- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] Bluetooth: Fix slab-out-of-bounds read in hci_extended_inquiry_result_evt()
by Yang Yingliang 10 Jun '21

10 Jun '21

From: Peilin Ye <yepeilin.cs(a)gmail.com> stable inclusion from linux-4.19.139 commit 8c4a649c20fec015ebb326f36b47d4e39d9ff5b7 CVE: CVE-2020-36386 -------------------------------- commit 51c19bf3d5cfaa66571e4b88ba2a6f6295311101 upstream. Check upon `num_rsp` is insufficient. A malformed event packet with a large `num_rsp` number makes hci_extended_inquiry_result_evt() go out of bounds. Fix it. This patch fixes the following syzbot bug: https://syzkaller.appspot.com/bug?id=4bf11aa05c4ca51ce0df86e500fce486552dc8… Reported-by: syzbot+d8489a79b781849b9c46(a)syzkaller.appspotmail.com Cc: stable(a)vger.kernel.org Signed-off-by: Peilin Ye <yepeilin.cs(a)gmail.com> Acked-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Marcel Holtmann <marcel(a)holtmann.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/bluetooth/hci_event.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c index b7c87f505fb6d..7eb68703783eb 100644 --- a/net/bluetooth/hci_event.c +++ b/net/bluetooth/hci_event.c @@ -4150,7 +4150,7 @@ static void hci_extended_inquiry_result_evt(struct hci_dev *hdev, BT_DBG("%s num_rsp %d", hdev->name, num_rsp); - if (!num_rsp) + if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1) return; if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ)) -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] HID: make arrays usage and value to be the same
by Yang Yingliang 10 Jun '21

10 Jun '21

From: Will McVicker <willmcvicker(a)google.com> stable inclusion from linux-4.19.178 commit ffca531f71d078c6caf752d64bc2a592f420f7c6 CVE: CVE-2021-0512 -------------------------------- commit ed9be64eefe26d7d8b0b5b9fa3ffdf425d87a01f upstream. The HID subsystem allows an "HID report field" to have a different number of "values" and "usages" when it is allocated. When a field struct is created, the size of the usage array is guaranteed to be at least as large as the values array, but it may be larger. This leads to a potential out-of-bounds write in __hidinput_change_resolution_multipliers() and an out-of-bounds read in hidinput_count_leds(). To fix this, let's make sure that both the usage and value arrays are the same size. Cc: stable(a)vger.kernel.org Signed-off-by: Will McVicker <willmcvicker(a)google.com> Signed-off-by: Jiri Kosina <jkosina(a)suse.cz> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Xiu Jianfeng <xiujianfeng(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/hid/hid-core.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c index 3178580db7fa9..4f6d676c4224c 100644 --- a/drivers/hid/hid-core.c +++ b/drivers/hid/hid-core.c @@ -93,7 +93,7 @@ EXPORT_SYMBOL_GPL(hid_register_report); * Register a new field for this report. */ -static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages, unsigned values) +static struct hid_field *hid_register_field(struct hid_report *report, unsigned usages) { struct hid_field *field; @@ -104,7 +104,7 @@ static struct hid_field *hid_register_field(struct hid_report *report, unsigned field = kzalloc((sizeof(struct hid_field) + usages * sizeof(struct hid_usage) + - values * sizeof(unsigned)), GFP_KERNEL); + usages * sizeof(unsigned)), GFP_KERNEL); if (!field) return NULL; @@ -294,7 +294,7 @@ static int hid_add_field(struct hid_parser *parser, unsigned report_type, unsign usages = max_t(unsigned, parser->local.usage_index, parser->global.report_count); - field = hid_register_field(report, usages, parser->global.report_count); + field = hid_register_field(report, usages); if (!field) return 0; -- 2.25.1

1 0

[PATCH kernel-4.19 1/2] block: take bd_mutex around delete_partitions in del_gendisk
by Yang Yingliang 09 Jun '21

09 Jun '21

From: Christoph Hellwig <hch(a)lst.de> mainline inclusion from mainline-v5.13-rc1 commit c76f48eb5c084b1e15c931ae8cc1826cd771d70d category: bugfix bugzilla: 55097 CVE: NA -------------------------------- There is nothing preventing an ioctl from trying do delete partition concurrenly with del_gendisk, so take open_mutex to serialize against that. Signed-off-by: Christoph Hellwig <hch(a)lst.de> Link: https://lore.kernel.org/r/20210406062303.811835-6-hch@lst.de Signed-off-by: Jens Axboe <axboe(a)kernel.dk> Conflicts: block/genhd.c block/partitions/core.c [Yufen: linux-4.19 have not extract blk_drop_partitions().] Signed-off-by: Yufen Yu <yuyufen(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/genhd.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/block/genhd.c b/block/genhd.c index 026d3f41c85a1..686a54698aa02 100644 --- a/block/genhd.c +++ b/block/genhd.c @@ -756,6 +756,7 @@ void del_gendisk(struct gendisk *disk) { struct disk_part_iter piter; struct hd_struct *part; + struct block_device *bdev; blk_integrity_del(disk); disk_del_events(disk); @@ -765,6 +766,14 @@ void del_gendisk(struct gendisk *disk) * disk is marked as dead (GENHD_FL_UP cleared). */ down_write(&disk->lookup_sem); + + /* + * If bdev is null, that menas memory allocate fail. Then + * add_partitions can also fail. + */ + bdev = bdget_disk(disk, 0); + if (bdev) + mutex_lock(&bdev->bd_mutex); /* invalidate stuff */ disk_part_iter_init(&piter, disk, DISK_PITER_INCL_EMPTY | DISK_PITER_REVERSE); @@ -774,6 +783,8 @@ void del_gendisk(struct gendisk *disk) delete_partition(disk, part->partno); } disk_part_iter_exit(&piter); + if (bdev) + mutex_unlock(&bdev->bd_mutex); invalidate_partition(disk, 0); bdev_unhash_inode(disk_devt(disk)); -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS 01/12] mac80211: mark station unauthorized before key removal
by Yang Yingliang 09 Jun '21

09 Jun '21

From: Johannes Berg <johannes.berg(a)intel.com> stable inclusion from linux-4.19.114 commit d34dce8d3dbfa7412cb10f38f9fa5583675b55cf -------------------------------- commit b16798f5b907733966fd1a558fca823b3c67e4a1 upstream. If a station is still marked as authorized, mark it as no longer so before removing its keys. This allows frames transmitted to it to be rejected, providing additional protection against leaking plain text data during the disconnection flow. Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/r/20200326155133.ccb4fb0bb356.If48f0f0504efdcf16b89… Signed-off-by: Johannes Berg <johannes.berg(a)intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- net/mac80211/sta_info.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c index 0c80a59ef914e..ec2e83272f9d8 100644 --- a/net/mac80211/sta_info.c +++ b/net/mac80211/sta_info.c @@ -3,7 +3,7 @@ * Copyright 2006-2007 Jiri Benc <jbenc(a)suse.cz> * Copyright 2013-2014 Intel Mobile Communications GmbH * Copyright (C) 2015 - 2017 Intel Deutschland GmbH - * Copyright (C) 2018 Intel Corporation + * Copyright (C) 2018-2020 Intel Corporation * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as @@ -979,6 +979,11 @@ static void __sta_info_destroy_part2(struct sta_info *sta) might_sleep(); lockdep_assert_held(&local->sta_mtx); + while (sta->sta_state == IEEE80211_STA_AUTHORIZED) { + ret = sta_info_move_state(sta, IEEE80211_STA_ASSOC); + WARN_ON_ONCE(ret); + } + /* now keys can no longer be reached */ ieee80211_free_sta_keys(local, sta); -- 2.25.1

1 11

[PATCH kernel-4.19 1/2] NFSv4: Fix deadlock between nfs4_evict_inode() and nfs4_opendata_get_inode()
by Yang Yingliang 09 Jun '21

09 Jun '21

From: Trond Myklebust <trond.myklebust(a)hammerspace.com> hulk inclusion category: bugfix bugzilla: 51898 CVE: NA --------------------------- If the inode is being evicted, but has to return a delegation first, then it can cause a deadlock in the corner case where the server reboots before the delegreturn completes, but while the call to iget5_locked() in nfs4_opendata_get_inode() is waiting for the inode free to complete. Since the open call still holds a session slot, the reboot recovery cannot proceed. In order to break the logjam, we can turn the delegation return into a privileged operation for the case where we're evicting the inode. We know that in that case, there can be no other state recovery operation that conflicts. Reported-by: zhangxiaoxu (A) <zhangxiaoxu5(a)huawei.com> Fixes: 5fcdfacc01f3 ("NFSv4: Return delegations synchronously in evict_inode") Signed-off-by: Trond Myklebust <trond.myklebust(a)hammerspace.com> Link: https://patchwork.kernel.org/project/linux-nfs/list/?series=491989 Conflict: fs/nfs/nfs4proc.c Signed-off-by: Zhang Xiaoxu <zhangxiaoxu5(a)huawei.com> Reviewed-by: Zhang Yi <yi.zhang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/nfs/nfs4_fs.h | 1 + fs/nfs/nfs4proc.c | 13 ++++++++++++- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h index a6b0b544c82d9..4f3b5add052b8 100644 --- a/fs/nfs/nfs4_fs.h +++ b/fs/nfs/nfs4_fs.h @@ -201,6 +201,7 @@ struct nfs4_exception { struct inode *inode; nfs4_stateid *stateid; long timeout; + unsigned char task_is_privileged : 1; unsigned char delay : 1, recovering : 1, retry : 1; diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index 35a60c3ed023f..5d9c132ffd760 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -564,6 +564,8 @@ int nfs4_handle_exception(struct nfs_server *server, int errorcode, struct nfs4_ goto out_retry; } if (exception->recovering) { + if (exception->task_is_privileged) + return -EDEADLOCK; ret = nfs4_wait_clnt_recover(clp); if (test_bit(NFS_MIG_FAILED, &server->mig_status)) return -EIO; @@ -589,6 +591,8 @@ nfs4_async_handle_exception(struct rpc_task *task, struct nfs_server *server, goto out_retry; } if (exception->recovering) { + if (exception->task_is_privileged) + return -EDEADLOCK; rpc_sleep_on(&clp->cl_rpcwaitq, task, NULL); if (test_bit(NFS4CLNT_MANAGER_RUNNING, &clp->cl_state) == 0) rpc_wake_up_queued_task(&clp->cl_rpcwaitq, task); @@ -6102,6 +6106,7 @@ static void nfs4_delegreturn_done(struct rpc_task *task, void *calldata) struct nfs4_exception exception = { .inode = data->inode, .stateid = &data->stateid, + .task_is_privileged = data->args.seq_args.sa_privileged, }; if (!nfs4_sequence_done(task, &data->res.seq_res)) @@ -6246,7 +6251,6 @@ static int _nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, co data = kzalloc(sizeof(*data), GFP_NOFS); if (data == NULL) return -ENOMEM; - nfs4_init_sequence(&data->args.seq_args, &data->res.seq_res, 1, 0); nfs4_state_protect(server->nfs_client, NFS_SP4_MACH_CRED_CLEANUP, @@ -6276,6 +6280,13 @@ static int _nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, co data->lr.roc = false; } + if (!data->inode) + nfs4_init_sequence(&data->args.seq_args, &data->res.seq_res, 1, + 1); + else + nfs4_init_sequence(&data->args.seq_args, &data->res.seq_res, 1, + 0); + task_setup_data.callback_data = data; msg.rpc_argp = &data->args; msg.rpc_resp = &data->res; -- 2.25.1

1 1

[PATCH kernel-4.19 01/41] net: hns3: remove redundant client_setup_tc handle
by Yang Yingliang 08 Jun '21

08 Jun '21

From: Jian Shen <shenjian15(a)huawei.com> mainline inclusion from mainline-v5.12-rc1 commit ae9e492a366433b97be414d2e90a2e24f8446abf category: bugfix bugzilla: NA CVE: NA ---------------------------- Since the real tx queue number and real rx queue number always be updated when netdev opens, it's redundant to call hclge_client_setup_tc to do the same thing. So remove it. Signed-off-by: Jian Shen <shenjian15(a)huawei.com> Signed-off-by: Huazhong Tan <tanhuazhong(a)huawei.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Signed-off-by: Yonglong Liu <liuyonglong(a)huawei.com> Reviewed-by: li yongxin <liyongxin1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 - .../net/ethernet/hisilicon/hns3/hns3_enet.c | 15 --------- .../hisilicon/hns3/hns3pf/hclge_dcb.c | 31 ------------------- 3 files changed, 47 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h index e407343fd0954..2e4b5c099fb4e 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h +++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h @@ -216,7 +216,6 @@ struct hnae3_client_ops { int (*init_instance)(struct hnae3_handle *handle); void (*uninit_instance)(struct hnae3_handle *handle, bool reset); void (*link_status_change)(struct hnae3_handle *handle, bool state); - int (*setup_tc)(struct hnae3_handle *handle, u8 tc); int (*reset_notify)(struct hnae3_handle *handle, enum hnae3_reset_notify_type type); void (*process_hw_error)(struct hnae3_handle *handle, diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c index e409633748a90..1db68d60794dd 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c @@ -4240,20 +4240,6 @@ static void hns3_link_status_change(struct hnae3_handle *handle, bool linkup) } } -static int hns3_client_setup_tc(struct hnae3_handle *handle, u8 tc) -{ - struct hnae3_knic_private_info *kinfo = &handle->kinfo; - struct net_device *ndev = kinfo->netdev; - - if (tc > HNAE3_MAX_TC) - return -EINVAL; - - if (!ndev) - return -ENODEV; - - return hns3_nic_set_real_num_queue(ndev); -} - static void hns3_clear_tx_ring(struct hns3_enet_ring *ring) { while (ring->next_to_clean != ring->next_to_use) { @@ -4682,7 +4668,6 @@ const struct hnae3_client_ops client_ops = { .init_instance = hns3_client_init, .uninit_instance = hns3_client_uninit, .link_status_change = hns3_link_status_change, - .setup_tc = hns3_client_setup_tc, .reset_notify = hns3_reset_notify, .process_hw_error = hns3_process_hw_error, }; diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c index 174a0bde8fe73..bf2f43281fda1 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c @@ -175,29 +175,6 @@ static int hclge_map_update(struct hclge_dev *hdev) return hclge_rss_init_hw(hdev); } -static int hclge_client_setup_tc(struct hclge_dev *hdev) -{ - struct hclge_vport *vport = hdev->vport; - struct hnae3_client *client; - struct hnae3_handle *handle; - int ret; - u32 i; - - for (i = 0; i < hdev->num_vmdq_vport + 1; i++) { - handle = &vport[i].nic; - client = handle->client; - - if (!client || !client->ops || !client->ops->setup_tc) - continue; - - ret = client->ops->setup_tc(handle, hdev->tm_info.num_tc); - if (ret) - return ret; - } - - return 0; -} - static int hclge_notify_down_uinit(struct hclge_dev *hdev) { int ret; @@ -257,10 +234,6 @@ static int hclge_ieee_setets(struct hnae3_handle *h, struct ieee_ets *ets) if (ret) goto err_out; - ret = hclge_client_setup_tc(hdev); - if (ret) - goto err_out; - ret = hclge_notify_init_up(hdev); if (ret) return ret; @@ -424,10 +397,6 @@ static int hclge_setup_tc(struct hnae3_handle *h, u8 tc, u8 *prio_tc) if (ret) goto err_out; - ret = hclge_client_setup_tc(hdev); - if (ret) - goto err_out; - hdev->flag &= ~HCLGE_FLAG_DCB_ENABLE; if (tc > 1) -- 2.25.1

1 40

[PATCH kernel-4.19 1/3] share_pool: Fix address checker
by Yang Yingliang 07 Jun '21

07 Jun '21

From: Tang Yizhou <tangyizhou(a)huawei.com> ascend inclusion category: bugfix bugzilla: 55086 CVE: NA ------------------------------------------------- Address range [MMAP_SHARE_POOL_START, MMAP_SHARE_POOL_16G_START) and [MMAP_SHARE_POOL_16G_START, MMAP_SHARE_POOL_16G_START + MMAP_SHARE_POOL_16G_SIZE) is always valid. Signed-off-by: Peng Wu <wupeng58(a)huawei.com> Signed-off-by: Tang Yizhou <tangyizhou(a)huawei.com> Reviewed-by: Ding Tianhong <dingtianhong(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/share_pool.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/mm/share_pool.c b/mm/share_pool.c index ad842151f1c71..995db20a1d3b9 100644 --- a/mm/share_pool.c +++ b/mm/share_pool.c @@ -2603,6 +2603,12 @@ bool sp_config_dvpp_range(size_t start, size_t size, int device_id, int pid) } EXPORT_SYMBOL_GPL(sp_config_dvpp_range); +static bool is_sp_normal_addr(unsigned long addr) +{ + return addr >= MMAP_SHARE_POOL_START && + addr < MMAP_SHARE_POOL_16G_START + MMAP_SHARE_POOL_16G_SIZE; +} + /** * is_sharepool_addr() - Check if a user memory address belongs to share pool. * @addr: the userspace address to be checked. @@ -2615,13 +2621,13 @@ bool is_sharepool_addr(unsigned long addr) bool ret = false; if (sp_area_customized == false) - return addr >= MMAP_SHARE_POOL_START && - addr < (MMAP_SHARE_POOL_16G_START + MMAP_SHARE_POOL_16G_SIZE); + return is_sp_normal_addr(addr); spa = __find_sp_area(addr); if (spa && spa->spg) - ret = addr >= spa->spg->dvpp_va_start && - addr < (spa->spg->dvpp_va_start + spa->spg->dvpp_size); + ret = (addr >= spa->spg->dvpp_va_start && + addr < spa->spg->dvpp_va_start + spa->spg->dvpp_size) || + is_sp_normal_addr(addr); __sp_area_drop(spa); return ret; -- 2.25.1

1 2

[PATCH kernel-4.19 000/104] backport linux-4.19.193
by Yang Yingliang 07 Jun '21

07 Jun '21

Adrian Hunter (2): perf intel-pt: Fix sample instruction bytes perf intel-pt: Fix transaction abort handling Alaa Emad (1): media: dvb: Add check on sp8870_readreg return Alan Stern (1): USB: usbfs: Don't WARN about excessively large memory allocations Alexander Usyskin (1): mei: request autosuspend after sending rx flow control Alexei Starovoitov (1): bpf: extend is_branch_taken to registers Andrey Ignatov (1): selftests/bpf: Test narrow loads with off > 0 in test_verifier Andy Shevchenko (1): platform/x86: intel_punit_ipc: Append MODULE_DEVICE_TABLE for ACPI Anirudh Rayabharam (1): net: fujitsu: fix potential null-ptr-deref Anna Schumaker (1): NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return() Atul Gopinathan (1): serial: max310x: unregister uart driver in case of failure and abort Aurelien Aptel (1): cifs: set server->cipher_type to AES-128-CCM for SMB3.0 Chris Park (1): drm/amd/display: Disconnect non-DP with no EDID Christophe JAILLET (3): net: netcp: Fix an error message net: mdio: thunder: Fix a double free issue in the .remove function net: mdio: octeon: Fix some double free issues Chunfeng Yun (1): usb: core: reduce power-on-good delay time of root hub DENG Qingfang (1): net: dsa: mt7530: fix VLAN traffic leaks Dan Carpenter (5): NFS: fix an incorrect limit in filelayout_decode_layout() net: dsa: fix a crash if ->get_sset_count() fails staging: emxx_udc: fix loop in _nbu2ss_nuke() ASoC: cs35l33: fix an error code in probe() scsi: libsas: Use _safe() loop in sas_resume_port() Daniel Borkmann (2): bpf, test_verifier: switch bpf_get_stack's 0 s> r8 test bpf: Update selftests to reflect new error states Daniele Palmas (1): USB: serial: option: add Telit LE910-S1 compositions 0x7010, 0x7011 Dominik Andreas Schorpp (1): USB: serial: ftdi_sio: add IDs for IDS GmbH Products Dongliang Mu (2): NFC: nci: fix memory leak in nci_allocate_device misc/uss720: fix memory leak in uss720_probe Du Cheng (1): net: caif: remove BUG_ON(dev == NULL) in caif_xmit Felix Fietkau (1): perf jevents: Fix getting maximum number of fds Francesco Ruggeri (1): ipv6: record frag_max_size in atomic fragments in input path Fugang Duan (1): net: fec: fix the potential memory leak in fec_enet_init() Geert Uytterhoeven (1): serial: sh-sci: Fix off-by-one error in FIFO threshold register setting Greg Kroah-Hartman (5): kgdb: fix gcc-11 warnings harder libertas: register sysfs groups properly ASoC: cs43130: handle errors in cs43130_probe() properly media: gspca: properly check for errors in po1030_probe() Linux 4.19.193 Hoang Le (1): Revert "net:tipc: Fix a double free in tipc_sk_mcast_rcv" Jack Pham (1): usb: dwc3: gadget: Enable suspend events Jean Delvare (1): i2c: i801: Don't generate an interrupt on bus reset Jesse Brandeburg (2): ixgbe: fix large MTU request from VF drivers/net/ethernet: clean up unused assignments Jingwen Chen (1): drm/amd/amdgpu: fix refcount leak Johan Hovold (2): net: hso: fix control-request directions USB: trancevibrator: fix control-request direction Johannes Berg (5): mac80211: drop A-MSDUs on old ciphers mac80211: add fragment cache to sta_info mac80211: check defrag PN against current frame mac80211: prevent attacks on TKIP/WEP as well mac80211: do not accept/forward invalid EAPOL frames John Fastabend (1): bpf: Test_verifier, bpf_get_stack return value add <0 Josef Bacik (1): btrfs: do not BUG_ON in link_to_fixup_dir Jussi Maki (1): bpf: Set mac_len in bpf_skb_change_head Kai-Heng Feng (1): platform/x86: hp_accel: Avoid invoking _INI to speed up resume Kees Cook (1): proc: Check /proc/$pid/attr/ writes against file opener Krzysztof Kozlowski (1): i2c: s3c2410: fix possible NULL pointer deref on read message after write Lucas Stankus (1): staging: iio: cdc: ad7746: avoid overwrite of num_channels Lukas Wunner (3): spi: gpio: Don't leak SPI master in probe error path spi: mt7621: Disable clock in probe error path spi: mt7621: Don't leak SPI master in probe error path Mathias Nyman (1): thunderbolt: dma_port: Fix NVM read buffer bounds and offset issue Mathy Vanhoef (4): mac80211: assure all fragments are encrypted mac80211: prevent mixed key and fragment cache attacks mac80211: properly handle A-MSDUs that start with an RFC 1042 header cfg80211: mitigate A-MSDU aggregation attacks Matt Wang (1): scsi: BusLogic: Fix 64-bit system enumeration error for Buslogic Mike Kravetz (1): hugetlbfs: hugetlb_fault_mutex_hash() cleanup Mikulas Patocka (1): dm snapshot: properly fix a crash when an origin has no snapshots Neil Armstrong (1): drm/meson: fix shutdown crash when component not probed Ovidiu Panait (2): bpf: fix up selftests after backports were fixed selftests/bpf: add selftest part of "bpf: improve verifier branch analysis" Pavel Skripkin (1): net: usb: fix memory leak in smsc75xx_bind Peter Zijlstra (1): openrisc: Define memory barrier mb Phillip Potter (2): isdn: mISDNinfineon: check/cleanup ioremap failure correctly in setup_io dmaengine: qcom_hidma: comment platform_driver_register call Piotr Krysiuk (1): bpf, selftests: Fix up some test_verifier cases for unprivileged Randy Dunlap (2): MIPS: alchemy: xxs1500: add gpio-au1000.h header file MIPS: ralink: export rt_sysc_membase for rt2880_wdt.c Rolf Eike Beer (1): iommu/vt-d: Fix sysfs leak in alloc_iommu() Sean MacLennan (1): USB: serial: ti_usb_3410_5052: add startech.com device id Shyam Sundar S K (1): platform/x86: hp-wireless: add AMD's hardware id to the supported list Sriram R (1): ath10k: Validate first subframe of A-MSDU before processing the list Steve French (1): SMB3: incorrect file id in requests compounded with open Taehee Yoo (2): mld: fix panic in mld_newpack() sch_dsmark: fix a NULL deref in qdisc_reset() Tao Liu (1): openvswitch: meter: fix race when getting now_ms. Thadeu Lima de Souza Cascardo (1): Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails Thinh Nguyen (1): usb: dwc3: gadget: Properly track pending and queued SG Tom Seewald (1): char: hpet: add checks after calling ioremap Trond Myklebust (1): NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce() Vladimir Oltean (1): net: dsa: fix error code getting shifted with 4 in dsa_slave_get_sset_count Vladyslav Tarasiuk (1): net/mlx4: Fix EEPROM dump support Wen Gong (1): mac80211: extend protection against mixed key and fragment cache attacks Xin Long (1): tipc: skb_linearize the head skb when reassembling msgs Yoshihiro Shimoda (1): usb: gadget: udc: renesas_usb3: Fix a race in usb3_start_pipen() YueHaibing (1): iio: adc: ad7793: Add missing error code in ad7793_setup() Yunsheng Lin (1): net: hns3: check the return of skb_checksum_help() Zhang Xiaoxu (1): NFSv4: Fix v4.0/v4.1 SEEK_DATA return -ENOTSUPP when set NFS_V4_2 config Zhen Lei (1): net: bnx2: Fix error return code in bnx2_init_board() Zheyu Ma (1): serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait' Zolton Jheng (1): USB: serial: pl2303: add device id for ADLINK ND-6530 GC xinhui pan (1): drm/amdgpu: Fix a use-after-free Makefile | 2 +- arch/mips/alchemy/board-xxs1500.c | 1 + arch/mips/ralink/of.c | 2 + arch/openrisc/include/asm/barrier.h | 9 ++ drivers/char/hpet.c | 4 + drivers/dma/qcom/hidma_mgmt.c | 14 ++ drivers/gpu/drm/amd/amdgpu/amdgpu_fb.c | 3 + drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c | 1 + drivers/gpu/drm/amd/display/dc/core/dc_link.c | 18 +++ drivers/gpu/drm/meson/meson_drv.c | 9 +- drivers/i2c/busses/i2c-i801.c | 6 +- drivers/i2c/busses/i2c-s3c2410.c | 3 + drivers/iio/adc/ad7793.c | 1 + drivers/iommu/dmar.c | 4 +- drivers/isdn/hardware/mISDN/mISDNinfineon.c | 24 ++- drivers/md/dm-snap.c | 2 +- drivers/media/dvb-frontends/sp8870.c | 4 +- drivers/media/usb/gspca/m5602/m5602_po1030.c | 10 +- drivers/misc/kgdbts.c | 3 +- drivers/misc/lis3lv02d/lis3lv02d.h | 1 + drivers/misc/mei/interrupt.c | 3 + drivers/net/caif/caif_serial.c | 1 - drivers/net/dsa/mt7530.c | 8 - drivers/net/ethernet/broadcom/bnx2.c | 2 +- drivers/net/ethernet/brocade/bna/bnad.c | 7 +- drivers/net/ethernet/dec/tulip/de4x5.c | 4 +- drivers/net/ethernet/dec/tulip/media.c | 5 - drivers/net/ethernet/freescale/fec_main.c | 11 +- drivers/net/ethernet/fujitsu/fmvj18x_cs.c | 5 + .../net/ethernet/hisilicon/hns3/hns3_enet.c | 10 +- .../net/ethernet/intel/ixgbe/ixgbe_sriov.c | 16 +- .../net/ethernet/mellanox/mlx4/en_ethtool.c | 4 +- drivers/net/ethernet/mellanox/mlx4/en_tx.c | 2 +- drivers/net/ethernet/mellanox/mlx4/port.c | 107 ++++++++++++- drivers/net/ethernet/micrel/ksz884x.c | 3 +- drivers/net/ethernet/microchip/lan743x_main.c | 6 +- .../net/ethernet/neterion/vxge/vxge-traffic.c | 32 ++-- drivers/net/ethernet/sfc/falcon/farch.c | 29 ++-- drivers/net/ethernet/sis/sis900.c | 5 +- .../net/ethernet/synopsys/dwc-xlgmac-common.c | 2 +- drivers/net/ethernet/ti/davinci_emac.c | 5 +- drivers/net/ethernet/ti/netcp_core.c | 2 +- drivers/net/ethernet/ti/tlan.c | 4 +- drivers/net/ethernet/via/via-velocity.c | 13 -- drivers/net/phy/mdio-octeon.c | 2 - drivers/net/phy/mdio-thunder.c | 1 - drivers/net/usb/hso.c | 4 +- drivers/net/usb/smsc75xx.c | 8 +- drivers/net/wireless/ath/ath10k/htt_rx.c | 61 ++++++- drivers/net/wireless/marvell/libertas/mesh.c | 28 +--- drivers/platform/x86/hp-wireless.c | 2 + drivers/platform/x86/hp_accel.c | 22 ++- drivers/platform/x86/intel_punit_ipc.c | 1 + drivers/scsi/BusLogic.c | 6 +- drivers/scsi/BusLogic.h | 2 +- drivers/scsi/libsas/sas_port.c | 4 +- drivers/spi/spi-gpio.c | 2 +- drivers/staging/emxx_udc/emxx_udc.c | 4 +- drivers/staging/iio/cdc/ad7746.c | 1 - drivers/staging/mt7621-spi/spi-mt7621.c | 10 +- drivers/thunderbolt/dma_port.c | 11 +- drivers/tty/serial/max310x.c | 6 +- drivers/tty/serial/rp2.c | 52 ++---- drivers/tty/serial/sh-sci.c | 4 +- drivers/usb/core/devio.c | 11 +- drivers/usb/core/hub.h | 6 +- drivers/usb/dwc3/gadget.c | 17 +- drivers/usb/gadget/udc/renesas_usb3.c | 5 +- drivers/usb/misc/trancevibrator.c | 4 +- drivers/usb/misc/uss720.c | 1 + drivers/usb/serial/ftdi_sio.c | 3 + drivers/usb/serial/ftdi_sio_ids.h | 7 + drivers/usb/serial/option.c | 4 + drivers/usb/serial/pl2303.c | 1 + drivers/usb/serial/pl2303.h | 1 + drivers/usb/serial/ti_usb_3410_5052.c | 3 + fs/btrfs/tree-log.c | 2 - fs/cifs/smb2pdu.c | 13 +- fs/hugetlbfs/inode.c | 4 +- fs/nfs/filelayout/filelayout.c | 2 +- fs/nfs/nfs4file.c | 2 +- fs/nfs/pagelist.c | 12 +- fs/nfs/pnfs.c | 15 +- fs/proc/base.c | 4 + include/linux/hugetlb.h | 2 +- include/net/cfg80211.h | 4 +- include/net/nfc/nci_core.h | 1 + kernel/bpf/verifier.c | 33 ++-- mm/hugetlb.c | 10 +- mm/userfaultfd.c | 2 +- net/bluetooth/cmtp/core.c | 5 + net/core/filter.c | 1 + net/dsa/master.c | 5 +- net/dsa/slave.c | 12 +- net/ipv6/mcast.c | 3 - net/ipv6/reassembly.c | 4 +- net/mac80211/ieee80211_i.h | 36 ++--- net/mac80211/iface.c | 11 +- net/mac80211/key.c | 7 + net/mac80211/key.h | 2 + net/mac80211/rx.c | 150 ++++++++++++++---- net/mac80211/sta_info.c | 6 +- net/mac80211/sta_info.h | 32 ++++ net/mac80211/wpa.c | 13 +- net/nfc/nci/core.c | 1 + net/nfc/nci/hci.c | 5 + net/openvswitch/meter.c | 8 + net/sched/sch_dsmark.c | 3 +- net/tipc/msg.c | 9 +- net/tipc/socket.c | 5 +- net/wireless/util.c | 7 +- sound/soc/codecs/cs35l33.c | 1 + sound/soc/codecs/cs43130.c | 28 ++-- tools/perf/pmu-events/jevents.c | 2 +- .../util/intel-pt-decoder/intel-pt-decoder.c | 6 +- tools/perf/util/intel-pt.c | 5 +- tools/testing/selftests/bpf/test_verifier.c | 112 ++++++++++--- 117 files changed, 855 insertions(+), 431 deletions(-) create mode 100644 arch/openrisc/include/asm/barrier.h -- 2.25.1

1 104

[PATCH kernel-4.19 1/4] readahead: introduce FMODE_WILLNEED to read first 2MB of file
by Yang Yingliang 05 Jun '21

05 Jun '21

From: Yufen Yu <yuyufen(a)huawei.com> hulk inclusion category: feature bugzilla: NA CVE: NA ------------------------------------------------- In some scenario, likely spark-sql, almost all meta file's size is less then 2MB and applications read these smaller files in random mode. That means, it may issue multiple times random io to rotate disk, which can cause performance degradation. To improve the small files random read, we try to read the first 2MB into pagecache on the first time of read. Then it can avoid multiple random io. In fact, applications can call fadvise system with POSIX_FADV_WILLNEED to achieve this goal. But, some apps may cannot easily do that. So, we provide a new file flag FMODE_WILLNEED. Signed-off-by: Yufen Yu <yuyufen(a)huawei.com> Reviewed-by: Hou Tao <houtao1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/fs.h | 3 +++ mm/readahead.c | 36 ++++++++++++++++++++++++++++++++++++ 2 files changed, 39 insertions(+) diff --git a/include/linux/fs.h b/include/linux/fs.h index 36d828c741d5c..05c85ee240aff 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h @@ -169,6 +169,9 @@ typedef int (dio_iodone_t)(struct kiocb *iocb, loff_t offset, /* File does not contribute to nr_files count */ #define FMODE_NOACCOUNT ((__force fmode_t)0x20000000) +/* File will try to read head of the file into pagecache */ +#define FMODE_WILLNEED ((__force fmode_t)0x40000000) + /* * Flag for rw_copy_check_uvector and compat_rw_copy_check_uvector * that indicates that they should check the contents of the iovec are diff --git a/mm/readahead.c b/mm/readahead.c index 205ac348bb4ae..89da1e7f0aee0 100644 --- a/mm/readahead.c +++ b/mm/readahead.c @@ -24,6 +24,7 @@ #include "internal.h" +#define READAHEAD_FIRST_SIZE (2 * 1024 * 1024) /* * Initialise a struct file's readahead state. Assumes that the caller has * memset *ra to zero. @@ -491,6 +492,35 @@ ondemand_readahead(struct address_space *mapping, return ra_submit(ra, mapping, filp); } +/* + * Try to read first @ra_size from head of the file. + */ +static bool page_cache_readahead_from_head(struct address_space *mapping, + struct file *filp, pgoff_t offset, + unsigned long req_size, + unsigned long ra_size) +{ + struct backing_dev_info *bdi = inode_to_bdi(mapping->host); + struct file_ra_state *ra = &filp->f_ra; + unsigned long size = min_t(unsigned long, ra_size, + file_inode(filp)->i_size); + unsigned long nrpages = (size + PAGE_SIZE - 1) / PAGE_SIZE; + unsigned long max_pages; + unsigned int offs = 0; + + /* Cannot read date over target size, back to normal way */ + if (offset + req_size > nrpages) + return false; + + max_pages = max_t(unsigned long, bdi->io_pages, ra->ra_pages); + max_pages = min(max_pages, nrpages); + while (offs < nrpages) { + force_page_cache_readahead(mapping, filp, offs, max_pages); + offs += max_pages; + } + return true; +} + /** * page_cache_sync_readahead - generic file readahead * @mapping: address_space which holds the pagecache and I/O vectors @@ -516,6 +546,12 @@ void page_cache_sync_readahead(struct address_space *mapping, if (blk_cgroup_congested()) return; + /* try to read first READAHEAD_FIRST_SIZE into pagecache */ + if (filp && (filp->f_mode & FMODE_WILLNEED) && + page_cache_readahead_from_head(mapping, filp, + offset, req_size, READAHEAD_FIRST_SIZE)) + return; + /* be dumb */ if (filp && (filp->f_mode & FMODE_RANDOM)) { force_page_cache_readahead(mapping, filp, offset, req_size); -- 2.25.1

1 3

Add support for ACPI device use physical node as pci device, to establish identity mapping
by LeoLiuoc 04 Jun '21

04 Jun '21

When using ACPI device to create identity mapping, if the physical node of the ACPI device is a pci device, domain_1 will be created for these two devices. But if the pci device and other pci devices belong to another domain_2, this will happen conflict and destroy another domain. Such as PCI devices under the PCIE-to-PCI bridge. Therefore, when the physical node of the ACPI device is a PCI device, this patch uses the PCI device to create the domain. In this way, there is only one domain. Signed-off-by: LeoLiu-oc <LeoLiu-oc(a)zhaoxin.com> --- drivers/iommu/intel-iommu.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c index e111e5d6d269..cf0dc4c80183 100644 --- a/drivers/iommu/intel-iommu.c +++ b/drivers/iommu/intel-iommu.c @@ -2736,12 +2736,32 @@ static int domain_prepare_identity_map(struct device *dev, return iommu_domain_identity_map(domain, start, end); } +static struct device *acpi_dev_find_pci_dev(struct device *dev) +{ + struct acpi_device_physical_node *pn; + struct acpi_device *adev; + + if (dev->bus == &acpi_bus_type) { + adev = to_acpi_device(dev); + mutex_lock(&adev->physical_node_lock); + list_for_each_entry(pn, &adev->physical_node_list, node) { + if (dev_is_pci(pn->dev)) { + return pn->dev; + } + } + mutex_unlock(&adev->physical_node_lock); + } + + return dev; +} + static int iommu_prepare_identity_map(struct device *dev, unsigned long long start, unsigned long long end) { struct dmar_domain *domain; int ret; + dev = acpi_dev_find_pci_dev(dev); domain = get_domain_for_dev(dev, DEFAULT_DOMAIN_ADDRESS_WIDTH); if (!domain) -- 2.20.1

1 0