- Kernel - mailweb.openeuler.org

[PATCH v2 openEuler-1.0-LTS] sched/smt: fix unbalance sched_smt_present dec/inc
by Yu Liao 04 Sep '23

04 Sep '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7YBSW CVE: NA -------------------------------- If cpuset_cpu_inactive() fails in sched_cpu_deactivate(), the cpu offline failed, but sched_smt_present is decreased before calling sched_cpu_deactivate, it leads unbalance dec/inc, so fix it by increasing sched_smt_present in the error path. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- kernel/sched/core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 67bda877bfa8..7825ceaae0c4 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -5897,6 +5897,10 @@ int sched_cpu_deactivate(unsigned int cpu) ret = cpuset_cpu_inactive(cpu); if (ret) { +#ifdef CONFIG_SCHED_SMT + if (cpumask_weight(cpu_smt_mask(cpu)) == 2) + static_branch_inc_cpuslocked(&sched_smt_present); +#endif set_cpu_active(cpu, true); return ret; } -- 2.25.1

2 1

[PATCH openEuler-23.09 0/8] I/O readahead scenario optimization
by ZhaoLong Wang 04 Sep '23

04 Sep '23

Hou Tao (5): vfs: add bare tracepoints for vfs read and release fs: add helper fs_file_read_do_trace() xfs: add trace for read and release of regular file ext4: add trace for the read and release of regular file selftests/bpf: add demo for file read pattern detection Yufen Yu (1): readahead: introduce FMODE_CTL_WILLNEED to read first 2MB of file ZhaoLong Wang (2): VFS: Rolling Back the fmode macro definition and structure members selftests/bpf: Update the demo file_read_pattern to run on libbpf 1.0+ fs/ext4/file.c | 4 + fs/read_write.c | 38 +++++ fs/xfs/xfs_file.c | 3 + include/linux/fs.h | 37 +++++ include/trace/events/fs.h | 33 ++++ mm/readahead.c | 40 ++++- tools/testing/selftests/bpf/Makefile | 1 + .../testing/selftests/bpf/file_read_pattern.c | 73 +++++++++ .../bpf/progs/file_read_pattern_prog.c | 142 ++++++++++++++++++ 9 files changed, 370 insertions(+), 1 deletion(-) create mode 100644 include/trace/events/fs.h create mode 100644 tools/testing/selftests/bpf/file_read_pattern.c create mode 100644 tools/testing/selftests/bpf/progs/file_read_pattern_prog.c -- 2.39.2

2 9

[PATCH openEuler-1.0-LTS] RDMA/irdma: Prevent zero-length STAG registration
by Liu Jian 04 Sep '23

04 Sep '23

mainline inclusion from mainline-v6.6-rc1 commit bb6d73d9add68ad270888db327514384dfa44958 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7Y6IP CVE: CVE-2023-25775 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- Currently irdma allows zero-length STAGs to be programmed in HW during the kernel mode fast register flow. Zero-length MR or STAG registration disable HW memory length checks. Improve gaps in bounds checking in irdma by preventing zero-length STAG or MR registrations except if the IB_PD_UNSAFE_GLOBAL_RKEY is set. This addresses the disclosure CVE-2023-25775. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Christopher Bednarz <christopher.n.bednarz(a)intel.com> Signed-off-by: Shiraz Saleem <shiraz.saleem(a)intel.com> Link: https://lore.kernel.org/r/20230818144838.1758-1-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: drivers/infiniband/hw/i40iw/i40iw_ctrl.c drivers/infiniband/hw/i40iw/i40iw_type.h drivers/infiniband/hw/i40iw/i40iw_verbs.c drivers/infiniband/hw/irdma/ctrl.c drivers/infiniband/hw/irdma/type.h drivers/infiniband/hw/irdma/verbs.c --- drivers/infiniband/hw/i40iw/i40iw_ctrl.c | 6 ++++++ drivers/infiniband/hw/i40iw/i40iw_type.h | 2 ++ drivers/infiniband/hw/i40iw/i40iw_verbs.c | 10 ++++++++-- 3 files changed, 16 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c index 4d841a3c68f3..026557aa2307 100644 --- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c +++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c @@ -2945,6 +2945,9 @@ static enum i40iw_status_code i40iw_sc_alloc_stag( u64 header; enum i40iw_page_size page_size; + if (!info->total_len && !info->all_memory) + return -EINVAL; + page_size = (info->page_size == 0x200000) ? I40IW_PAGE_SIZE_2M : I40IW_PAGE_SIZE_4K; cqp = dev->cqp; wqe = i40iw_sc_cqp_get_next_send_wqe(cqp, scratch); @@ -3003,6 +3006,9 @@ static enum i40iw_status_code i40iw_sc_mr_reg_non_shared( u8 addr_type; enum i40iw_page_size page_size; + if (!info->total_len && !info->all_memory) + return -EINVAL; + page_size = (info->page_size == 0x200000) ? I40IW_PAGE_SIZE_2M : I40IW_PAGE_SIZE_4K; if (info->access_rights & (I40IW_ACCESS_FLAGS_REMOTEREAD_ONLY | I40IW_ACCESS_FLAGS_REMOTEWRITE_ONLY)) diff --git a/drivers/infiniband/hw/i40iw/i40iw_type.h b/drivers/infiniband/hw/i40iw/i40iw_type.h index adc8d2ec523d..5c4e2f206105 100644 --- a/drivers/infiniband/hw/i40iw/i40iw_type.h +++ b/drivers/infiniband/hw/i40iw/i40iw_type.h @@ -779,6 +779,7 @@ struct i40iw_allocate_stag_info { bool use_hmc_fcn_index; u8 hmc_fcn_index; bool use_pf_rid; + bool all_memory; }; struct i40iw_reg_ns_stag_info { @@ -797,6 +798,7 @@ struct i40iw_reg_ns_stag_info { bool use_hmc_fcn_index; u8 hmc_fcn_index; bool use_pf_rid; + bool all_memory; }; struct i40iw_fast_reg_stag_info { diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c index a5e3349b8a7c..9cf8bf2c87e7 100644 --- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c +++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c @@ -1603,7 +1603,8 @@ static int i40iw_handle_q_mem(struct i40iw_device *iwdev, static int i40iw_hw_alloc_stag(struct i40iw_device *iwdev, struct i40iw_mr *iwmr) { struct i40iw_allocate_stag_info *info; - struct i40iw_pd *iwpd = to_iwpd(iwmr->ibmr.pd); + struct ib_pd *pd = iwmr->ibmr.pd; + struct i40iw_pd *iwpd = to_iwpd(pd); enum i40iw_status_code status; int err = 0; struct i40iw_cqp_request *cqp_request; @@ -1620,6 +1621,7 @@ static int i40iw_hw_alloc_stag(struct i40iw_device *iwdev, struct i40iw_mr *iwmr info->stag_idx = iwmr->stag >> I40IW_CQPSQ_STAG_IDX_SHIFT; info->pd_id = iwpd->sc_pd.pd_id; info->total_len = iwmr->length; + info->all_memory = pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY; info->remote_access = true; cqp_info->cqp_cmd = OP_ALLOC_STAG; cqp_info->post_sq = 1; @@ -1673,6 +1675,8 @@ static struct ib_mr *i40iw_alloc_mr(struct ib_pd *pd, iwmr->type = IW_MEMREG_TYPE_MEM; palloc = &iwpbl->pble_alloc; iwmr->page_cnt = max_num_sg; + /* Use system PAGE_SIZE as the sg page sizes are unknown at this point */ + iwmr->length = max_num_sg * PAGE_SIZE; mutex_lock(&iwdev->pbl_mutex); status = i40iw_get_pble(&iwdev->sc_dev, iwdev->pble_rsrc, palloc, iwmr->page_cnt); mutex_unlock(&iwdev->pbl_mutex); @@ -1769,7 +1773,8 @@ static int i40iw_hwreg_mr(struct i40iw_device *iwdev, { struct i40iw_pbl *iwpbl = &iwmr->iwpbl; struct i40iw_reg_ns_stag_info *stag_info; - struct i40iw_pd *iwpd = to_iwpd(iwmr->ibmr.pd); + struct ib_pd *pd = iwmr->ibmr.pd; + struct i40iw_pd *iwpd = to_iwpd(pd); struct i40iw_pble_alloc *palloc = &iwpbl->pble_alloc; enum i40iw_status_code status; int err = 0; @@ -1789,6 +1794,7 @@ static int i40iw_hwreg_mr(struct i40iw_device *iwdev, stag_info->total_len = iwmr->length; stag_info->access_rights = access; stag_info->pd_id = iwpd->sc_pd.pd_id; + stag_info->all_memory = pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY; stag_info->addr_type = I40IW_ADDR_TYPE_VA_BASED; stag_info->page_size = iwmr->page_size; -- 2.34.1

2 2

[PATCH OLK-5.10] RDMA/irdma: Prevent zero-length STAG registration
by Liu Jian 04 Sep '23

04 Sep '23

mainline inclusion from mainline-v6.6-rc1 commit bb6d73d9add68ad270888db327514384dfa44958 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7Y6IP CVE: CVE-2023-25775 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- Currently irdma allows zero-length STAGs to be programmed in HW during the kernel mode fast register flow. Zero-length MR or STAG registration disable HW memory length checks. Improve gaps in bounds checking in irdma by preventing zero-length STAG or MR registrations except if the IB_PD_UNSAFE_GLOBAL_RKEY is set. This addresses the disclosure CVE-2023-25775. Fixes: b48c24c2d710 ("RDMA/irdma: Implement device supported verb APIs") Signed-off-by: Christopher Bednarz <christopher.n.bednarz(a)intel.com> Signed-off-by: Shiraz Saleem <shiraz.saleem(a)intel.com> Link: https://lore.kernel.org/r/20230818144838.1758-1-shiraz.saleem@intel.com Signed-off-by: Leon Romanovsky <leon(a)kernel.org> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Conflicts: drivers/infiniband/hw/i40iw/i40iw_ctrl.c drivers/infiniband/hw/i40iw/i40iw_type.h drivers/infiniband/hw/i40iw/i40iw_verbs.c drivers/infiniband/hw/irdma/ctrl.c drivers/infiniband/hw/irdma/type.h drivers/infiniband/hw/irdma/verbs.c --- drivers/infiniband/hw/i40iw/i40iw_ctrl.c | 6 ++++++ drivers/infiniband/hw/i40iw/i40iw_type.h | 2 ++ drivers/infiniband/hw/i40iw/i40iw_verbs.c | 10 ++++++++-- 3 files changed, 16 insertions(+), 2 deletions(-) diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c index 86d3f8aff329..2b18bb36e4e3 100644 --- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c +++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c @@ -3033,6 +3033,9 @@ static enum i40iw_status_code i40iw_sc_alloc_stag( u64 header; enum i40iw_page_size page_size; + if (!info->total_len && !info->all_memory) + return -EINVAL; + page_size = (info->page_size == 0x200000) ? I40IW_PAGE_SIZE_2M : I40IW_PAGE_SIZE_4K; cqp = dev->cqp; wqe = i40iw_sc_cqp_get_next_send_wqe(cqp, scratch); @@ -3091,6 +3094,9 @@ static enum i40iw_status_code i40iw_sc_mr_reg_non_shared( u8 addr_type; enum i40iw_page_size page_size; + if (!info->total_len && !info->all_memory) + return -EINVAL; + page_size = (info->page_size == 0x200000) ? I40IW_PAGE_SIZE_2M : I40IW_PAGE_SIZE_4K; if (info->access_rights & (I40IW_ACCESS_FLAGS_REMOTEREAD_ONLY | I40IW_ACCESS_FLAGS_REMOTEWRITE_ONLY)) diff --git a/drivers/infiniband/hw/i40iw/i40iw_type.h b/drivers/infiniband/hw/i40iw/i40iw_type.h index c3babf3cbb8e..341aa6b1b6c1 100644 --- a/drivers/infiniband/hw/i40iw/i40iw_type.h +++ b/drivers/infiniband/hw/i40iw/i40iw_type.h @@ -786,6 +786,7 @@ struct i40iw_allocate_stag_info { bool use_hmc_fcn_index; u8 hmc_fcn_index; bool use_pf_rid; + bool all_memory; }; struct i40iw_reg_ns_stag_info { @@ -804,6 +805,7 @@ struct i40iw_reg_ns_stag_info { bool use_hmc_fcn_index; u8 hmc_fcn_index; bool use_pf_rid; + bool all_memory; }; struct i40iw_fast_reg_stag_info { diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c index 533f3caecb7a..89654dc91d81 100644 --- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c +++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c @@ -1494,7 +1494,8 @@ static int i40iw_handle_q_mem(struct i40iw_device *iwdev, static int i40iw_hw_alloc_stag(struct i40iw_device *iwdev, struct i40iw_mr *iwmr) { struct i40iw_allocate_stag_info *info; - struct i40iw_pd *iwpd = to_iwpd(iwmr->ibmr.pd); + struct ib_pd *pd = iwmr->ibmr.pd; + struct i40iw_pd *iwpd = to_iwpd(pd); enum i40iw_status_code status; int err = 0; struct i40iw_cqp_request *cqp_request; @@ -1511,6 +1512,7 @@ static int i40iw_hw_alloc_stag(struct i40iw_device *iwdev, struct i40iw_mr *iwmr info->stag_idx = iwmr->stag >> I40IW_CQPSQ_STAG_IDX_SHIFT; info->pd_id = iwpd->sc_pd.pd_id; info->total_len = iwmr->length; + info->all_memory = pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY; info->remote_access = true; cqp_info->cqp_cmd = OP_ALLOC_STAG; cqp_info->post_sq = 1; @@ -1563,6 +1565,8 @@ static struct ib_mr *i40iw_alloc_mr(struct ib_pd *pd, enum ib_mr_type mr_type, iwmr->type = IW_MEMREG_TYPE_MEM; palloc = &iwpbl->pble_alloc; iwmr->page_cnt = max_num_sg; + /* Use system PAGE_SIZE as the sg page sizes are unknown at this point */ + iwmr->length = max_num_sg * PAGE_SIZE; mutex_lock(&iwdev->pbl_mutex); status = i40iw_get_pble(&iwdev->sc_dev, iwdev->pble_rsrc, palloc, iwmr->page_cnt); mutex_unlock(&iwdev->pbl_mutex); @@ -1659,7 +1663,8 @@ static int i40iw_hwreg_mr(struct i40iw_device *iwdev, { struct i40iw_pbl *iwpbl = &iwmr->iwpbl; struct i40iw_reg_ns_stag_info *stag_info; - struct i40iw_pd *iwpd = to_iwpd(iwmr->ibmr.pd); + struct ib_pd *pd = iwmr->ibmr.pd; + struct i40iw_pd *iwpd = to_iwpd(pd); struct i40iw_pble_alloc *palloc = &iwpbl->pble_alloc; enum i40iw_status_code status; int err = 0; @@ -1679,6 +1684,7 @@ static int i40iw_hwreg_mr(struct i40iw_device *iwdev, stag_info->total_len = iwmr->length; stag_info->access_rights = access; stag_info->pd_id = iwpd->sc_pd.pd_id; + stag_info->all_memory = pd->flags & IB_PD_UNSAFE_GLOBAL_RKEY; stag_info->addr_type = I40IW_ADDR_TYPE_VA_BASED; stag_info->page_size = iwmr->page_size; -- 2.34.1

2 1

[PATCH OLK-5.10] cpu/hotplug: Prevent self deadlock on CPU hot-unplug
by Yu Liao 04 Sep '23

04 Sep '23

From: Thomas Gleixner <tglx(a)linutronix.de> mainline inclusion from mainline-v6.6-rc1 commit 2b8272ff4a70b866106ae13c36be7ecbef5d5da2 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7Y6AQ Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… -------------------------------- Xiongfeng reported and debugged a self deadlock of the task which initiates and controls a CPU hot-unplug operation vs. the CFS bandwidth timer. CPU1 CPU2 T1 sets cfs_quota starts hrtimer cfs_bandwidth 'period_timer' T1 is migrated to CPU2 T1 initiates offlining of CPU1 Hotplug operation starts ... 'period_timer' expires and is re-enqueued on CPU1 ... take_cpu_down() CPU1 shuts down and does not handle timers anymore. They have to be migrated in the post dead hotplug steps by the control task. T1 runs the post dead offline operation T1 is scheduled out T1 waits for 'period_timer' to expire T1 waits there forever if it is scheduled out before it can execute the hrtimer offline callback hrtimers_dead_cpu(). Cure this by delegating the hotplug control operation to a worker thread on an online CPU. This takes the initiating user space task, which might be affected by the bandwidth timer, completely out of the picture. Reported-by: Xiongfeng Wang <wangxiongfeng2(a)huawei.com> Signed-off-by: Thomas Gleixner <tglx(a)linutronix.de> Tested-by: Yu Liao <liaoyu15(a)huawei.com> Acked-by: Vincent Guittot <vincent.guittot(a)linaro.org> Cc: stable(a)vger.kernel.org Link: https://lore.kernel.org/lkml/8e785777-03aa-99e1-d20e-e956f5685be6@huawei.com Link: https://lore.kernel.org/r/87h6oqdq0i.ffs@tglx Conflict: kernel/cpu.c Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- kernel/cpu.c | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/kernel/cpu.c b/kernel/cpu.c index a70260b910d7..9eedba9acb9f 100644 --- a/kernel/cpu.c +++ b/kernel/cpu.c @@ -1112,11 +1112,33 @@ static int __ref _cpu_down(unsigned int cpu, int tasks_frozen, return ret; } +struct cpu_down_work { + unsigned int cpu; + enum cpuhp_state target; +}; + +static long __cpu_down_maps_locked(void *arg) +{ + struct cpu_down_work *work = arg; + + return _cpu_down(work->cpu, 0, work->target); +} + static int cpu_down_maps_locked(unsigned int cpu, enum cpuhp_state target) { + struct cpu_down_work work = { .cpu = cpu, .target = target, }; + if (cpu_hotplug_disabled) return -EBUSY; - return _cpu_down(cpu, 0, target); + + /* + * Ensure that the control task does not run on the to be offlined + * CPU to prevent a deadlock against cfs_b->period_timer. + */ + cpu = cpumask_any_but(cpu_online_mask, cpu); + if (cpu >= nr_cpu_ids) + return -EBUSY; + return work_on_cpu(cpu, __cpu_down_maps_locked, &work); } static int cpu_down(unsigned int cpu, enum cpuhp_state target) -- 2.25.1

2 3

[PATCH OLK-5.10] crypto:padata: Fix return err for PADATA_RESET
by Lu Jialin 03 Sep '23

03 Sep '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7RZMT CVE: NA -------------------------------- We found a hungtask bug in test_aead_vec_cfg as follows: [ 2297.136299] INFO: task cryptomgr_test:391009 blocked for more than 120 seconds. [ 2297.157611] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2297.168592] task:cryptomgr_test state:D stack: 0 pid:391009 ppid: 2 flags:0x00000208 [ 2297.168611] Call trace: [ 2297.193085] __switch_to+0x98/0xe0 [ 2297.199815] __schedule+0x6c4/0xf40 [ 2297.206674] schedule+0xd8/0x1b4 [ 2297.213223] schedule_timeout+0x474/0x560 [ 2297.220594] wait_for_common+0x368/0x4e0 [ 2297.227929] wait_for_completion+0x20/0x30 [ 2297.235480] test_aead_vec_cfg+0xab4/0xd50 [ 2297.243045] test_aead+0x144/0x1f0 [ 2297.249986] alg_test_aead+0xd8/0x1e0 [ 2297.257148] alg_test+0x634/0x890 [ 2297.264013] cryptomgr_test+0x40/0x70 [ 2297.271243] kthread+0x1e0/0x220 [ 2297.278070] ret_from_fork+0x10/0x18 [ 2297.285503] Kernel panic - not syncing: hung_task: blocked tasks For padata_do_parallel, when the return err is 0 or -EBUSY, it will call wait_for_completion(&wait->completion) in test_aead_vec_cfg. In normal case, aead_request_complete() will be called in pcrypt_aead_serial and the return err is 0 for padata_do_parallel. But, when pinst->flags is PADATA_RESET, the return err is -EBUSY for padata_do_parallel, and it won't call aead_request_complete(). Therefore, test_aead_vec_cfg will hung at wait_for_completion(&wait->completion), which will cause hungtask. The problem comes as following: (padata_do_parallel) | rcu_read_lock_bh(); | err = -EINVAL; | (padata_replace) | pinst->flags |= PADATA_RESET; err = -EBUSY | if (pinst->flags & PADATA_RESET) | rcu_read_unlock_bh() | return err | In order to resolve the problem, change the return err to -EAGAIN when pinst->flags is set PADATA_RESET. Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- crypto/pcrypt.c | 4 ++++ kernel/padata.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c index 9d10b846ccf7..005a36cb21bc 100644 --- a/crypto/pcrypt.c +++ b/crypto/pcrypt.c @@ -117,6 +117,8 @@ static int pcrypt_aead_encrypt(struct aead_request *req) err = padata_do_parallel(ictx->psenc, padata, &ctx->cb_cpu); if (!err) return -EINPROGRESS; + if (err == -EBUSY) + return -EAGAIN; return err; } @@ -164,6 +166,8 @@ static int pcrypt_aead_decrypt(struct aead_request *req) err = padata_do_parallel(ictx->psdec, padata, &ctx->cb_cpu); if (!err) return -EINPROGRESS; + if (err == -EBUSY) + return -EAGAIN; return err; } diff --git a/kernel/padata.c b/kernel/padata.c index 11ca3ebd8b12..ece4a2b77d32 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -207,7 +207,7 @@ int padata_do_parallel(struct padata_shell *ps, *cb_cpu = cpu; } - err = -EBUSY; + err = -EBUSY; if ((pinst->flags & PADATA_RESET)) goto out; -- 2.34.1

2 1

[PATCH openEuler-1.0-LTS] crypto:padata: Fix return err for PADATA_RESET
by Lu Jialin 03 Sep '23

03 Sep '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I7Y2IE CVE: NA -------------------------------- We found a hungtask bug in test_aead_vec_cfg as follows: [ 2297.136299] INFO: task cryptomgr_test:391009 blocked for more than 120 seconds. [ 2297.157611] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2297.168592] task:cryptomgr_test state:D stack: 0 pid:391009 ppid: 2 flags:0x00000208 [ 2297.168611] Call trace: [ 2297.193085] __switch_to+0x98/0xe0 [ 2297.199815] __schedule+0x6c4/0xf40 [ 2297.206674] schedule+0xd8/0x1b4 [ 2297.213223] schedule_timeout+0x474/0x560 [ 2297.220594] wait_for_common+0x368/0x4e0 [ 2297.227929] wait_for_completion+0x20/0x30 [ 2297.235480] test_aead_vec_cfg+0xab4/0xd50 [ 2297.243045] test_aead+0x144/0x1f0 [ 2297.249986] alg_test_aead+0xd8/0x1e0 [ 2297.257148] alg_test+0x634/0x890 [ 2297.264013] cryptomgr_test+0x40/0x70 [ 2297.271243] kthread+0x1e0/0x220 [ 2297.278070] ret_from_fork+0x10/0x18 [ 2297.285503] Kernel panic - not syncing: hung_task: blocked tasks For padata_do_parallel, when the return err is 0 or -EBUSY, it will call wait_for_completion(&wait->completion) in test_aead_vec_cfg. In normal case, aead_request_complete() will be called in pcrypt_aead_serial and the return err is 0 for padata_do_parallel. But, when pinst->flags is PADATA_RESET, the return err is -EBUSY for padata_do_parallel, and it won't call aead_request_complete(). Therefore, test_aead_vec_cfg will hung at wait_for_completion(&wait->completion), which will cause hungtask. The problem comes as following: (padata_do_parallel) | rcu_read_lock_bh(); | err = -EINVAL; | (padata_replace) | pinst->flags |= PADATA_RESET; err = -EBUSY | if (pinst->flags & PADATA_RESET) | rcu_read_unlock_bh() | return err | In order to resolve the problem, change the return err to -EAGAIN when pinst->flags is set PADATA_RESET. Signed-off-by: Lu Jialin <lujialin4(a)huawei.com> --- crypto/pcrypt.c | 4 ++++ kernel/padata.c | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c index 4bf4bb5b1a8b..ebe1f3639a22 100644 --- a/crypto/pcrypt.c +++ b/crypto/pcrypt.c @@ -175,6 +175,8 @@ static int pcrypt_aead_encrypt(struct aead_request *req) err = pcrypt_do_parallel(padata, &ctx->cb_cpu, &pencrypt); if (!err) return -EINPROGRESS; + if (err == -EBUSY) + return -EAGAIN; return err; } @@ -219,6 +221,8 @@ static int pcrypt_aead_decrypt(struct aead_request *req) err = pcrypt_do_parallel(padata, &ctx->cb_cpu, &pdecrypt); if (!err) return -EINPROGRESS; + if (err == -EBUSY) + return -EAGAIN; return err; } diff --git a/kernel/padata.c b/kernel/padata.c index 93e4fb2d9f2e..848e40e3581b 100644 --- a/kernel/padata.c +++ b/kernel/padata.c @@ -121,7 +121,7 @@ int padata_do_parallel(struct padata_instance *pinst, if (!cpumask_test_cpu(cb_cpu, pd->cpumask.cbcpu)) goto out; - err = -EBUSY; + err = -EBUSY; if ((pinst->flags & PADATA_RESET)) goto out; -- 2.34.1

2 1

[PATCH OLK-5.10 v2] block: don't get gendisk if queue has not been registered
by Li Lingfeng 02 Sep '23

02 Sep '23

hulk inclusion category: bugfix bugzilla: 189153, https://gitee.com/openeuler/kernel/issues/I7XVQD CVE: NA ---------------------------------------- Creating and using dm device at same time may trigger null-ptr-deref or deadlock. Some resources have not been initialized after calling add_disk in the process of creating dm device, which means users can get device and use some uninitialized resources. Using uninitialized resources may trigger null-ptr-deref directly. What's more, IO can't be finished by waiting specific resources to be initialized and the resources can't be initialized since IO is inflight, which triggers deadlock. Don't get gendisk if queue has not been registered to fix this. Signed-off-by: Li Lingfeng <lilingfeng3(a)huawei.com> --- v1->v2: change comment of QUEUE_FLAG_REGISTER_DONE block/blk-sysfs.c | 4 ++-- block/blk-throttle.c | 2 +- fs/block_dev.c | 6 ++++++ include/linux/blkdev.h | 2 +- 4 files changed, 10 insertions(+), 4 deletions(-) diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c index db7c0503bead..c95be9626a09 100644 --- a/block/blk-sysfs.c +++ b/block/blk-sysfs.c @@ -908,7 +908,7 @@ int blk_register_queue(struct gendisk *disk) wbt_enable_default(q); blk_throtl_register_queue(q); spin_lock_irq(&q->queue_lock); - blk_queue_flag_set(QUEUE_FLAG_THROTL_INIT_DONE, q); + blk_queue_flag_set(QUEUE_FLAG_REGISTER_DONE, q); spin_unlock_irq(&q->queue_lock); /* Now everything is ready and send out KOBJ_ADD uevent */ @@ -944,7 +944,7 @@ void blk_unregister_queue(struct gendisk *disk) return; spin_lock_irq(&q->queue_lock); - blk_queue_flag_clear(QUEUE_FLAG_THROTL_INIT_DONE, q); + blk_queue_flag_clear(QUEUE_FLAG_REGISTER_DONE, q); spin_unlock_irq(&q->queue_lock); /* diff --git a/block/blk-throttle.c b/block/blk-throttle.c index 2686634d2cc4..42ce18f991c4 100644 --- a/block/blk-throttle.c +++ b/block/blk-throttle.c @@ -1518,7 +1518,7 @@ static void tg_conf_updated(struct throtl_grp *tg, u64 *old_limits, bool global) static inline int throtl_check_init_done(struct request_queue *q) { - if (test_bit(QUEUE_FLAG_THROTL_INIT_DONE, &q->queue_flags)) + if (test_bit(QUEUE_FLAG_REGISTER_DONE, &q->queue_flags)) return 0; return blk_queue_dying(q) ? -ENODEV : -EBUSY; diff --git a/fs/block_dev.c b/fs/block_dev.c index 1c56cddcaa3d..a0e4d3ec300e 100644 --- a/fs/block_dev.c +++ b/fs/block_dev.c @@ -1136,6 +1136,12 @@ static struct gendisk *bdev_get_gendisk(struct block_device *bdev, int *partno) if (!disk) return NULL; + + if (!test_bit(QUEUE_FLAG_REGISTER_DONE, &disk->queue->queue_flags)) { + put_disk_and_module(disk); + return NULL; + } + /* * Now that we hold gendisk reference we make sure bdev we looked up is * not stale. If it is, it means device got removed and created before diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h index 9ede0a81e466..50b4fd0a0687 100644 --- a/include/linux/blkdev.h +++ b/include/linux/blkdev.h @@ -612,7 +612,7 @@ struct request_queue { /* Keep blk_queue_flag_name[] in sync with the definitions below */ #define QUEUE_FLAG_STOPPED 0 /* queue is stopped */ #define QUEUE_FLAG_DYING 1 /* queue being torn down */ -#define QUEUE_FLAG_THROTL_INIT_DONE 2 /* io throttle can be online */ +#define QUEUE_FLAG_REGISTER_DONE 2 /* blkdev can be opened */ #define QUEUE_FLAG_NOMERGES 3 /* disable merge attempts */ #define QUEUE_FLAG_SAME_COMP 4 /* complete on same CPU-group */ #define QUEUE_FLAG_FAIL_IO 5 /* fake timeout */ -- 2.31.1

2 1

[PATCH OLK-5.10 0/5] x86/speculation: Add force option to GDS mitigation
by Zeng Heng 02 Sep '23

02 Sep '23

Arnd Bergmann (1): x86: Move gds_ucode_mitigated() declaration to header Daniel Sneddon (3): x86/speculation: Add force option to GDS mitigation x86/speculation: Add Kconfig option for GDS KVM: Add GDS_NO support to KVM Dave Hansen (1): Documentation/x86: Fix backwards on/off logic about YMM support .../hw-vuln/gather_data_sampling.rst | 18 ++++++++--- .../admin-guide/kernel-parameters.txt | 8 ++++- arch/x86/Kconfig | 19 ++++++++++++ arch/x86/include/asm/processor.h | 2 ++ arch/x86/kernel/cpu/bugs.c | 31 ++++++++++++++++++- arch/x86/kvm/x86.c | 5 ++- 6 files changed, 76 insertions(+), 7 deletions(-) -- 2.25.1

2 6

[PATCH openEuler-1.0-LTS] sched/smt: fix unbalance sched_smt_present dec/inc
by Yu Liao 02 Sep '23

02 Sep '23

hulk inclusion category: bugfix bugzilla: 189013 CVE: NA -------------------------------- If cpuset_cpu_inactive() fails in sched_cpu_deactivate(), the cpu offline failed, but sched_smt_present is decreased before calling sched_cpu_deactivate, it leads unbalance dec/inc, so fix it by increasing sched_smt_present in the error path. Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Signed-off-by: Yu Liao <liaoyu15(a)huawei.com> --- kernel/sched/core.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/kernel/sched/core.c b/kernel/sched/core.c index 67bda877bfa8..7825ceaae0c4 100644 --- a/kernel/sched/core.c +++ b/kernel/sched/core.c @@ -5897,6 +5897,10 @@ int sched_cpu_deactivate(unsigned int cpu) ret = cpuset_cpu_inactive(cpu); if (ret) { +#ifdef CONFIG_SCHED_SMT + if (cpumask_weight(cpu_smt_mask(cpu)) == 2) + static_branch_inc_cpuslocked(&sched_smt_present); +#endif set_cpu_active(cpu, true); return ret; } -- 2.25.1

2 1