- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS] scsi: target: Fix XCOPY NAA identifier lookup
by Yang Yingliang 04 Feb '21

04 Feb '21

From: David Disseldorp <ddiss(a)suse.de> stable inclusion from linux-4.19.167 commit fff1180d24e68d697f98642d71444316036a81ff CVE: CVE-2020-28374 -------------------------------- commit 2896c93811e39d63a4d9b63ccf12a8fbc226e5e4 upstream. When attempting to match EXTENDED COPY CSCD descriptors with corresponding se_devices, target_xcopy_locate_se_dev_e4() currently iterates over LIO's global devices list which includes all configured backstores. This change ensures that only initiator-accessible backstores are considered during CSCD descriptor lookup, according to the session's se_node_acl LUN list. To avoid LUN removal race conditions, device pinning is changed from being configfs based to instead using the se_node_acl lun_ref. Reference: CVE-2020-28374 Fixes: cbf031f425fd ("target: Add support for EXTENDED_COPY copy offload emulation") Reviewed-by: Lee Duncan <lduncan(a)suse.com> Signed-off-by: David Disseldorp <ddiss(a)suse.de> Signed-off-by: Mike Christie <michael.christie(a)oracle.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/target/target_core_xcopy.c | 119 +++++++++++++++++------------ drivers/target/target_core_xcopy.h | 1 + 2 files changed, 71 insertions(+), 49 deletions(-) diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c index 7cdb5d7f6538..1709b8a99bd7 100644 --- a/drivers/target/target_core_xcopy.c +++ b/drivers/target/target_core_xcopy.c @@ -55,60 +55,83 @@ static int target_xcopy_gen_naa_ieee(struct se_device *dev, unsigned char *buf) return 0; } -struct xcopy_dev_search_info { - const unsigned char *dev_wwn; - struct se_device *found_dev; -}; - +/** + * target_xcopy_locate_se_dev_e4_iter - compare XCOPY NAA device identifiers + * + * @se_dev: device being considered for match + * @dev_wwn: XCOPY requested NAA dev_wwn + * @return: 1 on match, 0 on no-match + */ static int target_xcopy_locate_se_dev_e4_iter(struct se_device *se_dev, - void *data) + const unsigned char *dev_wwn) { - struct xcopy_dev_search_info *info = data; unsigned char tmp_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN]; int rc; - if (!se_dev->dev_attrib.emulate_3pc) + if (!se_dev->dev_attrib.emulate_3pc) { + pr_debug("XCOPY: emulate_3pc disabled on se_dev %p\n", se_dev); return 0; + } memset(&tmp_dev_wwn[0], 0, XCOPY_NAA_IEEE_REGEX_LEN); target_xcopy_gen_naa_ieee(se_dev, &tmp_dev_wwn[0]); - rc = memcmp(&tmp_dev_wwn[0], info->dev_wwn, XCOPY_NAA_IEEE_REGEX_LEN); - if (rc != 0) - return 0; - - info->found_dev = se_dev; - pr_debug("XCOPY 0xe4: located se_dev: %p\n", se_dev); - - rc = target_depend_item(&se_dev->dev_group.cg_item); + rc = memcmp(&tmp_dev_wwn[0], dev_wwn, XCOPY_NAA_IEEE_REGEX_LEN); if (rc != 0) { - pr_err("configfs_depend_item attempt failed: %d for se_dev: %p\n", - rc, se_dev); - return rc; + pr_debug("XCOPY: skip non-matching: %*ph\n", + XCOPY_NAA_IEEE_REGEX_LEN, tmp_dev_wwn); + return 0; } + pr_debug("XCOPY 0xe4: located se_dev: %p\n", se_dev); - pr_debug("Called configfs_depend_item for se_dev: %p se_dev->se_dev_group: %p\n", - se_dev, &se_dev->dev_group); return 1; } -static int target_xcopy_locate_se_dev_e4(const unsigned char *dev_wwn, - struct se_device **found_dev) +static int target_xcopy_locate_se_dev_e4(struct se_session *sess, + const unsigned char *dev_wwn, + struct se_device **_found_dev, + struct percpu_ref **_found_lun_ref) { - struct xcopy_dev_search_info info; - int ret; - - memset(&info, 0, sizeof(info)); - info.dev_wwn = dev_wwn; - - ret = target_for_each_device(target_xcopy_locate_se_dev_e4_iter, &info); - if (ret == 1) { - *found_dev = info.found_dev; - return 0; - } else { - pr_debug_ratelimited("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n"); - return -EINVAL; + struct se_dev_entry *deve; + struct se_node_acl *nacl; + struct se_lun *this_lun = NULL; + struct se_device *found_dev = NULL; + + /* cmd with NULL sess indicates no associated $FABRIC_MOD */ + if (!sess) + goto err_out; + + pr_debug("XCOPY 0xe4: searching for: %*ph\n", + XCOPY_NAA_IEEE_REGEX_LEN, dev_wwn); + + nacl = sess->se_node_acl; + rcu_read_lock(); + hlist_for_each_entry_rcu(deve, &nacl->lun_entry_hlist, link) { + struct se_device *this_dev; + int rc; + + this_lun = rcu_dereference(deve->se_lun); + this_dev = rcu_dereference_raw(this_lun->lun_se_dev); + + rc = target_xcopy_locate_se_dev_e4_iter(this_dev, dev_wwn); + if (rc) { + if (percpu_ref_tryget_live(&this_lun->lun_ref)) + found_dev = this_dev; + break; + } } + rcu_read_unlock(); + if (found_dev == NULL) + goto err_out; + + pr_debug("lun_ref held for se_dev: %p se_dev->se_dev_group: %p\n", + found_dev, &found_dev->dev_group); + *_found_dev = found_dev; + *_found_lun_ref = &this_lun->lun_ref; + return 0; +err_out: + pr_debug_ratelimited("Unable to locate 0xe4 descriptor for EXTENDED_COPY\n"); + return -EINVAL; } static int target_xcopy_parse_tiddesc_e4(struct se_cmd *se_cmd, struct xcopy_op *xop, @@ -255,12 +278,16 @@ static int target_xcopy_parse_target_descriptors(struct se_cmd *se_cmd, switch (xop->op_origin) { case XCOL_SOURCE_RECV_OP: - rc = target_xcopy_locate_se_dev_e4(xop->dst_tid_wwn, - &xop->dst_dev); + rc = target_xcopy_locate_se_dev_e4(se_cmd->se_sess, + xop->dst_tid_wwn, + &xop->dst_dev, + &xop->remote_lun_ref); break; case XCOL_DEST_RECV_OP: - rc = target_xcopy_locate_se_dev_e4(xop->src_tid_wwn, - &xop->src_dev); + rc = target_xcopy_locate_se_dev_e4(se_cmd->se_sess, + xop->src_tid_wwn, + &xop->src_dev, + &xop->remote_lun_ref); break; default: pr_err("XCOPY CSCD descriptor IDs not found in CSCD list - " @@ -412,18 +439,12 @@ static int xcopy_pt_get_cmd_state(struct se_cmd *se_cmd) static void xcopy_pt_undepend_remotedev(struct xcopy_op *xop) { - struct se_device *remote_dev; - if (xop->op_origin == XCOL_SOURCE_RECV_OP) - remote_dev = xop->dst_dev; + pr_debug("putting dst lun_ref for %p\n", xop->dst_dev); else - remote_dev = xop->src_dev; - - pr_debug("Calling configfs_undepend_item for" - " remote_dev: %p remote_dev->dev_group: %p\n", - remote_dev, &remote_dev->dev_group.cg_item); + pr_debug("putting src lun_ref for %p\n", xop->src_dev); - target_undepend_item(&remote_dev->dev_group.cg_item); + percpu_ref_put(xop->remote_lun_ref); } static void xcopy_pt_release_cmd(struct se_cmd *se_cmd) diff --git a/drivers/target/target_core_xcopy.h b/drivers/target/target_core_xcopy.h index 26ba4c3c9cff..974bc1e19ff2 100644 --- a/drivers/target/target_core_xcopy.h +++ b/drivers/target/target_core_xcopy.h @@ -29,6 +29,7 @@ struct xcopy_op { struct se_device *dst_dev; unsigned char dst_tid_wwn[XCOPY_NAA_IEEE_REGEX_LEN]; unsigned char local_dev_wwn[XCOPY_NAA_IEEE_REGEX_LEN]; + struct percpu_ref *remote_lun_ref; sector_t src_lba; sector_t dst_lba; -- 2.25.1

1 0

[PATCH kernel-4.19 1/2] netfilter: add and use nf_hook_slow_list()
by Yang Yingliang 30 Jan '21

30 Jan '21

From: Florian Westphal <fw(a)strlen.de> mainline inclusion from mainline-v5.5-rc1 commit ca58fbe06c54795f00db79e447f94c2028d30124 category: bugfix bugzilla: NA CVE: CVE-2021-20177 -------------------------------- At this time, NF_HOOK_LIST() macro will iterate the list and then calls nf_hook() for each individual skb. This makes it so the entire list is passed into the netfilter core. The advantage is that we only need to fetch the rule blob once per list instead of per-skb. NF_HOOK_LIST now only works for ipv4 and ipv6, as those are the only callers. v2: use skb_list_del_init() instead of list_del (Edward Cree) Signed-off-by: Florian Westphal <fw(a)strlen.de> Acked-by: Edward Cree <ecree(a)solarflare.com> Signed-off-by: Pablo Neira Ayuso <pablo(a)netfilter.org> Conflicts: include/linux/netfilter.h net/netfilter/core.c [yyl: adjust context] Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/linux/netfilter.h | 41 +++++++++++++++++++++++++++++---------- net/netfilter/core.c | 20 +++++++++++++++++++ 2 files changed, 51 insertions(+), 10 deletions(-) diff --git a/include/linux/netfilter.h b/include/linux/netfilter.h index 9460a5635c90..8bf57abee9e4 100644 --- a/include/linux/netfilter.h +++ b/include/linux/netfilter.h @@ -183,6 +183,8 @@ extern struct static_key nf_hooks_needed[NFPROTO_NUMPROTO][NF_MAX_HOOKS]; int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state, const struct nf_hook_entries *e, unsigned int i); +void nf_hook_slow_list(struct list_head *head, struct nf_hook_state *state, + const struct nf_hook_entries *e); /** * nf_hook - call a netfilter hook * @@ -295,17 +297,36 @@ NF_HOOK_LIST(uint8_t pf, unsigned int hook, struct net *net, struct sock *sk, struct list_head *head, struct net_device *in, struct net_device *out, int (*okfn)(struct net *, struct sock *, struct sk_buff *)) { - struct sk_buff *skb, *next; - struct list_head sublist; - - INIT_LIST_HEAD(&sublist); - list_for_each_entry_safe(skb, next, head, list) { - skb_list_del_init(skb); - if (nf_hook(pf, hook, net, sk, skb, in, out, okfn) == 1) - list_add_tail(&skb->list, &sublist); + struct nf_hook_entries *hook_head = NULL; + +#ifdef CONFIG_JUMP_LABEL + if (__builtin_constant_p(pf) && + __builtin_constant_p(hook) && + !static_key_false(&nf_hooks_needed[pf][hook])) + return; +#endif + + rcu_read_lock(); + switch (pf) { + case NFPROTO_IPV4: + hook_head = rcu_dereference(net->nf.hooks_ipv4[hook]); + break; + case NFPROTO_IPV6: + hook_head = rcu_dereference(net->nf.hooks_ipv6[hook]); + break; + default: + WARN_ON_ONCE(1); + break; } - /* Put passed packets back on main list */ - list_splice(&sublist, head); + + if (hook_head) { + struct nf_hook_state state; + + nf_hook_state_init(&state, hook, pf, in, out, sk, net, okfn); + + nf_hook_slow_list(head, &state, hook_head); + } + rcu_read_unlock(); } /* Call setsockopt() */ diff --git a/net/netfilter/core.c b/net/netfilter/core.c index 93aaec3a54ec..3f0bdc728f89 100644 --- a/net/netfilter/core.c +++ b/net/netfilter/core.c @@ -536,6 +536,26 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state, EXPORT_SYMBOL(nf_hook_slow); +void nf_hook_slow_list(struct list_head *head, struct nf_hook_state *state, + const struct nf_hook_entries *e) +{ + struct sk_buff *skb, *next; + struct list_head sublist; + int ret; + + INIT_LIST_HEAD(&sublist); + + list_for_each_entry_safe(skb, next, head, list) { + skb_list_del_init(skb); + ret = nf_hook_slow(skb, state, e, 0); + if (ret == 1) + list_add_tail(&skb->list, &sublist); + } + /* Put passed packets back on main list */ + list_splice(&sublist, head); +} +EXPORT_SYMBOL(nf_hook_slow_list); + int skb_make_writable(struct sk_buff *skb, unsigned int writable_len) { if (writable_len > skb->len) -- 2.25.1

1 1

[PATCH kernel-4.19 00/57] backport stable-4.19.171
by Yang Yingliang 29 Jan '21

29 Jan '21

Alex Leibovich (1): mmc: sdhci-xenon: fix 1.8v regulator stabilization Alexander Lobakin (1): skbuff: back tiny skbs with kmalloc() in __netdev_alloc_skb() too Alexander Shishkin (1): intel_th: pci: Add Alder Lake-P support Arnd Bergmann (1): scsi: megaraid_sas: Fix MEGASAS_IOC_FIRMWARE regression Ben Skeggs (5): drm/nouveau/bios: fix issue shadowing expansion ROMs drm/nouveau/privring: ack interrupts the same way as RM drm/nouveau/i2c/gm200: increase width of aux semaphore owner fields drm/nouveau/mmu: fix vram heap sizing drm/nouveau/kms/nv50-: fix case where notifier buffer is at offset 0 Can Guo (1): scsi: ufs: Correct the LUN used in eh_device_reset_handler() callback Cezary Rojewski (1): ASoC: Intel: haswell: Add missing pm_ops Damien Le Moal (1): riscv: Fix kernel time_init() Dan Carpenter (1): net: dsa: b53: fix an off by one in checking "vlan->vid" David Woodhouse (1): xen: Fix event channel callback via INTX/GSI Eric Dumazet (2): net_sched: avoid shift-out-of-bounds in tcindex_set_parms() net_sched: reject silly cell_log in qdisc_get_rtab() Eugene Korenevsky (1): ehci: fix EHCI host controller initialization sequence Geert Uytterhoeven (1): sh_eth: Fix power down vs. is_opened flag ordering Greg Kroah-Hartman (1): Linux 4.19.171 Guillaume Nault (2): netfilter: rpfilter: mask ecn bits before fib lookup udp: mask TOS bits in udp_v4_early_demux() Hangbin Liu (1): selftests: net: fib_tests: remove duplicate log test Hannes Reinecke (1): dm: avoid filesystem lookup in dm_get_dev_t() Hans de Goede (2): ACPI: scan: Make acpi_bus_get_device() clear return pointer on error platform/x86: intel-vbtn: Drop HP Stream x360 Convertible PC 11 from allow-list JC Kuo (1): xhci: tegra: Delay for disabling LFPS detector Josef Bacik (1): btrfs: fix lockdep splat in btrfs_recover_relocation Lars-Peter Clausen (1): iio: ad5504: Fix setting power-down state Lecopzer Chen (2): kasan: fix unaligned address is unhandled in kasan_remove_zero_shadow kasan: fix incorrect arguments passing in kasan_add_zero_shadow Longfang Liu (1): USB: ehci: fix an interrupt calltrace error Mathias Kresin (1): irqchip/mips-cpu: Set IPI domain parent chip Mathias Nyman (1): xhci: make sure TRB is fully written before giving it to the controller Matteo Croce (2): ipv6: create multicast route with RTPROT_KERNEL ipv6: set multicast flag on the multicast route Mikko Perttunen (1): i2c: bpmp-tegra: Ignore unknown I2C_M flags Mikulas Patocka (1): dm integrity: fix a crash if "recalculate" used without "internal_hash" Necip Fazil Yildiran (1): sh: dma: fix kconfig dependency for G2_DMA Nilesh Javali (1): scsi: qedi: Correct max length of CHAP secret Pali Rohár (1): serial: mvebu-uart: fix tx lost characters at power off Pan Bian (1): drm/atomic: put state on error path Patrik Jakobsson (1): usb: bdc: Make bdc pci driver depend on BROKEN Peter Collingbourne (1): mmc: core: don't initialize block size from ext_csd if not present Peter Geis (1): clk: tegra30: Add hda clock default rates to clock driver Rafael J. Wysocki (1): driver core: Extend device_is_dependent() Ryan Chen (1): usb: gadget: aspeed: fix stop dma register setting. Seth Miller (1): HID: Ignore battery for Elan touchscreen on ASUS UX550 Takashi Iwai (2): ALSA: seq: oss: Fix missing error check in snd_seq_oss_synth_make_info() ALSA: hda/via: Add minimum mute flag Tariq Toukan (1): net: Disable NETIF_F_HW_TLS_RX when RXCSUM is disabled Thinh Nguyen (1): usb: udc: core: Use lock when write to soft_connect Vincent Mailhol (3): can: dev: can_restart: fix use after free bug can: vxcan: vxcan_xmit: fix use after free bug can: peak_usb: fix use after free bugs Vladimir Oltean (1): net: mscc: ocelot: allow offloading of bridge on top of LAG Wang Hui (1): stm class: Fix module init return on allocation failure Wolfram Sang (1): i2c: octeon: check correct size of maximum RECV_LEN packet Makefile | 2 +- arch/arm/xen/enlighten.c | 2 +- arch/riscv/kernel/time.c | 3 + arch/sh/drivers/dma/Kconfig | 3 +- drivers/acpi/scan.c | 2 + drivers/base/core.c | 17 +++- drivers/clk/tegra/clk-tegra30.c | 2 + drivers/gpu/drm/drm_atomic_helper.c | 2 +- drivers/gpu/drm/nouveau/dispnv50/disp.c | 4 +- drivers/gpu/drm/nouveau/dispnv50/disp.h | 2 +- drivers/gpu/drm/nouveau/dispnv50/wimmc37b.c | 2 +- .../gpu/drm/nouveau/nvkm/subdev/bios/shadow.c | 2 +- .../drm/nouveau/nvkm/subdev/i2c/auxgm200.c | 8 +- .../gpu/drm/nouveau/nvkm/subdev/ibus/gf100.c | 10 ++- .../gpu/drm/nouveau/nvkm/subdev/ibus/gk104.c | 10 ++- .../gpu/drm/nouveau/nvkm/subdev/mmu/base.c | 6 +- drivers/hid/hid-ids.h | 1 + drivers/hid/hid-input.c | 2 + drivers/hwtracing/intel_th/pci.c | 5 ++ drivers/hwtracing/stm/heartbeat.c | 6 +- drivers/i2c/busses/i2c-octeon-core.c | 2 +- drivers/i2c/busses/i2c-tegra-bpmp.c | 2 +- drivers/iio/dac/ad5504.c | 4 +- drivers/irqchip/irq-mips-cpu.c | 7 ++ drivers/md/dm-integrity.c | 6 ++ drivers/md/dm-table.c | 15 +++- drivers/mmc/core/queue.c | 4 +- drivers/mmc/host/sdhci-xenon.c | 7 +- drivers/net/can/dev.c | 4 +- drivers/net/can/usb/peak_usb/pcan_usb_fd.c | 8 +- drivers/net/can/vxcan.c | 6 +- drivers/net/dsa/b53/b53_common.c | 2 +- drivers/net/ethernet/mscc/ocelot.c | 4 +- drivers/net/ethernet/renesas/sh_eth.c | 4 +- drivers/platform/x86/intel-vbtn.c | 6 -- drivers/scsi/megaraid/megaraid_sas_base.c | 6 +- drivers/scsi/qedi/qedi_main.c | 4 +- drivers/scsi/ufs/ufshcd.c | 11 +-- drivers/tty/serial/mvebu-uart.c | 10 ++- drivers/usb/gadget/udc/aspeed-vhub/epn.c | 5 +- drivers/usb/gadget/udc/bdc/Kconfig | 2 +- drivers/usb/gadget/udc/core.c | 13 ++- drivers/usb/host/ehci-hcd.c | 12 +++ drivers/usb/host/ehci-hub.c | 3 + drivers/usb/host/xhci-ring.c | 2 + drivers/usb/host/xhci-tegra.c | 7 ++ drivers/xen/events/events_base.c | 10 --- drivers/xen/platform-pci.c | 1 - drivers/xen/xenbus/xenbus.h | 1 + drivers/xen/xenbus/xenbus_comms.c | 8 -- drivers/xen/xenbus/xenbus_probe.c | 81 +++++++++++++++---- fs/btrfs/volumes.c | 2 + include/xen/xenbus.h | 2 +- mm/kasan/kasan_init.c | 23 +++--- net/core/dev.c | 5 ++ net/core/skbuff.c | 6 +- net/ipv4/netfilter/ipt_rpfilter.c | 2 +- net/ipv4/udp.c | 3 +- net/ipv6/addrconf.c | 3 +- net/sched/cls_tcindex.c | 8 +- net/sched/sch_api.c | 3 +- sound/core/seq/oss/seq_oss_synth.c | 3 +- sound/pci/hda/patch_via.c | 1 + sound/soc/intel/boards/haswell.c | 1 + tools/testing/selftests/net/fib_tests.sh | 1 - 65 files changed, 284 insertions(+), 127 deletions(-) -- 2.25.1

1 57

[FAQ] Introduce a JVMTI plug-in fix to openEuler release
by Erik Yuan 28 Jan '21

28 Jan '21

Hi, In Linux 5.8, Nick submitted a patch-set to fix some Errors in symbol search when you try to profile JIT compiled application in OpenJDK with perf. The patchset is: 1e4bd2ae4564 perf jit: Fix inaccurate DWARF line table 7d7e503cac31 perf jvmti: Remove redundant jitdump line table entries 0bdf31811be0 perf jvmti: Fix demangling Java symbols 525c821de0a6 perf tests: Add test for the java demangler 959f8ed4c1a8 perf jvmti: Do not report error when missing debug information 953e92402a52 perf jvmti: Fix jitdump for methods without debug info Because making perf work is very useful for performance analysis on JITed Java application, I'd like to support this patchset in openEuler release. The coming 21.03 should be a first target as that release is upgraded with 5.8+ kernel. Probably we can backport this patchset to 20.03 LTS if needed. To introduce the fix to 21.03, the kernel.spec should be changed with some lines to generate the JVMTI shared library. There are some things I am not sure: 1. kernel.spec is in src-openeuler project, do I submit the change by PR or by sending patch directly to the mailing list? 2. Is there rolling release of openEuler like Tumbleweed? Then we can run some tests with the daily ISO before the stable 21.03 And one more question, has version 21.03 created a build project in openEuler OBS?? Is it this one? https://build.openeuler.org/package/show/openEuler:Mainline/kernel Thanks, Erik

3 5

[PATCH kernel-4.19 00/22] backport stable-4.19.170
by Yang Yingliang 28 Jan '21

28 Jan '21

Andrey Zhizhikin (1): rndis_host: set proper input size for OID_GEN_PHYSICAL_MEDIUM request Arnd Bergmann (1): crypto: x86/crc32c - fix building with clang ias Aya Levin (1): net: ipv6: Validate GSO SKB before finish IPv6 processing Baptiste Lepers (2): udp: Prevent reuseport_select_sock from reading uninitialized socks rxrpc: Call state should be read with READ_ONCE() under some circumstances David Howells (1): rxrpc: Fix handling of an unsupported token type in rxrpc_read() David Wu (1): net: stmmac: Fixed mtu channged by cache aligned Eric Dumazet (1): net: avoid 32 x truesize under-estimation for tiny skbs Greg Kroah-Hartman (1): Linux 4.19.170 Hamish Martin (1): usb: ohci: Make distrust_firmware param default to false Hoang Le (1): tipc: fix NULL deref in tipc_link_xmit() Jakub Kicinski (1): net: sit: unregister_netdevice on newlink's error path Jason A. Donenfeld (2): net: introduce skb_list_walk_safe for skb segment walking net: skbuff: disambiguate argument and member for skb_list_walk_safe helper Manish Chopra (1): netxen_nic: fix MSI/MSI-x interrupts Michael Hennerich (1): spi: cadence: cache reference clock rate during probe Mikulas Patocka (1): dm integrity: fix flush with external metadata device Petr Machata (2): net: dcb: Validate netlink message in DCB handler net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands Stefan Chulski (1): net: mvpp2: Remove Pause and Asym_Pause support Will Deacon (1): compiler.h: Raise minimum version of GCC to 5.1 for arm64 Willem de Bruijn (1): esp: avoid unneeded kmap_atomic call Makefile | 2 +- arch/x86/crypto/crc32c-pcl-intel-asm_64.S | 2 +- drivers/md/dm-bufio.c | 6 +++ drivers/md/dm-integrity.c | 50 +++++++++++++++++-- .../net/ethernet/marvell/mvpp2/mvpp2_main.c | 2 - .../ethernet/qlogic/netxen/netxen_nic_main.c | 7 +-- .../net/ethernet/stmicro/stmmac/stmmac_main.c | 3 +- drivers/net/usb/rndis_host.c | 2 +- drivers/spi/spi-cadence.c | 6 ++- drivers/usb/host/ohci-hcd.c | 2 +- include/linux/compiler-gcc.h | 6 +++ include/linux/dm-bufio.h | 1 + include/linux/skbuff.h | 5 ++ net/core/skbuff.c | 9 +++- net/core/sock_reuseport.c | 2 +- net/dcb/dcbnl.c | 2 + net/ipv4/esp4.c | 7 +-- net/ipv6/esp6.c | 7 +-- net/ipv6/ip6_output.c | 40 ++++++++++++++- net/ipv6/sit.c | 5 +- net/rxrpc/input.c | 2 +- net/rxrpc/key.c | 6 ++- net/tipc/link.c | 9 +++- 23 files changed, 141 insertions(+), 42 deletions(-) -- 2.25.1

1 23

Re: [PATCH kernel-4.19] mmap: fix a compiling error for 'MAP_CHECKNODE'
by Bixuan Cui 28 Jan '21

28 Jan '21

> I think you should remove the VM_CHECKNODE to set_vm_checknode > set_vm_checknode(vm_flags_t *vm_flags, unsigned long flags) > { > if (flags & VM_CHECKNODE && is_set_cdmmask()) > *vm_flags |= VM_CHECKNODE | ((((flags >> MAP_HUGE_SHIFT) & > MAP_HUGE_MASK) << CHECKNODE_BITS) & CHECKNODE_MASK); > } VM_CHECKNODE has been checked before the set_vm_checknode function is used. Maybe we can put the check into set_vm_checknode(). What do you think? mm/mmap.c if (flags & MAP_CHECKNODE) set_vm_checknode(&vm_flags, flags); Thanks， Bixuan Cui

1 0

[PATCH kernel-4.19] clocksource/drivers/arch_timer: Fix vdso_fix compile error for arm32
by Yang Yingliang 28 Jan '21

28 Jan '21

From: Hanjun Guo <guohanjun(a)huawei.com> hulk inclusion category: bugfix bugzilla: 47461 CVE: NA ------------------------------------------------- We got compile error: drivers/clocksource/arm_arch_timer.c: In function 'arch_counter_register': drivers/clocksource/arm_arch_timer.c:1009:31: error: 'struct arch_clocksource_data' has no member named 'vdso_fix' 1009 | clocksource_counter.archdata.vdso_fix = vdso_fix; | ^ make[3]: *** [/builds/1mzfdQzleCy69KZFb5qHNSEgabZ/scripts/Makefile.build:303: drivers/clocksource/arm_arch_timer.o] Error 1 make[3]: Target '__build' not remade because of errors. Fix it by guarding vdso_fix with #ifdef CONFIG_ARM64 .. #endif Signed-off-by: Hanjun Guo <guohanjun(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/clocksource/arm_arch_timer.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/clocksource/arm_arch_timer.c b/drivers/clocksource/arm_arch_timer.c index d72ade5c70801..6847a5fe13fde 100644 --- a/drivers/clocksource/arm_arch_timer.c +++ b/drivers/clocksource/arm_arch_timer.c @@ -1010,7 +1010,9 @@ static void __init arch_counter_register(unsigned type) arch_timer_read_counter = arch_counter_get_cntpct; clocksource_counter.archdata.vdso_direct = vdso_default; +#ifdef CONFIG_ARM64 clocksource_counter.archdata.vdso_fix = vdso_fix; +#endif } else { arch_timer_read_counter = arch_counter_get_cntvct_mem; } -- 2.25.1

1 0

[PATCH kernel-4.19 1/4] KVM: Enable PUD huge mappings only on 1620
by Yang Yingliang 28 Jan '21

28 Jan '21

From: miaoyubo <miaoyubo(a)huawei.com> virt inclusion category: bugfix bugzilla: 47428 CVE: NA Disable PUD_SIZE huge mapping on 161x serial boards and only enable on 1620CS due to low performance on cache maintenance and complex implementation for pre-setup stage2 page table with PUD huge page. Which would even lead to hard lockup Signed-off-by: Zenghui Yu <yuzenghui(a)huawei.com> Signed-off-by: miaoyubo <miaoyubo(a)huawei.com> Reviewed-by: zhanghailiang <zhang.zhanghailiang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- virt/kvm/arm/mmu.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c index 3a74cf59f5c85..b030bd3dce52c 100644 --- a/virt/kvm/arm/mmu.c +++ b/virt/kvm/arm/mmu.c @@ -1763,6 +1763,13 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, if (vma_pagesize == PMD_SIZE || (vma_pagesize == PUD_SIZE && kvm_stage2_has_pmd(kvm))) gfn = (fault_ipa & huge_page_mask(hstate_vma(vma))) >> PAGE_SHIFT; + + /* Only enable PUD_SIZE huge mapping on 1620 serial boards */ + if (vma_pagesize == PUD_SIZE && !kvm_ncsnp_support) { + vma_pagesize = PMD_SIZE; + gfn = (fault_ipa & PMD_MASK) >> PAGE_SHIFT; + } + up_read(&current->mm->mmap_sem); /* We need minimum second+third level pages */ -- 2.25.1

1 3

[PATCH kernel-4.19 00/43] backport stable-4.19.169
by Yang Yingliang 27 Jan '21

27 Jan '21

Akilesh Kailash (1): dm snapshot: flush merged data before committing metadata Al Viro (1): dump_common_audit_data(): fix racy accesses to ->d_name Alexander Lobakin (1): MIPS: relocatable: fix possible boot hangup with KASLR enabled Arnd Bergmann (2): misdn: dsp: select CONFIG_BITREVERSE ARM: picoxcell: fix missing interrupt-parent properties Craig Tatlor (1): drm/msm: Call msm_init_vram before binding the gpu Dan Carpenter (1): ASoC: Intel: fix error code cnl_set_dsp_D0() Dave Wysochanski (1): NFS4: Fix use-after-free in trace_event_raw_event_nfs4_set_lock Dexuan Cui (1): ACPI: scan: Harden acpi_device_add() against device ID overflows Dinghao Liu (2): RDMA/usnic: Fix memleak in find_free_vf_and_create_qp_grp netfilter: nf_nat: Fix memleak in nf_nat_init Filipe Manana (1): btrfs: fix transaction leak and crash after RO remount caused by qgroup rescan Geert Uytterhoeven (2): ALSA: firewire-tascam: Fix integer overflow in midi_port_work() ALSA: fireface: Fix integer overflow in transmit_midi_msg() Greg Kroah-Hartman (1): Linux 4.19.169 Jan Kara (2): bfq: Fix computation of shallow depth ext4: fix superblock checksum failure when setting password salt Jann Horn (1): mm, slub: consider rest of partial list if acquire_slab() fails Jerome Brunet (1): ASoC: meson: axg-tdm-interface: fix loopback Jesper Dangaard Brouer (1): netfilter: conntrack: fix reading nf_conntrack_buckets Leon Schuermann (1): r8152: Add Lenovo Powered USB-C Travel Hub Mark Bloch (1): RDMA/mlx5: Fix wrong free of blue flame register on error Masahiro Yamada (3): ARC: build: remove non-existing bootpImage from KBUILD_IMAGE ARC: build: add uImage.lzma to the top-level target ARC: build: add boot_targets to PHONY Masami Hiramatsu (1): tracing/kprobes: Do the notrace functions check without kprobes on ftrace Miaohe Lin (1): mm/hugetlb: fix potential missing huge page size info Michael Ellerman (1): net: ethernet: fs_enet: Add missing MODULE_LICENSE Mike Snitzer (1): dm: eliminate potential source of excessive kernel log noise Mikulas Patocka (1): dm integrity: fix the maximum number of arguments Olaf Hering (1): kbuild: enforce -Werror=return-type Paul Cercueil (1): MIPS: boot: Fix unaligned access with CONFIG_MIPS_RAW_APPENDED_DTB Randy Dunlap (1): arch/arc: add copy_user_page() to <asm/page.h> to fix build error on ARC Rasmus Villemoes (1): ethernet: ucc_geth: fix definition and size of ucc_geth_tx_global_pram Roberto Sassu (1): ima: Remove __init annotation from ima_pcrread() Shawn Guo (1): ACPI: scan: add stub acpi_create_platform_device() for !CONFIG_ACPI Thomas Hebb (1): ASoC: dapm: remove widget from dirty list on free Trond Myklebust (3): pNFS: Mark layout for return if return-on-close was not sent NFS/pNFS: Fix a leak of the layout 'plh_outstanding' counter NFS: nfs_igrab_and_active must first reference the superblock Wei Liu (1): x86/hyperv: check cpu mask after interrupt has been disabled Yang Yingliang (1): config: set config CONFIG_KPROBE_EVENTS_ON_NOTRACE default value j.nixdorf(a)avm.de (1): net: sunrpc: interpret the return value of kstrtou32 correctly Makefile | 4 ++-- arch/arc/Makefile | 9 ++----- arch/arc/include/asm/page.h | 1 + arch/arm/boot/dts/picoxcell-pc3x2.dtsi | 4 ++++ arch/arm64/configs/hulk_defconfig | 1 + arch/mips/boot/compressed/decompress.c | 3 ++- arch/mips/kernel/relocate.c | 10 ++++++-- arch/x86/hyperv/mmu.c | 12 +++++++--- block/bfq-iosched.c | 8 +++---- drivers/acpi/internal.h | 2 +- drivers/acpi/scan.c | 15 +++++++++++- drivers/gpu/drm/msm/msm_drv.c | 8 +++---- drivers/infiniband/hw/mlx5/main.c | 2 +- drivers/infiniband/hw/usnic/usnic_ib_verbs.c | 3 +++ drivers/isdn/mISDN/Kconfig | 1 + drivers/md/dm-integrity.c | 2 +- drivers/md/dm-snap.c | 24 +++++++++++++++++++ drivers/md/dm.c | 2 +- .../ethernet/freescale/fs_enet/mii-bitbang.c | 1 + .../net/ethernet/freescale/fs_enet/mii-fec.c | 1 + drivers/net/ethernet/freescale/ucc_geth.h | 9 ++++++- drivers/net/usb/cdc_ether.c | 7 ++++++ drivers/net/usb/r8152.c | 1 + fs/btrfs/qgroup.c | 13 +++++++--- fs/btrfs/super.c | 8 +++++++ fs/ext4/ioctl.c | 3 +++ fs/nfs/internal.h | 12 ++++++---- fs/nfs/nfs4proc.c | 2 +- fs/nfs/pnfs.c | 7 ++++++ include/linux/acpi.h | 7 ++++++ kernel/trace/Kconfig | 2 +- kernel/trace/trace_kprobe.c | 2 +- mm/hugetlb.c | 2 +- mm/slub.c | 2 +- net/netfilter/nf_conntrack_standalone.c | 3 +++ net/netfilter/nf_nat_core.c | 1 + net/sunrpc/addr.c | 2 +- security/integrity/ima/ima_crypto.c | 2 +- security/lsm_audit.c | 7 ++++-- sound/firewire/fireface/ff-transaction.c | 2 +- sound/firewire/tascam/tascam-transaction.c | 2 +- sound/soc/intel/skylake/cnl-sst.c | 1 + sound/soc/meson/axg-tdm-interface.c | 14 ++++++++++- sound/soc/soc-dapm.c | 1 + 44 files changed, 176 insertions(+), 49 deletions(-) -- 2.25.1

1 43

[PATCH kernel-4.19] mmap: fix a compiling error for 'MAP_CHECKNODE'
by Bixuan Cui 27 Jan '21

27 Jan '21

hulk inclusion category: bugfix bugzilla: NA CVE: NA MAP_CHECKNODE was defined in uapi/asm-generic/mman.h, that was not automatically included by mm/mmap.c when building on platforms such as mips, and result in following compiling error: mm/mmap.c: In function ‘__do_mmap’: mm/mmap.c:1581:14: error: ‘MAP_CHECKNODE’ undeclared (first use in this function) if (flags & MAP_CHECKNODE) ^ mm/mmap.c:1581:14: note: each undeclared identifier is reported only once for each function it appears in scripts/Makefile.build:303: recipe for target 'mm/mmap.o' failed Fixes: 56a22a261008 ("arm64/ascend: mm: Add MAP_CHECKNODE flag to check node hugetlb") Signed-off-by: Bixuan Cui <cuibixuan(a)huawei.com> --- arch/alpha/include/uapi/asm/mman.h | 1 + arch/mips/include/uapi/asm/mman.h | 1 + arch/parisc/include/uapi/asm/mman.h | 1 + arch/powerpc/include/uapi/asm/mman.h | 1 + arch/sparc/include/uapi/asm/mman.h | 1 + arch/xtensa/include/uapi/asm/mman.h | 1 + 6 files changed, 6 insertions(+) diff --git a/arch/alpha/include/uapi/asm/mman.h b/arch/alpha/include/uapi/asm/mman.h index b3acfc00..1c7ce27 100644 --- a/arch/alpha/include/uapi/asm/mman.h +++ b/arch/alpha/include/uapi/asm/mman.h @@ -34,6 +34,7 @@ #define MAP_HUGETLB 0x100000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x200000/* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #define MS_ASYNC 1 /* sync memory asynchronously */ #define MS_SYNC 2 /* synchronous memory sync */ diff --git a/arch/mips/include/uapi/asm/mman.h b/arch/mips/include/uapi/asm/mman.h index 72a00c7..4570a54 100644 --- a/arch/mips/include/uapi/asm/mman.h +++ b/arch/mips/include/uapi/asm/mman.h @@ -52,6 +52,7 @@ #define MAP_HUGETLB 0x80000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x100000 /* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ /* * Flags for msync diff --git a/arch/parisc/include/uapi/asm/mman.h b/arch/parisc/include/uapi/asm/mman.h index 9e989d6..06857eb 100644 --- a/arch/parisc/include/uapi/asm/mman.h +++ b/arch/parisc/include/uapi/asm/mman.h @@ -28,6 +28,7 @@ #define MAP_HUGETLB 0x80000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x100000 /* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #define MS_SYNC 1 /* synchronous memory sync */ #define MS_ASYNC 2 /* sync memory asynchronously */ diff --git a/arch/powerpc/include/uapi/asm/mman.h b/arch/powerpc/include/uapi/asm/mman.h index 95f884a..24354f7 100644 --- a/arch/powerpc/include/uapi/asm/mman.h +++ b/arch/powerpc/include/uapi/asm/mman.h @@ -30,6 +30,7 @@ #define MAP_STACK 0x20000 /* give out an address that is best suited for process/thread stacks */ #define MAP_HUGETLB 0x40000 /* create a huge page mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ /* Override any generic PKEY permission defines */ #define PKEY_DISABLE_EXECUTE 0x4 diff --git a/arch/sparc/include/uapi/asm/mman.h b/arch/sparc/include/uapi/asm/mman.h index 0d1881b..214abe1 100644 --- a/arch/sparc/include/uapi/asm/mman.h +++ b/arch/sparc/include/uapi/asm/mman.h @@ -27,6 +27,7 @@ #define MAP_STACK 0x20000 /* give out an address that is best suited for process/thread stacks */ #define MAP_HUGETLB 0x40000 /* create a huge page mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #endif /* _UAPI__SPARC_MMAN_H__ */ diff --git a/arch/xtensa/include/uapi/asm/mman.h b/arch/xtensa/include/uapi/asm/mman.h index f584a59..2c9d705 100644 --- a/arch/xtensa/include/uapi/asm/mman.h +++ b/arch/xtensa/include/uapi/asm/mman.h @@ -59,6 +59,7 @@ #define MAP_HUGETLB 0x80000 /* create a huge page mapping */ #define MAP_FIXED_NOREPLACE 0x100000 /* MAP_FIXED which doesn't unmap underlying mapping */ #define MAP_PA32BIT 0x400000 /* physical address is within 4G */ +#define MAP_CHECKNODE 0x800000 /* hugetlb numa node check */ #ifdef CONFIG_MMAP_ALLOW_UNINITIALIZED # define MAP_UNINITIALIZED 0x4000000 /* For anonymous mmap, memory could be * uninitialized */ -- 2.7.4

1 0