- Kernel - mailweb.openeuler.org

[PATCH openEuler-1.0-LTS 1/2] bfq: Remove merged request already in bfq_requests_merged()
by Yang Yingliang 09 Dec '21

09 Dec '21

From: Jan Kara <jack(a)suse.cz> mainline inclusion from mainline-v5.14-rc1 commit a921c655f2033dd1ce1379128efe881dda23ea37 category: bugfix bugzilla: 185777, 185811 CVE: NA Currently, bfq does very little in bfq_requests_merged() and handles all the request cleanup in bfq_finish_requeue_request() called from blk_mq_free_request(). That is currently safe only because blk_mq_free_request() is called shortly after bfq_requests_merged() while bfqd->lock is still held. However to fix a lock inversion between bfqd->lock and ioc->lock, we need to call blk_mq_free_request() after dropping bfqd->lock. That would mean that already merged request could be seen by other processes inside bfq queues and possibly dispatched to the device which is wrong. So move cleanup of the request from bfq_finish_requeue_request() to bfq_requests_merged(). Acked-by: Paolo Valente <paolo.valente(a)linaro.org> Signed-off-by: Jan Kara <jack(a)suse.cz> Link: https://lore.kernel.org/r/20210623093634.27879-2-jack@suse.cz Signed-off-by: Jens Axboe <axboe(a)kernel.dk> conflict: in bfq_finish_requeue_request, 4.19 not have bfq_update_inject_limit branch; Signed-off-by: zhangwensheng <zhangwensheng5(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- block/bfq-iosched.c | 41 +++++++++++++---------------------------- 1 file changed, 13 insertions(+), 28 deletions(-) diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c index 7d77de9a0f5c0..5452d892480ba 100644 --- a/block/bfq-iosched.c +++ b/block/bfq-iosched.c @@ -1937,7 +1937,7 @@ static void bfq_requests_merged(struct request_queue *q, struct request *rq, *next_bfqq = bfq_init_rq(next); if (!bfqq) - return; + goto remove; /* * If next and rq belong to the same bfq_queue and next is older @@ -1960,6 +1960,14 @@ static void bfq_requests_merged(struct request_queue *q, struct request *rq, bfqq->next_rq = rq; bfqg_stats_update_io_merged(bfqq_group(bfqq), next->cmd_flags); +remove: + /* Merged request may be in the IO scheduler. Remove it. */ + if (!RB_EMPTY_NODE(&next->rb_node)) { + bfq_remove_request(next->q, next); + if (next_bfqq) + bfqg_stats_update_io_remove(bfqq_group(next_bfqq), + next->cmd_flags); + } } /* Must be called with bfqq != NULL */ @@ -4876,6 +4884,7 @@ static void bfq_finish_requeue_request(struct request *rq) { struct bfq_queue *bfqq = RQ_BFQQ(rq); struct bfq_data *bfqd; + unsigned long flags; /* * rq either is not associated with any icq, or is an already @@ -4893,36 +4902,12 @@ static void bfq_finish_requeue_request(struct request *rq) rq->io_start_time_ns, rq->cmd_flags); + spin_lock_irqsave(&bfqd->lock, flags); if (likely(rq->rq_flags & RQF_STARTED)) { - unsigned long flags; - - spin_lock_irqsave(&bfqd->lock, flags); - bfq_completed_request(bfqq, bfqd); - bfq_finish_requeue_request_body(bfqq); - - spin_unlock_irqrestore(&bfqd->lock, flags); - } else { - /* - * Request rq may be still/already in the scheduler, - * in which case we need to remove it (this should - * never happen in case of requeue). And we cannot - * defer such a check and removal, to avoid - * inconsistencies in the time interval from the end - * of this function to the start of the deferred work. - * This situation seems to occur only in process - * context, as a consequence of a merge. In the - * current version of the code, this implies that the - * lock is held. - */ - - if (!RB_EMPTY_NODE(&rq->rb_node)) { - bfq_remove_request(rq->q, rq); - bfqg_stats_update_io_remove(bfqq_group(bfqq), - rq->cmd_flags); - } - bfq_finish_requeue_request_body(bfqq); } + bfq_finish_requeue_request_body(bfqq); + spin_unlock_irqrestore(&bfqd->lock, flags); /* * Reset private fields. In case of a requeue, this allows -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] md: fix a warning caused by a race between concurrent md_ioctl()s
by Yang Yingliang 09 Dec '21

09 Dec '21

From: "Dae R. Jeong" <dae.r.jeong(a)kaist.ac.kr> mainline inclusion from mainline-v5.11-rc1 commit c731b84b51bf7fe83448bea8f56a6d55006b0615 category: bugfix bugzilla: 185833 CVE: NA ----------------------------------------------- Syzkaller reports a warning as belows. WARNING: CPU: 0 PID: 9647 at drivers/md/md.c:7169 ... Call Trace: ... RIP: 0010:md_ioctl+0x4017/0x5980 drivers/md/md.c:7169 RSP: 0018:ffff888096027950 EFLAGS: 00010293 RAX: ffff88809322c380 RBX: 0000000000000932 RCX: ffffffff84e266f2 RDX: 0000000000000000 RSI: ffffffff84e299f7 RDI: 0000000000000007 RBP: ffff888096027bc0 R08: ffff88809322c380 R09: ffffed101341a482 R10: ffff888096027940 R11: ffff88809a0d240f R12: 0000000000000932 R13: ffff8880a2c14100 R14: ffff88809a0d2268 R15: ffff88809a0d2408 __blkdev_driver_ioctl block/ioctl.c:304 [inline] blkdev_ioctl+0xece/0x1c10 block/ioctl.c:606 block_ioctl+0xee/0x130 fs/block_dev.c:1930 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:509 [inline] do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:696 ksys_ioctl+0xab/0xd0 fs/ioctl.c:713 __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl fs/ioctl.c:718 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:718 do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x49/0xbe This is caused by a race between two concurrenct md_ioctl()s closing the array. CPU1 (md_ioctl()) CPU2 (md_ioctl()) ------ ------ set_bit(MD_CLOSING, &mddev->flags); did_set_md_closing = true; WARN_ON_ONCE(test_bit(MD_CLOSING, &mddev->flags)); if(did_set_md_closing) clear_bit(MD_CLOSING, &mddev->flags); Fix the warning by returning immediately if the MD_CLOSING bit is set in &mddev->flags which indicates that the array is being closed. Fixes: 065e519e71b2 ("md: MD_CLOSING needs to be cleared after called md_set_readonly or do_md_stop") Reported-by: syzbot+1e46a0864c1a6e9bd3d8(a)syzkaller.appspotmail.com Cc: stable(a)vger.kernel.org Signed-off-by: Dae R. Jeong <dae.r.jeong(a)kaist.ac.kr> Signed-off-by: Song Liu <songliubraving(a)fb.com> Signed-off-by: Ye Bin <yebin10(a)huawei.com> Reviewed-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/md/md.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/md/md.c b/drivers/md/md.c index 8a2656cf7127d..409ec5ffd28d3 100644 --- a/drivers/md/md.c +++ b/drivers/md/md.c @@ -7306,8 +7306,11 @@ static int md_ioctl(struct block_device *bdev, fmode_t mode, err = -EBUSY; goto out; } - WARN_ON_ONCE(test_bit(MD_CLOSING, &mddev->flags)); - set_bit(MD_CLOSING, &mddev->flags); + if (test_and_set_bit(MD_CLOSING, &mddev->flags)) { + mutex_unlock(&mddev->open_mutex); + err = -EBUSY; + goto out; + } did_set_md_closing = true; mutex_unlock(&mddev->open_mutex); sync_blockdev(bdev); -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 1/2] net: hns3: fix race condition in debugfs
by Yang Yingliang 09 Dec '21

09 Dec '21

From: Yonglong Liu <liuyonglong(a)huawei.com> driver inclusion category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I4LD5U CVE: NA ---------------------------- When multiple users access debugfs at the same time, the process of alloc and release memory becomes disordered, causing the kernel crash like this: [763845.759089] PC is at kfree+0x19c/0x1a0 [763845.759100] LR is at kvfree+0x3c/0x58 [763845.759103] pc : [<ffff00000828878c>] lr : [<ffff00000823432c>] pstate: 60400009 [763845.759105] sp : ffff00003744fc90 [763845.759108] x29: ffff00003744fc90 x28: ffff8027dc87b800 [763845.759115] x27: ffff0000088a1000 x26: ffff000002970f48 [763845.759121] x25: ffff802502600000 x24: 00000000000000af [763845.759127] x23: 0000000000010000 x22: 0000000013dc0000 [763845.759133] x21: ffff00000823432c x20: ffff802502600000 [763845.759139] x19: ffff802502600000 x18: 0000ffffdaa06b10 [763845.759145] x17: 00000000004201c8 x16: ffff0000082b2b10 [763845.759151] x15: 000000000003013f x14: 0000ffffa462ffe0 [763845.759157] x13: ffffffffffffffff x12: 0433526ae61f3300 [763845.759163] x11: ffff000009694b30 x10: 0000000000000001 [763845.759169] x9 : 000000000007b224 x8 : ffff000009719edc [763845.759175] x7 : ffff7fe009409800 x6 : 00000045757af8cf [763845.759181] x5 : ffff8027fced69f0 x4 : 0000000000000000 [763845.759187] x3 : 0000000000000000 x2 : 0433526ae61f3300 [763845.759192] x1 : 0000000000000000 x0 : dead000000000100 [763845.759200] Process cat (pid: 57988, stack limit = 0xffff000037440000) [763845.759203] Call trace: [763845.759207] Exception stack(0xffff00003744fb50 to 0xffff00003744fc90) [763845.759211] fb40: dead000000000100 0000000000000000 [768745.759215] fb60: 0433526ae61f3300 0000000000000000 0000000000000000 ffff8027fced69f0 [763845.759219] fb80: 00000045757af8cf ffff7fe009409800 ffff000009719edc 000000000007b224 [763845.759222] fba0: 0000000000000001 ffff000009694b30 0433526ae61f3300 ffffffffffffffff [763845.759226] fbc0: 0000ffffa462ffe0 000000000003013f ffff0000082b2b10 00000000004201c8 [763845.759231] fbe0: 0000ffffdaa06b10 ffff802502600000 ffff802502600000 ffff00000823432c [763845.759235] fc00: 0000000013dc0000 0000000000010000 00000000000000af ffff802502600000 [763845.759238] fc20: ffff000002970f48 ffff0000088a1000 ffff8027dc87b800 ffff00003744fc90 [763845.759243] fc40: ffff00000823432c ffff00003744fc90 ffff00000828878c 0000000060400009 [763845.759247] fc60: ffff00003744feb0 0000000013dc0000 0000ffffffffffff 0000000000000023 [763845.759250] fc80: ffff00003744fc90 ffff00000828878c [763845.759259] [<ffff00000828878c>] kfree+0x19c/0x1a0 [763845.759263] [<ffff00000823432c>] kvfree+0x3c/0x58 [763845.759306] [<ffff00000295ab94>] hns3_dbg_read+0x94/0x240 [hns3] [763845.759318] [<ffff000008359550>] full_proxy_read+0x60/0x90 [763845.759324] [<ffff0000082b22a4>] __vfs_read+0x58/0x178 [763845.759327] [<ffff0000082b2454>] vfs_read+0x90/0x14c [763845.759332] [<ffff0000082b2b70>] SyS_read+0x60/0xc0 This patch adds a mutex lock to fix the race condition, and need to call hns3_dbg_read_cmd() function when buffer is NULL to avoid reading empty data. Fixes: c91910efc03a ("net: hns3: refactor the debugfs process") Signed-off-by: Yonglong Liu <liuyonglong(a)huawei.com> Reviewed-by: li yongxin <liyongxin1(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- drivers/net/ethernet/hisilicon/hns3/hnae3.h | 1 + .../ethernet/hisilicon/hns3/hns3_debugfs.c | 19 +++++++++++++------ 2 files changed, 14 insertions(+), 6 deletions(-) diff --git a/drivers/net/ethernet/hisilicon/hns3/hnae3.h b/drivers/net/ethernet/hisilicon/hns3/hnae3.h index c9ac1e7cf4492..048de5b367c19 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hnae3.h +++ b/drivers/net/ethernet/hisilicon/hns3/hnae3.h @@ -764,6 +764,7 @@ struct hnae3_handle { u8 netdev_flags; struct dentry *hnae3_dbgfs; + struct mutex dbgfs_lock; /* Network interface message level enabled bits */ u32 msg_enable; diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c index 7f3b7084e382f..c68e5f3d0ba52 100644 --- a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c @@ -807,6 +807,7 @@ static ssize_t hns3_dbg_read(struct file *filp, char __user *buffer, if (ret) return ret; + mutex_lock(&handle->dbgfs_lock); save_buf = &hns3_dbg_cmd[index].buf; if (!test_bit(HNS3_NIC_STATE_INITED, &priv->state) || @@ -819,15 +820,15 @@ static ssize_t hns3_dbg_read(struct file *filp, char __user *buffer, read_buf = *save_buf; } else { read_buf = kvzalloc(hns3_dbg_cmd[index].buf_len, GFP_KERNEL); - if (!read_buf) - return -ENOMEM; + if (!read_buf) { + ret = -ENOMEM; + goto out; + } /* save the buffer addr until the last read operation */ *save_buf = read_buf; - } - /* get data ready for the first time to read */ - if (!*ppos) { + /* get data ready for the first time to read */ ret = hns3_dbg_read_cmd(dbg_data, hns3_dbg_cmd[index].cmd, read_buf, hns3_dbg_cmd[index].buf_len); if (ret) @@ -836,8 +837,10 @@ static ssize_t hns3_dbg_read(struct file *filp, char __user *buffer, size = simple_read_from_buffer(buffer, count, ppos, read_buf, strlen(read_buf)); - if (size > 0) + if (size > 0) { + mutex_unlock(&handle->dbgfs_lock); return size; + } out: /* free the buffer for the last read operation */ @@ -846,6 +849,7 @@ static ssize_t hns3_dbg_read(struct file *filp, char __user *buffer, *save_buf = NULL; } + mutex_unlock(&handle->dbgfs_lock); return ret; } @@ -916,6 +920,7 @@ int hns3_dbg_init(struct hnae3_handle *handle) debugfs_create_dir(hns3_dbg_dentry[i].name, handle->hnae3_dbgfs); + mutex_init(&handle->dbgfs_lock); for (i = 0; i < ARRAY_SIZE(hns3_dbg_cmd); i++) { if (!hns3_dbg_cmd[i].init) { dev_err(&handle->pdev->dev, @@ -936,6 +941,7 @@ int hns3_dbg_init(struct hnae3_handle *handle) return 0; out: + mutex_destroy(&handle->dbgfs_lock); debugfs_remove_recursive(handle->hnae3_dbgfs); handle->hnae3_dbgfs = NULL; return ret; @@ -951,6 +957,7 @@ void hns3_dbg_uninit(struct hnae3_handle *handle) hns3_dbg_cmd[i].buf = NULL; } + mutex_destroy(&handle->dbgfs_lock); debugfs_remove_recursive(handle->hnae3_dbgfs); handle->hnae3_dbgfs = NULL; } -- 2.25.1

1 1

[PATCH openEuler-1.0-LTS] kabi: fix kabi broken in struct sock
by Yang Yingliang 09 Dec '21

09 Dec '21

hulk inclusion category: bugfix bugzilla: NA CVE: NA --------------------------- If config DEBUG_SPINLOCK or DEBUG_LOCK_ALLOC is enabled, don't need fix the kabi broken. It's introduced by 93c5c1d15abcd ("af_unix: fix races in sk_peer_pid and sk_peer_cred accesses"). Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> Reviewed-by: Cheng Jian <cj.chengjian(a)huawei.com> Reviewed-by: Yue Haibing <yuehaibing(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- include/net/sock.h | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/include/net/sock.h b/include/net/sock.h index b90b92882b3b8..803464e66e02c 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -472,7 +472,9 @@ struct sock { u32 sk_ack_backlog; u32 sk_max_ack_backlog; kuid_t sk_uid; +#if defined(CONFIG_DEBUG_SPINLOCK) || defined(CONFIG_DEBUG_LOCK_ALLOC) spinlock_t sk_peer_lock; +#endif struct pid *sk_peer_pid; const struct cred *sk_peer_cred; @@ -513,7 +515,18 @@ struct sock { struct sock_reuseport __rcu *sk_reuseport_cb; struct rcu_head sk_rcu; +#if !defined(CONFIG_DEBUG_SPINLOCK) && !defined(CONFIG_DEBUG_LOCK_ALLOC) +#ifndef __GENKSYMS__ + union { + spinlock_t sk_peer_lock; + unsigned long kabi_reserve1; + }; +#else KABI_RESERVE(1) +#endif +#else + KABI_RESERVE(1) +#endif KABI_RESERVE(2) KABI_RESERVE(3) KABI_RESERVE(4) -- 2.25.1

1 0

[PATCH openEuler-1.0-LTS 01/31] cifs: fix incorrect check for null pointer in header_assemble
by Yang Yingliang 08 Dec '21

08 Dec '21

From: Steve French <stfrench(a)microsoft.com> stable inclusion from linux-4.19.209 commit 43d2e0fbc67f8bcfb069130f4028a04887ae76b6 -------------------------------- commit 9ed38fd4a15417cac83967360cf20b853bfab9b6 upstream. Although very unlikely that the tlink pointer would be null in this case, get_next_mid function can in theory return null (but not an error) so need to check for null (not for IS_ERR, which can not be returned here). Address warning: fs/smbfs_client/connect.c:2392 cifs_match_super() warn: 'tlink' isn't an ERR_PTR Pointed out by Dan Carpenter via smatch code analysis tool CC: stable(a)vger.kernel.org Reported-by: Dan Carpenter <dan.carpenter(a)oracle.com> Acked-by: Ronnie Sahlberg <lsahlber(a)redhat.com> Signed-off-by: Steve French <stfrench(a)microsoft.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Acked-by: Jason Yan <yanaijie(a)huawei.com> Signed-off-by: Yang Yingliang <yangyingliang(a)huawei.com> --- fs/cifs/connect.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c index 907be252c5d47..36104dd8eb4dd 100644 --- a/fs/cifs/connect.c +++ b/fs/cifs/connect.c @@ -3373,9 +3373,10 @@ cifs_match_super(struct super_block *sb, void *data) spin_lock(&cifs_tcp_ses_lock); cifs_sb = CIFS_SB(sb); tlink = cifs_get_tlink(cifs_sb_master_tlink(cifs_sb)); - if (IS_ERR(tlink)) { + if (tlink == NULL) { + /* can not match superblock if tlink were ever null */ spin_unlock(&cifs_tcp_ses_lock); - return rc; + return 0; } tcon = tlink_tcon(tlink); ses = tcon->ses; -- 2.25.1

1 30

[PATCH OLK-5.10 107/107] fs/ntfs3: Add ntfs3 module in openeuler_defconfig
by Yin Xiujiang 08 Dec '21

08 Dec '21

kylin inclusion category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ------------------------------------------------- This adds ntfs3 module in openeuler_defconfig Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- arch/arm64/configs/openeuler_defconfig | 4 ++++ arch/x86/configs/openeuler_defconfig | 4 ++++ 2 files changed, 8 insertions(+) diff --git a/arch/arm64/configs/openeuler_defconfig b/arch/arm64/configs/openeuler_defconfig index 76d6a118330d..b1e8524eb5e6 100644 --- a/arch/arm64/configs/openeuler_defconfig +++ b/arch/arm64/configs/openeuler_defconfig @@ -6163,6 +6163,10 @@ CONFIG_EXFAT_DEFAULT_IOCHARSET="utf8" CONFIG_NTFS_FS=m # CONFIG_NTFS_DEBUG is not set # CONFIG_NTFS_RW is not set +CONFIG_NTFS3_FS=m +CONFIG_NTFS3_64BIT_CLUSTER=y +CONFIG_NTFS3_LZX_XPRESS=y +CONFIG_NTFS3_FS_POSIX_ACL=y # end of DOS/FAT/EXFAT/NT Filesystems # diff --git a/arch/x86/configs/openeuler_defconfig b/arch/x86/configs/openeuler_defconfig index b25d908dc7a1..83e143d139fa 100644 --- a/arch/x86/configs/openeuler_defconfig +++ b/arch/x86/configs/openeuler_defconfig @@ -7515,6 +7515,10 @@ CONFIG_EXFAT_DEFAULT_IOCHARSET="utf8" CONFIG_NTFS_FS=m # CONFIG_NTFS_DEBUG is not set # CONFIG_NTFS_RW is not set +CONFIG_NTFS3_FS=m +CONFIG_NTFS3_64BIT_CLUSTER=y +CONFIG_NTFS3_LZX_XPRESS=y +CONFIG_NTFS3_FS_POSIX_ACL=y # end of DOS/FAT/EXFAT/NT Filesystems # -- 2.30.0

1 0

[PATCH OLK-5.10 081/107] fs/ntfs3: Remove a useless shadowing variable
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> mainline inclusion from mainline-v5.15 commit 808bc0a82bcd2cbe32a139613325b1a3e03f35f1 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- There is already a 'u8 mask' defined at the top of the function. There is no need to define a new one here. Remove the useless and shadowing new 'mask' variable. Signed-off-by: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Reviewed-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/bitfunc.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/fs/ntfs3/bitfunc.c b/fs/ntfs3/bitfunc.c index bf10e2da5c6e..50d838093790 100644 --- a/fs/ntfs3/bitfunc.c +++ b/fs/ntfs3/bitfunc.c @@ -119,8 +119,7 @@ bool are_bits_set(const ulong *lmap, size_t bit, size_t nbits) pos = nbits & 7; if (pos) { - u8 mask = fill_mask[pos]; - + mask = fill_mask[pos]; if ((*map & mask) != mask) return false; } -- 2.30.0

1 0

[PATCH OLK-5.10 080/107] fs/ntfs3: Remove a useless test in 'indx_find()'
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> mainline inclusion from mainline-v5.15 commit d2846bf33c1423ff872c7a7c2afde292ad502c04 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- 'fnd' has been dereferenced several time before, so testing it here is pointless. Moreover, all callers of 'indx_find()' already have some error handling code that makes sure that no NULL 'fnd' is passed. So, remove the useless test. Signed-off-by: Christophe JAILLET <christophe.jaillet(a)wanadoo.fr> Reviewed-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/index.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/fs/ntfs3/index.c b/fs/ntfs3/index.c index 4f71a91f07d9..6f81e3a49abf 100644 --- a/fs/ntfs3/index.c +++ b/fs/ntfs3/index.c @@ -1072,9 +1072,7 @@ int indx_find(struct ntfs_index *indx, struct ntfs_inode *ni, if (!e) return -EINVAL; - if (fnd) - fnd->root_de = e; - + fnd->root_de = e; err = 0; for (;;) { -- 2.30.0

1 0

[PATCH OLK-5.10 078/107] fs/ntfs3: Change max hardlinks limit to 4000
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> mainline inclusion from mainline-v5.15 commit 56eaeb10e2619081cc383febf6740a4c3e806777 category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- xfstest generic/041 works with 3003 hardlinks. Because of this we raise hardlinks limit to 4000. There are no drawbacks or regressions. Theoretically we can raise all the way up to ffff, but there is no practical use for this. Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/ntfs.h | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/fs/ntfs3/ntfs.h b/fs/ntfs3/ntfs.h index 303a162c3158..9cc396b117bf 100644 --- a/fs/ntfs3/ntfs.h +++ b/fs/ntfs3/ntfs.h @@ -26,9 +26,11 @@ #define NTFS_NAME_LEN 255 -/* ntfs.sys used 500 maximum links on-disk struct allows up to 0xffff. */ -#define NTFS_LINK_MAX 0x400 -//#define NTFS_LINK_MAX 0xffff +/* + * ntfs.sys used 500 maximum links on-disk struct allows up to 0xffff. + * xfstest generic/041 creates 3003 hardlinks. + */ +#define NTFS_LINK_MAX 4000 /* * Activate to use 64 bit clusters instead of 32 bits in ntfs.sys. -- 2.30.0

1 0

[PATCH OLK-5.10 076/107] fs/ntfs3: Fix a memory leak on object opts
by Yin Xiujiang 08 Dec '21

08 Dec '21

From: Colin Ian King <colin.king(a)canonical.com> mainline inclusion from mainline-v5.15 commit 880301bb313295a65523e79bc5666f5cf49eb3ed category: feature bugzilla: https://gitee.com/openeuler/kernel/issues/I4G67J?from=project-issue CVE: NA ---------------------------------------------------------------------- Currently a failed allocation on sbi->upcase will cause an exit via the label free_sbi causing a memory leak on object opts. Fix this by re-ordering the exit paths free_opts and free_sbi so that kfree's occur in the reverse allocation order. Addresses-Coverity: ("Resource leak") Fixes: 27fac77707a1 ("fs/ntfs3: Init spi more in init_fs_context than fill_super") Signed-off-by: Colin Ian King <colin.king(a)canonical.com> Reviewed-by: Kari Argillander <kari.argillander(a)gmail.com> Signed-off-by: Konstantin Komarov <almaz.alexandrovich(a)paragon-software.com> Signed-off-by: Yin Xiujiang <yinxiujiang(a)kylinos.cn> --- fs/ntfs3/super.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/ntfs3/super.c b/fs/ntfs3/super.c index cefb9ddaf4db..6a535b144ff9 100644 --- a/fs/ntfs3/super.c +++ b/fs/ntfs3/super.c @@ -1393,10 +1393,10 @@ static int ntfs_init_fs_context(struct fs_context *fc) fc->ops = &ntfs_context_ops; return 0; -free_opts: - kfree(opts); free_sbi: kfree(sbi); +free_opts: + kfree(opts); return -ENOMEM; } -- 2.30.0

1 0