- Kernel - mailweb.openeuler.org

[PATCH 0/3] Fix use-after-free in dm_bm_set_read_only
by Yang Yingliang 11 Sep '20

11 Sep '20

Ye Bin (3): dm cache metadata: Avoid returning cmd->bm wild pointer on error dm thin metadata: Avoid returning cmd->bm wild pointer on error dm thin metadata: Fix use-after-free in dm_bm_set_read_only drivers/md/dm-cache-metadata.c | 8 ++++++-- drivers/md/dm-thin-metadata.c | 10 +++++++--- drivers/md/persistent-data/dm-block-manager.c | 14 ++++++++------ 3 files changed, 21 insertions(+), 11 deletions(-) -- 2.25.1

1 3

[PATCH] mm: slub: fix conversion of freelist_corrupted()
by Yang Yingliang 11 Sep '20

11 Sep '20

From: Eugeniu Rosca <erosca(a)de.adit-jv.com> mainline inclusion from mainline-v5.9-rc4 commit dc07a728d49cf025f5da2c31add438d839d076c0 category: bugfix bugzilla: NA CVE: NA ------------------------------------------------- Commit 52f23478081ae0 ("mm/slub.c: fix corrupted freechain in deactivate_slab()") suffered an update when picked up from LKML [1]. Specifically, relocating 'freelist = NULL' into 'freelist_corrupted()' created a no-op statement. Fix it by sticking to the behavior intended in the original patch [1]. In addition, make freelist_corrupted() immune to passing NULL instead of &freelist. The issue has been spotted via static analysis and code review. [1] https://lore.kernel.org/linux-mm/20200331031450.12182-1-dongli.zhang@oracle… Fixes: 52f23478081ae0 ("mm/slub.c: fix corrupted freechain in deactivate_slab()") Signed-off-by: Eugeniu Rosca <erosca(a)de.adit-jv.com> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Cc: Dongli Zhang <dongli.zhang(a)oracle.com> Cc: Joe Jin <joe.jin(a)oracle.com> Cc: Christoph Lameter <cl(a)linux.com> Cc: Pekka Enberg <penberg(a)kernel.org> Cc: David Rientjes <rientjes(a)google.com> Cc: Joonsoo Kim <iamjoonsoo.kim(a)lge.com> Cc: <stable(a)vger.kernel.org> Link: https://lkml.kernel.org/r/20200824130643.10291-1-erosca@de.adit-jv.com Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/slub.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/mm/slub.c b/mm/slub.c index 0415902a2749..887e3d67a4d7 100644 --- a/mm/slub.c +++ b/mm/slub.c @@ -646,12 +646,12 @@ static void slab_fix(struct kmem_cache *s, char *fmt, ...) } static bool freelist_corrupted(struct kmem_cache *s, struct page *page, - void *freelist, void *nextfree) + void **freelist, void *nextfree) { if ((s->flags & SLAB_CONSISTENCY_CHECKS) && - !check_valid_pointer(s, page, nextfree)) { - object_err(s, page, freelist, "Freechain corrupt"); - freelist = NULL; + !check_valid_pointer(s, page, nextfree) && freelist) { + object_err(s, page, *freelist, "Freechain corrupt"); + *freelist = NULL; slab_fix(s, "Isolate corrupted freechain"); return true; } @@ -1342,7 +1342,7 @@ static inline void dec_slabs_node(struct kmem_cache *s, int node, int objects) {} static bool freelist_corrupted(struct kmem_cache *s, struct page *page, - void *freelist, void *nextfree) + void **freelist, void *nextfree) { return false; } @@ -2036,7 +2036,7 @@ static void deactivate_slab(struct kmem_cache *s, struct page *page, * 'freelist' is already corrupted. So isolate all objects * starting at 'freelist'. */ - if (freelist_corrupted(s, page, freelist, nextfree)) + if (freelist_corrupted(s, page, &freelist, nextfree)) break; do { -- 2.25.1

1 0

[PATCH 0/7] Support some features of ARMv8.x
by Yang Yingliang 10 Sep '20

10 Sep '20

Support - SVE2 - ARMv8.5-CondM, Condition flag manipulation - ARMv8.5-FRINT, Armv8.5 Floating-point to integer - ARMv8.6 Matrix multiply extension Dave Martin (2): arm64: Expose SVE2 features for userspace arm64: cpufeature: Fix missing ZFR0 in __read_sysreg_by_encoding() Julien Grall (2): arm64: cpufeature: Treat ID_AA64ZFR0_EL1 as RAZ when SVE is not enabled arm64: cpufeature: Effectively expose FRINT capability to userspace Mark Brown (2): arm64: Expose ARMv8.5 CondM capability to userspace arm64: Expose FRINT capabilities to userspace Steven Price (1): arm64: cpufeature: Export matrix and other features to userspace Documentation/arm64/cpu-feature-registers.txt | 30 ++++++++++ Documentation/arm64/elf_hwcaps.txt | 59 +++++++++++++++++++ Documentation/arm64/sve.txt | 17 ++++++ arch/arm64/Kconfig | 3 + arch/arm64/include/asm/hwcap.h | 15 +++++ arch/arm64/include/asm/sysreg.h | 27 +++++++++ arch/arm64/include/uapi/asm/hwcap.h | 15 +++++ arch/arm64/kernel/cpufeature.c | 45 +++++++++++++- arch/arm64/kernel/cpuinfo.c | 15 +++++ 9 files changed, 225 insertions(+), 1 deletion(-) -- 2.25.1

1 7

[PATCH 0/6] Support TLB maintenance and TLB range instructions
by Yang Yingliang 10 Sep '20

10 Sep '20

Anshuman Khandual (1): arm64/cpufeature: Add remaining feature bits in ID_AA64ISAR0 register Sami Tolvanen (1): arm64: use a common .arch preamble for inline assembly Yuan Can (1): config: arm64: update defconfig Zhenyu Ye (3): arm64: tlb: Detect the ARMv8.4 TLBI RANGE feature arm64: enable tlbi range instructions arm64: tlb: Use the TLBI RANGE feature in arm64 arch/arm64/Kconfig | 18 +++ arch/arm64/Makefile | 15 ++- arch/arm64/configs/euleros_defconfig | 5 + arch/arm64/configs/hulk_defconfig | 5 + arch/arm64/configs/openeuler_defconfig | 5 + arch/arm64/include/asm/compiler.h | 6 + arch/arm64/include/asm/cpucaps.h | 3 +- arch/arm64/include/asm/cpufeature.h | 6 + arch/arm64/include/asm/sysreg.h | 4 + arch/arm64/include/asm/tlbflush.h | 160 ++++++++++++++++++++----- arch/arm64/kernel/cpufeature.c | 11 ++ 11 files changed, 205 insertions(+), 33 deletions(-) -- 2.25.1

1 6

[PATCH 0/2] Add interface to configure timeout
by Yang Yingliang 10 Sep '20

10 Sep '20

Wang Wensheng (2): watchdog: Add interface to config timeout and pretimeout in sysfs watchdog: Enable CONFIG_ASCEND_WATCHDOG_SYSFS_CONFIGURE in hulk_defconfig arch/arm64/Kconfig | 10 +++++ arch/arm64/configs/hulk_defconfig | 1 + drivers/watchdog/watchdog_dev.c | 63 +++++++++++++++++++++++++++++++ 3 files changed, 74 insertions(+) -- 2.25.1

1 2

[PATCH 0/6] arm64: Initial support for CVADP
by Yang Yingliang 09 Sep '20

09 Sep '20

ARMv8.5 introduces a DC CVADP instruction which cleans the data cache to the point of deep persistence. This series makes the instruction available to userspace and advertises the presence of this CPU feature. At present when CONFIG_ARM64_PMEM is enabled and the CVAP feature is present (ARMv8.2) the CVAP instruction is used (from memcpy_flushcache and arch_wb_cache_pmem). No changes have been made to use CVADP in these functions or similar. As we have moved beyond 32 capabilities we now begin using AT_HWCAP2 for userspace. Tested as follows: $ dmesg | grep "Deep" [ 0.166496] CPU features: detected: Data cache clean to Point of Deep Persistence $ LD_SHOW_AUXV=1 sleep 2>&1 | grep AT_HWCAP AT_HWCAP: ef91ff87 AT_HWCAP2: 0x1 Andrew Murray (6): arm64: HWCAP: add support for AT_HWCAP2 arm64: HWCAP: encapsulate elf_hwcap arm64: Handle trapped DC CVADP arm64: Expose DC CVADP to userspace arm64: add CVADP support to the cache maintenance helper arm64: Advertise ARM64_HAS_DCPODP cpu feature Documentation/arm64/elf_hwcaps.txt | 17 +++- arch/arm64/crypto/aes-ce-ccm-glue.c | 2 +- arch/arm64/crypto/aes-neonbs-glue.c | 2 +- arch/arm64/crypto/chacha20-neon-glue.c | 2 +- arch/arm64/crypto/ghash-ce-glue.c | 6 +- arch/arm64/crypto/sha256-glue.c | 4 +- arch/arm64/include/asm/assembler.h | 4 + arch/arm64/include/asm/cpucaps.h | 3 +- arch/arm64/include/asm/cpufeature.h | 21 ++--- arch/arm64/include/asm/esr.h | 3 +- arch/arm64/include/asm/hwcap.h | 54 +++++++++++- arch/arm64/include/uapi/asm/hwcap.h | 7 +- arch/arm64/kernel/cpufeature.c | 110 +++++++++++++++++-------- arch/arm64/kernel/cpuinfo.c | 3 +- arch/arm64/kernel/fpsimd.c | 4 +- arch/arm64/kernel/traps.c | 3 + drivers/clocksource/arm_arch_timer.c | 8 ++ 17 files changed, 186 insertions(+), 67 deletions(-) -- 2.25.1

1 6

[PATCH 1/3] mm/swap_state: fix a data race in swapin_nr_pages
by Yang Yingliang 09 Sep '20

09 Sep '20

From: Qian Cai <cai(a)lca.pw> mainline inclusion from mainline-v5.8-rc1 commit d6c1f098f2a7ba62627c9bc17cda28f534ef9e4a category: bugfix bugzilla: 35806 CVE: NA ------------------------------------------------- "prev_offset" is a static variable in swapin_nr_pages() that can be accessed concurrently with only mmap_sem held in read mode as noticed by KCSAN, BUG: KCSAN: data-race in swap_cluster_readahead / swap_cluster_readahead write to 0xffffffff92763830 of 8 bytes by task 14795 on cpu 17: swap_cluster_readahead+0x2a6/0x5e0 swapin_readahead+0x92/0x8dc do_swap_page+0x49b/0xf20 __handle_mm_fault+0xcfb/0xd70 handle_mm_fault+0xfc/0x2f0 do_page_fault+0x263/0x715 page_fault+0x34/0x40 1 lock held by (dnf)/14795: #0: ffff897bd2e98858 (&mm->mmap_sem#2){++++}-{3:3}, at: do_page_fault+0x143/0x715 do_user_addr_fault at arch/x86/mm/fault.c:1405 (inlined by) do_page_fault at arch/x86/mm/fault.c:1535 irq event stamp: 83493 count_memcg_event_mm+0x1a6/0x270 count_memcg_event_mm+0x119/0x270 __do_softirq+0x365/0x589 irq_exit+0xa2/0xc0 read to 0xffffffff92763830 of 8 bytes by task 1 on cpu 22: swap_cluster_readahead+0xfd/0x5e0 swapin_readahead+0x92/0x8dc do_swap_page+0x49b/0xf20 __handle_mm_fault+0xcfb/0xd70 handle_mm_fault+0xfc/0x2f0 do_page_fault+0x263/0x715 page_fault+0x34/0x40 1 lock held by systemd/1: #0: ffff897c38f14858 (&mm->mmap_sem#2){++++}-{3:3}, at: do_page_fault+0x143/0x715 irq event stamp: 43530289 count_memcg_event_mm+0x1a6/0x270 count_memcg_event_mm+0x119/0x270 __do_softirq+0x365/0x589 irq_exit+0xa2/0xc0 Signed-off-by: Qian Cai <cai(a)lca.pw> Signed-off-by: Andrew Morton <akpm(a)linux-foundation.org> Cc: Marco Elver <elver(a)google.com> Cc: Hugh Dickins <hughd(a)google.com> Link: http://lkml.kernel.org/r/20200402213748.2237-1-cai@lca.pw Signed-off-by: Linus Torvalds <torvalds(a)linux-foundation.org> Signed-off-by: Liu Shixin <liushixin2(a)huawei.com> Reviewed-by: Kefeng Wang <wangkefeng.wang(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- mm/swap_state.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/mm/swap_state.c b/mm/swap_state.c index b776b472974c..2137e2d57196 100644 --- a/mm/swap_state.c +++ b/mm/swap_state.c @@ -548,10 +548,11 @@ static unsigned long swapin_nr_pages(unsigned long offset) return 1; hits = atomic_xchg(&swapin_readahead_hits, 0); - pages = __swapin_nr_pages(prev_offset, offset, hits, max_pages, + pages = __swapin_nr_pages(READ_ONCE(prev_offset), offset, hits, + max_pages, atomic_read(&last_readahead_pages)); if (!hits) - prev_offset = offset; + WRITE_ONCE(prev_offset, offset); atomic_set(&last_readahead_pages, pages); return pages; -- 2.25.1

1 2

[PATCH 0/4] arm64: perf: Add support for ARMv8.5-PMU
by Yang Yingliang 09 Sep '20

09 Sep '20

Backport perf support patches for ARMv8.5-PMU. Andrew Murray (3): arm64: cpufeature: Extract capped perfmon fields KVM: arm64: limit PMU version to PMUv3 for ARMv8.1 arm64: perf: Add support for ARMv8.5-PMU 64-bit counters Robin Murphy (1): arm64: perf: Clean up enable/disable calls arch/arm64/include/asm/cpufeature.h | 23 ++++ arch/arm64/include/asm/perf_event.h | 3 +- arch/arm64/include/asm/sysreg.h | 10 ++ arch/arm64/kernel/perf_event.c | 170 +++++++++++++++++----------- arch/arm64/kvm/sys_regs.c | 10 ++ include/linux/perf/arm_pmu.h | 1 + 6 files changed, 150 insertions(+), 67 deletions(-) -- 2.25.1

1 4

[PATCH 0/8] ARMv8.4 TTL feature
by Yang Yingliang 09 Sep '20

09 Sep '20

ARMv8.4 TTL feature. Catalin Marinas (1): arm64: Shift the __tlbi_level() indentation left Marc Zyngier (2): arm64: Detect the ARMv8.4 TTL feature arm64: Add level-hinted TLB invalidation helper Peter Zijlstra (Intel) (1): tlb: mmu_gather: add tlb_flush_*_range APIs Zhenyu Ye (4): arm64: Add tlbi_user_level TLB invalidation helper arm64: tlb: Set the TTL field in flush_tlb_range arm64: tlb: Set the TTL field in flush_*_tlb_range arm64: tlb: don't set the ttl value in flush_tlb_page_nosync arch/arm64/include/asm/cpucaps.h | 3 +- arch/arm64/include/asm/pgtable.h | 10 ++++ arch/arm64/include/asm/stage2_pgtable.h | 9 ++++ arch/arm64/include/asm/sysreg.h | 1 + arch/arm64/include/asm/tlb.h | 29 +++++++++++- arch/arm64/include/asm/tlbflush.h | 63 ++++++++++++++++++++++--- arch/arm64/kernel/cpufeature.c | 11 +++++ include/asm-generic/tlb.h | 55 +++++++++++++++------ 8 files changed, 158 insertions(+), 23 deletions(-) -- 2.25.1

1 8

BPF 新特性合入openEuler内核策略讨论
by 陆志浩 09 Sep '20

09 Sep '20

Hi： BPF 特性在上游内核社区非常活跃，该特性在网络、内核维护、容器、安全等方面都有使用价值，当前openEuler 4.19内核的BPF特性相较最新版本比较陈旧，不利于下游场景的一些价值场景的业务开发。我希望在openEuler 4.19内核版本逐步合入BPF最新特性，并且长期更新BPF最新特性及bugfix。 PS: 会上提供BPF新特性列表以及相关的文件列表范围，初步给出对周边模块的影响性。 by luzhihao

1 0