- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10] scsi: sr: Do not leak information in ioctl
by Li Lingfeng 15 May '24

15 May '24

From: Tom Rix <trix(a)redhat.com> stable inclusion from stable-v5.18-rc4 commit faad6cebded8e0fd902b672f220449b93db479eb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9PGWG Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- sr_ioctl.c uses this pattern: result = sr_do_ioctl(cd, &cgc); to-user = buffer[]; kfree(buffer); return result; Use of a buffer without checking leaks information. Check result and jump over the use of buffer if there is an error. result = sr_do_ioctl(cd, &cgc); if (result) goto err; to-user = buffer[]; err: kfree(buffer); return result; Additionally, initialize the buffer to zero. This problem can be seen in the 2.4.0 kernel. Link: https://lore.kernel.org/r/20220411174756.2418435-1-trix@redhat.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Tom Rix <trix(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflicts: drivers/scsi/sr_ioctl.c [Commit aaff5ebaa269 ("scsi: remove the unchecked_isa_dma flag") remove the unchecked_isa_dma flag] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/scsi/sr_ioctl.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c index 4c1de11e69fb..0808217f2d7b 100644 --- a/drivers/scsi/sr_ioctl.c +++ b/drivers/scsi/sr_ioctl.c @@ -45,7 +45,7 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, int result; unsigned char *buffer; - buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); if (!buffer) return -ENOMEM; @@ -59,10 +59,13 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, cgc.data_direction = DMA_FROM_DEVICE; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; tochdr->cdth_trk0 = buffer[2]; tochdr->cdth_trk1 = buffer[3]; +err: kfree(buffer); return result; } @@ -75,7 +78,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, int result; unsigned char *buffer; - buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); if (!buffer) return -ENOMEM; @@ -90,6 +93,8 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, cgc.data_direction = DMA_FROM_DEVICE; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; tocentry->cdte_ctrl = buffer[5] & 0xf; tocentry->cdte_adr = buffer[5] >> 4; @@ -102,6 +107,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, tocentry->cdte_addr.lba = (((((buffer[8] << 8) + buffer[9]) << 8) + buffer[10]) << 8) + buffer[11]; +err: kfree(buffer); return result; } @@ -388,7 +394,7 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) { Scsi_CD *cd = cdi->handle; struct packet_command cgc; - char *buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + char *buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); int result; if (!buffer) @@ -404,10 +410,13 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) cgc.data_direction = DMA_FROM_DEVICE; cgc.timeout = IOCTL_TIMEOUT; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; memcpy(mcn->medium_catalog_number, buffer + 9, 13); mcn->medium_catalog_number[13] = 0; +err: kfree(buffer); return result; } -- 2.31.1

2 1

[PATCH openEuler-1.0-LTS] scsi: sr: Do not leak information in ioctl
by Li Lingfeng 15 May '24

15 May '24

From: Tom Rix <trix(a)redhat.com> stable inclusion from stable-v5.18-rc4 commit faad6cebded8e0fd902b672f220449b93db479eb category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9PGWG Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- sr_ioctl.c uses this pattern: result = sr_do_ioctl(cd, &cgc); to-user = buffer[]; kfree(buffer); return result; Use of a buffer without checking leaks information. Check result and jump over the use of buffer if there is an error. result = sr_do_ioctl(cd, &cgc); if (result) goto err; to-user = buffer[]; err: kfree(buffer); return result; Additionally, initialize the buffer to zero. This problem can be seen in the 2.4.0 kernel. Link: https://lore.kernel.org/r/20220411174756.2418435-1-trix@redhat.com Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reviewed-by: Christoph Hellwig <hch(a)lst.de> Signed-off-by: Tom Rix <trix(a)redhat.com> Signed-off-by: Martin K. Petersen <martin.petersen(a)oracle.com> Conflicts: drivers/scsi/sr_ioctl.c [Commit aaff5ebaa269 ("scsi: remove the unchecked_isa_dma flag") remove the unchecked_isa_dma flag] Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- drivers/scsi/sr_ioctl.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c index 335cfdde0cf0..85ed1c6be6ce 100644 --- a/drivers/scsi/sr_ioctl.c +++ b/drivers/scsi/sr_ioctl.c @@ -45,7 +45,7 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, int result; unsigned char *buffer; - buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); if (!buffer) return -ENOMEM; @@ -59,10 +59,13 @@ static int sr_read_tochdr(struct cdrom_device_info *cdi, cgc.data_direction = DMA_FROM_DEVICE; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; tochdr->cdth_trk0 = buffer[2]; tochdr->cdth_trk1 = buffer[3]; +err: kfree(buffer); return result; } @@ -75,7 +78,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, int result; unsigned char *buffer; - buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); if (!buffer) return -ENOMEM; @@ -90,6 +93,8 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, cgc.data_direction = DMA_FROM_DEVICE; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; tocentry->cdte_ctrl = buffer[5] & 0xf; tocentry->cdte_adr = buffer[5] >> 4; @@ -102,6 +107,7 @@ static int sr_read_tocentry(struct cdrom_device_info *cdi, tocentry->cdte_addr.lba = (((((buffer[8] << 8) + buffer[9]) << 8) + buffer[10]) << 8) + buffer[11]; +err: kfree(buffer); return result; } @@ -389,7 +395,7 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) { Scsi_CD *cd = cdi->handle; struct packet_command cgc; - char *buffer = kmalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); + char *buffer = kzalloc(32, GFP_KERNEL | SR_GFP_DMA(cd)); int result; if (!buffer) @@ -405,10 +411,13 @@ int sr_get_mcn(struct cdrom_device_info *cdi, struct cdrom_mcn *mcn) cgc.data_direction = DMA_FROM_DEVICE; cgc.timeout = IOCTL_TIMEOUT; result = sr_do_ioctl(cd, &cgc); + if (result) + goto err; memcpy(mcn->medium_catalog_number, buffer + 9, 13); mcn->medium_catalog_number[13] = 0; +err: kfree(buffer); return result; } -- 2.31.1

2 1

[PATCH OLK-5.10 0/1] CVE-2024-27002
by Yongqiang Liu 15 May '24

15 May '24

Yongqiang Liu (1): clk: mediatek: Do a runtime PM get on controllers during probe drivers/clk/mediatek/clk-mt8183-mfgcfg.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) -- 2.34.1

2 2

[openeuler:OLK-6.6 6911/9610] drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:1182:29: sparse: sparse: restricted __be32 degrades to integer
by kernel test robot 15 May '24

15 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 7c6c7d83d2bc788cd9aef8983afa59eae25e148e commit: 92e27ee40a7ac6d7716ce01305906610e50f577a [6911/9610] net: hns3: add support handling tx dhcp packets for ROH config: arm64-randconfig-r132-20240515 (https://download.01.org/0day-ci/archive/20240515/202405151226.9E443DSy-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240515/202405151226.9E443DSy-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405151226.9E443DSy-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3_enet.c:1182:29: sparse: sparse: restricted __be32 degrades to integer drivers/net/ethernet/hisilicon/hns3/hns3_enet.c: note: in included file (through include/linux/mmzone.h, include/linux/gfp.h, include/linux/xarray.h, ...): include/linux/page-flags.h:245:46: sparse: sparse: self-comparison always evaluates to false vim +1182 drivers/net/ethernet/hisilicon/hns3/hns3_enet.c 1165 1166 static struct hns3_dhcp_packet *hns3_get_dhcp_packet(struct sk_buff *skb, 1167 int *dhcp_len) 1168 { 1169 struct hns3_dhcp_packet *dhcp; 1170 union l4_hdr_info l4; 1171 int l4_payload_len; 1172 1173 l4.hdr = skb_transport_header(skb); 1174 if (l4.udp->dest != htons(HNS3_DHCP_CLIENT_PORT) || 1175 l4.udp->source != htons(HNS3_DHCP_SERVER_PORT)) 1176 return NULL; 1177 1178 dhcp = (struct hns3_dhcp_packet *)(l4.hdr + sizeof(struct udphdr)); 1179 l4_payload_len = ntohs(l4.udp->len) - sizeof(struct udphdr); 1180 if (l4_payload_len < offsetof(struct hns3_dhcp_packet, options) || 1181 dhcp->hlen != ETH_ALEN || > 1182 dhcp->cookie != htonl(HNS3_DHCP_MAGIC)) 1183 return NULL; 1184 1185 *dhcp_len = l4_payload_len; 1186 return dhcp; 1187 } 1188 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH OLK-5.10] xfs: pass the correct cursor to xfs_iomap_prealloc_size
by Zizhi Wo 15 May '24

15 May '24

From: "Darrick J. Wong" <djwong(a)kernel.org> mainline inclusion from mainline-v6.3-rc4 commit fcde88af6a783d32e735dd2615528e2bf7a0f533 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9PFXW Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- In xfs_buffered_write_iomap_begin, @icur is the iext cursor for the data fork and @ccur is the cursor for the cow fork. Pass in whichever cursor corresponds to allocfork, because otherwise the xfs_iext_prev_extent call can use the data fork cursor to walk off the end of the cow fork structure. Best case it returns the wrong results, worst case it does this: stack segment: 0000 [#1] PREEMPT SMP CPU: 2 PID: 3141909 Comm: fsstress Tainted: G W 6.3.0-rc2-xfsx #6.3.0-rc2 7bf5cc2e98997627cae5c930d890aba3aeec65dd Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS ?-20171121_152543-x86-ol7-builder-01.us.oracle.com-4.el7.1 04/01/2014 RIP: 0010:xfs_iext_prev+0x71/0x150 [xfs] RSP: 0018:ffffc90002233aa8 EFLAGS: 00010297 RAX: 000000000000000f RBX: 000000000000000e RCX: 000000000000000c RDX: 0000000000000002 RSI: 000000000000000e RDI: ffff8883d0019ba0 RBP: 989642409af8a7a7 R08: ffffea0000000001 R09: 0000000000000002 R10: 0000000000000000 R11: 000000000000000c R12: ffffc90002233b00 R13: ffff8883d0019ba0 R14: 989642409af8a6bf R15: 000ffffffffe0000 FS: 00007fdf8115f740(0000) GS:ffff88843fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdf8115e000 CR3: 0000000357256000 CR4: 00000000003506e0 Call Trace: <TASK> xfs_iomap_prealloc_size.constprop.0.isra.0+0x1a6/0x410 [xfs 619a268fb2406d68bd34e007a816b27e70abc22c] xfs_buffered_write_iomap_begin+0xa87/0xc60 [xfs 619a268fb2406d68bd34e007a816b27e70abc22c] iomap_iter+0x132/0x2f0 iomap_file_buffered_write+0x92/0x330 xfs_file_buffered_write+0xb1/0x330 [xfs 619a268fb2406d68bd34e007a816b27e70abc22c] vfs_write+0x2eb/0x410 ksys_write+0x65/0xe0 do_syscall_64+0x2b/0x80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Found by xfs/538 in alwayscow mode, but this doesn't seem particular to that test. Fixes: 590b16516ef3 ("xfs: refactor xfs_iomap_prealloc_size") Actually-Fixes: 66ae56a53f0e ("xfs: introduce an always_cow mode") Signed-off-by: Darrick J. Wong <djwong(a)kernel.org> Signed-off-by: Zizhi Wo <wozizhi(a)huawei.com> --- fs/xfs/xfs_iomap.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/fs/xfs/xfs_iomap.c b/fs/xfs/xfs_iomap.c index ae96ac52c974..8fa09970b0d4 100644 --- a/fs/xfs/xfs_iomap.c +++ b/fs/xfs/xfs_iomap.c @@ -1027,9 +1027,12 @@ xfs_buffered_write_iomap_begin( */ if (xfs_has_allocsize(mp)) prealloc_blocks = mp->m_allocsize_blocks; - else + else if (allocfork == XFS_DATA_FORK) prealloc_blocks = xfs_iomap_prealloc_size(ip, allocfork, offset, count, &icur); + else + prealloc_blocks = xfs_iomap_prealloc_size(ip, allocfork, + offset, count, &ccur); if (prealloc_blocks) { xfs_extlen_t align; xfs_off_t end_offset; -- 2.39.2

2 1

[PATCH OLK-6.6 v2] sched: smart_grid: silence complier error
by Yipeng Zou 15 May '24

15 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9PEF6 CVE: NA ---------------------------------------- Silence complier error with allnoconfig. Implicit declaration of function without CONFIG_CGROUP_SCHED: 1. tg_update_affinity_domains 2. init_auto_affinity Fixes: 6eb07f9925a9 ("sched: Introduce smart grid scheduling strategy for cfs") Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- kernel/sched/core.c | 7 +++++++ kernel/sched/fair.c | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 07bcc5f2e2d9..9e7a99947de6 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -9733,7 +9733,9 @@ int sched_cpu_activate(unsigned int cpu) static_branch_inc_cpuslocked(&sched_smt_present); #endif set_cpu_active(cpu, true); +#ifdef CONFIG_QOS_SCHED_SMART_GRID tg_update_affinity_domains(cpu, 1); +#endif if (sched_smp_initialized) { sched_update_numa(cpu, true); @@ -9823,7 +9825,9 @@ int sched_cpu_deactivate(unsigned int cpu) return ret; } sched_domains_numa_masks_clear(cpu); +#ifdef CONFIG_QOS_SCHED_SMART_GRID tg_update_affinity_domains(cpu, 0); +#endif return 0; } @@ -9947,7 +9951,10 @@ void __init sched_init_smp(void) sched_smp_initialized = true; sched_grid_zone_init(); + +#ifdef CONFIG_QOS_SCHED_SMART_GRID init_auto_affinity(&root_task_group); +#endif } static int __init migration_init(void) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 8de28b182763..3dcbf50b677f 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7253,7 +7253,7 @@ static void destroy_auto_affinity(struct task_group *tg) tg->auto_affinity = NULL; } #else -static void destroy_auto_affinity(struct task_group *tg) {} +static void __maybe_unused destroy_auto_affinity(struct task_group *tg) {} #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY static inline bool prefer_cpus_valid(struct task_struct *p); -- 2.34.1

2 1

[PATCH OLK-6.6] sched: smart_grid: silence complier error
by Yipeng Zou 15 May '24

15 May '24

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I9PEF6 CVE: NA ---------------------------------------- Silence complier error with allnoconfig. Implicit declaration of function without CONFIG_CGROUP_SCHED: 1. tg_update_affinity_domains 2. init_auto_affinity Signed-off-by: Yipeng Zou <zouyipeng(a)huawei.com> --- kernel/sched/core.c | 7 +++++++ kernel/sched/fair.c | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 07bcc5f2e2d9..9e7a99947de6 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -9733,7 +9733,9 @@ int sched_cpu_activate(unsigned int cpu) static_branch_inc_cpuslocked(&sched_smt_present); #endif set_cpu_active(cpu, true); +#ifdef CONFIG_QOS_SCHED_SMART_GRID tg_update_affinity_domains(cpu, 1); +#endif if (sched_smp_initialized) { sched_update_numa(cpu, true); @@ -9823,7 +9825,9 @@ int sched_cpu_deactivate(unsigned int cpu) return ret; } sched_domains_numa_masks_clear(cpu); +#ifdef CONFIG_QOS_SCHED_SMART_GRID tg_update_affinity_domains(cpu, 0); +#endif return 0; } @@ -9947,7 +9951,10 @@ void __init sched_init_smp(void) sched_smp_initialized = true; sched_grid_zone_init(); + +#ifdef CONFIG_QOS_SCHED_SMART_GRID init_auto_affinity(&root_task_group); +#endif } static int __init migration_init(void) diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c index 8de28b182763..3dcbf50b677f 100644 --- a/kernel/sched/fair.c +++ b/kernel/sched/fair.c @@ -7253,7 +7253,7 @@ static void destroy_auto_affinity(struct task_group *tg) tg->auto_affinity = NULL; } #else -static void destroy_auto_affinity(struct task_group *tg) {} +static void __maybe_unused destroy_auto_affinity(struct task_group *tg) {} #ifdef CONFIG_QOS_SCHED_DYNAMIC_AFFINITY static inline bool prefer_cpus_valid(struct task_struct *p); -- 2.34.1

2 1

[openeuler:OLK-6.6 6910/9610] drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:79:53: sparse: sparse: incorrect type in assignment (different base types)
by kernel test robot 15 May '24

15 May '24

tree: https://gitee.com/openeuler/kernel.git OLK-6.6 head: 7c6c7d83d2bc788cd9aef8983afa59eae25e148e commit: c7489eeb1b4ed08f28172986d496abb02d1258f1 [6910/9610] net: hns3: support arp proxy config: arm64-randconfig-r132-20240515 (https://download.01.org/0day-ci/archive/20240515/202405151052.AH2YMcM9-lkp@…) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce: (https://download.01.org/0day-ci/archive/20240515/202405151052.AH2YMcM9-lkp@…) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp(a)intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202405151052.AH2YMcM9-lkp@intel.com/ sparse warnings: (new ones prefixed by >>) >> drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:79:53: sparse: sparse: incorrect type in assignment (different base types) @@ expected restricted __be16 [usertype] vlan_tci @@ got unsigned short [usertype] vlan_tci @@ drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:79:53: sparse: expected restricted __be16 [usertype] vlan_tci drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:79:53: sparse: got unsigned short [usertype] vlan_tci >> drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:128:58: sparse: sparse: incorrect type in argument 3 (different base types) @@ expected unsigned short [usertype] vlan_tci @@ got restricted __be16 [usertype] vlan_tci @@ drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:128:58: sparse: expected unsigned short [usertype] vlan_tci drivers/net/ethernet/hisilicon/hns3/hns3_roh.c:128:58: sparse: got restricted __be16 [usertype] vlan_tci drivers/net/ethernet/hisilicon/hns3/hns3_roh.c: note: in included file (through include/linux/mmzone.h, include/linux/gfp.h, include/linux/xarray.h, ...): include/linux/page-flags.h:245:46: sparse: sparse: self-comparison always evaluates to false vim +79 drivers/net/ethernet/hisilicon/hns3/hns3_roh.c 56 57 int hns3_handle_roh_arp_req(struct sk_buff *skb, struct hns3_nic_priv *priv) 58 { 59 struct hnae3_handle *h = priv->ae_handle; 60 struct hns3_enet_ring *ring; 61 struct arphdr *arphdr; 62 struct ethhdr *ethhdr; 63 int reply_idx, len; 64 __be32 *sip, *tip; 65 66 /* use same queue num in rx */ 67 ring = &priv->ring[skb->queue_mapping + h->kinfo.num_tqps]; 68 reply_idx = ring->arp_reply_tail; 69 reply_idx = hns3_roh_arp_reply_idx_move_fd(reply_idx); 70 /* This smp_load_acquire() pairs with smp_store_release() in 71 * hns3_handle_roh_arp_reply(). 72 */ 73 if (reply_idx == smp_load_acquire(&ring->arp_reply_head)) 74 return NETDEV_TX_BUSY; 75 len = skb->len; 76 77 if (skb_vlan_tagged(skb)) { 78 ring->arp_reply[reply_idx].has_vlan = true; > 79 ring->arp_reply[reply_idx].vlan_tci = skb_vlan_tag_get(skb); 80 skb_vlan_pop(skb); 81 len += VLAN_HLEN; 82 } else { 83 ring->arp_reply[reply_idx].has_vlan = false; 84 } 85 86 ethhdr = eth_hdr(skb); 87 arphdr = arp_hdr(skb); 88 89 hns3_extract_arp_ip_field(arphdr, &sip, &tip, skb->dev->addr_len); 90 ether_addr_copy(ring->arp_reply[reply_idx].dest_hw, ethhdr->h_source); 91 ether_addr_copy(ring->arp_reply[reply_idx].src_hw, ethhdr->h_dest); 92 ring->arp_reply[reply_idx].dest_ip = *sip; 93 ring->arp_reply[reply_idx].src_ip = *tip; 94 hns3_roh_update_mac_by_ip(be32_to_cpu(*tip), 95 ring->arp_reply[reply_idx].src_hw); 96 /* This smp_store_release() pairs with smp_load_acquire() in 97 * hns3_handle_roh_arp_reply(). Ensure that the arp_reply_tail is 98 * update validly. 99 */ 100 smp_store_release(&ring->arp_reply_tail, reply_idx); 101 102 ring = &priv->ring[skb->queue_mapping]; 103 u64_stats_update_begin(&ring->syncp); 104 ring->stats.tx_pkts++; 105 ring->stats.tx_bytes += len; 106 u64_stats_update_end(&ring->syncp); 107 108 dev_kfree_skb_any(skb); 109 napi_schedule(&ring->tqp_vector->napi); 110 return NETDEV_TX_OK; 111 } 112 113 static struct sk_buff *setup_arp_reply_skb(struct hns3_arp_reply *arp_reply, 114 struct hns3_nic_priv *priv) 115 { 116 struct sk_buff *skb = arp_create(ARPOP_REPLY, ETH_P_ARP, 117 arp_reply->dest_ip, priv->netdev, 118 arp_reply->src_ip, arp_reply->dest_hw, 119 arp_reply->src_hw, arp_reply->dest_hw); 120 if (!skb) 121 return NULL; 122 123 skb_reset_mac_header(skb); 124 skb_reset_mac_len(skb); 125 126 if (arp_reply->has_vlan) { 127 skb = vlan_insert_tag_set_proto(skb, htons(ETH_P_8021Q), > 128 arp_reply->vlan_tci); 129 if (!skb) 130 return NULL; 131 skb_reset_network_header(skb); 132 } 133 134 skb_reserve(skb, skb->mac_len); 135 return skb; 136 } 137 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki

1 0

[PATCH] iommu/iova: Make depot list more efficient
by Zhang Zekun 15 May '24

15 May '24

In some scenarios in which is sensitive to the efficiency of allocating iova from iova_rcache. The commit 911aa1245da8 ("iommu/iova: Make the rcache depot scale better") change the format of depot from the fix length array to a list to make depot scale better for machines which has much cores. But the list operation is not as efficiency as the array operation, for some test case, such as IP tansfering, in which allocating iova from iova_rcache can become a bottle neck, this list operation can be reflected by a performance decrease. We can see the higher occupation of queue_iova() and __iova_rcache_get() in perf top. Operating iova_rache->depot on a list: 14.47% [kernel] [k] queue_iova 12.99% [kernel] [k] __iova_rcache_get 8.22% [kernel] [k] __arm_lpae_unmap 6.98% [kernel] [k] arm_lpae_map 6.20% [kernel] [k] native_queued_spin_unlock 4.63% [kernel] [k] __arm_lpae_map 2.56% [kernel] [k] __dev_queue_xmit Operating iova_rache->depot on a array: 10.50% [kernel] [k] __arm_lpae_unmap 7.80% [kernel] [k] native_queued_spin_unlock 7.23% [kernel] [k] queue_iova 7.16% [kernel] [k] arm_lpae_map 5.90% [kernel] [k] __arm_lpae_map 3.67% [kernel] [k] __iova_rcache_get 3.20% [kernel] [k] __dev_queue_xmit To make the depot operation more efficient, we can introduce a array buffer before using the depot list, the length of the array will be set to NR_CPUS, which should be enough for most workloads. iova_rcache will first try to use magazines in the array part of the depot. If we have too much magazines which need to be put in the depot, then the depot list will be used. Signed-off-by: Zhang Zekun <zhangzekun11(a)huawei.com> --- drivers/iommu/iova.c | 40 ++++++++++++++++++++++++++++++++-------- 1 file changed, 32 insertions(+), 8 deletions(-) diff --git a/drivers/iommu/iova.c b/drivers/iommu/iova.c index d59d0ea2fd21..220256dde24f 100644 --- a/drivers/iommu/iova.c +++ b/drivers/iommu/iova.c @@ -563,6 +563,7 @@ EXPORT_SYMBOL_GPL(reserve_iova); * we don't need to waste PFN capacity on a separate list head either. */ #define IOVA_MAG_SIZE 127 +#define IOVA_DEPOT_POOL_LEN NR_CPUS #define IOVA_DEPOT_DELAY msecs_to_jiffies(100) @@ -581,10 +582,15 @@ struct iova_cpu_rcache { struct iova_magazine *prev; }; +struct iova_rcache_depot { + struct iova_magazine *pool[IOVA_DEPOT_POOL_LEN]; + struct iova_magazine *list; +}; + struct iova_rcache { spinlock_t lock; unsigned int depot_size; - struct iova_magazine *depot; + struct iova_rcache_depot *depot; struct iova_cpu_rcache __percpu *cpu_rcaches; struct iova_domain *iovad; struct delayed_work work; @@ -671,9 +677,14 @@ static void iova_magazine_push(struct iova_magazine *mag, unsigned long pfn) static struct iova_magazine *iova_depot_pop(struct iova_rcache *rcache) { - struct iova_magazine *mag = rcache->depot; + struct iova_rcache_depot *depot = rcache->depot; + struct iova_magazine *mag; - rcache->depot = mag->next; + if (rcache->depot_size <= IOVA_DEPOT_POOL_LEN) + return depot->pool[--rcache->depot_size]; + + mag = depot->list; + depot->list = mag->next; mag->size = IOVA_MAG_SIZE; rcache->depot_size--; return mag; @@ -681,8 +692,15 @@ static struct iova_magazine *iova_depot_pop(struct iova_rcache *rcache) static void iova_depot_push(struct iova_rcache *rcache, struct iova_magazine *mag) { - mag->next = rcache->depot; - rcache->depot = mag; + struct iova_rcache_depot *depot = rcache->depot; + + if (rcache->depot_size < IOVA_DEPOT_POOL_LEN) { + depot->pool[rcache->depot_size++] = mag; + return; + } + + mag->next = depot->list; + depot->list = mag; rcache->depot_size++; } @@ -729,6 +747,11 @@ int iova_domain_init_rcaches(struct iova_domain *iovad) ret = -ENOMEM; goto out_err; } + rcache->depot = kzalloc(sizeof(struct iova_rcache_depot), GFP_KERNEL); + if (!rcache->depot) { + ret = -ENOMEM; + goto out_err; + } for_each_possible_cpu(cpu) { cpu_rcache = per_cpu_ptr(rcache->cpu_rcaches, cpu); @@ -832,7 +855,7 @@ static unsigned long __iova_rcache_get(struct iova_rcache *rcache, has_pfn = true; } else { spin_lock(&rcache->lock); - if (rcache->depot) { + if (rcache->depot_size > 0) { iova_magazine_free(cpu_rcache->loaded); cpu_rcache->loaded = iova_depot_pop(rcache); has_pfn = true; @@ -885,8 +908,9 @@ static void free_iova_rcaches(struct iova_domain *iovad) } free_percpu(rcache->cpu_rcaches); cancel_delayed_work_sync(&rcache->work); - while (rcache->depot) + while (rcache->depot_size > 0) iova_magazine_free(iova_depot_pop(rcache)); + kfree(rcache->depot); } kfree(iovad->rcaches); @@ -924,7 +948,7 @@ static void free_global_cached_iovas(struct iova_domain *iovad) for (int i = 0; i < IOVA_RANGE_CACHE_MAX_SIZE; ++i) { rcache = &iovad->rcaches[i]; spin_lock_irqsave(&rcache->lock, flags); - while (rcache->depot) { + while (rcache->depot_size > 0) { struct iova_magazine *mag = iova_depot_pop(rcache); iova_magazine_free_pfns(mag, iovad); -- 2.17.1

1 0

[PATCH OLK-5.10 0/3] bugfix from mainline
by Yang Yingliang 15 May '24

15 May '24

Josh Poimboeuf (3): x86/srso: Set CPUID feature bits independently of bug or mitigation status x86/srso: Don't probe microcode in a guest x86/srso: Fix vulnerability reporting for missing microcode Documentation/admin-guide/hw-vuln/srso.rst | 19 ++++++--- arch/x86/include/asm/processor.h | 2 - arch/x86/kernel/cpu/amd.c | 28 ++++--------- arch/x86/kernel/cpu/bugs.c | 49 ++++++++++------------ 4 files changed, 45 insertions(+), 53 deletions(-) -- 2.25.1

2 4