- Kernel - mailweb.openeuler.org

[PATCH 1/3] crypto: hisilicon/sgl - small cleanups for sgl.c
by Weili Qian 28 Nov '23

28 Nov '23

driver inclusion category: cleanup bugzilla: https://gitee.com/openeuler/kernel/issues/I8IVG6 CVE: NA ---------------------------------------------------------------------- 1. Remove unnecessary brackets in function hisi_acc_create_sgl_pool(). 2. Modify local variable type, ensure that the variable type is consistent with the variable type to be compared. 3. Because the function clear_hw_sgl_sge() is in the task process, obtain the value of le16_to_cpu(hw_sgl->entry_sum_in_sgl) before loop execting to shorten the loop execution time. Signed-off-by: Weili Qian <qianweili(a)huawei.com> Signed-off-by: JiangShui Yang <yangjiangshui(a)h-partners.com> --- drivers/crypto/hisilicon/sgl.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/drivers/crypto/hisilicon/sgl.c b/drivers/crypto/hisilicon/sgl.c index 09586a837b1e..6f281d808a0f 100644 --- a/drivers/crypto/hisilicon/sgl.c +++ b/drivers/crypto/hisilicon/sgl.c @@ -121,10 +121,10 @@ struct hisi_acc_sgl_pool *hisi_acc_create_sgl_pool(struct device *dev, return pool; err_free_mem: - for (j = 0; j < i; j++) { + for (j = 0; j < i; j++) dma_free_coherent(dev, block_size, block[j].sgl, block[j].sgl_dma); - } + kfree_sensitive(pool); return ERR_PTR(-ENOMEM); } @@ -140,7 +140,7 @@ EXPORT_SYMBOL_GPL(hisi_acc_create_sgl_pool); void hisi_acc_free_sgl_pool(struct device *dev, struct hisi_acc_sgl_pool *pool) { struct mem_block *block; - int i; + u32 i; if (!dev || !pool) return; @@ -196,9 +196,10 @@ static void update_hw_sgl_sum_sge(struct hisi_acc_hw_sgl *hw_sgl, u16 sum) static void clear_hw_sgl_sge(struct hisi_acc_hw_sgl *hw_sgl) { struct acc_hw_sge *hw_sge = hw_sgl->sge_entries; + u16 entry_sum = le16_to_cpu(hw_sgl->entry_sum_in_sgl); int i; - for (i = 0; i < le16_to_cpu(hw_sgl->entry_sum_in_sgl); i++) { + for (i = 0; i < entry_sum; i++) { hw_sge[i].page_ctrl = NULL; hw_sge[i].buf = 0; hw_sge[i].len = 0; @@ -223,10 +224,11 @@ hisi_acc_sg_buf_map_to_hw_sgl(struct device *dev, u32 index, dma_addr_t *hw_sgl_dma) { struct hisi_acc_hw_sgl *curr_hw_sgl; + unsigned int i, sg_n_mapped; dma_addr_t curr_sgl_dma = 0; struct acc_hw_sge *curr_hw_sge; struct scatterlist *sg; - int i, sg_n, sg_n_mapped; + int sg_n; if (!dev || !sgl || !pool || !hw_sgl_dma) return ERR_PTR(-EINVAL); -- 2.33.0

1 2

[PATCH v2 OLK-6.6 00/17] Support Qos scheduler
by Wenyu Huang 28 Nov '23

28 Nov '23

Hui Tang (1): sched: Fix null-ptr-deref in free_fair_sched_group Xia Fukun (1): sched/qos: Fix warning in CPU hotplug scenarios Zhang Qiao (15): sched: Introduce qos scheduler for co-location sched: Throttle qos cfs_rq when current cpu is running online task sched: Fix offline task can't be killed in a timely sched: Unthrottle the throttled cfs rq when offline rq sched: Unthrottle qos cfs rq when free a task group sched: bugfix setscheduler unlock cpuset_rwsem sched: Introduce handle priority reversion mechanism sched: enable CONFIG_QOS_SCHED on arm64 sched: Fix sleeping in atomic context at cpu_qos_write() sched/fair: Add qos_throttle_list node in struct cfs_rq sched: Throttle offline task at tracehook_notify_resume() sched/qos: Add qos_tg_{throttle,unthrottle}_{up,down} sched/fair: Update rq clock before unthrottle a qos cfs_rq sched/qos: Don't unthrottle cfs_rq when cfs_rq is throttled by qos sched: Enable qos scheduler config arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/cgroup.h | 4 + include/linux/resume_user_mode.h | 5 + include/linux/sched.h | 23 ++ include/linux/sched/sysctl.h | 8 + init/Kconfig | 12 + kernel/cgroup/cgroup.c | 22 ++ kernel/sched/core.c | 155 +++++++++++ kernel/sched/fair.c | 357 ++++++++++++++++++++++++- kernel/sched/sched.h | 12 + kernel/signal.c | 3 + kernel/sysctl.c | 24 ++ 13 files changed, 626 insertions(+), 1 deletion(-) -- 2.34.1

1 17

[PATCH OLK-5.10] ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
by Zhengchao Shao 28 Nov '23

28 Nov '23

mainline inclusion from mainline-v6.7-rc2 commit e2b706c691905fe78468c361aaabc719d0a496f1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8K0N2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When I perform the following test operations: 1.ip link add br0 type bridge 2.brctl addif br0 eth0 3.ip addr add 239.0.0.1/32 dev eth0 4.ip addr add 239.0.0.1/32 dev br0 5.ip addr add 224.0.0.1/32 dev br0 6.while ((1)) do ifconfig br0 up ifconfig br0 down done 7.send IGMPv2 query packets to port eth0 continuously. For example, ./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00 1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00" The preceding tests may trigger the refcnt uaf issue of the mc list. The stack is as follows: refcount_t: addition on 0; use-after-free. WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25) CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty #80 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 RIP: 0010:refcount_warn_saturate (lib/refcount.c:25) RSP: 0018:ffffb68f00657910 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908 RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900 RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680 R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00 FS: 0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0 Call Trace: <TASK> igmp_heard_query (net/ipv4/igmp.c:1068) igmp_rcv (net/ipv4/igmp.c:1132) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205) ip_local_deliver_finish (net/ipv4/ip_input.c:234) __netif_receive_skb_one_core (net/core/dev.c:5529) netif_receive_skb_internal (net/core/dev.c:5729) netif_receive_skb (net/core/dev.c:5788) br_handle_frame_finish (net/bridge/br_input.c:216) nf_hook_bridge_pre (net/bridge/br_input.c:294) __netif_receive_skb_core (net/core/dev.c:5423) __netif_receive_skb_list_core (net/core/dev.c:5606) __netif_receive_skb_list (net/core/dev.c:5674) netif_receive_skb_list_internal (net/core/dev.c:5764) napi_gro_receive (net/core/gro.c:609) e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467) e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805) __napi_poll (net/core/dev.c:6533) net_rx_action (net/core/dev.c:6735) __do_softirq (kernel/softirq.c:554) run_ksoftirqd (kernel/softirq.c:913) smpboot_thread_fn (kernel/smpboot.c:164) kthread (kernel/kthread.c:388) ret_from_fork (arch/x86/kernel/process.c:153) ret_from_fork_asm (arch/x86/entry/entry_64.S:250) </TASK> The root causes are as follows: Thread A Thread B ... netif_receive_skb br_dev_stop ... br_multicast_leave_snoopers ... __ip_mc_dec_group ... __igmp_group_dropped igmp_rcv igmp_stop_timer igmp_heard_query //ref = 1 ip_ma_put igmp_mod_timer refcount_dec_and_test igmp_start_timer //ref = 0 ... refcount_inc //ref increases from 0 When the device receives an IGMPv2 Query message, it starts the timer immediately, regardless of whether the device is running. If the device is down and has left the multicast group, it will cause the mc list refcount uaf issue. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Hangbin Liu <liuhangbin(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/ipv4/igmp.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/ipv4/igmp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index c71b863093ac..73c24ce011f0 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -216,8 +216,10 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay) int tv = prandom_u32() % max_delay; im->tm_running = 1; - if (!mod_timer(&im->timer, jiffies+tv+2)) - refcount_inc(&im->refcnt); + if (refcount_inc_not_zero(&im->refcnt)) { + if (mod_timer(&im->timer, jiffies + tv + 2)) + ip_ma_put(im); + } } static void igmp_gq_start_timer(struct in_device *in_dev) -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet
by Zhengchao Shao 28 Nov '23

28 Nov '23

mainline inclusion from mainline-v6.7-rc2 commit e2b706c691905fe78468c361aaabc719d0a496f1 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8K0N2 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- When I perform the following test operations: 1.ip link add br0 type bridge 2.brctl addif br0 eth0 3.ip addr add 239.0.0.1/32 dev eth0 4.ip addr add 239.0.0.1/32 dev br0 5.ip addr add 224.0.0.1/32 dev br0 6.while ((1)) do ifconfig br0 up ifconfig br0 down done 7.send IGMPv2 query packets to port eth0 continuously. For example, ./mausezahn ethX -c 0 "01 00 5e 00 00 01 00 72 19 88 aa 02 08 00 45 00 00 1c 00 01 00 00 01 02 0e 7f c0 a8 0a b7 e0 00 00 01 11 64 ee 9b 00 00 00 00" The preceding tests may trigger the refcnt uaf issue of the mc list. The stack is as follows: refcount_t: addition on 0; use-after-free. WARNING: CPU: 21 PID: 144 at lib/refcount.c:25 refcount_warn_saturate (lib/refcount.c:25) CPU: 21 PID: 144 Comm: ksoftirqd/21 Kdump: loaded Not tainted 6.7.0-rc1-next-20231117-dirty #80 Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011 RIP: 0010:refcount_warn_saturate (lib/refcount.c:25) RSP: 0018:ffffb68f00657910 EFLAGS: 00010286 RAX: 0000000000000000 RBX: ffff8a00c3bf96c0 RCX: ffff8a07b6160908 RDX: 00000000ffffffd8 RSI: 0000000000000027 RDI: ffff8a07b6160900 RBP: ffff8a00cba36862 R08: 0000000000000000 R09: 00000000ffff7fff R10: ffffb68f006577c0 R11: ffffffffb0fdcdc8 R12: ffff8a00c3bf9680 R13: ffff8a00c3bf96f0 R14: 0000000000000000 R15: ffff8a00d8766e00 FS: 0000000000000000(0000) GS:ffff8a07b6140000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055f10b520b28 CR3: 000000039741a000 CR4: 00000000000006f0 Call Trace: <TASK> igmp_heard_query (net/ipv4/igmp.c:1068) igmp_rcv (net/ipv4/igmp.c:1132) ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205) ip_local_deliver_finish (net/ipv4/ip_input.c:234) __netif_receive_skb_one_core (net/core/dev.c:5529) netif_receive_skb_internal (net/core/dev.c:5729) netif_receive_skb (net/core/dev.c:5788) br_handle_frame_finish (net/bridge/br_input.c:216) nf_hook_bridge_pre (net/bridge/br_input.c:294) __netif_receive_skb_core (net/core/dev.c:5423) __netif_receive_skb_list_core (net/core/dev.c:5606) __netif_receive_skb_list (net/core/dev.c:5674) netif_receive_skb_list_internal (net/core/dev.c:5764) napi_gro_receive (net/core/gro.c:609) e1000_clean_rx_irq (drivers/net/ethernet/intel/e1000/e1000_main.c:4467) e1000_clean (drivers/net/ethernet/intel/e1000/e1000_main.c:3805) __napi_poll (net/core/dev.c:6533) net_rx_action (net/core/dev.c:6735) __do_softirq (kernel/softirq.c:554) run_ksoftirqd (kernel/softirq.c:913) smpboot_thread_fn (kernel/smpboot.c:164) kthread (kernel/kthread.c:388) ret_from_fork (arch/x86/kernel/process.c:153) ret_from_fork_asm (arch/x86/entry/entry_64.S:250) </TASK> The root causes are as follows: Thread A Thread B ... netif_receive_skb br_dev_stop ... br_multicast_leave_snoopers ... __ip_mc_dec_group ... __igmp_group_dropped igmp_rcv igmp_stop_timer igmp_heard_query //ref = 1 ip_ma_put igmp_mod_timer refcount_dec_and_test igmp_start_timer //ref = 0 ... refcount_inc //ref increases from 0 When the device receives an IGMPv2 Query message, it starts the timer immediately, regardless of whether the device is running. If the device is down and has left the multicast group, it will cause the mc list refcount uaf issue. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> Reviewed-by: Eric Dumazet <edumazet(a)google.com> Reviewed-by: Hangbin Liu <liuhangbin(a)gmail.com> Signed-off-by: David S. Miller <davem(a)davemloft.net> Conflicts: net/ipv4/igmp.c Signed-off-by: Zhengchao Shao <shaozhengchao(a)huawei.com> --- net/ipv4/igmp.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c index 834780a8baf6..c4b396968acd 100644 --- a/net/ipv4/igmp.c +++ b/net/ipv4/igmp.c @@ -221,8 +221,10 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay) int tv = prandom_u32() % max_delay; im->tm_running = 1; - if (!mod_timer(&im->timer, jiffies+tv+2)) - refcount_inc(&im->refcnt); + if (refcount_inc_not_zero(&im->refcnt)) { + if (mod_timer(&im->timer, jiffies + tv + 2)) + ip_ma_put(im); + } } static void igmp_gq_start_timer(struct in_device *in_dev) -- 2.34.1

2 1

[PATCH OLK-5.10 v8 00/20] introduce smart_grid zone
by Yipeng Zou 28 Nov '23

28 Nov '23

The patch sets include two parts: 1. patch 1~15,20: Rebase smart_grid from openeuler-1.0-LTS to OLK-5.10 2. patch 16~19: introduce smart_grid zone qos and cpufreq Since v7: 1. Update x86 openeuler_defconfig Since v6: 1. check is timer active in affinity timer Since v5: 1. Fix race condition in smart_grid_governor_enable. 2. Fix race condition in stop_auto_affinity. 3. Fix some str to int input in smart_grid_level_write. Since v4: 1. Place the highest level task in current domain level itself in sched_grid_prefer_cpus Since v3: 1. fix CI warning Since v2: 1. static alloc sg_zone cpumask. 2. fix some warning Hui Tang (13): sched: Introduce smart grid scheduling strategy for cfs sched: fix smart grid usage count sched: fix WARN found by deadlock detect sched: Fix possible deadlock in tg_set_dynamic_affinity_mode sched: Fix negative count for jump label sched: Fix timer storm for smart grid sched: fix dereference NULL pointers sched: Fix memory leak on error branch sched: clear credit count in error branch sched: Adjust few parameters range for smart grid sched: Delete redundant updates to p->prefer_cpus sched: Fix memory leak for smart grid sched: Fix null pointer derefrence for sd->span Wang ShaoBo (2): sched: smart grid: init sched_grid_qos structure on QOS purpose config: enable CONFIG_QOS_SCHED_SMART_GRID by default Yipeng Zou (5): sched: introduce smart grid qos zone smart_grid: introduce /proc/pid/smart_grid_level smart_grid: introduce smart_grid_strategy_ctrl sysctl smart_grid: cpufreq: introduce smart_grid cpufreq control sched: smart grid: check is active in affinity timer arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + drivers/cpufreq/cpufreq.c | 232 ++++++++++++ fs/proc/array.c | 13 + fs/proc/base.c | 78 ++++ include/linux/cpufreq.h | 11 + include/linux/sched.h | 22 ++ include/linux/sched/grid_qos.h | 135 +++++++ include/linux/sched/sysctl.h | 5 + init/Kconfig | 13 + kernel/fork.c | 15 +- kernel/sched/Makefile | 1 + kernel/sched/core.c | 160 +++++++- kernel/sched/fair.c | 500 ++++++++++++++++++++++++- kernel/sched/grid/Makefile | 2 + kernel/sched/grid/internal.h | 6 + kernel/sched/grid/power.c | 27 ++ kernel/sched/grid/qos.c | 273 ++++++++++++++ kernel/sched/grid/stat.c | 47 +++ kernel/sched/sched.h | 48 +++ kernel/sysctl.c | 22 +- mm/mempolicy.c | 12 +- 22 files changed, 1606 insertions(+), 18 deletions(-) create mode 100644 include/linux/sched/grid_qos.h create mode 100644 kernel/sched/grid/Makefile create mode 100644 kernel/sched/grid/internal.h create mode 100644 kernel/sched/grid/power.c create mode 100644 kernel/sched/grid/qos.c create mode 100644 kernel/sched/grid/stat.c -- 2.34.1

2 21

[PATCH OLK-6.6 v2 0/1] Added SM3 as module signing algorithm
by GUO Zihua 28 Nov '23

28 Nov '23

This patch adds SM3 as one of the module signing algorithm. v2: Updated related issue. GUO Zihua (1): keys: Allow automatic module signature with SM3 kernel/module/Kconfig | 5 +++++ 1 file changed, 5 insertions(+) -- 2.34.1

2 2

[PATCH OLK-5.10 0/2] fix ksmbd to release the ones allocated for async work
by Zizhi Wo 28 Nov '23

28 Nov '23

fix typo and add release_async_work() to delete asynchronous work. Dawei Li (1): ksmbd: fix typo, syncronous->synchronous Namjae Jeon (1): ksmbd: delete asynchronous work from list fs/ksmbd/connection.c | 12 +++++------- fs/ksmbd/ksmbd_work.h | 2 +- fs/ksmbd/smb2pdu.c | 28 +++++++++++++++++++++------- fs/ksmbd/smb2pdu.h | 1 + 4 files changed, 28 insertions(+), 15 deletions(-) -- 2.39.2

2 3

[PATCH OLK-6.6 00/17] Support Qos scheduler
by Wenyu Huang 28 Nov '23

28 Nov '23

Hui Tang (1): sched: Fix null-ptr-deref in free_fair_sched_group Xia Fukun (1): sched/qos: Fix warning in CPU hotplug scenarios Zhang Qiao (15): sched: Introduce qos scheduler for co-location sched: Throttle qos cfs_rq when current cpu is running online task sched: Fix offline task can't be killed in a timely sched: Unthrottle the throttled cfs rq when offline rq sched: Unthrottle qos cfs rq when free a task group sched: bugfix setscheduler unlock cpuset_rwsem sched: Introduce handle priority reversion mechanism sched: enable CONFIG_QOS_SCHED on arm64 sched: Fix sleeping in atomic context at cpu_qos_write() sched/fair: Add qos_throttle_list node in struct cfs_rq sched: Throttle offline task at tracehook_notify_resume() sched/qos: Add qos_tg_{throttle,unthrottle}_{up,down} sched/fair: Update rq clock before unthrottle a qos cfs_rq sched/qos: Don't unthrottle cfs_rq when cfs_rq is throttled by qos sched: Enable qos scheduler config arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + include/linux/cgroup.h | 4 + include/linux/resume_user_mode.h | 5 + include/linux/sched.h | 23 ++ include/linux/sched/sysctl.h | 8 + init/Kconfig | 12 + kernel/cgroup/cgroup.c | 22 ++ kernel/sched/core.c | 155 +++++++++++ kernel/sched/fair.c | 357 ++++++++++++++++++++++++- kernel/sched/sched.h | 12 + kernel/signal.c | 3 + kernel/sysctl.c | 24 ++ 13 files changed, 626 insertions(+), 1 deletion(-) -- 2.34.1

1 17

[PATCH OLK-5.10 v4 00/20] psi irq in cgroupv1 and psi fine grained
by Lu Jialin 28 Nov '23

28 Nov '23

Chen Wandun (3): mm: disable psi cgroup v1 by default mm: add config isolation for psi under cgroup v1 psi: dont alloc memory for psi by default Chengming Zhou (3): sched/psi: Fix periodic aggregation shut off sched/psi: Optimize task switch inside shared cgroups again sched/psi: Add PSI_IRQ to track IRQ/SOFTIRQ pressure Hao Jia (1): sched/psi: Zero the memory of struct psi_group Johannes Weiner (1): sched/psi: Remove NR_ONCPU task accounting Lu Jialin (11): psi: support irq.pressure under cgroup v1 psi: enable CONFIG_PSI_CGROUP_V1 in openeuler_defconfig psi: update psi irqtime when the irq delta is nozero memcg: split async memcg reclaim from reclaim_high psi: add struct psi_group_ext PSI: Introduce fine grained stall time collect for cgroup reclaim PSI: Introduce avgs and total calculation for cgroup reclaim PSI: Introduce pressure.stat in psi PSI: add more memory fine grained stall tracking in pressure.stat add cpu fine grained stall tracking in pressure.stat PSI: enable CONFIG_PSI_FINE_GRAINED in openeuler_defconfig Suren Baghdasaryan (1): psi: Fix "defined but not used" warnings when CONFIG_PROC_FS=n Documentation/admin-guide/cgroup-v2.rst | 6 + arch/arm64/configs/openeuler_defconfig | 2 + arch/x86/configs/openeuler_defconfig | 2 + block/blk-cgroup.c | 2 +- block/blk-core.c | 2 +- include/linux/cgroup-defs.h | 6 +- include/linux/cgroup.h | 2 +- include/linux/psi.h | 9 +- include/linux/psi_types.h | 99 +++- include/linux/sched.h | 4 + init/Kconfig | 20 + kernel/cgroup/cgroup.c | 64 ++- kernel/sched/core.c | 2 + kernel/sched/cpuacct.c | 6 +- kernel/sched/fair.c | 6 - kernel/sched/psi.c | 691 ++++++++++++++++++++---- kernel/sched/stats.h | 9 + mm/compaction.c | 2 +- mm/filemap.c | 4 +- mm/memcontrol.c | 92 ++-- mm/page_alloc.c | 6 + mm/page_io.c | 3 + mm/vmscan.c | 5 +- 23 files changed, 873 insertions(+), 171 deletions(-) -- 2.34.1

2 21

[PATCH OLK-5.10] ipmi_si: fix a memleak in try_smi_init()
by Yi Yang 28 Nov '23

28 Nov '23

stable inclusion from stable-v5.10.195 commit 5c5f02e16b919c8cb6024dc3778c8d8f1fb1f26b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7GMMZ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit 6cf1a126de2992b4efe1c3c4d398f8de4aed6e3f upstream. Kmemleak reported the following leak info in try_smi_init(): unreferenced object 0xffff00018ecf9400 (size 1024): comm "modprobe", pid 2707763, jiffies 4300851415 (age 773.308s) backtrace: [<000000004ca5b312>] __kmalloc+0x4b8/0x7b0 [<00000000953b1072>] try_smi_init+0x148/0x5dc [ipmi_si] [<000000006460d325>] 0xffff800081b10148 [<0000000039206ea5>] do_one_initcall+0x64/0x2a4 [<00000000601399ce>] do_init_module+0x50/0x300 [<000000003c12ba3c>] load_module+0x7a8/0x9e0 [<00000000c246fffe>] __se_sys_init_module+0x104/0x180 [<00000000eea99093>] __arm64_sys_init_module+0x24/0x30 [<0000000021b1ef87>] el0_svc_common.constprop.0+0x94/0x250 [<0000000070f4f8b7>] do_el0_svc+0x48/0xe0 [<000000005a05337f>] el0_svc+0x24/0x3c [<000000005eb248d6>] el0_sync_handler+0x160/0x164 [<0000000030a59039>] el0_sync+0x160/0x180 The problem was that when an error occurred before handlers registration and after allocating `new_smi->si_sm`, the variable wouldn't be freed in the error handling afterwards since `shutdown_smi()` hadn't been registered yet. Fix it by adding a `kfree()` in the error handling path in `try_smi_init()`. Cc: stable(a)vger.kernel.org # 4.19+ Fixes: 7960f18a5647 ("ipmi_si: Convert over to a shutdown handler") Signed-off-by: Yi Yang <yiyang13(a)huawei.com> Co-developed-by: GONG, Ruiqi <gongruiqi(a)huaweicloud.com> Signed-off-by: GONG, Ruiqi <gongruiqi(a)huaweicloud.com> Message-Id: <20230629123328.2402075-1-gongruiqi(a)huaweicloud.com> Signed-off-by: Corey Minyard <minyard(a)acm.org> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Yi Yang <yiyang13(a)huawei.com> --- drivers/char/ipmi/ipmi_si_intf.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c index 9e3e24c43168..227eb9e8e47d 100644 --- a/drivers/char/ipmi/ipmi_si_intf.c +++ b/drivers/char/ipmi/ipmi_si_intf.c @@ -2089,6 +2089,11 @@ static int try_smi_init(struct smi_info *new_smi) new_smi->io.io_cleanup = NULL; } + if (rv && new_smi->si_sm) { + kfree(new_smi->si_sm); + new_smi->si_sm = NULL; + } + return rv; } -- 2.25.1

2 1