M] ; po ; [Mb] ; po ; [M] + | [M] ; po ; [Before-atomic] ; po ; [RMW] ; po? ; [M] + | [M] ; po? ; [RMW] ; po ; [After-atomic] ; po ; [M] + | [M] ; po? ; [LKW] ; po ; [After-spinlock] ; po ; [M] + | [M] ; po ; [UL] ; po ; [LKR] ; po ; [After-unlock-lock] ; po ; [M] + | [M] ; po? ; [SC] ; po ; [M] + | [M] ; po ; [SC] ; po? ; [M] + | po ; [Sync-rcu | Sync-srcu] ; po? +let strong-sync = strong-fence + | ([M] ; po-unlock-lock-po ; [After-unlock-lock] ; po ; [M]) let nonrw-fence = strong-fence | po-rel | acq-po let fence = nonrw-fence | wmb | rmb + + let barrier = fencerel(Barrier | Rmb | Wmb | Mb | Sync-rcu | Sync-srcu | Before-atomic | After-atomic | Acquire | Release | Rcu-lock | Rcu-unlock | Srcu-lock | Srcu-unlock) | @@ -64,35 +74,33 @@ empty rmw & (fre ; coe) as atomic (* Instruction execution ordering *) (**********************************) + (* Preserved Program Order *) -let dep = addr | data -let rwdep = (dep | ctrl) ; [W] -let overwrite = co | fr -let to-w = rwdep | (overwrite & int) | (addr ; [Plain] ; wmb) -let to-r = addr | (dep ; [Marked] ; rfi) -let ppo = to-r | to-w | fence | (po-unlock-lock-po & int) +let dop = rmb-plain? ; (addr | data | ctrl | rfi)+; plain-wmb? +let to-w = (dop | po-loc) ; [W] +let lrs = ([W] ; po-loc ; [R]) \ (po-loc ; [W] ; po-loc) +let to-r = addr | ((addr | data) ; lrs) +let ppo = to-r | to-w | fence | (po ; [UL] ; po ; [LKR] ; po) (* Propagation: Ordering from release operations and strong fences. *) -let A-cumul(r) = (rfe ; [Marked])? ; r -let cumul-fence = [Marked] ; (A-cumul(strong-fence | po-rel) | wmb | - po-unlock-lock-po) ; [Marked] -let prop = [Marked] ; (overwrite & ext)? ; cumul-fence* ; - [Marked] ; rfe? ; [Marked] +let cumul-fence = [Marked] ; (rfe? ; (po-rel ; (rfe ; rmw)*) | wmb | po-unlock-lock-po) ; [Marked] +let prop = [Marked] ; ((co | fr) & ext) ; cumul-fence* ; [Marked] ; rfe? ; [Marked] + (* * Happens Before: Ordering from the passage of time. - * No fences needed here for prop because relation confined to one process. *) -let hb = [Marked] ; (ppo | rfe | ((prop \ id) & int)) ; [Marked] -acyclic hb as happens-before +let hb = [Marked] ; (ppo | rfe | prop ; strong-sync) ; [Marked] +acyclic hb + +(* No fences needed here for prop because relation confined to one process. *) +irreflexive (prop ; ppo*) + + + + -(****************************************) -(* Write and fence propagation ordering *) -(****************************************) -(* Propagation: Each non-rf link needs a strong fence. *) -let pb = prop ; strong-fence ; hb* ; [Marked] -acyclic pb as propagation (*******) (* RCU *) @@ -118,7 +126,7 @@ let srcu-rscsi = srcu-rscs^-1 * one but two non-rf relations, but only in conjunction with an RCU * read-side critical section. *) -let rcu-link = po? ; hb* ; pb* ; prop ; po +let rcu-link = po? ; hb* ; prop? ; po (* * Any sequence containing at least as many grace periods as RCU read-side @@ -139,20 +147,20 @@ let rec rcu-order = rcu-gp | srcu-gp | ((srcu-rscsi ; rcu-link ; rcu-order ; rcu-link ; srcu-gp) & loc) | (rcu-order ; rcu-link ; rcu-order) let rcu-fence = po ; rcu-order ; po? -let fence = fence | rcu-fence -let strong-fence = strong-fence | rcu-fence +let fence-rcu = fence | rcu-fence +let strong-sync-rcu = strong-sync | rcu-fence -(* rb orders instructions just as pb does *) -let rb = prop ; rcu-fence ; hb* ; pb* ; [Marked] +(* rb orders instructions just as hb does *) +let rb = prop? ; rcu-fence ; hb* ; [Marked] irreflexive rb as rcu (* - * The happens-before, propagation, and rcu constraints are all + * The happens-before and rcu constraints are all * expressions of temporal ordering. They could be replaced by * a single constraint on an "executes-before" relation, xb: * - * let xb = hb | pb | rb + * let xb = hb | rb * acyclic xb as executes-before *) @@ -166,24 +174,24 @@ let mixed-accesses = ([Plain & W] ; (po-loc \ barrier) ; [Marked]) | flag ~empty mixed-accesses as mixed-accesses (* Executes-before and visibility *) -let xbstar = (hb | pb | rb)* +let xbstar = (hb | rb)* let vis = cumul-fence* ; rfe? ; [Marked] ; - ((strong-fence ; [Marked] ; xbstar) | (xbstar & int)) + ((strong-sync-rcu ; [Marked] ; xbstar) | (xbstar & int)) (* Boundaries for lifetimes of plain accesses *) -let w-pre-bounded = [Marked] ; (addr | fence)? +let w-pre-bounded = [Marked] ; (addr | fence-rcu)? let r-pre-bounded = [Marked] ; (addr | nonrw-fence | ([R4rmb] ; fencerel(Rmb) ; [~Noreturn]))? -let w-post-bounded = fence? ; [Marked] +let w-post-bounded = fence-rcu? ; [Marked] let r-post-bounded = (nonrw-fence | ([~Noreturn] ; fencerel(Rmb) ; [R4rmb]))? ; [Marked] (* Visibility and executes-before for plain accesses *) -let ww-vis = fence | (strong-fence ; xbstar ; w-pre-bounded) | +let ww-vis = (strong-sync-rcu ; xbstar ; w-pre-bounded) | (w-post-bounded ; vis ; w-pre-bounded) -let wr-vis = fence | (strong-fence ; xbstar ; r-pre-bounded) | +let wr-vis = (strong-sync-rcu ; xbstar ; r-pre-bounded) | (w-post-bounded ; vis ; r-pre-bounded) -let rw-xbstar = fence | (r-post-bounded ; xbstar ; w-pre-bounded) +let rw-xbstar = (r-post-bounded ; xbstar ; w-pre-bounded) (* Potential races *) let pre-race = ext & ((Plain * M) | ((M \ IW) * Plain)) diff --git a/tools/memory-model/linux-kernel.def b/tools/memory-model/linux-kernel.def index ef0f3c1..df239c2 100644 --- a/tools/memory-model/linux-kernel.def +++ b/tools/memory-model/linux-kernel.def @@ -14,7 +14,7 @@ smp_store_release(X,V) { __store{release}(*X,V); } smp_load_acquire(X) __load{acquire}(*X) rcu_assign_pointer(X,V) { __store{release}(X,V); } rcu_dereference(X) __load{once}(X) -smp_store_mb(X,V) { __store{once}(X,V); __fence{mb}; } +smp_store_mb(X,V) { __store{seq-cst}(X,V); } // Fences smp_mb() { __fence{mb}; } @@ -27,11 +27,11 @@ smp_mb__after_unlock_lock() { __fence{after-unlock-lock}; } barrier() { __fence{barrier}; } // Exchange -xchg(X,V) __xchg{mb}(X,V) +xchg(X,V) __xchg{seq-cst}(X,V) xchg_relaxed(X,V) __xchg{once}(X,V) xchg_release(X,V) __xchg{release}(X,V) xchg_acquire(X,V) __xchg{acquire}(X,V) -cmpxchg(X,V,W) __cmpxchg{mb}(X,V,W) +cmpxchg(X,V,W) __cmpxchg{seq-cst}(X,V,W) cmpxchg_relaxed(X,V,W) __cmpxchg{once}(X,V,W) cmpxchg_acquire(X,V,W) __cmpxchg{acquire}(X,V,W) cmpxchg_release(X,V,W) __cmpxchg{release}(X,V,W) @@ -65,52 +65,52 @@ atomic_sub(V,X) { __atomic_op(X,-,V); } atomic_inc(X) { __atomic_op(X,+,1); } atomic_dec(X) { __atomic_op(X,-,1); } -atomic_add_return(V,X) __atomic_op_return{mb}(X,+,V) +atomic_add_return(V,X) __atomic_op_return{seq-cst}(X,+,V) atomic_add_return_relaxed(V,X) __atomic_op_return{once}(X,+,V) atomic_add_return_acquire(V,X) __atomic_op_return{acquire}(X,+,V) atomic_add_return_release(V,X) __atomic_op_return{release}(X,+,V) -atomic_fetch_add(V,X) __atomic_fetch_op{mb}(X,+,V) +atomic_fetch_add(V,X) __atomic_fetch_op{seq-cst}(X,+,V) atomic_fetch_add_relaxed(V,X) __atomic_fetch_op{once}(X,+,V) atomic_fetch_add_acquire(V,X) __atomic_fetch_op{acquire}(X,+,V) atomic_fetch_add_release(V,X) __atomic_fetch_op{release}(X,+,V) -atomic_inc_return(X) __atomic_op_return{mb}(X,+,1) +atomic_inc_return(X) __atomic_op_return{seq-cst}(X,+,1) atomic_inc_return_relaxed(X) __atomic_op_return{once}(X,+,1) atomic_inc_return_acquire(X) __atomic_op_return{acquire}(X,+,1) atomic_inc_return_release(X) __atomic_op_return{release}(X,+,1) -atomic_fetch_inc(X) __atomic_fetch_op{mb}(X,+,1) +atomic_fetch_inc(X) __atomic_fetch_op{seq-cst}(X,+,1) atomic_fetch_inc_relaxed(X) __atomic_fetch_op{once}(X,+,1) atomic_fetch_inc_acquire(X) __atomic_fetch_op{acquire}(X,+,1) atomic_fetch_inc_release(X) __atomic_fetch_op{release}(X,+,1) -atomic_sub_return(V,X) __atomic_op_return{mb}(X,-,V) +atomic_sub_return(V,X) __atomic_op_return{seq-cst}(X,-,V) atomic_sub_return_relaxed(V,X) __atomic_op_return{once}(X,-,V) atomic_sub_return_acquire(V,X) __atomic_op_return{acquire}(X,-,V) atomic_sub_return_release(V,X) __atomic_op_return{release}(X,-,V) -atomic_fetch_sub(V,X) __atomic_fetch_op{mb}(X,-,V) +atomic_fetch_sub(V,X) __atomic_fetch_op{seq-cst}(X,-,V) atomic_fetch_sub_relaxed(V,X) __atomic_fetch_op{once}(X,-,V) atomic_fetch_sub_acquire(V,X) __atomic_fetch_op{acquire}(X,-,V) atomic_fetch_sub_release(V,X) __atomic_fetch_op{release}(X,-,V) -atomic_dec_return(X) __atomic_op_return{mb}(X,-,1) +atomic_dec_return(X) __atomic_op_return{seq-cst}(X,-,1) atomic_dec_return_relaxed(X) __atomic_op_return{once}(X,-,1) atomic_dec_return_acquire(X) __atomic_op_return{acquire}(X,-,1) atomic_dec_return_release(X) __atomic_op_return{release}(X,-,1) -atomic_fetch_dec(X) __atomic_fetch_op{mb}(X,-,1) +atomic_fetch_dec(X) __atomic_fetch_op{seq-cst}(X,-,1) atomic_fetch_dec_relaxed(X) __atomic_fetch_op{once}(X,-,1) atomic_fetch_dec_acquire(X) __atomic_fetch_op{acquire}(X,-,1) atomic_fetch_dec_release(X) __atomic_fetch_op{release}(X,-,1) -atomic_xchg(X,V) __xchg{mb}(X,V) +atomic_xchg(X,V) __xchg{seq-cst}(X,V) atomic_xchg_relaxed(X,V) __xchg{once}(X,V) atomic_xchg_release(X,V) __xchg{release}(X,V) atomic_xchg_acquire(X,V) __xchg{acquire}(X,V) -atomic_cmpxchg(X,V,W) __cmpxchg{mb}(X,V,W) +atomic_cmpxchg(X,V,W) __cmpxchg{seq-cst}(X,V,W) atomic_cmpxchg_relaxed(X,V,W) __cmpxchg{once}(X,V,W) atomic_cmpxchg_acquire(X,V,W) __cmpxchg{acquire}(X,V,W) atomic_cmpxchg_release(X,V,W) __cmpxchg{release}(X,V,W) -atomic_sub_and_test(V,X) __atomic_op_return{mb}(X,-,V) == 0 -atomic_dec_and_test(X) __atomic_op_return{mb}(X,-,1) == 0 -atomic_inc_and_test(X) __atomic_op_return{mb}(X,+,1) == 0 -atomic_add_negative(V,X) __atomic_op_return{mb}(X,+,V) < 0 +atomic_sub_and_test(V,X) __atomic_op_return{seq-cst}(X,-,V) == 0 +atomic_dec_and_test(X) __atomic_op_return{seq-cst}(X,-,1) == 0 +atomic_inc_and_test(X) __atomic_op_return{seq-cst}(X,+,1) == 0 +atomic_add_negative(V,X) __atomic_op_return{seq-cst}(X,+,V) < 0 -- 1.7.12.4

1 0

[PATCH openEuler-1.0-LTS 1/4] mm: mem_reliable: Start fallback if no suitable zone found
by Yongqiang Liu 24 Sep '22

24 Sep '22

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4SK3S CVE: NA -------------------------------- For reliable memory allocation bind to nodes which do not hvve any reliable zones, its memory allocation will fail and then warn message will be produced at the end of __alloc_pages_slowpath(). Though this memory allocation can fallback to movable zone in check_after_alloc() if fallback is enabled, something should be done to prevent this pointless warn log. To solve this problem, fallback to movable zone if no suitable zone found. Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/page_alloc.c | 30 ++++++++++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/mm/page_alloc.c b/mm/page_alloc.c index 1e59761354e1..44d286286dbb 100644 --- a/mm/page_alloc.c +++ b/mm/page_alloc.c @@ -4272,6 +4272,25 @@ check_retry_cpuset(int cpuset_mems_cookie, struct alloc_context *ac) } #ifdef CONFIG_MEMORY_RELIABLE +/* + * if fallback is enabled, fallback to movable zone if no dma/normal zone + * found + */ +static inline struct zone *mem_reliable_fallback_zone(gfp_t gfp_mask, + struct alloc_context *ac) +{ + if (!reliable_allow_fb_enabled()) + return NULL; + + if (!(gfp_mask & ___GFP_RELIABILITY)) + return NULL; + + ac->high_zoneidx = gfp_zone(gfp_mask & ~___GFP_RELIABILITY); + ac->preferred_zoneref = first_zones_zonelist( + ac->zonelist, ac->high_zoneidx, ac->nodemask); + return ac->preferred_zoneref->zone; +} + static inline void mem_reliable_fallback_slowpath(gfp_t gfp_mask, struct alloc_context *ac) { @@ -4290,6 +4309,11 @@ static inline void mem_reliable_fallback_slowpath(gfp_t gfp_mask, } } #else +static inline struct zone *mem_reliable_fallback_zone(gfp_t gfp_mask, + struct alloc_context *ac) +{ + return NULL; +} static inline void mem_reliable_fallback_slowpath(gfp_t gfp_mask, struct alloc_context *ac) {} #endif @@ -4339,8 +4363,10 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, */ ac->preferred_zoneref = first_zones_zonelist(ac->zonelist, ac->high_zoneidx, ac->nodemask); - if (!ac->preferred_zoneref->zone) - goto nopage; + if (!ac->preferred_zoneref->zone) { + if (!mem_reliable_fallback_zone(gfp_mask, ac)) + goto nopage; + } if (gfp_mask & __GFP_KSWAPD_RECLAIM) wake_all_kswapds(order, gfp_mask, ac); -- 2.25.1

1 3

[PATCH for openEuler 22.09] Memory model: Fix the memory model issues for Linux kernel
by Hanjun Guo 24 Sep '22

24 Sep '22

From: Jonas Oberhauser <jonas.oberhauser(a)huawei.com> This the update and fixes for memory model, simplify the model by removing redundancies, making semantics of seq-cst explicit, making ppo a subset of po, making ppo locally computable, as well as eliminating several spurious bugs in qspinlock and litmus tests, and ensuring correct compilation to the official power model. These issues were detected by Jonas Oberhauser, Viktor Vafeiadis, and the authors of "Verifying and Optimizing Compact NUMA-Aware Locks on Weak Memory Models", and the solutions are proposed by Jonas Oberhauser and Viktor Vafeiadis. Signed-off-by: Jonas Oberhauser <jonas.oberhauser(a)huawei.com> Signed-off-by: Hanjun Guo <guohanjun(a)huawei.com> --- tools/memory-model/linux-kernel.bell | 9 ++-- tools/memory-model/linux-kernel.cat | 100 +++++++++++++++++++---------------- 2 files changed, 60 insertions(+), 49 deletions(-) diff --git a/tools/memory-model/linux-kernel.bell b/tools/memory-model/linux-kernel.bell index 5be86b1..880b28b 100644 --- a/tools/memory-model/linux-kernel.bell +++ b/tools/memory-model/linux-kernel.bell @@ -4,6 +4,8 @@ * Copyright (C) 2016 Luc Maranget <luc.maranget(a)inria.fr> for Inria * Copyright (C) 2017 Alan Stern <stern(a)rowland.harvard.edu>, * Andrea Parri <parri.andrea(a)gmail.com> + * Copyright (C) 2022 Jonas Oberhauser <jonas.oberhauser(a)huawei.com> + * Viktor Vafeiadis <viktor(a)mpi-sws.org> * * An earlier version of this file appeared in the companion webpage for * "Frightening small children and disconcerting grown-ups: Concurrency @@ -16,10 +18,11 @@ enum Accesses = 'once (*READ_ONCE,WRITE_ONCE*) || 'release (*smp_store_release*) || 'acquire (*smp_load_acquire*) || + 'seq-cst (*smp_load, xchg...*) || 'noreturn (* R of non-return RMW *) -instructions R[{'once,'acquire,'noreturn}] -instructions W[{'once,'release}] -instructions RMW[{'once,'acquire,'release}] +instructions R[{'seq-cst, 'once,'acquire,'noreturn}] +instructions W[{'seq-cst, 'once,'release}] +instructions RMW[{'seq-cst, 'once,'acquire,'release}] enum Barriers = 'wmb (*smp_wmb*) || 'rmb (*smp_rmb*) || diff --git a/tools/memory-model/linux-kernel.cat b/tools/memory-model/linux-kernel.cat index d70315f..9f14d31 100644 --- a/tools/memory-model/linux-kernel.cat +++ b/tools/memory-model/linux-kernel.cat @@ -4,6 +4,8 @@ * Copyright (C) 2016 Luc Maranget <luc.maranget(a)inria.fr> for Inria * Copyright (C) 2017 Alan Stern <stern(a)rowland.harvard.edu>, * Andrea Parri <parri.andrea(a)gmail.com> + * Copyright (C) 2022 Jonas Oberhauser <jonas.oberhauser(a)huawei.com>, + * Viktor Vafeiadis <viktor(a)mpi-sws.org> * * An earlier version of this file appeared in the companion webpage for * "Frightening small children and disconcerting grown-ups: Concurrency @@ -25,25 +27,33 @@ include "lock.cat" (*******************) (* Release Acquire *) + let acq-po = [Acquire] ; po ; [M] let po-rel = [M] ; po ; [Release] let po-unlock-lock-po = po ; [UL] ; (po|rf) ; [LKR] ; po (* Fences *) -let R4rmb = R \ Noreturn (* Reads for which rmb works *) -let rmb = [R4rmb] ; fencerel(Rmb) ; [R4rmb] -let wmb = [W] ; fencerel(Wmb) ; [W] -let mb = ([M] ; fencerel(Mb) ; [M]) | - ([M] ; fencerel(Before-atomic) ; [RMW] ; po? ; [M]) | - ([M] ; po? ; [RMW] ; fencerel(After-atomic) ; [M]) | - ([M] ; po? ; [LKW] ; fencerel(After-spinlock) ; [M]) | - ([M] ; po ; [UL] ; (co | po) ; [LKW] ; - fencerel(After-unlock-lock) ; [M]) -let gp = po ; [Sync-rcu | Sync-srcu] ; po? -let strong-fence = mb | gp - +let R4rmb = R \ Noreturn +let rmb = [R4rmb] ; po ; [Rmb] ; po ; [R4rmb] +let wmb = [W] ; po ; [Wmb] ; po ; [W] + +let rmb-plain = [R \ Noreturn] ; po ; [Rmb] ; po \ ( po ; [W] ; po-loc) ; [R \ Noreturn] +let plain-wmb = [W] ; po \ (po-loc ; [W] ; po) ; [Wmb] ; po ; [W] +let strong-fence = + [M] ; po ; [Mb] ; po ; [M] + | [M] ; po ; [Before-atomic] ; po ; [RMW] ; po? ; [M] + | [M] ; po? ; [RMW] ; po ; [After-atomic] ; po ; [M] + | [M] ; po? ; [LKW] ; po ; [After-spinlock] ; po ; [M] + | [M] ; po ; [UL] ; po ; [LKR] ; po ; [After-unlock-lock] ; po ; [M] + | [M] ; po? ; [SC] ; po ; [M] + | [M] ; po ; [SC] ; po? ; [M] + | po ; [Sync-rcu | Sync-srcu] ; po? +let strong-sync = strong-fence + | ([M] ; po-unlock-lock-po ; [After-unlock-lock] ; po ; [M]) let nonrw-fence = strong-fence | po-rel | acq-po let fence = nonrw-fence | wmb | rmb + + let barrier = fencerel(Barrier | Rmb | Wmb | Mb | Sync-rcu | Sync-srcu | Before-atomic | After-atomic | Acquire | Release | Rcu-lock | Rcu-unlock | Srcu-lock | Srcu-unlock) | @@ -64,35 +74,33 @@ empty rmw & (fre ; coe) as atomic (* Instruction execution ordering *) (**********************************) + (* Preserved Program Order *) -let dep = addr | data -let rwdep = (dep | ctrl) ; [W] -let overwrite = co | fr -let to-w = rwdep | (overwrite & int) | (addr ; [Plain] ; wmb) -let to-r = addr | (dep ; [Marked] ; rfi) -let ppo = to-r | to-w | fence | (po-unlock-lock-po & int) +let dop = rmb-plain? ; (addr | data | ctrl | rfi)+; plain-wmb? +let to-w = (dop | po-loc) ; [W] +let lrs = ([W] ; po-loc ; [R]) \ (po-loc ; [W] ; po-loc) +let to-r = addr | ((addr | data) ; lrs) +let ppo = to-r | to-w | fence | (po ; [UL] ; po ; [LKR] ; po) (* Propagation: Ordering from release operations and strong fences. *) -let A-cumul(r) = (rfe ; [Marked])? ; r -let cumul-fence = [Marked] ; (A-cumul(strong-fence | po-rel) | wmb | - po-unlock-lock-po) ; [Marked] -let prop = [Marked] ; (overwrite & ext)? ; cumul-fence* ; - [Marked] ; rfe? ; [Marked] +let cumul-fence = [Marked] ; (rfe? ; (po-rel ; (rfe ; rmw)*) | wmb | po-unlock-lock-po) ; [Marked] +let prop = [Marked] ; ((co | fr) & ext) ; cumul-fence* ; [Marked] ; rfe? ; [Marked] + (* * Happens Before: Ordering from the passage of time. - * No fences needed here for prop because relation confined to one process. *) -let hb = [Marked] ; (ppo | rfe | ((prop \ id) & int)) ; [Marked] -acyclic hb as happens-before +let hb = [Marked] ; (ppo | rfe | prop ; strong-sync) ; [Marked] +acyclic hb + +(* No fences needed here for prop because relation confined to one process. *) +irreflexive (prop ; ppo*) + + + + -(****************************************) -(* Write and fence propagation ordering *) -(****************************************) -(* Propagation: Each non-rf link needs a strong fence. *) -let pb = prop ; strong-fence ; hb* ; [Marked] -acyclic pb as propagation (*******) (* RCU *) @@ -118,7 +126,7 @@ let srcu-rscsi = srcu-rscs^-1 * one but two non-rf relations, but only in conjunction with an RCU * read-side critical section. *) -let rcu-link = po? ; hb* ; pb* ; prop ; po +let rcu-link = po? ; hb* ; prop? ; po (* * Any sequence containing at least as many grace periods as RCU read-side @@ -139,20 +147,20 @@ let rec rcu-order = rcu-gp | srcu-gp | ((srcu-rscsi ; rcu-link ; rcu-order ; rcu-link ; srcu-gp) & loc) | (rcu-order ; rcu-link ; rcu-order) let rcu-fence = po ; rcu-order ; po? -let fence = fence | rcu-fence -let strong-fence = strong-fence | rcu-fence +let fence-rcu = fence | rcu-fence +let strong-sync-rcu = strong-sync | rcu-fence -(* rb orders instructions just as pb does *) -let rb = prop ; rcu-fence ; hb* ; pb* ; [Marked] +(* rb orders instructions just as hb does *) +let rb = prop? ; rcu-fence ; hb* ; [Marked] irreflexive rb as rcu (* - * The happens-before, propagation, and rcu constraints are all + * The happens-before and rcu constraints are all * expressions of temporal ordering. They could be replaced by * a single constraint on an "executes-before" relation, xb: * - * let xb = hb | pb | rb + * let xb = hb | rb * acyclic xb as executes-before *) @@ -166,24 +174,24 @@ let mixed-accesses = ([Plain & W] ; (po-loc \ barrier) ; [Marked]) | flag ~empty mixed-accesses as mixed-accesses (* Executes-before and visibility *) -let xbstar = (hb | pb | rb)* +let xbstar = (hb | rb)* let vis = cumul-fence* ; rfe? ; [Marked] ; - ((strong-fence ; [Marked] ; xbstar) | (xbstar & int)) + ((strong-sync-rcu ; [Marked] ; xbstar) | (xbstar & int)) (* Boundaries for lifetimes of plain accesses *) -let w-pre-bounded = [Marked] ; (addr | fence)? +let w-pre-bounded = [Marked] ; (addr | fence-rcu)? let r-pre-bounded = [Marked] ; (addr | nonrw-fence | ([R4rmb] ; fencerel(Rmb) ; [~Noreturn]))? -let w-post-bounded = fence? ; [Marked] +let w-post-bounded = fence-rcu? ; [Marked] let r-post-bounded = (nonrw-fence | ([~Noreturn] ; fencerel(Rmb) ; [R4rmb]))? ; [Marked] (* Visibility and executes-before for plain accesses *) -let ww-vis = fence | (strong-fence ; xbstar ; w-pre-bounded) | +let ww-vis = (strong-sync-rcu ; xbstar ; w-pre-bounded) | (w-post-bounded ; vis ; w-pre-bounded) -let wr-vis = fence | (strong-fence ; xbstar ; r-pre-bounded) | +let wr-vis = (strong-sync-rcu ; xbstar ; r-pre-bounded) | (w-post-bounded ; vis ; r-pre-bounded) -let rw-xbstar = fence | (r-post-bounded ; xbstar ; w-pre-bounded) +let rw-xbstar = (r-post-bounded ; xbstar ; w-pre-bounded) (* Potential races *) let pre-race = ext & ((Plain * M) | ((M \ IW) * Plain)) -- 1.7.12.4

1 0

[PATCH openEuler-22.09] mm: reliable: Fix ret errno to EACCES
by Zheng Zengkai 24 Sep '22

24 Sep '22

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4SK3S CVE: NA -------------------------------- Commit bc25b3081709 ("mm: reliable: Use EINVAL in reliable_check") update EPERM to EINVAL try to pass LTP's proc01 test, however LTP only treat EACCESS as whitelist in the scenario. To solve this problem, update EINVAL to EACCESS. Fixes: bc25b3081709 ("mm: reliable: Use EINVAL in reliable_check") Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Chen Wandun <chenwandun(a)huawei.com> --- fs/proc/base.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 0c3a2eb61726..2d1af92653bb 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -1264,7 +1264,7 @@ static const struct file_operations proc_oom_score_adj_operations = { static inline int reliable_check(struct task_struct *task, struct pid *pid) { if (!mem_reliable_is_enabled()) - return -EINVAL; + return -EACCES; if (is_global_init(task)) return -EINVAL; -- 2.20.1

1 0

[PATCH openEuler-22.09] mm: reliable: Use EINVAL in reliable_check
by Zheng Zengkai 24 Sep '22

24 Sep '22

From: Ma Wupeng <mawupeng1(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4SK3S CVE: NA -------------------------------- LTP's proc01 test was failing be because this ret code (1): proc01 1 TFAIL : proc01.c:400: read failed: /proc/self/task/1406366/reliable: errno=EPERM(1): Operation not permitted To slove this problem, replace EPERM with EINVAL in reliable_check(). Signed-off-by: Ma Wupeng <mawupeng1(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- fs/proc/base.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 8ae7c2be70c2..0c3a2eb61726 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -1264,14 +1264,14 @@ static const struct file_operations proc_oom_score_adj_operations = { static inline int reliable_check(struct task_struct *task, struct pid *pid) { if (!mem_reliable_is_enabled()) - return -EPERM; + return -EINVAL; if (is_global_init(task)) - return -EPERM; + return -EINVAL; if (!task->mm || (task->flags & PF_KTHREAD) || (task->flags & PF_EXITING)) - return -EPERM; + return -EINVAL; return 0; } -- 2.20.1

1 0

[PATCH openEuler-22.09] Revert "net: af_key: add check for pfkey_broadcast in function pfkey_process"
by Zheng Zengkai 22 Sep '22

22 Sep '22

From: Michal Kubecek <mkubecek(a)suse.cz> stable inclusion from stable-v5.10.122 commit 7fa8312879f78d255a63b372473a7016d4c29d67 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5L6D4 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 9c90c9b3e50e16d03c7f87d63e9db373974781e0 ] This reverts commit 4dc2a5a8f6754492180741facf2a8787f2c415d7. A non-zero return value from pfkey_broadcast() does not necessarily mean an error occurred as this function returns -ESRCH when no registered listener received the message. In particular, a call with BROADCAST_PROMISC_ONLY flag and null one_sk argument can never return zero so that this commit in fact prevents processing any PF_KEY message. One visible effect is that racoon daemon fails to find encryption algorithms like aes and refuses to start. Excluding -ESRCH return value would fix this but it's not obvious that we really want to bail out here and most other callers of pfkey_broadcast() also ignore the return value. Also, as pointed out by Steffen Klassert, PF_KEY is kind of deprecated and newer userspace code should use netlink instead so that we should only disturb the code for really important fixes. v2: add a comment explaining why is the return value ignored Signed-off-by: Michal Kubecek <mkubecek(a)suse.cz> Signed-off-by: Steffen Klassert <steffen.klassert(a)secunet.com> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- net/key/af_key.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/net/key/af_key.c b/net/key/af_key.c index dca264844be4..aa3b1e0cd311 100644 --- a/net/key/af_key.c +++ b/net/key/af_key.c @@ -2833,10 +2833,12 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb void *ext_hdrs[SADB_EXT_MAX]; int err; - err = pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, - BROADCAST_PROMISC_ONLY, NULL, sock_net(sk)); - if (err) - return err; + /* Non-zero return value of pfkey_broadcast() does not always signal + * an error and even on an actual error we may still want to process + * the message so rather ignore the return value. + */ + pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, + BROADCAST_PROMISC_ONLY, NULL, sock_net(sk)); memset(ext_hdrs, 0, sizeof(ext_hdrs)); err = parse_exthdrs(skb, hdr, ext_hdrs); -- 2.20.1

1 0

[PATCH 1/2] net: hns3: fix error resume keep alive when remove hclgevf
by Laibin Qiu 22 Sep '22

22 Sep '22

From: Yonglong Liu <liuyonglong(a)huawei.com> driver inclusion category: https://gitee.com/openeuler/kernel/issues/I5S7WZ bugzilla: NA CVE: NA ---------------------------- When enable lots of vf, remove the driver of vf will call keep alive wrong resume. Fixes: 6a804d0a6068 ("net: hns3: fix keep alive can not resume problem when system busy") Signed-off-by: Yonglong Liu <liuyonglong(a)huawei.com> Reviewed-by: li yongxin <liyongxin1(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 2 ++ drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h | 1 + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c | 3 ++- 3 files changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index 41a12df725b3..b4b1e440fba4 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -7096,6 +7096,7 @@ int hclge_vport_start(struct hclge_vport *vport) struct hclge_dev *hdev = vport->back; vport->last_active_jiffies = jiffies; + set_bit(HCLGE_VPORT_STATE_START, &vport->state); set_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state); if (test_bit(vport->vport_id, hdev->vport_config_block)) { @@ -7113,6 +7114,7 @@ int hclge_vport_start(struct hclge_vport *vport) void hclge_vport_stop(struct hclge_vport *vport) { + clear_bit(HCLGE_VPORT_STATE_START, &vport->state); clear_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state); } diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h index 8477dc343a40..99a55fa74cd4 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.h @@ -926,6 +926,7 @@ enum HCLGE_VPORT_STATE { HCLGE_VPORT_STATE_MAC_TBL_CHANGE, HCLGE_VPORT_STATE_PROMISC_CHANGE, HCLGE_VPORT_STATE_VLAN_FLTR_CHANGE, + HCLGE_VPORT_STATE_START, HCLGE_VPORT_STATE_MAX }; diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c index 45f94cd33524..893f6e0ce473 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c @@ -644,7 +644,8 @@ static void hclge_vf_keep_alive(struct hclge_vport *vport) vport->last_active_jiffies = jiffies; - if (!test_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state)) { + if (test_bit(HCLGE_VPORT_STATE_START, &vport->state) && + !test_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state)) { set_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state); dev_info(&hdev->pdev->dev, "VF %u keep alive resume!", -- 2.25.1

1 1

[PATCH 1/2] net: hns3: fix keep alive can not resume problem when system busy
by Laibin Qiu 22 Sep '22

22 Sep '22

From: Yonglong Liu <liuyonglong(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5S7WZ CVE: NA ---------------------------- Currently, VF send keep alive to PF every 2s, and PF detect the keep alive for 8s, some case, the work queue may schedule late, cause keep alive lost, then the mac setting from PF may not affect to the VF, and the keep alive can not resume, only reset VF or reload VF driver can resume. This patch adds keep alive resume mechanism, and adds some debug print for this case. When link status change between keep alive lost and resume, the link status of VF may not the same as the PF, so adds push link status to VF to avoid this case. Signed-off-by: Yonglong Liu <liuyonglong(a)huawei.com> Reviewed-by: li yongxin <liyongxin1(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- .../hisilicon/hns3/hns3pf/hclge_main.c | 9 ++++++-- .../hisilicon/hns3/hns3pf/hclge_mbx.c | 22 +++++++++++++++++++ 2 files changed, 29 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c index 7e5e58470017..41a12df725b3 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c @@ -4046,7 +4046,12 @@ static void hclge_update_vport_alive(struct hclge_dev *hdev) * receive a vf's alive msg for 8s, regards the vf is offline */ if (time_after(jiffies, vport->last_active_jiffies + 8 * HZ)) - clear_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state); + if (test_and_clear_bit(HCLGE_VPORT_STATE_ALIVE, + &vport->state)) + dev_info(&hdev->pdev->dev, + "VF %u keep alive lost!", + vport->vport_id - + HCLGE_VF_VPORT_START_NUM); /* If vf is not alive, set to default value */ if (!test_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state)) @@ -7090,8 +7095,8 @@ int hclge_vport_start(struct hclge_vport *vport) { struct hclge_dev *hdev = vport->back; - set_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state); vport->last_active_jiffies = jiffies; + set_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state); if (test_bit(vport->vport_id, hdev->vport_config_block)) { if (vport->vport_id) { diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c index b1b59c1f5cc6..45f94cd33524 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_mbx.c @@ -639,7 +639,29 @@ static int hclge_reset_vf(struct hclge_vport *vport) static void hclge_vf_keep_alive(struct hclge_vport *vport) { + struct hclge_dev *hdev = vport->back; + int ret; + vport->last_active_jiffies = jiffies; + + if (!test_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state)) { + set_bit(HCLGE_VPORT_STATE_ALIVE, &vport->state); + + dev_info(&hdev->pdev->dev, "VF %u keep alive resume!", + vport->vport_id - HCLGE_VF_VPORT_START_NUM); + + /* if vf support push link, need to push link status after keep + * alive restore, because the vf will not fetch the link status + * of it's own. + */ + ret = hclge_push_vf_link_status(vport); + if (ret) { + dev_err(&hdev->pdev->dev, + "failed to push link status to vf%u, ret=%d\n", + vport->vport_id - HCLGE_VF_VPORT_START_NUM, + ret); + } + } } static int hclge_set_vf_mtu(struct hclge_vport *vport, -- 2.25.1

1 1

[PATCH openEuler-5.10 01/16] blk-mq: fix io hung due to missing commit_rqs
by Zheng Zengkai 21 Sep '22

21 Sep '22

From: Yu Kuai <yukuai3(a)huawei.com> hulk inclusion category: bugfix bugzilla: 186851, https://gitee.com/openeuler/kernel/issues/I5L01G CVE: NA -------------------------------- Currently, in virtio_scsi, if 'bd->last' is not set to true while dispatching request, such io will stay in driver's queue, and driver will wait for block layer to dispatch more rqs. However, if block layer failed to dispatch more rq, it should trigger commit_rqs to inform driver. There is a problem in blk_mq_try_issue_list_directly() that commit_rqs won't be called: // assume that queue_depth is set to 1, list contains two rq blk_mq_try_issue_list_directly blk_mq_request_issue_directly // dispatch first rq // last is false __blk_mq_try_issue_directly blk_mq_get_dispatch_budget // succeed to get first budget __blk_mq_issue_directly scsi_queue_rq cmd->flags |= SCMD_LAST virtscsi_queuecommand kick = (sc->flags & SCMD_LAST) != 0 // kick is false, first rq won't issue to disk queued++ blk_mq_request_issue_directly // dispatch second rq __blk_mq_try_issue_directly blk_mq_get_dispatch_budget // failed to get second budget ret == BLK_STS_RESOURCE blk_mq_request_bypass_insert // errors is still 0 if (!list_empty(list) || errors && ...) // won't pass, commit_rqs won't be called In this situation, first rq relied on second rq to dispatch, while second rq relied on first rq to complete, thus they will both hung. Fix the problem by also treat 'BLK_STS_*RESOURCE' as 'errors' since it means that request is not queued successfully. Same problem exists in blk_mq_dispatch_rq_list(), 'BLK_STS_*RESOURCE' can't be treated as 'errors' here, fix the problem by calling commit_rqs if queue_rq return 'BLK_STS_*RESOURCE'. Fixes: d666ba98f849 ("blk-mq: add mq_ops->commit_rqs()") Signed-off-by: Yu Kuai <yukuai3(a)huawei.com> Link: https://lore.kernel.org/all/20220726122224.1790882-1-yukuai1@huaweicloud.co… Reviewed-by: Ming Lei <ming.lei(a)redhat.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/blk-mq.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/block/blk-mq.c b/block/blk-mq.c index 1941ffc4db85..b9827b3d3f63 100644 --- a/block/blk-mq.c +++ b/block/blk-mq.c @@ -1484,7 +1484,8 @@ bool blk_mq_dispatch_rq_list(struct blk_mq_hw_ctx *hctx, struct list_head *list, /* If we didn't flush the entire list, we could have told the driver * there was more coming, but that turned out to be a lie. */ - if ((!list_empty(list) || errors) && q->mq_ops->commit_rqs && queued) + if ((!list_empty(list) || errors || needs_resource || + ret == BLK_STS_DEV_RESOURCE) && q->mq_ops->commit_rqs && queued) q->mq_ops->commit_rqs(hctx); /* * Any items that need requeuing? Stuff them into hctx->dispatch, @@ -2224,6 +2225,7 @@ void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx, list_del_init(&rq->queuelist); ret = blk_mq_request_issue_directly(rq, list_empty(list)); if (ret != BLK_STS_OK) { + errors++; if (ret == BLK_STS_RESOURCE || ret == BLK_STS_DEV_RESOURCE) { blk_mq_request_bypass_insert(rq, false, @@ -2231,7 +2233,6 @@ void blk_mq_try_issue_list_directly(struct blk_mq_hw_ctx *hctx, break; } blk_mq_end_request(rq, ret); - errors++; } else queued++; } -- 2.20.1

1 15

[PATCH openEuler-22.09 v2] bpf:programmable: Fix build error of 'stack exceeds 512 bytes'
by Zheng Zengkai 21 Sep '22

21 Sep '22

From: Hui Tang <tanghui20(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5RMFU CVE: NA -------------------------------- 1.Change arg type of 'bpf_get_cpumask_info' to avoid bpf program stack exceeds 512 bytes. 2.Fix back-edge error in sample 'sched_select_core' 3.Fix loop too complex in sample 'sached_select_core' Changes in v2: Move cpu initialization out of the for loop. Fixes: 1bf0417b95a9 ("sched: programmable: Add helper function for cpu topo...") Fixes: 2c1189e32bf9 ("samples:bpf: Add samples for cfs select core") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- include/uapi/linux/bpf.h | 2 +- kernel/sched/bpf_topology.c | 9 ++- samples/bpf/sched_select_core_kern.c | 32 ++++++++--- tools/include/uapi/linux/bpf.h | 2 +- tools/lib/bpf/libbpf_sched.h | 86 +++++++++++++++++++++------- 5 files changed, 96 insertions(+), 35 deletions(-) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index db585d960d64..7e474c6fc4a7 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -3903,7 +3903,7 @@ union bpf_attr { * Return * 0 on success, or a negative error in case of failure. * - * int bpf_get_cpumask_info(struct bpf_cpumask_info *cpus, int len) + * int bpf_get_cpumask_info(struct bpf_map *map, struct bpf_cpumask_info *cpus) * Description * Get system cpus returned in *cpus*. * Return diff --git a/kernel/sched/bpf_topology.c b/kernel/sched/bpf_topology.c index 9c2eda139e2a..843b6092a64f 100644 --- a/kernel/sched/bpf_topology.c +++ b/kernel/sched/bpf_topology.c @@ -70,10 +70,9 @@ const struct bpf_func_proto bpf_init_cpu_topology_proto = { .arg2_type = ARG_ANYTHING, }; -BPF_CALL_2(bpf_get_cpumask_info, struct bpf_cpumask_info *, cpus, - int, len) +BPF_CALL_2(bpf_get_cpumask_info, struct bpf_map *, map, struct bpf_cpumask_info *, cpus) { - if (len != sizeof(*cpus)) + if (!cpus) return -EINVAL; cpumask_copy(&cpus->cpu_possible_cpumask, cpu_possible_mask); @@ -92,6 +91,6 @@ const struct bpf_func_proto bpf_get_cpumask_info_proto = { .func = bpf_get_cpumask_info, .gpl_only = false, .ret_type = RET_INTEGER, - .arg1_type = ARG_PTR_TO_UNINIT_MEM, - .arg2_type = ARG_CONST_SIZE, + .arg1_type = ARG_CONST_MAP_PTR, + .arg2_type = ARG_PTR_TO_MAP_VALUE_OR_NULL, }; diff --git a/samples/bpf/sched_select_core_kern.c b/samples/bpf/sched_select_core_kern.c index 18617e89b395..30765ae65f85 100644 --- a/samples/bpf/sched_select_core_kern.c +++ b/samples/bpf/sched_select_core_kern.c @@ -62,7 +62,7 @@ struct tag_info { struct tag_info tag_tbl[] = { {TAG_NONE, ""}, - {TAG_ID(1), "0-3"}, + {TAG_ID(1), "0-1"}, {TAG_ID(2), "4-7"}, {TAG_MAX, ""}, }; @@ -94,13 +94,17 @@ static struct cpumask *select_better_cpus(struct task_struct *p, long min_util = INT_MIN; struct task_group *tg; long spare; - int cpu; + int cpu, i; if (!prefer_cpus_valid(prefer_cpus, (void *)getVal(p->cpus_ptr))) return (void *)getVal(p->cpus_ptr); tg = p->sched_task_group; - libbpf_for_each_cpu(cpu, prefer_cpus) { + for (i = 0, cpu = -1; i < BPF_SCHED_LOOP_MAX; i++) { + cpu = libbpf_cpumask_next(cpu, (void *)getVal(prefer_cpus)); + if (cpu >= libbpf_nr_cpus_ids()) + break; + if (idlest_cpu && libbpf_available_idle_cpu(cpu)) { *idlest_cpu = cpu; } else if (idlest_cpu) { @@ -159,9 +163,14 @@ int BPF_PROG(cfs_select_cpu_range, struct sched_migrate_ctx *h_ctx) SEC("sched/cfs_select_rq_exit") int BPF_PROG(cfs_select_cpu_range_exit, struct sched_migrate_ctx *h_ctx) { + struct task_struct *p = getVal(h_ctx->task); + long tag = getVal(p->tag); int *idlest_cpu; int key = 0; + if (tag <= TAG_NONE || tag >= TAG_MAX) + return SELECT_RQ_EXIT_CPU_VALID; + idlest_cpu = bpf_map_lookup_elem(&map_idlest_cpu, &key); if (!idlest_cpu) { libbpf_sched_set_task_cpus_ptr(h_ctx, (void *)getVal(h_ctx->cpus_allowed)); @@ -186,7 +195,7 @@ static int find_idlest_cpu(struct task_struct *p, int parent) int cpu; int i; - for (i = 0, cpu = -1; i < NR_CPUS; i++) { + for (i = 0, cpu = -1; i < BPF_SCHED_LOOP_MAX; i++) { cpu = libbpf_cpumask_next(cpu, (void *)getVal(p->cpus_ptr)); if (cpu >= libbpf_nr_cpus_ids()) break; @@ -203,17 +212,26 @@ static int find_idlest_cpu(struct task_struct *p, int parent) static int select_idle_cpu(struct task_struct *p, int parent, int prev_cpu) { - int cpu; + int cpu, i; if (libbpf_available_idle_cpu(prev_cpu)) return prev_cpu; if (libbpf_available_idle_cpu(parent)) - return prev_cpu; + return parent; + + cpu = libbpf_cpumask_next_wrap(prev_cpu - 1, + (void *)getVal(p->cpus_ptr), + prev_cpu, false); + for (i = 0; i < BPF_SCHED_LOOP_MAX; i++) { + if (cpu >= libbpf_nr_cpumask_bits()) + break; - libbpf_for_each_cpu_wrap(cpu, (void *)getVal(p->cpus_ptr), prev_cpu) { if (libbpf_available_idle_cpu(cpu)) return cpu; + + cpu = libbpf_cpumask_next_wrap(cpu, (void *)getVal(p->cpus_ptr), + prev_cpu, true); } return prev_cpu; diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 57b927e99092..22f7880a0bb6 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -4613,7 +4613,7 @@ union bpf_attr { * Return * 0 on success, or a negative error in case of failure. * - * int bpf_get_cpumask_info(struct bpf_cpumask_info *cpus, int len) + * int bpf_get_cpumask_info(struct bpf_map *map, struct bpf_cpumask_info *cpus) * Description * Get system cpus returned in *cpus*. * Return diff --git a/tools/lib/bpf/libbpf_sched.h b/tools/lib/bpf/libbpf_sched.h index 6cb30e8e81f8..187e854b99b3 100644 --- a/tools/lib/bpf/libbpf_sched.h +++ b/tools/lib/bpf/libbpf_sched.h @@ -21,6 +21,8 @@ #include <bpf/bpf_helpers.h> #include <bpf/bpf_tracing.h> +/* set bigger value may lead verifier failed */ +#define BPF_SCHED_LOOP_MAX 1024 #define INVALID_PTR ((void *)(0UL)) #define getVal(P) \ ({ \ @@ -69,6 +71,13 @@ static __always_inline int libbpf_nr_cpumask_bits(void); #endif +struct { + __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); + __type(key, u32); + __type(value, struct bpf_cpumask_info); + __uint(max_entries, 1); +} map_cpumask_info SEC(".maps"); + static __always_inline long libbpf_cpumask_copy(struct cpumask *dst, struct cpumask *src) { @@ -228,58 +237,93 @@ static __always_inline long libbpf_cpumask_cpulist_parse(char *src1, static __always_inline int libbpf_num_active_cpus(void) { - struct bpf_cpumask_info cpus; + struct bpf_cpumask_info *cpus; + int key = 0; + + cpus = bpf_map_lookup_elem(&map_cpumask_info, &key); + if (!cpus) + return -1; - bpf_get_cpumask_info(&cpus, sizeof(cpus)); - return getVal(cpus.nums_active_cpus); + bpf_get_cpumask_info(&map_cpumask_info, cpus); + return getVal(cpus->nums_active_cpus); } static __always_inline int libbpf_num_possible_cpus(void) { - struct bpf_cpumask_info cpus; + struct bpf_cpumask_info *cpus; + int key = 0; - bpf_get_cpumask_info(&cpus, sizeof(cpus)); - return getVal(cpus.nums_possible_cpus); + cpus = bpf_map_lookup_elem(&map_cpumask_info, &key); + if (!cpus) + return -1; + + bpf_get_cpumask_info(&map_cpumask_info, cpus); + return getVal(cpus->nums_possible_cpus); } static __always_inline void libbpf_possible_cpus_mask(struct cpumask *mask) { - struct bpf_cpumask_info cpus; + struct bpf_cpumask_info *cpus; + int key = 0; + + cpus = bpf_map_lookup_elem(&map_cpumask_info, &key); + if (!cpus) + return; - bpf_get_cpumask_info(&cpus, sizeof(cpus)); - libbpf_cpumask_copy(mask, &cpus.cpu_possible_cpumask); + bpf_get_cpumask_info(&map_cpumask_info, cpus); + libbpf_cpumask_copy(mask, &cpus->cpu_possible_cpumask); } static __always_inline void libbpf_active_cpus_mask(struct cpumask *mask) { - struct bpf_cpumask_info cpus; + struct bpf_cpumask_info *cpus; + int key = 0; - bpf_get_cpumask_info(&cpus, sizeof(cpus)); - libbpf_cpumask_copy(mask, &cpus.cpu_active_cpumask); + cpus = bpf_map_lookup_elem(&map_cpumask_info, &key); + if (!cpus) + return; + + bpf_get_cpumask_info(&map_cpumask_info, cpus); + libbpf_cpumask_copy(mask, &cpus->cpu_active_cpumask); } static __always_inline void libbpf_isolate_cpus_mask(struct cpumask *mask) { - struct bpf_cpumask_info cpus; + struct bpf_cpumask_info *cpus; + int key = 0; + + cpus = bpf_map_lookup_elem(&map_cpumask_info, &key); + if (!cpus) + return; - bpf_get_cpumask_info(&cpus, sizeof(cpus)); - libbpf_cpumask_copy(mask, &cpus.cpu_isolate_cpumask); + bpf_get_cpumask_info(&map_cpumask_info, cpus); + libbpf_cpumask_copy(mask, &cpus->cpu_isolate_cpumask); } static __always_inline int libbpf_nr_cpus_ids(void) { - struct bpf_cpumask_info cpus; + struct bpf_cpumask_info *cpus; + int key = 0; - bpf_get_cpumask_info(&cpus, sizeof(cpus)); - return getVal(cpus.nr_cpu_ids); + cpus = bpf_map_lookup_elem(&map_cpumask_info, &key); + if (!cpus) + return -1; + + bpf_get_cpumask_info(&map_cpumask_info, cpus); + return getVal(cpus->nr_cpu_ids); } static __always_inline int libbpf_nr_cpumask_bits(void) { - struct bpf_cpumask_info cpus; + struct bpf_cpumask_info *cpus; + int key = 0; + + cpus = bpf_map_lookup_elem(&map_cpumask_info, &key); + if (!cpus) + return -1; - bpf_get_cpumask_info(&cpus, sizeof(cpus)); - return getVal(cpus.bpf_nr_cpumask_bits); + bpf_get_cpumask_info(&map_cpumask_info, cpus); + return getVal(cpus->bpf_nr_cpumask_bits); } static __always_inline unsigned long libbpf_cfs_load_avg_of(int cpu) -- 2.20.1

1 0

[PATCH openEuler-5.10-LTS 01/18] x86/speculation: Add RSB VM Exit protections
by Zheng Zengkai 20 Sep '22

20 Sep '22

From: Daniel Sneddon <daniel.sneddon(a)linux.intel.com> stable inclusion from stable-v5.10.136 commit 509c2c9fe75ea7493eebbb6bb2f711f37530ae19 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5N1SO CVE: CVE-2022-26373 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 2b1299322016731d56807aa49254a5ea3080b6b3 upstream. tl;dr: The Enhanced IBRS mitigation for Spectre v2 does not work as documented for RET instructions after VM exits. Mitigate it with a new one-entry RSB stuffing mechanism and a new LFENCE. == Background == Indirect Branch Restricted Speculation (IBRS) was designed to help mitigate Branch Target Injection and Speculative Store Bypass, i.e. Spectre, attacks. IBRS prevents software run in less privileged modes from affecting branch prediction in more privileged modes. IBRS requires the MSR to be written on every privilege level change. To overcome some of the performance issues of IBRS, Enhanced IBRS was introduced. eIBRS is an "always on" IBRS, in other words, just turn it on once instead of writing the MSR on every privilege level change. When eIBRS is enabled, more privileged modes should be protected from less privileged modes, including protecting VMMs from guests. == Problem == Here's a simplification of how guests are run on Linux' KVM: void run_kvm_guest(void) { // Prepare to run guest VMRESUME(); // Clean up after guest runs } The execution flow for that would look something like this to the processor: 1. Host-side: call run_kvm_guest() 2. Host-side: VMRESUME 3. Guest runs, does "CALL guest_function" 4. VM exit, host runs again 5. Host might make some "cleanup" function calls 6. Host-side: RET from run_kvm_guest() Now, when back on the host, there are a couple of possible scenarios of post-guest activity the host needs to do before executing host code: * on pre-eIBRS hardware (legacy IBRS, or nothing at all), the RSB is not touched and Linux has to do a 32-entry stuffing. * on eIBRS hardware, VM exit with IBRS enabled, or restoring the host IBRS=1 shortly after VM exit, has a documented side effect of flushing the RSB except in this PBRSB situation where the software needs to stuff the last RSB entry "by hand". IOW, with eIBRS supported, host RET instructions should no longer be influenced by guest behavior after the host retires a single CALL instruction. However, if the RET instructions are "unbalanced" with CALLs after a VM exit as is the RET in #6, it might speculatively use the address for the instruction after the CALL in #3 as an RSB prediction. This is a problem since the (untrusted) guest controls this address. Balanced CALL/RET instruction pairs such as in step #5 are not affected. == Solution == The PBRSB issue affects a wide variety of Intel processors which support eIBRS. But not all of them need mitigation. Today, X86_FEATURE_RSB_VMEXIT triggers an RSB filling sequence that mitigates PBRSB. Systems setting RSB_VMEXIT need no further mitigation - i.e., eIBRS systems which enable legacy IBRS explicitly. However, such systems (X86_FEATURE_IBRS_ENHANCED) do not set RSB_VMEXIT and most of them need a new mitigation. Therefore, introduce a new feature flag X86_FEATURE_RSB_VMEXIT_LITE which triggers a lighter-weight PBRSB mitigation versus RSB_VMEXIT. The lighter-weight mitigation performs a CALL instruction which is immediately followed by a speculative execution barrier (INT3). This steers speculative execution to the barrier -- just like a retpoline -- which ensures that speculation can never reach an unbalanced RET. Then, ensure this CALL is retired before continuing execution with an LFENCE. In other words, the window of exposure is opened at VM exit where RET behavior is troublesome. While the window is open, force RSB predictions sampling for RET targets to a dead end at the INT3. Close the window with the LFENCE. There is a subset of eIBRS systems which are not vulnerable to PBRSB. Add these systems to the cpu_vuln_whitelist[] as NO_EIBRS_PBRSB. Future systems that aren't vulnerable will set ARCH_CAP_PBRSB_NO. [ bp: Massage, incorporate review comments from Andy Cooper. ] Signed-off-by: Daniel Sneddon <daniel.sneddon(a)linux.intel.com> Co-developed-by: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> Signed-off-by: Pawan Gupta <pawan.kumar.gupta(a)linux.intel.com> Signed-off-by: Borislav Petkov <bp(a)suse.de> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> conflict: arch/x86/include/asm/cpufeatures.h Signed-off-by: Chen Jiahao <chenjiahao16(a)huawei.com> Reviewed-by: Zhang Jianhua <chris.zjh(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- Documentation/admin-guide/hw-vuln/spectre.rst | 8 ++ arch/x86/include/asm/cpufeatures.h | 2 + arch/x86/include/asm/msr-index.h | 4 + arch/x86/include/asm/nospec-branch.h | 17 +++- arch/x86/kernel/cpu/bugs.c | 86 ++++++++++++++----- arch/x86/kernel/cpu/common.c | 12 ++- arch/x86/kvm/vmx/vmenter.S | 8 +- tools/arch/x86/include/asm/cpufeatures.h | 1 + tools/arch/x86/include/asm/msr-index.h | 4 + 9 files changed, 113 insertions(+), 29 deletions(-) diff --git a/Documentation/admin-guide/hw-vuln/spectre.rst b/Documentation/admin-guide/hw-vuln/spectre.rst index 6bd97cd50d62..7e061ed449aa 100644 --- a/Documentation/admin-guide/hw-vuln/spectre.rst +++ b/Documentation/admin-guide/hw-vuln/spectre.rst @@ -422,6 +422,14 @@ The possible values in this file are: 'RSB filling' Protection of RSB on context switch enabled ============= =========================================== + - EIBRS Post-barrier Return Stack Buffer (PBRSB) protection status: + + =========================== ======================================================= + 'PBRSB-eIBRS: SW sequence' CPU is affected and protection of RSB on VMEXIT enabled + 'PBRSB-eIBRS: Vulnerable' CPU is vulnerable + 'PBRSB-eIBRS: Not affected' CPU is not affected by PBRSB + =========================== ======================================================= + Full mitigation might require a microcode update from the CPU vendor. When the necessary microcode is not available, the kernel will report vulnerability. diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h index bf531e883e82..b5852d41d9b9 100644 --- a/arch/x86/include/asm/cpufeatures.h +++ b/arch/x86/include/asm/cpufeatures.h @@ -297,6 +297,7 @@ #define X86_FEATURE_RETPOLINE_LFENCE (11*32+13) /* "" Use LFENCE for Spectre variant 2 */ #define X86_FEATURE_RETHUNK (11*32+14) /* "" Use REturn THUNK */ #define X86_FEATURE_UNRET (11*32+15) /* "" AMD BTB untrain return */ +#define X86_FEATURE_RSB_VMEXIT_LITE (11*32+17) /* "" Fill RSB on VM exit when EIBRS is enabled */ /* Intel-defined CPU features, CPUID level 0x00000007:1 (EAX), word 12 */ #define X86_FEATURE_AVX512_BF16 (12*32+ 5) /* AVX512 BFLOAT16 instructions */ @@ -428,5 +429,6 @@ #define X86_BUG_SRBDS X86_BUG(24) /* CPU may leak RNG bits if not mitigated */ #define X86_BUG_MMIO_STALE_DATA X86_BUG(25) /* CPU is affected by Processor MMIO Stale Data vulnerabilities */ #define X86_BUG_RETBLEED X86_BUG(26) /* CPU is affected by RETBleed */ +#define X86_BUG_EIBRS_PBRSB X86_BUG(27) /* EIBRS is vulnerable to Post Barrier RSB Predictions */ #endif /* _ASM_X86_CPUFEATURES_H */ diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h index ffc09df04d41..d9c352e76850 100644 --- a/arch/x86/include/asm/msr-index.h +++ b/arch/x86/include/asm/msr-index.h @@ -148,6 +148,10 @@ * are restricted to targets in * kernel. */ +#define ARCH_CAP_PBRSB_NO BIT(24) /* + * Not susceptible to Post-Barrier + * Return Stack Buffer Predictions. + */ #define MSR_IA32_FLUSH_CMD 0x0000010b #define L1D_FLUSH BIT(0) /* diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h index 32e25cac72b2..3c615488b740 100644 --- a/arch/x86/include/asm/nospec-branch.h +++ b/arch/x86/include/asm/nospec-branch.h @@ -118,13 +118,28 @@ #endif .endm +.macro ISSUE_UNBALANCED_RET_GUARD + ANNOTATE_INTRA_FUNCTION_CALL + call .Lunbalanced_ret_guard_\@ + int3 +.Lunbalanced_ret_guard_\@: + add $(BITS_PER_LONG/8), %_ASM_SP + lfence +.endm + /* * A simpler FILL_RETURN_BUFFER macro. Don't make people use the CPP * monstrosity above, manually. */ -.macro FILL_RETURN_BUFFER reg:req nr:req ftr:req +.macro FILL_RETURN_BUFFER reg:req nr:req ftr:req ftr2 +.ifb \ftr2 ALTERNATIVE "jmp .Lskip_rsb_\@", "", \ftr +.else + ALTERNATIVE_2 "jmp .Lskip_rsb_\@", "", \ftr, "jmp .Lunbalanced_\@", \ftr2 +.endif __FILL_RETURN_BUFFER(\reg,\nr,%_ASM_SP) +.Lunbalanced_\@: + ISSUE_UNBALANCED_RET_GUARD .Lskip_rsb_\@: .endm diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c index bc6382f5ec27..d4cb9ff639aa 100644 --- a/arch/x86/kernel/cpu/bugs.c +++ b/arch/x86/kernel/cpu/bugs.c @@ -1290,6 +1290,53 @@ static void __init spec_ctrl_disable_kernel_rrsba(void) } } +static void __init spectre_v2_determine_rsb_fill_type_at_vmexit(enum spectre_v2_mitigation mode) +{ + /* + * Similar to context switches, there are two types of RSB attacks + * after VM exit: + * + * 1) RSB underflow + * + * 2) Poisoned RSB entry + * + * When retpoline is enabled, both are mitigated by filling/clearing + * the RSB. + * + * When IBRS is enabled, while #1 would be mitigated by the IBRS branch + * prediction isolation protections, RSB still needs to be cleared + * because of #2. Note that SMEP provides no protection here, unlike + * user-space-poisoned RSB entries. + * + * eIBRS should protect against RSB poisoning, but if the EIBRS_PBRSB + * bug is present then a LITE version of RSB protection is required, + * just a single call needs to retire before a RET is executed. + */ + switch (mode) { + case SPECTRE_V2_NONE: + return; + + case SPECTRE_V2_EIBRS_LFENCE: + case SPECTRE_V2_EIBRS: + if (boot_cpu_has_bug(X86_BUG_EIBRS_PBRSB)) { + setup_force_cpu_cap(X86_FEATURE_RSB_VMEXIT_LITE); + pr_info("Spectre v2 / PBRSB-eIBRS: Retire a single CALL on VMEXIT\n"); + } + return; + + case SPECTRE_V2_EIBRS_RETPOLINE: + case SPECTRE_V2_RETPOLINE: + case SPECTRE_V2_LFENCE: + case SPECTRE_V2_IBRS: + setup_force_cpu_cap(X86_FEATURE_RSB_VMEXIT); + pr_info("Spectre v2 / SpectreRSB : Filling RSB on VMEXIT\n"); + return; + } + + pr_warn_once("Unknown Spectre v2 mode, disabling RSB mitigation at VM exit"); + dump_stack(); +} + static void __init spectre_v2_select_mitigation(void) { enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline(); @@ -1438,28 +1485,7 @@ static void __init spectre_v2_select_mitigation(void) setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW); pr_info("Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch\n"); - /* - * Similar to context switches, there are two types of RSB attacks - * after vmexit: - * - * 1) RSB underflow - * - * 2) Poisoned RSB entry - * - * When retpoline is enabled, both are mitigated by filling/clearing - * the RSB. - * - * When IBRS is enabled, while #1 would be mitigated by the IBRS branch - * prediction isolation protections, RSB still needs to be cleared - * because of #2. Note that SMEP provides no protection here, unlike - * user-space-poisoned RSB entries. - * - * eIBRS, on the other hand, has RSB-poisoning protections, so it - * doesn't need RSB clearing after vmexit. - */ - if (boot_cpu_has(X86_FEATURE_RETPOLINE) || - boot_cpu_has(X86_FEATURE_KERNEL_IBRS)) - setup_force_cpu_cap(X86_FEATURE_RSB_VMEXIT); + spectre_v2_determine_rsb_fill_type_at_vmexit(mode); /* * Retpoline protects the kernel, but doesn't protect firmware. IBRS @@ -2202,6 +2228,19 @@ static char *ibpb_state(void) return ""; } +static char *pbrsb_eibrs_state(void) +{ + if (boot_cpu_has_bug(X86_BUG_EIBRS_PBRSB)) { + if (boot_cpu_has(X86_FEATURE_RSB_VMEXIT_LITE) || + boot_cpu_has(X86_FEATURE_RSB_VMEXIT)) + return ", PBRSB-eIBRS: SW sequence"; + else + return ", PBRSB-eIBRS: Vulnerable"; + } else { + return ", PBRSB-eIBRS: Not affected"; + } +} + static ssize_t spectre_v2_show_state(char *buf) { if (spectre_v2_enabled == SPECTRE_V2_LFENCE) @@ -2214,12 +2253,13 @@ static ssize_t spectre_v2_show_state(char *buf) spectre_v2_enabled == SPECTRE_V2_EIBRS_LFENCE) return sprintf(buf, "Vulnerable: eIBRS+LFENCE with unprivileged eBPF and SMT\n"); - return sprintf(buf, "%s%s%s%s%s%s\n", + return sprintf(buf, "%s%s%s%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled], ibpb_state(), boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "", stibp_state(), boot_cpu_has(X86_FEATURE_RSB_CTXSW) ? ", RSB filling" : "", + pbrsb_eibrs_state(), spectre_v2_module_string()); } diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c index 901352bd3b42..9fc91482e85e 100644 --- a/arch/x86/kernel/cpu/common.c +++ b/arch/x86/kernel/cpu/common.c @@ -1024,6 +1024,7 @@ static void identify_cpu_without_cpuid(struct cpuinfo_x86 *c) #define NO_SWAPGS BIT(6) #define NO_ITLB_MULTIHIT BIT(7) #define NO_SPECTRE_V2 BIT(8) +#define NO_EIBRS_PBRSB BIT(9) #define VULNWL(vendor, family, model, whitelist) \ X86_MATCH_VENDOR_FAM_MODEL(vendor, family, model, whitelist) @@ -1064,7 +1065,7 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = { VULNWL_INTEL(ATOM_GOLDMONT, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT), VULNWL_INTEL(ATOM_GOLDMONT_D, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT), - VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT), + VULNWL_INTEL(ATOM_GOLDMONT_PLUS, NO_MDS | NO_L1TF | NO_SWAPGS | NO_ITLB_MULTIHIT | NO_EIBRS_PBRSB), /* * Technically, swapgs isn't serializing on AMD (despite it previously @@ -1074,7 +1075,9 @@ static const __initconst struct x86_cpu_id cpu_vuln_whitelist[] = { * good enough for our purposes. */ - VULNWL_INTEL(ATOM_TREMONT_D, NO_ITLB_MULTIHIT), + VULNWL_INTEL(ATOM_TREMONT, NO_EIBRS_PBRSB), + VULNWL_INTEL(ATOM_TREMONT_L, NO_EIBRS_PBRSB), + VULNWL_INTEL(ATOM_TREMONT_D, NO_ITLB_MULTIHIT | NO_EIBRS_PBRSB), /* AMD Family 0xf - 0x12 */ VULNWL_AMD(0x0f, NO_MELTDOWN | NO_SSB | NO_L1TF | NO_MDS | NO_SWAPGS | NO_ITLB_MULTIHIT), @@ -1252,6 +1255,11 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) setup_force_cpu_bug(X86_BUG_RETBLEED); } + if (cpu_has(c, X86_FEATURE_IBRS_ENHANCED) && + !cpu_matches(cpu_vuln_whitelist, NO_EIBRS_PBRSB) && + !(ia32_cap & ARCH_CAP_PBRSB_NO)) + setup_force_cpu_bug(X86_BUG_EIBRS_PBRSB); + if (cpu_matches(cpu_vuln_whitelist, NO_MELTDOWN)) return; diff --git a/arch/x86/kvm/vmx/vmenter.S b/arch/x86/kvm/vmx/vmenter.S index 857fa0fc49fa..982138bebb70 100644 --- a/arch/x86/kvm/vmx/vmenter.S +++ b/arch/x86/kvm/vmx/vmenter.S @@ -197,11 +197,13 @@ SYM_INNER_LABEL(vmx_vmexit, SYM_L_GLOBAL) * entries and (in some cases) RSB underflow. * * eIBRS has its own protection against poisoned RSB, so it doesn't - * need the RSB filling sequence. But it does need to be enabled - * before the first unbalanced RET. + * need the RSB filling sequence. But it does need to be enabled, and a + * single call to retire, before the first unbalanced RET. */ - FILL_RETURN_BUFFER %_ASM_CX, RSB_CLEAR_LOOPS, X86_FEATURE_RSB_VMEXIT + FILL_RETURN_BUFFER %_ASM_CX, RSB_CLEAR_LOOPS, X86_FEATURE_RSB_VMEXIT,\ + X86_FEATURE_RSB_VMEXIT_LITE + pop %_ASM_ARG2 /* @flags */ pop %_ASM_ARG1 /* @vmx */ diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h index 54ba20492ad1..ec53f52a06a5 100644 --- a/tools/arch/x86/include/asm/cpufeatures.h +++ b/tools/arch/x86/include/asm/cpufeatures.h @@ -296,6 +296,7 @@ #define X86_FEATURE_RETPOLINE_LFENCE (11*32+13) /* "" Use LFENCE for Spectre variant 2 */ #define X86_FEATURE_RETHUNK (11*32+14) /* "" Use REturn THUNK */ #define X86_FEATURE_UNRET (11*32+15) /* "" AMD BTB untrain return */ +#define X86_FEATURE_RSB_VMEXIT_LITE (11*32+17) /* "" Fill RSB on VM-Exit when EIBRS is enabled */ /* Intel-defined CPU features, CPUID level 0x00000007:1 (EAX), word 12 */ #define X86_FEATURE_AVX512_BF16 (12*32+ 5) /* AVX512 BFLOAT16 instructions */ diff --git a/tools/arch/x86/include/asm/msr-index.h b/tools/arch/x86/include/asm/msr-index.h index 53373ca3b487..b8954262d767 100644 --- a/tools/arch/x86/include/asm/msr-index.h +++ b/tools/arch/x86/include/asm/msr-index.h @@ -148,6 +148,10 @@ * are restricted to targets in * kernel. */ +#define ARCH_CAP_PBRSB_NO BIT(24) /* + * Not susceptible to Post-Barrier + * Return Stack Buffer Predictions. + */ #define MSR_IA32_FLUSH_CMD 0x0000010b #define L1D_FLUSH BIT(0) /* -- 2.20.1

1 17

[PATCH openEuler-1.0-LTS 0/2] fix the i40e crash problem
by tangbin 20 Sep '22

20 Sep '22

The two patches solve the crash of i40e Ivan Vecera (1): i40e: Fix kernel crash during module removal Yunjian Wang (1): i40e: Fix use-after-free in i40e_client_subtask() drivers/net/ethernet/intel/i40e/i40e_client.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) -- 2.18.4

1 2

[PATCH openEuler-5.10 000/139] Add patches for CVE-2022-29900,
by Zheng Zengkai 20 Sep '22

20 Sep '22

Patches for CVE-2022-29900, CVE-2022-23816 and CVE-2022-29901 Reference: https://lore.kernel.org/all/CAODzB9qH9WhxQ0eB+mNvmsn64bHXUVppuSTMDGJekYOPCw… https://www.amd.com/system/files/documents/technical-guidance-for-mitigatin… https://www.intel.com/content/www/us/en/developer/articles/technical/softwa… Alexandre Chartre (2): x86/bugs: Report AMD retbleed vulnerability x86/bugs: Add AMD retbleed= boot parameter Andrew Cooper (1): x86/cpu/amd: Enumerate BTC_NO Arnaldo Carvalho de Melo (5): tools arch: Update arch/x86/lib/mem{cpy,set}_64.S copies used in 'perf bench mem memcpy' tools arch x86: Sync the msr-index.h copy with the kernel sources tools headers cpufeatures: Sync with the kernel sources tools arch: Update arch/x86/lib/mem{cpy,set}_64.S copies used in 'perf bench mem memcpy' - again tools headers: Remove broken definition of __LITTLE_ENDIAN Ben Hutchings (3): x86: Add insn_decode_kernel() Makefile: Set retpoline cflags based on CONFIG_CC_IS_{CLANG,GCC} x86/xen: Fix initialisation in hypercall_page after rethunk Borislav Petkov (7): x86/insn: Rename insn_decode() to insn_decode_from_regs() x86/insn: Add a __ignore_sync_check__ marker x86/insn: Add an insn_decode() API x86/alternative: Use insn_decode() x86/alternative: Optimize single-byte NOPs at an arbitrary position kvm/emulate: Fix SETcc emulation function offsets with SLS tools/insn: Restore the relative include paths for cross building Greg Kroah-Hartman (1): x86, kvm: use proper ASM macros for kvm_vcpu_is_preempted Joe Lawrence (1): objtool: Make .altinstructions section entry size consistent Josh Poimboeuf (24): objtool: Refactor ORC section generation objtool: Add 'alt_group' struct objtool: Support stack layout changes in alternatives objtool: Support retpoline jump detection for vmlinux.o objtool: Assume only ELF functions do sibling calls objtool: Combine UNWIND_HINT_RET_OFFSET and UNWIND_HINT_FUNC x86/xen: Support objtool validation in xen-asm.S x86/xen: Support objtool vmlinux.o validation in xen-head.S objtool: Support asm jump tables objtool: Don't make .altinstructions writable objtool: Remove reloc symbol type checks in get_alt_entry() x86/bugs: Do IBPB fallback check only once x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n x86/speculation: Fix firmware entry SPEC_CTRL handling x86/speculation: Fix SPEC_CTRL write on SMT state change x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit x86/speculation: Remove x86_spec_ctrl_mask objtool: Re-add UNWIND_HINT_{SAVE_RESTORE} KVM: VMX: Flatten __vmx_vcpu_run() KVM: VMX: Convert launched argument to flags KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS KVM: VMX: Fix IBRS handling after vmexit x86/speculation: Fill RSB on vmexit for IBRS x86/ftrace: Add UNWIND_HINT_FUNC annotation for ftrace_stub Juergen Gross (4): x86/alternative: Merge include files x86/alternative: Support not-feature x86/alternative: Support ALTERNATIVE_TERNARY x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has() Kim Phillips (3): x86/sev: Avoid using __x86_return_thunk x86/bugs: Enable STIBP for JMP2RET x86/bugs: Remove apostrophe typo Konrad Rzeszutek Wilk (1): x86/kexec: Disable RET on kexec Lin Yujun (2): x86: Fix objtool build warning Re-add padlen to the structure alt_instr Linus Torvalds (2): objtool: print out the symbol type when complaining about it kvm: fix objtool relocation warning Nathan Chancellor (1): x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current Pawan Gupta (3): x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS x86/bugs: Add Cannon lake to RETBleed affected CPU list x86/speculation: Disable RRSBA behavior Peter Zijlstra (70): x86/alternatives: Optimize optimize_nops() x86/retpoline: Simplify retpolines objtool: Correctly handle retpoline thunk calls objtool: Handle per arch retpoline naming objtool: Rework the elf_rebuild_reloc_section() logic objtool: Add elf_create_reloc() helper objtool: Create reloc sections implicitly objtool: Extract elf_strtab_concat() objtool: Extract elf_symbol_add() objtool: Add elf_create_undef_symbol() objtool: Keep track of retpoline call sites objtool: Cache instruction relocs objtool: Skip magical retpoline .altinstr_replacement objtool/x86: Rewrite retpoline thunk calls objtool: Fix .symtab_shndx handling for elf_create_undef_symbol() objtool: Only rewrite unconditional retpoline thunk calls objtool/x86: Ignore __x86_indirect_alt_* symbols objtool: Teach get_alt_entry() about more relocation types objtool: Introduce CFI hash objtool: Handle __sanitize_cov*() tail calls objtool: Classify symbols objtool: Explicitly avoid self modifying code in .altinstr_replacement objtool,x86: Replace alternatives with .retpoline_sites x86/retpoline: Remove unused replacement symbols x86/asm: Fix register order x86/asm: Fixup odd GEN-for-each-reg.h usage x86/retpoline: Move the retpoline thunk declarations to nospec-branch.h x86/retpoline: Create a retpoline thunk array x86/alternative: Implement .retpoline_sites support bpf,x86: Simplify computing label offsets bpf,x86: Respect X86_FEATURE_RETPOLINE* x86/lib/atomic64_386_32: Rename things x86: Prepare asm files for straight-line-speculation x86: Prepare inline-asm for straight-line-speculation x86/alternative: Relax text_poke_bp() constraint objtool: Add straight-line-speculation validation x86: Add straight-line-speculation mitigation objtool: Default ignore INT3 for unreachable crypto: x86/poly1305 - Fixup SLS objtool: Fix SLS validation for kcov tail-call replacement x86/entry: Remove skip_r11rcx x86/kvm/vmx: Make noinstr clean x86/cpufeatures: Move RETPOLINE flags to word 11 x86/retpoline: Cleanup some #ifdefery x86/retpoline: Swizzle retpoline thunk x86/retpoline: Use -mfunction-return x86: Undo return-thunk damage x86,objtool: Create .return_sites x86,static_call: Use alternative RET encoding x86/ftrace: Use alternative RET encoding x86/bpf: Use alternative RET encoding x86/kvm: Fix SETcc emulation for return thunks x86/vsyscall_emu/64: Don't use RET in vsyscall emulation x86: Use return-thunk in asm code objtool: Treat .text.__x86.* as noinstr x86: Add magic AMD return-thunk x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value x86/entry: Add kernel IBRS implementation x86/bugs: Optimize SPEC_CTRL MSR writes x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() x86/bugs: Report Intel retbleed vulnerability intel_idle: Disable IBRS during long idle objtool: Update Retpoline validation x86/xen: Rename SYS* entry points x86/bugs: Add retbleed=ibpb objtool: Add entry UNRET validation x86/cpu/amd: Add Spectral Chicken x86/common: Stamp out the stepping madness x86/retbleed: Add fine grained Kconfig knobs um: Add missing apply_returns() Thadeu Lima de Souza Cascardo (5): x86/realmode: build with -D__DISABLE_EXPORTS objtool: skip non-text sections when adding return-thunk sites x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported efi/x86: use naked RET on mixed mode call wrapper x86/kvm: fix FASTOP_SIZE when return thunks are enabled Thomas Gleixner (1): x86/static_call: Serialize __static_call_fixup() properly Uros Bizjak (2): KVM/VMX: Use TEST %REG,%REG instead of CMP $0,%REG in vmenter.S KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw Vasily Gorbik (1): objtool: Fix elf_create_undef_symbol() endianness .../admin-guide/kernel-parameters.txt | 25 + Makefile | 20 +- arch/um/kernel/um_arch.c | 8 + arch/x86/Kconfig | 91 +- arch/x86/Makefile | 8 +- arch/x86/boot/compressed/efi_thunk_64.S | 2 +- arch/x86/boot/compressed/head_64.S | 4 +- arch/x86/boot/compressed/mem_encrypt.S | 4 +- arch/x86/crypto/aegis128-aesni-asm.S | 48 +- arch/x86/crypto/aes_ctrby8_avx-x86_64.S | 2 +- arch/x86/crypto/aesni-intel_asm.S | 52 +- arch/x86/crypto/aesni-intel_avx-x86_64.S | 40 +- arch/x86/crypto/blake2s-core.S | 4 +- arch/x86/crypto/blowfish-x86_64-asm_64.S | 12 +- arch/x86/crypto/camellia-aesni-avx-asm_64.S | 18 +- arch/x86/crypto/camellia-aesni-avx2-asm_64.S | 18 +- arch/x86/crypto/camellia-x86_64-asm_64.S | 12 +- arch/x86/crypto/cast5-avx-x86_64-asm_64.S | 12 +- arch/x86/crypto/cast6-avx-x86_64-asm_64.S | 16 +- arch/x86/crypto/chacha-avx2-x86_64.S | 6 +- arch/x86/crypto/chacha-avx512vl-x86_64.S | 6 +- arch/x86/crypto/chacha-ssse3-x86_64.S | 8 +- arch/x86/crypto/crc32-pclmul_asm.S | 2 +- arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 2 +- arch/x86/crypto/crct10dif-pcl-asm_64.S | 2 +- arch/x86/crypto/des3_ede-asm_64.S | 4 +- arch/x86/crypto/ghash-clmulni-intel_asm.S | 6 +- arch/x86/crypto/nh-avx2-x86_64.S | 2 +- arch/x86/crypto/nh-sse2-x86_64.S | 2 +- arch/x86/crypto/poly1305-x86_64-cryptogams.pl | 38 +- arch/x86/crypto/serpent-avx-x86_64-asm_64.S | 16 +- arch/x86/crypto/serpent-avx2-asm_64.S | 16 +- arch/x86/crypto/serpent-sse2-i586-asm_32.S | 6 +- arch/x86/crypto/serpent-sse2-x86_64-asm_64.S | 6 +- arch/x86/crypto/sha1_avx2_x86_64_asm.S | 2 +- arch/x86/crypto/sha1_ni_asm.S | 2 +- arch/x86/crypto/sha1_ssse3_asm.S | 2 +- arch/x86/crypto/sha256-avx-asm.S | 2 +- arch/x86/crypto/sha256-avx2-asm.S | 2 +- arch/x86/crypto/sha256-ssse3-asm.S | 2 +- arch/x86/crypto/sha256_ni_asm.S | 2 +- arch/x86/crypto/sha512-avx-asm.S | 2 +- arch/x86/crypto/sha512-avx2-asm.S | 2 +- arch/x86/crypto/sha512-ssse3-asm.S | 2 +- arch/x86/crypto/twofish-avx-x86_64-asm_64.S | 16 +- arch/x86/crypto/twofish-i586-asm_32.S | 4 +- arch/x86/crypto/twofish-x86_64-asm_64-3way.S | 6 +- arch/x86/crypto/twofish-x86_64-asm_64.S | 4 +- arch/x86/entry/Makefile | 2 +- arch/x86/entry/calling.h | 72 +- arch/x86/entry/entry.S | 22 + arch/x86/entry/entry_32.S | 6 +- arch/x86/entry/entry_64.S | 62 +- arch/x86/entry/entry_64_compat.S | 21 +- arch/x86/entry/thunk_32.S | 2 +- arch/x86/entry/thunk_64.S | 2 +- arch/x86/entry/vdso/Makefile | 1 + arch/x86/entry/vdso/vdso32/system_call.S | 4 +- arch/x86/entry/vsyscall/vsyscall_emu_64.S | 3 + arch/x86/include/asm/GEN-for-each-reg.h | 14 +- arch/x86/include/asm/alternative-asm.h | 114 -- arch/x86/include/asm/alternative.h | 133 +- arch/x86/include/asm/asm-prototypes.h | 17 - arch/x86/include/asm/cpufeature.h | 41 +- arch/x86/include/asm/cpufeatures.h | 12 +- arch/x86/include/asm/disabled-features.h | 21 +- arch/x86/include/asm/inat.h | 2 +- arch/x86/include/asm/insn-eval.h | 4 +- arch/x86/include/asm/insn.h | 28 +- arch/x86/include/asm/linkage.h | 22 + arch/x86/include/asm/msr-index.h | 13 + arch/x86/include/asm/nospec-branch.h | 148 ++- arch/x86/include/asm/paravirt.h | 2 +- arch/x86/include/asm/qspinlock_paravirt.h | 4 +- arch/x86/include/asm/smap.h | 5 +- arch/x86/include/asm/static_call.h | 19 +- arch/x86/include/asm/unwind_hints.h | 23 +- arch/x86/kernel/acpi/wakeup_32.S | 6 +- arch/x86/kernel/alternative.c | 356 +++++- arch/x86/kernel/cpu/amd.c | 46 +- arch/x86/kernel/cpu/bugs.c | 475 ++++++- arch/x86/kernel/cpu/common.c | 61 +- arch/x86/kernel/cpu/cpu.h | 2 + arch/x86/kernel/cpu/hygon.c | 6 + arch/x86/kernel/cpu/scattered.c | 1 + arch/x86/kernel/ftrace.c | 7 +- arch/x86/kernel/ftrace_32.S | 6 +- arch/x86/kernel/ftrace_64.S | 13 +- arch/x86/kernel/head_32.S | 2 +- arch/x86/kernel/head_64.S | 5 + arch/x86/kernel/irqflags.S | 4 +- arch/x86/kernel/kprobes/core.c | 2 +- arch/x86/kernel/kvm.c | 2 +- arch/x86/kernel/module.c | 15 +- arch/x86/kernel/paravirt.c | 2 +- arch/x86/kernel/process.c | 2 +- arch/x86/kernel/relocate_kernel_32.S | 15 +- arch/x86/kernel/relocate_kernel_64.S | 13 +- arch/x86/kernel/sev-es.c | 2 +- arch/x86/kernel/sev_verify_cbit.S | 2 +- arch/x86/kernel/static_call.c | 52 +- arch/x86/kernel/umip.c | 2 +- arch/x86/kernel/verify_cpu.S | 4 +- arch/x86/kernel/vmlinux.lds.S | 23 +- arch/x86/kvm/emulate.c | 39 +- arch/x86/kvm/svm/vmenter.S | 11 +- arch/x86/kvm/vmx/nested.c | 32 +- arch/x86/kvm/vmx/run_flags.h | 8 + arch/x86/kvm/vmx/vmenter.S | 170 +-- arch/x86/kvm/vmx/vmx.c | 78 +- arch/x86/kvm/vmx/vmx.h | 5 + arch/x86/kvm/x86.c | 4 +- arch/x86/lib/atomic64_386_32.S | 88 +- arch/x86/lib/atomic64_cx8_32.S | 18 +- arch/x86/lib/checksum_32.S | 8 +- arch/x86/lib/clear_page_64.S | 6 +- arch/x86/lib/cmpxchg16b_emu.S | 4 +- arch/x86/lib/cmpxchg8b_emu.S | 4 +- arch/x86/lib/copy_mc_64.S | 6 +- arch/x86/lib/copy_page_64.S | 10 +- arch/x86/lib/copy_user_64.S | 12 +- arch/x86/lib/csum-copy_64.S | 2 +- arch/x86/lib/error-inject.c | 3 +- arch/x86/lib/getuser.S | 22 +- arch/x86/lib/hweight.S | 6 +- arch/x86/lib/inat.c | 2 +- arch/x86/lib/insn-eval.c | 6 +- arch/x86/lib/insn.c | 222 +++- arch/x86/lib/iomap_copy_64.S | 2 +- arch/x86/lib/memcpy_64.S | 14 +- arch/x86/lib/memmove_64.S | 11 +- arch/x86/lib/memset_64.S | 8 +- arch/x86/lib/msr-reg.S | 4 +- arch/x86/lib/putuser.S | 6 +- arch/x86/lib/retpoline.S | 118 +- arch/x86/math-emu/div_Xsig.S | 2 +- arch/x86/math-emu/div_small.S | 2 +- arch/x86/math-emu/mul_Xsig.S | 6 +- arch/x86/math-emu/polynom_Xsig.S | 2 +- arch/x86/math-emu/reg_norm.S | 6 +- arch/x86/math-emu/reg_round.S | 2 +- arch/x86/math-emu/reg_u_add.S | 2 +- arch/x86/math-emu/reg_u_div.S | 2 +- arch/x86/math-emu/reg_u_mul.S | 2 +- arch/x86/math-emu/reg_u_sub.S | 2 +- arch/x86/math-emu/round_Xsig.S | 4 +- arch/x86/math-emu/shr_Xsig.S | 8 +- arch/x86/math-emu/wm_shrx.S | 16 +- arch/x86/mm/mem_encrypt_boot.S | 6 + arch/x86/net/bpf_jit_comp.c | 185 ++- arch/x86/net/bpf_jit_comp32.c | 22 +- arch/x86/platform/efi/efi_stub_32.S | 2 +- arch/x86/platform/efi/efi_stub_64.S | 2 +- arch/x86/platform/efi/efi_thunk_64.S | 5 +- arch/x86/platform/olpc/xo1-wakeup.S | 6 +- arch/x86/power/hibernate_asm_32.S | 4 +- arch/x86/power/hibernate_asm_64.S | 4 +- arch/x86/um/checksum_32.S | 4 +- arch/x86/um/setjmp_32.S | 2 +- arch/x86/um/setjmp_64.S | 2 +- arch/x86/xen/Makefile | 1 - arch/x86/xen/setup.c | 6 +- arch/x86/xen/xen-asm.S | 43 +- arch/x86/xen/xen-head.S | 6 +- arch/x86/xen/xen-ops.h | 6 +- drivers/base/cpu.c | 8 + drivers/idle/intel_idle.c | 43 +- include/linux/cpu.h | 2 + include/linux/kvm_host.h | 2 +- include/linux/objtool.h | 14 +- samples/ftrace/ftrace-direct-modify.c | 4 +- samples/ftrace/ftrace-direct-too.c | 2 +- samples/ftrace/ftrace-direct.c | 2 +- scripts/Makefile.build | 6 + scripts/link-vmlinux.sh | 6 + security/Kconfig | 11 - tools/arch/x86/include/asm/cpufeatures.h | 12 +- .../arch/x86/include/asm/disabled-features.h | 21 +- tools/arch/x86/include/asm/inat.h | 2 +- tools/arch/x86/include/asm/insn.h | 28 +- tools/arch/x86/include/asm/msr-index.h | 13 + tools/arch/x86/lib/inat.c | 2 +- tools/arch/x86/lib/insn.c | 222 +++- tools/arch/x86/lib/memcpy_64.S | 14 +- tools/arch/x86/lib/memset_64.S | 8 +- .../asm/{alternative-asm.h => alternative.h} | 0 tools/include/linux/kconfig.h | 67 + tools/include/linux/objtool.h | 14 +- .../Documentation/stack-validation.txt | 16 +- tools/objtool/Makefile | 4 - tools/objtool/arch.h | 13 +- tools/objtool/arch/x86/decode.c | 58 +- tools/objtool/builtin-check.c | 6 +- tools/objtool/builtin-orc.c | 6 +- tools/objtool/builtin.h | 3 +- tools/objtool/cfi.h | 2 + tools/objtool/check.c | 1131 +++++++++++++---- tools/objtool/check.h | 35 +- tools/objtool/elf.c | 230 ++-- tools/objtool/elf.h | 20 +- tools/objtool/objtool.c | 2 + tools/objtool/objtool.h | 5 +- tools/objtool/orc_gen.c | 324 ++--- tools/objtool/special.c | 22 +- tools/objtool/sync-check.sh | 17 +- tools/objtool/weak.c | 7 +- tools/perf/check-headers.sh | 15 +- 207 files changed, 4322 insertions(+), 1901 deletions(-) create mode 100644 arch/x86/entry/entry.S delete mode 100644 arch/x86/include/asm/alternative-asm.h create mode 100644 arch/x86/kvm/vmx/run_flags.h rename tools/include/asm/{alternative-asm.h => alternative.h} (100%) create mode 100644 tools/include/linux/kconfig.h -- 2.20.1

1 139

[PATCH openEuler-5.10] KVM: x86: do not report a vCPU as preempted outside instruction boundaries
by Zheng Zengkai 20 Sep '22

20 Sep '22

From: Paolo Bonzini <pbonzini(a)redhat.com> mainline inclusion from mainline-v5.19-rc2 commit 6cd88243c7e03845a450795e134b488fc2afb736 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PJ7H CVE: CVE-2022-39189 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------- If a vCPU is outside guest mode and is scheduled out, it might be in the process of making a memory access. A problem occurs if another vCPU uses the PV TLB flush feature during the period when the vCPU is scheduled out, and a virtual address has already been translated but has not yet been accessed, because this is equivalent to using a stale TLB entry. To avoid this, only report a vCPU as preempted if sure that the guest is at an instruction boundary. A rescheduling request will be delivered to the host physical CPU as an external interrupt, so for simplicity consider any vmexit *not* instruction boundary except for external interrupts. It would in principle be okay to report the vCPU as preempted also if it is sleeping in kvm_vcpu_block(): a TLB flush IPI will incur the vmentry/vmexit overhead unnecessarily, and optimistic spinning is also unlikely to succeed. However, leave it for later because right now kvm_vcpu_check_block() is doing memory accesses. Even though the TLB flush issue only applies to virtual memory address, it's very much preferrable to be conservative. Reported-by: Jann Horn <jannh(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> conflict: arch/x86/kvm/x86.c Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- arch/x86/include/asm/kvm_host.h | 3 +++ arch/x86/kvm/svm/svm.c | 2 ++ arch/x86/kvm/vmx/vmx.c | 1 + arch/x86/kvm/x86.c | 24 ++++++++++++++++++++++++ 4 files changed, 30 insertions(+) diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h index 3d9da4629325..5103638cc911 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -553,6 +553,7 @@ struct kvm_vcpu_arch { u64 ia32_misc_enable_msr; u64 smbase; u64 smi_count; + bool at_instruction_boundary; bool tpr_access_reporting; bool xsaves_enabled; u64 ia32_xss; @@ -1077,6 +1078,8 @@ struct kvm_vcpu_stat { u64 utime; u64 stime; u64 gtime; + u64 preemption_reported; + u64 preemption_other; u64 preemption_timer_exits; }; diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 2124fe54abfb..5231f40e8312 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -3992,6 +3992,8 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu, static void svm_handle_exit_irqoff(struct kvm_vcpu *vcpu) { + if (to_svm(vcpu)->vmcb->control.exit_code == SVM_EXIT_INTR) + vcpu->arch.at_instruction_boundary = true; } static void svm_sched_in(struct kvm_vcpu *vcpu, int cpu) diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 6bb07e495eca..fad74e5faade 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -6605,6 +6605,7 @@ static void handle_external_interrupt_irqoff(struct kvm_vcpu *vcpu) return; handle_interrupt_nmi_irqoff(vcpu, gate_offset(desc)); + vcpu->arch.at_instruction_boundary = true; } static void vmx_handle_exit_irqoff(struct kvm_vcpu *vcpu) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 284bf9b0c12c..c275efd0bb70 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -233,6 +233,8 @@ struct kvm_stats_debugfs_item debugfs_entries[] = { VCPU_STAT("l1d_flush", l1d_flush), VCPU_STAT("halt_poll_success_ns", halt_poll_success_ns), VCPU_STAT("halt_poll_fail_ns", halt_poll_fail_ns), + VCPU_STAT("preemption_reported", preemption_reported), + VCPU_STAT("preemption_other", preemption_other), VM_STAT("mmu_shadow_zapped", mmu_shadow_zapped), VM_STAT("mmu_pte_write", mmu_pte_write), VM_STAT("mmu_pde_zapped", mmu_pde_zapped), @@ -287,6 +289,8 @@ struct dfx_kvm_stats_debugfs_item dfx_debugfs_entries[] = { DFX_STAT("stime", stime), DFX_STAT("gtime", gtime), DFX_STAT("preemption_timer_exits", preemption_timer_exits), + DFX_STAT("preemption_reported", preemption_reported), + DFX_STAT("preemption_other", preemption_other), { NULL } }; @@ -4082,6 +4086,19 @@ static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu) struct kvm_host_map map; struct kvm_steal_time *st; + /* + * The vCPU can be marked preempted if and only if the VM-Exit was on + * an instruction boundary and will not trigger guest emulation of any + * kind (see vcpu_run). Vendor specific code controls (conservatively) + * when this is true, for example allowing the vCPU to be marked + * preempted if and only if the VM-Exit was due to a host interrupt. + */ + if (!vcpu->arch.at_instruction_boundary) { + vcpu->stat.preemption_other++; + return; + } + + vcpu->stat.preemption_reported++; if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED)) return; @@ -9329,6 +9346,13 @@ static int vcpu_run(struct kvm_vcpu *vcpu) vcpu->arch.l1tf_flush_l1d = true; for (;;) { + /* + * If another guest vCPU requests a PV TLB flush in the middle + * of instruction emulation, the rest of the emulation could + * use a stale page translation. Assume that any code after + * this point can start executing an instruction. + */ + vcpu->arch.at_instruction_boundary = false; if (kvm_vcpu_running(vcpu)) { r = vcpu_enter_guest(vcpu); } else { -- 2.20.1

1 0

[PATCH openEuler-5.10 01/14] block: fix the problem of io_ticks becoming smaller
by Zheng Zengkai 20 Sep '22

20 Sep '22

From: Chunguang Xu <brookxu(a)tencent.com> mainline inclusion from mainline-v5.14-rc1 commit d80c228d44640f0b47b57a2ca4afa26ef87e16b0 category: bugfix bugzilla: 187475, https://gitee.com/openeuler/kernel/issues/I5ME0J CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- On the IO submission path, blk_account_io_start() may interrupt the system interruption. When the interruption returns, the value of part->stamp may have been updated by other cores, so the time value collected before the interruption may be less than part-> stamp. So when this happens, we should do nothing to make io_ticks more accurate? For kernels less than 5.0, this may cause io_ticks to become smaller, which in turn may cause abnormal ioutil values. Signed-off-by: Chunguang Xu <brookxu(a)tencent.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/1625521646-1069-1-git-send-email-brookxu.cn@gmail… Signed-off-by: Jens Axboe <axboe(a)kernel.dk> conflict: block/blk-core.c Signed-off-by: Li Nan <linan122(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- block/blk-core.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/block/blk-core.c b/block/blk-core.c index 109fb2750453..0b496dabc5ac 100644 --- a/block/blk-core.c +++ b/block/blk-core.c @@ -1258,7 +1258,7 @@ void update_io_ticks(struct hd_struct *part, unsigned long now, bool end) unsigned long stamp; again: stamp = READ_ONCE(part->stamp); - if (unlikely(stamp != now)) { + if (unlikely(time_after(now, stamp))) { if (likely(cmpxchg(&part->stamp, stamp, now) == stamp)) __part_stat_add(part, io_ticks, end ? now - stamp : 1); } -- 2.20.1

1 13

[PATCH RFC v2 openEuler-1.0-LTS 0/6] md: improve performance
by Yu Kuai 20 Sep '22

20 Sep '22

From: Yu Kuai <yukuai3(a)huawei.com> Changes in v2: - fix the problem that if 'nr_pending' is decreased to 0 in wait_barrier_nolock() in patch 1, 'conf->barrier' is not waked, and raise_barrier() can hang while waiting 'nr_pending' to be 0. - only modify hot path in patch 2. - use node 1 as default in patch 6. In some architecture, for example KUNPENG 920, memory access latency is very bad across nodes compare to local node. For consequence, io performance is rather bad while users issue io from multiple nodes if lock contention exist in the driver. This patchset tries to avoid memory access across nodes in driver. Test environment: aarch64 Huawei KUNPENG 920 Raid10 initialize: mdadm --create /dev/md0 --level 10 --bitmap none --raid-devices 4 /dev/nvme0n1 /dev/nvme1n1 /dev/nvme2n1 /dev/nvme3n1 Test cmd: (task set -c 0-15) fio -name=0 -ioengine=libaio -direct=1 -group_reporting=1 -randseed=2022 -rwmixread=70 -refill_buffers -filename=/dev/md0 -numjobs=16 -runtime=60s -bs=4k -iodepth=256 -rw=randread Test result: before this patchset: 3.2 GiB/s bind node before this patchset: 6.9 Gib/s after this patchset: 7.9 Gib/s bind node after this patchset: 8.0 Gib/s Wang ShaoBo (1): arm64/topology: Getting preferred sibling's cpumask supported by platform Yu Kuai (5): md/raid10: convert resync_lock to use seqlock md/raid10: prevent unnecessary calls to wake_up() in fast path block: add new fields in request_queue block: support to dispatch bio asynchronously md: enable dispatching bio asynchronously by default arch/arm64/Kconfig | 8 ++ arch/arm64/include/asm/smp_plat.h | 14 ++ arch/arm64/kernel/smp.c | 9 ++ arch/arm64/kernel/topology.c | 51 +++++++ block/blk-core.c | 212 +++++++++++++++++++++++++++++- block/blk-sysfs.c | 40 ++++++ drivers/md/md.c | 5 + drivers/md/raid10.c | 98 +++++++++----- drivers/md/raid10.h | 2 +- include/linux/arch_topology.h | 7 + include/linux/blkdev.h | 6 + 11 files changed, 420 insertions(+), 32 deletions(-) -- 2.31.1

2 11

[PATCH 1/2] jfs: fix GPF in diFree
by Laibin Qiu 20 Sep '22

20 Sep '22

From: Pavel Skripkin <paskripkin(a)gmail.com> mainline inclusion from mainline-6.0-rc4 commit 9d574f985fe33efd6911f4d752de6f485a1ea732 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5RX0N?from=project-issue CVE: CVE-2022-3202 -------------------------------- Avoid passing inode with JFS_SBI(inode->i_sb)->ipimap == NULL to diFree()[1]. GFP will appear: struct inode *ipimap = JFS_SBI(ip->i_sb)->ipimap; struct inomap *imap = JFS_IP(ipimap)->i_imap; JFS_IP() will return invalid pointer when ipimap == NULL Call Trace: diFree+0x13d/0x2dc0 fs/jfs/jfs_imap.c:853 [1] jfs_evict_inode+0x2c9/0x370 fs/jfs/inode.c:154 evict+0x2ed/0x750 fs/inode.c:578 iput_final fs/inode.c:1654 [inline] iput.part.0+0x3fe/0x820 fs/inode.c:1680 iput+0x58/0x70 fs/inode.c:1670 Reported-and-tested-by: syzbot+0a89a7b56db04c21a656(a)syzkaller.appspotmail.com Signed-off-by: Pavel Skripkin <paskripkin(a)gmail.com> Signed-off-by: Dave Kleikamp <dave.kleikamp(a)oracle.com> Signed-off-by: ZhaoLong Wang <wangzhaolong1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- fs/jfs/inode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/fs/jfs/inode.c b/fs/jfs/inode.c index 054cc761b426..87b41edc800d 100644 --- a/fs/jfs/inode.c +++ b/fs/jfs/inode.c @@ -161,7 +161,8 @@ void jfs_evict_inode(struct inode *inode) if (test_cflag(COMMIT_Freewmap, inode)) jfs_free_zero_link(inode); - diFree(inode); + if (JFS_SBI(inode->i_sb)->ipimap) + diFree(inode); /* * Free the inode from the quota allocation. -- 2.25.1

1 1

[PATCH openEuler-22.09] arm64/__mc_ex_table: fix __mc_ex_table do_sort() issue
by Zheng Zengkai 20 Sep '22

20 Sep '22

From: Tong Tiangen <tongtiangen(a)huawei.com> hulk inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I5GB28 CVE: NA ------------------------------- If ARCH_HAS_MC_EXTABLE is not set then the _mc_ex_table is empty. There is a logic error in do_sort(). _mc_ex_table is different from _ex_table. _ex_table is always not empty, while _mc_ex_table may be empty. If _mc_ex_table is empty, there is a issue with setting the initial value of mc_extable_index to 0. Fixes: 7c3d926bb083 ("[Huawei] arm64: extable: add new extable type "__mc_ex_table"") Signed-off-by: Tong Tiangen <tongtiangen(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- scripts/sorttable.h | 20 +++++++++----------- 1 file changed, 9 insertions(+), 11 deletions(-) diff --git a/scripts/sorttable.h b/scripts/sorttable.h index 874cbd7046b0..d67242f8c75f 100644 --- a/scripts/sorttable.h +++ b/scripts/sorttable.h @@ -227,7 +227,6 @@ static int do_sort(Elf_Ehdr *ehdr, Elf_Rel *mc_relocs = NULL; int mc_relocs_size = 0; char *mc_extab_image = NULL; - int mc_extab_index = 0; shstrndx = r2(&ehdr->e_shstrndx); if (shstrndx == SHN_XINDEX) @@ -245,11 +244,6 @@ static int do_sort(Elf_Ehdr *ehdr, extab_index = i; } - if (!strcmp(secstrings + idx, "__mc_ex_table")) { - mc_extab_sec = s; - mc_extab_index = i; - } - if (!strcmp(secstrings + idx, ".symtab")) symtab_sec = s; if (!strcmp(secstrings + idx, ".strtab")) @@ -262,11 +256,15 @@ static int do_sort(Elf_Ehdr *ehdr, relocs_size = _r(&s->sh_size); } - if ((r(&s->sh_type) == SHT_REL || - r(&s->sh_type) == SHT_RELA) && - r(&s->sh_info) == mc_extab_index) { - mc_relocs = (void *)ehdr + _r(&s->sh_offset); - mc_relocs_size = _r(&s->sh_size); + if (!strcmp(secstrings + idx, "__mc_ex_table")) { + mc_extab_sec = s; + + if ((r(&s->sh_type) == SHT_REL || + r(&s->sh_type) == SHT_RELA) && + r(&s->sh_info) == i) { + mc_relocs = (void *)ehdr + _r(&s->sh_offset); + mc_relocs_size = _r(&s->sh_size); + } } if (r(&s->sh_type) == SHT_SYMTAB_SHNDX) -- 2.20.1

1 0

[PATCH openEuler-1.0-LTS] xfs: preserve default grace interval during quotacheck
by tangbin 19 Sep '22

19 Sep '22

From: "Darrick J. Wong" <darrick.wong(a)oracle.com> stable inclusion from stable-v5.10.143 commit f1101295c145e9710b1b37e9b0a13ef9af9af0c9 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5RTF5 CVE: NA -------------------------------- commit 5885539f0af371024d07afd14974bfdc3fff84c5 upstream. When quotacheck runs, it zeroes all the timer fields in every dquot. Unfortunately, it also does this to the root dquot, which erases any preconfigured grace intervals and warning limits that the administrator may have set. Worse yet, the incore copies of those variables remain set. This cache coherence problem manifests itself as the grace interval mysteriously being reset back to the defaults at the /next/ mount. Fix it by not resetting the root disk dquot's timer and warning fields. Signed-off-by: Darrick J. Wong <darrick.wong(a)oracle.com> Reviewed-by: Dave Chinner <dchinner(a)redhat.com> Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: tangbin <tangbin(a)cmss.chinamobile.com> --- fs/xfs/xfs_qm.c | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c index 65b77ea9d5a9..0fb2b37b56f2 100644 --- a/fs/xfs/xfs_qm.c +++ b/fs/xfs/xfs_qm.c @@ -870,12 +870,20 @@ xfs_qm_reset_dqcounts( ddq->d_bcount = 0; ddq->d_icount = 0; ddq->d_rtbcount = 0; - ddq->d_btimer = 0; - ddq->d_itimer = 0; - ddq->d_rtbtimer = 0; - ddq->d_bwarns = 0; - ddq->d_iwarns = 0; - ddq->d_rtbwarns = 0; + + /* + * dquot id 0 stores the default grace period and the maximum + * warning limit that were set by the administrator, so we + * should not reset them. + */ + if (ddq->d_id != 0) { + ddq->d_btimer = 0; + ddq->d_itimer = 0; + ddq->d_rtbtimer = 0; + ddq->d_bwarns = 0; + ddq->d_iwarns = 0; + ddq->d_rtbwarns = 0; + } if (xfs_sb_version_hascrc(&mp->m_sb)) { xfs_update_cksum((char *)&dqb[j], -- 2.18.4

1 0

[PATCH openEuler-22.09 1/2] bpf:programmable: Fix build error of 'stack exceeds 512 bytes'
by Zheng Zengkai 19 Sep '22

19 Sep '22

From: Hui Tang <tanghui20(a)huawei.com> hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5RMFU CVE: NA -------------------------------- 1.Change arg type of 'bpf_get_cpumask_info' to avoid bpf program stack exceeds 512 bytes. 2.Fix back-edge error in sample 'sched_select_core' 3.Fix loop too complex in sample 'sached_select_core' Fixes: 1bf0417b95a9 ("sched: programmable: Add helper function for cpu topo...") Fixes: 2c1189e32bf9 ("samples:bpf: Add samples for cfs select core") Signed-off-by: Hui Tang <tanghui20(a)huawei.com> --- include/uapi/linux/bpf.h | 2 +- kernel/sched/bpf_topology.c | 9 ++- samples/bpf/sched_select_core_kern.c | 33 ++++++++--- tools/include/uapi/linux/bpf.h | 2 +- tools/lib/bpf/libbpf_sched.h | 86 +++++++++++++++++++++------- 5 files changed, 97 insertions(+), 35 deletions(-) diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h index db585d960d64..7e474c6fc4a7 100644 --- a/include/uapi/linux/bpf.h +++ b/include/uapi/linux/bpf.h @@ -3903,7 +3903,7 @@ union bpf_attr { * Return * 0 on success, or a negative error in case of failure. * - * int bpf_get_cpumask_info(struct bpf_cpumask_info *cpus, int len) + * int bpf_get_cpumask_info(struct bpf_map *map, struct bpf_cpumask_info *cpus) * Description * Get system cpus returned in *cpus*. * Return diff --git a/kernel/sched/bpf_topology.c b/kernel/sched/bpf_topology.c index 9c2eda139e2a..843b6092a64f 100644 --- a/kernel/sched/bpf_topology.c +++ b/kernel/sched/bpf_topology.c @@ -70,10 +70,9 @@ const struct bpf_func_proto bpf_init_cpu_topology_proto = { .arg2_type = ARG_ANYTHING, }; -BPF_CALL_2(bpf_get_cpumask_info, struct bpf_cpumask_info *, cpus, - int, len) +BPF_CALL_2(bpf_get_cpumask_info, struct bpf_map *, map, struct bpf_cpumask_info *, cpus) { - if (len != sizeof(*cpus)) + if (!cpus) return -EINVAL; cpumask_copy(&cpus->cpu_possible_cpumask, cpu_possible_mask); @@ -92,6 +91,6 @@ const struct bpf_func_proto bpf_get_cpumask_info_proto = { .func = bpf_get_cpumask_info, .gpl_only = false, .ret_type = RET_INTEGER, - .arg1_type = ARG_PTR_TO_UNINIT_MEM, - .arg2_type = ARG_CONST_SIZE, + .arg1_type = ARG_CONST_MAP_PTR, + .arg2_type = ARG_PTR_TO_MAP_VALUE_OR_NULL, }; diff --git a/samples/bpf/sched_select_core_kern.c b/samples/bpf/sched_select_core_kern.c index 18617e89b395..62ffb29f2725 100644 --- a/samples/bpf/sched_select_core_kern.c +++ b/samples/bpf/sched_select_core_kern.c @@ -62,7 +62,7 @@ struct tag_info { struct tag_info tag_tbl[] = { {TAG_NONE, ""}, - {TAG_ID(1), "0-3"}, + {TAG_ID(1), "0-1"}, {TAG_ID(2), "4-7"}, {TAG_MAX, ""}, }; @@ -94,13 +94,17 @@ static struct cpumask *select_better_cpus(struct task_struct *p, long min_util = INT_MIN; struct task_group *tg; long spare; - int cpu; + int cpu, i; if (!prefer_cpus_valid(prefer_cpus, (void *)getVal(p->cpus_ptr))) return (void *)getVal(p->cpus_ptr); tg = p->sched_task_group; - libbpf_for_each_cpu(cpu, prefer_cpus) { + for (i = 0, cpu = -1; i < BPF_SCHED_LOOP_MAX; i++) { + cpu = libbpf_cpumask_next(cpu, (void *)getVal(prefer_cpus)); + if (cpu >= libbpf_nr_cpus_ids()) + break; + if (idlest_cpu && libbpf_available_idle_cpu(cpu)) { *idlest_cpu = cpu; } else if (idlest_cpu) { @@ -159,9 +163,14 @@ int BPF_PROG(cfs_select_cpu_range, struct sched_migrate_ctx *h_ctx) SEC("sched/cfs_select_rq_exit") int BPF_PROG(cfs_select_cpu_range_exit, struct sched_migrate_ctx *h_ctx) { + struct task_struct *p = getVal(h_ctx->task); + long tag = getVal(p->tag); int *idlest_cpu; int key = 0; + if (tag <= TAG_NONE || tag >= TAG_MAX) + return SELECT_RQ_EXIT_CPU_VALID; + idlest_cpu = bpf_map_lookup_elem(&map_idlest_cpu, &key); if (!idlest_cpu) { libbpf_sched_set_task_cpus_ptr(h_ctx, (void *)getVal(h_ctx->cpus_allowed)); @@ -186,7 +195,7 @@ static int find_idlest_cpu(struct task_struct *p, int parent) int cpu; int i; - for (i = 0, cpu = -1; i < NR_CPUS; i++) { + for (i = 0, cpu = -1; i < BPF_SCHED_LOOP_MAX; i++) { cpu = libbpf_cpumask_next(cpu, (void *)getVal(p->cpus_ptr)); if (cpu >= libbpf_nr_cpus_ids()) break; @@ -203,17 +212,27 @@ static int find_idlest_cpu(struct task_struct *p, int parent) static int select_idle_cpu(struct task_struct *p, int parent, int prev_cpu) { - int cpu; + int cpu, i; if (libbpf_available_idle_cpu(prev_cpu)) return prev_cpu; if (libbpf_available_idle_cpu(parent)) - return prev_cpu; + return parent; + + for (i = 0, cpu = libbpf_cpumask_next_wrap(prev_cpu - 1, + (void *)getVal(p->cpus_ptr), + prev_cpu, false); + i < BPF_SCHED_LOOP_MAX; i++) { + + if (cpu >= libbpf_nr_cpumask_bits()) + break; - libbpf_for_each_cpu_wrap(cpu, (void *)getVal(p->cpus_ptr), prev_cpu) { if (libbpf_available_idle_cpu(cpu)) return cpu; + + cpu = libbpf_cpumask_next_wrap(cpu, (void *)getVal(p->cpus_ptr), + prev_cpu, true); } return prev_cpu; diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h index 57b927e99092..22f7880a0bb6 100644 --- a/tools/include/uapi/linux/bpf.h +++ b/tools/include/uapi/linux/bpf.h @@ -4613,7 +4613,7 @@ union bpf_attr { * Return * 0 on success, or a negative error in case of failure. * - * int bpf_get_cpumask_info(struct bpf_cpumask_info *cpus, int len) + * int bpf_get_cpumask_info(struct bpf_map *map, struct bpf_cpumask_info *cpus) * Description * Get system cpus returned in *cpus*. * Return diff --git a/tools/lib/bpf/libbpf_sched.h b/tools/lib/bpf/libbpf_sched.h index 6cb30e8e81f8..187e854b99b3 100644 --- a/tools/lib/bpf/libbpf_sched.h +++ b/tools/lib/bpf/libbpf_sched.h @@ -21,6 +21,8 @@ #include <bpf/bpf_helpers.h> #include <bpf/bpf_tracing.h> +/* set bigger value may lead verifier failed */ +#define BPF_SCHED_LOOP_MAX 1024 #define INVALID_PTR ((void *)(0UL)) #define getVal(P) \ ({ \ @@ -69,6 +71,13 @@ static __always_inline int libbpf_nr_cpumask_bits(void); #endif +struct { + __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); + __type(key, u32); + __type(value, struct bpf_cpumask_info); + __uint(max_entries, 1); +} map_cpumask_info SEC(".maps"); + static __always_inline long libbpf_cpumask_copy(struct cpumask *dst, struct cpumask *src) { @@ -228,58 +237,93 @@ static __always_inline long libbpf_cpumask_cpulist_parse(char *src1, static __always_inline int libbpf_num_active_cpus(void) { - struct bpf_cpumask_info cpus; + struct bpf_cpumask_info *cpus; + int key = 0; + + cpus = bpf_map_lookup_elem(&map_cpumask_info, &key); + if (!cpus) + return -1; - bpf_get_cpumask_info(&cpus, sizeof(cpus)); - return getVal(cpus.nums_active_cpus); + bpf_get_cpumask_info(&map_cpumask_info, cpus); + return getVal(cpus->nums_active_cpus); } static __always_inline int libbpf_num_possible_cpus(void) { - struct bpf_cpumask_info cpus; + struct bpf_cpumask_info *cpus; + int key = 0; - bpf_get_cpumask_info(&cpus, sizeof(cpus)); - return getVal(cpus.nums_possible_cpus); + cpus = bpf_map_lookup_elem(&map_cpumask_info, &key); + if (!cpus) + return -1; + + bpf_get_cpumask_info(&map_cpumask_info, cpus); + return getVal(cpus->nums_possible_cpus); } static __always_inline void libbpf_possible_cpus_mask(struct cpumask *mask) { - struct bpf_cpumask_info cpus; + struct bpf_cpumask_info *cpus; + int key = 0; + + cpus = bpf_map_lookup_elem(&map_cpumask_info, &key); + if (!cpus) + return; - bpf_get_cpumask_info(&cpus, sizeof(cpus)); - libbpf_cpumask_copy(mask, &cpus.cpu_possible_cpumask); + bpf_get_cpumask_info(&map_cpumask_info, cpus); + libbpf_cpumask_copy(mask, &cpus->cpu_possible_cpumask); } static __always_inline void libbpf_active_cpus_mask(struct cpumask *mask) { - struct bpf_cpumask_info cpus; + struct bpf_cpumask_info *cpus; + int key = 0; - bpf_get_cpumask_info(&cpus, sizeof(cpus)); - libbpf_cpumask_copy(mask, &cpus.cpu_active_cpumask); + cpus = bpf_map_lookup_elem(&map_cpumask_info, &key); + if (!cpus) + return; + + bpf_get_cpumask_info(&map_cpumask_info, cpus); + libbpf_cpumask_copy(mask, &cpus->cpu_active_cpumask); } static __always_inline void libbpf_isolate_cpus_mask(struct cpumask *mask) { - struct bpf_cpumask_info cpus; + struct bpf_cpumask_info *cpus; + int key = 0; + + cpus = bpf_map_lookup_elem(&map_cpumask_info, &key); + if (!cpus) + return; - bpf_get_cpumask_info(&cpus, sizeof(cpus)); - libbpf_cpumask_copy(mask, &cpus.cpu_isolate_cpumask); + bpf_get_cpumask_info(&map_cpumask_info, cpus); + libbpf_cpumask_copy(mask, &cpus->cpu_isolate_cpumask); } static __always_inline int libbpf_nr_cpus_ids(void) { - struct bpf_cpumask_info cpus; + struct bpf_cpumask_info *cpus; + int key = 0; - bpf_get_cpumask_info(&cpus, sizeof(cpus)); - return getVal(cpus.nr_cpu_ids); + cpus = bpf_map_lookup_elem(&map_cpumask_info, &key); + if (!cpus) + return -1; + + bpf_get_cpumask_info(&map_cpumask_info, cpus); + return getVal(cpus->nr_cpu_ids); } static __always_inline int libbpf_nr_cpumask_bits(void) { - struct bpf_cpumask_info cpus; + struct bpf_cpumask_info *cpus; + int key = 0; + + cpus = bpf_map_lookup_elem(&map_cpumask_info, &key); + if (!cpus) + return -1; - bpf_get_cpumask_info(&cpus, sizeof(cpus)); - return getVal(cpus.bpf_nr_cpumask_bits); + bpf_get_cpumask_info(&map_cpumask_info, cpus); + return getVal(cpus->bpf_nr_cpumask_bits); } static __always_inline unsigned long libbpf_cfs_load_avg_of(int cpu) -- 2.20.1

1 1

[PATCH openEuler-5.10-LTS v2 000/139] Patches for CVE-2022-29900,
by Zheng Zengkai 16 Sep '22

16 Sep '22

Add patches for CVE-2022-29900, CVE-2022-23816 and CVE-2022-29901. Reference: https://lore.kernel.org/all/CAODzB9qH9WhxQ0eB+mNvmsn64bHXUVppuSTMDGJekYOPCw… https://www.amd.com/system/files/documents/technical-guidance-for-mitigatin… https://www.intel.com/content/www/us/en/developer/articles/technical/softwa… Alexandre Chartre (2): x86/bugs: Report AMD retbleed vulnerability x86/bugs: Add AMD retbleed= boot parameter Andrew Cooper (1): x86/cpu/amd: Enumerate BTC_NO Arnaldo Carvalho de Melo (5): tools arch: Update arch/x86/lib/mem{cpy,set}_64.S copies used in 'perf bench mem memcpy' tools arch x86: Sync the msr-index.h copy with the kernel sources tools headers cpufeatures: Sync with the kernel sources tools arch: Update arch/x86/lib/mem{cpy,set}_64.S copies used in 'perf bench mem memcpy' - again tools headers: Remove broken definition of __LITTLE_ENDIAN Ben Hutchings (3): x86: Add insn_decode_kernel() Makefile: Set retpoline cflags based on CONFIG_CC_IS_{CLANG,GCC} x86/xen: Fix initialisation in hypercall_page after rethunk Borislav Petkov (7): x86/insn: Rename insn_decode() to insn_decode_from_regs() x86/insn: Add a __ignore_sync_check__ marker x86/insn: Add an insn_decode() API x86/alternative: Use insn_decode() x86/alternative: Optimize single-byte NOPs at an arbitrary position kvm/emulate: Fix SETcc emulation function offsets with SLS tools/insn: Restore the relative include paths for cross building Greg Kroah-Hartman (1): x86, kvm: use proper ASM macros for kvm_vcpu_is_preempted Joe Lawrence (1): objtool: Make .altinstructions section entry size consistent Josh Poimboeuf (24): objtool: Refactor ORC section generation objtool: Add 'alt_group' struct objtool: Support stack layout changes in alternatives objtool: Support retpoline jump detection for vmlinux.o objtool: Assume only ELF functions do sibling calls objtool: Combine UNWIND_HINT_RET_OFFSET and UNWIND_HINT_FUNC x86/xen: Support objtool validation in xen-asm.S x86/xen: Support objtool vmlinux.o validation in xen-head.S objtool: Support asm jump tables objtool: Don't make .altinstructions writable objtool: Remove reloc symbol type checks in get_alt_entry() x86/bugs: Do IBPB fallback check only once x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n x86/speculation: Fix firmware entry SPEC_CTRL handling x86/speculation: Fix SPEC_CTRL write on SMT state change x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit x86/speculation: Remove x86_spec_ctrl_mask objtool: Re-add UNWIND_HINT_{SAVE_RESTORE} KVM: VMX: Flatten __vmx_vcpu_run() KVM: VMX: Convert launched argument to flags KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS KVM: VMX: Fix IBRS handling after vmexit x86/speculation: Fill RSB on vmexit for IBRS x86/ftrace: Add UNWIND_HINT_FUNC annotation for ftrace_stub Juergen Gross (4): x86/alternative: Merge include files x86/alternative: Support not-feature x86/alternative: Support ALTERNATIVE_TERNARY x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has() Kim Phillips (3): x86/sev: Avoid using __x86_return_thunk x86/bugs: Enable STIBP for JMP2RET x86/bugs: Remove apostrophe typo Konrad Rzeszutek Wilk (1): x86/kexec: Disable RET on kexec Lin Yujun (2): x86: Fix objtool build warning Re-add padlen to the structure alt_instr Linus Torvalds (2): objtool: print out the symbol type when complaining about it kvm: fix objtool relocation warning Nathan Chancellor (1): x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current Pawan Gupta (3): x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS x86/bugs: Add Cannon lake to RETBleed affected CPU list x86/speculation: Disable RRSBA behavior Peter Zijlstra (70): x86/alternatives: Optimize optimize_nops() x86/retpoline: Simplify retpolines objtool: Correctly handle retpoline thunk calls objtool: Handle per arch retpoline naming objtool: Rework the elf_rebuild_reloc_section() logic objtool: Add elf_create_reloc() helper objtool: Create reloc sections implicitly objtool: Extract elf_strtab_concat() objtool: Extract elf_symbol_add() objtool: Add elf_create_undef_symbol() objtool: Keep track of retpoline call sites objtool: Cache instruction relocs objtool: Skip magical retpoline .altinstr_replacement objtool/x86: Rewrite retpoline thunk calls objtool: Fix .symtab_shndx handling for elf_create_undef_symbol() objtool: Only rewrite unconditional retpoline thunk calls objtool/x86: Ignore __x86_indirect_alt_* symbols objtool: Teach get_alt_entry() about more relocation types objtool: Introduce CFI hash objtool: Handle __sanitize_cov*() tail calls objtool: Classify symbols objtool: Explicitly avoid self modifying code in .altinstr_replacement objtool,x86: Replace alternatives with .retpoline_sites x86/retpoline: Remove unused replacement symbols x86/asm: Fix register order x86/asm: Fixup odd GEN-for-each-reg.h usage x86/retpoline: Move the retpoline thunk declarations to nospec-branch.h x86/retpoline: Create a retpoline thunk array x86/alternative: Implement .retpoline_sites support bpf,x86: Simplify computing label offsets bpf,x86: Respect X86_FEATURE_RETPOLINE* x86/lib/atomic64_386_32: Rename things x86: Prepare asm files for straight-line-speculation x86: Prepare inline-asm for straight-line-speculation x86/alternative: Relax text_poke_bp() constraint objtool: Add straight-line-speculation validation x86: Add straight-line-speculation mitigation objtool: Default ignore INT3 for unreachable crypto: x86/poly1305 - Fixup SLS objtool: Fix SLS validation for kcov tail-call replacement x86/entry: Remove skip_r11rcx x86/kvm/vmx: Make noinstr clean x86/cpufeatures: Move RETPOLINE flags to word 11 x86/retpoline: Cleanup some #ifdefery x86/retpoline: Swizzle retpoline thunk x86/retpoline: Use -mfunction-return x86: Undo return-thunk damage x86,objtool: Create .return_sites x86,static_call: Use alternative RET encoding x86/ftrace: Use alternative RET encoding x86/bpf: Use alternative RET encoding x86/kvm: Fix SETcc emulation for return thunks x86/vsyscall_emu/64: Don't use RET in vsyscall emulation x86: Use return-thunk in asm code objtool: Treat .text.__x86.* as noinstr x86: Add magic AMD return-thunk x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value x86/entry: Add kernel IBRS implementation x86/bugs: Optimize SPEC_CTRL MSR writes x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() x86/bugs: Report Intel retbleed vulnerability intel_idle: Disable IBRS during long idle objtool: Update Retpoline validation x86/xen: Rename SYS* entry points x86/bugs: Add retbleed=ibpb objtool: Add entry UNRET validation x86/cpu/amd: Add Spectral Chicken x86/common: Stamp out the stepping madness x86/retbleed: Add fine grained Kconfig knobs um: Add missing apply_returns() Thadeu Lima de Souza Cascardo (5): x86/realmode: build with -D__DISABLE_EXPORTS objtool: skip non-text sections when adding return-thunk sites x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported efi/x86: use naked RET on mixed mode call wrapper x86/kvm: fix FASTOP_SIZE when return thunks are enabled Thomas Gleixner (1): x86/static_call: Serialize __static_call_fixup() properly Uros Bizjak (2): KVM/VMX: Use TEST %REG,%REG instead of CMP $0,%REG in vmenter.S KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw Vasily Gorbik (1): objtool: Fix elf_create_undef_symbol() endianness .../admin-guide/kernel-parameters.txt | 25 + Makefile | 20 +- arch/um/kernel/um_arch.c | 8 + arch/x86/Kconfig | 91 +- arch/x86/Makefile | 8 +- arch/x86/boot/compressed/efi_thunk_64.S | 2 +- arch/x86/boot/compressed/head_64.S | 4 +- arch/x86/boot/compressed/mem_encrypt.S | 4 +- arch/x86/crypto/aegis128-aesni-asm.S | 48 +- arch/x86/crypto/aes_ctrby8_avx-x86_64.S | 2 +- arch/x86/crypto/aesni-intel_asm.S | 52 +- arch/x86/crypto/aesni-intel_avx-x86_64.S | 40 +- arch/x86/crypto/blake2s-core.S | 4 +- arch/x86/crypto/blowfish-x86_64-asm_64.S | 12 +- arch/x86/crypto/camellia-aesni-avx-asm_64.S | 18 +- arch/x86/crypto/camellia-aesni-avx2-asm_64.S | 18 +- arch/x86/crypto/camellia-x86_64-asm_64.S | 12 +- arch/x86/crypto/cast5-avx-x86_64-asm_64.S | 12 +- arch/x86/crypto/cast6-avx-x86_64-asm_64.S | 16 +- arch/x86/crypto/chacha-avx2-x86_64.S | 6 +- arch/x86/crypto/chacha-avx512vl-x86_64.S | 6 +- arch/x86/crypto/chacha-ssse3-x86_64.S | 8 +- arch/x86/crypto/crc32-pclmul_asm.S | 2 +- arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 2 +- arch/x86/crypto/crct10dif-pcl-asm_64.S | 2 +- arch/x86/crypto/des3_ede-asm_64.S | 4 +- arch/x86/crypto/ghash-clmulni-intel_asm.S | 6 +- arch/x86/crypto/nh-avx2-x86_64.S | 2 +- arch/x86/crypto/nh-sse2-x86_64.S | 2 +- arch/x86/crypto/poly1305-x86_64-cryptogams.pl | 38 +- arch/x86/crypto/serpent-avx-x86_64-asm_64.S | 16 +- arch/x86/crypto/serpent-avx2-asm_64.S | 16 +- arch/x86/crypto/serpent-sse2-i586-asm_32.S | 6 +- arch/x86/crypto/serpent-sse2-x86_64-asm_64.S | 6 +- arch/x86/crypto/sha1_avx2_x86_64_asm.S | 2 +- arch/x86/crypto/sha1_ni_asm.S | 2 +- arch/x86/crypto/sha1_ssse3_asm.S | 2 +- arch/x86/crypto/sha256-avx-asm.S | 2 +- arch/x86/crypto/sha256-avx2-asm.S | 2 +- arch/x86/crypto/sha256-ssse3-asm.S | 2 +- arch/x86/crypto/sha256_ni_asm.S | 2 +- arch/x86/crypto/sha512-avx-asm.S | 2 +- arch/x86/crypto/sha512-avx2-asm.S | 2 +- arch/x86/crypto/sha512-ssse3-asm.S | 2 +- arch/x86/crypto/twofish-avx-x86_64-asm_64.S | 16 +- arch/x86/crypto/twofish-i586-asm_32.S | 4 +- arch/x86/crypto/twofish-x86_64-asm_64-3way.S | 6 +- arch/x86/crypto/twofish-x86_64-asm_64.S | 4 +- arch/x86/entry/Makefile | 2 +- arch/x86/entry/calling.h | 72 +- arch/x86/entry/entry.S | 22 + arch/x86/entry/entry_32.S | 6 +- arch/x86/entry/entry_64.S | 62 +- arch/x86/entry/entry_64_compat.S | 21 +- arch/x86/entry/thunk_32.S | 2 +- arch/x86/entry/thunk_64.S | 2 +- arch/x86/entry/vdso/Makefile | 1 + arch/x86/entry/vdso/vdso32/system_call.S | 4 +- arch/x86/entry/vsyscall/vsyscall_emu_64.S | 3 + arch/x86/include/asm/GEN-for-each-reg.h | 14 +- arch/x86/include/asm/alternative-asm.h | 114 -- arch/x86/include/asm/alternative.h | 133 +- arch/x86/include/asm/asm-prototypes.h | 17 - arch/x86/include/asm/cpufeature.h | 41 +- arch/x86/include/asm/cpufeatures.h | 12 +- arch/x86/include/asm/disabled-features.h | 21 +- arch/x86/include/asm/inat.h | 2 +- arch/x86/include/asm/insn-eval.h | 4 +- arch/x86/include/asm/insn.h | 28 +- arch/x86/include/asm/linkage.h | 22 + arch/x86/include/asm/msr-index.h | 13 + arch/x86/include/asm/nospec-branch.h | 148 ++- arch/x86/include/asm/paravirt.h | 2 +- arch/x86/include/asm/qspinlock_paravirt.h | 4 +- arch/x86/include/asm/smap.h | 5 +- arch/x86/include/asm/static_call.h | 19 +- arch/x86/include/asm/unwind_hints.h | 23 +- arch/x86/kernel/acpi/wakeup_32.S | 6 +- arch/x86/kernel/alternative.c | 356 +++++- arch/x86/kernel/cpu/amd.c | 46 +- arch/x86/kernel/cpu/bugs.c | 475 ++++++- arch/x86/kernel/cpu/common.c | 61 +- arch/x86/kernel/cpu/cpu.h | 2 + arch/x86/kernel/cpu/hygon.c | 6 + arch/x86/kernel/cpu/scattered.c | 1 + arch/x86/kernel/ftrace.c | 7 +- arch/x86/kernel/ftrace_32.S | 6 +- arch/x86/kernel/ftrace_64.S | 13 +- arch/x86/kernel/head_32.S | 2 +- arch/x86/kernel/head_64.S | 5 + arch/x86/kernel/irqflags.S | 4 +- arch/x86/kernel/kprobes/core.c | 2 +- arch/x86/kernel/kvm.c | 2 +- arch/x86/kernel/module.c | 15 +- arch/x86/kernel/paravirt.c | 2 +- arch/x86/kernel/process.c | 2 +- arch/x86/kernel/relocate_kernel_32.S | 15 +- arch/x86/kernel/relocate_kernel_64.S | 13 +- arch/x86/kernel/sev-es.c | 2 +- arch/x86/kernel/sev_verify_cbit.S | 2 +- arch/x86/kernel/static_call.c | 52 +- arch/x86/kernel/umip.c | 2 +- arch/x86/kernel/verify_cpu.S | 4 +- arch/x86/kernel/vmlinux.lds.S | 23 +- arch/x86/kvm/emulate.c | 39 +- arch/x86/kvm/svm/vmenter.S | 11 +- arch/x86/kvm/vmx/nested.c | 32 +- arch/x86/kvm/vmx/run_flags.h | 8 + arch/x86/kvm/vmx/vmenter.S | 170 +-- arch/x86/kvm/vmx/vmx.c | 78 +- arch/x86/kvm/vmx/vmx.h | 5 + arch/x86/kvm/x86.c | 4 +- arch/x86/lib/atomic64_386_32.S | 88 +- arch/x86/lib/atomic64_cx8_32.S | 18 +- arch/x86/lib/checksum_32.S | 8 +- arch/x86/lib/clear_page_64.S | 6 +- arch/x86/lib/cmpxchg16b_emu.S | 4 +- arch/x86/lib/cmpxchg8b_emu.S | 4 +- arch/x86/lib/copy_mc_64.S | 6 +- arch/x86/lib/copy_page_64.S | 10 +- arch/x86/lib/copy_user_64.S | 14 +- arch/x86/lib/csum-copy_64.S | 2 +- arch/x86/lib/error-inject.c | 3 +- arch/x86/lib/getuser.S | 22 +- arch/x86/lib/hweight.S | 6 +- arch/x86/lib/inat.c | 2 +- arch/x86/lib/insn-eval.c | 6 +- arch/x86/lib/insn.c | 222 +++- arch/x86/lib/iomap_copy_64.S | 2 +- arch/x86/lib/memcpy_64.S | 14 +- arch/x86/lib/memmove_64.S | 11 +- arch/x86/lib/memset_64.S | 8 +- arch/x86/lib/msr-reg.S | 4 +- arch/x86/lib/putuser.S | 6 +- arch/x86/lib/retpoline.S | 118 +- arch/x86/math-emu/div_Xsig.S | 2 +- arch/x86/math-emu/div_small.S | 2 +- arch/x86/math-emu/mul_Xsig.S | 6 +- arch/x86/math-emu/polynom_Xsig.S | 2 +- arch/x86/math-emu/reg_norm.S | 6 +- arch/x86/math-emu/reg_round.S | 2 +- arch/x86/math-emu/reg_u_add.S | 2 +- arch/x86/math-emu/reg_u_div.S | 2 +- arch/x86/math-emu/reg_u_mul.S | 2 +- arch/x86/math-emu/reg_u_sub.S | 2 +- arch/x86/math-emu/round_Xsig.S | 4 +- arch/x86/math-emu/shr_Xsig.S | 8 +- arch/x86/math-emu/wm_shrx.S | 16 +- arch/x86/mm/mem_encrypt_boot.S | 6 + arch/x86/net/bpf_jit_comp.c | 185 ++- arch/x86/net/bpf_jit_comp32.c | 22 +- arch/x86/platform/efi/efi_stub_32.S | 2 +- arch/x86/platform/efi/efi_stub_64.S | 2 +- arch/x86/platform/efi/efi_thunk_64.S | 5 +- arch/x86/platform/olpc/xo1-wakeup.S | 6 +- arch/x86/power/hibernate_asm_32.S | 4 +- arch/x86/power/hibernate_asm_64.S | 4 +- arch/x86/um/checksum_32.S | 4 +- arch/x86/um/setjmp_32.S | 2 +- arch/x86/um/setjmp_64.S | 2 +- arch/x86/xen/Makefile | 1 - arch/x86/xen/setup.c | 6 +- arch/x86/xen/xen-asm.S | 43 +- arch/x86/xen/xen-head.S | 6 +- arch/x86/xen/xen-ops.h | 6 +- drivers/base/cpu.c | 8 + drivers/idle/intel_idle.c | 43 +- include/linux/cpu.h | 2 + include/linux/kvm_host.h | 2 +- include/linux/objtool.h | 14 +- samples/ftrace/ftrace-direct-modify.c | 4 +- samples/ftrace/ftrace-direct-too.c | 2 +- samples/ftrace/ftrace-direct.c | 2 +- scripts/Makefile.build | 6 + scripts/link-vmlinux.sh | 6 + security/Kconfig | 11 - tools/arch/x86/include/asm/cpufeatures.h | 12 +- .../arch/x86/include/asm/disabled-features.h | 21 +- tools/arch/x86/include/asm/inat.h | 2 +- tools/arch/x86/include/asm/insn.h | 28 +- tools/arch/x86/include/asm/msr-index.h | 13 + tools/arch/x86/lib/inat.c | 2 +- tools/arch/x86/lib/insn.c | 222 +++- tools/arch/x86/lib/memcpy_64.S | 14 +- tools/arch/x86/lib/memset_64.S | 8 +- .../asm/{alternative-asm.h => alternative.h} | 0 tools/include/linux/kconfig.h | 67 + tools/include/linux/objtool.h | 14 +- .../Documentation/stack-validation.txt | 16 +- tools/objtool/Makefile | 4 - tools/objtool/arch.h | 13 +- tools/objtool/arch/x86/decode.c | 58 +- tools/objtool/builtin-check.c | 6 +- tools/objtool/builtin-orc.c | 6 +- tools/objtool/builtin.h | 3 +- tools/objtool/cfi.h | 2 + tools/objtool/check.c | 1131 +++++++++++++---- tools/objtool/check.h | 35 +- tools/objtool/elf.c | 230 ++-- tools/objtool/elf.h | 20 +- tools/objtool/objtool.c | 2 + tools/objtool/objtool.h | 5 +- tools/objtool/orc_gen.c | 324 ++--- tools/objtool/special.c | 22 +- tools/objtool/sync-check.sh | 17 +- tools/objtool/weak.c | 7 +- tools/perf/check-headers.sh | 15 +- 207 files changed, 4323 insertions(+), 1902 deletions(-) create mode 100644 arch/x86/entry/entry.S delete mode 100644 arch/x86/include/asm/alternative-asm.h create mode 100644 arch/x86/kvm/vmx/run_flags.h rename tools/include/asm/{alternative-asm.h => alternative.h} (100%) create mode 100644 tools/include/linux/kconfig.h -- 2.20.1

1 139

[PATCH RFC v2 openEuler-1.0-LTS 0/6] md: improve performance
by Yu Kuai 16 Sep '22

16 Sep '22

From: Yu Kuai <yukuai3(a)huawei.com> Changes in v2: - fix the problem that if 'nr_pending' is decreased to 0 in wait_barrier_nolock() in patch 1, 'conf->barrier' is not waked, and raise_barrier() can hang while waiting 'nr_pending' to be 0. - only modify hot path in patch 2. - use node 1 as default in patch 6. In some architecture, for example KUNPENG 920, memory access latency is very bad across nodes compare to local node. For consequence, io performance is rather bad while users issue io from multiple nodes if lock contention exist in the driver. This patchset tries to avoid memory access across nodes in driver. Test environment: aarch64 Huawei KUNPENG 920 Raid10 initialize: mdadm --create /dev/md0 --level 10 --bitmap none --raid-devices 4 /dev/nvme0n1 /dev/nvme1n1 /dev/nvme2n1 /dev/nvme3n1 Test cmd: (task set -c 0-15) fio -name=0 -ioengine=libaio -direct=1 -group_reporting=1 -randseed=2022 -rwmixread=70 -refill_buffers -filename=/dev/md0 -numjobs=16 -runtime=60s -bs=4k -iodepth=256 -rw=randread Test result: before this patchset: 3.2 GiB/s bind node before this patchset: 6.9 Gib/s after this patchset: 7.9 Gib/s bind node after this patchset: 8.0 Gib/s Wang ShaoBo (1): arm64/topology: Getting preferred sibling's cpumask supported by platform Yu Kuai (5): md/raid10: convert resync_lock to use seqlock md/raid10: prevent unnecessary calls to wake_up() in fast path block: add new fields in request_queue block: support to dispatch bio asynchronously md: enable dispatching bio asynchronously by default arch/arm64/Kconfig | 8 ++ arch/arm64/include/asm/smp_plat.h | 14 ++ arch/arm64/kernel/smp.c | 9 ++ arch/arm64/kernel/topology.c | 51 +++++++ block/blk-core.c | 212 +++++++++++++++++++++++++++++- block/blk-sysfs.c | 40 ++++++ drivers/md/md.c | 5 + drivers/md/raid10.c | 98 +++++++++----- drivers/md/raid10.h | 2 +- include/linux/arch_topology.h | 7 + include/linux/blkdev.h | 6 + 11 files changed, 420 insertions(+), 32 deletions(-) -- 2.31.1

1 6

subscribe
by hiixfj 16 Sep '22

16 Sep '22

1 0

help
by hiixfj 16 Sep '22

16 Sep '22

1 0

[PATCH openEuler-1.0-LTS] mm: Force TLB flush for PFNMAP mappings before unlink_file_vma()
by Yongqiang Liu 14 Sep '22

14 Sep '22

From: Jann Horn <jannh(a)google.com> stable inclusion from stable-v4.19.257 commit c3b1e88f14e7f442e2ddcbec94527eec84ac0ca3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PE9S CVE: CVE-2022-39188 -------------------------------- commit b67fbebd4cf980aecbcc750e1462128bffe8ae15 upstream. Some drivers rely on having all VMAs through which a PFN might be accessible listed in the rmap for correctness. However, on X86, it was possible for a VMA with stale TLB entries to not be listed in the rmap. This was fixed in mainline with commit b67fbebd4cf9 ("mmu_gather: Force tlb-flush VM_PFNMAP vmas"), but that commit relies on preceding refactoring in commit 18ba064e42df3 ("mmu_gather: Let there be one tlb_{start,end}_vma() implementation") and commit 1e9fdf21a4339 ("mmu_gather: Remove per arch tlb_{start,end}_vma()"). This patch provides equivalent protection without needing that refactoring, by forcing a TLB flush between removing PTEs in unmap_vmas() and the call to unlink_file_vma() in free_pgtables(). [This is a stable-specific rewrite of the upstream commit!] Signed-off-by: Jann Horn <jannh(a)google.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: zuoze <zuoze1(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- mm/mmap.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/mm/mmap.c b/mm/mmap.c index a2699bc10f7b..3bf113a24599 100644 --- a/mm/mmap.c +++ b/mm/mmap.c @@ -2899,6 +2899,18 @@ static void unmap_region(struct mm_struct *mm, tlb_gather_mmu(&tlb, mm, start, end); update_hiwater_rss(mm); unmap_vmas(&tlb, vma, start, end); + + /* + * Ensure we have no stale TLB entries by the time this mapping is + * removed from the rmap. + * Note that we don't have to worry about nested flushes here because + * we're holding the mm semaphore for removing the mapping - so any + * concurrent flush in this region has to be coming through the rmap, + * and we synchronize against that using the rmap lock. + */ + if ((vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) != 0) + tlb_flush_mmu(&tlb); + free_pgtables(&tlb, vma, prev ? prev->vm_end : FIRST_USER_ADDRESS, next ? next->vm_start : USER_PGTABLES_CEILING); tlb_finish_mmu(&tlb, start, end); -- 2.25.1

1 0

[PATCH openEuler-5.10] Script: Add shell script for adding openeuler patch header
by Zheng Zengkai 14 Sep '22

14 Sep '22

script for adding mainline patch header. Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- add-openeuler-patch-header-mainline.sh | 56 ++++++++++++++++++++++++++ 1 file changed, 56 insertions(+) create mode 100755 add-openeuler-patch-header-mainline.sh diff --git a/add-openeuler-patch-header-mainline.sh b/add-openeuler-patch-header-mainline.sh new file mode 100755 index 000000000000..e9352911d242 --- /dev/null +++ b/add-openeuler-patch-header-mainline.sh @@ -0,0 +1,56 @@ +#!/bin/sh + +# +# Usage: +# +# prerequisite: +# +# The patches to add header should be patches from linux mainline. +# +# command (run in the directory where patch files stored): +# add-openeuler-patch-header-mainline.sh commit1..commit2 gitee_issue_url +# +# commit1: mainline start commit id +# commit2: mainline end commit id +# gitee_issue_url: for example: https://gitee.com/openeuler/kernel/issues/I4MKP4 +# +# Example: +# add-openeuler-patch-header-mainline.sh 2c85ebc57b3e..80e78fcce86d https://gitee.com/openeuler/kernel/issues/I5OHOB +# + +for p in `ls *.patch` +do + if [ $p == "0000-cover-letter.patch" ]; then + continue + fi + + title=$(sed '/^Subject: \[PATCH .*\]/{N;s/\n / /g}' $p | grep -E "^Subject: \[PATCH .*\]" | cut -d ']' -f 2) + commit=$(git log --pretty=oneline $1 | grep -F "$title" | cut -d ' ' -f 1) + if [ -n "$multi" ]; then + echo "$p" has multi-commits + commit="multi" + continue + fi + if [ -z "$commit" ]; then + echo "$p" commit is null + commit="null" + continue + fi + + # find insert line + i=5 + while true + do + ln=""$i"p" + sub=`cat $p | sed -n "$ln"` + i=$(($i+1)) + if [ -z "$sub" ]; then + break + fi + done + i=$(($i-1)) + + version=`git name-rev $commit | awk -F '[v~^]' '{print $2}'` + + sed ""$i"a mainline inclusion\nfrom mainline-v$version\ncommit $commit\ncategory: feature\nbugzilla: $2\nCVE: NA\n\n--------------------------------\n" -i $p +done -- 2.20.1

1 0

[PATCH openEuler-5.10-LTS 1/6] KVM: x86: do not report a vCPU as preempted outside instruction boundaries
by Zheng Zengkai 14 Sep '22

14 Sep '22

From: Paolo Bonzini <pbonzini(a)redhat.com> mainline inclusion from mainline-v5.19-rc2 commit 6cd88243c7e03845a450795e134b488fc2afb736 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PJ7H CVE: CVE-2022-39189 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… ---------------------------------------- If a vCPU is outside guest mode and is scheduled out, it might be in the process of making a memory access. A problem occurs if another vCPU uses the PV TLB flush feature during the period when the vCPU is scheduled out, and a virtual address has already been translated but has not yet been accessed, because this is equivalent to using a stale TLB entry. To avoid this, only report a vCPU as preempted if sure that the guest is at an instruction boundary. A rescheduling request will be delivered to the host physical CPU as an external interrupt, so for simplicity consider any vmexit *not* instruction boundary except for external interrupts. It would in principle be okay to report the vCPU as preempted also if it is sleeping in kvm_vcpu_block(): a TLB flush IPI will incur the vmentry/vmexit overhead unnecessarily, and optimistic spinning is also unlikely to succeed. However, leave it for later because right now kvm_vcpu_check_block() is doing memory accesses. Even though the TLB flush issue only applies to virtual memory address, it's very much preferrable to be conservative. Reported-by: Jann Horn <jannh(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> conflict: arch/x86/kvm/x86.c Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: yezengruan <yezengruan(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- arch/x86/include/asm/kvm_host.h | 3 +++ arch/x86/kvm/svm/svm.c | 2 ++ arch/x86/kvm/vmx/vmx.c | 1 + arch/x86/kvm/x86.c | 24 ++++++++++++++++++++++++ 4 files changed, 30 insertions(+) diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h index d90792da5b9e..01544554a4c2 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -551,6 +551,7 @@ struct kvm_vcpu_arch { u64 ia32_misc_enable_msr; u64 smbase; u64 smi_count; + bool at_instruction_boundary; bool tpr_access_reporting; bool xsaves_enabled; u64 ia32_xss; @@ -1072,6 +1073,8 @@ struct kvm_vcpu_stat { u64 utime; u64 stime; u64 gtime; + u64 preemption_reported; + u64 preemption_other; u64 preemption_timer_exits; }; diff --git a/arch/x86/kvm/svm/svm.c b/arch/x86/kvm/svm/svm.c index 2124fe54abfb..5231f40e8312 100644 --- a/arch/x86/kvm/svm/svm.c +++ b/arch/x86/kvm/svm/svm.c @@ -3992,6 +3992,8 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu, static void svm_handle_exit_irqoff(struct kvm_vcpu *vcpu) { + if (to_svm(vcpu)->vmcb->control.exit_code == SVM_EXIT_INTR) + vcpu->arch.at_instruction_boundary = true; } static void svm_sched_in(struct kvm_vcpu *vcpu, int cpu) diff --git a/arch/x86/kvm/vmx/vmx.c b/arch/x86/kvm/vmx/vmx.c index 79889d27aa5b..96693ac066c2 100644 --- a/arch/x86/kvm/vmx/vmx.c +++ b/arch/x86/kvm/vmx/vmx.c @@ -6532,6 +6532,7 @@ static void handle_external_interrupt_irqoff(struct kvm_vcpu *vcpu) return; handle_interrupt_nmi_irqoff(vcpu, gate_offset(desc)); + vcpu->arch.at_instruction_boundary = true; } static void vmx_handle_exit_irqoff(struct kvm_vcpu *vcpu) diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 24c198e70f8e..dac43d92eb81 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -232,6 +232,8 @@ struct kvm_stats_debugfs_item debugfs_entries[] = { VCPU_STAT("l1d_flush", l1d_flush), VCPU_STAT("halt_poll_success_ns", halt_poll_success_ns), VCPU_STAT("halt_poll_fail_ns", halt_poll_fail_ns), + VCPU_STAT("preemption_reported", preemption_reported), + VCPU_STAT("preemption_other", preemption_other), VM_STAT("mmu_shadow_zapped", mmu_shadow_zapped), VM_STAT("mmu_pte_write", mmu_pte_write), VM_STAT("mmu_pde_zapped", mmu_pde_zapped), @@ -286,6 +288,8 @@ struct dfx_kvm_stats_debugfs_item dfx_debugfs_entries[] = { DFX_STAT("stime", stime), DFX_STAT("gtime", gtime), DFX_STAT("preemption_timer_exits", preemption_timer_exits), + DFX_STAT("preemption_reported", preemption_reported), + DFX_STAT("preemption_other", preemption_other), { NULL } }; @@ -4078,6 +4082,19 @@ static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu) struct kvm_host_map map; struct kvm_steal_time *st; + /* + * The vCPU can be marked preempted if and only if the VM-Exit was on + * an instruction boundary and will not trigger guest emulation of any + * kind (see vcpu_run). Vendor specific code controls (conservatively) + * when this is true, for example allowing the vCPU to be marked + * preempted if and only if the VM-Exit was due to a host interrupt. + */ + if (!vcpu->arch.at_instruction_boundary) { + vcpu->stat.preemption_other++; + return; + } + + vcpu->stat.preemption_reported++; if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED)) return; @@ -9306,6 +9323,13 @@ static int vcpu_run(struct kvm_vcpu *vcpu) vcpu->arch.l1tf_flush_l1d = true; for (;;) { + /* + * If another guest vCPU requests a PV TLB flush in the middle + * of instruction emulation, the rest of the emulation could + * use a stale page translation. Assume that any code after + * this point can start executing an instruction. + */ + vcpu->arch.at_instruction_boundary = false; if (kvm_vcpu_running(vcpu)) { r = vcpu_enter_guest(vcpu); } else { -- 2.20.1

1 5

openEuler Kernel SIG例会
by openEuler conference 14 Sep '22

14 Sep '22

您好！ Kernel SIG 邀请您参加 2022-09-16 14:00 召开的Zoom会议(自动录制) 会议主题：openEuler Kernel SIG例会会议内容： 1.调度系列技术分享第三期 -- Linux调度器框架 2.openEuler开源之夏特性 -- 轻量级死锁检测实现 3.openEuler-22.09龙芯支持特性简介会议链接：https://us06web.zoom.us/j/87690719217?pwd=cDN6V3Bhc05DU3lqTmhHYzA2L0RBQT09 会议纪要：https://etherpad.openeuler.org/p/Kernel-meetings 温馨提醒：建议接入会议后修改参会人的姓名，也可以使用您在gitee.com的ID 更多资讯尽在：https://openeuler.org/zh/ Hello! openEuler Kernel SIG invites you to attend the Zoom conference(auto recording) will be held at 2022-09-16 14:00, The subject of the conference is openEuler Kernel SIG例会, Summary: 1.调度系列技术分享第三期 -- Linux调度器框架 2.openEuler开源之夏特性 -- 轻量级死锁检测实现 3.openEuler-22.09龙芯支持特性简介 You can join the meeting at https://us06web.zoom.us/j/87690719217?pwd=cDN6V3Bhc05DU3lqTmhHYzA2L0RBQT09. Add topics at https://etherpad.openeuler.org/p/Kernel-meetings. Note: You are advised to change the participant name after joining the conference or use your ID at gitee.com. More information: https://openeuler.org/en/

1 0

[PATCH openEuler-1.0-LTS] video: fbdev: pxa3xx-gcu: Fix integer overflow in pxa3xx_gcu_write
by Yongqiang Liu 14 Sep '22

14 Sep '22

From: Hyunwoo Kim <imv4bel(a)gmail.com> mainline inclusion from mainline-v5.19-rc4 commit a09d2d00af53b43c6f11e6ab3cb58443c2cac8a7 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PRMO CVE: CVE-2022-39842 --------------------- In pxa3xx_gcu_write, a count parameter of type size_t is passed to words of type int. Then, copy_from_user() may cause a heap overflow because it is used as the third argument of copy_from_user(). Signed-off-by: Hyunwoo Kim <imv4bel(a)gmail.com> Signed-off-by: Helge Deller <deller(a)gmx.de> Signed-off-by: Zhao Wenhui <zhaowenhui8(a)huawei.com> Reviewed-by: Chen Hui <judy.chenhui(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/video/fbdev/pxa3xx-gcu.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/video/fbdev/pxa3xx-gcu.c b/drivers/video/fbdev/pxa3xx-gcu.c index 69cfb337c857..6fe5573e2008 100644 --- a/drivers/video/fbdev/pxa3xx-gcu.c +++ b/drivers/video/fbdev/pxa3xx-gcu.c @@ -394,7 +394,7 @@ pxa3xx_gcu_write(struct file *file, const char *buff, struct pxa3xx_gcu_batch *buffer; struct pxa3xx_gcu_priv *priv = to_pxa3xx_gcu_priv(file); - int words = count / 4; + size_t words = count / 4; /* Does not need to be atomic. There's a lock in user space, * but anyhow, this is just for statistics. */ -- 2.25.1

1 0

[PATCH openEuler-5.10-LTS 000/137] Patches for CVE-2022-29900, CVE-2022-23816
by Zheng Zengkai 14 Sep '22

14 Sep '22

Add patches for CVE-2022-29900, CVE-2022-23816 and CVE-2022-29901. Reference: https://lore.kernel.org/all/CAODzB9qH9WhxQ0eB+mNvmsn64bHXUVppuSTMDGJekYOPCw… https://www.amd.com/system/files/documents/technical-guidance-for-mitigatin… https://www.intel.com/content/www/us/en/developer/articles/technical/softwa… Alexandre Chartre (2): x86/bugs: Report AMD retbleed vulnerability x86/bugs: Add AMD retbleed= boot parameter Andrew Cooper (1): x86/cpu/amd: Enumerate BTC_NO Arnaldo Carvalho de Melo (5): tools arch: Update arch/x86/lib/mem{cpy,set}_64.S copies used in 'perf bench mem memcpy' tools arch x86: Sync the msr-index.h copy with the kernel sources tools headers cpufeatures: Sync with the kernel sources tools arch: Update arch/x86/lib/mem{cpy,set}_64.S copies used in 'perf bench mem memcpy' - again tools headers: Remove broken definition of __LITTLE_ENDIAN Ben Hutchings (3): x86: Add insn_decode_kernel() Makefile: Set retpoline cflags based on CONFIG_CC_IS_{CLANG,GCC} x86/xen: Fix initialisation in hypercall_page after rethunk Borislav Petkov (7): x86/insn: Rename insn_decode() to insn_decode_from_regs() x86/insn: Add a __ignore_sync_check__ marker x86/insn: Add an insn_decode() API x86/alternative: Use insn_decode() x86/alternative: Optimize single-byte NOPs at an arbitrary position kvm/emulate: Fix SETcc emulation function offsets with SLS tools/insn: Restore the relative include paths for cross building Greg Kroah-Hartman (1): x86, kvm: use proper ASM macros for kvm_vcpu_is_preempted Joe Lawrence (1): objtool: Make .altinstructions section entry size consistent Josh Poimboeuf (24): objtool: Refactor ORC section generation objtool: Add 'alt_group' struct objtool: Support stack layout changes in alternatives objtool: Support retpoline jump detection for vmlinux.o objtool: Assume only ELF functions do sibling calls objtool: Combine UNWIND_HINT_RET_OFFSET and UNWIND_HINT_FUNC x86/xen: Support objtool validation in xen-asm.S x86/xen: Support objtool vmlinux.o validation in xen-head.S objtool: Support asm jump tables objtool: Don't make .altinstructions writable objtool: Remove reloc symbol type checks in get_alt_entry() x86/bugs: Do IBPB fallback check only once x86/speculation: Fix RSB filling with CONFIG_RETPOLINE=n x86/speculation: Fix firmware entry SPEC_CTRL handling x86/speculation: Fix SPEC_CTRL write on SMT state change x86/speculation: Use cached host SPEC_CTRL value for guest entry/exit x86/speculation: Remove x86_spec_ctrl_mask objtool: Re-add UNWIND_HINT_{SAVE_RESTORE} KVM: VMX: Flatten __vmx_vcpu_run() KVM: VMX: Convert launched argument to flags KVM: VMX: Prevent guest RSB poisoning attacks with eIBRS KVM: VMX: Fix IBRS handling after vmexit x86/speculation: Fill RSB on vmexit for IBRS x86/ftrace: Add UNWIND_HINT_FUNC annotation for ftrace_stub Juergen Gross (4): x86/alternative: Merge include files x86/alternative: Support not-feature x86/alternative: Support ALTERNATIVE_TERNARY x86/alternative: Use ALTERNATIVE_TERNARY() in _static_cpu_has() Kim Phillips (3): x86/sev: Avoid using __x86_return_thunk x86/bugs: Enable STIBP for JMP2RET x86/bugs: Remove apostrophe typo Konrad Rzeszutek Wilk (1): x86/kexec: Disable RET on kexec Lin Yujun (2): x86: Fix objtool build warning Re-add padlen to the structure alt_instr Linus Torvalds (2): objtool: print out the symbol type when complaining about it kvm: fix objtool relocation warning Nathan Chancellor (1): x86/speculation: Use DECLARE_PER_CPU for x86_spec_ctrl_current Pawan Gupta (3): x86/speculation: Add spectre_v2=ibrs option to support Kernel IBRS x86/bugs: Add Cannon lake to RETBleed affected CPU list x86/speculation: Disable RRSBA behavior Peter Zijlstra (69): x86/alternatives: Optimize optimize_nops() x86/retpoline: Simplify retpolines objtool: Correctly handle retpoline thunk calls objtool: Handle per arch retpoline naming objtool: Rework the elf_rebuild_reloc_section() logic objtool: Add elf_create_reloc() helper objtool: Create reloc sections implicitly objtool: Extract elf_strtab_concat() objtool: Extract elf_symbol_add() objtool: Add elf_create_undef_symbol() objtool: Keep track of retpoline call sites objtool: Cache instruction relocs objtool: Skip magical retpoline .altinstr_replacement objtool/x86: Rewrite retpoline thunk calls objtool: Fix .symtab_shndx handling for elf_create_undef_symbol() objtool: Only rewrite unconditional retpoline thunk calls objtool: Teach get_alt_entry() about more relocation types objtool: Introduce CFI hash objtool: Handle __sanitize_cov*() tail calls objtool: Classify symbols objtool: Explicitly avoid self modifying code in .altinstr_replacement objtool,x86: Replace alternatives with .retpoline_sites objtool/x86: Ignore __x86_indirect_alt_* symbols x86/asm: Fix register order x86/asm: Fixup odd GEN-for-each-reg.h usage x86/retpoline: Move the retpoline thunk declarations to nospec-branch.h x86/retpoline: Create a retpoline thunk array x86/alternative: Implement .retpoline_sites support bpf,x86: Simplify computing label offsets bpf,x86: Respect X86_FEATURE_RETPOLINE* x86/lib/atomic64_386_32: Rename things x86: Prepare asm files for straight-line-speculation x86: Prepare inline-asm for straight-line-speculation x86/alternative: Relax text_poke_bp() constraint objtool: Add straight-line-speculation validation x86: Add straight-line-speculation mitigation objtool: Default ignore INT3 for unreachable crypto: x86/poly1305 - Fixup SLS objtool: Fix SLS validation for kcov tail-call replacement x86/entry: Remove skip_r11rcx x86/kvm/vmx: Make noinstr clean x86/cpufeatures: Move RETPOLINE flags to word 11 x86/retpoline: Cleanup some #ifdefery x86/retpoline: Swizzle retpoline thunk x86/retpoline: Use -mfunction-return x86: Undo return-thunk damage x86,objtool: Create .return_sites x86,static_call: Use alternative RET encoding x86/ftrace: Use alternative RET encoding x86/bpf: Use alternative RET encoding x86/kvm: Fix SETcc emulation for return thunks x86/vsyscall_emu/64: Don't use RET in vsyscall emulation x86: Use return-thunk in asm code objtool: Treat .text.__x86.* as noinstr x86: Add magic AMD return-thunk x86/bugs: Keep a per-CPU IA32_SPEC_CTRL value x86/entry: Add kernel IBRS implementation x86/bugs: Optimize SPEC_CTRL MSR writes x86/bugs: Split spectre_v2_select_mitigation() and spectre_v2_user_select_mitigation() x86/bugs: Report Intel retbleed vulnerability intel_idle: Disable IBRS during long idle objtool: Update Retpoline validation x86/xen: Rename SYS* entry points x86/bugs: Add retbleed=ibpb objtool: Add entry UNRET validation x86/cpu/amd: Add Spectral Chicken x86/common: Stamp out the stepping madness x86/retbleed: Add fine grained Kconfig knobs um: Add missing apply_returns() Thadeu Lima de Souza Cascardo (4): x86/realmode: build with -D__DISABLE_EXPORTS x86/bugs: Do not enable IBPB-on-entry when IBPB is not supported efi/x86: use naked RET on mixed mode call wrapper x86/kvm: fix FASTOP_SIZE when return thunks are enabled Thomas Gleixner (1): x86/static_call: Serialize __static_call_fixup() properly Uros Bizjak (2): KVM/VMX: Use TEST %REG,%REG instead of CMP $0,%REG in vmenter.S KVM/nVMX: Use __vmx_vcpu_run in nested_vmx_check_vmentry_hw Vasily Gorbik (1): objtool: Fix elf_create_undef_symbol() endianness .../admin-guide/kernel-parameters.txt | 25 + Makefile | 20 +- arch/um/kernel/um_arch.c | 8 + arch/x86/Kconfig | 91 +- arch/x86/Makefile | 8 +- arch/x86/boot/compressed/efi_thunk_64.S | 2 +- arch/x86/boot/compressed/head_64.S | 4 +- arch/x86/boot/compressed/mem_encrypt.S | 4 +- arch/x86/crypto/aegis128-aesni-asm.S | 48 +- arch/x86/crypto/aes_ctrby8_avx-x86_64.S | 2 +- arch/x86/crypto/aesni-intel_asm.S | 52 +- arch/x86/crypto/aesni-intel_avx-x86_64.S | 40 +- arch/x86/crypto/blake2s-core.S | 4 +- arch/x86/crypto/blowfish-x86_64-asm_64.S | 12 +- arch/x86/crypto/camellia-aesni-avx-asm_64.S | 18 +- arch/x86/crypto/camellia-aesni-avx2-asm_64.S | 18 +- arch/x86/crypto/camellia-x86_64-asm_64.S | 12 +- arch/x86/crypto/cast5-avx-x86_64-asm_64.S | 12 +- arch/x86/crypto/cast6-avx-x86_64-asm_64.S | 16 +- arch/x86/crypto/chacha-avx2-x86_64.S | 6 +- arch/x86/crypto/chacha-avx512vl-x86_64.S | 6 +- arch/x86/crypto/chacha-ssse3-x86_64.S | 8 +- arch/x86/crypto/crc32-pclmul_asm.S | 2 +- arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 2 +- arch/x86/crypto/crct10dif-pcl-asm_64.S | 2 +- arch/x86/crypto/des3_ede-asm_64.S | 4 +- arch/x86/crypto/ghash-clmulni-intel_asm.S | 6 +- arch/x86/crypto/nh-avx2-x86_64.S | 2 +- arch/x86/crypto/nh-sse2-x86_64.S | 2 +- arch/x86/crypto/poly1305-x86_64-cryptogams.pl | 38 +- arch/x86/crypto/serpent-avx-x86_64-asm_64.S | 16 +- arch/x86/crypto/serpent-avx2-asm_64.S | 16 +- arch/x86/crypto/serpent-sse2-i586-asm_32.S | 6 +- arch/x86/crypto/serpent-sse2-x86_64-asm_64.S | 6 +- arch/x86/crypto/sha1_avx2_x86_64_asm.S | 2 +- arch/x86/crypto/sha1_ni_asm.S | 2 +- arch/x86/crypto/sha1_ssse3_asm.S | 2 +- arch/x86/crypto/sha256-avx-asm.S | 2 +- arch/x86/crypto/sha256-avx2-asm.S | 2 +- arch/x86/crypto/sha256-ssse3-asm.S | 2 +- arch/x86/crypto/sha256_ni_asm.S | 2 +- arch/x86/crypto/sha512-avx-asm.S | 2 +- arch/x86/crypto/sha512-avx2-asm.S | 2 +- arch/x86/crypto/sha512-ssse3-asm.S | 2 +- arch/x86/crypto/twofish-avx-x86_64-asm_64.S | 16 +- arch/x86/crypto/twofish-i586-asm_32.S | 4 +- arch/x86/crypto/twofish-x86_64-asm_64-3way.S | 6 +- arch/x86/crypto/twofish-x86_64-asm_64.S | 4 +- arch/x86/entry/Makefile | 2 +- arch/x86/entry/calling.h | 72 +- arch/x86/entry/entry.S | 22 + arch/x86/entry/entry_32.S | 6 +- arch/x86/entry/entry_64.S | 62 +- arch/x86/entry/entry_64_compat.S | 21 +- arch/x86/entry/thunk_32.S | 2 +- arch/x86/entry/thunk_64.S | 2 +- arch/x86/entry/vdso/Makefile | 1 + arch/x86/entry/vdso/vdso32/system_call.S | 4 +- arch/x86/entry/vsyscall/vsyscall_emu_64.S | 3 + arch/x86/include/asm/GEN-for-each-reg.h | 14 +- arch/x86/include/asm/alternative-asm.h | 114 -- arch/x86/include/asm/alternative.h | 133 +- arch/x86/include/asm/asm-prototypes.h | 17 - arch/x86/include/asm/cpufeature.h | 41 +- arch/x86/include/asm/cpufeatures.h | 12 +- arch/x86/include/asm/disabled-features.h | 21 +- arch/x86/include/asm/inat.h | 2 +- arch/x86/include/asm/insn-eval.h | 4 +- arch/x86/include/asm/insn.h | 28 +- arch/x86/include/asm/linkage.h | 22 + arch/x86/include/asm/msr-index.h | 13 + arch/x86/include/asm/nospec-branch.h | 148 ++- arch/x86/include/asm/paravirt.h | 2 +- arch/x86/include/asm/qspinlock_paravirt.h | 4 +- arch/x86/include/asm/smap.h | 5 +- arch/x86/include/asm/static_call.h | 19 +- arch/x86/include/asm/unwind_hints.h | 23 +- arch/x86/kernel/acpi/wakeup_32.S | 6 +- arch/x86/kernel/alternative.c | 356 +++++- arch/x86/kernel/cpu/amd.c | 46 +- arch/x86/kernel/cpu/bugs.c | 475 ++++++- arch/x86/kernel/cpu/common.c | 61 +- arch/x86/kernel/cpu/cpu.h | 2 + arch/x86/kernel/cpu/hygon.c | 6 + arch/x86/kernel/cpu/scattered.c | 1 + arch/x86/kernel/ftrace.c | 7 +- arch/x86/kernel/ftrace_32.S | 6 +- arch/x86/kernel/ftrace_64.S | 13 +- arch/x86/kernel/head_32.S | 2 +- arch/x86/kernel/head_64.S | 5 + arch/x86/kernel/irqflags.S | 4 +- arch/x86/kernel/kprobes/core.c | 2 +- arch/x86/kernel/kvm.c | 2 +- arch/x86/kernel/module.c | 15 +- arch/x86/kernel/paravirt.c | 2 +- arch/x86/kernel/process.c | 2 +- arch/x86/kernel/relocate_kernel_32.S | 15 +- arch/x86/kernel/relocate_kernel_64.S | 13 +- arch/x86/kernel/sev-es.c | 2 +- arch/x86/kernel/sev_verify_cbit.S | 2 +- arch/x86/kernel/static_call.c | 52 +- arch/x86/kernel/umip.c | 2 +- arch/x86/kernel/verify_cpu.S | 4 +- arch/x86/kernel/vmlinux.lds.S | 23 +- arch/x86/kvm/emulate.c | 39 +- arch/x86/kvm/svm/vmenter.S | 11 +- arch/x86/kvm/vmx/nested.c | 32 +- arch/x86/kvm/vmx/run_flags.h | 8 + arch/x86/kvm/vmx/vmenter.S | 170 +-- arch/x86/kvm/vmx/vmx.c | 78 +- arch/x86/kvm/vmx/vmx.h | 5 + arch/x86/kvm/x86.c | 4 +- arch/x86/lib/atomic64_386_32.S | 88 +- arch/x86/lib/atomic64_cx8_32.S | 18 +- arch/x86/lib/checksum_32.S | 8 +- arch/x86/lib/clear_page_64.S | 6 +- arch/x86/lib/cmpxchg16b_emu.S | 4 +- arch/x86/lib/cmpxchg8b_emu.S | 4 +- arch/x86/lib/copy_mc_64.S | 6 +- arch/x86/lib/copy_page_64.S | 10 +- arch/x86/lib/copy_user_64.S | 14 +- arch/x86/lib/csum-copy_64.S | 2 +- arch/x86/lib/error-inject.c | 3 +- arch/x86/lib/getuser.S | 22 +- arch/x86/lib/hweight.S | 6 +- arch/x86/lib/inat.c | 2 +- arch/x86/lib/insn-eval.c | 6 +- arch/x86/lib/insn.c | 222 +++- arch/x86/lib/iomap_copy_64.S | 2 +- arch/x86/lib/memcpy_64.S | 14 +- arch/x86/lib/memmove_64.S | 11 +- arch/x86/lib/memset_64.S | 8 +- arch/x86/lib/msr-reg.S | 4 +- arch/x86/lib/putuser.S | 6 +- arch/x86/lib/retpoline.S | 118 +- arch/x86/math-emu/div_Xsig.S | 2 +- arch/x86/math-emu/div_small.S | 2 +- arch/x86/math-emu/mul_Xsig.S | 6 +- arch/x86/math-emu/polynom_Xsig.S | 2 +- arch/x86/math-emu/reg_norm.S | 6 +- arch/x86/math-emu/reg_round.S | 2 +- arch/x86/math-emu/reg_u_add.S | 2 +- arch/x86/math-emu/reg_u_div.S | 2 +- arch/x86/math-emu/reg_u_mul.S | 2 +- arch/x86/math-emu/reg_u_sub.S | 2 +- arch/x86/math-emu/round_Xsig.S | 4 +- arch/x86/math-emu/shr_Xsig.S | 8 +- arch/x86/math-emu/wm_shrx.S | 16 +- arch/x86/mm/mem_encrypt_boot.S | 6 + arch/x86/net/bpf_jit_comp.c | 185 ++- arch/x86/net/bpf_jit_comp32.c | 22 +- arch/x86/platform/efi/efi_stub_32.S | 2 +- arch/x86/platform/efi/efi_stub_64.S | 2 +- arch/x86/platform/efi/efi_thunk_64.S | 5 +- arch/x86/platform/olpc/xo1-wakeup.S | 6 +- arch/x86/power/hibernate_asm_32.S | 4 +- arch/x86/power/hibernate_asm_64.S | 4 +- arch/x86/um/checksum_32.S | 4 +- arch/x86/um/setjmp_32.S | 2 +- arch/x86/um/setjmp_64.S | 2 +- arch/x86/xen/Makefile | 1 - arch/x86/xen/setup.c | 6 +- arch/x86/xen/xen-asm.S | 43 +- arch/x86/xen/xen-head.S | 6 +- arch/x86/xen/xen-ops.h | 6 +- drivers/base/cpu.c | 8 + drivers/idle/intel_idle.c | 43 +- include/linux/cpu.h | 2 + include/linux/kvm_host.h | 2 +- include/linux/objtool.h | 14 +- samples/ftrace/ftrace-direct-modify.c | 4 +- samples/ftrace/ftrace-direct-too.c | 2 +- samples/ftrace/ftrace-direct.c | 2 +- scripts/Makefile.build | 6 + scripts/link-vmlinux.sh | 6 + security/Kconfig | 11 - tools/arch/x86/include/asm/cpufeatures.h | 12 +- .../arch/x86/include/asm/disabled-features.h | 21 +- tools/arch/x86/include/asm/inat.h | 2 +- tools/arch/x86/include/asm/insn.h | 28 +- tools/arch/x86/include/asm/msr-index.h | 13 + tools/arch/x86/lib/inat.c | 2 +- tools/arch/x86/lib/insn.c | 222 +++- tools/arch/x86/lib/memcpy_64.S | 14 +- tools/arch/x86/lib/memset_64.S | 8 +- .../asm/{alternative-asm.h => alternative.h} | 0 tools/include/linux/kconfig.h | 67 + tools/include/linux/objtool.h | 14 +- .../Documentation/stack-validation.txt | 16 +- tools/objtool/Makefile | 4 - tools/objtool/arch.h | 13 +- tools/objtool/arch/x86/decode.c | 58 +- tools/objtool/builtin-check.c | 6 +- tools/objtool/builtin-orc.c | 6 +- tools/objtool/builtin.h | 3 +- tools/objtool/cfi.h | 2 + tools/objtool/check.c | 1131 +++++++++++++---- tools/objtool/check.h | 35 +- tools/objtool/elf.c | 230 ++-- tools/objtool/elf.h | 20 +- tools/objtool/objtool.c | 2 + tools/objtool/objtool.h | 5 +- tools/objtool/orc_gen.c | 324 ++--- tools/objtool/special.c | 22 +- tools/objtool/sync-check.sh | 17 +- tools/objtool/weak.c | 7 +- tools/perf/check-headers.sh | 15 +- 207 files changed, 4323 insertions(+), 1902 deletions(-) create mode 100644 arch/x86/entry/entry.S delete mode 100644 arch/x86/include/asm/alternative-asm.h create mode 100644 arch/x86/kvm/vmx/run_flags.h rename tools/include/asm/{alternative-asm.h => alternative.h} (100%) create mode 100644 tools/include/linux/kconfig.h -- 2.20.1

1 137

[PATCH openEuler-1.0-LTS] KVM: x86: do not report a vCPU as preempted outside instruction boundaries
by Yongqiang Liu 14 Sep '22

14 Sep '22

From: Paolo Bonzini <pbonzini(a)redhat.com> mainline inclusion from mainline-v5.19-rc2 commit 6cd88243c7e03845a450795e134b488fc2afb736 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PJ7H CVE: CVE-2022-39189 ---------------------------------------- If a vCPU is outside guest mode and is scheduled out, it might be in the process of making a memory access. A problem occurs if another vCPU uses the PV TLB flush feature during the period when the vCPU is scheduled out, and a virtual address has already been translated but has not yet been accessed, because this is equivalent to using a stale TLB entry. To avoid this, only report a vCPU as preempted if sure that the guest is at an instruction boundary. A rescheduling request will be delivered to the host physical CPU as an external interrupt, so for simplicity consider any vmexit *not* instruction boundary except for external interrupts. It would in principle be okay to report the vCPU as preempted also if it is sleeping in kvm_vcpu_block(): a TLB flush IPI will incur the vmentry/vmexit overhead unnecessarily, and optimistic spinning is also unlikely to succeed. However, leave it for later because right now kvm_vcpu_check_block() is doing memory accesses. Even though the TLB flush issue only applies to virtual memory address, it's very much preferrable to be conservative. Reported-by: Jann Horn <jannh(a)google.com> Signed-off-by: Paolo Bonzini <pbonzini(a)redhat.com> conflict: arch/x86/include/asm/kvm_host.h arch/x86/kvm/svm.c arch/x86/kvm/vmx.c arch/x86/kvm/x86.c Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- arch/x86/include/asm/kvm_host.h | 3 +++ arch/x86/kvm/svm.c | 3 +++ arch/x86/kvm/vmx.c | 1 + arch/x86/kvm/x86.c | 25 +++++++++++++++++++++++++ 4 files changed, 32 insertions(+) diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h index 6549c20c958c..7afb2cb2d42c 100644 --- a/arch/x86/include/asm/kvm_host.h +++ b/arch/x86/include/asm/kvm_host.h @@ -520,6 +520,7 @@ struct kvm_vcpu_arch { u64 ia32_misc_enable_msr; u64 smbase; u64 smi_count; + bool at_instruction_boundary; bool tpr_access_reporting; u64 ia32_xss; u64 microcode_version; @@ -935,6 +936,8 @@ struct kvm_vcpu_stat { u64 utime; u64 stime; u64 gtime; + u64 preemption_reported; + u64 preemption_other; }; struct x86_instruction_info; diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c index 46567343680f..f611ecdfc145 100644 --- a/arch/x86/kvm/svm.c +++ b/arch/x86/kvm/svm.c @@ -6205,6 +6205,9 @@ static int svm_check_intercept(struct kvm_vcpu *vcpu, static void svm_handle_external_intr(struct kvm_vcpu *vcpu) { + if (to_svm(vcpu)->vmcb->control.exit_code == SVM_EXIT_INTR) + vcpu->arch.at_instruction_boundary = true; + local_irq_enable(); /* * We must have an instruction with interrupts enabled, so diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c index 7ab18b5a8e96..4164016cf105 100644 --- a/arch/x86/kvm/vmx.c +++ b/arch/x86/kvm/vmx.c @@ -10597,6 +10597,7 @@ static void vmx_handle_external_intr(struct kvm_vcpu *vcpu) [cs]"i"(__KERNEL_CS) ); } + vcpu->arch.at_instruction_boundary = true; } STACK_FRAME_NON_STANDARD(vmx_handle_external_intr); diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c index 5da2811219ec..c61cab768d2a 100644 --- a/arch/x86/kvm/x86.c +++ b/arch/x86/kvm/x86.c @@ -186,6 +186,8 @@ struct kvm_stats_debugfs_item debugfs_entries[] = { { "halt_successful_poll", VCPU_STAT(halt_successful_poll) }, { "halt_attempted_poll", VCPU_STAT(halt_attempted_poll) }, { "halt_poll_invalid", VCPU_STAT(halt_poll_invalid) }, + { "preemption_reported", VCPU_STAT(preemption_reported) }, + { "preemption_other", VCPU_STAT(preemption_other) }, { "halt_wakeup", VCPU_STAT(halt_wakeup) }, { "hypercalls", VCPU_STAT(hypercalls) }, { "request_irq", VCPU_STAT(request_irq_exits) }, @@ -231,6 +233,8 @@ struct dfx_kvm_stats_debugfs_item dfx_debugfs_entries[] = { DFX_STAT("halt_exits", halt_exits), DFX_STAT("halt_successful_poll", halt_successful_poll), DFX_STAT("halt_attempted_poll", halt_attempted_poll), + DFX_STAT("preemption_reported", preemption_reported), + DFX_STAT("preemption_other", preemption_other), DFX_STAT("halt_wakeup", halt_wakeup), DFX_STAT("request_irq", request_irq_exits), DFX_STAT("irq_exits", irq_exits), @@ -3314,6 +3318,20 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu) static void kvm_steal_time_set_preempted(struct kvm_vcpu *vcpu) { + /* + * The vCPU can be marked preempted if and only if the VM-Exit was on + * an instruction boundary and will not trigger guest emulation of any + * kind (see vcpu_run). Vendor specific code controls (conservatively) + * when this is true, for example allowing the vCPU to be marked + * preempted if and only if the VM-Exit was due to a host interrupt. + */ + if (!vcpu->arch.at_instruction_boundary) { + vcpu->stat.preemption_other++; + return; + } + + vcpu->stat.preemption_reported++; + if (!(vcpu->arch.st.msr_val & KVM_MSR_ENABLED)) return; @@ -7920,6 +7938,13 @@ static int vcpu_run(struct kvm_vcpu *vcpu) vcpu->arch.l1tf_flush_l1d = true; for (;;) { + /* + * If another guest vCPU requests a PV TLB flush in the middle + * of instruction emulation, the rest of the emulation could + * use a stale page translation. Assume that any code after + * this point can start executing an instruction. + */ + vcpu->arch.at_instruction_boundary = false; if (kvm_vcpu_running(vcpu)) { r = vcpu_enter_guest(vcpu); } else { -- 2.25.1

1 0

[PATCH] KVM: arm64: Write arch.mdcr_el2 changes since last vcpu_load on VHE
by Laibin Qiu 14 Sep '22

14 Sep '22

From: Andrew Murray <andrew.murray(a)arm.com> mainline inclusion from mainline-v5.6 commit 4942dc6638b07b5326b6d2faa142635c559e7cd5 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5QR6C CVE: NA ------------- On VHE systems arch.mdcr_el2 is written to mdcr_el2 at vcpu_load time to set options for self-hosted debug and the performance monitors extension. Unfortunately the value of arch.mdcr_el2 is not calculated until kvm_arm_setup_debug() in the run loop after the vcpu has been loaded. This means that the initial brief iterations of the run loop use a zero value of mdcr_el2 - until the vcpu is preempted. This also results in a delay between changes to vcpu->guest_debug taking effect. Fix this by writing to mdcr_el2 in kvm_arm_setup_debug() on VHE systems when a change to arch.mdcr_el2 has been detected. Fixes: d5a21bcc2995 ("KVM: arm64: Move common VHE/non-VHE trap config in separate functions") Cc: <stable(a)vger.kernel.org> # 4.17.x- Suggested-by: James Morse <james.morse(a)arm.com> Acked-by: Will Deacon <will(a)kernel.org> Reviewed-by: Marc Zyngier <maz(a)kernel.org> Signed-off-by: Andrew Murray <andrew.murray(a)arm.com> Signed-off-by: Catalin Marinas <catalin.marinas(a)arm.com> Signed-off-by: Zengruan Ye <yezengruan(a)huawei.com> Reviewed-by: Keqian Zhu <zhukeqian1(a)huawei.com> Signed-off-by: Laibin Qiu <qiulaibin(a)huawei.com> --- arch/arm64/kvm/debug.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/arch/arm64/kvm/debug.c b/arch/arm64/kvm/debug.c index 00d422336a45..4e722d73a3c3 100644 --- a/arch/arm64/kvm/debug.c +++ b/arch/arm64/kvm/debug.c @@ -112,7 +112,7 @@ void kvm_arm_reset_debug_ptr(struct kvm_vcpu *vcpu) void kvm_arm_setup_debug(struct kvm_vcpu *vcpu) { bool trap_debug = !(vcpu->arch.flags & KVM_ARM64_DEBUG_DIRTY); - unsigned long mdscr; + unsigned long mdscr, orig_mdcr_el2 = vcpu->arch.mdcr_el2; trace_kvm_arm_setup_debug(vcpu, vcpu->guest_debug); @@ -208,6 +208,10 @@ void kvm_arm_setup_debug(struct kvm_vcpu *vcpu) if (vcpu_read_sys_reg(vcpu, MDSCR_EL1) & (DBG_MDSCR_KDE | DBG_MDSCR_MDE)) vcpu->arch.flags |= KVM_ARM64_DEBUG_DIRTY; + /* Write mdcr_el2 changes since vcpu_load on VHE systems */ + if (has_vhe() && orig_mdcr_el2 != vcpu->arch.mdcr_el2) + write_sysreg(vcpu->arch.mdcr_el2, mdcr_el2); + trace_kvm_arm_set_dreg32("MDCR_EL2", vcpu->arch.mdcr_el2); trace_kvm_arm_set_dreg32("MDSCR_EL1", vcpu_read_sys_reg(vcpu, MDSCR_EL1)); } -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] perf bench futex-wake: Restore thread count default to online CPU count
by tangbin 13 Sep '22

13 Sep '22

From: Tommi Rantala <tommi.t.rantala(a)nokia.com> stable inclusion from stable-v4.19.111 commit 5e8dff99645e574122aef5dec91b8803339a6362 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5QSAP CVE: NA -------------------------------- commit f649bd9dd5d5004543bbc3c50b829577b49f5d75 upstream. Since commit 3b2323c2c1c4 ("perf bench futex: Use cpumaps") the default number of threads the benchmark uses got changed from number of online CPUs to zero: $ perf bench futex wake # Running 'futex/wake' benchmark: Run summary [PID 15930]: blocking on 0 threads (at [private] futex 0x558b8ee4bfac), waking up 1 at a time. [Run 1]: Wokeup 0 of 0 threads in 0.0000 ms [...] [Run 10]: Wokeup 0 of 0 threads in 0.0000 ms Wokeup 0 of 0 threads in 0.0004 ms (+-40.82%) Restore the old behavior by grabbing the number of online CPUs via cpu->nr: $ perf bench futex wake # Running 'futex/wake' benchmark: Run summary [PID 18356]: blocking on 8 threads (at [private] futex 0xb3e62c), waking up 1 at a time. [Run 1]: Wokeup 8 of 8 threads in 0.0260 ms [...] [Run 10]: Wokeup 8 of 8 threads in 0.0270 ms Wokeup 8 of 8 threads in 0.0419 ms (+-24.35%) Fixes: 3b2323c2c1c4 ("perf bench futex: Use cpumaps") Signed-off-by: Tommi Rantala <tommi.t.rantala(a)nokia.com> Tested-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> Cc: Alexander Shishkin <alexander.shishkin(a)linux.intel.com> Cc: Darren Hart <dvhart(a)infradead.org> Cc: Davidlohr Bueso <dave(a)stgolabs.net> Cc: Jiri Olsa <jolsa(a)redhat.com> Cc: Mark Rutland <mark.rutland(a)arm.com> Cc: Namhyung Kim <namhyung(a)kernel.org> Cc: Peter Zijlstra <peterz(a)infradead.org> Cc: Thomas Gleixner <tglx(a)linutronix.de> Link: http://lore.kernel.org/lkml/20200305083714.9381-3-tommi.t.rantala@nokia.com Signed-off-by: Arnaldo Carvalho de Melo <acme(a)redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: tangbin <tangbin(a)cmss.chinamobile.com> --- tools/perf/bench/futex-wake.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tools/perf/bench/futex-wake.c b/tools/perf/bench/futex-wake.c index e8181ad7d088..e62006342b18 100644 --- a/tools/perf/bench/futex-wake.c +++ b/tools/perf/bench/futex-wake.c @@ -42,7 +42,7 @@ static bool done = false, silent = false, fshared = false; static pthread_mutex_t thread_lock; static pthread_cond_t thread_parent, thread_worker; static struct stats waketime_stats, wakeup_stats; -static unsigned int ncpus, threads_starting, nthreads = 0; +static unsigned int threads_starting, nthreads = 0; static int futex_flag = 0; static const struct option options[] = { @@ -140,7 +140,7 @@ int bench_futex_wake(int argc, const char **argv) sigaction(SIGINT, &act, NULL); if (!nthreads) - nthreads = ncpus; + nthreads = cpu->nr; worker = calloc(nthreads, sizeof(*worker)); if (!worker) -- 2.18.4

1 0

[PATCH openEuler-1.0-LTS] netfilter: nf_conntrack_irc: Tighten matching on DCC message
by Yongqiang Liu 13 Sep '22

13 Sep '22

From: David Leadbeater <dgl(a)dgl.cx> mainline inclusion from mainline-v6.0-rc6 commit e8d5dfd1d8747b56077d02664a8838c71ced948e category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5OWZ7 CVE: CVE-2022-2663 --------------------------- CTCP messages should only be at the start of an IRC message, not anywhere within it. While the helper only decodes packes in the ORIGINAL direction, its possible to make a client send a CTCP message back by empedding one into a PING request. As-is, thats enough to make the helper believe that it saw a CTCP message. Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port") Signed-off-by: David Leadbeater <dgl(a)dgl.cx> Signed-off-by: Florian Westphal <fw(a)strlen.de> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- net/netfilter/nf_conntrack_irc.c | 34 ++++++++++++++++++++++++++------ 1 file changed, 28 insertions(+), 6 deletions(-) diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c index 4099f4d79bae..819fc0df233f 100644 --- a/net/netfilter/nf_conntrack_irc.c +++ b/net/netfilter/nf_conntrack_irc.c @@ -150,15 +150,37 @@ static int help(struct sk_buff *skb, unsigned int protoff, data = ib_ptr; data_limit = ib_ptr + skb->len - dataoff; - /* strlen("\1DCC SENT t AAAAAAAA P\1\n")=24 - * 5+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=14 */ - while (data < data_limit - (19 + MINMATCHLEN)) { - if (memcmp(data, "\1DCC ", 5)) { + /* Skip any whitespace */ + while (data < data_limit - 10) { + if (*data == ' ' || *data == '\r' || *data == '\n') + data++; + else + break; + } + + /* strlen("PRIVMSG x ")=10 */ + if (data < data_limit - 10) { + if (strncasecmp("PRIVMSG ", data, 8)) + goto out; + data += 8; + } + + /* strlen(" :\1DCC SENT t AAAAAAAA P\1\n")=26 + * 7+MINMATCHLEN+strlen("t AAAAAAAA P\1\n")=26 + */ + while (data < data_limit - (21 + MINMATCHLEN)) { + /* Find first " :", the start of message */ + if (memcmp(data, " :", 2)) { data++; continue; } + data += 2; + + /* then check that place only for the DCC command */ + if (memcmp(data, "\1DCC ", 5)) + goto out; data += 5; - /* we have at least (19+MINMATCHLEN)-5 bytes valid data left */ + /* we have at least (21+MINMATCHLEN)-(2+5) bytes valid data left */ iph = ip_hdr(skb); pr_debug("DCC found in master %pI4:%u %pI4:%u\n", @@ -174,7 +196,7 @@ static int help(struct sk_buff *skb, unsigned int protoff, pr_debug("DCC %s detected\n", dccprotos[i]); /* we have at least - * (19+MINMATCHLEN)-5-dccprotos[i].matchlen bytes valid + * (21+MINMATCHLEN)-7-dccprotos[i].matchlen bytes valid * data left (== 14/13 bytes) */ if (parse_dcc(data, data_limit, &dcc_ip, &dcc_port, &addr_beg_p, &addr_end_p)) { -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] selftests/bpf: Enlarge select() timeout for test_maps
by tangbin 13 Sep '22

13 Sep '22

From: Li Zhijian <lizhijian(a)cn.fujitsu.com> stable inclusion from stable-v4.19.207 commit 4c48bd3aa1a33cb3e8a0eca8330b8f100f43d895 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I5QR5E CVE: NA -------------------------------- commit 2d82d73da35b72b53fe0d96350a2b8d929d07e42 0Day robot observed that it's easily timeout on a heavy load host. ------------------- # selftests: bpf: test_maps # Fork 1024 tasks to 'test_update_delete' # Fork 1024 tasks to 'test_update_delete' # Fork 100 tasks to 'test_hashmap' # Fork 100 tasks to 'test_hashmap_percpu' # Fork 100 tasks to 'test_hashmap_sizes' # Fork 100 tasks to 'test_hashmap_walk' # Fork 100 tasks to 'test_arraymap' # Fork 100 tasks to 'test_arraymap_percpu' # Failed sockmap unexpected timeout not ok 3 selftests: bpf: test_maps # exit=1 # selftests: bpf: test_lru_map # nr_cpus:8 ------------------- Since this test will be scheduled by 0Day to a random host that could have only a few cpus(2-8), enlarge the timeout to avoid a false NG report. In practice, i tried to pin it to only one cpu by 'taskset 0x01 ./test_maps', and knew 10S is likely enough, but i still perfer to a larger value 30. Reported-by: kernel test robot <lkp(a)intel.com> Signed-off-by: Li Zhijian <lizhijian(a)cn.fujitsu.com> Signed-off-by: Alexei Starovoitov <ast(a)kernel.org> Acked-by: Song Liu <songliubraving(a)fb.com> Link: https://lore.kernel.org/bpf/20210820015556.23276-2-lizhijian@cn.fujitsu.com Signed-off-by: tangbin <tangbin(a)cmss.chinamobile.com> --- tools/testing/selftests/bpf/test_maps.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c index 9b552c0fc47d..e5e62cb57ff7 100644 --- a/tools/testing/selftests/bpf/test_maps.c +++ b/tools/testing/selftests/bpf/test_maps.c @@ -796,7 +796,7 @@ static void test_sockmap(int tasks, void *data) FD_ZERO(&w); FD_SET(sfd[3], &w); - to.tv_sec = 1; + to.tv_sec = 30; to.tv_usec = 0; s = select(sfd[3] + 1, &w, NULL, NULL, &to); if (s == -1) { -- 2.18.4

1 0

[PATCH openEuler-5.10 1/3] netfilter: nf_tables: do not allow SET_ID to refer to another table
by Zheng Zengkai 13 Sep '22

13 Sep '22

From: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> stable inclusion from stable-v5.10.137 commit 1a4b18b1ff11ba26f9a852019d674fde9d1d1cff category: bugfix bugzilla: 187457, https://gitee.com/src-openeuler/kernel/issues/I5MEZD CVE: CVE-2022-2586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2 upstream. When doing lookups for sets on the same batch by using its ID, a set from a different table can be used. Then, when the table is removed, a reference to the set may be kept after the set is freed, leading to a potential use-after-free. When looking for sets by ID, use the table that was used for the lookup by name, and only return sets belonging to that same table. This fixes CVE-2022-2586, also reported as ZDI-CAN-17470. Reported-by: Team Orca of Sea Security (@seasecresponse) Fixes: 958bee14d071 ("netfilter: nf_tables: use new transaction infrastructure to handle sets") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Lu Wei <luwei32(a)huawei.com> Reviewed-by: Wei Yongjun <weiyongjun1(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> --- net/netfilter/nf_tables_api.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 560a93aad5b6..7b0497da2d94 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3638,6 +3638,7 @@ static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table, } static struct nft_set *nft_set_lookup_byid(const struct net *net, + const struct nft_table *table, const struct nlattr *nla, u8 genmask) { struct nft_trans *trans; @@ -3648,6 +3649,7 @@ static struct nft_set *nft_set_lookup_byid(const struct net *net, struct nft_set *set = nft_trans_set(trans); if (id == nft_trans_set_id(trans) && + set->table == table && nft_active_genmask(set, genmask)) return set; } @@ -3668,7 +3670,7 @@ struct nft_set *nft_set_lookup_global(const struct net *net, if (!nla_set_id) return set; - set = nft_set_lookup_byid(net, nla_set_id, genmask); + set = nft_set_lookup_byid(net, table, nla_set_id, genmask); } return set; } -- 2.20.1

1 2

[PATCH openEuler-22.09] Add openEuler header script for LoongArch
by Zheng Zengkai 13 Sep '22

13 Sep '22

Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- add-openeuler-head_loongarch.py | 39 +++++++++++++++++++ modify_message_loongarch.py | 62 ++++++++++++++++++++++++++++++ usage | 68 +++++++++++++++++++++++++++++++++ 3 files changed, 169 insertions(+) create mode 100755 add-openeuler-head_loongarch.py create mode 100755 modify_message_loongarch.py create mode 100644 usage diff --git a/add-openeuler-head_loongarch.py b/add-openeuler-head_loongarch.py new file mode 100755 index 000000000000..8219f6b6d8d2 --- /dev/null +++ b/add-openeuler-head_loongarch.py @@ -0,0 +1,39 @@ +#!/usr/local/bin/python3 + +import argparse +import sys +import os +import textwrap + +dir = os.path.split(os.path.realpath(__file__))[0] + +def parser_arg(): + parser = argparse.ArgumentParser( + formatter_class=argparse.RawDescriptionHelpFormatter, + description=textwrap.dedent('''\ + Use git rebase to add header for commits on current branch + Note: + Make sure modify_message_loonarch.py be in the same dir + ''')) + + parser.add_argument('-n', type=str, default="", help='add head to last n patch') + parser.add_argument('--bugzilla', type=str, help='bugzilla id', required=True) + return parser.parse_args() + +def main(): + args = parser_arg() + + if args.n == "": + args.n = os.popen("git log --oneline origin/openEuler-22.09..HEAD | wc -l").readline().strip("\n") + + command ="git rebase --onto HEAD~" + args.n + " HEAD~" + args.n + " --exec \"" + command += dir + "/modify_message_loongarch.py " + command += " --bugzilla " + args.bugzilla + " " + command += "\"" + print(command) + os.system(command) + +if __name__ == "__main__": + # execute only if run as a script + main() + diff --git a/modify_message_loongarch.py b/modify_message_loongarch.py new file mode 100755 index 000000000000..6853178794f7 --- /dev/null +++ b/modify_message_loongarch.py @@ -0,0 +1,62 @@ +#!/usr/local/bin/python3 + +import argparse +import sys +import os +import re + +def parser_arg(): + parser = argparse.ArgumentParser(description='add head to last patch') + parser.add_argument('--bugzilla', type=str, help='bugzilla id', required=True) + return parser.parse_args() + +args = parser_arg() + +def add_head_loongarch(title): + head = [ + "LoongArch inclusion\n", + "category: feature\n", + "bugzilla: " + args.bugzilla + "\n", + "\n", + "--------------------------------\n", + "\n", + ] + return head + +def add_head(): + MSG = ".git/TEMP_COMMIT_MSG" + message = os.popen("git log -n 1 --pretty=%B").readlines() + find = 0 + + title = message[0].strip("\n"); + + # there is areadly a head + if title[0] == "[": + return + + if find == 0: + head = add_head_loongarch(title) + if head: + find = 1 + + if message[1] == "\t\n": + post = 1; + else: + post = 2; + + message[post:post] = head + + f = open(MSG, 'w') + for line in message: + f.write(line) + f.close() + + os.system("git commit --amend -F " + MSG) + +def main(): + add_head() + return 0 + +if __name__ == "__main__": + # execute only if run as a script + main() diff --git a/usage b/usage new file mode 100644 index 000000000000..97c9bd7e05da --- /dev/null +++ b/usage @@ -0,0 +1,68 @@ +Usage: +./add-openeuler-head_loongarch.py -n=2 --bugzilla=https://gitee.com/openeuler/kernel/issues/I5OHOB + +-n to specify the number of patches to add header to. + +before adding header: + +commit f0f6daca3f4677e3aa2817e204e2281d0d999614 +Author: Hongchen Zhang <zhanghongchen(a)loongson.cn> +Date: Thu Sep 8 14:32:38 2022 +0800 + + irqchip: fix phytium 2500 compile error + + commit 75378552d2ee ("APCI: irq: Add support for multiple GSI domains") + changed the parameter type,fix it accordingly. + + Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> + +commit 6c3213c6068534e84e65cf1f2aff0ed18810cc4b +Author: Hongchen Zhang <zhanghongchen(a)loongson.cn> +Date: Wed Sep 7 13:24:03 2022 +0800 + + LoongArch: defconfig: add openeuler default config + + add openeuler default config for LoongArch,the difference with + loongson3_defconfig is following: + CONFIG_DEBUG_INFO=y + CONFIG_MODULE_SIG=y + + Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> + +After adding header: + +commit 94e56df31f6c6b8177687b7f7db6362d62183cd5 (HEAD -> openEuler-22.09) +Author: Hongchen Zhang <zhanghongchen(a)loongson.cn> +Date: Thu Sep 8 14:32:38 2022 +0800 + + irqchip: fix phytium 2500 compile error + + LoongArch inclusion + category: feature + bugzilla: https://gitee.com/openeuler/kernel/issues/I5OHOB + + -------------------------------- + + commit 75378552d2ee ("APCI: irq: Add support for multiple GSI domains") + changed the parameter type,fix it accordingly. + + Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> + +commit 7e7e79233dce5cef575c35ab40b67982919eb1ca +Author: Hongchen Zhang <zhanghongchen(a)loongson.cn> +Date: Wed Sep 7 13:24:03 2022 +0800 + + LoongArch: defconfig: add openeuler default config + + LoongArch inclusion + category: feature + bugzilla: https://gitee.com/openeuler/kernel/issues/I5OHOB + + -------------------------------- + + add openeuler default config for LoongArch,the difference with + loongson3_defconfig is following: + CONFIG_DEBUG_INFO=y + CONFIG_MODULE_SIG=y + + Signed-off-by: Hongchen Zhang <zhanghongchen(a)loongson.cn> -- 2.20.1

1 0

[PATCH openEuler-22.09 0/6] tools/bpftool: Add BTF_KIND_FLOAT support
by Zheng Zengkai 08 Sep '22

08 Sep '22

Some BPF programs compiled on s390 fail to load, because s390 arch-specific linux headers contain float and double types. Introduce support for such types by representing them using the new BTF_KIND_FLOAT. This series deals with libbpf, bpftool, in-kernel BTF parser as well as selftests and documentation. Ilya Leoshkevich (6): tools/bpftool: Add BTF_KIND_FLOAT support selftests/bpf: Use the 25th bit in the "invalid BTF_INFO" test bpf: Add BTF_KIND_FLOAT support selftest/bpf: Add BTF_KIND_FLOAT tests selftests/bpf: Add BTF_KIND_FLOAT to the existing deduplication tests bpf: Document BTF_KIND_FLOAT in btf.rst Documentation/bpf/btf.rst | 17 +- kernel/bpf/btf.c | 83 ++++++++- tools/bpf/bpftool/btf.c | 8 + tools/bpf/bpftool/btf_dumper.c | 1 + tools/testing/selftests/bpf/btf_helpers.c | 4 + tools/testing/selftests/bpf/prog_tests/btf.c | 176 +++++++++++++++++-- tools/testing/selftests/bpf/test_btf.h | 3 + 7 files changed, 275 insertions(+), 17 deletions(-) -- 2.20.1

1 6

[OLK-5.10,0/3] Fix CVE-2022-2586
by Lu Wei 07 Sep '22

07 Sep '22

Thadeu Lima de Souza Cascardo (3): netfilter: nf_tables: do not allow SET_ID to refer to another table netfilter: nf_tables: do not allow CHAIN_ID to refer to another table netfilter: nf_tables: do not allow RULE_ID to refer to another chain net/netfilter/nf_tables_api.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) -- 2.31.1

1 3

[PATCH openEuler-5.10-LTS 1/3] netfilter: nf_tables: do not allow SET_ID to refer to another table
by Zheng Zengkai 07 Sep '22

07 Sep '22

From: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> mainline inclusion from mainline-v6.0-rc1 commit 470ee20e069a6d05ae549f7d0ef2bdbcee6a81b2 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5MEZD CVE: CVE-2022-2586 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When doing lookups for sets on the same batch by using its ID, a set from a different table can be used. Then, when the table is removed, a reference to the set may be kept after the set is freed, leading to a potential use-after-free. When looking for sets by ID, use the table that was used for the lookup by name, and only return sets belonging to that same table. This fixes CVE-2022-2586, also reported as ZDI-CAN-17470. Reported-by: Team Orca of Sea Security (@seasecresponse) Fixes: 958bee14d071 ("netfilter: nf_tables: use new transaction infrastructure to handle sets") Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo(a)canonical.com> Cc: <stable(a)vger.kernel.org> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> conflict: net/netfilter/nf_tables_api.c Signed-off-by: Lu Wei <luwei32(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- net/netfilter/nf_tables_api.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c index 560a93aad5b6..7b0497da2d94 100644 --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3638,6 +3638,7 @@ static struct nft_set *nft_set_lookup_byhandle(const struct nft_table *table, } static struct nft_set *nft_set_lookup_byid(const struct net *net, + const struct nft_table *table, const struct nlattr *nla, u8 genmask) { struct nft_trans *trans; @@ -3648,6 +3649,7 @@ static struct nft_set *nft_set_lookup_byid(const struct net *net, struct nft_set *set = nft_trans_set(trans); if (id == nft_trans_set_id(trans) && + set->table == table && nft_active_genmask(set, genmask)) return set; } @@ -3668,7 +3670,7 @@ struct nft_set *nft_set_lookup_global(const struct net *net, if (!nla_set_id) return set; - set = nft_set_lookup_byid(net, nla_set_id, genmask); + set = nft_set_lookup_byid(net, table, nla_set_id, genmask); } return set; } -- 2.20.1

1 2

[PATCH openEuler-1.0-LTS 00/64] linux-4.19.y inclusion
by Yongqiang Liu 07 Sep '22

07 Sep '22

*** BLURB HERE *** Chen Zhongjin (2): profiling: fix shift too large makes kernel panic kprobes: Forbid probing on trampoline and BPF code areas Dan Carpenter (1): kfifo: fix kfifo_to_user() return type David Howells (1): vfs: Check the truncate maximum size in inode_newsize_ok() Duoming Zhou (1): mtd: sm_ftl: Fix deadlock caused by cancel_work_sync in sm_release Eric Dumazet (1): tcp: fix over estimation in sk_forced_mem_schedule() Eric Whitney (1): ext4: fix extent status tree race in writeback error recovery path Hector Martin (1): locking/atomic: Make test_and_*_bit() ordered on failure Ilpo Järvinen (1): serial: 8250_dw: Store LSR into lsr_saved_flags in dw8250_tx_wait_empty() Jason A. Donenfeld (1): fs: check FMODE_LSEEK to control internal pipe splicing Johan Hovold (1): x86/pmem: Fix platform-device leak in error path Kiselev, Oleg (1): ext4: avoid resizing to a partial cluster size Kuniyuki Iwashima (36): ip: Fix data-races around sysctl_ip_fwd_use_pmtu. ip: Fix data-races around sysctl_ip_nonlocal_bind. ip: Fix a data-race around sysctl_fwmark_reflect. tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept. tcp: Fix data-races around sysctl_tcp_mtu_probing. tcp: Fix a data-race around sysctl_tcp_probe_threshold. tcp: Fix a data-race around sysctl_tcp_probe_interval. igmp: Fix data-races around sysctl_igmp_llm_reports. igmp: Fix a data-race around sysctl_igmp_max_memberships. tcp: Fix data-races around sysctl_tcp_reordering. tcp: Fix data-races around some timeout sysctl knobs. tcp: Fix a data-race around sysctl_tcp_notsent_lowat. tcp: Fix a data-race around sysctl_tcp_tw_reuse. tcp: Fix data-races around sysctl_tcp_fastopen. tcp: Fix a data-race around sysctl_tcp_early_retrans. tcp: Fix data-races around sysctl_tcp_recovery. tcp: Fix a data-race around sysctl_tcp_thin_linear_timeouts. tcp: Fix data-races around sysctl_tcp_slow_start_after_idle. tcp: Fix a data-race around sysctl_tcp_retrans_collapse. tcp: Fix a data-race around sysctl_tcp_stdurg. tcp: Fix a data-race around sysctl_tcp_rfc1337. tcp: Fix data-races around sysctl_tcp_max_reordering. tcp: Fix data-races around sysctl_tcp_dsack. tcp: Fix a data-race around sysctl_tcp_app_win. tcp: Fix a data-race around sysctl_tcp_adv_win_scale. tcp: Fix a data-race around sysctl_tcp_frto. tcp: Fix a data-race around sysctl_tcp_nometrics_save. tcp: Fix a data-race around sysctl_tcp_challenge_ack_limit. net: ping6: Fix memleak in ipv6_renew_options(). igmp: Fix data-races around sysctl_igmp_qrv. tcp: Fix a data-race around sysctl_tcp_min_tso_segs. tcp: Fix a data-race around sysctl_tcp_min_rtt_wlen. tcp: Fix a data-race around sysctl_tcp_autocorking. tcp: Fix a data-race around sysctl_tcp_invalid_ratelimit. tcp: Fix a data-race around sysctl_tcp_comp_sack_delay_ns. tcp: Fix a data-race around sysctl_tcp_comp_sack_nr. Lukas Czerner (1): ext4: make sure ext4_append() always allocates new block Matthias May (1): geneve: do not use RT_TOS for IPv6 flowlabel Miaohe Lin (1): mm/mmap.c: fix missing call to vm_unacct_memory in mmap_region Nicolas Saenz Julienne (1): nohz/full, sched/rt: Fix missed tick-reenabling bug in dequeue_task_rt() Theodore Ts'o (1): ext4: update s_overhead_clusters in the superblock during an on-line resize Trond Myklebust (2): NFSv4/pnfs: Fix a use-after-free bug in open SUNRPC: Reinitialise the backchannel request buffers before reuse Uwe Kleine-König (1): mtd: st_spi_fsm: Add a clk_disable_unprepare() in .probe()'s error path Vincent Mailhol (1): can: error: specify the values of data[5..7] of CAN error frames Wang Cheng (1): mm/mempolicy: fix uninit-value in mpol_rebind_policy() Xiu Jianfeng (1): selinux: Add boundary check in put_entry() Yang Xu (1): fs: Add missing umask strip in vfs_tmpfile Yang Yingliang (1): bus: hisi_lpc: fix missing platform_device_put() in hisi_lpc_acpi_probe() Yonglong Li (1): tcp: make retransmitted SKB fit into the send window Zhang Xianwei (1): NFSv4.1: RECLAIM_COMPLETE must handle EACCES huhai (1): ACPI: LPSS: Fix missing check in register_device_clock() Documentation/atomic_bitops.txt | 2 +- arch/x86/kernel/pmem.c | 7 ++++- drivers/acpi/acpi_lpss.c | 3 ++ drivers/bus/hisi_lpc.c | 10 +++--- drivers/mtd/devices/st_spi_fsm.c | 8 +++-- drivers/mtd/sm_ftl.c | 2 +- drivers/net/geneve.c | 3 +- drivers/tty/serial/8250/8250_dw.c | 3 ++ fs/attr.c | 2 ++ fs/ext4/inode.c | 7 +++++ fs/ext4/namei.c | 16 ++++++++++ fs/ext4/resize.c | 11 +++++++ fs/namei.c | 2 ++ fs/nfs/nfs4proc.c | 14 ++++++--- fs/splice.c | 10 +++--- include/asm-generic/bitops/atomic.h | 6 ---- include/linux/kfifo.h | 2 +- include/net/inet_sock.h | 5 +-- include/net/ip.h | 4 +-- include/net/tcp.h | 11 ++++--- include/uapi/linux/can/error.h | 5 ++- kernel/kprobes.c | 3 +- kernel/profile.c | 7 +++++ kernel/sched/rt.c | 15 +++++---- mm/mempolicy.c | 2 +- mm/mmap.c | 1 - net/ipv4/af_inet.c | 2 +- net/ipv4/igmp.c | 47 +++++++++++++++++------------ net/ipv4/route.c | 2 +- net/ipv4/tcp.c | 12 +++++--- net/ipv4/tcp_fastopen.c | 4 +-- net/ipv4/tcp_input.c | 39 ++++++++++++++---------- net/ipv4/tcp_ipv4.c | 2 +- net/ipv4/tcp_metrics.c | 5 +-- net/ipv4/tcp_minisocks.c | 2 +- net/ipv4/tcp_output.c | 46 +++++++++++++++++----------- net/ipv4/tcp_recovery.c | 6 ++-- net/ipv4/tcp_timer.c | 14 ++++----- net/ipv6/ping.c | 6 ++++ net/sctp/protocol.c | 2 +- net/sunrpc/backchannel_rqst.c | 14 +++++++++ security/selinux/ss/policydb.h | 2 ++ 42 files changed, 240 insertions(+), 126 deletions(-) -- 2.25.1

1 64

[PATCH openEuler-1.0-LTS 00/13] ACPI and block bugfix from mainline
by Yongqiang Liu 07 Sep '22

07 Sep '22

Chunguang Xu (1): block: fix the problem of io_ticks becoming smaller Dan Carpenter (1): acpi/nfit: improve bounds checking for 'func' Erik Kaneda (2): ACPICA: Do not increment operation_region reference counts for field units ACPICA: Disassembler: create buffer fields in ACPI_PARSE_LOAD_PASS1 Francesco Pollicino (1): block, bfq: save & resume weight on a queue merge/split Jiasheng Jiang (1): ACPI: APD: Check for NULL pointer after calling devm_ioremap() Mark Langsdorf (2): ACPI: custom_method: fix a possible memory leak ACPI: custom_method: fix potential use-after-free issue Maximilian Luz (1): ACPICA: Fix exception code class checks Qinglang Miao (1): ACPI: configfs: add missing check after configfs_register_default_group() Robin Murphy (1): ACPI/IORT: Check node revision for PMCG resources Tuan Phan (1): ACPI/IORT: Fix PMCG node single ID mapping handling zhengbin (1): blk-mq: Fix memory leak in blk_mq_init_allocated_queue error handling block/bfq-iosched.c | 2 ++ block/bfq-iosched.h | 9 +++++++++ block/bio.c | 2 +- block/blk-mq.c | 9 ++++++--- drivers/acpi/acpi_apd.c | 2 ++ drivers/acpi/acpi_configfs.c | 7 ++++++- drivers/acpi/acpica/dsfield.c | 2 +- drivers/acpi/acpica/dswload.c | 21 +++++++++++++++++++++ drivers/acpi/acpica/exprep.c | 4 ---- drivers/acpi/acpica/utdelete.c | 6 +----- drivers/acpi/arm64/iort.c | 19 ++++++++++++++++--- drivers/acpi/custom_method.c | 4 +++- drivers/acpi/nfit/core.c | 7 ++++--- drivers/acpi/nfit/nfit.h | 1 + include/acpi/acexcep.h | 10 +++++----- 15 files changed, 78 insertions(+), 27 deletions(-) -- 2.25.1

1 13

[PATCH openEuler-1.0-LTS 0/4] fix openEuler-1.0-LTS
by tangbin 07 Sep '22

07 Sep '22

When use openEuler-1.0-LTS kernel in euler22.03, we found it unable to compile and boot, thus fix it. Andy Lutomirski (1): x86/entry/64: Don't compile ignore_sysret if 32-bit emulation is enabled Aristeu Rozanski (1): EDAC: skx_common: downgrade message importance on missing PCI device Borislav Petkov (1): x86: Fix early boot crash on gcc-10, third try Josh Poimboeuf (1): objtool: Don't fail on missing symbol table arch/x86/entry/entry_64.S | 6 ++++++ arch/x86/include/asm/stackprotector.h | 7 ++++++- arch/x86/kernel/smpboot.c | 8 ++++++++ arch/x86/xen/smp_pv.c | 1 + drivers/edac/skx_common.c | 2 +- include/linux/compiler.h | 6 ++++++ init/main.c | 2 ++ tools/objtool/elf.c | 7 +++++-- 8 files changed, 35 insertions(+), 4 deletions(-) -- 2.18.4

1 4

[PATCH openEuler-1.0-LTS 1/3] usb: gadget: function: printer: fix use-after-free in __lock_acquire
by Yongqiang Liu 07 Sep '22

07 Sep '22

From: Zqiang <qiang.zhang(a)windriver.com> stable inclusion from stable-v4.19.154 commit cedb0187b8ba929c3f76f28e6bc25804d65f8a54 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5PB1E CVE: CVE-2020-27784 --------------------------- [ Upstream commit e8d5f92b8d30bb4ade76494490c3c065e12411b1 ] Fix this by increase object reference count. BUG: KASAN: use-after-free in __lock_acquire+0x3fd4/0x4180 kernel/locking/lockdep.c:3831 Read of size 8 at addr ffff8880683b0018 by task syz-executor.0/3377 CPU: 1 PID: 3377 Comm: syz-executor.0 Not tainted 5.6.11 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xce/0x128 lib/dump_stack.c:118 print_address_description.constprop.4+0x21/0x3c0 mm/kasan/report.c:374 __kasan_report+0x131/0x1b0 mm/kasan/report.c:506 kasan_report+0x12/0x20 mm/kasan/common.c:641 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135 __lock_acquire+0x3fd4/0x4180 kernel/locking/lockdep.c:3831 lock_acquire+0x127/0x350 kernel/locking/lockdep.c:4488 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x35/0x50 kernel/locking/spinlock.c:159 printer_ioctl+0x4a/0x110 drivers/usb/gadget/function/f_printer.c:723 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl+0xfb/0x130 fs/ioctl.c:763 __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl fs/ioctl.c:770 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:770 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4531a9 Code: ed 60 fc ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 bb 60 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fd14ad72c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000073bfa8 RCX: 00000000004531a9 RDX: fffffffffffffff9 RSI: 000000000000009e RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004bbd61 R13: 00000000004d0a98 R14: 00007fd14ad736d4 R15: 00000000ffffffff Allocated by task 2393: save_stack+0x21/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] __kasan_kmalloc.constprop.3+0xa7/0xd0 mm/kasan/common.c:515 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:529 kmem_cache_alloc_trace+0xfa/0x2d0 mm/slub.c:2813 kmalloc include/linux/slab.h:555 [inline] kzalloc include/linux/slab.h:669 [inline] gprinter_alloc+0xa1/0x870 drivers/usb/gadget/function/f_printer.c:1416 usb_get_function+0x58/0xc0 drivers/usb/gadget/functions.c:61 config_usb_cfg_link+0x1ed/0x3e0 drivers/usb/gadget/configfs.c:444 configfs_symlink+0x527/0x11d0 fs/configfs/symlink.c:202 vfs_symlink+0x33d/0x5b0 fs/namei.c:4201 do_symlinkat+0x11b/0x1d0 fs/namei.c:4228 __do_sys_symlinkat fs/namei.c:4242 [inline] __se_sys_symlinkat fs/namei.c:4239 [inline] __x64_sys_symlinkat+0x73/0xb0 fs/namei.c:4239 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 3368: save_stack+0x21/0x90 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] kasan_set_free_info mm/kasan/common.c:337 [inline] __kasan_slab_free+0x135/0x190 mm/kasan/common.c:476 kasan_slab_free+0xe/0x10 mm/kasan/common.c:485 slab_free_hook mm/slub.c:1444 [inline] slab_free_freelist_hook mm/slub.c:1477 [inline] slab_free mm/slub.c:3034 [inline] kfree+0xf7/0x410 mm/slub.c:3995 gprinter_free+0x49/0xd0 drivers/usb/gadget/function/f_printer.c:1353 usb_put_function+0x38/0x50 drivers/usb/gadget/functions.c:87 config_usb_cfg_unlink+0x2db/0x3b0 drivers/usb/gadget/configfs.c:485 configfs_unlink+0x3b9/0x7f0 fs/configfs/symlink.c:250 vfs_unlink+0x287/0x570 fs/namei.c:4073 do_unlinkat+0x4f9/0x620 fs/namei.c:4137 __do_sys_unlink fs/namei.c:4184 [inline] __se_sys_unlink fs/namei.c:4182 [inline] __x64_sys_unlink+0x42/0x50 fs/namei.c:4182 do_syscall_64+0x9e/0x510 arch/x86/entry/common.c:294 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8880683b0000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 24 bytes inside of 1024-byte region [ffff8880683b0000, ffff8880683b0400) The buggy address belongs to the page: page:ffffea0001a0ec00 refcount:1 mapcount:0 mapping:ffff88806c00e300 index:0xffff8880683b1800 compound_mapcount: 0 flags: 0x100000000010200(slab|head) raw: 0100000000010200 0000000000000000 0000000600000001 ffff88806c00e300 raw: ffff8880683b1800 000000008010000a 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Reported-by: Kyungtae Kim <kt0755(a)gmail.com> Signed-off-by: Zqiang <qiang.zhang(a)windriver.com> Signed-off-by: Felipe Balbi <balbi(a)kernel.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Wei Li <liwei391(a)huawei.com> Reviewed-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/usb/gadget/function/f_printer.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c index 9c7ed2539ff7..8ed1295d7e35 100644 --- a/drivers/usb/gadget/function/f_printer.c +++ b/drivers/usb/gadget/function/f_printer.c @@ -31,6 +31,7 @@ #include <linux/types.h> #include <linux/ctype.h> #include <linux/cdev.h> +#include <linux/kref.h> #include <asm/byteorder.h> #include <linux/io.h> @@ -64,7 +65,7 @@ struct printer_dev { struct usb_gadget *gadget; s8 interface; struct usb_ep *in_ep, *out_ep; - + struct kref kref; struct list_head rx_reqs; /* List of free RX structs */ struct list_head rx_reqs_active; /* List of Active RX xfers */ struct list_head rx_buffers; /* List of completed xfers */ @@ -218,6 +219,13 @@ static inline struct usb_endpoint_descriptor *ep_desc(struct usb_gadget *gadget, /*-------------------------------------------------------------------------*/ +static void printer_dev_free(struct kref *kref) +{ + struct printer_dev *dev = container_of(kref, struct printer_dev, kref); + + kfree(dev); +} + static struct usb_request * printer_req_alloc(struct usb_ep *ep, unsigned len, gfp_t gfp_flags) { @@ -348,6 +356,7 @@ printer_open(struct inode *inode, struct file *fd) spin_unlock_irqrestore(&dev->lock, flags); + kref_get(&dev->kref); DBG(dev, "printer_open returned %x\n", ret); return ret; } @@ -365,6 +374,7 @@ printer_close(struct inode *inode, struct file *fd) dev->printer_status &= ~PRINTER_SELECTED; spin_unlock_irqrestore(&dev->lock, flags); + kref_put(&dev->kref, printer_dev_free); DBG(dev, "printer_close\n"); return 0; @@ -1350,7 +1360,8 @@ static void gprinter_free(struct usb_function *f) struct f_printer_opts *opts; opts = container_of(f->fi, struct f_printer_opts, func_inst); - kfree(dev); + + kref_put(&dev->kref, printer_dev_free); mutex_lock(&opts->lock); --opts->refcnt; mutex_unlock(&opts->lock); @@ -1419,6 +1430,7 @@ static struct usb_function *gprinter_alloc(struct usb_function_instance *fi) return ERR_PTR(-ENOMEM); } + kref_init(&dev->kref); ++opts->refcnt; dev->minor = opts->minor; dev->pnp_string = opts->pnp_string; -- 2.25.1

1 2

[PATCH openEuler-5.10 01/14] tty: drivers/tty/, stop using tty_schedule_flip()
by Zheng Zengkai 06 Sep '22

06 Sep '22

From: Jiri Slaby <jslaby(a)suse.cz> stable inclusion from stable-v5.10.134 commit 6a81848252869d929354a879e08807c932444929 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5A5Y1 CVE: CVE-2022-1462 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5f6a85158ccacc3f09744b3aafe8b11ab3b6c6f6 upstream. Since commit a9c3f68f3cd8d (tty: Fix low_latency BUG) in 2014, tty_flip_buffer_push() is only a wrapper to tty_schedule_flip(). We are going to remove the latter (as it is used less), so call the former in drivers/tty/. Cc: Vladimir Zapolskiy <vz(a)mleia.com> Reviewed-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Jiri Slaby <jslaby(a)suse.cz> Link: https://lore.kernel.org/r/20211122111648.30379-2-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/tty/cyclades.c | 6 +++--- drivers/tty/goldfish.c | 2 +- drivers/tty/moxa.c | 4 ++-- drivers/tty/serial/lpc32xx_hs.c | 2 +- drivers/tty/vt/keyboard.c | 6 +++--- drivers/tty/vt/vt.c | 2 +- 6 files changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c index 097266342e5e..4bcaab250676 100644 --- a/drivers/tty/cyclades.c +++ b/drivers/tty/cyclades.c @@ -556,7 +556,7 @@ static void cyy_chip_rx(struct cyclades_card *cinfo, int chip, } info->idle_stats.recv_idle = jiffies; } - tty_schedule_flip(port); + tty_flip_buffer_push(port); /* end of service */ cyy_writeb(info, CyRIR, save_xir & 0x3f); @@ -996,7 +996,7 @@ static void cyz_handle_rx(struct cyclades_port *info) mod_timer(&info->rx_full_timer, jiffies + 1); #endif info->idle_stats.recv_idle = jiffies; - tty_schedule_flip(&info->port); + tty_flip_buffer_push(&info->port); /* Update rx_get */ cy_writel(&buf_ctrl->rx_get, new_rx_get); @@ -1172,7 +1172,7 @@ static void cyz_handle_cmd(struct cyclades_card *cinfo) if (delta_count) wake_up_interruptible(&info->port.delta_msr_wait); if (special_count) - tty_schedule_flip(&info->port); + tty_flip_buffer_push(&info->port); } } diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c index c8c5cdfc5e19..ed0f3a7b8fe5 100644 --- a/drivers/tty/goldfish.c +++ b/drivers/tty/goldfish.c @@ -151,7 +151,7 @@ static irqreturn_t goldfish_tty_interrupt(int irq, void *dev_id) address = (unsigned long)(void *)buf; goldfish_tty_rw(qtty, address, count, 0); - tty_schedule_flip(&qtty->port); + tty_flip_buffer_push(&qtty->port); return IRQ_HANDLED; } diff --git a/drivers/tty/moxa.c b/drivers/tty/moxa.c index f9f14104bd2c..d6528f3bb9b9 100644 --- a/drivers/tty/moxa.c +++ b/drivers/tty/moxa.c @@ -1385,7 +1385,7 @@ static int moxa_poll_port(struct moxa_port *p, unsigned int handle, if (inited && !tty_throttled(tty) && MoxaPortRxQueue(p) > 0) { /* RX */ MoxaPortReadData(p); - tty_schedule_flip(&p->port); + tty_flip_buffer_push(&p->port); } } else { clear_bit(EMPTYWAIT, &p->statusflags); @@ -1410,7 +1410,7 @@ static int moxa_poll_port(struct moxa_port *p, unsigned int handle, if (tty && (intr & IntrBreak) && !I_IGNBRK(tty)) { /* BREAK */ tty_insert_flip_char(&p->port, 0, TTY_BREAK); - tty_schedule_flip(&p->port); + tty_flip_buffer_push(&p->port); } if (intr & IntrLine) diff --git a/drivers/tty/serial/lpc32xx_hs.c b/drivers/tty/serial/lpc32xx_hs.c index b5898c932036..a9802308ff60 100644 --- a/drivers/tty/serial/lpc32xx_hs.c +++ b/drivers/tty/serial/lpc32xx_hs.c @@ -344,7 +344,7 @@ static irqreturn_t serial_lpc32xx_interrupt(int irq, void *dev_id) LPC32XX_HSUART_IIR(port->membase)); port->icount.overrun++; tty_insert_flip_char(tport, 0, TTY_OVERRUN); - tty_schedule_flip(tport); + tty_flip_buffer_push(tport); } /* Data received? */ diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c index 78acc270e39a..aa0026a9839c 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -311,7 +311,7 @@ int kbd_rate(struct kbd_repeat *rpt) static void put_queue(struct vc_data *vc, int ch) { tty_insert_flip_char(&vc->port, ch, 0); - tty_schedule_flip(&vc->port); + tty_flip_buffer_push(&vc->port); } static void puts_queue(struct vc_data *vc, char *cp) @@ -320,7 +320,7 @@ static void puts_queue(struct vc_data *vc, char *cp) tty_insert_flip_char(&vc->port, *cp, 0); cp++; } - tty_schedule_flip(&vc->port); + tty_flip_buffer_push(&vc->port); } static void applkey(struct vc_data *vc, int key, char mode) @@ -565,7 +565,7 @@ static void fn_inc_console(struct vc_data *vc) static void fn_send_intr(struct vc_data *vc) { tty_insert_flip_char(&vc->port, 0, TTY_BREAK); - tty_schedule_flip(&vc->port); + tty_flip_buffer_push(&vc->port); } static void fn_scroll_forw(struct vc_data *vc) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 0a6336d54a65..30fc2a60c352 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -1834,7 +1834,7 @@ static void csi_m(struct vc_data *vc) static void respond_string(const char *p, size_t len, struct tty_port *port) { tty_insert_flip_string(port, p, len); - tty_schedule_flip(port); + tty_flip_buffer_push(port); } static void cursor_report(struct vc_data *vc, struct tty_struct *tty) -- 2.20.1

1 13

[PATCH openEuler-5.10 00/44] Backport 5.10.120 LTS
by Zheng Zengkai 06 Sep '22

06 Sep '22

Backport 5.10.120 LTS patches from upstream. git cherry-pick v5.10.119..v5.10.120~1 -s Already merged(-8): ea62d169b6e7 netfilter: nf_tables: disallow non-stateful expression in sets earlier 57d01bcae704 io_uring: don't re-import iovecs from callbacks 8adb751d294e io_uring: fix using under-expanded iters 72464fd2b4b7 xfs: fix the forward progress assertion in xfs_iwalk_run_callbacks a9e7f19a5577 xfs: fix an ABBA deadlock in xfs_renam 2728d95c6c95 xfs: Fix CIL throttle hang when CIL space used going backwards c0aff1faf66b netfilter: nf_tables: sanitize nft_set_desc_concat_parse() 3d8fc6e28f32 KVM: x86: avoid calling x86 emulator without a decoded instruction Skiped(-1)： 45d97f70da4d xfs: show the proper user quota options Context conflict: 630192aa4523 lib/crypto: add prompts back to crypto libraries 8df42bcd364c dm verity: set DM_TARGET_IMMUTABLE feature flag KABI fixed(+1): pipe: fix kabi for poll_usage in struct pipe_inode_info Total patches: 52 - 8 - 1 + 1= 44 Akira Yokosawa (1): docs: submitting-patches: Fix crossref to 'The canonical patch format' Al Viro (1): percpu_ref_init(): clean ->percpu_count_ref on failure Alex Elder (1): net: ipa: compute proper aggregation limit Chuck Lever (1): NFSD: Fix possible sleep during nfsd4_release_lockowner() Dan Carpenter (1): dm integrity: fix error code in dm_integrity_ctr() Darrick J. Wong (1): xfs: detect overflows in bmbt records David Howells (1): pipe: Fix missing lock in pipe_resize_ring() Fabio Estevam (1): crypto: caam - fix i.MX6SX entropy delay value Florian Westphal (1): netfilter: conntrack: re-fetch conntrack after insertion Gustavo A. R. Silva (1): drm/i915: Fix -Wstringop-overflow warning in call to intel_read_wm_latency() IotaHydrae (1): pinctrl: sunxi: fix f1c100s uart2 function Joel Stanley (1): net: ftgmac100: Disable hardware checksum on AST2600 Jonathan Bakker (1): ARM: dts: s5pv210: Correct interrupt name for bluetooth in Aries Justin M. Forbes (1): lib/crypto: add prompts back to crypto libraries Kuniyuki Iwashima (1): pipe: make poll_usage boolean and annotate its access Lin Ma (1): nfc: pn533: Fix buggy cleanup order Liu Jian (1): bpf: Enlarge offset check value to INT_MAX in bpf_skb_{load,store}_bytes Marek Maślanka (1): HID: multitouch: Add support for Google Whiskers Touchpad Mariusz Tkaczyk (1): raid5: introduce MD_BROKEN Mika Westerberg (1): i2c: ismt: Provide a DMA buffer for Interrupt Cause Logging Mikulas Patocka (2): dm crypt: make printing of the key constant-time dm stats: add cond_resched when looping over entries Miri Korenblit (1): cfg80211: set custom regdomain after wiphy registration Nicolai Stange (4): crypto: drbg - prepare for more fine-grained tracking of seeding state crypto: drbg - track whether DRBG was seeded with !rng_is_initialized() crypto: drbg - move dynamic ->reseed_threshold adjustments to __drbg_seed() crypto: drbg - make reseeding from get_random_bytes() synchronous Paolo Bonzini (1): x86, kvm: use correct GFP flags for preemption disabled Piyush Malgujar (1): drivers: i2c: thunderx: Allow driver to work with ACPI defined TWSI controllers Sarthak Kukreti (1): dm verity: set DM_TARGET_IMMUTABLE feature flag Sean Christopherson (1): x86/kvm: Alloc dummy async #PF token outside of raw spinlock Stefan Mahnke-Hartmann (1): tpm: Fix buffer access in tpm2_get_tpm_pt() Stephen Brennan (1): assoc_array: Fix BUG_ON during garbage collect Steven Rostedt (1): Bluetooth: hci_qca: Use del_timer_sync() before freeing Sultan Alsawaf (1): zsmalloc: fix races between asynchronous zspage free and page migration Tadeusz Struk (1): exfat: check if cluster num is valid Tao Jin (1): HID: multitouch: add quirks to enable Lenovo X12 trackpoint Thomas Bartschies (1): net: af_key: check encryption module availability consistency Trond Myklebust (1): NFS: Memory allocation failures are not server fatal errors Vitaly Chikunov (1): crypto: ecrdsa - Fix incorrect use of vli_cmp Xiaomeng Tong (1): KVM: PPC: Book3S HV: fix incorrect NULL check on list iterator Xiu Jianfeng (1): tpm: ibmvtpm: Correct the return value in tpm_ibmvtpm_probe() Yuntao Wang (1): bpf: Fix potential array overflow in bpf_trampoline_get_progs() Zheng Zengkai (1): pipe: fix kabi for poll_usage in struct pipe_inode_info Documentation/process/submitting-patches.rst | 2 +- arch/arm/boot/dts/s5pv210-aries.dtsi | 2 +- arch/powerpc/kvm/book3s_hv_uvmem.c | 8 +- arch/x86/kernel/kvm.c | 41 ++++--- crypto/Kconfig | 2 - crypto/drbg.c | 110 +++++++----------- crypto/ecrdsa.c | 8 +- drivers/bluetooth/hci_qca.c | 4 +- drivers/char/random.c | 2 - drivers/char/tpm/tpm2-cmd.c | 11 +- drivers/char/tpm/tpm_ibmvtpm.c | 1 + drivers/crypto/caam/ctrl.c | 18 +++ drivers/gpu/drm/i915/intel_pm.c | 2 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-multitouch.c | 9 ++ drivers/i2c/busses/i2c-ismt.c | 14 +++ drivers/i2c/busses/i2c-thunderx-pcidrv.c | 1 + drivers/md/dm-crypt.c | 14 ++- drivers/md/dm-integrity.c | 2 - drivers/md/dm-stats.c | 8 ++ drivers/md/dm-verity-target.c | 1 + drivers/md/raid5.c | 47 ++++---- drivers/net/ethernet/faraday/ftgmac100.c | 5 + drivers/net/ipa/ipa_endpoint.c | 4 +- drivers/nfc/pn533/pn533.c | 5 +- drivers/pinctrl/sunxi/pinctrl-suniv-f1c100s.c | 2 +- fs/exfat/balloc.c | 8 +- fs/exfat/exfat_fs.h | 8 ++ fs/exfat/fatent.c | 8 -- fs/nfs/internal.h | 1 + fs/nfsd/nfs4state.c | 12 +- fs/pipe.c | 33 +++--- fs/xfs/libxfs/xfs_bmap.c | 5 + include/crypto/drbg.h | 10 +- include/linux/pipe_fs_i.h | 2 +- include/net/netfilter/nf_conntrack_core.h | 7 +- kernel/bpf/trampoline.c | 18 ++- lib/Kconfig | 2 + lib/assoc_array.c | 8 ++ lib/crypto/Kconfig | 17 ++- lib/percpu-refcount.c | 1 + mm/zsmalloc.c | 37 +++++- net/core/filter.c | 4 +- net/key/af_key.c | 6 +- net/wireless/core.c | 8 +- net/wireless/reg.c | 1 + 46 files changed, 328 insertions(+), 192 deletions(-) -- 2.20.1

1 44

[PATCH openEuler-1.0-LTS 1/2] lightnvm: disable the subsystem
by Yongqiang Liu 06 Sep '22

06 Sep '22

From: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> stable inclusion from stable-v5.10.114 commit 549209caabc89f2877ad5f62d11fca5c052e0e8f category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5O6A9 CVE: CVE-2022-2991 --------------------------- In commit 9ea9b9c48387 ("remove the lightnvm subsystem") the lightnvm subsystem was removed as there is no hardware in the wild for it, and the code is known to have problems. This should also be disabled for older LTS kernels as well to prevent anyone from accidentally using it. Cc: Christoph Hellwig <hch(a)lst.de> Cc: Matias Bjørling <mb(a)lightnvm.io> Cc: Javier González <javier(a)javigon.com> Cc: Jens Axboe <axboe(a)kernel.dk> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Guo Mengqi <guomengqi3(a)huawei.com> Reviewed-by: Weilong Chen <chenweilong(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/lightnvm/Kconfig | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/lightnvm/Kconfig b/drivers/lightnvm/Kconfig index 439bf90d084d..1db33cb28859 100644 --- a/drivers/lightnvm/Kconfig +++ b/drivers/lightnvm/Kconfig @@ -4,7 +4,7 @@ menuconfig NVM bool "Open-Channel SSD target support" - depends on BLOCK && PCI + depends on BLOCK && PCI && BROKEN select BLK_DEV_NVME help Say Y here to get to enable Open-channel SSDs. -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 1/6] configfs: return -ENAMETOOLONG earlier in configfs_lookup
by Yongqiang Liu 06 Sep '22

06 Sep '22

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v5.15-rc1 commit 417b962ddeca2b70eb72d28c87541bdad4e234f8 category: bugfix bugzilla: 187567, https://gitee.com/openeuler/kernel/issues/I5PK1G CVE: NA -------------------------------- Just like most other file systems: get the simple checks out of the way first. Signed-off-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Zhihao Cheng <chengzhihao1(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- fs/configfs/dir.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/configfs/dir.c b/fs/configfs/dir.c index 9b43611e1bb3..ff298a9baa0a 100644 --- a/fs/configfs/dir.c +++ b/fs/configfs/dir.c @@ -483,6 +483,9 @@ static struct dentry * configfs_lookup(struct inode *dir, int found = 0; int err; + if (dentry->d_name.len > NAME_MAX) + return ERR_PTR(-ENAMETOOLONG); + /* * Fake invisibility if dir belongs to a group/default groups hierarchy * being attached @@ -513,8 +516,6 @@ static struct dentry * configfs_lookup(struct inode *dir, * If it doesn't exist and it isn't a NOT_PINNED item, * it must be negative. */ - if (dentry->d_name.len > NAME_MAX) - return ERR_PTR(-ENAMETOOLONG); d_add(dentry, NULL); return NULL; } -- 2.25.1

1 5

[PATCH openEuler-5.10-LTS 01/12] tty: drivers/tty/, stop using tty_schedule_flip()
by Zheng Zengkai 06 Sep '22

06 Sep '22

From: Jiri Slaby <jslaby(a)suse.cz> stable inclusion from stable-v5.10.134 commit 6a81848252869d929354a879e08807c932444929 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I5A5Y1 CVE: CVE-2022-1462 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 5f6a85158ccacc3f09744b3aafe8b11ab3b6c6f6 upstream. Since commit a9c3f68f3cd8d (tty: Fix low_latency BUG) in 2014, tty_flip_buffer_push() is only a wrapper to tty_schedule_flip(). We are going to remove the latter (as it is used less), so call the former in drivers/tty/. Cc: Vladimir Zapolskiy <vz(a)mleia.com> Reviewed-by: Johan Hovold <johan(a)kernel.org> Signed-off-by: Jiri Slaby <jslaby(a)suse.cz> Link: https://lore.kernel.org/r/20211122111648.30379-2-jslaby@suse.cz Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Zheng Zengkai <zhengzengkai(a)huawei.com> --- drivers/tty/cyclades.c | 6 +++--- drivers/tty/goldfish.c | 2 +- drivers/tty/moxa.c | 4 ++-- drivers/tty/serial/lpc32xx_hs.c | 2 +- drivers/tty/vt/keyboard.c | 6 +++--- drivers/tty/vt/vt.c | 2 +- 6 files changed, 11 insertions(+), 11 deletions(-) diff --git a/drivers/tty/cyclades.c b/drivers/tty/cyclades.c index 097266342e5e..4bcaab250676 100644 --- a/drivers/tty/cyclades.c +++ b/drivers/tty/cyclades.c @@ -556,7 +556,7 @@ static void cyy_chip_rx(struct cyclades_card *cinfo, int chip, } info->idle_stats.recv_idle = jiffies; } - tty_schedule_flip(port); + tty_flip_buffer_push(port); /* end of service */ cyy_writeb(info, CyRIR, save_xir & 0x3f); @@ -996,7 +996,7 @@ static void cyz_handle_rx(struct cyclades_port *info) mod_timer(&info->rx_full_timer, jiffies + 1); #endif info->idle_stats.recv_idle = jiffies; - tty_schedule_flip(&info->port); + tty_flip_buffer_push(&info->port); /* Update rx_get */ cy_writel(&buf_ctrl->rx_get, new_rx_get); @@ -1172,7 +1172,7 @@ static void cyz_handle_cmd(struct cyclades_card *cinfo) if (delta_count) wake_up_interruptible(&info->port.delta_msr_wait); if (special_count) - tty_schedule_flip(&info->port); + tty_flip_buffer_push(&info->port); } } diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c index c8c5cdfc5e19..ed0f3a7b8fe5 100644 --- a/drivers/tty/goldfish.c +++ b/drivers/tty/goldfish.c @@ -151,7 +151,7 @@ static irqreturn_t goldfish_tty_interrupt(int irq, void *dev_id) address = (unsigned long)(void *)buf; goldfish_tty_rw(qtty, address, count, 0); - tty_schedule_flip(&qtty->port); + tty_flip_buffer_push(&qtty->port); return IRQ_HANDLED; } diff --git a/drivers/tty/moxa.c b/drivers/tty/moxa.c index f9f14104bd2c..d6528f3bb9b9 100644 --- a/drivers/tty/moxa.c +++ b/drivers/tty/moxa.c @@ -1385,7 +1385,7 @@ static int moxa_poll_port(struct moxa_port *p, unsigned int handle, if (inited && !tty_throttled(tty) && MoxaPortRxQueue(p) > 0) { /* RX */ MoxaPortReadData(p); - tty_schedule_flip(&p->port); + tty_flip_buffer_push(&p->port); } } else { clear_bit(EMPTYWAIT, &p->statusflags); @@ -1410,7 +1410,7 @@ static int moxa_poll_port(struct moxa_port *p, unsigned int handle, if (tty && (intr & IntrBreak) && !I_IGNBRK(tty)) { /* BREAK */ tty_insert_flip_char(&p->port, 0, TTY_BREAK); - tty_schedule_flip(&p->port); + tty_flip_buffer_push(&p->port); } if (intr & IntrLine) diff --git a/drivers/tty/serial/lpc32xx_hs.c b/drivers/tty/serial/lpc32xx_hs.c index b5898c932036..a9802308ff60 100644 --- a/drivers/tty/serial/lpc32xx_hs.c +++ b/drivers/tty/serial/lpc32xx_hs.c @@ -344,7 +344,7 @@ static irqreturn_t serial_lpc32xx_interrupt(int irq, void *dev_id) LPC32XX_HSUART_IIR(port->membase)); port->icount.overrun++; tty_insert_flip_char(tport, 0, TTY_OVERRUN); - tty_schedule_flip(tport); + tty_flip_buffer_push(tport); } /* Data received? */ diff --git a/drivers/tty/vt/keyboard.c b/drivers/tty/vt/keyboard.c index 78acc270e39a..aa0026a9839c 100644 --- a/drivers/tty/vt/keyboard.c +++ b/drivers/tty/vt/keyboard.c @@ -311,7 +311,7 @@ int kbd_rate(struct kbd_repeat *rpt) static void put_queue(struct vc_data *vc, int ch) { tty_insert_flip_char(&vc->port, ch, 0); - tty_schedule_flip(&vc->port); + tty_flip_buffer_push(&vc->port); } static void puts_queue(struct vc_data *vc, char *cp) @@ -320,7 +320,7 @@ static void puts_queue(struct vc_data *vc, char *cp) tty_insert_flip_char(&vc->port, *cp, 0); cp++; } - tty_schedule_flip(&vc->port); + tty_flip_buffer_push(&vc->port); } static void applkey(struct vc_data *vc, int key, char mode) @@ -565,7 +565,7 @@ static void fn_inc_console(struct vc_data *vc) static void fn_send_intr(struct vc_data *vc) { tty_insert_flip_char(&vc->port, 0, TTY_BREAK); - tty_schedule_flip(&vc->port); + tty_flip_buffer_push(&vc->port); } static void fn_scroll_forw(struct vc_data *vc) diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c index 0a6336d54a65..30fc2a60c352 100644 --- a/drivers/tty/vt/vt.c +++ b/drivers/tty/vt/vt.c @@ -1834,7 +1834,7 @@ static void csi_m(struct vc_data *vc) static void respond_string(const char *p, size_t len, struct tty_port *port) { tty_insert_flip_string(port, p, len); - tty_schedule_flip(port); + tty_flip_buffer_push(port); } static void cursor_report(struct vc_data *vc, struct tty_struct *tty) -- 2.20.1

1 11