- Kernel - mailweb.openeuler.org

[PATCH OLK-5.10 v3 0/2] block: support to dispatch bio asynchronously
by Li Nan 14 Jun '24

14 Jun '24

v3: code optimization. Li Nan (2): block: support to dispatch bio asynchronously block: fix kabi broken in struct request_queue about CONFIG_BLK_BIO_DISPATCH_ASYNC block/blk.h | 7 + include/linux/blk_types.h | 1 + include/linux/blkdev.h | 9 + block/blk-core.c | 240 ++++++++++++++++++++++++- block/blk-mq-debugfs.c | 1 + block/blk-sysfs.c | 59 ++++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + block/Kconfig | 11 ++ 9 files changed, 329 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS v3 0/2] block: support to dispatch bio asynchronously
by Li Nan 14 Jun '24

14 Jun '24

v3: code optimization. Li Nan (2): block: support to dispatch bio asynchronously block: fix kabi broken in struct request_queue about CONFIG_BLK_BIO_DISPATCH_ASYNC block/blk.h | 7 + include/linux/blk_types.h | 1 + include/linux/blkdev.h | 9 + block/blk-core.c | 240 ++++++++++++++++++++++++- block/blk-mq-debugfs.c | 1 + block/blk-sysfs.c | 59 ++++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + block/Kconfig | 11 ++ 9 files changed, 329 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[PATCH OLK-5.10 v2 0/2] block: support to dispatch bio asynchronously
by Li Nan 14 Jun '24

14 Jun '24

v2: bugfix and code optimization. Li Nan (2): block: support to dispatch bio asynchronously block: fix kabi broken in struct request_queue about CONFIG_BLK_BIO_DISPATCH_ASYNC block/blk.h | 7 + include/linux/blk_types.h | 1 + include/linux/blkdev.h | 9 + block/blk-core.c | 238 ++++++++++++++++++++++++- block/blk-mq-debugfs.c | 1 + block/blk-sysfs.c | 60 +++++++ arch/arm64/configs/openeuler_defconfig | 1 + arch/x86/configs/openeuler_defconfig | 1 + block/Kconfig | 11 ++ 9 files changed, 328 insertions(+), 1 deletion(-) -- 2.39.2

2 3

[PATCH openEuler-1.0-LTS] iio: mma8452: Fix trigger reference couting
by Zhang Changzhong 14 Jun '24

14 Jun '24

From: Lars-Peter Clausen <lars(a)metafoo.de> stable inclusion from stable-v4.19.221 commit f5deab10ced368c807866283f8b79144c4823be8 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9S271 CVE: CVE-2021-47500 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- commit cd0082235783f814241a1c9483fb89e405f4f892 upstream. The mma8452 driver directly assigns a trigger to the struct iio_dev. The IIO core when done using this trigger will call `iio_trigger_put()` to drop the reference count by 1. Without the matching `iio_trigger_get()` in the driver the reference count can reach 0 too early, the trigger gets freed while still in use and a use-after-free occurs. Fix this by getting a reference to the trigger before assigning it to the IIO device. Fixes: ae6d9ce05691 ("iio: mma8452: Add support for interrupt driven triggers.") Signed-off-by: Lars-Peter Clausen <lars(a)metafoo.de> Link: https://lore.kernel.org/r/20211024092700.6844-1-lars@metafoo.de Cc: <Stable(a)vger.kernel.org> Signed-off-by: Jonathan Cameron <Jonathan.Cameron(a)huawei.com> Signed-off-by: Greg Kroah-Hartman <gregkh(a)linuxfoundation.org> Signed-off-by: Zhang Changzhong <zhangchangzhong(a)huawei.com> --- drivers/iio/accel/mma8452.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/iio/accel/mma8452.c b/drivers/iio/accel/mma8452.c index 421a0a8..db815ba 100644 --- a/drivers/iio/accel/mma8452.c +++ b/drivers/iio/accel/mma8452.c @@ -1465,7 +1465,7 @@ static int mma8452_trigger_setup(struct iio_dev *indio_dev) if (ret) return ret; - indio_dev->trig = trig; + indio_dev->trig = iio_trigger_get(trig); return 0; } -- 2.9.5

2 1

[PATCH OLK-5.10 v3 00/26] xfs: atomic writes for xfs
by Long Li 13 Jun '24

13 Jun '24

THis patch set support xfs atomic writes feature. Alan Adamson (1): nvme: Atomic write support Darrick J. Wong (3): fs: xfs: Introduce FORCEALIGN inode flag fs: xfs: Enable file data forcealign feature fs: xfs: Make file data allocations observe the 'forcealign' flag John Garry (11): block: Add core atomic write support fs: xfs: Do not free EOF blocks for forcealign fs: iomap: Sub-extent zeroing fs: xfs: iomap: Sub-extent zeroing fs: Add FS_XFLAG_ATOMICWRITES flag fs: iomap: Atomic write support fs: xfs: Support FS_XFLAG_ATOMICWRITES for forcealign fs: xfs: Validate atomic writes fs: xfs: Support setting FMODE_CAN_ATOMIC_WRITE xfs: Update xfs_is_falloc_aligned() mask for forcealign xfs: Only free full extents for forcealign Long Li (6): block: get atomic write max sectors xfs: support atomic write ioctl xfs: atomic write file dio convert to mark IOCB_ATOMIC xfs: fix set xflags fail when inode has extent hit xfs: make bunmapi observe forcealigin block: fix kabi in struct queue_limits Prasad Singamsetty (1): fs: Initial atomic write support Zhang Yi (4): math64: add rem_u64() to just return the remainder iomap: pass blocksize to iomap_truncate_page() xfs: refactor the truncating order xfs: correct the truncate blocksize of realtime inode Documentation/ABI/testing/sysfs-block | 52 ++++++++++++ block/blk-core.c | 39 ++++++++- block/blk-merge.c | 95 ++++++++++++++++++++- block/blk-settings.c | 55 ++++++++++++ block/blk-sysfs.c | 34 ++++++++ block/blk.h | 1 + drivers/md/dm-table.c | 1 + drivers/nvme/host/core.c | 56 ++++++++++++ fs/aio.c | 8 +- fs/iomap/buffered-io.c | 8 +- fs/iomap/direct-io.c | 33 +++++-- fs/read_write.c | 2 +- fs/xfs/libxfs/xfs_bmap.c | 22 ++++- fs/xfs/libxfs/xfs_format.h | 15 +++- fs/xfs/libxfs/xfs_inode_buf.c | 40 +++++++++ fs/xfs/libxfs/xfs_inode_buf.h | 3 + fs/xfs/libxfs/xfs_sb.c | 4 + fs/xfs/xfs_bmap_util.c | 10 ++- fs/xfs/xfs_file.c | 41 ++++++++- fs/xfs/xfs_inode.c | 43 ++++++++++ fs/xfs/xfs_inode.h | 12 +++ fs/xfs/xfs_ioctl.c | 96 ++++++++++++++++++++- fs/xfs/xfs_iomap.c | 19 ++++- fs/xfs/xfs_iops.c | 118 +++++++++++++------------- fs/xfs/xfs_mount.h | 5 ++ fs/xfs/xfs_super.c | 9 ++ include/linux/blk_types.h | 7 ++ include/linux/blkdev.h | 76 ++++++++++++++++- include/linux/fs.h | 30 ++++++- include/linux/iomap.h | 5 +- include/linux/math64.h | 24 ++++++ include/uapi/linux/fs.h | 9 +- io_uring/io_uring.c | 2 +- 33 files changed, 877 insertions(+), 97 deletions(-) -- 2.31.1

2 27

[PATCH openEuler-1.0-LTS] watchdog: Fix possible use-after-free by calling del_timer_sync()
by Jialin Zhang 13 Jun '24

13 Jun '24

From: Zou Wei <zou_wei(a)huawei.com> stable inclusion from stable-v4.19.198 commit ecd620e0fb1ff7f78fdb593379b2e6938c99707a category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RL1P CVE: CVE-2021-47321 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit d0212f095ab56672f6f36aabc605bda205e1e0bf ] This driver's remove path calls del_timer(). However, that function does not wait until the timer handler finishes. This means that the timer handler may still be running after the driver's remove function has finished, which would result in a use-after-free. Fix by calling del_timer_sync(), which makes sure the timer handler has finished, and unable to re-schedule itself. Reported-by: Hulk Robot <hulkci(a)huawei.com> Signed-off-by: Zou Wei <zou_wei(a)huawei.com> Reviewed-by: Guenter Roeck <linux(a)roeck-us.net> Acked-by: Vladimir Zapolskiy <vz(a)mleia.com> Link: https://lore.kernel.org/r/1620802676-19701-1-git-send-email-zou_wei@huawei.… Signed-off-by: Guenter Roeck <linux(a)roeck-us.net> Signed-off-by: Wim Van Sebroeck <wim(a)linux-watchdog.org> Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/watchdog/lpc18xx_wdt.c | 2 +- drivers/watchdog/w83877f_wdt.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/watchdog/lpc18xx_wdt.c b/drivers/watchdog/lpc18xx_wdt.c index 331cadb459ac..48580b6406c2 100644 --- a/drivers/watchdog/lpc18xx_wdt.c +++ b/drivers/watchdog/lpc18xx_wdt.c @@ -301,7 +301,7 @@ static int lpc18xx_wdt_remove(struct platform_device *pdev) struct lpc18xx_wdt_dev *lpc18xx_wdt = platform_get_drvdata(pdev); dev_warn(&pdev->dev, "I quit now, hardware will probably reboot!\n"); - del_timer(&lpc18xx_wdt->timer); + del_timer_sync(&lpc18xx_wdt->timer); watchdog_unregister_device(&lpc18xx_wdt->wdt_dev); clk_disable_unprepare(lpc18xx_wdt->wdt_clk); diff --git a/drivers/watchdog/w83877f_wdt.c b/drivers/watchdog/w83877f_wdt.c index 05658ecc0aa4..ec4641fc2d21 100644 --- a/drivers/watchdog/w83877f_wdt.c +++ b/drivers/watchdog/w83877f_wdt.c @@ -170,7 +170,7 @@ static void wdt_startup(void) static void wdt_turnoff(void) { /* Stop the timer */ - del_timer(&timer); + del_timer_sync(&timer); wdt_change(WDT_DISABLE); -- 2.25.1

2 1

[PATCH openEuler-1.0-LTS 0/1] CVE-2021-47261
by Yongqiang Liu 13 Jun '24

13 Jun '24

Alaa Hleihel (1): IB/mlx5: Fix initializing CQ fragments buffer drivers/infiniband/hw/mlx5/cq.c | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-36020
by Yongqiang Liu 13 Jun '24

13 Jun '24

Aleksandr Loktionov (1): i40e: fix vf may be used uninitialized in this function warning .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 34 +++++++++---------- 1 file changed, 16 insertions(+), 18 deletions(-) -- 2.34.1

2 2

[PATCH openEuler-22.03-LTS-SP1] drm/panel: fix a possible null pointer dereference
by Jialin Zhang 13 Jun '24

13 Jun '24

From: Ma Ke <make_ruc2021(a)163.com> stable inclusion from stable-v5.10.202 commit c7dc0aca5962fb37dbea9769dd26ec37813faae1 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9RFEM CVE: CVE-2023-52821 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id… -------------------------------- [ Upstream commit 924e5814d1f84e6fa5cb19c6eceb69f066225229 ] In versatile_panel_get_modes(), the return value of drm_mode_duplicate() is assigned to mode, which will lead to a NULL pointer dereference on failure of drm_mode_duplicate(). Add a check to avoid npd. Signed-off-by: Ma Ke <make_ruc2021(a)163.com> Reviewed-by: Neil Armstrong <neil.armstrong(a)linaro.org> Link: https://lore.kernel.org/r/20231007033105.3997998-1-make_ruc2021@163.com Signed-off-by: Neil Armstrong <neil.armstrong(a)linaro.org> Link: https://patchwork.freedesktop.org/patch/msgid/20231007033105.3997998-1-make… Signed-off-by: Sasha Levin <sashal(a)kernel.org> Signed-off-by: Jialin Zhang <zhangjialin11(a)huawei.com> --- drivers/gpu/drm/panel/panel-arm-versatile.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/gpu/drm/panel/panel-arm-versatile.c b/drivers/gpu/drm/panel/panel-arm-versatile.c index abb0788843c6..503ecea72c5e 100644 --- a/drivers/gpu/drm/panel/panel-arm-versatile.c +++ b/drivers/gpu/drm/panel/panel-arm-versatile.c @@ -267,6 +267,8 @@ static int versatile_panel_get_modes(struct drm_panel *panel, connector->display_info.bus_flags = vpanel->panel_type->bus_flags; mode = drm_mode_duplicate(connector->dev, &vpanel->panel_type->mode); + if (!mode) + return -ENOMEM; drm_mode_set_name(mode); mode->type = DRM_MODE_TYPE_DRIVER | DRM_MODE_TYPE_PREFERRED; -- 2.25.1

2 1

[PATCH openEuler-22.03-LTS-SP1 0/1] CVE-2024-36020
by Yongqiang Liu 13 Jun '24

13 Jun '24

Aleksandr Loktionov (1): i40e: fix vf may be used uninitialized in this function warning .../ethernet/intel/i40e/i40e_virtchnl_pf.c | 34 +++++++++---------- 1 file changed, 16 insertions(+), 18 deletions(-) -- 2.34.1

2 2