- Kernel - mailweb.openeuler.org

[PATCH v2] mm: oom: move memcg_print_bad_task() out of mem_cgroup_scan_tasks()
by Kang Chen 17 Apr '23

17 Apr '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6NYW4 CVE: NA -------------------------------- raw call flow: oom_kill_process -> mem_cgroup_scan_tasks(.., .., message) -> memcg_print_bad_task(message, ..) message is "const char*" type, and incorrectly cast to "oom_control*" type in memcg_print_bad_task. Fix it by moving memcg_print_bad_task out of mem_cgroup_scan_tasks and call it in select_bad_process and dump_tasks. Furthermore, remove the useless parm `ret`. Signed-off-by: Kang Chen <void0red(a)hust.edu.cn> --- v2 -> v1: remove parm `ret` and create a memcg_print_bad_task stub mm/memcontrol.c | 14 +++++++++----- mm/oom_kill.c | 14 ++++++++------ 2 files changed, 17 insertions(+), 11 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 635cb8b65b86..e87a96a6c712 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -1214,9 +1214,6 @@ int mem_cgroup_scan_tasks(struct mem_cgroup *memcg, break; } } -#ifdef CONFIG_MEMCG_QOS - memcg_print_bad_task(arg, ret); -#endif return ret; } @@ -4004,14 +4001,14 @@ bool memcg_low_priority_scan_tasks(int (*fn)(struct task_struct *, void *), return oc->chosen ? true : false; } -void memcg_print_bad_task(void *arg, int ret) +void memcg_print_bad_task(void *arg) { struct oom_control *oc = arg; if (!static_branch_likely(&memcg_qos_stat_key)) return; - if (!ret && oc->chosen) { + if (oc->chosen) { struct mem_cgroup *memcg; memcg = mem_cgroup_from_task(oc->chosen); @@ -4042,6 +4039,13 @@ int sysctl_memcg_qos_handler(struct ctl_table *table, int write, return ret; } + +#else + +void memcg_print_bad_task(void *arg) +{ +} + #endif #ifdef CONFIG_NUMA diff --git a/mm/oom_kill.c b/mm/oom_kill.c index 0f77eb4c6644..03df1a9093b5 100644 --- a/mm/oom_kill.c +++ b/mm/oom_kill.c @@ -408,9 +408,10 @@ static void select_bad_process(struct oom_control *oc) { oc->chosen_points = LONG_MIN; - if (is_memcg_oom(oc)) - mem_cgroup_scan_tasks(oc->memcg, oom_evaluate_task, oc); - else { + if (is_memcg_oom(oc)) { + if (mem_cgroup_scan_tasks(oc->memcg, oom_evaluate_task, oc)) + memcg_print_bad_task(oc); + } else { struct task_struct *p; #ifdef CONFIG_MEMCG_QOS @@ -473,9 +474,10 @@ static void dump_tasks(struct oom_control *oc) pr_info("Tasks state (memory values in pages):\n"); pr_info("[ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name\n"); - if (is_memcg_oom(oc)) - mem_cgroup_scan_tasks(oc->memcg, dump_task, oc); - else { + if (is_memcg_oom(oc)) { + if (mem_cgroup_scan_tasks(oc->memcg, dump_task, oc)) + memcg_print_bad_task(oc); + } else { struct task_struct *p; rcu_read_lock(); -- 2.34.1

1 0

[PATCH openEuler-1.0-LTS] Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
by Yongqiang Liu 17 Apr '23

17 Apr '23

From: Zheng Wang <zyytlz.wz(a)163.com> mainline inclusion from mainline-v6.3-rc7 commit 73f7b171b7c09139eb3c6a5677c200dc1be5f318 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6UW68 CVE: CVE-2023-1989 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- In btsdio_probe, the data->work is bound with btsdio_work. It will be started in btsdio_send_frame. If the btsdio_remove runs with a unfinished work, there may be a race condition that hdev is freed but used in btsdio_work. Fix it by canceling the work before do cleanup in btsdio_remove. Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/bluetooth/btsdio.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c index 20142bc77554..1325b1df4a8e 100644 --- a/drivers/bluetooth/btsdio.c +++ b/drivers/bluetooth/btsdio.c @@ -356,6 +356,7 @@ static void btsdio_remove(struct sdio_func *func) if (!data) return; + cancel_work_sync(&data->work); hdev = data->hdev; sdio_set_drvdata(func, NULL); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS] Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition
by Yongqiang Liu 17 Apr '23

17 Apr '23

From: Zheng Wang <zyytlz.wz(a)163.com> mainline inclusion from mainline-v6.3-rc7 commit 73f7b171b7c09139eb3c6a5677c200dc1be5f318 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6UW68 CVE: CVE-2023-1989 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?… --------------------------- In btsdio_probe, the data->work is bound with btsdio_work. It will be started in btsdio_send_frame. If the btsdio_remove runs with a unfinished work, there may be a race condition that hdev is freed but used in btsdio_work. Fix it by canceling the work before do cleanup in btsdio_remove. Signed-off-by: Zheng Wang <zyytlz.wz(a)163.com> Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz(a)intel.com> Signed-off-by: Liu Jian <liujian56(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Reviewed-by: Wang Weiyang <wangweiyang2(a)huawei.com> Signed-off-by: Yongqiang Liu <liuyongqiang13(a)huawei.com> --- drivers/bluetooth/btsdio.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c index 20142bc77554..1325b1df4a8e 100644 --- a/drivers/bluetooth/btsdio.c +++ b/drivers/bluetooth/btsdio.c @@ -356,6 +356,7 @@ static void btsdio_remove(struct sdio_func *func) if (!data) return; + cancel_work_sync(&data->work); hdev = data->hdev; sdio_set_drvdata(func, NULL); -- 2.25.1

1 0

[PATCH rdma-core v3 0/2] Add support for SVE Direct WQE
by Chengchang Tang 17 Apr '23

17 Apr '23

From: Juan Zhou <zhoujuan51(a)h-partners.com> Yixing Liu (2): Update kernel headers libhns: Add support for SVE Direct WQE CMakeLists.txt | 1 + buildlib/RDMA_EnableCStd.cmake | 17 +++++++++++++++++ kernel-headers/rdma/hns-abi.h | 1 + providers/hns/CMakeLists.txt | 5 +++++ providers/hns/hns_roce_u_hw_v2.c | 21 ++++++++++++++++++++- 5 files changed, 44 insertions(+), 1 deletion(-) -- 2.30.0

1 0

[PATCH v4] eulerfs: fix wrong dereferencing in eufs_lookup
by Kang Chen 17 Apr '23

17 Apr '23

uniontech inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I6TN56 CVE: NA -------------------------------- smatch report: fs/eulerfs/namei.c:118 eufs_lookup() error: 'inode' dereferencing possible ERR_PTR() fix it by using the ino above in eufs_err. Signed-off-by: Kang Chen <void0red(a)hust.edu.cn> --- I think we need use IS_ERR to handle all errors, the err can't pass to BUG_ON line later. v4 -> v3: fix some bugs and return EIO/ENOMEM anyway. v3 -> v2: use IS_ERR to handle all kind err v2 -> v1: use correct string format fs/eulerfs/namei.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/eulerfs/namei.c b/fs/eulerfs/namei.c index e4c6c36575f2..7064de644b34 100644 --- a/fs/eulerfs/namei.c +++ b/fs/eulerfs/namei.c @@ -114,9 +114,11 @@ static struct dentry *eufs_lookup(struct inode *dir, struct dentry *dentry, goto not_found; inode = eufs_iget(dir->i_sb, s2p(dir->i_sb, de->inode)); - if (inode == ERR_PTR(-ESTALE)) { - eufs_err(dir->i_sb, "deleted inode referenced: 0x%lx", - inode->i_ino); + if (IS_ERR(inode)) { + eufs_err(dir->i_sb, "eufs_iget failed ino 0x%llx err %d\n", + le64_to_cpu(de->inode), PTR_ERR(inode)); + if (inode == ERR_PTR(-ENOMEM)) + return ERR_PTR(-ENOMEM); return ERR_PTR(-EIO); } not_found: -- 2.34.1

3 2

[PATCH] mm: move memcg_print_bad_task out of mem_cgroup_scan_tasks to avoid wrong type cast
by Kang Chen 16 Apr '23

16 Apr '23

hulk inclusion category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I6NYW4 CVE: NA -------------------------------- raw call flow: oom_kill_process -> mem_cgroup_scan_tasks(.., .., message) -> memcg_print_bad_task(message, ..) message is "const char*" type, and incorrectly cast to "oom_control*" type in memcg_print_bad_task. Fix it by moving memcg_print_bad_task out of mem_cgroup_scan_tasks and call it in select_bad_process and dump_tasks. Signed-off-by: Kang Chen <void0red(a)hust.edu.cn> --- mm/memcontrol.c | 3 --- mm/oom_kill.c | 24 ++++++++++++++++++------ 2 files changed, 18 insertions(+), 9 deletions(-) diff --git a/mm/memcontrol.c b/mm/memcontrol.c index 635cb8b65b86..8e0d5d484153 100644 --- a/mm/memcontrol.c +++ b/mm/memcontrol.c @@ -1214,9 +1214,6 @@ int mem_cgroup_scan_tasks(struct mem_cgroup *memcg, break; } } -#ifdef CONFIG_MEMCG_QOS - memcg_print_bad_task(arg, ret); -#endif return ret; } diff --git a/mm/oom_kill.c b/mm/oom_kill.c index 0f77eb4c6644..1e3ba16dd748 100644 --- a/mm/oom_kill.c +++ b/mm/oom_kill.c @@ -406,11 +406,17 @@ static int oom_evaluate_task(struct task_struct *task, void *arg) */ static void select_bad_process(struct oom_control *oc) { + int ret; oc->chosen_points = LONG_MIN; - if (is_memcg_oom(oc)) - mem_cgroup_scan_tasks(oc->memcg, oom_evaluate_task, oc); - else { + if (is_memcg_oom(oc)) { + ret = mem_cgroup_scan_tasks(oc->memcg, oom_evaluate_task, oc); + +#ifdef CONFIG_MEMCG_QOS + memcg_print_bad_task(oc, ret); +#endif + + } else { struct task_struct *p; #ifdef CONFIG_MEMCG_QOS @@ -470,12 +476,18 @@ static int dump_task(struct task_struct *p, void *arg) */ static void dump_tasks(struct oom_control *oc) { + int ret; pr_info("Tasks state (memory values in pages):\n"); pr_info("[ pid ] uid tgid total_vm rss pgtables_bytes swapents oom_score_adj name\n"); - if (is_memcg_oom(oc)) - mem_cgroup_scan_tasks(oc->memcg, dump_task, oc); - else { + if (is_memcg_oom(oc)) { + ret = mem_cgroup_scan_tasks(oc->memcg, dump_task, oc); + +#ifdef CONFIG_MEMCG_QOS + memcg_print_bad_task(oc, ret); +#endif + + } else { struct task_struct *p; rcu_read_lock(); -- 2.34.1

1 0

[PATCH OLK-5.10 0/8] SAS-related bugfix
by Yihang Li 14 Apr '23

14 Apr '23

From: xiabing <xiabing12(a)h-partners.com> *** BLURB HERE *** Jie Zhan (3): scsi: libsas: Add smp_ata_check_ready_type() scsi: hisi_sas: Fix SATA devices missing issue during I_T nexus reset scsi: libsas: Do not export sas_ata_wait_after_reset() Martin K. Petersen (1): scsi: sd: Reorganize DIF/DIX code to avoid calling revalidate twice Xingui Yang (1): scsi: sd: Update DIX config every time sd_revalidate_disk() is called Yihang Li (3): scsi: hisi_sas: Set a port invalid only if there are no devices attached when refreshing port id scsi: hisi_sas: Exit suspending state when usage count is greater than 0 scsi: hisi_sas: Ensure all enabled PHYs up during controller reset drivers/scsi/hisi_sas/hisi_sas_main.c | 42 ++++++++++++--- drivers/scsi/hisi_sas/hisi_sas_v3_hw.c | 73 ++++++++++++++++++++------ drivers/scsi/libsas/sas_ata.c | 28 +++++++++- drivers/scsi/libsas/sas_expander.c | 4 +- drivers/scsi/libsas/sas_internal.h | 2 + drivers/scsi/sd.c | 59 +++++++++++---------- drivers/scsi/sd_dif.c | 12 ++--- include/scsi/sas_ata.h | 7 ++- 8 files changed, 161 insertions(+), 66 deletions(-) -- 2.30.0

1 8

快看，内核&编译器领域 SIG组来啦！诚邀您参加 openEuler Developer Day 2023
by openEuler 14 Apr '23

14 Apr '23

1 0

[PATCH openEuler-22.03-LTS-SP1 0/5] Backport 5.10.150 LTS
by Jialin Zhang 13 Apr '23

13 Apr '23

Backport 5.10.151 LTS patches from upstream. Makefile | 3 +++ scripts/link-vmlinux.sh | 2 +- scripts/pahole-flags.sh | 21 +++++++++++++++++++++ 3 files changed, 25 insertions(+), 1 deletion(-) create mode 100755 scripts/pahole-flags.sh -- 2.25.1

1 5

[PATCH openEuler-22.03-LTS-SP1 v2 000/370] Backport 5.10.150 LTS
by Jialin Zhang 13 Apr '23

13 Apr '23

1 370